Deterministic Semantics Research Articles

Towards Building Verifiable CPS using Lingua Franca

Formal verification of cyber-physical systems (CPS) is challenging because it has to consider real-time and concurrency aspects that are often absent in ordinary software. Moreover, the software in CPS is often complex and low-level, making it hard to assure that a formal model of the system used for verification is a faithful representation of the actual implementation, which can undermine the value of a verification result. To address this problem, we propose a methodology for building verifiable CPS based on the principle that a formal model of the software can be derived automatically from its implementation. Our approach requires that the system implementation is specified in Lingua Franca (LF), a polyglot coordination language tailored for real-time, concurrent CPS, which we made amenable to the specification of safety properties via annotations in the code. The program structure and the deterministic semantics of LF enable automatic construction of formal axiomatic models directly from LF programs. The generated models are automatically checked using Bounded Model Checking (BMC) by the verification engine Uclid5 using the Z3 SMT solver. The proposed technique enables checking a well-defined fragment of Safety Metric Temporal Logic (Safety MTL) formulas. To ensure the completeness of BMC, we present a method to derive an upper bound on the completeness threshold of an axiomatic model based on the semantics of LF. We implement our approach in the LF V erifier and evaluate it using a benchmark suite with 22 programs sampled from real-life applications and benchmarks for Erlang, Lustre, actor-oriented languages, and RTOSes. The LF V erifier correctly checks 21 out of 22 programs automatically.

RML: Theory and practice of a domain specific language for runtime verification

• Simple, expressive, abstract Domain Specific Language for Runtime Verification. • Strict separation between instrumentation and specification to support reusability. • Portable specifications and interoperable monitors. • Full formal semantics, equational laws for optimization of generated monitors. • Compiler available with several running examples and benchmarks. Runtime verification (RV) is an approach to verification consisting in dynamically checking that the event traces generated by single runs of a system under scrutiny (SUS) are compliant with the formal specification of its expected correct behavior. RML (Runtime Monitoring Language) is a simple but powerful Domain Specific Language (DSL) for RV which is able to express non context-free properties. When designing RML, particular care has been taken to favor abstraction and simplicity, to better support reusability and portability of specifications and interoperability of the monitors generated from them; this is mainly achieved by decoupling the two problems of property specification and event generation, and by minimizing the available primitive constructs. The formalization and implementation of RML is based on a trace calculus with a fully deterministic rewriting semantics. The semantics of RML is defined by translation into such a calculus, which, in fact, is used as intermediate representation (IR) by the RML compiler. The effectiveness of RML and its methodological impact on RV are presented through interesting patterns that can be adapted to different contexts requiring verification of standard properties. A collection of tested examples is provided, together with benchmarks showing that the deterministic semantics and the performed dynamic optimizations based on the laws of the trace calculus significantly improve the performances of the generated monitors.

Semantic framework for data flow control in the network of information graphs

Abstract The mixed information stream of reliable, semi-reliable and obviously false data observed in the network is a data flow in the so-called facilitated format, the task of which is to somehow attract attention, influence the emotional sphere in the form of hype-information, which helps to make hasty decisions and harm-actions. A growing variety of forms of technological push-impact, which are successfully used for commercial purposes. Nevertheless, the study of various push-forms shows that they are based on a single semantic component that uses the offset of actual concepts to achieve the benefit of the information provider. The consumer of push services receives an apparent benefit that is far from his actual interests and intentions. A semantic computational model is proposed that captures the emerging bias of concepts. The concept of a semantic broadcasting channel is developing. The paper considers the task of constructing specialized semantic systems in the form of information graphs. The information graphs are considered as structured sets of vertices that define the method of processing information and are connected by arcs, describing the sequence of processing. In its turn, an information graph can be used as an arc, which gives hyper-graph nature to the network in the whole. The information graphs are compared with other data flow control tools. The tools for constructing transformational semantics for calculations above information graphs are offered, which assume the specialization for the class of computations associated with the vertices of the graph. A method for making an abstract computing machine with a given semantics is proposed. The paper considers an example of making an abstract machine for the case of deterministic semantics, which is illustrative for certain fragments of antimonopoly legislation.

Synthesis of Σ-Automata Specified in the First Order Logical Languages LP and LF

This paper presents methods for synthesizing Σ-automata from specifications in the language LP with deterministic semantics and in the language LF with nondeterministic semantics. These methods are based on the equivalent transformation of a formula of the form ∀tF (t) into the so-called normal form whose structure corresponds to the state transition graph of a specified Σ-automaton.

Semantics in space systems architectures

Costs, life cycles, technologies and agreements between stakeholders and organizations make space systems unique with respect to the complexity. A commonly accepted technique to address part of this complexity is to model and to maintain space systems architectures through the life cycle of their space programs. The benefits may range from supporting consistent model definitions and maintenance up to supporting analysis and verification. Space systems architectures have been modeled using UPDM (unified profile for DoDAF And MODAF; a UML profile). In fact, UPDM argues that it provides a clearer understanding of the semantics behind specific views and viewpoints. Nonetheless, while UML defines its semantics imprecisely using plain text and variation points, UPDM does not define any semantics. In this paper, we evaluate an extension of fUML (semantics of a foundational subset for executable UML models) as a semantics for space systems architectures. The extension of fUML as a synchronous language (synchronous fUML) provides a limited, but formally precise and deterministic, form to describe structure and behavior in UML. Through the combination of this semantics with UPDM, a precise language supporting a standardized meta-model emerges for the definition of space systems architectures. At the end, a simplified case study covering the operational view (OV-*) is presented. Our initial results show that synchronous fUML is able to offer a precise and deterministic semantics for UPDM.

Blame assignment for higher-order contracts with intersection and union

We present an untyped calculus of blame assignment for a higher-order contract system with two new operators: intersection and union. The specification of these operators is based on the corresponding type theoretic constructions. This connection makes intersection and union contracts their inevitable dynamic counterparts with a range of desirable properties and makes them suitable for subsequent integration in a gradual type system. A denotational specification provides the semantics of a contract in terms of two sets: a set of terms satisfying the contract and a set of contexts respecting the contract. This kind of specification for contracts is novel and interesting in its own right. A nondeterministic operational semantics serves as the specification for contract monitoring and for proving its correctness. It is complemented by a deterministic semantics that is closer to an implementation and that is connected to the nondeterministic semantics by simulation. The calculus is the formal basis of TJS, a language embedded, higher-order contract system implemented for JavaScript.

Modeling and simulation of multi-scale environmental systems with Generalized Hybrid Petri Nets

Predicting and studying the dynamics and properties of environmental systems necessitates the construction and simulation of mathematical models entailing different levels of complexities. Such type of computational experiments often require the combination of discrete and continuous variables as well as processes operating at different time scales. Furthermore, the iterative steps of constructing and analyzing environmental models might involve researchers with different background. Hybrid Petri nets may contribute in overcoming such challenges as they facilitate the implementation of systems integrating discrete and continuous dynamics. Additionally, the visual depiction of model components will inevitably help to bridge the gap between scientists with distinct expertise working on the same problem. Thus, modeling environmental systems with hybrid Petri nets enables the construction of complex processes while keeping the models comprehensible for researchers working on the same project with significantly divergent education path. In this paper we propose the utilization of a special class of hybrid Petri nets, Generalized Hybrid Petri Nets (GHPN), to model and simulate environmental systems exposing processes interacting at different time-scales. GHPN integrate stochastic and deterministic semantics as well as other types of special basic events. Moreover, a case study is presented to illustrate the use of GHPN in constructing and simulating multi-timescale environmental scenarios.

Tractability of Planning with Loops

We create a unified framework for analyzing and synthesizing plans with loops for solving problems with non-deterministic numeric effects and a limited form of partial observability. Three different action models---with deterministic, qualitative non-deterministic and Boolean non-deterministic semantics---are handled using a single abstract representation. We establish the conditions under which the correctness and termination of solutions, represented as abstract policies, can be verified. We also examine the feasibility of learning abstract policies from examples. We demonstrate our techniques on several planning problems and show that they apply to challenging real-world tasks such as doing the laundry with a PR2 robot. These results resolve a number of open questions about planning with loops and facilitate the development of new algorithms and applications.

Lumpability abstractions of rule-based systems

The induction of a signaling pathway is characterized by transient complex formation and mutual posttranslational modification of proteins. To faithfully capture this combinatorial process in a mathematical model is an important challenge in systems biology. Exploiting the limited context on which most binding and modification events are conditioned, attempts have been made to reduce the combinatorial complexity by quotienting the reachable set of molecular species into species aggregates while preserving the deterministic semantics of the thermodynamic limit. Recently, we proposed a quotienting that also preserves the stochastic semantics and that is complete in the sense that the semantics of individual species can be recovered from the aggregate semantics. In this paper, we prove that this quotienting yields a sufficient condition for weak lumpability (that is to say that the quotient system is still Markovian for a given set of initial distributions) and that it gives rise to a backward Markov bisimulation between the original and aggregated transition system (which means that the conditional probability of being in a given state in the original system knowing that we are in its equivalence class is an invariant of the system). We illustrate the framework on a case study of the epidermal growth factor (EGF)/insulin receptor crosstalk.

Lumpability Abstractions of Rule-based Systems

The induction of a signaling pathway is characterized by transient complex formation and mutual posttranslational modification of proteins. To faithfully capture this combinatorial process in a mathematical model is an important challenge in systems biology. Exploiting the limited context on which most binding and modification events are conditioned, attempts have been made to reduce the combinatorial complexity by quotienting the reachable set of molecular species, into species aggregates while preserving the deterministic semantics of the thermodynamic limit. Recently we proposed a quotienting that also preserves the stochastic semantics and that is complete in the sense that the semantics of individual species can be recovered from the aggregate semantics. In this paper we prove that this quotienting yields a sufficient condition for weak lumpability and that it gives rise to a backward Markov bisimulation between the original and aggregated transition system. We illustrate the framework on a case study of the EGF/insulin receptor crosstalk.

Implicit invocation meets safe, implicit concurrency

Writing correct and efficient concurrent programs still remains a challenge. Explicit concurrency is difficult, error prone, and creates code which is hard to maintain and debug. This type of concurrency also treats modular program design and concurrency as separate goals, where modularity often suffers. To solve these problems, we are designing a new language that we call Panini. In this paper, we focus on Panini's asynchronous, typed events which reconcile the modularity goal promoted by the implicit invocation design style with the concurrency goal of exposing potential concurrency between the execution of subjects and observers. Since modularity is improved and concurrency is implicit in Panini, programs are easier to reason about and maintain. The language incorporates a static analysis to determine potential conflicts between handlers and a dynamic analysis which uses the conflict information to determine a safe order for handler invocation. This mechanism avoids races and deadlocks entirely, yielding programs with a guaranteed deterministic semantics. To evaluate our language design and implementation we show several examples of its usage as well as an empirical study of program performance. We found that not only is developing and understanding Panini programs significantly easier compared to standard concurrent object-oriented programs, butt also performance of Panini programs is comparable to their equivalent hand-tuned versions written using Java's fork-join framework.

Falsifying Safety Properties Through Games on Over-approximating Models

Abstractions of programs are traditionally over-approximations and have proved to be useful for the verification of safety properties. They are presently perceived as being useless for the falsification of safety properties, i.e. showing that program execution definitely reaches a “bad” state. Alternative techniques, such as the computation of under-approximating must transitions, have addressed this shortcoming in the past. We show that over-approximating models can indeed falsify safety properties by relying on and exploiting the seriality and partial determinism of programs: programs don't just stop for no reason, and most program statements have deterministic semantics. Our method is based on solving a two-person attractor game derived from over-approximating models and makes no assumptions about the abstraction domain used. An example demonstrates the successful use of our approach, and highlights the role played by seriality and our handling of nondeterminism. Finally, we show that our method can encode must transitions, if supplied, by a simple modification of the ownership of nodes in the attractor game derived from the over-approximating model.

A deterministic logical semantics for pure Esterel

Esterel is a synchronous design language for the specification of reactive systems. There exist two main semantics for Esterel. On the one hand, the logical behavioral semantics provides a simple and compact formalization of the behavior of programs using SOS rules. But it does not ensure deterministic deadlock-free executions, as it may define zero, one, or many possible behaviors for a given program and input sequence. Since nondeterministic programs have to be rejected by compilers, this means that it defines behaviors for incorrect programs, which is awkward. On the other hand, the constructive semantics is deterministic (amongst other properties) but at the expense of a much more complex formalism. In this work, we build and thoroughly analyze a new deterministic semantics for Esterel that retains the simplicity of the logical behavioral semantics from which it derives. It defines, at most, one behavior per program and input sequence. We further extend this semantics with the ability to deal with errors so that incorrect programs are no longer (negatively) characterized by a lack of behavior, but (positively) by the existence of an incorrect behavior. In our view, this new semantics, with or without explicit errors, provides a better framework for formal and automated reasoning about Esterel programs.

Relational languages for metadata integration

In this article, we develop a relational algebra for metadata integration, Federated Interoperable Relational Algebra (FIRA). FIRA has many desirable properties such as compositionality, closure, a deterministic semantics, a modest complexity, support for nested queries, a subalgebra equivalent to canonical Relational Algebra (RA), and robustness under certain classes of schema evolution. Beyond this, FIRA queries are capable of producing fully dynamic output schemas, where the number of relations and/or the number of columns in relations of the output varies dynamically with the input instance. Among existing query languages for relational metadata integration, only FIRA provides generalized dynamic output schemas, where the values in any (fixed) number of input columns can determine output schemas.Further contributions of this article include development of an extended relational model for metadata integration, the Federated Relational Data Model , which is strictly downward compatible with the relational model. Additionally, we define the notion of Transformational Completeness for relational query languages and postulate FIRA as a canonical transformationally complete language. We also give a declarative, SQL-like query language that is equivalent to FIRA, called Federated Interoperable Structured Query Language (FISQL).While our main contributions are conceptual, the federated model, FISQL/FIRA, and the notion of transformational completeness nevertheless have important applications to data integration and OLAP. In addition to summarizing these applications, we illustrate the use of FIRA to optimize FISQL queries using rule-based transformations that directly parallel their canonical relational counterparts. We conclude the article with an extended discussion of related work as well as an indication of current and future work on FISQL/FIRA.

A Deterministic Logical Semantics for Esterel

Esterel is a synchronous design language for the specification of reactive systems. There exist two main semantics for Esterel. On the one hand, the logical behavioral semantics provides a simple and compact formalization of the behavior of programs using SOS rules. But it does not ensure deterministic executions for all programs and all inputs. As non-deterministic programs have to be rejected as incorrect, this means it defines behaviors for incorrect programs, which is not convenient. On the other hand, the constructive semantics is deterministic (amongst other properties) but at the expense of a much more complex formalism. In this work, we construct and thoroughly analyze a new deterministic semantics for Esterel that retains the simplicity of the logical behavioral semantics, from which it derives. In our view, it provides a much better framework for formal reasoning about Esterel programs.

Operational semantics for declarative multi-paradigm languages

Declarative multi-paradigm languages combine the most important features of functional, logic and concurrent programming. The computational model of such integrated languages is usually based on a combination of two different operational principles: narrowing and residuation. This work is motivated by the fact that a precise definition of an operational semantics including all aspects of modern multi-paradigm languages like laziness, sharing, non-determinism, equational constraints, external functions and concurrency does not exist. Therefore, in this article, we present the first rigorous operational description covering all the aforementioned features in a precise and understandable manner. We develop our operational semantics in several steps. First, we define a natural (big-step) semantics covering laziness, sharing and non-determinism. We also present an equivalent small-step semantics which additionally includes a number of practical features like equational constraints and external functions. Then, we introduce a deterministic version of the small-step semantics which makes the search strategy explicit; this is essential for profiling, tracing, debugging etc. Finally, the deterministic semantics is extended in order to cover the concurrent facilities of modern declarative multi-paradigm languages. The semantics developed provides an appropriate foundation for modeling actual declarative multi-paradigm languages like Curry. The complete operational semantics has been implemented and used with various programming tools.

An Operational Semantics for Declarative Multi-Paradigm Languages

Practical declarative multi-paradigm languages combine the main features of functional, logic and concurrent programming (e.g., laziness, sharing, higher-order, logic variables, non-determinism, search strategies). Usually, these languages also include interfaces to external functions as well as to constraint solvers. In this work, we introduce the first formal description of an operational semantics for realistic multi-paradigm languages covering all the aforementioned features in a precise and understandable manner. We also provide a deterministic version of the operational semantics which models search strategies explicitly. This deterministic semantics becomes essential to develop language-specific tools like program tracers, profilers, optimizers, etc. Finally, we extend the deterministic semantics in order to model concurrent computations. An implementation of the complete operational semantics has been undertaken.

A Space Semantics for Core Haskell

Haskell currently lacks a standard operational semantics. We argue that such a semantics should be provided to enable reasoning about operational properties of programs, to ensure that implementations guarantee certain space and time behaviour and to help determine the source of space faults. We present a small-step deterministic semantics for the sequential evaluation of Core Haskell programs and show that it is an accurate model of asymptotic space and time usage. The semantics is a formalisation of a graphical notation so it provides a useful mental model as well as a precise mathematical notation. We discuss its implications for education, programming and implementation. The basic semantics is extended with a monadic IO mechanism so that all the space under the control of an implementation is included.

Complexity and Expressive Power of Deterministic Semantics for DATALOG¬

Deterministic models are (partial) stable models which are not contradicted by any other stable model; i.e., M is a deterministic model if there is no stable model N such that M ∪ N is not an interpretation. For instanced the well-founded model, which coincides with the intersection of all partial stable models, is a deterministic model. As the well-founded model is deterministic and unique for each program, well-founded model semantics has been proposed as the canonical deterministic semantics for partial stable models. But the well-founded model is not the unique deterministic model; indeed the family of deterministic (partial stable) models is not, in general, a singleton and admits a minimum (the well-founded model) and a maximum, the max-deterministic model. The latter model is, another candidate for a deterministic semantics. The aim of this paper is to study the complexity and the expressive power of deterministic semantics. In coherence with the deterministic nature of the model, the expressive power of max-deterministic semantics is shown to be able to express problems with unique solutions, whereas the well-founded model only captures a proper subset of the queries computable in polynomial time, the so-called fixpoint queries.

The Expressive Powers of Stable Models for Bound and Unbound DATALOG Queries

Various types of stable models are known in the literature:T-stable(total stable),P-stable(partial stable, also calledthree-valued stable),M-stable(maximal stable, also known under various different names), andL-stable(least undefined stable). For each type of stable model, the paper analyzes two versions of deterministic semantics:possiblesemantics, which is based on the union of all stable models of the given type, anddefinitesemantics, which is instead based on their intersection and is like classicalcertainsemantics except that it makes no inference if no model exists. For total stable models, which are the only type of stable models whose existence is not guaranteed for every program, certain semantics is taken into account as well. The expressive powers of each type of stable model under the above versions of semantics are investigated for bothbound(i.e., ground) andunboundqueries on DATALOG programs with negation. As deterministic semantics is argued to be inappropriate for unbound queries, a non-deterministic semantics is also proposed for them and its expressive power is fully characterized as well.