Synchronous Programming with Refinement Types

Jiawei Chen,José Luiz Vargas de Mendonça,Bereket Shimels Ayele,Bereket Ngussie Bekele,Shayan Jalili,Pranjal Sharma,Nicholas Wohlfeil,Yicheng Zhang,Jean-Baptiste Jeannin
2024-09-04
Abstract:Cyber-Physical Systems (CPS) consist of software interacting with the physical world, such as robots, vehicles, and industrial processes. CPS are frequently responsible for the safety of lives, property, or the environment, and so software correctness must be determined with a high degree of certainty. To that end, simply testing a CPS is insufficient, as its interactions with the physical world may be difficult to predict, and unsafe conditions may not be immediately obvious. Formal verification can provide stronger safety guarantees but relies on the accuracy of the verified system in representing the real system. Bringing together verification and implementation can be challenging, as languages that are typically used to implement CPS are not easy to formally verify, and languages that lend themselves well to verification often abstract away low-level implementation details. Translation between verification and implementation languages is possible, but requires additional assurances in the translation process and increases software complexity; having both in a single language is desirable. This paper presents a formalization of MARVeLus, a CPS language which combines verification and implementation. We develop a metatheory for its synchronous refinement type system and demonstrate verified synchronous programs executing on real systems.
Programming Languages
What problem does this paper attempt to address?
The problem that this paper attempts to solve is: how to develop and deploy reliable Cyber - Physical Systems (CPS) software while ensuring security. Specifically, the authors propose a language MARVeLus that combines verification and execution, aiming to solve the following problems: 1. **Limitations of testing**: Traditional testing methods are difficult to comprehensively cover all possible system and environment configurations, especially when it involves interaction with the physical world, and unsafe situations may not be immediately apparent. 2. **Challenges of formal verification**: Although formal verification can provide stronger security guarantees, mainstream programming languages are usually difficult to be formally verified because their semantics are not precise enough or not clearly defined. On the other hand, languages designed specifically for formal verification may abstract away too many underlying implementation details, resulting in the generated executable programs that cannot accurately reflect the behavior of the actual system. 3. **Complexity of conversion between verification and implementation**: Converting between verification languages and implementation languages not only increases software complexity but may also introduce new errors. Therefore, directly supporting verification and execution in a single language is an ideal choice. ### Main contributions of the paper To address the above challenges, this paper proposes the following key improvements: 1. **Formalization of MARVeLus**: Introduce more precise operational semantics, and specify types based on a subset of Linear Temporal Logic (LTL), adjust the existing type system to support the proof of type preservation. 2. **Definition and proof of the meta - theory of synchronous refinement types**: Define and prove the type safety of synchronous refinement types, ensuring that the program can verify its safety properties at compile time. 3. **Improved experimental methods**: Support dynamic obstacles (such as collision avoidance of moving vehicles), demonstrating the effectiveness of MARVeLus in practical applications. Through these improvements, MARVeLus enables developers to verify and deploy CPS software within a unified framework, thereby improving the reliability and security of the system. ### Formula examples When describing certain technical details, the paper uses mathematical formulas to express specific concepts. For example, when defining flow semantics, the following judgment symbols are used: \[ S; \sigma \vdash e \Downarrow v \rightarrow e' \] This formula indicates that in the function context \( S \) and the term context \( \sigma \), the flow \( e \) is transformed into a new flow \( e' \) and emits a value \( v \) in each clock cycle. In addition, for the definitions of state predicates and trajectory predicates, logical symbols are also used: - State predicates \( p, q \) may include: - Boolean constants: `true` or `false` - Variables: \( x \) - Equations: \( e_1 = e_2 \) - Inequalities: \( e_1 > e_2 \) - Conjunctions: \( p \land q \) - Negations: \( \neg p \) - Trajectory predicates \( \varphi, \psi \) include: - State predicates: \( p \) - “Always” operator: \( \Box \varphi \) - “Next” operator: \( \# \varphi \) - Conjunctions: \( \varphi \land \psi \) These formulas and symbols help readers more precisely understand the semantics and type system of MARVeLus.