Proofs Of Programs Research Articles

FORMAL PROOFS OF FUNCTIONAL BSP PROGRAMS

The Bulk Synchronous Parallel ML (BSML) is a functional language for BSP programming, a model of computing which allows parallel programs to be ported to a wide range of architectures. It is based on an extension of the ML language by parallel operations on a parallel data structure called parallel vector, which is given by intention. We present a new approach to certifying BSML programs in the context of type theory. Given a specification and a program, an incomplete proof of the specification (of which algorithmic contents corresponds to the given program) is built in the type theory, in which gaps would correspond to the proof obligation. This development demonstrates the usefulness of higher-order logic in the process of software certification of parallel applications. It also shows that the proof of rather complex parallel algorithms may be done with inductive types without great difficulty by using existing certified programs. This work has been implemented in the Coq Proof Assistant, applied on non-trivial examples and is the basis of a certified library of BSML programs.

Renormalization Horseshoe for Critical Circle Maps

We prove that the invariant horseshoe for the renormalization of critical circle maps is globally uniformly hyperbolic with one-dimensional unstable direction. This extends our earlier result on hyperbolicity of periodic orbits of the renormalization, and completes the proof of Lanford's Program.

System ST toward a type system for extraction and proofs of programs

We introduce a new type system called “System ST” (ST stands for subtyping), based on subtyping, and prove the basic property of the system. We show the extraordinary expressive power of the system which leads us to think that it could be a good candidate for doing both proof and extraction of programs.

A provably sound TAL for back-end optimization

Typed assembly languages provide a way to generate machine-checkable safety proofs for machine-language programs. But the soundness proofs of most existing typed assembly languages are hand-written and cannot be machine-checked, which is worrisome for such large calculi. We have designed and implemented a low-level typed assembly language (LTAL) with a semantic model and established its soundness from the model. Compared to existing typed assembly languages, LTAL is more scalable and more secure; it has no macro instructions that hinder low-level optimizations such as instruction scheduling; its type constructors are expressive enough to capture dataflow information, support the compiler's choice of data representations and permit typed position-independent code; and its type-checking algorithm is completely syntax-directed.We have built a prototype system, based on Standard ML of New Jersey, that compiles most of core ML to Sparc code. We explain how we were able to make the untyped back end in SML/NJ preserve types during instruction selection and register allocation, without restricting low-level optimizations and without knowledge of any type system pervading the instruction selector and register allocator.

FORMAL PROOF OF APPLICATIONS DISTRIBUTED IN SYMMETRIC INTERCONNECTION NETWORKS

This paper focuses on the formal proof of parallel programs dedicated to distributed memory symmetric interconnection networks; communications are realized by message passing. We have developed a method to formally verify the computational correctness of this kind of application. Using the notion of Cayley graphs to model the networks in the Nqthm theorem prover, we have formally specified and mechanically proven correct a large set of collective communication primitives. Our compositional approach allows us to reuse these libraries of pre-proven procedures to validate complex application programs within Nqthm. This is illustrated by three examples.

On modular termination proofs of general logic programs

We propose a modular method for proving termination of general logic programs (i.e. logic programs with negation). It is based on the notion of acceptable programs, but it allows us to prove termination in a truly modular way. We consider programs consisting of a hierarchy of modules and supply a general result for proving termination by dealing with each module separately. For programs which are in a certain sense well-behaved, namely well-moded or well-typed programs, we derive both a simple verification technique and an iterative proof method. Some examples show how our system allows for greatly simplified proofs.

An Experiment in Program Composition and Proof

This paper explores a compositional approach to program specification, development and proof. We apply a theory of composition to a problem in distributed computing with the goal of understanding the strengths and weaknesses of this compositional approach. First, we describe the theory briefly. Then we give a specification of a desired system. Next, we propose a design of the desired system as a composition of components and prove its correctness. Finally, we show how the proof can be reused for a slightly different compositional structure by using the concept of observation.

Automated verification of function block-based industrial control systems

The international standard IEC 61131-3, which supports Brad Cox’ concept of “Software-ICs” for industrial control programming, is increasingly being used in safety-related application domains. They include safety-instrumented functions, such as burner management, emergency shutdown and gas leak detection, but also complex automation processes controlling, e.g., chemical production plants. For such highly dependable applications, code inspection and testing, the predominant quality assurance techniques used in practice today, are, in general, not sufficient to demonstrate the functional correctness and safety of an application. This paper presents a theorem prover-based verification technique as a supplementary validation measure. The verification task is separated into the a priori verification of reusable function blocks, which are usually maintained in domain-specific libraries, and a separate compositional proof of individual application programs. Core concepts of the standardized languages, their semantic embedding into higher order logic, and the verification approach are illustrated with a small example. Some design ideas for a verification tool usable by automation engineers and safety licensing authorities conclude the contribution.

Reasoning about code mobility with mobile UNITY

Advancements in network technology have led to the emergence of new computing paradigms that challenge established programming practices by employing weak forms of consistency and dynamic forms of binding. Code mobility, for instance, allows for invocation-time binding between a code fragment and the location where it executes. Similarly, mobile computing allows hosts (and the software they execute) to alter their physical location. Despite apparent similarities, the two paradigms are distinct in their treatment of location and movement. This paper seeks to uncover a common foundation for the two paradigms by exploring the manner in which stereotypical forms of code mobility can be expressed in a programming notation developed for mobile computing. Several solutions to a distributed simulation problem are used to illustrate the modeling strategy and the ability to construct assertional-style proofs for programs that employ code mobility.

On the Number of Rule Applications in Constraint Programs

We predict the maximal number of rule applications, i.e. worst-case derivation lengths of computations, in rule-based constraint solver programs written in the CHR language. CHR are a committed-choice concurrent constraint logic programming language consisting of multi-headed guarded rules. The derivation lengths are derived from rankings used in termination proofs for the respective programs. We are especially interested in rankings that give us a good upper bound, we call such rankings tight. Based on test-runs with randomized data, we compare our predictions with empirical results by considering constraint solvers ranging from Boolean and terminological constraints to arc-consistency and path-consistency.

Termination proofs for logic programs with tabling

Tabled evaluation is receiving increasing attention in the logic programming community. It avoids many of the shortcomings of SLD execution and provides a more flexible and often considerably more efficient execution mechanism for logic programs. In particular, tabled execution terminates more often than execution based on SLD-resolution. In this article, we introduce two notions of universal termination of logic programming with tabling: quasi-termination and (the stronger notion of) LG-termination. We present sufficient conditions for these two notions of termination, namely quasi-acceptability and LG-acceptability, and we show that these conditions are also necessary in case the selection of tabled predicates meets certain natural criteria. Starting from these conditions, we develop modular termination proofs, i.e., proofs capable of combining termination proofs of separate programs to obtain termination proofs of combined programs. Finally, in the presence of mode information, we state sufficient conditions which form the basis for automatically proving termination in a constraint-based way.

A calculus of functional BSP programs

An extension of the λ-calculus called BS λ is introduced as a formal basis for functional languages expressing bulk synchronous parallel algorithms. A confluence result is shown. The application of the calculus is illustrated by examples of program proofs and the associated notion of parallel reduction. The reduction process is interpreted in the BSP cost model.

AXIOMATIC FRAMEWORKS FOR DEVELOPING BSP-STYLE PROGRAMS*

In bulk-synchronous parallel (BSP) computation a superstep comprises a collection of concurrently executed processes with initial and terminal synchronisations. Data transfer between processes is realised through asynchronous communications. BSP programs can be organised either as explicit compositions of supersteps or as parallel compositions of threads (processes) which include synchronisation alignment operations. In this paper axiomatic semantics for the two approaches are proposed: in both cases the semantics are based on a new form of multiple substitution - predicate substitution which generalises previous definitions of substitution. Predicate substitution together with global synchronisation provide a means of linking state based and process semantics of BSP. Features of both models are illustrated through correctness proofs of matrix multiplication programs

Higher order generalization and its application in program verification

Generalization is a fundamental operation of inductive inference. While first order syntactic generalization (antidunification) is well understood, its various extensions are often needed in applications. This paper discusses syntactic higher order generalization in a higher order language λ2 l1r. Based on the application ordering, we prove that least general generalization exists for any two terms and is unique up to renaming. An algorithm to compute the least general generalization is also presented. To illustrate its usefulness, we propose a program verification system based on higher order generalization that can reuse the proofs of similar programs.

Modular Verification of Function Block Based Industrial Control Systems

IEC 61131-3, the world-wide standard for industrial control programming, is increasingly being used in safety-related control applications. Control loops are built from components taken from domain-specific function block libraries. Code inspection and testing are the two predominant quality assurance techniques. For highly dependable control applications, however, these techniques are not sufficient, in general.This paper suggests to augment testing with compositional, theorem-prover supported verification. The approach is based on a representation of IEC 61131-3 function blocks in higher-order logic. The verification task is separated into the a priori verification of library components and a separate proof of individual application programs.

Automated Verification of Function Block Based Industrial Control Systems

IEC 61131-3, the world-wide standard for industrial control programming, is increasingly being used in embadded control applications. The standard supports the concept of reusable “software ICs” through the concept of function blocks. can be hierarchically grouped and horizontally “wired” to Complex control loops are typically built from elementary components taken from domain-specific libraries. Code inspection and testing are the two predominant quality assurance techniques in practice, today. For highly dependable control applications, however, these techniques are not sufficient, in general.This paper suggests to augment testing with compositional, theorem-prover supported verification. The approach is based on a representation of IEC 61131-3 function blocks in higher-order logic. The verification task is separated into the a priori verification of library components and a separate proof of individual application programs. The latter relies on proven properties of the library components used. We sketch the semantic embedding of three most used languages of the IEC standard and illustrate our verification approach with a simple example. We conclude with a wish list for a verification tool that is usable by application and licensing engineers.

Development of a Bonded Repair for the F-16 FS479 Bulkhead Vertical Tail Attach Bosses

A bonded repair has been developed to repair cracked FS479 bulkheads on the F-16 aircraft. The cracking occurs at the vertical tail to aft fuselage interface in a sharp fillet between the vertical tail attach boss and the top flange of the bulkhead. The repair approach entails machining off the attach bosses along with any existing cracks, and bonding on a replacement 'saddle' with an optimized contour that eliminates the stress concentration caused by the fillet. As a final step the saddle is reinforced with boron doublers to optimize the load transfer. This repair is a cost effective alternative to bulkhead replacement because it can be applied in the field and does not require the removal of the bulkhead from the aircraft. To date, the repair has successfully completed proof of concept static testing over a temperature range of − 65○F to 200○F and durability testing at room temperature to 1.5 lifetimes. This paper details the repair design and summarizes the results obtained in the proof of concept program.

Partiality and Nondeterminacy in Program Proofs

Abstract. Specifications and programs make much use of nondeterministic and/or partial expressions, i.e. expressions which may yield several or no outcomes for some values of their free variables. Traditional 2-valued logics do not comfortably accommodate reasoning about undefined expressions, and do not cater at all for nondeterministic expressions. We seek to rectify this with a 4-valued typed logic E4 which classifies formulae as either “true”, “false”, “neither true nor false”, or “possibly true, possibly false”. The logic is derived in part from the 2-valued logic E and the 3-valued LPF, and preserves most of the theorems of E . Indeed, the main result is that nondeterminacy can be added to a logic covering partiality at little cost.

Theories for mechanical proofs of imperative programs

Abstract For convenient application of a first-order theorem prover to verification of imperative programs, it is important to encapsulate the operational semantics in generic theories. The possibility to do so is illustrated by two theories for the Boyer-Moore theorem prover Nqthm. The first theory is an Nqthm version of the classical while-theorem. Here the main interest is to show how one can use Nqthm's facilities to constrain and to functionally instantiate for the development and application of a generic theory. The theory is illustrated by a linear search program. The second theory is a finitary approach to progress for shared-memory concurrent programs. It is illustrated by Peterson's algorithm for mutual exclusion of two processes. The proof of progress for Peterson's algorithm is new. The assertion of bounded fairness is slightly stronger than the conventional notion of weak fairness. This new concept may have other applications.

Termination of Nested and Mutually Recursive Algorithms

This paper deals with automated termination analysis for functional programs. Previously developed methods for automated termination proofs of functional programs often fail for algorithms with nested recursion and they cannot handle algorithms with mutual recursion. We show that termination proofs for nested and mutually recursive algorithms can be performed without having to prove the correctness of the algorithms simultaneously. Using this result, nested and mutually recursive algorithms do no longer constitute a special problem and the existing methods for automated termination analysis can be extended to nested and mutual recursion in a straightforward way. We give some examples of algorithms whose termination can now be proved automatically (including well-known challenge problems such as McCarthy’s f_91 function).