A High-Level Certification Language for Automatically Generated Code

Program verification using Hoare-style techniques requires many logical annotations. We have previously shown that a generic annotation inference algorithm can be used to weave in all annotations required to certify safety properties for automatically generated code. The algorithm is implemented as part of our AUTOCERT system. It uses patterns to capture generatorand property-specific code idioms and property-specific meta-program fragments to construct the annotations. It is customized by specifying the code patterns and integrating them with the meta-program fragments for annotation construction. However, the latter part has so far involved tedious and error-prone low-level term manipulations, which has made customization difficult. Here, we describe an annotation schema compiler that simplifies and largely automates this customization task. It takes a collection of high-level declarative annotation schemas tailored towards a specific code generator and safety property, and generates all glue code required for interfacing with the generic algorithm core, thus effectively creating a customized annotation inference algorithm. The compiler raises the level of abstraction and simplifies schema development and maintenance. It also takes care of some more routine aspects of formulating patterns and schemas, in particular handling of irrelevant program fragments and irrelevant variance in the program structure, which reduces the size, complexity, and number of different patterns and annotation schemas that are required. This paper further contributes to developing a declarative and generative approach to logical annotations. The improvements described here make it easier and faster to customize the system to a new safety property or a new generator. We have been able to show different properties for a variety of programs generated by our AUTOBAYES and AUTOFILTER generators. We have also applied AUTOCERT to code derived from MathWorks Real-Time Workshop, and show some initial results.