Operational Semantics Research Articles

Formal verification of IoT applications using rewriting logic: An MDE-based approach

Internet of Things (IoT) systems are complex assemblies of components that collaborate to achieve common goals. These components are based on heterogeneous technologies, and they communicate using various communication protocols. This heterogeneity makes the design and the development of IoT applications a challenging issue. Diverse approaches based on Model-Driven Engineering (MDE) have been proposed to overcome this major issue using suitable modeling languages. ThingML is a promising UML profile for modeling IoT applications that aims to address the challenges of heterogeneity. However, ThingML does not have rigorous semantics, making it unsuitable for formal verification and analysis of system designs. This paper proposes an MDE-based formal approach to define the formal semantics of the ThingML language using rewriting logic and its language Maude. The main advantage of our approach over other approaches lies in the universality and versatility of Maude's mathematical notation, which implements all ThingML concepts and their behavioral aspects in a unified formal logic. The existing Maude language verification tools provide powerful analysis techniques, including simulation and model checking, which enable rigorous analysis and verification of ThingML designs. The contributions of this work include the following: (i) we propose a semantics mapping between ThingML concepts and Maude constructs, (ii) we define and implement an operational semantics for the ThingML action language in the Maude language, and (iii) we develop a tool that enables the automatic transformation of ThingML specifications into Maude. Our approach is illustrated through a case study.

Bounded Invariant Checking for Stateflow

Stateflow models are complex software models, often used as part of industrial safety-critical software solutions designed with Matlab Simulink. Being part of safety-critical solutions, these models require the application of rigorous verification techniques for assuring their correctness. In this paper, we propose a refutation-based formal verification approach for analyzing Stateflow models against invariant properties, based on bounded model checking (BMC). The crux of our technique is: i) a representation of the state space of Stateflow models as a symbolic transition system (STS) over the symbolic configurations of the model, and ii) application of incremental BMC, to generate verification results after each unrolling of the next-state relation of the transition system. To this end, we develop a symbolic structural operational semantics (SSOS) for Stateflow, starting from an existing structural operational semantics (SOS), and show the preservation of invariant properties between the two. We define bounded invariant checking for STS over symbolic configurations as a satisfiability problem. We develop an automated procedure for generating the initial and next-state predicates of the STS, and a prototype implementation of the technique in the form of a tool utilising standard, off-the-shelf satisfiability solvers. Finally, we present preliminary performance results by applying our tool on an illustrative example and two industrial models.

SecIoTComm: An Actor-Based Model and Framework for Secure IoT Communication.

Internet of Things (IoT) ecosystems are becoming increasingly ubiquitous and heterogeneous, adding extra layers of complexity to secure communication and resource allocation. IoT computing resources are often located at the network edge and distributed across many heterogeneous sensors, actuators, and controller devices. This makes it challenging to provide the proper security mechanisms to IoT ecosystems in terms of manageability and maintainability. In an IoT ecosystem, computational resources are naturally distributed and shareable among their constituency, which creates an opportunity to distribute heavy tasks to them. However, resource allocation in IoT requires secure and complex communication and coordination mechanisms, which existing ones do not adequately support. In this paper, we present Secure Actor-based Model for IoT Communication (SecIoTComm), a model for representing secure IoT communication. SecIoTComm aims to represent secure IoT communication properties and design and implement novel mechanisms to improve their programmability and performance. SecIoTComm separates the communication and computation concerns, achieving design modularity in building IoT ecosystems. First, this paper presents the syntax and operational semantics of SecIoTComm. Then, we present an IoT framework implementing the key concepts of the model. Finally, we evaluate the developed framework using various performance and scalability metrics.

Bousi[formula omitted]Prolog: Design and implementation of a proximity-based fuzzy logic programming language

The fuzzy logic programming language Bousi∼Prolog extends Prolog with a weak unification algorithm based on proximity relations and truth degree annotations. The weak unification algorithm makes the search for answers more flexible, while rule annotations make possible knowledge-based applications where the rules may be uncertain. In this paper, after recalling the main concepts supporting this language, we detail its design and implementation. We describe the implementation of its operational semantics, which is based on compiling programs and queries into Prolog, and those important features that makes it more applicable: fuzzy sets, integration with WordNet and efficiency techniques. The result is a high-level open-source implementation of the Bousi∼Prolog system, written on top of SWI-Prolog, and publicly available. We also summarise some experiments measuring its performance compared to other systems.

A categorical framework for congruence of applicative bisimilarity in higher-order languages

Applicative bisimilarity is a coinductive characterisation of observational equivalence in call-by-name lambda-calculus, introduced by Abramsky (1990). Howe (1996) gave a direct proof that it is a congruence, and generalised the result to all languages complying with a suitable format. We propose a categorical framework for specifying operational semantics, in which we prove that (an abstract analogue of) applicative bisimilarity is automatically a congruence. Example instances include standard applicative bisimilarity in call-by-name, call-by-value, and call-by-name non-deterministic $\lambda$-calculus, and more generally all languages complying with a variant of Howe's format.

A Tool for Describing and Checking Natural Semantics Definitions of Programming Languages

Many universities have courses and projects revolving around compiler or interpreter implementation as part of their degree programmes in computer science. In such teaching activities, tool support can be highly beneficial. While there are already several tools for assisting with development of the front end of compilers, tool support tapers off towards the back end, or requires more background experience than is expected of undergraduate students. Structural operational semantics is a useful and mathematically simple formalism for specifying the behaviour of programs and a specification lends itself well to implementation; in particular big-step or natural semantics is often a useful and simple approach. However, many students struggle with learning the notation and often come up with ill-defined and meaningless attempts at defining a structural operational semantics. A survey shows that students working on programming language projects feel that tool support is lacking and would be useful. Many of these problems encountered when developing a semantic definition are similar to problems encountered in programming, in particular ones that are essentially the result of type errors. We present a pedagogical metalanguage based on natural semantics, and its implementation, as an attempt to marry two notions: a syntax similar to textbook notation for natural semantics on the one hand, and automatic verification of some correctness properties on the other by means of a strong type discipline. The metalanguage and the tool provide the facilities for writing and executing specifications as a form of programming. The user can check that the specification is not meaningless as well as execute programs, if the specification makes sense.

Bayesian Networks based approach to enhance GO methodology for reliability modeling of multi-state consecutive-k-out-of-n: F system

As a success-oriented system reliability and safety analysis technique, GO methodology is widely used in the modeling and analysis scenarios of critical safety engineering systems with signal flow, such as nuclear, chemical industry, electric power transportation, wireless network and microwave communication network. Consecutive-k-out-of-n systems are also widely applied in these fields, but due to their relatively complex logic, there are no corresponding graphical modeling and calculation methods. In this paper, the basic GO methodology is extended to support the modeling and analysis of multi-state linear and circular consecutive-k-out-of-n: F system (MLC(k,n) &MCC(k,n)) models. Two new operators are defined in graphical modeling to represent the two types of complex system logic. The multi-state logic semantics of the new operators and mapping rules to Bayesian networks (BN) are given. And the programmable process is presented to transform the extended GO model into BN, and the reliability of the MLC(k,n)/MCC(k,n) is calculated. Finally, three cases are used to verify i) the correctness of the method supporting multi-state model, ii) the efficiency and ability of the algorithm, and iii) the forward calculation and reverse diagnosis of the MLC(k,n) and MCC(k,n) systems with external shared components.

Linear Dependent Type Theory for Quantum Programming Languages

Modern quantum programming languages integrate quantum resources and classical control. They must, on the one hand, be linearly typed to reflect the no-cloning property of quantum resources. On the other hand, high-level and practical languages should also support quantum circuits as first-class citizens, as well as families of circuits that are indexed by some classical parameters. Quantum programming languages thus need linear dependent type theory. This paper defines a general semantic structure for such a type theory via certain fibrations of monoidal categories. The categorical model of the quantum circuit description language Proto-Quipper-M by Rios and Selinger (2017) constitutes an example of such a fibration, which means that the language can readily be integrated with dependent types. We then devise both a general linear dependent type system and a dependently typed extension of Proto-Quipper-M, and provide them with operational semantics as well as a prototype implementation.

Proceedings Combined 29th International Workshop on Expressiveness in Concurrency and 19th Workshop on Structural Operational Semantics

Proceedings Combined 29th International Workshop on Expressiveness in Concurrency and 19th Workshop on Structural Operational Semantics

Automatically deriving control-flow graph generators from operational semantics

We develop the first theory of control-flow graphs from first principles, and use it to create an algorithm for automatically synthesizing many variants of control-flow graph generators from a language’s operational semantics. Our approach first introduces a new algorithm for converting a large class of small-step operational semantics to an abstract machine. It next uses a technique called ”abstract rewriting” to automatically abstract the semantics of a language, which is used both to directly generate a CFG from a program (”interpreted mode”) and to generate standalone code, similar to a human-written CFG generator, for any program in a language. We show how the choice of two abstraction and projection parameters allow our approach to synthesize several families of CFG-generators useful for different kinds of tools. We prove the correspondence between the generated graphs and the original semantics. We provide and prove an algorithm for automatically proving the termination of interpreted-mode generators. In addition to our theoretical results, we have implemented this algorithm in a tool called Mandate, and show that it produces human-readable code on two medium-size languages with 60−80 rules, featuring nearly all intraprocedural control constructs common in modern languages. We then show these CFG-generators were sufficient to build two static analyses atop them. Our work is a promising step towards the grand vision of being able to synthesize all desired tools from the semantics of a programming language.

Verified symbolic execution with Kripke specification monads (and no meta-programming)

Verifying soundness of symbolic execution-based program verifiers is a significant challenge. This is especially true if the resulting tool needs to be usable outside of the proof assistant, in which case we cannot rely on shallowly embedded assertion logics and meta-programming. The tool needs to manipulate deeply embedded assertions, and it is crucial for efficiency to eagerly prune unreachable paths and simplify intermediate assertions in a way that can be justified towards the soundness proof. Only a few such tools exist in the literature, and their soundness proofs are intricate and hard to generalize or reuse. We contribute a novel, systematic approach for the construction and soundness proof of such a symbolic execution-based verifier. We first implement a shallow verification condition generator as an object language interpreter in a specification monad, using an abstract interface featuring angelic and demonic nondeterminism. Next, we build a symbolic executor by implementing a similar interpreter, in a symbolic specification monad. This symbolic monad lives in a universe that is Kripke-indexed by variables in scope and a path condition. Finally, we reduce the soundness of the symbolic execution to the soundness of the shallow execution by relating both executors using a Kripke logical relation. We report on the practical application of these techniques in Katamaran, a tool for verifying security guarantees offered by instruction set architectures (ISAs). The tool is fully verified by combining our symbolic execution machinery with a soundness proof of the shallow verification conditions against an axiomatized separation logic, and an Iris-based implementation of the axioms, proven sound against the operational semantics. Based on our experience with Katamaran, we can report good results on practicality and efficiency of the tool, demonstrating practical viability of our symbolic execution approach.

Analyzing binding extent in 3CPS

To date, the most effective approach to compiling strict, higher-order functional languages (such as OCaml, Scheme, and SML) has been to use whole-program techniques to convert the program to a first-order monomorphic representation that can be optimized using traditional compilation techniques. This approach, popularized by MLton, has limitations, however. We are interested in exploring a different approach to compiling such languages, one that preserves the higher-order and polymorphic character of the program throughout optimization. To enable such an approach, we must have effective analyses that both provide precise information about higher-order programs and that scale to larger units of compilation. This paper describes one such analysis for determining the extent of variable bindings. We classify the extent of variables as either register (only one binding instance can be live at any time), stack (the lifetimes of binding instances obey a LIFO order), or heap (binding lifetimes are arbitrary). These extents naturally connect variables to the machine resources required to represent them. We believe that precise information about binding extents will enable efficient management of environments, which is a key problem in the efficient compilation of higher-order programs. At the core of the paper is the 3CPS intermediate representation, which is a factored CPS-based intermediate representation (IR) that statically marks variables to indicate their binding extent. We formally specify the management of this binding structure by means of a small-step operational semantics and define a static analysis that determines the extents of the variables in a program. We evaluate our analysis using a standard suite of SML benchmark programs. Our implementation gets surprisingly high yield and exhibits scalable performance. While this paper uses a CPS-based IR, the algorithm and results are easily transferable to other λ-calculus IRs, such as ANF.

Branching Pomsets for Choreographies

Choreographic languages describe possible sequences of interactions among a set of agents. Typical models are based on languages or automata over sending and receiving actions. Pomsets provide a more compact alternative by using a partial order over these actions and by not making explicit the possible interleaving of concurrent actions. However, pomsets offer no compact representation of choices. For example, if an agent Alice can send one of two possible messages to Bob three times, one would need a set of 2 * 2 * 2 distinct pomsets to represent all possible branches of Alice's behaviour. This paper proposes an extension of pomsets, named branching pomsets, with a branching structure that can represent Alice's behaviour using 2 + 2 + 2 ordered actions. We encode choreographies as branching pomsets and show that the pomset semantics of the encoded choreographies are bisimilar to their operational semantics.

Session Fidelity for ElixirST: A Session-Based Type System for Elixir Modules

This paper builds on prior work investigating the adaptation of session types to provide behavioural information about Elixir modules. A type system called ElixirST has been constructed to statically determine whether functions in an Elixir module observe their endpoint specifications, expressed as session types; a corresponding tool automating this typechecking has also been constructed. In this paper we formally validate this type system. An LTS-based operational semantics for the language fragment supported by the type system is developed, modelling its runtime behaviour when invoked by the module client. This operational semantics is then used to prove session fidelity for ElixirST.

Modules over monads and operational semantics (expanded version)

This paper is a contribution to the search for efficient and high-level mathematical tools to specify and reason about (abstract) programming languages or calculi. Generalising the reduction monads of Ahrens et al., we introduce transition monads, thus covering new applications such as lambda-bar-mu-calculus, pi-calculus, Positive GSOS specifications, differential lambda-calculus, and the big-step, simply-typed, call-by-value lambda-calculus. Moreover, we design a suitable notion of signature for transition monads.

Types for Complexity of Parallel Computation in Pi-calculus

Type systems as a technique to analyse or control programs have been extensively studied for functional programming languages. In particular, some systems allow one to extract from a typing derivation a complexity bound on the program. We explore how to extend such results to parallel complexity in the setting of pi-calculus, considered as a communication-based model for parallel computation. Two notions of time complexity are given: the total computation time without parallelism (the work) and the computation time under maximal parallelism (the span). We define operational semantics to capture those two notions and present two type systems from which one can extract a complexity bound on a process. The type systems are inspired both by sized types and by input/output types, with additional temporal information about communications.

An Operational Semantics for Situated Ideological Systems, with a Case Study Concerning a Paradigmatic Religious Conflict


 
 
 
 This paper introduces an operational semantics for what, in previous work, we have called situated
 ideological systems: sets of ways to envisage concrete social situations (normatively, valuationally etc.) that individuals and social groups may use to direct their choices and actions in such situations. The agent-based social model that we call Agent Society is used to computationally construe possible social situations where individual agents and groups of agents may find themselves, and to formally represent ideological systems in ways they can collectively share. As a case study of the proposed semantics, the paper formally presents the ideological dynamics underlying the temporal evolution of a paradigmatic situation of religious conflict (between catholics and devotees of African-Brazilian cults), as pictured in the classical Brazilian theatrical play The Keeper of Promises (O Pagador de Promessas). The ideology modeling language TinyIML is used for the computational presentation of the various stages of that ideological dynamics. The syntax and semantics of TinyIML is summarized in an appendix.
 
 
 

Super-optimization of Smart Contracts

Smart contracts are programs deployed on a blockchain. They are executed for a monetary fee paid in gas —a clear optimization target for smart contract compilers. Because smart contracts are a young, fast-moving field without (manually) fine-tuned compilers, they highly benefit from automated and adaptable approaches, especially as smart contracts are effectively immutable, and as such need a high level of assurance. This makes them an ideal domain for applying formal methods. Super-optimization is a technique to find the best translation of a block of instructions by trying all possible sequences of instructions that produce the same result. We present a framework for super-optimizing smart contracts based on Max-SMT with two main ingredients: (1) a stack functional specification extracted from the basic blocks of a smart contract, which is simplified using rules capturing the semantics of arithmetic, bit-wise, and relational operations, and (2) the synthesis of optimized blocks , which finds—by means of an efficient SMT encoding—basic blocks with minimal gas cost whose stack functional specification is equal (modulo commutativity) to the extracted one. We implemented our framework in the tool syrup 2.0 . Through large-scale experiments on real-world smart contracts, we analyze performance improvements for different SMT encodings, as well as tradeoffs between quality of optimizations and required optimization time.

Precise Dynamic Symbolic Execution for Nonuniform Data Access in Smart Contracts

Dynamic symbolic execution (DSE) has been successfully adopted for vulnerability detection in desktop and mobile platforms. Unfortunately, we cannot simply extrapolate those techniques to smart contracts. The major challenge is that smart contracts exhibit a nonuniform data access mode. Other than accessing the data via uniform addresses, smart contracts compromise multiple addressing modes, including flat address mode and key-value mode. More seriously, accessing a key-value table usually involves additional hash operations to obtain the keys. In this paper, we propose a DSE framework to resolve the nonuniform data access in smart contracts. More specifically, we exactly track the symbolic variables with concrete addresses and compute the actual/hash keys for table-like accesses. We also take the symbolic keys into account to distinguish data accesses incidentally with the same concrete keys resulting from artificially generated values. We describe the DSE framework in operational semantics. On top of the framework, we implement an integer overflow detector NOVA and a multi-transactional vulnerability detector MTVD. The experiments show that NOVA outperforms state-of-the-art analysis tools in detecting the integer overflows with much higher precision and recall, 94.2% and 93.0%, respectively. MTVD successfully reports three ether leaking vulnerabilities and one suicidal issue from real-world smart contracts.

A theoretical approach to the computational complexity measure of abstract DEVS simulators

DEVS is a sound Modeling and Simulation (M&S) framework that describes a model in a modular and hierarchical way. It comes along with an abstract simulation algorithm which defines its operational semantics. Many variants of such an algorithm have been proposed by DEVS researchers. Yet, the proper interpretation and analysis of the computational complexity of such approaches have not been systematically addressed and defined. As systems become larger and more complex, the efficiency of the DEVS simulation algorithms in terms of time complexity measure becomes a major issue. Therefore, it is necessary to devise a method for computing this complexity. This paper proposes a generic method to address such an issue, taking advantage of the recursion embedded in the triggered-by-message principle of the DEVS simulation protocol. The applicability of the method is shown through the complexity analysis of various DEVS simulation algorithms.