Terminal Analysis Research Articles

Retaliatory Termination of Physician Employment by Hospitals: The Case of Zelman versus Cape Cod Hospital

A disturbing problem in the United States is that of illegal termination by hospitals of professional employees. Nurses, for example, have consistently decried poor staffing levels and, more recently in times of COVID-19, inadequate Personal Protective Equipment (PPE) that places both nurse and patient at high risk. For the most part, hospitals do little to correct these issues. The complaints have usually been kept “in house” and the nurses were expected to “stand down” once they’d complained. Physicians, who are now employees in growing numbers, have also filed formal complaints with professional associations, States’ licensing authorities, and also with States Boards of Health. When this happens, it is not unusual to hear that the physicians who were in good standing and who filed the complaints have been dismissed from their employment even in cases where the physicians have been long term employees of hospitals. Terminated medical employees have sued their former employers. This paper examines the issue of employment of professionals by hospitals, in particular physicians, and causes for termination that are legal. The paper will also examine, by means of analyzing a current case (Zelman), the termination of employment of a physician that appears to be illegal/retaliatory. The paper concludes by demonstrating civil penalties that can attach to the successful proof of retaliatory termination by reviewing of some recent cases that are illuminating in their outcomes.

Thread-modular counter abstraction: automated safety and termination proofs of parameterized software by reduction to sequential program verification

AbstractParameterized programs are composed of an arbitrary number of concurrent, infinite-state threads. Automated safety and liveness proofs of such parameterized software are hard; state-of-the-art methods for their formal verification rely on intricate abstractions and complicated proof techniques that impede automation. In this paper, we introduce thread-modular counter abstraction (TMCA), a lean new abstraction technique to replace the existing heavy proof machinery. TMCA is a structured abstraction framework built from a novel combination of counter abstraction, thread-modular reasoning, and predicate abstraction. Its major strength lies in reducing the parameterized verification problem to the sequential setting, for which powerful proof procedures, efficient heuristics, and effective automated tools have been developed over the past decades. In this work, we first introduce the TMCA abstraction paradigm, then present a fully automated method for parameterized safety proofs, and finally discuss its application to automated termination and liveness proofs of parameterized software.

Termination of threefold flips in mixed characteristic

AbstractThis note gives a short proof of termination of threefold flips over positive dimensional base and in particular demonstrates that the results hold in mixed characteristic. The work draws on recent developments in mixed and positive characteristic birational geometry as well as earlier ideas from characteristic zero.

On Lexicographic Proof Rules for Probabilistic Termination

We consider the almost-sure (a.s.) termination problem for probabilistic programs, which are a stochastic extension of classical imperative programs. Lexicographic ranking functions provide a sound and practical approach for termination of non-probabilistic programs, and their extension to probabilistic programs is achieved via lexicographic ranking supermartingales (LexRSMs). However, LexRSMs introduced in the previous work have a limitation that impedes their automation: all of their components have to be non-negative in all reachable states. This might result in a LexRSM not existing even for simple terminating programs. Our contributions are twofold. First, we introduce a generalization of LexRSMs that allows for some components to be negative. This standard feature of non-probabilistic termination proofs was hitherto not known to be sound in the probabilistic setting, as the soundness proof requires a careful analysis of the underlying stochastic process. Second, we present polynomial-time algorithms using our generalized LexRSMs for proving a.s. termination in broad classes of linear-arithmetic programs.

Interval Parsing Grammars for File Format Parsing

File formats specify how data is encoded for persistent storage. They cannot be formalized as context-free grammars since their specifications include context-sensitive patterns such as the random access pattern and the type-length-value pattern. We propose a new grammar mechanism called Interval Parsing Grammars IPGs) for file format specifications. An IPG attaches to every nonterminal/terminal an interval, which specifies the range of input the nonterminal/terminal consumes. By connecting intervals and attributes, the context-sensitive patterns in file formats can be well handled. In this paper, we formalize IPGs' syntax as well as its semantics, and its semantics naturally leads to a parser generator that generates a recursive-descent parser from an IPG. In general, IPGs are declarative, modular, and enable termination checking. We have used IPGs to specify a number of file formats including ZIP, ELF, GIF, PE, and part of PDF; we have also evaluated the performance of the generated parsers.

An Automated Approach to the Collatz Conjecture

We explore the Collatz conjecture and its variants through the lens of termination of string rewriting. We construct a rewriting system that simulates the iterated application of the Collatz function on strings corresponding to mixed binary–ternary representations of positive integers. We prove that the termination of this rewriting system is equivalent to the Collatz conjecture. We also prove that a previously studied rewriting system that simulates the Collatz function using unary representations does not admit termination proofs via natural matrix interpretations, even when used in conjunction with dependency pairs. To show the feasibility of our approach in proving mathematically interesting statements, we implement a minimal termination prover that uses natural/arctic matrix interpretations and we find automated proofs of nontrivial weakenings of the Collatz conjecture. Although we do not succeed in proving the Collatz conjecture, we believe that the ideas here represent an interesting new approach.

Analyzing Innermost Runtime Complexity Through Tuple Interpretations

Time complexity in rewriting is naturally understood as the number of steps needed to reduce terms to normal forms. Establishing complexity bounds to this measure is a well-known problem in the rewriting community. A vast majority of techniques to find such bounds consist of modifying termination proofs in order to recover complexity information. This has been done for instance with semantic interpretations, recursive path orders, and dependency pairs. In this paper, we follow the same program by tailoring tuple interpretations to deal with innermost complexity analysis. A tuple interpretation interprets terms as tuples holding upper bounds to the cost of reduction and size of normal forms. In contrast with the full rewriting setting, the strongly monotonic requirement for cost components is dropped when reductions are innermost. This weakened requirement on cost tuples allows us to prove the innermost version of the compatibility result: if all rules in a term rewriting system can be strictly oriented, then the innermost rewrite relation is well-founded. We establish the necessary conditions for which tuple interpretations guarantee polynomial bounds to the runtime of compatible systems and describe a search procedure for such interpretations.

The probabilistic termination tool amber

We describe the Amber tool for proving and refuting the termination of a class of probabilistic while-programs with polynomial arithmetic, in a fully automated manner. Amber combines martingale theory with properties of asymptotic bounding functions and implements relaxed versions of existing probabilistic termination proof rules to prove/disprove (positive) almost sure termination of probabilistic loops. Amber supports programs parametrized by symbolic constants and drawing from common probability distributions. Our experimental comparisons give practical evidence of Amber outperforming existing state-of-the-art tools.

Direct proof of termination of the Kohn algorithm in the real-analytic case

In 1979 J.J. Kohn gave an indirect argument via the Diederich-Fornaess Theorem showing that finite D'Angelo type implies termination of the Kohn algorithm for a pseudoconvex domain with real-analytic boundary. We give here a direct argument for this same implication using the stratification coming from Catlin's notion of a boundary system as well as algebraic geometry on the ring of real-analytic functions. We also indicate how this argument could be used in order to compute an effective lower bound for the subelliptic gain in the $\bar\partial$-Neumann problem in terms of the D'Angelo type, the dimension of the space, and the level of forms provided that an effective Łojasiewicz inequality can be proven in the real-analytic case and slightly more information obtained about the behavior of the sheaves of multipliers in the Kohn algorithm.

Making weak memory models fair

Liveness properties, such as termination, of even the simplest shared-memory concurrent programs under sequential consistency typically require some fairness assumptions about the scheduler. Under weak memory models, we observe that the standard notions of thread fairness are insufficient, and an additional fairness property, which we call memory fairness, is needed. In this paper, we propose a uniform definition for memory fairness that can be integrated into any declarative memory model enforcing acyclicity of the union of the program order and the reads-from relation. For the well-known models, SC, x86-TSO, RA, and StrongCOH, that have equivalent operational and declarative presentations, we show that our declarative memory fairness condition is equivalent to an intuitive model-specific operational notion of memory fairness, which requires the memory system to fairly execute its internal propagation steps. Our fairness condition preserves the correctness of local transformations and the compilation scheme from RC11 to x86-TSO, and also enables the first formal proofs of termination of mutual exclusion lock implementations under declarative weak memory models.

Global Solution of Semi-infinite Programs with Existence Constraints

We consider what we term existence-constrained semi-infinite programs. They contain a finite number of (upper-level) variables, a regular objective, and semi-infinite existence constraints. These constraints assert that for all (medial-level) variable values from a set of infinite cardinality, there must exist (lower-level) variable values from a second set that satisfy an inequality. Existence-constrained semi-infinite programs are a generalization of regular semi-infinite programs, possess three rather than two levels, and are found in a number of applications. Building on our previous work on the global solution of semi-infinite programs (Djelassi and Mitsos in J Glob Optim 68(2):227–253, 2017), we propose (for the first time) an algorithm for the global solution of existence-constrained semi-infinite programs absent any convexity or concavity assumptions. The algorithm is guaranteed to terminate with a globally optimal solution with guaranteed feasibility under assumptions that are similar to the ones made in the regular semi-infinite case. In particular, it is assumed that host sets are compact, defining functions are continuous, an appropriate global nonlinear programming subsolver is used, and that there exists a Slater point with respect to the semi-infinite existence constraints. A proof of finite termination is provided. Numerical results are provided for the solution of an adjustable robust design problem from the chemical engineering literature.

Petr4: formal foundations for p4 data planes

P4 is a domain-specific language for programming and specifying packet-processing systems. It is based on an elegant design with high-level abstractions like parsers and match-action pipelines that can be compiled to efficient implementations in software or hardware. Unfortunately, like many industrial languages, P4 has developed without a formal foundation. The P4 Language Specification is a 160-page document with a mixture of informal prose, graphical diagrams, and pseudocode, leaving many aspects of the language semantics up to individual compilation targets. The P4 reference implementation is a complex system, running to over 40KLoC of C++ code, with support for only a few targets. Clearly neither of these artifacts is suitable for formal reasoning about P4 in general. This paper presents a new framework, called Petr4, that puts P4 on a solid foundation. Petr4 consists of a clean-slate definitional interpreter and a core calculus that models a fragment of P4. Petr4 is not tied to any particular target: the interpreter is parameterized over an interface that collects features delegated to targets in one place, while the core calculus overapproximates target-specific behaviors using non-determinism. We have validated the interpreter against a suite of over 750 tests from the P4 reference implementation, exercising our target interface with tests for different targets. We validated the core calculus with a proof of type-preserving termination. While developing Petr4, we reported dozens of bugs in the language specification and the reference implementation, many of which have been fixed.

DKL: an efficient algorithm for learning deterministic Kripke structures

There has been a recent growth of interest in software engineering community to use grammatical inference, aka automaton learning, in software engineering applications. This is primarily due to the reason that capacity of underlying hardware resources has improved significantly over the last years; which has enabled the use of this approach beyond the toy examples in a greater frequency. In this paper, we present a new grammatical inference algorithm, DKL, to learn deterministic Kripke structures. The DKL is only the second of its kind for incremental learning of deterministic Kripke structures. Earlier, IKL algorithm was introduced for learning deterministic Kripke structures but it often constructs a hypothesis much larger in state size than the target Kripke structure. This problem is known as state-space explosion and it primarily occurs due to the sub-direct product construction used in the IKL design, which in turn affects time efficiency of IKL; especially when it is used for practical applications of software engineering. The DKL algorithm is designed to resolve the problem of state-space explosion. We give a proof of correctness and termination of the DKL algorithm. We also compared the performance of DKL with IKL by implementing an evaluation framework. Our results show that DKL is more efficient in terms of time in reaching the target automaton than the IKL algorithm and is not prone to the problem of state-space explosion.

Strong functional pearl: Harper’s regular-expression matcher in Cedille

This paper describes an implementation of Harper's continuation-based regular-expression matcher as a strong functional program in Cedille; i.e., Cedille statically confirms termination of the program on all inputs. The approach uses neither dependent types nor termination proofs. Instead, a particular interface dubbed a recursion universe is provided by Cedille, and the language ensures that all programs written against this interface terminate. Standard polymorphic typing is all that is needed to check the code against the interface. This answers a challenge posed by Bove, Krauss, and Sozeau.

Combining predicate transformer semantics for effects: a case study in parsing regular languages

This paper describes how to verify a parser for regular expressions in a functional programming language using predicate transformer semantics for a variety of effects. Where our previous work in this area focused on the semantics for a single effect, parsing requires a combination of effects: non-determinism, general recursion and mutable state. Reasoning about such combinations of effects is notoriously difficult, yet our approach using predicate transformers enables the careful separation of program syntax, correctness proofs and termination proofs.

Resource Analysis driven by (Conditional) Termination Proofs

AbstractWhen programs feature a complex control flow, existing techniques for resource analysis produce cost relation systems (CRS) whose cost functions retain the complex flow of the program and, consequently, might not be solvable into closed-form upper bounds. This paper presents a novel approach to resource analysis that is driven by the result of a termination analysis. The fundamental idea is that the termination proof encapsulates the flows of the program which are relevant for the cost computation so that, by driving the generation of the CRS using the termination proof, we produce a linearly-bounded CRS (LB-CRS). A LB-CRS is composed of cost functions that are guaranteed to be locally bounded by linear ranking functions and thus greatly simplify the process of CRS solving. We have built a new resource analysis tool, named MaxCore, that is guided by the VeryMax termination analyzer and uses CoFloCo and PUBS as CRS solvers. Our experimental results on the set of benchmarks from the Complexity and Termination Competition 2019 for C Integer programs show that MaxCore outperforms all other resource analysis tools.

Detecting multiphase linear ranking functions for single-path linear-constraint loops

Single-path linear-constraint loops are important since many analyses in different fields can be reduced to termination proof synthesis for such loops. In 2017, Ben-Amram and Genaim provided a complete polynomial-time solution to the problem of existence and of synthesis of multiphase linear ranking functions ( $$M\varPhi \hbox {RFs}$$ ) of bounded depth to prove the termination of a single-path linear-constraint loop. However, an open question whether one can precompute a bound on the depth of a $$M\varPhi \hbox {RF}$$ for a given loop is raised and the solution has not been accomplished so far. In this paper, we propose an approach to depth bound detection and synthesis of $$M\varPhi \hbox {RFs}$$ for rational single-path linear-constraint loops. We take a step further based on the work of Ben-Amram and Genaim, and detect the depth bound for a certain class of rational single-path linear-constraint loops. Furthermore, the effectiveness of our approach is presented with experimental evidence. The depth bound can be precomputed for loops where existing tools fail to infer a $$M\varPhi \hbox {RF}$$ or prove that none exists.

Discretization-based algorithms for generalized semi-infinite and bilevel programs with coupling equality constraints

Discretization-based algorithms are proposed for the global solution of mixed-integer nonlinear generalized semi-infinite (GSIP) and bilevel (BLP) programs with lower-level equality constraints coupling the lower and upper level. The algorithms are extensions, respectively, of the algorithm proposed by Mitsos and Tsoukalas (J Glob Optim 61(1):1–17, 2015. https://doi.org/10.1007/s10898-014-0146-6 ) and by Mitsos (J Glob Optim 47(4):557–582, 2010. https://doi.org/10.1007/s10898-009-9479-y ). As their predecessors, the algorithms are based on bounding procedures, which achieve convergence through a successive discretization of the lower-level variable space. In order to cope with convergence issues introduced by coupling equality constraints, a subset of the lower-level variables is treated as dependent variables fixed by the equality constraints while the remaining lower-level variables are discretized. Proofs of finite termination with $$\varepsilon $$ -optimality are provided under appropriate assumptions, the preeminent of which are the existence, uniqueness, and continuity of the solution to the equality constraints. The performance of the proposed algorithms is assessed based on numerical experiments.

On Quasi Ordinal Diagram Systems

The purposes of this note are the following two; we first generalize Okada-Takeuti's well quasi ordinal diagram theory, utilizing the recent result of Dershowitz-Tzameret's version of tree embedding theorem with gap conditions. Second, we discuss possible use of such strong ordinal notation systems for the purpose of a typical traditional termination proof method for term rewriting systems, especially for second-order (pattern-matching-based) rewriting systems including a rewrite-theoretic version of Buchholz's hydra game.

Batting an in-flight object to the target

Striking a flying object such as a ball to some target location is a highly skillful maneuver that a human being has to learn through a great deal of practice. In robotic manipulation, precision batting remains one of the most challenging tasks in which computer vision, modeling, planning, control, and action must be tightly coordinated in a split second. This paper investigates the problem of a two-degree-of-freedom robotic arm intercepting an object in free flight and redirecting it to some target with a single strike, assuming all the movements take place in one vertical plane. Two-dimensional impact is solved under Coulomb friction and energy-based restitution with a proof of termination. Planning combines impact dynamics and projectile flight mechanics with manipulator kinematics and image-based motion estimation. As the object is on the incoming flight, the post-impact task constraint of reaching the target is propagated backward in time, while the arm’s kinematic constraints are propagated forward (via joint trajectory interpolation), all to the pre-impact instant when they will meet constraints that allow batting to happen. All the constraints (16 in total) are then exerted on the arm’s pre-impact joint angles and velocities, which are repeatedly planned based on updated estimates of the object’s motion captured by a high-speed camera. The arm keeps adjusting its motion in sync with planning until batting takes place. Experiments have demonstrated a better batting performance by a Barrett Technology WAM Arm than by a human being without training.