Soundness Research Articles

A clock-based dynamic logic for the verification of CCSL specifications in synchronous systems

The Clock Constraint Specification Language (CCSL) is a clock-based specification language for real-time embedded systems. With logical clocks defined as first-class citizens, CCSL provides a natural way for describing clock constraints in synchronous systems — a classical model of concurrency for real-time embedded systems. In this paper, we propose a clock-based dynamic logic called CCSL Dynamic Logic (CDL) for the verification of CCSL specifications in synchronous systems. It extends the first-order dynamic logic with a synchronous execution mechanism in its program model and with CCSL primitives as terms in its logical formulae. We build a sound and relatively complete proof system for CDL to support the verification. Compared with previous approaches for verifying CCSL specifications, which are based on model checking and SMT checking techniques, our approach, which is based on theorem-proving, offers a unified verification framework in which both bounded and unbounded CCSL specifications can be verified. Technically, with the proof system of CDL, a complex CDL formula can be semi-automatically transformed into a set of quantifier-free, arithmetical first-order logic (QF-AFOL) formulae which can be checked by an SMT solver in an efficient way. As a case study, we analyze a simple synchronous system throughout the paper to illustrate how CDL works. We analyze and prove the soundness and completeness of the proof system for CDL. Currently, CDL is partially mechanized in Coq. • Dynamic Logic to deal with Logical Clocked Systems. • Proof system for CCSL and synchronous systems. • Rely on a decidable subset theory for efficient use of SMT solvers. • Proof of soundness and relative completeness.

ιDOT: a DOT calculus with object initialization

The Dependent Object Types (DOT) calculus serves as a foundation of the Scala programming language, with a machine-verified soundness proof. However, Scala's type system has been shown to be unsound due to null references, which are used as default values of fields of objects before they have been initialized. This paper proposes ιDOT, an extension of DOT for ensuring safe initialization of objects. DOT was previously extended to κDOT with the addition of mutable fields and constructors. To κDOT, ιDOT adds an initialization effect system that statically prevents the possibility of reading a null reference from an uninitialized object. To design ιDOT, we have reformulated the Freedom Before Commitment object initialization scheme in terms of disjoint subheaps to make it easier to formalize in an effect system and prove sound. Soundness of ιDOT depends on the interplay of three systems of rules: a type system close to that of DOT, an effect system to ensure definite assignment of fields in each constructor, and an initialization system that tracks the initialization status of objects in a stack of subheaps. We have proven the overall system sound and verified the soundness proof using the Coq proof assistant.

Handling bidirectional control flow

Pressed by the difficulty of writing asynchronous, event-driven code, mainstream languages have recently been building in support for a variety of advanced control-flow features. Meanwhile, experimental language designs have suggested effect handlers as a unifying solution to programmer-defined control effects, subsuming exceptions, generators, and async–await. However, despite these trends, complex control flow—in particular, control flow that exhibits a bidirectional pattern—remains challenging to manage. We introduce bidirectional algebraic effects, a new programming abstraction that supports bidirectional control transfer in a more natural way. Handlers of bidirectional effects can raise further effects to transfer control back to the site where the initiating effect was raised, and can use themselves to handle their own effects. We present applications of this expressive power, which falls out naturally as we push toward the unification of effectful programming with object-oriented programming. We pin down the mechanism and the unification formally using a core language that makes generalizations to effect operations and effect handlers. The usual propagation semantics of control effects such as exceptions conflicts with modular reasoning in the presence of effect polymorphism—it breaks parametricity. Bidirectionality exacerbates the problem. Hence, we set out to show the core language, which builds on the existing tunneling semantics for algebraic effects, is not only type-safe (no effects go unhandled), but also abstraction-safe (no effects are accidentally handled). We devise a step-indexed logical-relations model, and construct its parametricity and soundness proofs. These core results are fully mechanized in Coq. While a full-featured compiler is left to future work, experiments show that as a first-class language feature, bidirectional handlers can be implemented efficiently.

Abstracting Strings for Model Checking of C Programs

Data type abstraction plays a crucial role in software verification. In this paper, we introduce a domain for abstracting strings in the C programming language, where strings are managed as null-terminated arrays of characters. The new domain M-String is parametrized on an index (bound) domain and a character domain. By means of these different constituent domains, M-Strings captures shape information on the array structure as well as value information on the characters occurring in the string. By tuning these two parameters, M-String can be easily tailored for specific verification tasks, balancing precision against complexity. The concrete and the abstract semantics of basic operations on strings are carefully formalized, and soundness proofs are fully detailed. Moreover, for a selection of functions contained in the standard C library, we provide the semantics for character access and update, enabling an automatic lifting of arbitrary string-manipulating code into our new domain. An implementation of abstract operations is provided within a tool that automatically lifts existing programs into the M-String domain along with an explicit-state model checker. The accuracy of the proposed domain is experimentally evaluated on real-case test programs, showing that M-String can efficiently detect real-world bugs as well as to prove that program does not contain them after they are fixed.

Constrained Pseudo-Propositional Logic

Propositional logic, with the aid of SAT solvers, has become capable of solving a range of important and complicated problems. Expanding this range, to contain additional varieties of problems, is subject to the complexity resulting from encoding counting constraints in conjunctive normal form (CNF). Due to the limitation of the expressive power of propositional logic, generally, such an encoding increases the numbers of variables and clauses excessively. This work eliminates the indicated drawback by interpolating constraint symbols and the set of natural numbers $${\mathbb {N}}$$ into the alphabet of propositional logic and adjusting the underlying language accordingly. In the extended logic counting constraints are naturally formulated, while many important aspects, such as Boolean nature and the soundness and completeness theorems, are kept preserved.

SEMANTICS FOR PURE THEORIES OF CONNEXIVE IMPLICATION

AbstractIn this article, I provide Urquhart-style semilattice semantics for three connexive logics in an implication-negation language (I call these “pure theories of connexive implication”). The systems semantically characterized include the implication-negation fragment of a connexive logic of Wansing, a relevant connexive logic recently developed proof-theoretically by Francez, and an intermediate system that is novel to this article. Simple proofs of soundness and completeness are given and the semantics is used to establish various facts about the systems (e.g., that two of the systems have the variable sharing property). I emphasize the intuitive content of the semantics and discuss how natural informational considerations underly each of the examined systems.

Domain Theoretic Second-Order Euler's Method for Solving Initial Value Problems

A domain-theoretic method for solving initial value problems (IVPs) is presented, together with proofs of soundness, completeness, and some results on the algebraic complexity of the method. While the common fixed-precision interval arithmetic methods are restricted by the precision of the underlying machine architecture, domain-theoretic methods may be complete, i.e., the result may be obtained to any degree of accuracy. Furthermore, unlike methods based on interval arithmetic which require access to the syntactic representation of the vector field, domain-theoretic methods only deal with the semantics of the field, in the sense that the field is assumed to be given via finitely-representable approximations, to within any required accuracy.In contrast to the domain-theoretic first-order Euler method, the second-order method uses the local Lipschitz properties of the field. This is achieved by using a domain for Lipschitz functions, whose elements are consistent pairs that provide approximations of the field and its local Lipschitz properties. In the special case where the field is differentiable, the local Lipschitz properties are exactly the local differential properties of the field. In solving IVPs, Lipschitz continuity of the field is a common assumption, as a sufficient condition for uniqueness of the solution. While the validated methods for solving IVPs commonly impose further restrictions on the vector field, the second-order Euler method requires no further condition. In this sense, the method may be seen as the most general of its kind.To avoid complicated notations and lengthy arguments, the results of the paper are stated for the second-order Euler method. Nonetheless, the framework, and the results, may be extended to any higher-order Euler method, in a straightforward way.

Секвенційні числення першопорядкових логік часткових предикатів з розширеними реномінаціями та композицією предикатного доповнення

We study new classes of program-oriented logical formalisms – pure first-order logics of quasiary predicates with extended renominations and a composition of predicate complement. For these logics, various logical consequence relations are specified and corresponding calculi of sequent type are constructed. We define basic sequent forms for the specified calculi and closeness conditions. The soundness, completeness, and counter-model existence theorems are proved for the introduced calculi.

Towards a Formal IoT Security Model

The heterogeneity of Internet of Things (IoT) systems has so far prevented the definition of adequate standards, hence making it difficult to compare meaningfully the security degree of diverse architectural choices. This task can be nonetheless achieved with formal methodologies. However, the dedicated IoT literature shows no evidence of a universal model allowing the security evaluation of any arbitrary system. Based on these considerations, we propose a new model that aims at being global and all-encompassing. Our model can be used to fairly analyse the security level of different IoT systems and compare them in a significant way. It is designed to be adaptive with realistic definitions of the adversary’s (1) actions of interacting with IoT systems; (2) capabilities of accessing the data generated by and exchanged in IoT systems with established rules; and (3) objectives of attacking IoT systems according to the four recognised security properties of confidentiality, integrity, availability and soundness. Such a design enables the straightforward characterization of new adversaries. It further helps in providing a fine-grained security evaluation of IoT systems by either accurately describing attacks against the analysed systems or formally proving their guaranteed level of security.

Scala step-by-step: soundness for DOT with step-indexed logical relations in Iris

The metatheory of Scala’s core type system—theDependent Object Types (DOT)calculus—is hard to extend, like the metatheory of other type systems combining subtyping and dependent types. Soundness of important Scala features therefore remains an open problem in theory and in practice. To address some of these problems, we use asemantics-firstapproach to develop a logical relations model for a new version of DOT, calledguarded DOT (gDOT). Our logical relations model makes use of an abstract form ofstep-indexing, as supported by the Iris framework, to model various forms of recursion in gDOT. To demonstrate the expressiveness of gDOT, we show that it handles Scala examples that could not be handled by previous versions of DOT, and prove using our logical relations model that gDOT provides the desired data abstraction. The gDOT type system, its semantic model, its soundness proofs, and all examples in the paper have been mechanized in Coq.

Raising expectations: automating expected cost analysis with types

This article presents a type-based analysis for deriving upper bounds on the expected execution cost of probabilistic programs. The analysis is naturally compositional, parametric in the cost model, and supports higher-order functions and inductive data types. The derived bounds are multivariate polynomials that are functions of data structures. Bound inference is enabled by local type rules that reduce type inference to linear constraint solving. The type system is based on the potential method of amortized analysis and extends automatic amortized resource analysis (AARA) for deterministic programs. A main innovation is that bounds can contain symbolic probabilities, which may appear in data structures and function arguments. Another contribution is a novel soundness proof that establishes the correctness of the derived bounds with respect to a distribution-based operational cost semantics that also includes nontrivial diverging behavior. For cost models like time, derived bounds imply termination with probability one. To highlight the novel ideas, the presentation focuses on linear potential and a core language. However, the analysis is implemented as an extension of Resource Aware ML and supports polynomial bounds and user defined data structures. The effectiveness of the technique is evaluated by analyzing the sample complexity of discrete distributions and with a novel average-case estimation for deterministic programs that combines expected cost analysis with statistical methods.

Separation logic for sequential programs (functional pearl)

This paper presents a simple mechanized formalization of Separation Logic for sequential programs. This formalization is aimed for teaching the ideas of Separation Logic, including its soundness proof and its recent enhancements. The formalization serves as support for a course that follows the style of the successful Software Foundations series, with all the statement and proofs formalized in Coq. This course only assumes basic knowledge of lambda-calculus, semantics and logics, and therefore should be accessible to a broad audience.

ANALISIS RASIO INETERNAL PERUSAHAAN YANG BERPENGARUH TERHADAP PROFITABILITAS PADA PERUSAHAAN SUB SEKTOR PERBANKAN KONVENSIONAL

The bank's financial performance can be assessed from several indicators, one of the main indicators used as the basis for the assessment is the bank's financial statements. Based on the financial statements, a number of financial ratios can be calculated which are commonly used as a basis for assessing the soundness of a bank. Financial ratios are the results of calculations of bank financial data, which are used to explain the relationship between financial data. Financial ratios that can measure financial performance, can be referred to as internal ratios. The purpose of this study was to determine the effect of Net Interest Margin (NIM), Net Performing Loans (NPL), Loan to Deposit Ratio (LDR), and Capital Adequacy Ratio (CAR) on Return on Assets (ROA). The study uses quantitative methods by taking samples of conventional commercial banking companies listed on the Indonesia Stock Exchange from 2016 to 2018. The sampling technique in this study was purposive sampling with a sample of 19 banking companies. Data analysis techniques used descriptive analysis with panel data regression models using eviews 10. The results showed that the Net Interest Margin (NIM) had a significant positive effect on Return On Assets (ROA), so that banking companies had to keep NIM at a high ratio by maintaining loan asset quality and operating expense efficiency; Non Performing Loans (NPLs) have a significant negative effect on profitability (ROA), so as to increase Return On Assets (ROA) banking companies must keep their Net Performing Loans (NPLs) at a low ratio by suppressing the existence of problem loans through loan restructuring; Loan To Deposit Ratio (LDR) has no effect on Return On Assets (ROA), so that banking companies must increase lending so that profits from loan interest obtained will increase, but lending must be done prudentially and compliance so as not to cause non-performing loans; and Capital Adequacy Ratio (CAR) has no effect on profitability (ROA), so banks must improve efficiency and reduce problem financing.

Natural deduction and semantic models of justification logic in the proof assistant Coq

Abstract The purpose of this paper is to present a formalization of the language, semantics and axiomatization of justification logic in Coq. We present proofs in a natural deduction style derived from the axiomatic approach of justification logic. Additionally, we present possible world semantics in Coq based on Fitting models to formalize the semantic satisfaction of formulas. As an important result, with this implementation, it is possible to give a proof of soundness for $\mathsf{L}\mathsf{P}$ with respect to Fitting models.

Causality analysis and fault ascription in component-based systems

This article introduces a general framework for fault ascription, which consists in identifying, within a multi-component system, the components whose faulty behavior has caused the failure of said system. Our framework uses configuration structures as a general semantical model to handle truly concurrent executions, partial and distributed observations in a uniform way. As a first contribution, and in contrast with most of the current literature on counterfactual analysis which relies heavily on a set of toy examples, we first define a set of expected formal properties for counterfactual builders, i.e. operators that build counterfactual executions. We then show that causality analyses that satisfy our requirements meet a set of elementary soundness and completeness properties. Finally we present a concrete causality analysis meeting all our requirements, and we show that it behaves well under refinement. We present several examples illustrating various phenomena such as causal over-determination or observational determinism, and we discuss the relationship of our approach with Halpern and Pearl's actual causality analysis.

A complete axiomatization of weighted branching bisimulation

We propose an axiomatization for weighted branching bisimulation over a weighted process algebra with positive rational weights including zero and show that this axiomatization is both sound and complete. Our proof of soundness and completeness are inspired by similar results by Milner for strong and weak bisimulation and by van Glabbeek for branching bisimulation. We also show that the claim that weighted branching bisimilarity is an equivalence relation indeed holds true. As auxiliary results, we give two alternative characterizations of weighted branching bisimulation, one in terms of weighted stuttering transitions and another in terms of a relative branching base which can be seen as a linear basis from which we can construct all weighted stuttering transitions.

Hydration and soundness properties of phosphoric acid modified steel slag powder

The utilization of steel slag powder (SS) for blended cement has been hindered for its low hydration activity and poor soundness. In this investigation, a new method of using phosphoric acid (HP) with anhydrous ethanol as the solvent to modify the SS is put forward. The effects of HP pretreatment on the mineral compositions, specific surface area, hydration activity and soundness of SS and SS blended cement were investigated. Results show that the optimum dosage of HP is 4 wt% of the SS. At this dosage, the amount of free-CaO in the SS is reduced from 2.03% to 1.01%, and the specific surface area of the SS is increased from 3.26 m2/g to 7.07 m2/g. In addition, the 72 h hydration heat of SS paste is raised from 33.85 J/g to 59.44 J/g, the 3 d and 7 d compressive strength of SS paste is nearly doubled, and the soundness has been greatly improved. While for the cement pastes containing HP modified SS, the dosage of HP for pretreating SS should below 4 wt% in order to avoid the excessive corrosion of active minerals in SS and the retard effect of PO43−.

Correctness checking for BPMN collaborations with sub-processes

BPMN collaboration models are commonly used to describe the behaviour and interactions of processes in an inter-organisational context. An important role in this kind of models is played both by the message flow, and by sub-processes. The interplay between these features of BPMN models can conceal subtle or unexpected effects, which makes the design activity error-prone, thus leading to the possible inclusion of incorrect behaviour. In this paper, we face this problem by providing a framework for checking the correctness of BPMN models. In particular we are interested on collaboration models that include message exchange and/or sub-processes, and with a special focus on properties well-established in the business process domain, namely safeness and soundness. To enable such a verification, we have (i) defined an operational semantics for BPMN collaborations, (ii) formalised safeness and soundness properties, and a new relaxed version of soundness for detecting situations where asynchronous messages are not handled correctly by the receiver, (iii) applied the related checks on state-space representations (i.e., labelled transition systems) of collaborations, and (iv) implemented the overall formal framework that has been also integrated in the Camunda modelling environment. The resulting verification framework and tool, named S3, have been validated in relation to its effectiveness, efficiency and usability, both by using models available on a publicly accessible repository, and by carrying out experiments with a group of designers.

Exactly true and non-falsity logics meeting infectious ones

In this paper, we study logical systems which represent entailment relations of two kinds. We extend the approach of finding ‘exactly true’ and ‘non-falsity’ versions of four-valued logics that emerged in series of recent works [Pietz & Rivieccio (2013). Nothing but the truth. Journal of Philosophical Logic, 42(1), 125–135; Shramko (2019). Dual-Belnap logic and anything but falsehood. Journal of Logics and their Applications, 6, 413–433; Shramko et al. (2017). First-degree entailment and its relatives. Studia Logica, 105(6), 1291–1317] to the case of infectious logics, namely to the case of Deutsch's logic introduced in Deutsch [Relevant analytic entailment. The Relevance Logic Newsletter, 2(1), 26–44; The completeness of S. Studia Logica, 38(2), 137–147]. The particular systems obtained in this way are and . We present them in the form of sequent calculi and prove corresponding soundness and completeness theorems. We illuminate the connection between , and two well-known systems, strong Kleene three-valued logic and Priest's Logic of Paradox . This connection allows us to investigate the characterisation of the entailment relations associated with and as well as to introduce the notion of ‘infectious analogue’ of a certain logic. We also study implicative extensions of and and prove soundness and completeness theorems for them as well.

Deciding Quantifier-free Definability in Finite Algebraic Structures

This work deals with the definability problem by quantifier-free first-order formulas over a finite algebraic structure. We show the problem to be coNP-complete and present a decision algorithm based on a semantical characterization of definable relations as those preserved by isomorphisms of substructures. Our approach also includes the design of an algorithm that computes the isomorphism type of a tuple in a finite algebraic structure. Proofs of soundness and completeness of the algorithms are presented, as well as empirical tests assessing their performances.