A Formalization of the C99 Standard in HOL, Isabelle and Coq

Robbert Krebbers Joint work with Freek Wiedijk

Radboud University Nijmegen

July 19, 2011 @ CICM, Bertinoro, Italy The

Among the two currently most used languages:

I LangPop.com - Programming Language Popularity

I TIOBE Software - Programming Community index

Used for the smallest microcontroller to the largest supercomputer. The C99 standard

The official description issued by ANSI and ISO:

I Written in English

I No mathematically precise formalism

I Incomplete and ambiguous int *p = &x + 1, *q = &y; if (memcmp(&p, &q, sizeof(p)) == 0) { printf("%d\n", *p); }

Example

int x = 30, y = 31;

30 31

&x &y int *p = &x + 1, *q = &y; if (memcmp(&p, &q, sizeof(p)) == 0) { printf("%d\n", *p); }

Example

int x = 30, y = 31;

30 31

&x &x+1 &y if (memcmp(&p, &q, sizeof(p)) == 0) { printf("%d\n", *p); }

Example

int x = 30, y = 31; int *p = &x + 1, *q = &y;

3030 31

p q printf("%d\n", *p);

Example

int x = 30, y = 31; int *p = &x + 1, *q = &y; if (memcmp(&p, &q, sizeof(p)) == 0) {

} 3030 31

p q Example

int x = 30, y = 31; int *p = &x + 1, *q = &y; if (memcmp(&p, &q, sizeof(p)) == 0) { printf("%d\n", *p); } 3030 31

p q Example

int x = 30, y = 31; int *p = &x + 1, *q = &y; if (memcmp(&p, &q, sizeof(p)) == 0) { printf("%d\n", *p); }

Defect report #260: The implementation is permitted to use the derivation of a pointer value in determining whether or not access through that pointer is undefined behaviour, . . . The Formalin project

I May 2011 to May 2015 Isabelle/ I Create a formalization of the OL4 H HOL complete C99 standard C99 I In the theorem provers HOL4, Isabelle/HOL and Coq

I Which follow the standard closely COQ I All derived from a common master formalization (e.g. in Ott) Features

I C preprocessor

I C standard library

I Floating point arithmetic

I Casts

I Non-determinism

I Sequence points

I Alignment requirements

I Non-local control flow (goto, setjmp/longjmp, signal handling)

I volatile, restrict and const variables

I Programs in a ‘freestanding environment’ Purposes

I Utterly precise version of the standard

I Validate correctness of formal versions of subsets of C (e.g. Compcert)

I Verify correctness of verification conditions generated by tools (e.g. VCC or Frama-C) Research team

Robbert Krebbers Freek Wiedijk Herman Geuvers James McKinna

PhD student Project leader Promotor Advisor RU, The RU, The RU, The RU, The Netherlands Netherlands Netherlands Netherlands

Jean-Christophe Erik Poll Michael Norrish Andreas Lochbihler Filliˆatre

Advisor HOL advisor Isabelle advisor Coq advisor RU, The NICTA, Australia KIT, Germany CNRS, France Netherlands Related projects

I Michael Norrish. C and C++ semantics (L4.verified)

I Xavier Leroy et al. Verified C in Coq (Compcert)

I Chucky Ellison and Grigore Rosu. Executable C semantics in Maude (KCC) More information

http://ch2o.cs.ru.nl/