Ghosts for Lists: from Axiomatic to Executable Specications

Internet of Things (IoT) applications are becoming increasingly critical and require formal verifcation. Our recent work presented formal verifcation of the linked list module of Contiki, an OS for IoT. It relies on a parallel view of a linked list via a companion ghost array and uses an inductive predicate to link both views. In this work, a few interactively proved lemmas allow for the automatic verifcation of the list functions specifcations, expressed in the acsl specifcation language and proved with the Frama-C/Wp tool. In a broader verifcation context, especially as long as the whole system is not yet formally verifed, it would be very useful to use runtime verification, in particular, to test client modules that use the list module. It is not possible with the current specifcations, which include an inductive predicate and axiomatically defined functions. In this early-idea paper we show how to de ne a provably equivalent non-inductive predicate and a provably equivalent non-axiomatic function that belong to the executable subset e-acsl of acsl and can be transformed into executable C code. Finally, we propose an extension of Frama-C to handle both axiomatic specifcations for deductive veri cation and executable speci cations for runtime verifcation.