Auxiliary Assertions Research Articles

Algorithms for Constructing Isolating Sets of Phase Flows and Computer-Assisted Proofs with the Use of Interval Taylor Models

This work continues the research devoted to considering interval Taylor models (TM) as applied to proving the existence of periodic trajectories in systems of ordinary differential equations (ODEs). The Taylor models are used here within a topological approach to constructing an isolating set for the ODE phase flow. We prove auxiliary assertions and propose constructive algorithms for validated numerics over TMs with the aim to expand the domain of their applicability. Necessary topological assertions are proved in order to establish the properties of isolating sets constructed with the aid of TMs. As a result, constructive algorithms are formulated and the main theorem is proved. This theorem makes it possible to construct and verify the homotopy equivalence of the isolating set and the one-dimensional sphere and the homotopy of the mapping of the isolating set into itself to the identity mapping for given systems of ODEs. We also prove the computational complexity of the main algorithm and provide an example of its usage.

Compositional certified resource bounds

This paper presents a new approach for automatically deriving worst-case resource bounds for C programs. The described technique combines ideas from amortized analysis and abstract interpretation in a unified framework to address four challenges for state-of-the-art techniques: compositionality, user interaction, generation of proof certificates, and scalability. Compositionality is achieved by incorporating the potential method of amortized analysis. It enables the derivation of global whole-program bounds with local derivation rules by naturally tracking size changes of variables in sequenced loops and function calls. The resource consumption of functions is described abstractly and a function call can be analyzed without access to the function body. User interaction is supported with a new mechanism that clearly separates qualitative and quantitative verification. A user can guide the analysis to derive complex non-linear bounds by using auxiliary variables and assertions. The assertions are separately proved using established qualitative techniques such as abstract interpretation or Hoare logic. Proof certificates are automatically generated from the local derivation rules. A soundness proof of the derivation system with respect to a formal cost semantics guarantees the validity of the certificates. Scalability is attained by an efficient reduction of bound inference to a linear optimization problem that can be solved by off-the-shelf LP solvers. The analysis framework is implemented in the publicly-available tool C4B. An experimental evaluation demonstrates the advantages of the new technique with a comparison of C4B with existing tools on challenging micro benchmarks and the analysis of more than 2900 lines of C code from the cBench benchmark suite.

Synthesizing software verifiers from proof rules

Automatically generated tools can significantly improve programmer productivity. For example, parsers and dataflow analyzers can be automatically generated from declarative specifications in the form of grammars, which tremendously simplifies the task of implementing a compiler. In this paper, we present a method for the automatic synthesis of software verification tools. Our synthesis procedure takes as input a description of the employed proof rule, e.g., program safety checking via inductive invariants, and produces a tool that automatically discovers the auxiliary assertions required by the proof rule, e.g., inductive loop invariants and procedure summaries. We rely on a (standard) representation of proof rules using recursive equations over the auxiliary assertions. The discovery of auxiliary assertions, i.e., solving the equations, is based on an iterative process that extrapolates solutions obtained for finitary unrollings of equations. We show how our method synthesizes automatic safety and liveness verifiers for programs with procedures, multi-threaded programs, and functional programs. Our experimental comparison of the resulting verifiers with existing state-of-the-art verification tools confirms the practicality of the approach.

Correct blame for contracts

Behavioral software contracts supplement interface information with logical assertions. A rigorous enforcement of contracts provides useful feedback to developers if it signals contract violations as soon as they occur and if it assigns blame to violators with preciseexplanations. Correct blame assignment gets programmers started with the debugging process and can significantly decrease the time needed to discover and fix bugs. Sadly the literature on contracts lacks a framework for making statements about the correctness of blame assignment and for validating such statements. This paper fills the gap and uses the framework to demonstrate how one of the proposed semantics for higher-order contracts satisfies this criteria and another semantics occasionally assigns blame to the wrong module. Concretely, the paper applies the framework to the lax enforcement of dependent higher-order contracts and the picky one. A higher-order dependent contract specifies constraints for the domain and range of higher-order functions and also relates arguments and results in auxiliary assertions. The picky semantics ensures that the use of arguments in the auxiliary assertion satisfies the domain contracts and the lax one does not. While the picky semantics discovers more contract violations than the lax one, it occasionally blames the wrong module. Hence the paper also introduces a third semantics, dubbed indy , which fixes the problems of the picky semantics without giving up its advantages.

On the completeness of compositional reasoning methods

Hardware systems and reactive software systems can be described as the composition of several concurrently active processes. Automated reasoning based on model checking algorithms can substantially increase confidence in the overall reliability of a system. Direct methods for model checking a concurrent composition, however, usually suffer from the explosion in the number of program states that arises from concurrency. Reasoning compositionally about individual processes helps mitigate this problem. A number of rules have been proposed for compositional reasoning, typically based on an assume-guarantee reasoning paradigm. Reasoning with these rules can be delicate, as some are syntactically circular in nature, in that assumptions and guarantees are mutually dependent. This is known to be a source of unsoundness. In this article, we investigate rules for compositional reasoning from the viewpoint of completeness . We show that several rules are incomplete: that is, there are properties whose validity cannot be established using (only) these rules. We derive a new, circular, reasoning rule and show it to be sound and complete. We show that the auxiliary assertions needed for completeness need be defined only on the interface of the component processes. We also show that the two main paradigms of circular and noncircular reasoning are closely related, in that a proof of one type can be transformed in a straightforward manner to one of the other type. These results give some insight into the applicability of compositional reasoning methods.

Global solvability of the equations of one-dimensional nonisothermic motion of a two-phase mixture. I. Statement of the problem and auxiliary assertions

The parabolic regularization is considered of the problem of one-dimensional motion of two interpenetrative viscous incompressible fluids. Some estimates of solutions are obtained that are uniform with respect to the regularization parameter on every finite time interval.

Property-directed incremental invariant generation

Abstract A fundamental method of analyzing a system such as a program or a circuit is invariance analysis, in which one proves that an assertion holds on all reachable states. Typically, the proof is performed via induction; however, an assertion, while invariant, may not be inductive (provable via induction). Invariant generation procedures construct auxiliary inductive assertions for strengthening the assertion to be inductive. We describe a general method of generating invariants that is incremental and property-directed. Rather than generating one large auxiliary inductive assertion, our method generates many simple assertions, each of which is inductive relative to those generated before it. Incremental generation is amenable to parallelization. Our method is also property-directed in that it generates inductive assertions that are relevant for strengthening the given assertion. We describe two instances of our method: a procedure for generating clausal invariants of finite-state systems and a procedure for generating affine inequalities of numerical infinite-state systems. We provide evidence that our method scales to checking safety properties of some large finite-state systems.

Model checking and abstraction to the aid of parameterized systems (a survey)

Parameterized systems are systems that involve numerous instantiations of the same finite-state module, and depend on a parameter which defines their size. Examples of parameterized systems include sensor systems, telecommunication protocols, bus protocols, cache coherence protocols, and many other protocols that underly current state-of-the-art systems. Formal verification of parameterized systems is known to be undecidable (Inform. Process. Lett. 22 (6)) and thus cannot be automated. Recent research has shown that it is often the case that a combination of methodologies allows to reduce the problem of verification of a parameterized system into the problem of verification of a finite-state system, that can be automatically verified. This paper describes several recent methodologies, based on model checking and abstraction. We start with the method of invisible auxiliary assertions that combines a small-model theorem with heuristics to automatically generate auxiliary constructs used in proofs of correctness of parameterized systems. We also describe the method of counter abstraction that offers simple liveness proofs for many parameterized systems, and discuss novel methodologies of using counter abstraction to automatically verify that probabilistic parameterized system satisfy their temporal specifications with probability 1.

Automatic generation of state invariants from requirements specifications

Automatic generation of state invariants, properties that hold in every reachable state of a state machine model, can be valuable in software development. Not only can such invariants be presented to system users for validation, in addition, they can be used as auxiliary assertions in proving other invariants. This paper describes an algorithm for the automatic generation of state invariants that, in contrast to most other such algorithms, which operate on programs, derives invariants from requirements specifications. Generating invariants from requirements specifications rather than programs has two advantages: 1) because requirements specifications, unlike programs, are at a high level of abstraction, generation of and analysis using such invariants is easier, and 2) using invariants to detect errors during the requirements phase is considerably more cost-effective than using invariants later in software development. To illustrate the algorithm, we use it to generate state invariants from requirements specifications of an automobile cruise control system and a simple control system for a nuclear plant. The invariants are derived from specifications expressed in the SCR (Software Cost Reduction) tabular notation.

Automatic generation of invariants and intermediate assertions

Verifying temporal specifications of reactive and concurrent systems commonly relies on generating auxiliary assertions and on strengthening given properties of the system. This can be achieved by two dual approaches: The bottom-up method performs an abstract forward propagation (computation) of the system, generating auxiliary assertions; the top-down method performs an abstract backward propagation to strengthen given properties. Exact application of these methods is complete but is usually infeasible for large-scale verification. Approximation techniques are often needed to complete the verification. We give an overview of known methods for generation of auxiliary invariants in the verification of invariance properties. We extend these methods, by formalizing and analyzing a general verification rule that uses assertion graphs to generate auxiliary assertions for the verification of general safety properties.

On the logic of UNITY

The UNITY approach to specification, design, and verification of parallel programs expounded by Chandy and Misra (1988) contains a programming notation, and a programming logic to express and prove properties of UNITY programs. For progress properties there is a basic notion leads-to, which comes in two versions. One version — here called leads-to — explicitly expresses progress of fair execution sequences of a UNITY program. Another prima facie stronger version — here called ↦ — is defined by infinitary closure conditions from the more elementary notion ensures. This version is used in the actual proofs of program properties given in (Chandy and Misra, 1988). In this paper these notions are investigated from a foundational point of view. A principle of transfinite induction for ↦ is introduced, and it is proved that every true leads-to proposition can be obtained by application of one single instance of this principle. Semantic completeness of ↦ w.r.t. its intended semantics leads-to is a corollary. Aspects of the complexity and computational power of UNITY are analyzed. The halting problem for fair executions of UNITY programs is shown to be Π 1 1-complete, and it is proved that a nondeterministic numerical function is computable by a UNITY program if and only if its graph is ∑ 1 1 and its halting set is a Π 1 1-subset of its domain. In order to retain completeness of the principle of transfinite induction for ↦, arbitrarily large recursive ordinals are needed as heights of well-founded relations. A formalized finitary proof system for ↦ is introduced and proved syntactically correct and complete relative to the set of true Π 1 1-sentences of a second-order assertion language. More precisely, the well-founded relation itself and the auxiliary assertions used can be expressed in a first-order language. It is only the hypothesis of well-foundedness, which has to be expressed by a Π 1 1 formula. In view of the Π 1 1-completeness phenomenon, this result is best possible.

Totally umbilical submanifolds inG(2,n). II

This paper is a continuation of "Totally umbilical submanifolds inG (2,n). I" [Ukrain. Geom. Sb., No. 34 22–46 (1991)]. Auxiliary and differential-geometric assertions for the classification of the mentioned submanifolds are proved.

MEASURABLE STRATEGIES IN DIFFERENTIAL GAMES

Nonlinear approach-evasion differential games are considered in which the initial data depend on the time. These games are investigated in the class of strategies that are functions of three variables, namely, the time, the phase variable, and the current value of the other player's control, and are measurable jointly with respect to the time and the phase variable. The ideas of the Pontryagin methods in differential games and Krasovskiĭ's ideas on extremal aiming are developed, and it is shown that measurable strategies have broad applicability. It is proved that measurable strategies are compatible with differential equations with discontinuous right-hand side, and general theorems on the existence of solving measurable strategies in approach-evasion problems are proved, along with some auxiliary assertions. It is shown that the saddle point condition in the small game ensures the existence of solving measurable strategies. An example is given. Bibliography: 14 titles.

How good can a nonhereditary family be?

A family of vectors of a Hilbert space H is said to be hereditarily complete, if it has biorthogonal\(\mathfrak{X}'\) (minimally) and any element of H can be reconstructed from its Fourier series:. In this paper we describe all pairs of spaces A, B, which contain minimal mutually biorthogonal and complete families\(\mathfrak{X}, \mathfrak{X}' ( V\left( \mathfrak{X} \right) = A, V\left( {\mathfrak{X}'} \right) = B\) and: for this it is necessary and sufficient that the operator PAPBPA not be completely continuous. This assertion allows one to prove that: 1) if dn > 0,, then there exist an orthonormal basis {ϕn}v⩾1 and complete but not hereditarily complete biorthogonal families\(\mathfrak{X}, \mathfrak{X}'\) in H, such that ∥ Xn-ϕn∥⩽dn, ∥x′n-ϕn∥⩽ dr, (n⩾1), 2) if, then there exist families of the type described in the preceding assertion for which, where σ is any finite set of natural numbers and is the spectral projector corresponding to it. One of the auxiliary assertions is the description of all real collections α=(αk)n k=1, representable in the form, where q is a Hilbert seminorm defined in the Euclidean space En, {fk)n k=1 is a suitable orthonormal basis. This set is the convex hull of all permutations of the eigenvalues (λ1, ..., λn) of the seminorm q.