Notion Of Correctness Research Articles

Management of Correctness Problems in UML Class Diagrams Towards a Pattern-Based Approach

UML is now widely accepted as the standard modeling language for software construction. The Class Diagram is its core view, having well formed semantics and providing the backbone for any modeling effort. Class diagrams are widely used for purposes such as software specification, database and ontology engineering, meta-modeling, and model transformation. The central role played by class diagrams emphasizes the need for strengthening UML modeling tools with features such as recognition of erroneous models and the detection of errors’ sources. Correctness of UML class diagrams refers to the capability of a diagram to denote a finite but not empty reality. This is a natural, unquestionable requirement. Nevertheless, incorrect diagrams are often designed, due to the interaction of contradicting constraints and the limitations of current tools. In this paper, the authors clarify the notion of class diagram correctness, discuss various approaches for detecting correctness problems, and propose a pattern-based approach for identifying situations in which correctness problems occur, and for providing explanations and repair advices.

Behaviour Protocols for Interacting Stateful Components

We propose a formal foundation for behaviour protocols of interacting, concurrent components with data states. Formally, behaviour protocols are given by labelled transition systems which specify the order of operation invocations as well as the allowed changes of data states of components in terms of pre- and postconditions. We study the compatibility of protocols and we consider their composition which yields a behaviour protocol for a component assembly. Behaviour protocols are equipped with a model-theoretic semantics which describes the class of all correct component or assembly implementations. Implementation models are again formalised in terms of labelled transition systems and the correctness notion is based on an alternating simulation relation between protocol and implementation which takes into account concrete control and data states. As a major result we show that our approach is compositional, i.e. that locally correct implementation models of compatible protocols compose to a globally correct implementation, thus ensuring independent implementability.

Semi-automatic derivation of timing models for WCET analysis

Embedded systems are widely used for supporting our every day life. In the area of safety-critical systems human life often depends on the system's correct behavior. Many of such systems are hard real-time systems, so that the notion of correctness not only means functional correctness. They additionally have to obey stringent timing constraints, i.e. timely task completion under all circumstances is essential. An example for such a safety-critical system is the flight control computer in an airplane, which is responsible for stability, attitude and path control. In order to derive guarantees on the timing behavior of hard real-time systems, the worst-case execution time (WCET) of each task in the system has to be determined. Saarland University and AbsInt GmbH have successfully developed the aiT WCET analyzer for computing safe upper bounds on the WCET of a task. The computation is mainly based on abstract interpretation of timing models of the processor and its periphery. Such timing models are currently hand-crafted by human experts. Therefore their implementation is a time-consuming and error-prone process. Modern processors or system controllers are automatically synthesized out of formal hardware specifications like VHDL or Verilog. Besides the system' functional behavior, such specifications provide all information needed for the creation of a timing model. But due to their size and complexity, manually examining the sources is even more complex than only looking at the processor manuals. Moreover, this would not reduce the effort nor the probability of implementation errors. To face this problem, this paper proposes a method for semi-automatically deriving suitable timing models out of formal hardware specifications in VHDL that fit to the tool chain of the aiT WCET analyzer. By this, we reduce the creation time of timing models from months to weeks.

From Boolean to quantitative notions of correctness

Classical formalizations of systems and properties are boolean: given a system and a property, the property is either true or false of the system. Correspondingly, classical methods for system analysis determine the truth value of a property, preferably giving a proof if the property is true, and a counterexample if the property is false; classical methods for system synthesis construct a system for which a property is true; classical methods for system transformation, composition, and abstraction aim to preserve the truth of properties. The boolean view is prevalent even if the system, the property, or both refer to numerical quantities, such as the times or probabilities of events. For example, a timed automaton either satisfies or violates a formula of a real-time logic; a stochastic process either satisfies or violates a formula of a probabilistic logic. The classical black-and-white view partitions the world into "correct" and "incorrect" systems, offering few nuances. In reality, of several systems that satisfy a property in the boolean sense, often some are more desirable than others, and of the many systems that violate a property, usually some are less objectionable than others. For instance, among the systems that satisfy the response property that every request be granted, we may prefer systems that grant requests quickly (the quicker, the better), or we may prefer systems that issue few unnecessary grants (the fewer, the better); and among the systems that violate the response property, we may prefer systems that serve many initial requests (the more, the better), or we may prefer systems that serve many requests in the long run (the greater the fraction of served to unserved requests, the better). Formally, while a boolean notion of correctness is given by a preorder on systems and properties, a quantitative notion of correctness is defined by a directed metric on systems and properties, where the distance between a system and a property provides a measure of "fit" or "desirability." There are many ways how such distances can be defined. In a linear-time framework, one assigns numerical values to individual behaviors before assigning values to systems and properties, which are sets of behaviors. For example, the value of a single behavior may be a discounted value, which is largely determined by a prefix of the behavior, e.g., by the number of requests that are granted before the first request that is not granted; or a limit value, which is independent of any finite prefix. A limit value may be an average, such as the average response time over an infinite sequence of requests and grants, or a supremum, such as the worst-case response time. Similarly, the value of a set of behaviors may be an extremum or an average across the values of all behaviors in the set: in this way one can measure the worst of all possible average-case response times, or the average of all possible worst-case response times, etc. Accordingly, the distance between two sets of behaviors may be defined as the worst or average difference between the values of corresponding behaviors. In summary, we propagate replacing boolean specifications for the correctness of systems with quantitative measures for the desirability of systems. In quantitative analysis, the aim is to compute the distance between a system and a property (or between two systems, or two properties); in quantitative synthesis, the objective is to construct a system that has minimal distance from a given property. Multiple quantitative measures can be prioritized (e.g., combined lexicographically into a single measure) or studied along the Pareto curve. Quantitative transformations, compositions, and abstractions of systems are useful if they allow us to bound the induced change in distance from a property. We present some initial results in some of these directions. We also give some potential applications, which not only generalize tradiditional correctness concerns in the functional, timed, and probabilistic domains, but also capture such system measures as resource use, performance, cost, reliability, and robustness.

Decentralized Prognosis of Failures in Discrete Event Systems

We study the prognosis of failures, i.e., their prediction prior to their occurrence, in discrete event systems in a decentralized setting where multiple prognosers use their local observations to issue local prognosis decisions. We define the notion of correctness of a decentralized set of prognosers in terms of ?no missed detections? (each failure is prognosed prior to its occurrence) and ?no false alarms? (an incorrect prognostic decision is never issued), and introduce the notion of <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">coprognosability</i> as an existence condition. When specialized to the centralized case (i.e., the case of a single prognoser), this condition turns out to be weaker than the one introduced by Genc and Lafortune in 2006 since a uniform bound on the number of steps within which a failure will occur is not required. For comparison, we also introduce the stronger notion of ?uniformly bounded coprognosability? and identify the subclass of decentralized prognosers for which it serves as an existence condition. We show that the two notions coincide when the underlying system and its nonfailure specification possess finite-state representations, and present a verification algorithm whose complexity is polynomial in the sizes of the system being prognosed and its nonfailure specification, and is exponential in the number of the local prognosers. We also introduce the notion of <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">reaction bound for coprognosis</i> as the earliest time beyond a prognostic decision when a failure can occur, and present an algorithm for computing it. The complexity of this algorithm is identical to that of the verification algorithm. An algorithm with complexity linear in the size of the specification and the number of local prognosers is also presented for an online prognosis of failures. We show that the notions of coprognosability and its uniformly bounded version are in general incomparable with the notion of <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">codiagnosability</i> (that guarantees a uniformly bounded delay detection of a failure by a local diagnoser). When the system cannot execute an unbounded sequence of unobservable events, uniformly bounded coprognosability implies codiagnosability, whereas coprognosability and codiagnosability remain incomparable.

Detection of corrupted schema mappings in XML data integration systems

In modern data integration scenarios, many remote data sources are located on the Web and are accessible only through forms or Web services, and no guarantee is given about their stability. In these contexts the detection of corrupted mappings, as a consequence of a change in the source or in the target schema, is a key problem. A corrupted mapping fails in matching the target or the source schema, hence it is not able to transform data conforming to a schema S into data conforming to a schema T, nor it can be used for effective query reformulation. This article describes a novel technique for maintaining schema mappings in XML data integration systems, based on a notion of mapping correctness relying on the denotational semantics of mappings.

A theory of contracts for strong service compliance

We investigate, in a process algebraic setting, a new notion of correctness for service compositions, which we callstrong service compliance: composed services are strong compliant if their composition is both deadlock and livelock free (this is the traditional notion of compliance), and whenever a message can be sent to invoke a service, it is guranteed to be ready to serve the invocation. We also define a new notion of refinement, calledstrong subcontract pre-order, suitable for strong compliance: given a composition of strong compliant services, we can replace any service with any other service in subcontract relation while preserving the overall strong compliance. Finally, we present a characterisation of the strong subcontract pre-order by resorting to the theory of a (should) testing pre-order.

Token‐Aware Completion Functions for Elastic Processor Verification

We develop a formal verification procedure to check that elastic pipelined processor designs correctly implement their instruction set architecture (ISA) specifications. The notion of correctness we use is based on refinement. Refinement proofs are based on refinement maps, which—in the context of this problem—are functions that map elastic processor states to states of the ISA specification model. Data flow in elastic architectures is complicated by the insertion of any number of buffers in any place in the design, making it hard to construct refinement maps for elastic systems in a systematic manner. We introduce token‐aware completion functions, which incorporate a mechanism to track the flow of data in elastic pipelines, as a highly automated and systematic approach to construct refinement maps. We demonstrate the efficiency of the overall verification procedure based on token‐aware completion functions using six elastic pipelined processor models based on the DLX architecture.

Looking at Laughter: Humor, Power, and Transgression in Roman Visual Culture, 100 B.C.—A.D. 250 by John R. Clarke

426 PHOENIX engaged in sporting activities) communicate about the childhood experience. Collectively, these articles illustrate how indispensable case studies of material culture are in mapping ancient childhood. Not all contributions, however, focus on archaeological or art-historical evidence. Louise Pratt's discussion centers on mythological parent-child (and pseudo-parent-child) relationshipsin Homer's Iliad thatconveyand exemplify culturally significant ideasabout personal sacrifice. In two particularly welcome contributions, Lisa Alberici, Mary Harlow, and Phyllis Katz attempt to illuminate further our rather limited picture of late antique childhood.Alberici andHarlow analyze the work ofmedical, legal,and patristic writers, from the second through seventh centuries a.d., in an effort to understand better the life course of females. They are especially interested to know what signaled a girl's transition from childhood to adulthood, and whether this transition was immediate or gradual. In classical Rome, marriage had traditionally marked this change and this belief seems to have carriedover intolateantiquity. Butwhat happenedwhen girls intheChristian community did notmarry and insteadchose to devote theirlives toChrist? How and atwhat age did theybecome adults in the eyesof thecommunity?PhyllisKatz also toucheson the life-course ofwomen in her rigorous and insightful reassessment of Jerome's letter to Laeta (Epistle107),who had soughthis adviceon the futureeducationofher infant daughter Paula. Katz argues, contrary to conventional views, that the unusual curriculum Jerome recommends demonstrates no real understanding of children's development, nor a genuine fondness for Laeta's baby daughter. Instead, it reveals his fervent desire to prepare another femalefora lifeof celibacyand servicetoChrist. Some readers will undoubtedly have reservations about the choice and treatment of the art-historical and archaeological evidence, finding it too selective to be meaningful or perhaps too controversial. Others may consider certain contributions to be more descriptive than analytical. For the most part, however, this collection has only one limitation, and thisshortcoming isone readilyacknowledgedby theeditorsthemselves: Roman childhood is not well represented here. A disproportionate number of articles focus on Greek and Aegean society from the Bronze Age to the hellenistic period, and this imbalance gives a false impression about the state of research on ancient children's history.1 In spite of this weakness, Constructions ofChildhood offers the present generation of scholars a great deal to digest, and is bound to influence, in a highly positive manner, future research on children and childhood in the ancient Mediterranean. Mount Allison University Leslie Shumka Looking at Laughter: Humor, Power, and Transgression in Roman Visual Culture, 100 b.c.-a.d. 250. By John R. Clarke. Berkeley: University of California Press. 2007. Pp. xi, 322. Most who have studied Rome have some understanding of Roman humour. But while we have a sense of what the Romans found humorous, it is a more difficult matter 1As a remedy see the collections of V. Dasen (ed.), Naissance etpetite enfance dans lAntiquite: Actes du colloque deFribourg, 28 novembre-ler decembre 2001 (Fribourg 2004) and K. Mustakallio etal. (eds.), Hoping for Continuity: Childhood, Education, and Death in Antiquity and the Middle Ages (Acta Instituti Romani Finlandiae 33; Rome 2005). BOOKREVIEWS/COMPTES RENDUS 427 to explain it.What made Romans laugh? Putting asidemodern notions of political correctness and recognizing that different strata of society will find different words and images amusing, Clarke attempts to answer that question, always taking care to explain Roman humour in a Roman social context. Clarke's study treats humour under three headings:VisualHumor (Chapters One toFour), SocialHumor (ChaptersFive toSeven), and SexualHumor (ChaptersEight toNine). The volume iswell-illustrated,including twenty-four colour plates at the end of Part 2. As one would expect, while he touches on a wide range ofmaterial, Clarke's main focus is on visual images, and those familiar with his earlier works will notice the return of some familiar "faces," for example, the hyperphallic Aethiops fromthebaths. The first chapter,"Words or Images?Degrees ofVisuality inRoman Humor," looks first at verbal humour, situating it largely within the context of the elite classes of Graeco Roman society, and emphasizing its use in political oratory. Some of the themes towhich Clarke will return throughout the study are introduced here: humour based on physical peculiarities, apotropaic laughter, and role reversal. For the last, he invokes the Saturnalia, and with that brief examination...

A Trace-Based Framework for Verifiable GALS Composition of IPs

Composing intellectual property (IP) blocks running at different clock speeds over asynchronous communication links for a system-on-chip (SoC) design is a challenging task, especially for ensuring the functional correctness of the overall design. In this paper, we propose a trace-based framework that helps in identifying a class of IPs that can be composed to ldquocorrect-by-constructionrdquo globally asynchronous locally synchronous (GALS) designs, and their correctness is maintained with respect to their synchronous compositions. Our notion of correctness is latency equivalence. Latency equivalence means that the order of valid values is same on the corresponding signals in the synchronous as well as asynchronous compositions. We also provide a description of the protocol to be inserted between the IPs to obtain this equivalence.

Review Essay: Boudon's European Diagnosis of and Prophylactic against Relativism

Raymond Boudon is the doyen of French sociology. His 2004 book The Poverty of Relativism counters the relativist plague with philosophical, historical, and comparative deconstruction and proposes an alternative: a cognitive notion of values that rehabilitates the notions of reason, correctness, and progress. More surprising is his rehabilitation of moral evolutionism that restores to it a human face. Will his efforts staunch relativism? Some considerations pro and con are offered.

Normativity and Correctness: A Reply to Hattiangadi

In this paper I will present and evaluate Anandi Hattiangadi’s arguments for the conclusion that meaning is not intrinsically normative or prescriptive. I will argue that she misconstrues the way the thesis that meaning is normative is presented in the literature and that there is an important class of semantic rules that she fails to consider and rule out. According to Hattiangadi, defenders of meaning prescriptivity argue that speaking truthfully is a necessary condition for speaking meaningfully. I will maintain that this is not how prescriptivity is construed by ‘normativists’ such as Kripke, Hacker and Baker, Brandom and Millar. I think that Hattiangadi misconstrues the prescriptivity thesis because she does not distinguish between the general notion of correctness of use and the specific notion of correctness of application. In other words, she does not distinguish between using a term correctly and applying it truthfully. In addition, I submit that there is an important class of semantic rules determining correct use that Hattiangadi does not consider. Following the later Wittgenstein, Hacker and Baker argue that accepted explanations of the meanings of words have the function of semantic rules. These rules are categorically prescriptive because following them is constitutive of being a speaker of a language.

Resource workflow nets: an approach to workflow modelling and analysis

A workflow is the automation of a business process that takes place inside one organisation. Workflow management deals with controlling, monitoring, optimising and supporting workflows. While most of the formal approaches to workflow modelling consider only the process perspective, we propose a Petri net model which integrates both the process and the resource perspective. This article introduces a special class of nested Petri nets, resource workflow nets (RWFN-nets), which unifies the two perspectives into a single model. Unlike other models, RWFN-nets permit a clear distinction between the perspectives, modelling efficiently their interaction and ensure the flexibility of the system. This article also defines a notion of behavioural correctness for RWFN-nets, soundness, and proves that this property is decidable.

The Role of Variety Recognition in Japanese University Students’ Attitudes Towards English Speech Varieties

Language attitude studies have tended to assume that informants who listen to and evaluate speech stimuli are able to identify with consistent accuracy the varieties of English in question. However, misidentification could reduce the validity of any results obtained, particularly when it involves the evaluations of non-native English-speaking informants, who are likely to have had less exposure to varieties of English speech. The present study investigated the perceptions of 558 Japanese university students of six varieties of English speech. The results indicated that whilst evaluations of speakers of UK and US English were particularly positive in terms of status, a Japanese speaker of heavily–accented English was rated most favourably in terms of social attractiveness. The findings from an additional dialect recognition question demonstrated that accurate identification had a significant positive effect upon the perceived status of native varieties of English, suggesting a tendency amongst the informants to look to native speakers to provide ‘notions of correctness’. The results also imply that Japanese learners retain representations of varieties of English speech and draw upon this resource, whether consciously or unconsciously, in order to identify and evaluate (speakers of) these speech varieties.

What is Correctness of Security Protocols?

As soon as major protocol flaws were discovered empirically — a good luck that is not older than the early 1990s — this title question came up to the world. It was soon realised that some notion of formal correctness was necessary to substantiate the confidence derived from informal analyses. But protocol correctness was born in a decade when security in general was only beginning to ferment. Security protocols aim at a large variety of goals. This is partly due to the increasing domains where the protocols are finding an application, such as secure access to local- area network services, secure e-mail, e-commerce, public-key registration at certification authorities and so on. Also, several interpretations are possible about each goal. Clearly, it is impossible to study protocol correctness profitably without a universal and unambiguous interpretation of its goals. What may be typical of security problems is that it is at least as important to state a detailed and appropriate model of threats that a secure system is meant to withstand. This has been a second and significant source of perhaps useless debates around many protocols. These are certain to be some of the reasons why dozens of papers appeared about one, now popular, protocol attack in just a few years of the second half of the last decade. One of the protocol designers firmly refused those because his protocol had been conceived within a different threat model — and perhaps for different goals — from the one that the publications had been constructed upon. It seems obvious that an ant may survive under a single sheet of paper but certainly will not under a hard-back bulky book. It should be clarified what an ant and a bulky book precisely are. With particular attention to similar issues, this position paper discusses some findings of the author's in the area of protocol formal analysis. Their significance mostly is methodical rather than specific for particular protocols. The paper then outlines the author's favourite tool, the Inductive Method, and concludes with a few open problems.

A new foundation for control dependence and slicing for modern program structures

The notion of control dependence underlies many program analysis and transformation techniques. Despite being widely used, existing definitions and approaches to calculating control dependence are difficult to apply directly to modern program structures because these make substantial use of exception processing and increasingly support reactive systems designed to run indefinitely. This article revisits foundational issues surrounding control dependence, and develops definitions and algorithms for computing several variations of control dependence that can be directly applied to modern program structures. To provide a foundation for slicing reactive systems, the article proposes a notion of slicing correctness based on weak bisimulation, and proves that some of these new definitions of control dependence generate slices that conform to this notion of correctness. This new framework of control dependence definitions, with corresponding correctness results, is even able to support programs with irreducible control flow graphs. Finally, a variety of properties show that the new definitions conservatively extend classic definitions. These new definitions and algorithms form the basis of the Indus Java slicer, a publicly available program slicer that has been implemented for full Java.

Engineering and theoretical underpinnings of retrenchment

Refinement is reviewed, highlighting in particular the distinction between its use as a specification constructor at a high level, and its use as an implementation mechanism at a low level. Some of its shortcomings as a specification constructor at high levels of abstraction are pointed out, and these are used to motivate the adoption of retrenchment for certain high level development steps. Basic properties of retrenchment are described, including a justification of the operation proof obligation, simple examples, its use in requirements engineering and model evolution, and simulation properties. The interaction of retrenchment with refinement notions of correctness is overviewed, as is a range of other technical issues. Two case study scenarios are presented. One is a simple digital redesign control theory problem, and the other is an overview of the application of retrenchment to the Mondex Purse development.

Interpreting People and Interpreting Texts

What is the relation between interpreting a person’s speech and actions, on the one hand, and interpreting a written text, on the other? That question is considered in connection with the theories of interpretation offered by Donald Davidson and Paul Ricoeur. There are some important similarities between those theories. However, it is argued that Davidson and Ricoeur are divided on fundamental questions about the relation between meaning and intention, about the reference of texts, about the relation between the meanings of texts and the meanings of spoken words, and about the notion of correctness that applies to interpretation. On each of these points, it is contended, Davidson has the better of the dispute.

Formalization of the Equivalent Transformation Computation Model

In the equivalent transformation (ET) computation model, a specification provides background knowledge in a problem domain and defines a set of queries of interest. A program is a set of prioritized transformation rules, and computation consists in successive reduction of queries using meaning-preserving transformation with respect to given background knowledge. We present a formalization of the ET model from the viewpoint of program synthesis, where not only computation but also program correctness and correctness relations are of central importance. The notion of program correctness defines “what it means for a program to be correct with respect to a specification,” and a correctness relation provides guidance on “how to obtain such a program.” The correctness relation of the ET model is established, based on which how the basic structure of the ET model facilitates program synthesis is discussed together with program synthesis strategies in this model.

Linguistic ideology in Spains ivory tower: (Not) Analyzing Catalan Spanish

This paper examines the Spanish of Catalonia and the treatment it has received in the professional literature on linguistics written in Spain in the late 20th century. I argue that hegemonic linguistic ideologies relating to notions of linguistic correctness (Woolard and Schieffelin 1994) within Spanish academia have led to a lack of recognition of the Spanish of Catalonia as a legitimate dialect of Spanish. Such language ideologies are revealed through discourse analysis of several influential academic texts in Spanish linguistics of the late 20th century. Works from the Spanish linguistics 'canon' (such as Zamora Vicente 1989) and the few investigations actually written in Spain about the Spanish of Catalonia (such as Badia 1980) are considered in light of the cultural, political, linguistic, and geographic contexts in which they were written. In the late 20th century, Spanish academics repeatedly analyzed the stereotypical Spanish of Catalonia in terms of linguistic interference and prescriptive errors. In addition to consideration of the ideologies guiding such research, my paper presents an alternative analysis in which the innovative linguistic forms that actually appear in an oral corpus of Spanish spoken in Barcelona are seen not as deviant but rather as potential carriers of sociolinguistic and cultural significance. I conclude that for contact dialects of Spanish associated with ethnic minorities to be scientifically investigated in Spain, they must first be recognized as legitimate in the academic literature. Such recognition depends on a reinterpretation of the body of doctrine that continues to guide academic discourse in Spain and the devices that maintain its operation. The professional 'overlooking' of the Spanish of Catalonia in descriptions of Spanish dialectology and sociolinguistics in Spain continues to be a matter of power relations and larger socioeconomic, sociohistoric, and sociopolitical processes.