Algebraic Specification Research Articles

Reasoning about logical systems in the Coq proof assistant

The theory of institutions provides an abstract mathematical framework for specifying logical systems and their semantic relationships. Institutions are based on category theory and have deep roots in a well-developed branch of algebraic specification. However, there are no machine-assisted proofs of correctness for institution-theoretic constructions—chiefly satisfaction conditions for institutions and their (co)morphisms—making them difficult to incorporate into mainstream formal methods. This paper therefore provides the details of our approach to formalizing a fragment of the theory of institutions in the Coq proof assistant. We instantiate this framework with the institutions FOPEQ for first-order predicate logic and EVT for the Event-B specification language, and define some institution-independent constructions, all of which serve as an illustration and evaluation of the overall approach.

Transport Layer Security 1.0 handshake protocol formal verification case study: How to use a proof script generator for existing large proof scores.

The Transport Layer Security (TLS) 1.0 protocol has been formally verified with CafeInMaude Proof Generator (CiMPG) and Proof Assistant (CiMPA), where CafeInMaude is the second major implementation of CafeOBJ, a direct successor of OBJ3, a canonical algebraic specification language. The properties concerned are the secrecy property of pre-master secrets and the correspondence (or authentication) property from both server and client points of view. We need to use several lemmas to formally verify that TLS 1.0 enjoys the properties. CiMPG takes proof scores written in CafeOBJ and infers proof scripts that can be checked by CiMPA. Proof scores are prone to human errors and CiMPG can be regarded as a proof score checker in that if the proof scripts inferred by CiMPG from proof scores are successfully executed with CiMPA, it is guaranteed that no human error is lurking in the proof scores. We have used the existing proof scores to show that TLS 1.0 enjoys the two properties. We needed to revise the proof scores so that CiMPG can handle them. Through the revision process, we discovered that one additional lemma is required for the revised proof scores. There are about 20 proof scores and each proof score is large. It is not reasonable to handle all proof scores at the same time with CiMPG. Thus, we handled each proof score one by one with CiMPG. There is one proof score that it took a long time to handle with CiMPG. For that proof score, we handled each induction case one by one to reduce the time taken. We describe how to revise the existing proof scores, how to find the new lemma, the lemma, how to handle each proof score one by one, and how to handle each induction case one by one as tips on checking existing large proof scores with CiMPG and CiMPA.

Advances of proof scores in CafeOBJ

Critical flaws continue to exist at the level of domain, requirement, and/or design specification, and specification verification (i.e., to check whether a specification has desirable properties) is still one of the most important challenges in software/system engineering. CafeOBJ is an executable algebraic specification language system and domain/requirement/design engineers can write proof scores for improving quality of specifications by the specification verification. This paper describes advances of the proof scores for the specification verification in CafeOBJ.

Revisiting Language Support for Generic Programming: When Genericity Is a Core Design Goal

Context: Generic programming, as defined by Stepanov, is a methodology for writing efficient and reusable algorithms by considering only the required properties of their underlying data types and operations. Generic programming has proven to be an effective means of constructing libraries of reusable software components in languages that support it. Generics-related language design choices play a major role in how conducive generic programming is in practice. Inquiry: Several mainstream programming languages (e.g. Java and C++) were first created without generics; features to support generic programming were added later, gradually. Much of the existing literature on supporting generic programming focuses thus on retrofitting generic programming into existing languages and identifying related implementation challenges. Is the programming experience significantly better, or different when programming with a language designed for generic programming without limitations from prior language design choices? Approach: We examine Magnolia, a language designed to embody generic programming. Magnolia is representative of an approach to language design rooted in algebraic specifications. We repeat a well-known experiment, where we put Magnolia's generic programming facilities under scrutiny by implementing a subset of the Boost Graph Library, and reflect on our development experience. Knowledge: We discover that the idioms identified as key features for supporting Stepanov-style generic programming in the previous studies and work on the topic do not tell a full story. We clarify which of them are more of a means to an end, rather than fundamental features for supporting generic programming. Based on the development experience with Magnolia, we identify variadics as an additional key feature for generic programming and point out limitations and challenges of genericity by property. Grounding: Our work uses a well-known framework for evaluating the generic programming facilities of a language from the literature to evaluate the algebraic approach through Magnolia, and we draw comparisons with well-known programming languages. Importance: This work gives a fresh perspective on generic programming, and clarifies what are fundamental language properties and their trade-offs when considering supporting Stepanov-style generic programming. The understanding of how to set the ground for generic programming will inform future language design.

Partial arithmetical data types of rational numbers and their equational specification

Upon adding division to the operations of a field we obtain a meadow. It is conventional to view division in a field as a partial function, which complicates considerably its algebra and logic. But partiality is one out of a plurality of possible design decisions regarding division. Upon adding a partial division function ÷ to a field Q of rational numbers we obtain a partial meadow Q(÷) of rational numbers that qualifies as a data type. Partial data types bring problems for specifying and programming that have led to complicated algebraic and logical theories – unlike total data types. We discuss four different ways of providing an algebraic specification of this important arithmetical partial data type Q(÷) via the algebraic specification of a closely related total data type. We argue that the specification method that uses a common meadow of rational numbers as the total algebra is the most attractive and useful among these four options. We then analyse the problem of equality between expressions in partial data types by examining seven notions of equality that arise from our methods alone. Finally, based on the laws of common meadows, we present an equational calculus for working with fracterms that is of general interest outside programming theory.

Totalising Partial Algebras

We will examine totalising a partial operation in a general algebra by using an absorbtive element, bottom, such as an error flag. We then focus on the simplest example of a partial operation, namely subtraction on the natural numbers: n - m is undefined whenever n < m. We examine the use of bottom in algebraic structures for the natural numbers, especially semigroups and semirings. We axiomatise this totalisation process and introduce the algebraic concept of a team, being an additive cancellative semigroup with totalised subtraction. Also, with the natural numbers in mind, we introduce the property of being generated by an iterative function, which we call a splinter. We prove a number of theorems about the algebraic specification of datatypes of natural numbers.

Formal Verification of Multitask Hybrid Systems by the OTS/CafeOBJ Method

Hybrid systems combine both continuous and discrete behaviors, which occur frequently in safety-critical applications in various domains including Internet-of-Things (IoT) and Cyber-Physical Systems (CPS) applications such as health care, transportation, and robotics. For safe and reliable information society with IoT and CPS technologies, it is important to establish a way to specify and verify hybrid systems formally. Formal descriptions of hybrid systems may help us to verify desired properties of a given system formally with computer supports. We propose a way to describe a formal specification of a given multitask hybrid system as an observational transition system (OTS) in CafeOBJ algebraic specification language. OTSs are models where systems behaviors are described through observations. CafeOBJ supports specification execution based on a rewrite theory. We verify that OTS/CafeOBJ specifications of hybrid systems satisfy desired property by the proof score method based on equational reasoning implemented in CafeOBJ interpreter. In this paper, we specify a signal control system with an arbitrary number of vehicles by our proposed method, and verify the system satisfies a safety property by the proof score method.

A process algebraic mutation framework with application to a vehicle charging protocol

Modern day renewable and smart energy systems are increasingly playing an important role in our societies. Electric vehicle charging services infrastructures are becoming ever more popular and accessible, although at a pace that we argue is not well understood yet in terms of the reliability and security of this new paradigm. Often solutions are rolled out to the market with little or no analysis of their resilience and even at the standards level, specifications of systems and protocol often omit or skim over the question of reliability. In this paper, we propose a new formal approach for analysing the effects of single failures on process algebraic specifications used often in specifying communication protocols. We apply this new approach to one part of an international standard protocol, the Open Charge Point Protocol, for electric vehicle charging, and demonstrate how the effects of specification faults can impact the safety and security of the protocol.

Algebraic Specification for Input-Output in Abstract Data Types

Data Types (ADT) are used when creating software systems, in the systems design. Usually we use algebraic specification to specify the operations in a data type. The use of data types is a methodology or style of working which yields improved design when followed. In this paper we study the addition of input-output operations to the algebraic specification of operations over a data type. The motivation is that input-output operations are used in actual implementations. A specification with input-output is more complete than one without it. We need input-output operations in our programs. This justifies the addition of such operations to the specification. We consider the definition of input-output operations in functional programming in particular in Haskell. Our input-output specifications are not exactly equal to Haskell programs although some of them are likely. We specify input-output operations in a form likely to the specification of the other operations. The result is the algebraic specification of the input-output operations for many frequently used data types. The language considered is sufficiently expressive to model all these operations. The technique is illustrated by means of a variety of examples. We started from sequences, continued with sets and finish with dictionaries. The specifications we present in this paper can be used as specifications of methods of ADT definitions in object oriented programing.

Most General Algebraic Specifications for an Abstract Datatype of Rational Numbers

The notion of a most general algebraic specification of an arithmetical datatype of characteristic zero is introduced.Three examples of such specifications are given. A preference is formulated for a specification by means of infinitely many equations which can be presented via a finite number of so-called schematic equations phrased in terms of an infinite signature. On the basis of the latter specification three topics are discussed: (i) fracterm decomposition operators and the numerator paradox, (ii) foundational specifications of arithmetical datatypes, and (iii) poly-infix operations.

The simple essence of algebraic subtyping: principal type inference with subtyping made easy (functional pearl)

MLsub extends traditional Hindley-Milner type inference with subtyping while preserving compact principal types, an exciting new development. However, its specification in terms of biunification is difficult to understand, relying on the new concepts of bisubstitution and polar types, and making use of advanced notions from abstract algebra. In this paper, we show that these are in fact not essential to understanding the mechanisms at play in MLsub. We propose an alternative algorithm called Simple-sub, which can be implemented efficiently in under 500 lines of code (including parsing, simplification, and pretty-printing), looks more familiar, and is easier to understand. We present an experimental evaluation of Simple-sub against MLsub on a million randomly-generated well-scoped expressions, showing that the two systems agree. The mutable automaton-based implementation of MLsub is quite far from its algebraic specification, leaving a lot of space for errors; in fact, our evaluation uncovered several bugs in it. We sketch more straightforward soundness and completeness arguments for Simple-sub, based on a syntactic specification of the type system. This paper is meant to be light in formalism, rich in insights, and easy to consume for prospective designers of new type systems and programming languages. In particular, no abstract algebra is inflicted on readers.

A programming guide for tensor networks with global [formula omitted] symmetry

This paper is a manual with tips and tricks for programming tensor network algorithms with global SU(2) symmetry. We focus on practical details that are many times overlooked when it comes to implementing the basic building blocks of codes, such as useful data structures to store the tensors, practical ways of manipulating them, and adapting typical functions for symmetric tensors. Here we do not restrict ourselves to any specific tensor network method, but keep always in mind that the implementation should scale well for simulations of higher-dimensional systems using, e.g., Projected Entangled Pair States, where tensors with many indices may show up. To this end, the structural tensors (or intertwiners) that arise in the usual decomposition of SU(2)-symmetric tensors are never explicitly stored throughout the simulation. Instead, we store and manipulate the corresponding fusion trees – an algebraic specification of the symmetry constraints on the tensor – in order to implement basic SU(2)-symmetric tensor operations. This fusion tree approach is readily extensible to anyonic systems, as we demonstrate for a chain of Fibonacci anyons.

Formal Modelling of FHIR Based, Medical Data Exchange Using Algebraic Petri Nets.

Enabling interoperability is a challenging task in medical data exchange and is often addressed by the use of versatile communication standards like HL7 FHIR. Although daily routine and scientific experiences show its suitability, the use comes with major risks regarding safety and security of data. To overcome these problems, we present an approach to enable a formal verification of medical communication use cases. We identified the Neonatal Screening as a practical example in which two process participants (physician and screening laboratory) are involved. We analyzed the FHIR specification as well as identified necessary resources in that context and formally modeled them as algebraic specifications. By that, we were able to represent the participants' behavior and data flow with help of Algebraic Petri Nets. This strategy allows to formally verify the correctness of a system by specified requirements regarding data safety and data security.

Arithmetical Datatypes, Fracterms, and the Fraction Definition Problem

Datatypes and abstract datatypes are positioned as results of importing aspects of universal algebra into computer science and software engineering. It is suggested that 50 years later, by way of a transfer in the opposite direction, outcomes of research on datatypes can be made available via elementary arithmetic. This idea leads to the notions of an arithmetical signature, an arithmetical datatype and an arithmetical abstract datatype and to algebraic specifications for such entities. The area of fractions in elementary arithmetic is chosen as an application area and while taking a common meadow of rational numbers as the basis, an arithmetical datatype equipped with an absorptive element. The use of datatypes and signatures makes syntax available for giving precise definitions in cases where lack of precision is common place. Fracterm is coined as the name for a fraction when primarily understood as a syntactic entity. The main contribution of the paper is to provide a detailed terminology of fracterms. Subsequently the fraction definition problem is stated, a distinction between explicit definitions of fractions and implicit definitions of fractions is made, and an outline of a survey of both forms of definitions of the notion of a fraction is given.

Specifying with syntactic theory functors

We propose a framework, syntactic theory functors (STFs), for creating syntactic structuring mechanisms for specification languages. Good support for common reuse patterns is important for systematically developing specifications for large systems. Though immaterial to foundational theory, lack of support otherwise causes lengthy writing of boilerplate code or repeated adaptation from one context to another.We present STFs in the context of the Goguen & Burstall institution theory. This theory captures the essential structure of ontologies, modelling and formal specifications (OMS). In particular it provides powerful structuring mechanisms that are independent of the specification formalism, i.e., they are institution-independent.The presented STF framework is institution-independent as well. As such it encompasses many approaches to software and information systems. STFs subsume the standard institution-independent structuring mechanisms, and open up new ways of reusing existing and structuring new specifications. In this, STFs subsume and enrich the tool-set of ‘good practices’, which includes separation of concerns, ease of reuse of specification-text, and improved theorem proving support. STFs are aimed at structuring and reuse beyond the classical mechanisms.However, most STFs are institution-specific and support specific reuse patterns in that institution. With such institution-specific STFs it is possible to incrementally grow more complex institutions from simpler ones. This is very much needed when developing ontologies or specification languages for a new domain.In this paper, we motivate STFs with examples in Casl, the common standard algebraic specification language. We further demonstrate how STFs can ease specification through capturing repeated constructions once and for all as patterns formulated as STFs.

Program synthesis with algebraic library specifications

A key challenge in program synthesis is synthesizing programs that use libraries, which most real-world software does. The current state of the art is to model libraries with mock library implementations that perform the same function in a simpler way. However, mocks may still be large and complex, and must include many implementation details, both of which could limit synthesis performance. To address this problem, we introduce JLibSketch, a Java program synthesis tool that allows library behavior to be described with algebraic specifications, which are rewrite rules for sequences of method calls, e.g., encryption followed by decryption (with the same key) is the identity. JLibSketch implements rewrite rules by compiling JLibSketch problems into problems for the Sketch program synthesis tool. More specifically, after compilation, library calls are represented by abstract data types (ADTs), and rewrite rules manipulate those ADTs. We formalize compilation and prove it sound and complete if the rewrite rules are ordered and non-unifiable. We evaluated JLibSketch by using it to synthesize nine programs that use libraries from three domains: data structures, cryptography, and file systems. We found that algebraic specifications are, on average, about half the size of mocks. We also found that algebraic specifications perform better than mocks on seven of the nine programs, sometimes significantly so, and perform equally well on the last two programs. Thus, we believe that JLibSketch takes an important step toward synthesis of programs that use libraries.

Dual Number Meadows

The class of dual number meadows is introduced. By definition this class is a quasivariety. Dual number meadows contain a non-zero element the square of which is zero. These structures are non-involutive and coregular. Some properties of the equational theory of dual number meadows are discussed and an initial algebra specification is given for the minimal dual number meadow of characteristic zero which contains the dual rational numbers. Several open problems are stated.

Model Checking Based Approach for Compliance Checking


 
 
 Process mining is the set of techniques to retrieve a process model starting from available logging data. The discovered process model has to be analyzed to verify it respects the defined properties, i.e., the so-called compliance checking. Our aim is to use a model checking based approach to verify compliance. First, we propose an integrated-tool approach using existing tools as ProM (a framework supporting process mining techniques) and CADP (a formal verification environment). More precisely, the execution traces from a software system are extracted. Then, using the “Mine Transition System” plugin in ProM, we obtain a labelled transition system, that can be easily used to verify formal properties trough CADP. However, this choice presents the “state explosion” problem, i.e., models discovered through the classical process mining techniques tend to be large and complex. In order to solve this problem, another custom-made approach is shown, which accomplishes a pre- processing on the traces to obtain abstract traces, where abstraction is based on the set of temporal logic formulae specifying the system properties. Then, from the set of abstracted traces, we discover a system described in Lotos, a process algebra specification language; in this way we do not build an operational model for the system, but we produce only a language description from which a model checking environment will automatically obtain the reduced corresponding transition system. Real systems have been used as case studies to evaluate the proposed methodologies.
 
 

A Software Development Model for the Automatic Generation of Classes


 
 
 In this paper it is presented a software development model based on transformations that allows to derive, in an automatic way, classes in object-oriented programming languages (Ada 95, C++, Eiffel and Java) starting from formal specifications. The set of transformations that conforms the software development model are a systematic steps, which starts from the algebraic specification of a type. This algebraic specification describes the abstract behavior of a type (type of interest) by means of other type, previously specified and implemented (representation type). In a progressive way, the transformations steps allow get a program (class) nearby to the initial specification (type of interest). These transformations obtain -in the first step- an intermediate specification (class specification) that it describes the operations of the type of interest by means of pre and post-conditions. Then, the intermediate specification is used to obtain imperative code in language-independent notation (pseudo-class); and finally the pseudo-class is transformed to any object- oriented programming language for which it has been defined transformations.
 
 

Slicing from formal semantics: Chisel—a tool for generic program slicing

We describe Chisel, a tool that synthesizes a program slicer directly from a given algebraic specification of a programming language operational semantics \(\mathcal {S}\). \(\mathcal {S}\) is assumed to be a rewriting logic specification, given in Maude, while the program is a ground term of this specification. Chisel takes \(\mathcal {S}\) and synthesizes language constructs, i.e., instructions, that produce features relevant for slicing, e.g., data dependency. We implement syntheses adjusted to each feature as model checking properties over an abstract representation of \(\mathcal {S}\). The syntheses results are used by a traditional interprocedural slicing algorithm that we parameterize by the synthesized language features. We present the tool on two language paradigms: high-level, imperative and low-level, assembly languages. Computing program slices for these languages allows for extracting traceability properties in standard compilation chains and makes our tool fitting for the validation of embedded system designs. Chisel’s slicing benchmark evaluation is based on benchmarks used in avionics.