A formal semantics of C with applications

This paper describes an executable formal semantics of C expressed using a formalism based on term rewriting. Being executable, the semantics has been thoroughly tested against the GCC torture test suite and successfully passes over 96% of 715 test programs. It is the most complete and thoroughly tested formal definition of C to date. The semantics yields an interpreter, debugger, and state space search tool “for free”. The semantics is shown capable of automatically finding program errors, both statically and at runtime. It is also used to enumerate nondeterministic behavior. These techniques together allow the tool to identify undefined programs. The entire C semantics is included as Appendix B.

[1]  Grigore Rosu,et al.  A Rewriting Logic Approach to Static Checking of Units of Measurement in C , 2012, RULE.

[2]  Simon Peyton Jones,et al.  A static semantics for Haskell , 1992 .

[3]  Benjamin Monate,et al.  A Value Analysis for C Programs , 2009, 2009 Ninth IEEE International Working Conference on Source Code Analysis and Manipulation.

[4]  Hisashi Sasaki.  A formal semantics for Verilog-VHDL simulation interoperability by abstract state machine , 1999, DATE '99.

[5]  Xavier Leroy,et al.  Mechanized Semantics for the Clight Subset of the C Language , 2009, Journal of Automated Reasoning.

[6]  Paolo Arcaini,et al.  CoMA: Conformance Monitoring of Java Programs by Abstract State Machines , 2011, RV.

[7]  J. Meseguer,et al.  Rewriting Logic as a Logical and Semantic Framework , 1996 .

[8]  Sophia Drossopoulou,et al.  Java Type Soundness Revisited , 2000 .

[9]  Uwe F. Pleban.  Compiler prototyping using formal semantics , 1984, SIGPLAN '84.

[10]  George C. Necula,et al.  CIL: Intermediate Language and Tools for Analysis and Transformation of C Programs , 2002, CC.

[11]  José Meseguer,et al.  A formal executable semantics of Verilog , 2010, Eighth ACM/IEEE International Conference on Formal Methods and Models for Codesign (MEMOCODE 2010).

[12]  Arie van Deursen,et al.  The ASF+SDF Meta-environment: A Component-Based Language Development Environment , 2001 .

[13]  Gérard Ferrand,et al.  An operational formal definition of PROLOG: a specification method and its application , 1992, New Generation Computing.

[14]  Elvinia Riccobene,et al.  A Modeling and Executable Language for Designing and Prototyping Service-Oriented Applications , 2011, 2011 37th EUROMICRO Conference on Software Engineering and Advanced Applications.

[15]  Egon Börger,et al.  A high-level modular definition of the semantics of C# , 2005, Theor. Comput. Sci..

[16]  David Broman,et al.  Formal Semantics Based Translator Generation and Tool Development in Practice , 2009, 2009 Australian Software Engineering Conference.

[17]  Jim Alves-Foss,et al.  Dynamic Denotational Semantics of Java , 1999, Formal Syntax and Semantics of Java.

[18]  Steven S. Muchnick,et al.  Advanced Compiler Design and Implementation , 1997 .

[19]  Karl-Filip Faxén,et al.  A static semantics for Haskell , 2002, Journal of Functional Programming.

[20]  Savi Maharaj,et al.  Studying the ML Module System in Hol , 1994, TPHOLs.

[21]  Nicholas Nethercote,et al.  Valgrind: a framework for heavyweight dynamic binary instrumentation , 2007, PLDI '07.

[22]  Robin Milner,et al.  Definition of standard ML , 1990 .

[23]  Adrián Riesco,et al.  A Complete Declarative Debugger for Maude , 2010, AMAST.

[24]  Suresh Jagannathan,et al.  Relaxed-memory concurrency and verified compilation , 2011, POPL '11.

[25]  José Meseguer,et al.  The Maude LTL Model Checker , 2004, WRLA.

[26]  Mitchell Wand,et al.  Essentials of programming languages , 2008 .

[27]  Charles Wallace,et al.  The semantics of the C++ programming language , 1995, Specification and validation methods.

[28]  Tom Ridge,et al.  Ott: effective tool support for the working semanticist , 2007, ICFP '07.

[29]  Grigore Rosu,et al.  K: A Rewriting-Based Framework for Computations -- Preliminary version -- , 2007 .

[30]  Derek M. Jones.  The New C Standard An Economic and Cultural Commentary , 2004 .

[31]  Viljem Zumer,et al.  Compiler/interpreter generator system LISA , 2000, Proceedings of the 33rd Annual Hawaii International Conference on System Sciences.

[32]  Grigore Rosu,et al.  An Executable Rewriting Logic Semantics of K-Scheme , 2007 .

[33]  José Meseguer,et al.  Mapping Modular SOS to Rewriting Logic , 2002, LOPSTR.

[34]  Christian Urban,et al.  alpha-Prolog: A Logic Programming Language with Names, Binding and a-Equivalence , 2004, ICLP.

[35]  Sophia Drossopoulou,et al.  Describing the Semantics of Java and Proving Type Soundness , 1999, Formal Syntax and Semantics of Java.

[36]  R. Kent Dybvig,et al.  Revised6 Report on the Algorithmic Language Scheme , 2009 .

[37]  Irina Mariuca Asavoae,et al.  Collecting Semantics under Predicate Abstraction in the K Framework , 2010, WRLA.

[38]  Bradley C. Kuszmaul,et al.  Cilk: an efficient multithreaded runtime system , 1995, PPOPP '95.

[39]  Yuri Gurevich,et al.  The Semantics of the C Programming Language , 1992, CSL.

[40]  José Meseguer,et al.  Conditioned Rewriting Logic as a United Model of Concurrency , 1992, Theor. Comput. Sci..

[41]  Xuejun Yang,et al.  Testing Static Analyzers with Randomly Generated Programs , 2012, NASA Formal Methods.

[42]  Fabricio Chalub,et al.  Maude MSOS Tool , 2007, WRLA.

[43]  S TraianFlorin.  A Rewriting Logic Approach to Operational Semantics , 2010 .

[44]  Xavier Leroy,et al.  Formal verification of a realistic compiler , 2009, CACM.

[45]  Chucky Ellison,et al.  An executable formal semantics of C with applications , 2011, POPL '12.

[46]  José Meseguer,et al.  The Rewriting Logic Semantics Project , 2006, SOS@ICALP.

[47]  Gordon J. Pace,et al.  Formal reasoning with Verilog HDL , 1998 .

[48]  Brian W. Kernighan,et al.  The C Programming Language , 1978 .

[49]  José Meseguer,et al.  Algebraic Semantics of the C Preprocessor and Correctness of its Refactorings , 2006 .

[50]  Guy L. Steele,et al.  The Java Language Specification , 1996 .

[51]  Michael Mehlich.  CheckPointer - A C Memory Access Validator , 2011, 2011 IEEE 11th International Working Conference on Source Code Analysis and Manipulation.

[52]  Matthias Felleisen,et al.  Semantics Engineering with PLT Redex , 2009 .

[53]  Paul E. Black.  Axiomatic semantics verification of a secure web server , 1998 .

[54]  Jürgen Giesl,et al.  A Linear Operational Semantics for Termination and Complexity Analysis of ISO Prolog , 2011, LOPSTR.

[55]  Yuri Gurevich,et al.  Evolving algebras 1993: Lipari guide , 1995, Specification and validation methods.

[56]  John Regehr,et al.  Understanding integer overflow in C/C++ , 2012, ICSE 2012.

[57]  Mario Wolczko,et al.  Semantics of Smalltalk-80 , 1987, ECOOP.

[58]  S. Doaitse Swierstra,et al.  Ruler: Programming Type Rules , 2006, FLOPS.

[59]  Grigore Rosu,et al.  A rewriting approach to concurrent programming language design and semantics , 2010 .

[60]  Horatiu Jula,et al.  An Executable Specification of C++ , 2005, Abstract State Machines.

[61]  Lasse R. Nielsen,et al.  Refocusing in Reduction Semantics , 2004 .

[62]  David B. MacQueen,et al.  The Definition of Standard ML (Revised) , 1997 .

[63]  Nikolaos S. Papaspyrou.  Denotational semantics of ANSI C , 2001, Comput. Stand. Interfaces.

[64]  Grigore Rosu,et al.  KOOL: An Application of Rewriting Logic to Language Prototyping and Analysis , 2007, RTA.

[65]  Sam Tobin-Hochstadt,et al.  Run your research: on the effectiveness of lightweight mechanization , 2012, POPL '12.

[66]  Jade Alglave,et al.  Synchronising C/C++ and POWER , 2012, PLDI.

[67]  Gilles Kahn,et al.  Natural Semantics , 1987, STACS.

[68]  Peter Sewell,et al.  Clarifying and compiling C/C++ concurrency: from C++11 to POWER , 2012, POPL '12.

[69]  Derek J. Andrews,et al.  The Formal Definition of Modula-2 and Its Associated Interpreter , 1988, VDM Europe.

[70]  Kristina Lundqvist,et al.  The TASM Toolset: Specification, Simulation, and Formal Verification of Real-Time Systems , 2007, CAV.

[71]  Grigore Rosu,et al.  An overview of the K semantic framework , 2010, J. Log. Algebraic Methods Program..

[72]  Claude Marché,et al.  The Why/Krakatoa/Caduceus Platform for Deductive Program Verification , 2007, CAV.

[73]  José Meseguer,et al.  A rewriting logic approach to operational semantics , 2009, Inf. Comput..

[74]  Michael Norrish.  C formalised in HOL , 1998 .

[75]  Guy L. Steele,et al.  Java(TM) Language Specification, The (3rd Edition) (Java (Addison-Wesley)) , 2005 .

[76]  José Meseguer,et al.  Formal Analysis of Java Programs in JavaFAN , 2004, CAV.

[77]  Grigore Rosu,et al.  Matching logic: a new program verification approach (NIER track) , 2011, 2011 33rd International Conference on Software Engineering (ICSE).

[78]  Dan Grossman,et al.  A theory of platform-dependent low-level software , 2008, POPL '08.

[79]  Gordon D. Plotkin,et al.  The origins of structural operational semantics , 2004, J. Log. Algebraic Methods Program..

[80]  Matthias Anlauff,et al.  XASM - An Extensible, Component-Based ASM Language , 2000, Abstract State Machines.

[81]  Elsa L. Gunter,et al.  Hol-ml , 1993, HUG.

[82]  Nikolaos Papaspyrou,et al.  A Formal Semantics for the C Programming Language , 2000 .

[83]  Grigore Rosu,et al.  Towards a Unified Theory of Operational and Axiomatic Semantics , 2012, ICALP.

[84]  R. Kent Dybvig,et al.  Revised5 Report on the Algorithmic Language Scheme , 1986, SIGP.

[85]  Grigore Rosu,et al.  From Hoare Logic to Matching Logic Reachability , 2012, FM.

[86]  Dragan Macos,et al.  A study of evaluation order semantics in expressions with side effects , 2000, J. Funct. Program..

[87]  Axel Dold,et al.  A Framework for Modeling the Semantics of Expression Evaluation with Abstract State Machines , 2003, Abstract State Machines.

[88]  Matthias Felleisen,et al.  A Visual Environment for Developing Context-Sensitive Term Rewriting Systems , 2004, RTA.

[89]  Christoph Beierle,et al.  Defining Standard Prolog in Rewriting Logic , 2000, WRLA.

[90]  Grigore Rosu,et al.  K-Maude: A Rewriting Based Tool for Semantics of Programming Languages , 2010, WRLA.

[91]  Paul Klint,et al.  Compiling language definitions: the ASF+SDF compiler , 2000, TOPL.

[92]  Claude Marché,et al.  Multi-prover Verification of C Programs , 2004, ICFEM.

[93]  James K. Huggins,et al.  An ASM Dynamic Semantics for Standard ML , 2000, Abstract State Machines.

[94]  José Meseguer,et al.  The Rewriting Logic Semantics Project: A Progress Report , 2011, FCT.

[95]  Michael Norrish.  A formal semantics for c , 2007 .

[96]  Patrick Borras,et al.  Centaur: the system , 1988, Software Development Environments.

[97]  Matthew R. Lakin.  An executable meta-language for inductive definitions with binders , 2010 .

[98]  Christopher W. Fraser,et al.  A Retargetable C Compiler: Design and Implementation , 1995 .

[99]  Julien Signoles,et al.  Experience report: OCaml for an industrial-strength static analysis framework , 2009, ICFP.

[100]  Egon Börger,et al.  Java and the Java Virtual Machine: Definition, Verification, Validation , 2001 .

[101]  Xuejun Yang,et al.  Finding and understanding bugs in C compilers , 2011, PLDI '11.

[102]  Angelo Gargantini,et al.  Model-Driven Language Engineering: The ASMETA Case Study , 2008, 2008 The Third International Conference on Software Engineering Advances.

[103]  Grigore Rosu,et al.  Runtime Verification of C Memory Safety , 2009, RV.

[104]  Dorel Lucanu,et al.  The K Primer (version 2.5) , 2012 .

[105]  Chucky Ellison,et al.  A Rewriting Logic Approach to Type Inference , 2009, WADT.

[106]  Roozbeh Farahbod,et al.  CoreASM: An Extensible ASM Execution Engine , 2007, Fundam. Informaticae.

[107]  Matthew Might.  Abstract Interpreters for Free , 2010, SAS.

[108]  Narciso Martí-Oliet,et al.  Maude: specification and programming in rewriting logic , 2002, Theor. Comput. Sci..

[109]  Wolfram Schulte,et al.  Semantic essence of AsmL , 2005, Theor. Comput. Sci..

[110]  Chucky Ellison,et al.  Matching Logic: An Alternative to Hoare/Floyd Logic , 2010, AMAST.

[111]  Grigore Rosu,et al.  A K Definition of Scheme , 2007 .

[112]  Egon Börger,et al.  A Mathematical Definition of Full Prolog , 1995, Sci. Comput. Program..

[113]  Egon Börger,et al.  A Programmer Friendly Modular Definition of the Semantics of Java , 1999, Formal Syntax and Semantics of Java.

[114]  Milo M. K. Martin,et al.  Formalizing the LLVM intermediate representation for verified program transformations , 2012, POPL '12.

[115]  Robert S. Boyer,et al.  A computational logic handbook , 1979, Perspectives in computing.

[116]  Peter Sewell,et al.  Mathematizing C++ concurrency , 2011, POPL '11.

[117]  Peter D. Mosses,et al.  Modular structural operational semantics , 2004, J. Log. Algebraic Methods Program..

[118]  Xuejun Yang,et al.  Test-case reduction for C compiler bugs , 2012, PLDI.