#Framac

Tutilurenn@mastodon.nu
2024-05-05

I started looking at ACSL in Frama-C. Looks promising, although a bit complex at first.

I wonder if I can convey it to output its proofs in some readable format for archiving. And it would be swell with some test report or so. Perhaps also a non-zero return code so that it becomes more easily integrated in a regression test CI/CD pipeline.

#FramaC #ACSL

"The current verification tool for #ACSL is #FramaC. It also implements a sister language, ANSI/ISO C++ Specification Language (ACSL++), defined for C++."

https://en.wikipedia.org/wiki/ANSI/ISO_C_Specification_Language

last time I checked, C++ was left out, only C was supported — times have changed?

now I wonder where #Rust is in the process — there seems to be an ongoing work but nothing that would stand out yet

for #Ada there is #SPARK

https://en.wikipedia.org/wiki/SPARK_(programming_language)

and #PSL is actually independent from the HDLs, can be added on top of VHDL, SV, or Synthesizable #SystemC as well, though the implementations are uncertain

https://en.wikipedia.org/wiki/Property_Specification_Language

p.s. #Accelera good, IEEE bad
naive random thought: #FramaC and the like should not need human interaction and be able to always check automatically that the post-conditions follow from pre-conditions -- it's proof checking (the C code is the proof term), not search (for which there may be no generic algorithm)
well actually no: this proof term (C code) is only concerned with the explicit arguments (passed as C function arguments) and ignores the implicit hypotheses (pre-conditions); what's more important is that this function returns only the C value and not Cartesian product (dependent sum) of it with the post-conditions
the dependence of the post-conditions on the pre-conditions, the C function arguments, and the result is yet to be constructed, e.g.

forall x, A x -> exists y, B x y

A x is the pre-condition, B x y is the post-condition, x is input argument, and y is the result of C function

y_t f (x_t x) { ... }

f alone isn't enough to build a term of type B x y

to be even more specific, let x_t and y_t be uint8_t, f be increment by one, A x be x < 255, and B x y be x < y
Vivien, cyberconcombregugurumbe@mastouille.fr
2023-07-17
2023-01-11

Glad to see #FramaC get a shout out from #AdaCore. #C is one language with tooling for using solvers to prove correctness. Glad to see competition here. They’re moving the whole industry forward.

adacore.com/uploads/technical-

2019-12-20

#FramaC WP just threw at me that #ACSL lambdas are not supported yet. How the hell am i supposed to use \numof ?! #framacWP #formalmethods

I have time to figure it out till Dec30

2019-05-29

It's of course ”with Frama-C” and let me add a few tags: #FramaC #FormalMethods #DeductiveVerification

2019-03-31
Messing around with #Frama-C again. Managed to prove that a gcd() function actually has the property that there is no number greater than the return value which divides both arguments. Or in ACSL parlance: ensures ! (\exists integer x; x > \result && a % x == 0 && b % x == 0)
2018-11-21
I wrote a blog post about my recent experiences with #Frama-C, a tool for doing formal verification of C code. Check it out: http://www.härdin.se/blog/2018/11/20/trying-out-frama-c/
2018-07-02
Tried implementing some basic string manipulation functions in #frama-c today. Specifically, strlcpy() and my own strlen(). Quite tricky. But I did learn one can take a gander at /usr/share/frama-c/libc/string.h to get some ideas for more ACSL to decorate one's contracts with. #langsec

Client Info

Server: https://mastodon.social
Version: 2025.04
Repository: https://github.com/cyevgeniy/lmst