Operational Semantics Research Articles

Review

Review

A PRACTICAL MODEL FROM MULTIDIMENSIONAL LAYERING: PERSONAL FINANCE INFORMATION FRAMEWORK USING MOBILE SOFTWARE INTERFACE OPERATIONS

End user involvement is crucial in improving software development processes. Hence, nowadays user interface (UI) and user experience (UX) are particularly concerned with end user interactions in many software designs as most methodologies have inconsistencies between design and implementation. Besides, it is relatively difficult to make changes in complex software and personal finance application is one of the more complex software to design, develop, and adapt. This paper proposes the development of a mobile personal finance application using informative multidimensional layering. We have separated functional data cutting across the relationships of three categories and datasets showing operational semantics of dimensions, and combined layers of three-dimensional information including aspect elements through components. This study is concerned with the corresponsive composition of end user features using visual interfaces. It is illustrated in a Three-layer User Interface Composition Model to transfer and compose layers, functional data, aspect elements, and components to Graphical User Interfaces (GUIs). Therefore, an integrated view of the software system would make the design and implementation consistent to support our framework in a more straightforward manner. There have been a few studies which presented practical models of mobile informative multidimensional layering. This research applied aspect orientation and informative multidimensional layering to present a better features model for mobile personal finance application. We deliver a practical framework in the application in all four phases of analysis, design, implementation, and evaluation. In addressing the gap, this research proposes a clearer operation of three-dimensional models, functional data, and aspect elements that cut across through informative multidimensional layering.

TEST SCENARIO SPECIFICATION LANGUAGE FOR MODEL-BASED TESTING

In mission critical systems a single failure might cause catastrophic consequences. This sets high expectations to timely detection of design faults and runtime failures. By traditional software testing methods the detection of deeply nested faults that occur sporadically is almost impossible. The discovery of such bugs can be facilitated by generating well-targeted test cases where the test scenario is explicitly specified. On the other hand, the excess of implementation details in manually crafted test scripts makes it hard to understand and to interpret the test results. This paper defines high-level test scenario specification language TDLTP for specifying complex test scenarios that are relevant for model-based testing of mission critical systems. The syntax and semantics of TDLTP operators are defined and the transformation rules that map its declarative expressions to executable Uppaal Timed Automata test models are specified. The scalability of the method is demonstrated on the TUT100 satellite software integration testing case study.

Operational Semantics of Annotated Reflex Programs

Reflex is a process-oriented language that provides a design of easy-to-maintain control software for programmable logic controllers. The language has been successfully used in a several reliability critical control systems, e. g. control software for a silicon single crystal growth furnace and electronic equipment control system. Currently, the main goal of the Reflex language project is to develop formal verification methods for Reflex programs in order to guarantee increased reliability of the software created on its basis. The paper presents the formal operational semantics of Reflex programs extended by annotations describing the formal specification of software requirements as a necessary basis for the application of such methods. A brief overview of the Reflex language is given and a simple example of its use – a control program for a hand dryer – is provided. The concepts of environment and variables shared with the environment are defined that allows to disengage from specific input/output ports. Types of annotations that specify restrictions on the values of the variables at program launch, restrictions on the environment (in particular, on the control object), invariants of the control cycle, pre- and postconditions of external functions used in Reflex programs are defined. Annotated Reflex also uses standard annotations assume, assert and havoc. The operational semantics of the annotated Reflex programs uses the global clock as well as the local clocks of separate processes, the time of which is measured in the number of iterations of the control cycle, to simulate time constraints on the execution of processes at certain states. It stores a complete history of changes of the values of shared variables for a more precise description of the time properties of the program and its environment. Semantics takes into account the infinity of the program execution cycle, the logic of process transition management from state to state and the interaction of processes with each other and with the environment. Extending the formal operational semantics of the Reflex language to annotations simplifies the proof of the correctness of the transformation approach to deductive verification of Reflex programs developed by the authors, transforming an annotated Reflex program to an annotated program in a very limited subset of the C language, by reducing a complex proof of preserving the truth of program requirements during the transformation to a simpler proof of equivalence of the original and the resulting annotated programs with respect to their operational semantics.

Interaction trees: representing recursive and impure programs in Coq

Interaction trees (ITrees) are a general-purpose data structure for representing the behaviors of recursive programs that interact with their environments. A coinductive variant of “free monads,” ITrees are built out of uninterpreted events and their continuations. They support compositional construction of interpreters from event handlers , which give meaning to events by defining their semantics as monadic actions. ITrees are expressive enough to represent impure and potentially nonterminating, mutually recursive computations, while admitting a rich equational theory of equivalence up to weak bisimulation. In contrast to other approaches such as relationally specified operational semantics, ITrees are executable via code extraction, making them suitable for debugging, testing, and implementing software artifacts that are amenable to formal verification. We have implemented ITrees and their associated theory as a Coq library, mechanizing classic domain- and category-theoretic results about program semantics, iteration, monadic structures, and equational reasoning. Although the internals of the library rely heavily on coinductive proofs, the interface hides these details so that clients can use and reason about ITrees without explicit use of Coq’s coinduction tactics. To showcase the utility of our theory, we prove the termination-sensitive correctness of a compiler from a simple imperative source language to an assembly-like target whose meanings are given in an ITree-based denotational semantics. Unlike previous results using operational techniques, our bisimulation proof follows straightforwardly by structural induction and elementary rewriting via an equational theory of combinators for control-flow graphs.

Composition modeling for manufacturing resource cloud service

The lack of semantic information of description model and quality of service (QoS) constraints in manufacturing resource cloud service (MRCS) has caused problems such as uneven distribution, small sharing scope and low standardization of manufacturing resources. The paper studies composition modeling of MRCS for this problem. Firstly, a modeling method for MRCS based on semantic extension is proposed. The formalization method is used to classify manufacturing resources, and the 6-layer semantic information of function, interface, execution, state, QoS and physical-virtual resource mapping is attached to the MRCS, and a data model based on eXtensible Markup Language and a semantic model based on ontology are constructed. Then a composition method for MRCS with multi-constraint of QoS is proposed. A composition framework and process for cloud services with multi-constraint of QoS is planned. A planning method based on hierarchical task network (HTN) is used to decompose manufacturing tasks into atomic tasks. The manufacturing task is decomposed into atomic tasks and used as service requirements by a planning method based on HTN, and multiple independent and related cloud services are composed into a new cloud service according to application needs through interface semantic matching. The attribute weight of the scheme for MRCS is comprehensively calculated based on quality function deployment. The composite cloud service corresponding to each atomic task is used as an independent component service, and the interface semantic matching operation is repeated according to the workflow of the atomic task to form a complete composite cloud service with more powerful functions to realize the manufacturing task.

A simple differentiable programming language

Automatic differentiation plays a prominent role in scientific computing and in modern machine learning, often in the context of powerful programming systems. The relation of the various embodiments of automatic differentiation to the mathematical notion of derivative is not always entirely clear---discrepancies can arise, sometimes inadvertently. In order to study automatic differentiation in such programming contexts, we define a small but expressive programming language that includes a construct for reverse-mode differentiation. We give operational and denotational semantics for this language. The operational semantics employs popular implementation techniques, while the denotational semantics employs notions of differentiation familiar from real analysis. We establish that these semantics coincide.

Formal verification of a constant-time preserving C compiler

Timing side-channels are arguably one of the main sources of vulnerabilities in cryptographic implementations. One effective mitigation against timing side-channels is to write programs that do not perform secret-dependent branches and memory accesses. This mitigation, known as "cryptographic constant-time", is adopted by several popular cryptographic libraries. This paper focuses on compilation of cryptographic constant-time programs, and more specifically on the following question: is the code generated by a realistic compiler for a constant-time source program itself provably constant-time? Surprisingly, we answer the question positively for a mildly modified version of the CompCert compiler, a formally verified and moderately optimizing compiler for C. Concretely, we modify the CompCert compiler to eliminate sources of potential leakage. Then, we instrument the operational semantics of CompCert intermediate languages so as to be able to capture cryptographic constant-time. Finally, we prove that the modified CompCert compiler preserves constant-time. Our mechanization maximizes reuse of the CompCert correctness proof, through the use of new proof techniques for proving preservation of constant-time. These techniques achieve complementary trade-offs between generality and tractability of proof effort, and are of independent interest.

The high-level benefits of low-level sandboxing

Sandboxing is a common technique that allows low-level, untrusted components to safely interact with trusted code. However, previous work has only investigated the low-level memory isolation guarantees of sandboxing, leaving open the question of the end-to-end guarantees that sandboxing affords programmers. In this paper, we fill this gap by showing that sandboxing enables reasoning about the known concept of robust safety , i.e. , safety of the trusted code even in the presence of arbitrary untrusted code. To do this, we first present an idealized operational semantics for a language that combines trusted code with untrusted code. Sandboxing is built into our semantics. Then, we prove that safety properties of the trusted code (as enforced through a rich type system) are upheld in the presence of arbitrary untrusted code, so long as all interactions with untrusted code occur at the “any” type (a type inhabited by all values). Finally, to alleviate the burden of having to interact with untrusted code at only the “any” type, we formalize and prove safe several wrappers , which automatically convert values between the “any” type and much richer types. All our results are mechanized in the Coq proof assistant.

Label-dependent session types

Session types have emerged as a typing discipline for communication protocols. Existing calculi with session types come equipped with many different primitives that combine communication with the introduction or elimination of the transmitted value. We present a foundational session type calculus with a lightweight operational semantics. It fully decouples communication from the introduction and elimination of data and thus features a single communication reduction, which acts as a rendezvous between senders and receivers. We achieve this decoupling by introducing label-dependent session types, a minimalist value-dependent session type system with subtyping. The system is sufficiently powerful to simulate existing functional session type systems. Compared to such systems, label-dependent session types place fewer restrictions on the code. We further introduce primitive recursion over natural numbers at the type level, thus allowing to describe protocols whose behaviour depends on numbers exchanged in messages. An algorithmic type checking system is introduced and proved equivalent to its declarative counterpart. The new calculus showcases a novel lightweight integration of dependent types and linear typing, with has uses beyond session type systems.

Stacked borrows: an aliasing model for Rust

Type systems are useful not just for the safety guarantees they provide, but also for helping compilers generate more efficient code by simplifying important program analyses. In Rust, the type system imposes a strict discipline on pointer aliasing, and it is an express goal of the Rust compiler developers to make use of that alias information for the purpose of program optimizations that reorder memory accesses. The problem is that Rust also supports unsafe code, and programmers can write unsafe code that bypasses the usual compiler checks to violate the aliasing discipline. To strike a balance between optimizations and unsafe code, the language needs to provide a set of rules such that unsafe code authors can be sure, if they are following these rules, that the compiler will preserve the semantics of their code despite all the optimizations it is doing. In this work, we propose Stacked Borrows , an operational semantics for memory accesses in Rust. Stacked Borrows defines an aliasing discipline and declares programs violating it to have undefined behavior , meaning the compiler does not have to consider such programs when performing optimizations. We give formal proofs (mechanized in Coq) showing that this rules out enough programs to enable optimizations that reorder memory accesses around unknown code and function calls, based solely on intraprocedural reasoning. We also implemented this operational model in an interpreter for Rust and ran large parts of the Rust standard library test suite in the interpreter to validate that the model permits enough real-world unsafe Rust code.

ε-TPN: definition of a Time Petri Net formalism simulating the behaviour of the timed grafcets

To allow a formal verification of timed GRAFCET models, many authors proposed to translate them into formal and well-reputed languages such as timed automata or Time Petri nets (TPN). Thus, the work presented in [Sogbohossou, Vianou, Formal modeling of grafcets with Time Petri nets, IEEE Transactions on Control Systems Technology, 23(5)(2015)] concerns the TPN formalism: the resulting TPN of the translation, called here ε-TPN, integrates some infinitesimal delays (ε) to simulate the synchronous semantics of the grafcet. The first goal of this paper is to specify a formal operational semantics for an ε-TPN to amend the previous one: especially, priority is introduced here between two defined categories of the ε-TPN transitions, in order to respect strictly the synchronous hypothesis. The second goal is to provide how to build the finite state space abstraction resulting from the new definitions. Afin de permettre la vérification formelle des grafcets temporisés, plusieurs auteurs ont proposé de les traduire dans des langages formels de réputation tels que les automates temporisés et les réseaux de Petri temporels (TPN). Ainsi, les travaux présentés dans [Sogbohossou, Vianou, Formal modeling of grafcets with Time Petri nets, IEEE Transactions on Control Systems Technology, 23(5)(2015)] concernent le formalisme des TPN: le réseau résultant de la traduction, dénommé ici ε-TPN, intègre des délais infinitésimaux (ε) pour simuler la sémantique synchrone du grafcet. Le premier objectif de cet article est de définir la sémantique opérationnelle d'un ε-TPN afin d'améliorer l'ancienne définition: spécifiquement, une priorité est introduite ici entre deux catégories de transitions définies pour ces réseaux, dans l'optique de respecter rigoureusement l'hypothèse synchrone. Le second but est de fournir une méthode de calcul de l'espace d'état fini qui découle des nouvelles définitions.

Congruence from the operator\u2019s point of view

A basic sanity property of a process semantics is that it constitutes a congruence with respect to standard process operators. This issue has been traditionally addressed by developing, for a specific process semantics, a syntactic format for operational semantics specifications. We suggest a novel, orthogonal approach, which focuses on a specific process operator and determines a class of congruence relations for this operator. To this end, we impose syntactic restrictions on Hennessy–Milner logic, so that a process semantics whose modal characterization satisfies those criteria is guaranteed to be a congruence with respect to the operator in question. We investigate alternative composition, action prefix, projection, encapsulation, renaming, and parallel composition with communication, in the context of both concrete and weak process semantics.

Using relaxed concurrent data structures for contention minimization in multithreaded MPI programs

Parallel computing is one of the top priorities in computer science. The main means of parallel processing information is a distributed computing system (CS) - a composition of elementary machines that interact through a communication medium. Modern distributed VSs implement thread-level parallelism (TLP) within a single computing node (multi-core CS with shared memory), as well as process-level parallelism (PLP) process-level parallelism for the entire distributed CS. The main tool for developing parallel programs for such systems is the MPI standard. The need to create scalable parallel programs that effectively use compute nodes with shared memory has determined the development of the MPI standard, which today supports the creation of hybrid multi-threaded MPI programs. A hybrid multi-threaded MPI program is the combination of the computational capabilities of processes and threads. The standard defines four types of multithreading: Single - one thread of execution; Funneled - a multi-threaded program, but only main thread can perform MPI operations; Serialized - only one thread at the exact same time can make a call to MPI functions; Multiple - each program flow can perform MPI functions at any time. The main task of the multiple mode is the need to synchronize the communication flows within each process. This paper presents an overview of the work that addresses the problem of synchronizing processes running on remote machines and synchronizing internal program threads. Method for synchronization of threads based on queues with weakened semantics of operations is proposed.

Verification-Oriented Process Ontology

This paper presents the ontology of the concurrent processes close to Hoare communicating sequential processes. It is a part of an intellectual system for supporting verification of behavioral properties of such processes. Our ontological representation of the processes is oriented both to the application of formal verification methods and to the extraction of information from technical documentation (by our previously developed system of information extraction from a natural language text). We describe the ontology classes and domains that define communicating concurrent processes. These processes are characterized by sets of local and shared variables, a list of actions on these variables which change their values, a list of channels for the process communication (which, in turn, are characterized by the type of reading messages, capacity, modes of writing and reading, and reliability), and also a list of communication actions for sending messages. In addition to the formal mathematical definition of classes and domains of the ontology, examples of descriptions of some ontological classes, as well as typical properties and axioms for them, are specified in the editor Protégé in the OWL language with the use of the inference rules in the SWRL language. We define the formal operational semantics of communicating processes for their ontological representation. This semantics is a labeled transition system. It is reduced to the local operational semantics of separate process instances in the interleaving model. We specialize several types of processes from the subject domain of automatic control systems that model the typical functional elements of the automatic control system (sensors, comparators and regulators), as well as their combinations. The concepts of the specialized ontology are illustrated by the example of a control part of a bottle-filling system.

Believing Probabilistic Contents: On the Expressive Power and Coherence of Sets of Sets of Probabilities

Moss argues that rational agents are best thought of not as having degrees of belief in various propositions. Instead, they are best thought of as having beliefs in probabilistic contents. Probabilistic contents are sets of probability functions. Probabilistic belief states, in turn, can then be modelled by sets of probabilistic contents, or sets of sets of probability functions. We argue that this Mossean framework is of considerable interest quite independently of its role in Moss’s account of probabilistic knowledge or her semantics for epistemic modals and probability operators. It is an extremely general model of uncertainty. Indeed, it is at least as general and expressively powerful as every other current imprecise probability framework, including lower probabilities, lower previsions, sets of probabilities, sets of desirable gambles and choice functions. In addition, we partially answer an important question that Moss leaves open, viz., why should rational agents have consistent probabilistic beliefs? We will show that a large range of failures of consistency will lead you to be Dutch bookable.

Topological operations for editing the singularity on a hex mesh

This paper introduces topological operations for editing the singularity on a hex mesh while maintaining the connectivity of hexahedral mesh. The operations include (1) an enhanced column collapse operation that can avoid generating the poor-quality elements; (2) a column insertion operation that is the opposite operation of column collapse; (3) four semantic operations for achieving the movement of different types of singularity pairs based on column operations. To demonstrate their effectiveness, two related applications are provided. One is moving face-based hex mesh editing, in which the interface between the original mesh and the new region mesh is made structured using the semantic operations. The other is hex mesh structure simplification based on the topological operations.

Formalizing SPARCv8 instruction set architecture in Coq

The SPARCv8 instruction set architecture (ISA) has been widely used in various processors for workstations, embedded systems, and space missions. In order to formally verify the correctness of embedded operating systems running on SPARCv8 processors, one has to formalize the semantics of SPARCv8 ISA. In this article, we present our formalization of SPARCv8 ISA, which is faithful to the realistic design of SPARCv8. We also prove the determinacy and isolation properties with respect to the operational semantics of our formal model. In addition, we have verified that two trap handlers handling window overflow and window underflow satisfy the user's specifications based on our formal model. All of the formalization and proofs have been mechanized in Coq. • Effective computational method to solve high-dimensional time-dependent nonlinear PDEs on tensor manifolds with constant rank. • New adaptive algorithm for dynamic addition and removal of modes. • Computable hierarchical bi-orthogonal decomposition of high-dimensional functions.

Miracles in Monochrome: Grisaille in Visual Hagiography

Through an examination of the miracles of Anthony of Padua painted by Girolamo da Treviso in the Saraceni Chapel (1525–26), I demonstrate here the complex ways in which monochrome painting would have created meaning for diverse audiences. I argue that the use of grisaille in the chapel, by visually evoking marble relief, did many things at once: it presented both established and lesser-known miracles as reliable evidence of Anthony’s saintly power, ‘carved’ in immutable stone; it conjured the specific thaumaturgical context of the burial shrine, with its elevated marble tombs; and it activated the paragone to produce sensations of both intimacy and distance, and to foster both comprehension and confusion. Taking as a case study visual hagiography – a form of pictorial narrative that addressed multiple audiences and engaged dynamically with both visual and textual precedents, this study sheds new light on the semantic operations of grisaille in Renaissance visual culture.

A formal actor-based model for streaming the future

Asynchronous Actor-based programming has gained increasing attention as a model of concurrency and distribution. The Abstract Behavioral Specification (ABS) language is an actor-based programming language that has been developed for both the modeling and formal analysis of distributed systems. In ABS, actors are modeled as concurrent objects that communicate by asynchronous method calls. Return values are also communicated asynchronously via return statements and so-called futures. Many modern distributed software applications require a form of continuous interaction between their components which consists of streaming data from a server to its clients. In this paper, we extend the ABS language in order to support the streaming of data. We introduce the notion of “future-based data streams” by augmenting the syntax, type system, and operational semantics of ABS. As a proof of concept, we further discuss a prototype implementation for supporting future-based data streams on top of ABS, and discuss the impact of the use of these data streams in ABS on the performance in the implementation of a distributed application for the generation of social networks.