Correctness-preserving Transformations Research Articles

Correctness enhancement: a pervasive software engineering paradigm

Refinement-based correctness-preserving transformations are considered as the gold standard of program transformations. While we do not dispute the merits of transforming programs in a way that preserves their correctness, we argue that the vast majority of software engineering processes are in fact instances of correctness enhancement rather than correctness preservation. In this paper, we discuss mathematics of correctness enhancement, i.e., the process of making a program more correct than it is with respect to a specification; then we highlight in what way and to what extent correctness enhancement pervades the practice of software engineering.

Correctness enhancement: a pervasive software engineering paradigm

Refinement-based correctness-preserving transformations are considered as the gold standard of program transformations. While we do not dispute the merits of transforming programs in a way that preserves their correctness, we argue that the vast majority of software engineering processes are in fact instances of correctness enhancement rather than correctness preservation. In this paper, we discuss mathematics of correctness enhancement, i.e., the process of making a program more correct than it is with respect to a specification; then we highlight in what way and to what extent correctness enhancement pervades the practice of software engineering.

Program Derivation by Correctness Enhacements

Relative correctness is the property of a program to be more-correct than another program with respect to a given specification. Among the many properties of relative correctness, that which we found most intriguing is the property that program P' refines program P if and only if P' is more-correct than P with respect to any specification. This inspires us to reconsider program derivation by successive refinements: each step of this process mandates that we transform a program P into a program P' that refines P, i.e. P' is more-correct than P with respect to any specification. This raises the question: why should we want to make P' more-correct than P with respect to any specification, when we only have to satisfy specification R? In this paper, we discuss a process of program derivation that replaces traditional sequence of refinement-based correctness-preserving transformations starting from specification R by a sequence of relative correctness-based correctness-enhancing transformations starting from abort.

An algebraic approach to the design of compilers for object-oriented languages

Abstract In this paper we describe an algebraic approach to construct provably correct compilers for object-oriented languages; this is illustrated for programs written in a language similar to a sequential subset of Java. It includes recursive classes, inheritance, dynamic binding, recursion, type casts and test, assignment, and class-based visibility, but a copy semantics. In our approach, we tackle the problem of compiler correctness by reducing the task of compilation to that of program refinement. Compilation is identified with the reduction of a source program to a normal form that models the execution of object code. The normal form is generated by a series of correctness-preserving transformations that are proved sound from the basic laws of the language; therefore it is correct by construction. The main advantages of our approach are the characterisation of compilation within a uniform framework, where comparisons and translations between semantics are avoided, and the modularity and extensibility of the resulting compiler.

Correctness-preserving derivation of concurrent garbage collection algorithms

Constructing correct concurrent garbage collection algorithms is notoriously hard. Numerous such algorithms have been proposed, implemented, and deployed - and yet the relationship among them in terms of speed and precision is poorly understood, and the validation of one algorithm does not carry over to others.As programs with low latency requirements written in garbagecollected languages become part of society's mission-critical infrastructure, it is imperative that we raise the level of confidence in the correctness of the underlying system, and that we understand the trade-offs inherent in our algorithmic choice.In this paper we present correctness-preserving transformations that can be applied to an initial abstract concurrent garbage collection algorithm which is simpler, more precise, and easier to prove correct than algorithms used in practice--but also more expensive and with less concurrency. We then show how both pre-existing and new algorithms can be synthesized from the abstract algorithm by a series of our transformations. We relate the algorithms formally using a new definition of precision, and informally with respect to overhead and concurrency.This provides many insights about the nature of concurrent collection, allows the direct synthesis of new and useful algorithms, reduces the burden of proof to a single simple algorithm, and lays the groundwork for the automated synthesis of correct concurrent collectors.

Asynchronous system synthesis

We propose a method for synthesising a set of components from a high-level specification of the intended behaviour of the target system. The designer proceeds via correctness-preserving transformation steps towards an implementable architecture of components which communicate asynchronously. The interface model of each component specifies the communication protocol used. At each step a pre-defined component is extracted and the correctness of the step is proved. This ensures the compatibility of the components. We use Action Systems as our formal approach to system design. The method is inspired by hardware-oriented approaches with their component libraries, but is more general. We also explore the possibility of using tool support to administer the derivation, as well as to assist in correctness proofs. Here we rely on the tools supporting the B Method, as this method is closely related to Action Systems and has good tool support.

Modeling and formal verification of embedded systems based on a Petri net representation

In this paper we concentrate on aspects related to modeling and formal verification of embedded systems. First, we define a formal model of computation for embedded systems based on Petri nets that can capture important features of such systems and allows their representation at different levels of granularity. Our modeling formalism has a well-defined semantics so that it supports a precise representation of the system, the use of formal methods to verify its correctness, and the automation of different tasks along the design process. Second, we propose an approach to the problem of formal verification of embedded systems represented in our modeling formalism. We make use of model checking to prove whether certain properties, expressed as temporal logic formulas, hold with respect to the system model. We introduce a systematic procedure to translate our model into timed automata so that it is possible to use available model checking tools. We propose two strategies for improving the verification efficiency, the first by applying correctness-preserving transformations and the second by exploring the degree of parallelism characteristic to the system. Some examples, including a realistic industrial case, demonstrate the efficiency of our approach on practical applications.

A Takagi–Sugeno model with fuzzy inputs viewed from multidimensional interval analysis

Takagi–Sugeno (T–S) fuzzy systems have been successfully applied to a wide range of problems and have demonstrated significant advantages in nonlinear control. This paper presents a fuzzified T–S interpolation–approximation system mainly based on the specification of a multidimensional crisp partition that defines the corresponding local regions (multidimensional intervals) where the corresponding rules apply, the related output functions and a reduced set of global fuzzy parameters. These fuzzy parameters capture the different uncertainties of a fuzzy system: imprecision of inputs, vagueness of antecedent linguistic labels and smoothness requirements of outputs. This approach makes easier the design of a zero-order product–sum T–S system with fuzzified inputs, fuzzified antecedent crisp partition, and outputs with an additional spatial output filter. Convolution operations applied on an equalized and normalized input domain are considered to specify the corresponding fuzzification of a crisp partition. The kernels of these convolutions are even B-spline functions of order n, constructed from a n-fold convolution of an even interval characteristic function. We use a correctness-preserving transformation to simplify the output computation: a global transformation of imprecision of inputs, vagueness of antecedent terms and smoothness requirements of outputs into a set of off-line convolution operations applied to the corresponding antecedent crisp partition. By this method a fuzzified zero-order T–S system defined on a multidimensional crisp partition is directly transformed into a multidimensional spline interpolator–approximator by means of fuzzy operations and an equalization–normalization of the corresponding input domain.

Toward formally-based design of message passing programs

Presents a systematic approach to the development of message passing programs. Our programming model is SPMD, with communications restricted to collective operations: scan, reduction, gather, etc. The design process in such an architecture-independent language is based on correctness-preserving transformation rules that are provable in a formal functional framework. We develop a set of design rules for composition and decomposition. For example, scan followed by reduction is replaced by a single reduction, and global reduction is decomposed into two faster operations. The impact of the design rules on the target performance is estimated analytically and tested in machine experiments. As a case study, we design two provably correct, efficient programs using the Message Passing Interface (MPI) for the famous maximum segment sum problem, starting from an intuitive, but inefficient, algorithm specification.

The T-Ruby Design System

This paper describes the T-Ruby system for designing VLSI circuits, starting from formal specifications in which they are described in terms of relational abstractions of their behaviour. The design process involves correctness-preserving transformations based on proved equivalences between relations, together with the addition of constraints. A class of implementable relations is defined. The tool enables such relations to be simulated or translated into a circuit description in VHDL. The design process is illustrated by the derivation of a circuit for 2-dimensional convolution.

Calculational derivation of a counter with bounded response time and bounded power dissipation

A counter is calculationally designed by applying a functional way of programming, in which a machine is conceived as a function from states to behaviours. The design exploits the fine-grained concurrency available in VLSI. It is obtained by applying a series of correctness-preserving transformations on an initial design, which satisfies the functional specification but does not meet the cost/performance requirements. The transformations are purely calculational, i.e. they are based on a few simple axioms. The design is generic in that it describes counters with all possible periods. An attractive property of the design is that all these counters have the same response time as well as the same power dissipation.

The sliding-window protocol revisited

Abstract We give a correctness proof of the sliding-window protocol. Both safety and liveness properties are addressed. We show how faulty channels can be represented as nondeterministic programs. The correctness proof is given as a sequence of correctness-preserving transformations of a sequential program that satisfies the original specification, with the exception that it does not have any faulty channels. We work as long as possible with a sequential program, although the transformation steps are guided by the aim of going to a distributed program. The final transformation steps consist in distributing the actions of the sequential program over a number of processes.

Automated transformation of algorithms into register-transfer level implementations

This paper describes a high-level synthesis system, called CAMAD, for transforming algorithms into hardware implementation structures at register-transfer level. The algorithms are used to specify the behaviors of the hardware to be designed. They are first translated into a formal representation model which is based on timed Petri nets and consists of separate but related descriptions of control and data path. The formal model is used as an intermediate design representation and supports an iterative transformation approach to high-level synthesis. The basic idea is that once the behavioral specification is translated into the initial design representation, it can be viewed as a primitive implementation. Correctness-preserving transformations are then used to successively transform the initial design into an efficient implementation. Selection of transformations is guided by an optimization strategy which makes design decisions concerning operation scheduling, data path allocation, and control allocation simultaneously. The integration of these several synthesis subtasks has resulted in a better chance to reach the globally optimal solution. Experimental results show that our approach produces improved register-transfer designs, especially in the cases when the designed hardware consists of data paths and control logics that are tightly coupled.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

Introducing structure into behavioural descriptions obtained from timing diagram specifications

Communication-dominated hardware is quite naturally specified in terms of timing diagrams. By providing timing diagrams with a formal semantics in terms of a timed extension of the formal description technique LOTOS, we obtain formalized pure behavioural specifications. Hereupon we apply correctness-preserving transformations, which are initiated by the user's directives and which iteratively lead to structural specifications. These can be further compiled, eg. into VHDL code.

Systematic serialisation of array-based architectures

This paper describes the use of Ruby, a language of functions and relations, to develop serialised implementations of array-based architectures. Our Ruby expressions contain parameters which can be varied to produce a wide range of designs with different space-time trade-offs. Such expressions can be obtained by applying correctness-preserving transformations to an initial simple description. This approach provides a unified treatment of serialisation schemes similar to LPGS (Locally Parallel Globally Sequential) and LSGP (Locally Sequential Globally Parallel) partitioning methods, and will be illustrated by the development of a variety of circuits for convolution.

Pipelining and transposing heterogeneous array designs

This paper describes a scheme for representing heterogeneous array circuits, in particular those which have been optimized by pipelining or by transposition. Equations for correctness-preserving transformations of these parametric representations are presented. The method is illustrated on developing novel pipelined designs for parallel division. It is estimated that, for a field-programmable gate array implementation, the speed of an integer divider can be doubled at the expense of a 50 percent increase in area.

From operational semantics to abstract machines

We consider the problem of mechanically constructing abstract machines from operational semantics, producing intermediate-level specifications of evaluators guaranteed to be correct with respect to the operational semantics. We construct these machines by repeatedly applying correctness-preserving transformations to operational semantics until the resulting specifications have the form of abstract machines. Though not automatable in general, this approach to constructing machine implementations can be mechanized, providing machine-verified correctness proofs. As examples, we present the transformation of specifications for both call-by-name and call-by-value evaluation of the untyped λ-calculus into abstract machines that implement such evaluation strategies. We also present extensions to the call-by-value machine for a language containing constructs for recursion, conditionals, concrete data types, and built-in functions. In all cases, the correctness of the derived abstract machines follows from the (generally transparent) correctness of the initial operational semantic specification and the correctness of the transformations applied.

Transformational approach to program concretization

This paper focuses on the problem of program concretization by applying correctness-preserving transformations of annotated programs. According to the approach presented, a general-purpose program can be annotated by known information about a specific context of its applications and correctly transformed into a specialized program which is equivalent to the original one on the context-defined ranges of inputs and outputs and is better than it by quality criteria given by the context. Tools for program concretizations via annotated program transformations are considered.

Specification styles in distributed systems design and verification

Substantial experience with the use of formal specification languages in the design of distributed systems has shown that finding appropriate structures for formal specifications presents a serious, and often underestimated problem. Its solutions are of great importance for ensuring the quality of the various designs that need to be developed at different levels of abstraction along the design trajectory of a system. This paper introduces four specification styles that allow us to structure formal specifications in different ways: the monolithic, the constraint-oriented, the state-oriented, and the resource-oriented style. These styles have been selected on the basis of their suitability to express design concerns by structuring specifications and their suitability to pursue qualitative design principles such as generality, orthogonality, and open-endedness. By giving a running example, a query-answer service, in the ISO specification language LOTOS, these styles are discussed in detail. The support of verification and correctness preserving transformation by these styles is shown by verifying designs, expressed in different styles, with respect to each other. This verification is based on equational laws for (weak) bisimulation equivalence.

VLSI programming for the compact disc player

Designs are derived for three error-handling functions in the compact disc player: the first decoder in the error corrector, the interpolator and the muter. All three functions are performed by autonomous processes, which interact with their environment by communication only. The designs are derived in a transformational way, which means that the ultimate design is derived by applying a series of correctness-preserving transformations on an initial design. Initial designs are fairly direct translations of functional specifications. A functional way of programming is applied. An automaton is conceived as a function from states to behaviours (processes), where states are equivalence classes of communication histories. A program then consists of two parts: a function definition of the automaton and an application of that function to the initial state. States are very useful in the verification of program transformations, since they facilitate the definition of a function mapping the states of the transformed automaton onto the states of the original one.