Proofs Of Program Correctness Research Articles

Synthesis of circular compositional program proofs via abduction

This paper presents a new technique for synthesizing circular compositional proofs of program correctness. Our technique uses abductive inference to decompose the proof into small lemmas (i.e., compositionality) and proves that each lemma is not the first one to fail (i.e., circularity). Our approach represents lemmas as small program fragments annotated with pre and post-conditions and uses different tools to discharge each different lemma. This approach allows us to combine the strengths of different verifiers and addresses scalability concerns, as each lemma concerns the correctness of small syntactic fragments of the program. We have implemented our proposed technique for generating circular compositional proofs and used four different program analysis tools to discharge the proof subgoals. We evaluate our approach on a collection of synthetic and real-world benchmarks and show that our technique can successfully verify applications that cannot be verified by any individual technique.

Operational Semantics for Lazy Evaluation

An operational semantics for lazy evaluation of a calculus without higher order functions was defined. Although it optimizes many aspects of implementation, e.g. there is a sharing in the recursive computation, there is no α conversion, the heap is automatically reclaimed, and an attempt to evaluate an argument is done at most once. It is still suitable for reasoning about program behavior and proofs of program correctness; this is primarily due to the definition via inferences and axioms which allows for proofs by induction on the height of the proof tree. We also proved the correctness of this operational semantics by showing that it is equivalent with respect to the values calculated to the operational semantics of LAZY-PCF+SHAR due to S. Purushothaman Iyer and Jill Seaman.

Synthetic Topology: of Data Types and Classical Spaces

Synthetic topology as conceived in this monograph has three fundamental aspects: 1. to explain what has been done in classical topology in conceptual terms, 2. to provide one-line, enlightening proofs of the theorems that constitute the core of the theory, and 3. to smoothly export topological concepts and theorems to unintended situations, keeping the synthetic proofs unmodified. The unintended situation that we focus on is the theory of computation, in particular regarding programming languages from both operational (Part I) and denotational (Part III) points of view, with emphasis on sequential computation. We are aware of other applications of synthetic topology, e.g. to locales, convergence spaces, sequential spaces, equilogical spaces, and some sheaf and realizability toposes, but this will be reported elsewhere. Aspects 1 and 2 are the subject of Part II. However, it turns out that it is possible to tackle aspect 3 without previous reference to 1 or 2. In fact, we start by developing synthetic topology of programming-language data types in Part I, without assuming any background in classical topology and without introducing any. Part III combines ideas from Parts I and II, developing non-trivial computational applications. The main new result is a computational version of the Tychonoff theorem. We also review previously known applications and explain how topology and semantics interact in program-correctness proofs. Although computers are finite, infinity shows up in a number of important situations in the theory of computation, e.g. infinity in syntax : loops, recursion; infinity in time: non-terminating computations; infinity of data: stream computation and higher-type computation; infinity in precision: real-number computation; infinity through abstraction: probabilistic descriptions. The first few chapters of Part I explore how the fundamental topological notions of continuous map, open set, closed set, compact set, Hausdorff space, and discrete space reconcile the finite character of computers with the infinite nature of the entities one wishes to calculate with. One of the main contributions of this monograph is to explain the computational nature of the the notion of compactness. Roughly speaking, a set is compact if and only if, given any semidecidable property, one can semidecide whether it holds for all elements of the set in finite time. Surprisingly, there are infinite computationally compact sets, for example that of infinite streams of binary digits.

Secure mechanical verification of mutually recursive procedures

The verification of programs that contain mutually recursive procedures is a difficult task, and one which has not been satisfactorily addressed in the literature. Published proof rules have been later discovered to be unsound. Verification condition generator (VCG) tools have been effective in partially automating the verification of programs, but in the past these VCG tools have in general not themselves been proven, so any proof using and depending on these VCGs might not be sound. In this paper, we present a set of proof rules for proving the partial correctness of programs with mutually recursive procedures, together with a VCG that automates the use of the proof rules in program correctness proofs. The soundness of the proof rules and the VCG itself have been mechanically proven within the Higher Order Logic theorem prover, with respect to the underlying structural operational semantics of the programming language. This proof of soundness then forms the core of an implementation of the VCG that significantly eases the verification of individual programs with complete security.

THE FASTEST AND SHORTEST ALGORITHM FOR ALL WELL-DEFINED PROBLEMS

An algorithm M is described that solves any well-defined problem p as quickly a the fastest algorithm computing a solution to p, save for a factor of 5 and low-order additive terms. M optimally distributes resources between the execution of provably correct p-solving programs and an enumeration of all proofs, including relevant proofs of program correctness and of time bounds on program runtimes. M avoids Blum's speed-up theorem by ignoring programs without correctness proof. M has broader applicability and can be faster than Levin's universal search, the fastest method for inverting functions save for a large multiplicative constant. An extension of Kolmogorov complexity and two novel natural measures of function complexity are used to show the most efficient program computing some function f is also among the shortest programs provably computing f.

Can a Numerical Computation Prove Anything

The answer is yes--if you read the question the right way. However, anyone writing an editorial with a title such as this one must first define computation. The writer can then speculate on the real issue: is a computation ever proof? Giving a definition often means ruling out things that the object to be defined is not. For this discussion, I've ruled out proofs of program correctness, even automated ones. And I've ruled out the whole subject of combinatorics (where questions can occasionally be answered by looking at a number of specific cases). The computer-assisted proof of the Four-Color Theorem is the most famous example of this type. So that leaves numerical computation, in particular, if and when the result of a numerical (floating-point) computation gives a proof.

Rigorous proofs of program correctness without formal logic

Three fundamental principles of static reasoning used to write imperative program code with built-in proof of its correctness are presented and explained in operational terms. It is argued that, although the traditional use of formal logic in the Hoare-Dijkstra-Gries methodology is probably the most efficient way to write code with built-in proofs of correctness, the ideas underlying that methodology are much simpler than commonly perceived through the veil of formal logic and axiomatic semantics. Examples are given illustrating principles and techniques for deriving code from specifications, using the informal reasoning of the mathematician without either the terminology or notation of formal logic.

Abstract interpretation and application to logic programs

Abstract interpretation is a theory of semantics approximation that is used for the construction of semantic-based program analysis algorithms (sometimes called “data flow analysis”), the comparison of formal semantics (e.g., construction of a denotational semantics from an operational one), design of proof methods, etc. Automatic program analysers are used for determining statistically conservative approximations of dynamic properties of programs. Such properties of the run-time behavior of programs are useful for debugging (e.g., type inference), code optimization (e.g., compile-time garbage collection, useless occur-check elimination), program transformation (e.g., partial evaluation, parallelization), and even program correctness proofs (e.g., termination proof). After a few simple introductory examples, we recall the classical framework for abstract interpretation of programs. Starting from a ground operational semantics formalized as a transition system, classes of program properties are first encapsulated in collecting semantics expressed as fixpoints on partial orders representing concrete program properties. We consider invariance properties characterizing descendants of the initial states (corresponding to top/down or forward analyses), ascendant states of the final states (corresponding to bottom/up or backward analyses) as well as a combination of the two. Then we choose specific approximate abstract properties to be gathered about program behaviors and express them as elements of a poset of abstract properties. The correspondence between concrete and abstract properties is established by a concretization and abstraction function that is a Galois connection formalizing the loss of information. We can then constructively derive the abstract program properties from the collecting semantics by a formal computation leading to a fixpoint expression in terms of abstract operators on the domain of abstract properties. The design of the abstract interpreter then involves the choice of a chaotic iteration strategy to solve this abstract fixpoint equation. We insist on the compositional design of this abstract interpreter, which is formalized by a series of propositions for designing Galois connections (such as Moore families, decomposition by partitioning, reduced product, down-set completion, etc.). Then we recall the convergence acceleration methods using widening and narrowing allowing for the use of very expressive infinite domains of abstract properties. We show that this classical formal framework can be applied in extenso to logic programs. For simplicity, we use a variant of SLD-resolution as the ground operational semantics. The first example is groundness analysis, which is a variant of Mellish mode analysis. It is extended to a combination of top/down and bottom/up analyses. The second example is the derivation of constraints among argument sizes, which involves an infinite abstract domain requiring the use of convergence accelaration methods. We end up with a short thematic guide to the literature on abstract interpretation of logic programs.

Algorithms of the digital differential analyser genus implemented on an Intel 2920 signal processor

The concept of the digital differential analyser can be applied directly to programs for the Intel 2920 for the solution of differential equations. The technique is particularly useful where this solution is an analogue function which needs to be generated. One example quoted is that of sinusoidal generation. Error analysis and program correctness proofs are not considered in the paper

Approaches to Program Correctness

At the beginning of the computer age programs were verified primarily by spot checking them against precomputed values. Except for programmed diagnostics, which detect only specific classes of errors, this is till the only verification technique is general use today. A great deal of research is being devoted to new approaches. Generally speaking, these fall into three broad categories: systematic program testing, mathematical proofs of program correctness, and writing programs so that they are known to be correct in the first place. The last of these, writing programs that are known to be correct, appears to be already developed and ready for use. The first, systematic program testing, has reached the computer assisted stage. The extent of its usefulness in this form and the prospects for extending it to a fully automatic technique remain to be seen. The second, mathematical proofs of program correctness, will be restricted in its application to relatively trivial problems until at least one serious fundamental difficulty is overcome — the development of more powerful theorem provers.

Test data as an aid in proving program correctness

Proofs of program correctness tend to be long and tedious, whereas testing, though useful in detecting errors, usually does not guarantee correctness. This paper introduces a technique whereby test data can be used in proving program correctness. In addition to simplifying the process of providing correctness, this method simplifies the process of providing accurate specification for a program. The applicability of this technique to procedures and recursive programs is demonstrated.

Specification techniques for data abstractions

The main purposes in writing this paper are to discuss the importance of formal specifications and to survey a number of promising specification techniques. The role of formal specifications both in proofs of program correctness, and in programming methodologies leading to programs which are correct by construction, is explained. Some criteria are established for evaluating the practical potential of specification techniques. The importance of providing specifications at the right level of abstraction is discussed, and a particularly interesting class of specification techniques, those used to construct specifications of data abstractions, is identified. A number of specification techniques for describing data abstractions are surveyed and evaluated with respect to the criteria. Finally, directions for future research are indicated.

Specification techniques for data abstractions

Discusses the importance of formal specifications and surveys a number of promising specification techniques. The role of formal specifications both in proofs of program correctness and in programming methodologies leading to programs which are correct by construction, is explained. Some criteria are established for evaluating the practical potential of specification techniques. The importance of providing specifications at the right level of abstraction is discussed, and a particularly interesting class of specification techniques, those used to construct specifications of data abstractions, is identified. A number of specification techniques for describing data abstractions are surveyed and evaluated with respect to the criteria.

Proof of correctness of data representations

A powerful method of simplifying the proofs of program correctness is suggested; and some new light is shed on the problem of functions with side-effects.