Program Verification Problems Research Articles

VST-A: A Foundationally Sound Annotation Verifier

Program verifiers for imperative languages such as C may be annotation-based, in which assertions and invariants are put into source files and then checked, or tactic-based, where proof scripts separate from programs are interactively developed in a proof assistant such as Coq. Annotation verifiers have been more automated and convenient, but some interactive verifiers have richer assertion languages and formal proofs of soundness. We present VST-A, an annotation verifier that uses the rich assertion language of VST, leverages the formal soundness proof of VST, but allows users to describe functional correctness proofs intuitively by inserting assertions. VST-A analyzes control flow graphs, decomposes every C function into control flow paths between assertions, and reduces program verification problems into corresponding straightline Hoare triples. Compared to existing foundational program verification tools like VST and Iris, in VST-A such decompositions and reductions can nonstructural, which makes VST-A more flexible to use. VST-A's decomposition and reduction is defined in Coq, proved sound in Coq, and computed call-by-value in Coq. The soundness proof for reduction is totally logical, independent of the complicated semantic model (and soundness proof) of VST's Hoare triple. Because of the rich assertion language, not all reduced proof goals can be automatically checked, but the system allows users to prove residual proof goals using the full power of the Coq proof assistant.

Verification of message-passing uninterpreted programs

Message-passing programs involve several processes with channel-based communications to deal with tasks concurrently. The complex computations and communications between processes make the verification of message-passing programs hard. By regarding the functions in programs as uninterpreted functions, we focus on the verification problem of message-passing uninterpreted programs. Although the usage of uninterpreted functions alleviates the computational difficulties brought by functions, the verification problem is still undecidable in general. In this work, we provide a decidable subclass of message-passing uninterpreted programs, wherein programs in this subclass satisfy the property of k-record coherence. The decidability result closely relies on communicating finite-state machine (CFM) with bounded channels. Based on the decidability result, we proposed a verification framework for message-passing uninterpreted programs.

Reasoning about block-based cloud storage systems via separation logic

Owing to the massive growth in the storage demands of big data, cloud storage systems emerge at a historic moment, among which block-based cloud storage systems (BCSSs) are typical. Compared with traditional storage systems, BCSSs have many advantages, such as higher capacity, lower cost, and better scalability. BCSSs are also much more complex and error prone than traditional systems, and therefore, their reliability is a significant concern. Correctness is the most basic requirement for reliability. Therefore, it is of great significance to study BCSS program correctness verification to establish the theoretical basis for cloud storage systems. In this paper, we propose a novel framework based on separation logic (SL) to verify the correctness of BCSS management programs. We first construct a two-tier heap structure as the formal model of the storage architecture for BCSSs and present a modelling language based on this structure to describe the program execution. We then define assertion pairs to describe the properties of the two-tier structure. The two components of an assertion pair affect each other, producing several interesting properties. Finally, we propose a Hoare-style proof system to reason about BCSS programs and establish its soundness. We also demonstrate our proof system's uniqueness, usability, and scalability by verifying several real-world BCSS sample programs. In summary, this work presents a systematic approach that can be used to effectively solve BCSS program verification problems, and provides an SL-based logical modelling strategy, specifically to build its consistency with the actual behaviour of BCSSs.

Reachability of Patterned Conditional Pushdown Systems

Conditional pushdown systems (CPDSs) extend pushdown systems by associating each transition rule with a regular language over the stack alphabet. The goal is to model program verification problems that need to examine the runtime call stack of programs. Examples include security property checking of programs with stack inspection, compatibility checking of HTML5 parser specifications, etc. Esparza et al. proved that the reachability problem of CPDSs is EXPTIME-complete, which prevents the existence of an algorithm tractable for all instances in general. Driven by the practical applications of CPDSs, we study the reachability of patterned CPDS (pCPDS) that is a practically important subclass of CPDS, in which each transition rule carries a regular expression obeying certain patterns. First, we present new saturation algorithms for solving state and configuration reachability of pCPDSs. The algorithms exhibit the exponential-time complexity in the size of atomic patterns in the worst case. Next, we show that the reachability of pCPDSs carrying simple patterns is solvable in fixed-parameter polynomial time and space. This answers the question on whether there exist tractable reachability analysis algorithms of CPDSs tailored for those practical instances that admit efficient solutions such as stack inspection without exception handling. We have evaluated the proposed approach, and our experiments show that the pattern-driven algorithm steadily scales on pCPDSs with simple patterns.

Arithmetics based on computability logic

This paper is a brief survey of number theories based on em computability logic (CoL) a game-semantically conceived logic of computational tasks of resources. Such theories, termed em clarithmetics, are conservative extensions of first-order Peano arithmetic. 
 
 The first section of the paper lays out the conceptual basis of CoL and describes the relevant fragment of its formal language, with so called parallel connectives, choice connectives and quantifiers, and blind quantifiers. Both syntactically and semantically, this is a conservative generalization of the language of classical logic. 
 
 Clarithmetics, based on the corresponding fragment of CoL in the same sense as Peano 
 arithmetic is based on classical logic, are discussed in the second section. The axioms and inference rules of the system of clarithmetic named ${\bf CLA11}$ are presented, and the main results on this system are stated: constructive soundness, extensional completeness, and intensional completeness. 
 
 
 In the final section two potential applications of clarithmetics are addressed: clarithmetics as declarative programming languages in an extreme sense, and as tools for separating computational complexity classes. When clarithmetics or similar CoL-based theories are viewed as programming languages, programming reduces to proof-search, as programs can be mechanically extracted from proofs; such programs also serves as their own formal verifications, thus fully neutralizing the notorious (and generally undecidable) program verification problem. The second application reduces the problem of separating various computational complexity classes to separating the corresponding versions of clarithmetic, the potential benefits of which stem from the belief that separating theories should generally be easier than separating complexity classes directly. 

Automatically disproving fair termination of higher-order functional programs

We propose an automated method for disproving fair termination of higher-order functional programs, which is complementary to Murase et al.’s recent method for proving fair termination. A program is said to be fair terminating if it has no infinite execution trace that satisfies a given fairness constraint. Fair termination is an important property because program verification problems for arbitrary ω-regular temporal properties can be transformed to those of fair termination. Our method reduces the problem of disproving fair termination to higher-order model checking by using predicate abstraction and CEGAR. Given a program, we convert it to an abstract program that generates an approximation of the (possibly infinite) execution traces of the original program, so that the original program has a fair infinite execution trace if the tree generated by the abstract program satisfies a certain property. The method is a non-trivial extension of Kuwahara et al.’s method for disproving plain termination.

Proving mutual termination

Two programs are said to be mutually terminating if they terminate on exactly the same inputs. We suggest inference rules and a proof system for proving mutual termination of a given pair of procedures $$\langle $$�$$f$$f, $$f'$$f�$$\rangle $$� and the respective subprograms that they call under a free context. Given a (possibly partial) mapping between the procedures of the two programs, the premise of the rule requires proving that given the same arbitrary input in, f(in) and $$f'(in)$$f�(in) call procedures mapped in the mapping with the same arguments. A variant of this proof rule with a weaker premise allows to prove termination of one of the programs if the other is known to terminate. In addition, we suggest various techniques for battling the inherent incompleteness of our solution, including a case in which the interface of the two procedures is not identical, and a case in which partial equivalence (the equivalence of their input/output behavior) has only been proven for some, but not all, the outputs of the two given procedures. We present an algorithm for decomposing the verification problem of whole programs to that of proving mutual termination of individual procedures, based on our suggested inference rules. The reported prototype implementation of this algorithm is the first to deal with the mutual termination problem.

Model Checking Higher-Order Programs

We propose a novel verification method for higher-order functional programs based on higher-order model checking, or more precisely, model checking of higher-order recursion schemes (recursion schemes, for short). The most distinguishing feature of our verification method for higher-order programs is that it is sound, complete, and automatic for the simply typed λ-calculus with recursion and finite base types, and for various program verification problems such as reachability, flow analysis, and resource usage verification. We first show that a variety of program verification problems can be reduced to model checking problems for recursion schemes, by transforming a program into a recursion scheme that generates a tree representing all the interesting possible event sequences of the program. We then develop a new type-based model-checking algorithm for recursion schemes and implement a prototype recursion scheme model checker. To our knowledge, this is the first implementation of a recursion scheme model checker. Experiments show that our model checker is reasonably fast, despite the worst-case time complexity of recursion scheme model checking being hyperexponential in general. Altogether, the results provide a new, promising approach to verification of higher-order functional programs.

Higher-order multi-parameter tree transducers and recursion schemes for program verification

We introduce higher-order, multi-parameter, tree transducers (HMTTs, for short), which are kinds of higher-order tree transducers that take input trees and output a (possibly infinite) tree. We study the problem of checking whether the tree generated by a given HMTT conforms to a given output specification, provided that the input trees conform to input specifications (where both input/output specifications are regular tree languages). HMTTs subsume higher-order recursion schemes and ordinary tree transducers, so that their verification has a number of potential applications to verification of functional programs using recursive data structures, including resource usage verification, string analysis, and exact type-checking of XML-processing programs. We propose a sound but incomplete verification algorithm for the HMTT verification problem: the algorithm reduces the verification problem to a model-checking problem for higher-order recursion schemes extended with finite data domains, and then uses (an extension of)Kobayashi's algorithm for model-checking recursion schemes. While the algorithm is incomplete (indeed, as we show in the paper, the verification problem is undecidable in general), it is sound and complete for a subclass of HMTTs called linear HMTTs . We have applied our HMTT verification algorithm to various program verification problems and obtained promising results.

On the verification problem for weak memory models

We address the verification problem of finite-state concurrent programs running under weak memory models. These models capture the reordering of program (read and write) operations done by modern multi-processor architectures for performance. The verification problem we study is crucial for the correctness of concurrency libraries and other performance-critical system services employing lock-free synchronization, as well as for the correctness of compiler backends that generate code targeted to run on such architectures. We consider in this paper combinations of three well-known program order relaxations. We consider first the "write to read" relaxation, which corresponds to the TSO (Total Store Ordering) model. This relaxation is used in most hardware architectures available today. Then, we consider models obtained by adding either (1) the "write to write" relaxation, leading to a model which is essentially PSO (Partial Store Ordering), or (2) the "read to read/write" relaxation, or (3) both of them, as it is done in the RMO (Relaxed Memory Ordering) model for instance. We define abstract operational models for these weak memory models based on state machines with (potentially unbounded) FIFO buffers, and we investigate the decidability of their reachability and their repeated reachability problems. We prove that the reachability problem is decidable for the TSO model, as well as for its extension with "write to write" relaxation (PSO). Furthermore, we prove that the reachability problem becomes undecidable when the "read to read/write" relaxation is added to either of these two memory models, and we give a condition under which this addition preserves the decidability of the reachability problem. We show also that the repeated reachability problem is undecidable for all the considered memory models.

Verifying Multithreaded Recursive Programs with Integer Variables

We consider the verification problem of programs containing the following complex features: (1) dynamic creation of parallel threads, (2) synchronisation between parallel threads via global variables, (3) (possibly recursive) procedure calls, and (4) integer variables. The configurations of such programs are represented by terms, and their transitions by term rewriting systems. The novelty of our modeling w.r.t. other existing works consists in explicitely modeling integer variables in the terms. We propose a semi-decision procedure that, in case of termination, checks whether an infinite set of configurations, represented by a regular tree language, is reachable from an infinite set of initial configurations of the program (usually represented by a set of non ground terms). As fas as we know, this is the first time that reachability between non-ground terms and regular tree languages is considered. We implemented our techniques in a tool, and tested it successfully on several examples.

Program analysis as constraint solving

A constraint-based approach to invariant generation in programs translates a program into constraints that are solved using off-the-shelf constraint solvers to yield desired program invariants. In this paper we show how the constraint-based approach can be used to model a wide spectrum of program analyses in an expressive domain containing disjunctions and conjunctions of linear inequalities. In particular, we show how to model the problem of context-sensitive interprocedural program verification. We also present the first constraint-based approach to weakest precondition and strongest postcondition inference. The constraints we generate are boolean combinations of quadratic inequalities over integer variables. We reduce these constraints to SAT formulae using bitvector modeling and use off-the-shelf SAT solvers to solve them. Furthermore, we present interesting applications of the above analyses, namely bounds analysis and generation of most-general counter-examples for both safety and termination properties. We also present encouraging preliminary experimental results demonstrating the feasibility of our technique on a variety of challenging examples.

REQUIREMENT AND USE FOR REMOTE TEACHING OF DISCRETE EVENTS SYSTEMS

Today, Internet makes possible remote access to PLC (Programmable Logic Controllers) remote maintenance, monitoring, supervision and follow-up of plants. In this article, we are interested in the possibilities that Internet offers for the D.E.S (Discrete Events System) teaching. The concept of distributed practical work room is proposed in order to facilitate the technical know-how transmission. The idea consists for students, on the one hand to use a real PLC and specialized software via Internet and on the other hand, to check their controller program by the mean of a plant simulation. In addition, the controller program verification problem is proposed. Indeed, as well within the framework of the real as simulated plant use, it is necessary to develop controller verification tools able to cooperate with the teacher and students and having explanatory capacities.

Concurrent object-oriented programming

Three significant trends have underscored the central role of concurrency in computing. First, there is increased use of interacting processes by individual users, for example, application programs running on X windows. Second, workstation networks have become a cost-effective mechanism for resource sharing and distributed problem solving. For example, loosely coupled problems, such as finding all the factors of large prime numbers, have been solved by utilizing ideal cycles on networks of hundreds of workstations. A loosely coupled problem is one which can be easily partitioned into many smaller subproblems so that interactions between the subproblems is quite limited. Finally, multiprocessor technology has advanced to the point of providing supercomputing power at a fraction of the traditional cost. At the same time, software engineering considerations such as the need for data abstraction to promote program modularity underlie the rapid acceptance of object-oriented programming methodology. By separating the specification of what is done (the abstraction) from how it is done (the implementation), the concept of objects provides modularity necessary for programming in the large. It turns out that concurrency is a natural consequence of the concept of objects. In fact Simula, the first object-oriented language, simulated a simple form of concurrency using coroutines on conventional architectures. Current development of concurrent object-oriented programming (COOP) is providing a solid software foundation for concurrent computing on multiprocessors, Future generation computing systems are likely to be based on the foundations being developed by this emerging software technology. The goal of this article is to discuss the foundations and methodology of COOP. Concurrency refers to the potentially parallel execution of parts of a computation. In a concurrent computation, the components of a program may be executed sequentially, or they may be executed in parallel. Concurrency provides us with the flexibility to interleave the execution of components of a program on a single processor, or to distribute it among several processors. Concurrency abstracts away some of the details in an execution, allowing us to concentrate on conceptual issues without having to be concerned with a particular order of execution which may result from the quirks of a given system. Objects can be defined as entities which encapsulate data and operations into a single computational unit. Object models differ in how the internal behavior of objects is specified. Further, models of concurrent computation based on objects must specify how the objects interact, and different design concerns have led to different models of communication between objects. Object-oriented programming builds on the concepts of objects by supporting patterns of reuse and classification, for example, through the use of inheritance which allows all instances of a particular class to share the same method. In the following section, we outline some common patterns of concurrent problem solving. These patterns can be easily expressed in terms of the rich variety of structures provided by COOP. In particular, we discuss the actor model as a framework for concurrent systems 1 and some concepts which are useful in building actor systems. We will then describe some other models of objects and their relation to the actor model along with novel techniques for supporting reusability and modularity in concurrent object-oriented programming. The last section briefly outlines some major on-going projects in COOP. It is important to note that the actor languages give special emphasis to developing flexible program structures which simplify reasoning about programs. By reasoning we do not narrowly restrict ourselves to the problem of program verification—an important program of research whose direct practical utility has yet to be established. Rather our interest is in the ability to understand the properties of software because of clarity in the structure of the code. Such an understanding may be gained by reasoning either informally or formally about programs. The ease with which we can carry out such reasoning is aided by two factors: by modularity in code which is the result of the ability to separate design concerns, and by the ability to abstract program structures which occur repeatedly. In particular, because of their flexible structure, actor languages are particularly well-suited to rapid prototyping applications.

A set of inference rules for quantified formula handling and array handling in verification of programs over integers

Because of the undecidability problem of program verification, it becomes necessary for an automated verifier to seek human assistance for proving theorems which fall beyond its capability. In order that the user be able to interact smoothly with the machine, it is desired that the theorems be maintained and processed by the prover in a form as close as possible to the popular algebraic notation. Motivated by the need of such an automated verifier, which works in an environment congenial to human participation and at the same time uses the methodologies of resolution provers of first-order logic, some inference rules have previously been proposed by the authors (ibid., vol.15, no.1, p.1-9, Jan. 1989) for integer arithmetic, and their completeness issues have been discussed. In the present work, the authors examine how these rules can be applied to quantified formulas vis-a-vis verification of programs involving arrays. An interesting situation, referred to as bound-extension, has been found to occur frequently in proving the quantified verification conditions of the paths in a program. A novel rule, called bound-extension rule, has been devised to consolidate and depict the various issues involved in a bound-extension process. It has been proved that the rule set proposed previously by the authors is adequate for handling a more general phenomenon, called bound-modification, which covers bound-extension in all its entirety.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

Switching Functions Based Geometric Modeling Language and its Application to Numerical Control Program Verification

Summary The need for a solid geometric modeler which is capable of executing IF-ELSE statements related to set operations and of performing repeated operations by means of DO-loops, and its relevance and importance to manufacturing oriented applications has already been recognized in a broader sense such a solid modeler should be referred to as an interface between artificial intelligence and manufacturing applications, because it enables one to replace some non algorithmic rules by algorithmic ones Such a modeler should be available to researchers and application engineers in the form of a formal language, in the present paper a formal high level programming language based upon solid modeling techniques is presented. The power of the language is then demonstrated by applying it to the problem of numerical control program verification.

A logic for the specification and proof of regular controllable processes of CCS

This work has been motivated by the following general problem: find logics for the specification and proof of programs, described by terms of some algebra with given congruence relation. This relation is supposed to define a satisfactory concept for the behavioural comparison of programs. We require these logics to be adequate with respect to the term language, in the sense that two programs, behaviourally equivalent satisfy the same formulas and conversely. The term language considered is the subset of controllable, regular terms of CCS, on a vocabulary of actions A, with observational congruence. A term is said to be controllable if it is congruent to some term without occurrence of τ. We obtain an adequate logic whose language of formulas is obtained from constants true, false and ¦Nil¦ by using operators ∨, ∧, fixpoint operators, + and a for a∈A; the latter can be considered as extensions of the operators + and a for a∈A of CCS. As a result, controllable CCS terms can be considered as formulas of this logic and the problem of program verification is reduced to the proof of the validity of a formula.

Multilevel structured program design: Formalization and applications

The authors present the conception of structured design grammars (SDG), which provide the basis for the MSPD method. A classification of program development methods according to top-down, bottom-up, and mixed strategy is proposed. The SDG formalism makes it possible to consider the problem of multilevel partial program verification, program transformation, and documentation generation during program development and subsequent maintenance. The MSPD method is demonstrated in application to a number of program design projects. They develop the arsenal of structured programming using MSPD method. Language and software tools constituting the basis of structured programming are considered. The problem of multilevel optimizing translation is treated in the context of the mul'tiprotsessist system oriented to automatic structured parallel programming by the MSPD method. Applications of the MSPD method to symbolic processing are considered. The process of structured design of the partran system and of software modules for mini- and microcomputers is described. 70 references.