{
  "slug": "crash-refinement",
  "term": "Crash refinement",
  "aliases": [],
  "definition": "Crash refinement relates an implementation to a specification by requiring crash-free equivalence and permitting no additional observable outcomes after modeled crashes and recovery.",
  "note": "Yggdrasil defines the relation from equivalent consistent states and includes recovery idempotence. Equivalence is specified, not raw disk-byte identity. [yggdrasil]\n\nIn Yxv6, validating the free-block or free-inode candidate protects allocation safety without proving that the search succeeds whenever space is available. A refinement result must be read alongside the operation's permitted failures and resource guarantees. [yggdrasil]\n\nA proof does not repair an inadequate specification or certify unverified integration code. The released artifact warns about both boundaries. [yggdrasil-artifact]",
  "status": "research",
  "advantages": [
    {
      "text": "Supports modular verification against explicit storage contracts.",
      "citationIds": [
        "yggdrasil"
      ]
    }
  ],
  "limitations": [
    {
      "text": "The research prototype assumes atomic block writes and does not verify concurrent execution.",
      "citationIds": [
        "yggdrasil"
      ]
    }
  ],
  "related": [
    "bounded-crash-testing",
    "crash-test-oracle"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "citations": [
    {
      "id": "yggdrasil",
      "title": "Sigurbjarnarson et al. Push-Button Verification of File Systems via Crash Refinement. OSDI 2016, pp. 1-16; sections 2-3, 4.2, 4.5 and 6.",
      "url": "https://unsat.cs.washington.edu/papers/sigurbjarnarson-yggdrasil.pdf",
      "accessed": "2026-10-24"
    },
    {
      "id": "yggdrasil-artifact",
      "title": "Yggdrasil authors. README: guarantees, version differences and limitations; revision e1de61d798acafb9ae2d8387d176c4b091773623.",
      "url": "https://github.com/uw-unsat/yggdrasil/blob/e1de61d798acafb9ae2d8387d176c4b091773623/README",
      "accessed": "2026-10-24"
    },
    {
      "id": "hesela",
      "title": "Hesela. Crash-consistency tests: the oracle is part of the result.",
      "url": "https://hesela.com/analyses/crash-testing-oracles-and-bounds/#crash-refinement",
      "accessed": "2026-10-24"
    }
  ],
  "updated": "2026-10-24",
  "provenance": [
    "Literature review; no theorem-prover rerun, filesystem execution or hardware validation by Hesela."
  ]
}