SPARK: Formally verify an ordered set/map library in SPARK

AdaCore: Helping Developers Build Software that Matters
Everything we do at AdaCore is centered around helping developers build safe, secure and reliable software.

For 30 years, we've partnered with global leaders in aerospace & defense, air traffic management, space, railway and financial services. We've developed tools and services simplifying high-integrity software development through a subscription-based model. As demand for secure applications grows in industries like automotive, medical, energy, and IoT, we're adapting our proven technologies to assist a new generation of developers.
Our +190 global experts based in the US, France, Germany, the UK, and Estonia, collectively develop cutting-edge technologies to address the challenges of high-grade software development.
Joining AdaCore is about joining a culture of innovation, openness, collaboration and dependability, which defines how we work together, with our customers and partners.

Context

SPARK is a subset of the Ada programming language, together with formal verification tools that provide mathematical guarantees for SPARK programs, ranging from correct data flows to the absence of runtime errors to the correct implementation of functional requirements. SPARK is open source and freely available to the Community on Alire, an Ada package manager, and is professionally supported by AdaCore, which co-develops SPARK with Inria.

The SPARK toolset includes a library called SPARKlib. It provides several standard utilities compatible with the SPARK subset, in particular bounded and unbounded containers (lists, vectors, sets, and maps). These libraries are not, in general, formally verified using SPARK, however. In the past few months, the SPARK team has launched an effort to verify as many of these libraries as possible. The goals are both to increase confidence in the library's correctness and to improve the SPARK tool itself by using it on real codebases.

Goals 

The goal of this internship is to verify, using the SPARK tool, the implementation of packages from the SPARKlib, in particular the ordered set and map libraries, which are based on red-black trees. The data structure is complex, so the main goal is to prove the absence of runtime exceptions (array index out of bounds…) even if more complex properties could be attempted later. To manage the library’s complexity and size, the intern will use AI-assisted verification. This verification work is, at the time of writing of this internship subject, at the limit of what the models used by AdaCore can achieve. This is an opportunity to push the boundaries of current model capabilities and requires careful oversight. 

Skills required/nice to have:

• A good understanding of logic and formal methods
• Some experience with a tool for proof of programs - Frama-C, SPARK, Key, Why3, Rocq...
• Knowledge of Ada is a plus

Timeframe & Location
During 2027 - 6 months - Toulouse office

Beyond the job

We're a global organization driven by diverse backgrounds, fostering innovation through an open exchange of ideas. We welcome applicants of all backgrounds, celebrating diversity in ethnicity, nationality, gender, age, religion, abilities, sexual orientation, veteran or marital status. 
Our commitment is to help our teammates, wherever they are based, feel comfortable and satisfied, by encouraging flexibility to ensure them a healthy work-life balance. Additionally, we prioritize individual development by offering continuous training from day one with a personalized onboarding plan.

For more information about our recruitment process, visit our FAQ.