Verifying Transformation Rules of the HATS High- Assurance Transformation System: An Approach

In high-consequence systems, there is a high cost associated with failure. Thus, there should be strong evidence that the systems will not fail in the field. Such evidence cannot be obtained by traditional verification methods such as testing. Transformation-oriented programming (TOP) is a promising formal software development technique. In TOP, a source file that represents a correct formal specification is continuously refined to produce an implementation. The High-Assurance Transformation System (HATS) is an example of TOP that takes as input a source file and a transformation language program (TLP) which represents a sequence of actions to be applied to the source file. HATS users express these actions as a sequence of transformation rules and control strategies. HATS has been used to develop an application for a high-consequence system, namely the Sandia Secure Processor (SSP). The application is the SSP-classloader in which a source file (class file) is incrementally refined through five canonical forms until it becomes a ROM image that will be executed by the SSP hardware. In this paper, we introduce an approach to proving the correctness of the TLPs that produce the five canonical forms using ACL2. Our goal is to verify that a TLP that produces a canonical form preserves the semantics of a class file. To achieve this goal, a semantic function that describes the behavior of the TLP must be identified. We have successfully built a simplified model of the TLP that produces the first canonical form, developed a semantic function for this model, and proved that the model preserves the semantic of the class file.