Refinement Relation Research Articles

Polynomial spaces reproduced by elliptic scaling functions

In this paper, we consider the so-called elliptic scaling functions [V. G. Zakharov, Elliptic scaling functions as compactly supported multivariate analogs of the B-splines, Int. J. Wavelets Multiresolut. Inf. Process. 12 (2014) 1450018]. Any elliptic scaling function satisfies the refinement relation with a real isotropic dilation matrix; and, in the paper, we prove that any real isotropic matrix is similar to an orthogonal matrix and the similarity transformation matrix determines a positive-definite quadratic form. We prove that the polynomial space reproduced by integer shifts of a compactly supported function can be usually considered as a polynomial solution to a system of constant coefficient PDE’s. We show that the algebraic polynomials reproduced by a compactly supported elliptic scaling function belong to the kernel of a homogeneous elliptic differential operator that the differential operator corresponds to the quadratic form; and thus any elliptic scaling function reproduces only affinely-invariant polynomial spaces. However, in the paper, we present nonstationary elliptic scaling functions such that the scaling functions can reproduce no scale-invariant (only shift-invariant) polynomial spaces.

CEGAR for compositional analysis of qualitative properties in Markov decision processes

We consider Markov decision processes (MDPs) which are a standard model for probabilistic systems. We focus on qualitative properties for MDPs that can express that desired behaviors of the system arise almost-surely (with probability 1) or with positive probability. We introduce a new simulation relation to capture the refinement relation of MDPs with respect to qualitative properties, and present discrete graph algorithms with quadratic complexity to compute the simulation relation. We present an automated technique for assume-guarantee style reasoning for compositional analysis of two-player games by giving a counterexample guided abstraction-refinement approach to compute our new simulation relation. We show a tight link between two-player games and MDPs, and as a consequence the results for games are lifted to MDPs with qualitative properties. We have implemented our algorithms and show that the compositional analysis leads to significant improvements.

Contract-based modeling and verification of timed safety requirements within SysML

In order to cope with the growing complexity of critical real-time embedded systems, systems engineering has adopted a component-based design technique driven by requirements. Yet, such an approach raises several issues since it does not explicitly prescribe how system requirements can be decomposed on components nor how components contribute to the satisfaction of requirements. The envisioned solution is to design, with respect to each requirement and for each involved component, an abstract specification, tractable at each design step, that models how the component is concerned by the satisfaction of the requirement and that can be further refined toward a correct implementation. In this paper, we consider such specifications in the form of contracts. A contract for a component consists in a pair (assumption, guarantee) where the assumption models an abstract behavior of the component's environment and the guarantee models an abstract behavior of the component given that the environment behaves according to the assumption. Therefore, contracts are a valuable asset for the correct design of systems, but also for mapping and tracing requirements to components, for tracing the evolution of requirements during design and, most importantly, for compositional verification of requirements. The aim of this paper is to introduce contract-based reasoning for the design of critical real-time systems made of reactive components modeled with UML and/or SysML. We propose an extension of UML and SysML languages with a syntax and semantics for contracts and the refinement relations that they must satisfy. The semantics of components and contracts is formalized by a variant of timed input/output automata on top of which we build a formal contract-based theory. We prove that the contract-based theory is sound and can be applied for a relatively large class of SysML system models. Finally, we show on a case study extracted from the automated transfer vehicle (http://www.esa.int/ATV) that our contract-based theory allows to verify requirement satisfaction for previously intractable models.

Stepwise refinement of sequence diagrams with soft real-time constraints

UML sequence diagrams and similar notations are much used to specify and analyze computer systems and their requirements. Probabilities are often essential, in particular for capturing soft real-time constraints. It is also important to be able to specify systems at different levels of abstraction. Refinement is a means to relate abstract specifications to more concrete specifications in such a way that constraints and analysis results are preserved through the transition. In order to allow soft real-time constraints to be included as an integral part of sequence diagram specifications, this paper presents an approach to extend UML 2.x sequence diagrams to capture probabilistic choice in general and soft real-time constraints in particular. The approach is supported by formal semantics and pragmatic refinement relations with mathematical properties that allow stepwise and modular development of specifications. An example focusing on communication is provided to demonstrate the language and refinement relations.

Verifying a quantitative relaxation of linearizability via refinement

The recent years have seen increasingly widespread use of highly concurrent data structures in both multi-core and distributed computing environments, thereby escalating the priority for verifying their correctness. Quasi linearizability is a quantitative variation of the standard linearizability correctness condition to allow more implementation freedom for performance optimization. However, ensuring that the implementation satisfies the quantitative aspect of this new correctness condition is often an arduous task. In this paper, we propose the first automated method for formally verifying quasi linearizability of the implementation model of a concurrent data structure with respect to its sequential specification. The method is based on checking a relaxed version of the refinement relation between the implementation model and the specification model through explicit state model checking. Our method can directly handle concurrent systems where each thread or process makes infinitely many method calls. Furthermore, unlike many existing verification methods, it does not require the user to supply annotations of the linearization points. We have implemented the new method in the PAT verification framework. Our experimental evaluation shows that the method is effective in verifying the new quasi linearizability requirement and detecting violations.

Verification Method of Real-time System Based on Refinement Relation

With the continuous increase in the size and complexity of a real-time computer system, the use of formal verification methods in software development is also on the rise. The traditional formal verification method is not fully applicable to the development of actual system life cycle. Therefore, this paper presents a new real-time system verification method, It takes the deadlock timed Buchi automata as the medium, and translates the timed temporal logic into timed communicating sequential process language. The tock event is also joined, which can be directly used for the detection of refinement tool FDR. The method verifies the situation of deadlock. To establish the link between the conventional model checking and refinement model checking can well combine the advantages of both and improves system security and reliability.

Quantum group spin nets: Refinement limit and relation to spin foams

So far spin foam models are hardly understood beyond a few of their basic building blocks. To make progress on this question, we define analogue spin foam models, so-called ``spin nets,'' for quantum groups $\mathrm{SU}(2{)}_{k}$ and examine their effective continuum dynamics via tensor network renormalization. In the refinement limit of this coarse-graining procedure, we find a vast nontrivial fixed-point structure beyond the degenerate and the $BF$ phase. In comparison to previous work, we use fixed-point intertwiners, inspired by Reisenberger's construction principle [M. P. Reisenberger, J. Math. Phys. (N.Y.) 40, 2046 (1999)] and the recent work [B. Dittrich and W. Kaminski, arXiv:1311.1798], as the initial parametrization. In this new parametrization fine-tuning is not required in order to flow to these new fixed points. Encouragingly, each fixed point has an associated extended phase, which allows for the study of phase transitions in the future. Finally we also present an interpretation of spin nets in terms of melonic spin foams. The coarse-graining flow of spin nets can thus be interpreted as describing the effective coupling between two spin foam vertices or space time atoms.

An algebraic theory of interface automata

We formulate a compositional specification theory for interface automata, where a component model specifies the allowed sequences of input and output interactions with the environment. A trace-based linear-time refinement is provided, which is the weakest preorder preserving substitutivity of components, and is weaker than the classical alternating simulation defined on interface automata. Since our refinement allows a component to be refined by refusing to produce any output, we also define a refinement relation that guarantees safety and progress. The theory includes the operations of parallel composition to support the structural composition of components, logical conjunction and disjunction for independent development, hiding to support abstraction of interfaces, and quotient for incremental synthesis of components. Our component formulation highlights the algebraic properties of the specification theory for both refinement preorders, and is shown to be fully abstract with respect to observation of communication mismatches. Examples of independent and incremental component development are provided.

Required behavior of sequence diagrams

Many reusable software artifacts such as design patterns and design aspects make use of UML sequence diagrams to describe interaction behaviors. When a pattern or an aspect is reused in an application, it is important to ensure that the sequence diagrams for the application conform to the corresponding sequence diagrams for the pattern or aspect. Reasoning about conformance relationship between sequence diagrams has not been addressed adequately in literature. In this article, we focus on required behaviors specified by a UML sequence diagram and provide a semantic-based formalization of conformance relationships between sequence diagrams. A novel trace semantics is first given that captures precisely required behaviors. A refinement relation between sequence diagrams is then defined based on the semantics. The refinement relation allows a sequence diagram to be refined by changing its structure so long as its required behaviors are preserved. A conformance relation between sequence diagrams is finally given that includes the refinement relation as a special case. It allows one to introduce and rename lifelines, messages, and system variables when reusing sequence diagrams. Properties of the semantics, refinement, and conformance relations are studied. Two case studies are provided to illustrate the efficacy of semantic-based conformance reasoning.

Rely-Guarantee-Based Simulation for Compositional Verification of Concurrent Program Transformations

Verifying program transformations usually requires proving that the resulting program (the target) refines or is equivalent to the original one (the source). However, the refinement relation between individual sequential threads cannot be preserved in general with the presence of parallel compositions, due to instruction reordering and the different granularities of atomic operations at the source and the target. On the other hand, the refinement relation defined based on fully abstract semantics of concurrent programs assumes arbitrary parallel environments, which is too strong and cannot be satisfied by many well-known transformations. In this article, we propose a R ely- G uarantee-based Sim ulation (RGSim) to verify concurrent program transformations. The relation is parametrized with constraints of the environments that the source and the target programs may compose with. It considers the interference between threads and their environments, thus is less permissive than relations over sequential programs. It is compositional with respect to parallel compositions as long as the constraints are satisfied. Also, RGSim does not require semantics preservation under all environments, and can incorporate the assumptions about environments made by specific program transformations in the form of rely/guarantee conditions. We use RGSim to reason about optimizations and prove atomicity of concurrent objects. We also propose a general garbage collector verification framework based on RGSim, and verify the Boehm et al. concurrent mark-sweep GC.

ELLIPTIC SCALING FUNCTIONS AS COMPACTLY SUPPORTED MULTIVARIATE ANALOGS OF THE B-SPLINES

In the paper, we present a family of multivariate compactly supported scaling functions, which we call as elliptic scaling functions. The elliptic scaling functions are the convolution of elliptic splines, which correspond to homogeneous elliptic differential operators, with distributions. The elliptic scaling functions satisfy refinement relations with real isotropic dilation matrices. The elliptic scaling functions satisfy most of the properties of the univariate cardinal B-splines: compact support, refinement relation, partition of unity, total positivity, order of approximation, convolution relation, Riesz basis formation (under a restriction on the mask), etc. The algebraic polynomials contained in the span of integer shifts of any elliptic scaling function belong to the null-space of a homogeneous elliptic differential operator. Similarly to the properties of the B-splines under differentiation, it is possible to define elliptic (not necessarily differential) operators such that the elliptic scaling functions satisfy relations with these operators. In particular, the elliptic scaling functions can be considered as a composition of segments, where the function inside a segment, like a polynomial in the case of the B-splines, vanishes under the action of the introduced operator.

A compositional framework to the specification of service protocols controllability and substitutability

Service description aims at specifying syntactic and semantic properties of the service by distinguishing several interoperability levels (signature, interaction protocol, and semantics). However, providing a basic service description is not sufficient to facilitate the development of services and provide customized information. To do so, it is important to develop formal methods and sufficient software tools for analysing service description. This paper provides a new compositional framework for specifying controllability and substitutability of service protocols interacting asynchronously. First, we investigate necessary and sufficient conditions for protocols controllability and give sufficient conditions for preserving controllability by composition. Then, we propose two protocols substitutability relations and show the soundness of our formal framework. Finally, we propose two protocols refinement relations for checking our substitutability relations and show that the implementability of protocols under refinement is context-independent. We use INA and CADP tools to automatically verify the protocols controllability and substitutability via refinement.

Formal verification of synchronous data-flow program transformations toward certified compilers

Translation validation was invented in the 90's by Pnueli et al. as a technique to formally verify the correctness of code generators. Rather than certifying the code generator or exhaustively qualifying it, translation validators attempt to verify that program transformations preserve semantics. In this work, we adopt this approach to formally verify that the clock semantics and data dependence are preserved during the compilation of the Signal compiler. Translation validation is implemented for every compilation phase from the initial phase until the latest phase where the executable code is generated, by proving the transformation in each phase of the compiler preserves the semantics. We represent the clock semantics, the data dependence of a program and its transformed counterpart as first-order formulas which are called clock models and synchronous dependence graphs (SDGs), respectively. We then introduce clock refinement and dependence refinement relations which express the preservations of clock semantics and dependence, as a relation on clock models and SDGs, respectively. Our validator does not require any instrumentation or modification of the compiler, nor any rewriting of the source program.

Refinement patterns for ASTDs

Abstract This paper introduces three refinement patterns for algebraic state-transition diagrams ( astds ): state refinement, transition refinement and loop-transition refinement. These refinement patterns are derived from practice in using astds for specifying information systems and security policies in two industrial research projects. Two refinement relations used in these patterns are formally defined. For each pattern, proof obligations are proposed to ensure preservation of behaviour through refinement. The proposed refinement relations essentially consist in preserving scenarios by replacing abstract events with concrete events, or by introducing new events. Deadlocks cannot be introduced; divergence over new events is allowed in one of the refinement relation. We prove congruence-like properties for these three patterns, in order to show that they can be applied to a subpart of a specification while preserving global properties. These three refinement patterns are illustrated with a simple case study of a complaint management system.

Real-time specifications

A specification theory combines notions of specifications and implementations with a satisfaction relation, a refinement relation, and a set of operators supporting stepwise design. We develop a specification framework for real-time systems using Timed I/O Automata as the specification formalism, with the semantics expressed in terms of Timed I/O Transition Systems. We provide constructs for refinement, consistency checking, logical and structural composition, and quotient of specifications—all indispensable ingredients of a compositional design methodology. The theory is implemented in the new tool Ecdar. We present symbolic versions of the algorithms used in Ecdar, and demonstrate the use of the tool using a small case study in compositional verification.

Verifying Linearizability via Optimized Refinement Checking

Linearizability is an important correctness criterion for implementations of concurrent objects. Automatic checking of linearizability is challenging because it requires checking that: (1) All executions of concurrent operations are serializable, and (2) the serialized executions are correct with respect to the sequential semantics. In this work, we describe a method to automatically check linearizability based on refinement relations from abstract specifications to concrete implementations. The method does not require that linearization points in the implementations be given, which is often difficult or impossible. However, the method takes advantage of linearization points if they are given. The method is based on refinement checking of finite-state systems specified as concurrent processes with shared variables. To tackle state space explosion, we develop and apply symmetry reduction, dynamic partial order reduction, and a combination of both for refinement checking. We have built the method into the PAT model checker, and used PAT to automatically check a variety of implementations of concurrent objects, including the first algorithm for scalable nonzero indicators. Our system is able to find all known and injected bugs in these implementations.

Integration of Products of Gaussians and Wavelets with Applications to Electronic Structure Calculations

In this work, we consider a scheme for the computation of integrals of Gaussian functions with products of wavelets, which is applicable to wavelet bases given only implicitly in terms of refinement relations. The integrals under consideration arise in wavelet discretizations of operator equations involving separable approximations of Coulomb potentials. Motivated by this application, we study in particular the case of large exponents in the Gaussian terms. The numerical tests demonstrate the practical efficiency of the method.

Introducing extra operations in refinement

Abstract This paper reconsiders refinements which introduce actions on the concrete level which were not present at the abstract level. It considers a range of different basic refinement relations, covering the standard ones for formalisms like Event-B, Z, action systems, and CSP. It also describes a number of ways in which new operations may be introduced: extended interfaces, internal actions, stuttering steps, and action refinement. The main contribution of this paper is in exploring the interaction between those two dimensions. In particular, it shows how the “refining skip” method is incompatible with failures-based refinement relations, and consequently some decisions in designing Event-B refinement are more entangled than previously highlighted.

Relational concurrent refinement part III: traces, partial relations and automata

Abstract Data refinement in a state-based language such as Z is defined using a relational model in terms of the behaviour of abstract programs. Downward and upward simulation conditions form a sound and jointly complete methodology to verify relational data refinements, which can be checked on an event-by-event basis rather than per trace. In models of concurrency, refinement is often defined in terms of sets of observations, which can include the events a system is prepared to accept or refuse, or depend on explicit properties of states and transitions. By embedding such concurrent semantics into a relational framework, eventwise verification methods for such refinement relations can be derived. In this paper, we continue our program of deriving simulation conditions for process algebraic refinement by defining further embeddings into our relational model: traces, completed traces, failure traces and extension. We then extend our framework to include various notions of automata based refinement.

Using refinement calculus techniques to prove linearizability

Abstract Stepwise refinement is a method for systematically transforming a high-level program into an efficiently executable one. A sequence of successively refined programs can also serve as a correctness proof, which makes different mechanisms in the program explicit. We present rules for refinement of multi-threaded shared-variable concurrent programs. We apply our rules to the problem of verifying linearizability of concurrent objects, that are accessed by an unbounded number of concurrent threads. Linearizability is an established correctness criterion for concurrent objects, which states that the effect of each method execution can be considered to occur atomically at some point in time between its invocation and response. We show how linearizability can be expressed in terms of our refinement relation, and present rules for establishing this refinement relation between programs by a sequence of local transformations of method bodies. Contributions include strengthenings of previous techniques for atomicity refinement, as well as an absorption rule, which is particularly suitable for reasoning about concurrent algorithms that implement atomic operations. We illustrate the application of the refinement rules by proving linearizability of Treiber’s concurrent stack algorithm and Michael and Scott’s concurrent queue algorithm.