Proof Rules Research Articles

Iteration-free PDL with storing, recovering and parallel composition: a complete axiomatization

We devote this paper to the axiomatization/completeness of PRSPDL0 - a variant of iteration-free PDL with parallel composition. Our results are based on the following: although the program operation of parallel composition is not modally definable in the ordinary language of PDL, it becomes definable in a modal language strengthened by the introduction of propositional quantifiers. Instead of using axioms to define the program operation of parallel composition in the language of PDL enlarged with propositional quantifiers, we add an unorthodox rule of proof that makes the canonical model standard for the program operation of parallel composition and we use large programs for the proof of the Truth Lemma.

The Unit-B method: refinement guided by progress concerns

We present Unit-B, a formal method inspired by Event-B and UNITY. Unit-B aims at the stepwise design of software systems satisfying safety and liveness properties. The method features the novel notion of coarse and fine schedules, a generalisation of weak and strong fairness for specifying events' scheduling assumptions. Based on events schedules, we propose proof rules to reason about progress properties and a refinement order preserving both liveness and safety properties. We illustrate our approach by an example to show that systems development can be driven by not only safety but also liveness requirements.

Parametrized invariance for infinite state processes

We study the uniform verification problem for infinite state processes. This problem consists of proving that the parallel composition of an arbitrary number of processes running the same program (or a finite collection of programs) satisfies a temporal property. Our practical motivation is to build a general framework for the temporal verification of concurrent datatypes. In this paper we propose a general method for the verification of safety properties of parametrized programs that manipulate complex local and global data, including mutable state in the heap. Our method is based on a clear division between the following two dimensions of the problem: the interaction between executing threads—handled by novel parametrized invariance proof rules, and the data being manipulated—handled by specialized decision procedures. Our proof rules discharge automatically a finite collection of verification conditions. The size of this collection depends only on the size of the program and the specification, but not on the number of processes in any given instance or on the kind of data manipulated. Moreover, all verification conditions are quantifier free, which eases the development of decision procedures for complex data-types on top of off-the-shelf SMT solvers. We prove soundness of our proof rules and illustrate their application in the formal verification of (1) two infinite-state mutual exclusion protocols; (2) shape and functional correctness properties of several concurrent data-types, including fine-grained and non-blocking concurrent lists and queues. We report empirical results using a prototype implementation of the proof rules and decision procedures.

Integrating deductive verification and symbolic execution for abstract object creation in dynamic logic

We present a fully abstract weakest precondition calculus and its integration with symbolic execution. Our assertion language allows both specifying and verifying properties of objects at the abstraction level of the programming language, abstracting from a specific implementation of object creation. Objects which are not (yet) created never play any role. The corresponding proof theory is discussed and justified formally by soundness theorems. The usage of the assertion language and proof rules is illustrated with an example of a linked list reachability property. All proof rules presented are fully implemented in a version of the KeY verification system for Java programs.

Symbolic Execution Proofs for Higher Order Store Programs

Higher order store programs are programs which store, manipulate and invoke code at runtime. Important examples of higher order store programs include operating system kernels which dynamically load and unload kernel modules. Yet conventional Hoare logics, which provide no means of representing changes to code at runtime, are not applicable to such programs. Recently, however, new logics using nested Hoare triples have addressed this shortcoming. In this paper we describe, from top to bottom, a sound semi-automated verification system for higher order store programs. We give a programming language with higher order store features, define an assertion language with nested triples for specifying such programs, and provide reasoning rules for proving programs correct. We then present in full our algorithms for automatically constructing correctness proofs. In contrast to earlier work, the language also includes ordinary (fixed) procedures and mutable local variables, making it easy to model programs which perform dynamic loading and other higher order store operations. We give an operational semantics for programs and a step-indexed interpretation of assertions, and use these to show soundness of our reasoning rules, which include a deep frame rule which allows more modular proofs. Our automated reasoning algorithms include a scheme for separation logic based symbolic execution of programs, and automated provers for solving various kinds of entailment problems. The latter are presented in the form of sets of derived proof rules which are constrained enough to be read as a proof search algorithm.

On the relation between Concurrent Separation Logic and Concurrent Kleene Algebra

We investigate the connection between a general form of Concurrent Separation Logic (CSL), a logic for modular reasoning about concurrent programs, and Concurrent Kleene Algebra (CKA), which provides an axiomatic approach to models of concurrency. We show how the proof theory of a general form of CSL can be embedded in a variation on the notion of CKA. Our embedding, however, induces models of a particular form based on predicate transformers. We also investigate the relation between concrete models of CSL based on interleaving of traces and CKA. We find, curiously, that the validity of CSL's Concurrency proof rule in these models does not follow from or otherwise utilize CKA structure, but that a CKA structure exists nonetheless which can give a different model of the CSL proof rules.Our results can be read as providing a completeness theorem showing a sense in which nothing is missing as far as proof power goes in (a variant on) the notion of CKA, while at the same time showing that CKAs impose constraints that rule out some natural CSL models.

A constraint-based approach to solving games on infinite graphs

We present a constraint-based approach to computing winning strategies in two-player graph games over the state space of infinite-state programs. Such games have numerous applications in program verification and synthesis, including the synthesis of infinite-state reactive programs and branching-time verification of infinite-state programs. Our method handles games with winning conditions given by safety, reachability, and general Linear Temporal Logic (LTL) properties. For each property class, we give a deductive proof rule that --- provided a symbolic representation of the game players --- describes a winning strategy for a particular player. Our rules are sound and relatively complete. We show that these rules can be automated by using an off-the-shelf Horn constraint solver that supports existential quantification in clause heads. The practical promise of the rules is demonstrated through several case studies, including a challenging "Cinderella-Stepmother game" that allows infinite alternation of discrete and continuous choices by two players, as well as examples derived from prior work on program repair and synthesis.

Ograniczenie zasady działania sądu z urzędu i jego wpływ na wyrokowanie

The adversarial principle is merely the name of a specific type of organizing process, not a specific Directive of criminal proceedings. The adversarial principle is uniformly recognized as non-codified directive, according to which the criminal process is conducted in the form of equal sides dispute before the impartial court. The adversarial principle in criminal proceedings is something other than adversarial in civil proceedings. The adversarial principle was exposed in the course of work on the revision of the Code of criminal proceedings. The creators of the reform emphasized that Article 167 § 1 of the Code of criminal proceedings differently than it did before, sets out the rules of proof, giving this task in the hands of the parties, leaving only the court admissibility of evidence, and reducing the possibility of taking evidence by the court to exceptional cases justified special circumstances. The creators of the reform emphasized that Article 167 § 1 of the Code of criminal proceedings differently than it did before, sets out the rules of taking of evidence, giving this process to the parties, leaving only the admissibility of evidence to the court, and reducing the possibility of taking evidence by the court to exceptional cases justified by special circumstances. Will be changed the rules for transfer of the court materials from preliminary proceedings. Another important issue is the systematization of the list of evidence, in accordance with the modified Article 333 § 1 of the Code of Criminal Procedure and solutions for planning of court hearings. May cause discussions restriction the possibility of taking the initiative of the evidence by the court. The changes enforce proactive stance of the accused, even though he should be able to take advantage of the „right to silence”. Militate against the principle of adversarial problems brought to light on the background of the appeal proceedings. You can express its concern that the adversarial principle in the present approach will detrimental to the presumption of innocence, leading to a model of „proceedings for the rich”. These changes will force to remodel the psyche of judges who feel guilty persons determining cases of dispute run by the parties, not the players involved who have the task of replacing the prosecutor.

Relaxed separation logic

We introduce relaxed separation logic (RSL), the first program logic for reasoning about concurrent programs running under the C11 relaxed memory model. From a user's perspective, RSL is an extension of concurrent separation logic (CSL) with proof rules for the various kinds of C11 atomic accesses. As in CSL, individual threads are allowed to access non-atomically only the memory that they own, thus preventing data races. Ownership can, however, be transferred via certain atomic accesses. For SC-atomic accesses, we permit arbitrary ownership transfer; for acquire/release atomic accesses, we allow ownership transfer only in one direction; whereas for relaxed atomic accesses, we rule out ownership transfer completely. We illustrate RSL with a few simple examples and prove its soundness directly over the axiomatic C11 weak memory model.

Compositional probabilistic verification through multi-objective model checking

Compositional approaches to verification offer a powerful means to address the challenge of scalability. In this paper, we develop techniques for compositional verification of probabilistic systems based on the assume-guarantee paradigm. We target systems that exhibit both nondeterministic and stochastic behaviour, modelled as probabilistic automata, and augment these models with costs or rewards to reason about, for example, energy usage or performance metrics. Despite significant theoretical advances in compositional reasoning for probabilistic automata, there has been a distinct lack of practical progress regarding automated verification. We propose a new assume-guarantee framework based on multi-objective probabilistic model checking which supports compositional verification for a range of quantitative properties, including probabilistic ω-regular specifications and expected total cost or reward measures. We present a wide selection of assume-guarantee proof rules, including asymmetric, circular and asynchronous variants, and also show how to obtain numerical results in a compositional fashion. Given appropriate assumptions to be used in the proof rules, our compositional verification methods are, in contrast to previously proposed approaches, efficient and fully automated. Experimental results demonstrate their practical applicability on several large case studies, including instances where conventional probabilistic verification is infeasible.

Axiomatic Basis for Computer Programming

This paper considers a formal method, known as axiomatic semantics, used to prove the correctness of a computer program. This formal method extracts, using some proof rules, the mathematical verification conditions from a computer program. The axioms of program flow, including, sequential flow, iteration, and alternation flows are presented. Using the axiomatic basis the completeness of two variants of integer multiplication program is proved. Results show that computer programs can actually be verified sufficiently for correctness without necessarily testing them, or more practically put, to complement their testing.

Specification patterns for reasoning about recursion through the store

Higher-order store means that code can be stored on the mutable heap that programs manipulate, and is the basis of flexible software that can be changed or reconfigured at runtime.Specifying such programs is challenging because higher-order store allows recursion through the store, where new (mutual) recursions between code are set up on the fly.This paper presents a series of formal specification patterns that capture increasingly complex uses of recursion through the store. To express the necessary specifications we extend the separation logic for higher-order store given by Schwinghammer et al. (CSL, 2009), adding parameter passing, and certain recursively defined families of assertions.We give proof rules for our extended logic and show their soundness. Finally, we apply our specification patterns and rules to an example program that exploits many of the possibilities offered by higher-order store; this is the first larger case study conducted with logical techniques based on work by Schwinghammer et al. (CSL, 2009), and shows that they are practical.

Modular verification of preemptive OS kernels

AbstractMost major OS kernels today run on multiprocessor systems and are preemptive: it is possible for a process running in the kernel mode to get descheduled. Existing modular techniques for verifying concurrent code are not directly applicable in this setting: they rely on scheduling being implemented correctly, and in a preemptive kernel, the correctness of the scheduler is interdependent with the correctness of the code it schedules. This interdependency is even stronger in mainstream kernels, such as those of Linux, FreeBSD or Mac OS X, where the scheduler and processes interact in complex ways. We propose the first logic that is able to decompose the verification of preemptive multiprocessor kernel code into verifying the scheduler and the rest of the kernel separately, even in the presence of complex interdependencies between the two components. The logic hides the manipulation of control by the scheduler when reasoning about preemptable code and soundly inherits proof rules from concurrent separation logic to verify it thread-modularly. We illustrate the power of our logic by verifying an example scheduler, which includes some of the key features of the scheduler from Linux 2.6.11 challenging for verification.

Verifying B proof rules using deep embedding and automated theorem proving

We propose a formal and mechanized framework which consists in verifying proof rules of the B method, which cannot be automatically proved by the elementary prover of Atelier B and using an external automated theorem prover called Zenon. This framework contains in particular a set of tools, named BCARe and developed by Siemens IC-MOL, which relies on a deep embedding of the B theory within the logic of the Coq proof assistant. This toolkit allows us to automatically generate the required properties to be checked for a given proof rule. Currently, this tool chain is able to automatically verify a part of the derived rules of the B-Book, as well as some added rules coming from Atelier B and the rule database maintained by Siemens IC-MOL.

Local Reasoning for Global Invariants, Part II

Dedicated to the memory of John C. Reynolds (1935--2013). The hiding of internal invariants creates a mismatch between procedure specifications in an interface and proof obligations on the implementations of those procedures. The mismatch is sound if the invariants depend only on encapsulated state, but encapsulation is problematic in contemporary software due to the many uses of shared mutable objects. The mismatch is formalized here in a proof rule that achieves flexibility via explicit restrictions on client effects, expressed using ghost state and ordinary first order assertions. The restrictions amount to a stateful frame condition that must be satisfied by any client; this dynamic encapsulation boundary complements conventional scope-based encapsulation. The technical development is based on a companion article, Part I, that presents Region Logic---a programming logic with stateful frame conditions for commands.

The ramifications of sharing in data structures

Programs manipulating mutable data structures with intrinsic sharing present a challenge for modular verification. Deep aliasing inside data structures dramatically complicates reasoning in isolation over parts of these objects because changes to one part of the structure (say, the left child of a dag node) can affect other parts (the right child or some of its descendants) that may point into it. The result is that finding intuitive and compositional proofs of correctness is usually a struggle. We propose a compositional proof system that enables local reasoning in the presence of sharing. While the AI "frame problem" elegantly captures the reasoning required to verify programs without sharing, we contend that natural reasoning about programs with sharing instead requires an answer to a different and more challenging AI problem, the "ramification problem": reasoning about the indirect consequences of actions. Accordingly, we present a RAMIFY proof rule that attacks the ramification problem head-on and show how to reason with it. Our framework is valid in any separation logic and permits sound compositional and local reasoning in the context of both specified and unspecified sharing. We verify the correctness of a number of examples, including programs that manipulate dags, graphs, and overlaid data structures in nontrivial ways.

High-level separation logic for low-level code

Separation logic is a powerful tool for reasoning about structured, imperative programs that manipulate pointers. However, its application to unstructured, lower-level languages such as assembly language or machine code remains challenging. In this paper we describe a separation logic tailored for this purpose that we have applied to x86 machine-code programs. The logic is built from an assertion logic on machine states over which we construct a specification logic that encapsulates uses of frames and step indexing. The traditional notion of Hoare triple is not applicable directly to unstructured machine code, where code and data are mixed together and programs do not in general run to completion, so instead we adopt a continuation-passing style of specification with preconditions alone. Nevertheless, the range of primitives provided by the specification logic, which include a higher-order frame connective, a novel read-only frame connective, and a 'later' modality, support the definition of derived forms to support structured-programming-style reasoning for common cases, in which standard rules for Hoare triples are derived as lemmas. Furthermore, our encoding of scoped assembly-language labels lets us give definitions and proof rules for powerful assembly-language 'macros' such as while loops, conditionals and procedures. We have applied the framework to a model of sequential x86 machine code built entirely within the Coq proof assistant, including tactic support based on computational reflection.

The Role of Social Image Concerns in the Design of Legal Regimes

We consider situations where legal liability yields insufficient incentives for socially efficient behavior, e.g., individuals who cause harm are not always sued or are unable to pay fully for harm done. Some individuals nevertheless behave efficiently because of intrinsic prosocial concerns. Others have no such concerns but would like people to believe that they do. We show that fault-based liability is generally more effective than strict liability in harnessing social image concerns. This extends to the case where courts can make mistakes. The rules of proof then affect the inferences drawn from court decisions and therefore the stigma attached to an adverse judgment. If fault is a rare event, plaintiffs or prosecutors should bear the burden of proving the defendant’s fault; otherwise there are cases where defendants should prove compliance with the legal standard of behavior. Under either assignment of the burden of proof, incentives to comply are maximized by a standard of proof stronger than a mere preponderance of evidence.

When enough is enough: how the decision was made to stop the FEAST trial: data and safety monitoring in an African trial of Fluid Expansion As Supportive Therapy (FEAST) for critically ill children

In resource-rich countries, bolus fluid expansion is routinely used for the treatment of poor perfusion and shock, but is less commonly used in many African settings. Controversial results from the recently completed FEAST (Fluid Expansion As Supportive Therapy) trial in African children have raised questions about the use of intravenous bolus fluid for the treatment of shock. Prior to the start of the trial, the Independent data monitoring committee (IDMC) developed stopping rules for the proof of benefit that bolus fluid resuscitation would bring. Although careful safety monitoring was put in place, there was less expectation that bolus fluid expansion would be harmful and differential stopping rules for harm were not formulated.In July 2010, two protocol amendments were agreed to increase the sample size from 2,880 to 3,600 children, and to increase bolus fluid administration. There was a non-significant trend against bolus treatment, but although the implications were discussed, the IDMC did not comment on the results, or on the amendments, in order to avoid inadvertent partial unblinding of the study.In January 2011, the trial was stopped for futility, as the combined intervention arms had significantly higher mortality (relative risk 1.46, 95% CI 1.13 to 1.90, P = 0.004) than the control arm. The stopping rule for proof of benefit was not achieved, and the IDMC stopped the trial with a lower level of significance (P = 0.01) due to futility and an increased risk of mortality from bolus fluid expansion in children enrolled in the trial. The basis for this decision was that the local standard of care was not to use bolus fluid for the care of children with shock in these African countries, and this was a different standard of care to that used in the UK. These decisions emphasize two important principles: firstly, the IDMC should avoid inadvertent unblinding of the trial by commenting on amendments, and secondly, when considering stopping a trial, the IDMC should be guided by the local standard of care rather than standards of care in other parts of the world.

On the burden of proof in civil procedure

The appliance of burden of proof rules is conceived of assumption that evidences are taken and that court didn't reach the required degree of conviction of a particular fact, what implies limitation of application of these rules on proceedings in which the judgment is rendered after the plenary proceedings. The Code of Civil Procedure (CCP) has no suitable answers for the problems arising from new conception of the principle of party control of facts and means of proof in Serbian litigation legislature, by which the court has no more power to take the evidence ex offo. There is no answer to the question how should court conduct when evidence is not taken because of a lack of parties' indication of the means of proof. In this case courts practice somehow wider conception of burden of proof rules, which however has no explicit legal ground. They are applying them even though evidences are not taken. In any case it would be useful to reformulate basic rule of burden of proof in manner which would correspondent to the new conception of the principle of party presentation. The rule of burden of proof applies when the high degree of conviction of facts is demanded from the court, in order to render the judgment. Consequently this rule loses its' sense when mere probability of factual findings is demanded. The broader conception of parties' representation principle however does not liberate court from his responsibility to clarify facts that should be base for adjudication. Circumstance that CCP does mention the principle of material truth anymore should not be seen as argument for liberation of mentioned responsibility. It is still expected from the court to be active. Only when joint effort of the court and parties is left without of goal, in sense that court doesn't reach the high degree conviction, there would be ground for burden of proof rule's application. In this situation court also must justify why he couldn't reach required degree of conviction, i.e. he must give clear reasons for the cause of application of burden of proof rules. Thus the role of the court is not relieved, nor does the application of burden of proof provisions mean the liberation from the duty to evaluate the evidences and reasoning the impossibility of reaching the required degree of conviction. In the case when evidences are not taken at all the application of burden of proof rule could be only justified with the idea that else unacceptable results would arise - substantive legal protection and favoritism of the party who didn't make any effort to proof its factual allegations.