Hyper Hoare Logic: (Dis-)Proving Program Hyperproperties

We formalize a Hoare logic for the partial correctness of while programs in PVS and prove its soundness and relative completeness. We use the PVS higher-order logic to define the syntax and semantics of a small imperative programming language, and describe a proof system for Hoare triples involving programs in this language. We prove the soundness of the proof system by demonstrating that only valid triples are provable. We also demonstrate the relative completeness of the proof system by defining the weakest liberal precondition operator and using it to prove that all valid Hoare triples are provable modulo the assertion logic. Finally, we verify a verification condition generator for Hoare logic Variants of Hoare logic have been formalized before in PVS and using other interactive proof assistants. We use Hoare logic as a tutorial exercise to illustrate the effective use of PVS in capturing the syntax and semantics of embedded logics. The embedding of Hoare logic is simple enough to be easily reproduced by the reader, but it also illustrates some of the nuances of formalization and proof using PVS, in particular, and higher-order logic, in general.

Starting with Hoare Logic over 50 years ago, numerous program logics have been devised to reason about the different kinds of programs encountered in the real world. This includes reasoning about computational effects, particularly those effects that cause the program execution to branch into multiple paths due to, e.g., nondeterministic or probabilistic choice. Outcome Logic reimagines Hoare Logic with branching at its core, using an algebraic representation of choice to capture programs that branch into many outcomes. In this article, we give a comprehensive account of the Outcome Logic metatheory. This includes a relatively complete proof system for Outcome Logic with the ability to reason about general purpose looping. We also show that this proof system applies to programs with various types of branching, that it subsumes some well-known logics such as Hoare Logic, and that it facilitates the reuse of proof fragments across different kinds of specifications.

Incorrectness Separation Logic (ISL) is a proof system that is tailored specifically to resolve problems of under-approximation in programs that manipulate heaps, and it primarily focuses on bug detection. This approach is different from the over-approximation methods that are used in traditional logics such as Hoare Logic or Separation Logic. Although the soundness of ISL has been established, its completeness remains unproven. In this study, we establish relative completeness by leveraging the expressiveness of the weakest postconditions; expressiveness is a factor that is critical to demonstrating relative completeness in Reverse Hoare Logic. In our ISL framework, we allow for infinite disjunctions in disjunctive normal forms, where each clause comprises finite symbolic heaps with existential quantifiers. To compute the weakest postconditions in ISL, we introduce a canonicalization that includes variable aliasing.

The Business Process Model and Notation (BPMN) has become a widely accepted standard for business process modeling. However, much of the formal verification research on BPMN is based on earlier versions and often overlooks unstructured and loop elements. This paper presents a novel approach to BPMN verification using Hoare logic. In this paper, we enhance the expressiveness and precision of BPMN by explicitly incorporating conditions into decision gateways and loop tasks. Based on this enhancement, we provide formal semantics and dynamic state explanations for BPMN diagrams. A framework is designed to partition BPMN diagrams and verify properties with our proof system based on Hoare logic, offering an intuitive, state-space explosion-free method. A logistics case study demonstrates the framework’s applicability and effectiveness.

We propose a simple compositional program logic for an imperative extension of call-by-value PCF, built on Hoare logic and our preceding work on program logics for pure higher-order functions. A systematic use of names and operations on them allows precise and general description of complex higher-order imperative behaviour. The logic offers a foundation for general treatment of aliasing and local state on its basis, with minimal extensions. After establishing soundness, we prove that valid assertions for programs completely characterise their behaviour up to observational congruence, which is proved using a variant of finite canonical forms. The use of the logic is illustrated through reasoning examples which are hard to assert and infer using existing program logics.

Automated verification of all members of a (potentially infinite) set of programs has the potential to be useful in program synthesis, as well as in verification of dynamically loaded code, concurrent code, and language properties. Existing techniques for verification of sets of programs are limited in scope and unable to create or use interpretable or reusable information about sets of programs. The consequence is that one cannot learn anything from one verification problem that can be used in another. Unrealizability logic (UL), proposed by Kim et al. as the first Hoare-style proof system to prove properties over sets of programs (defined by a regular tree grammar), presents a theoretical framework that can express and use reusable insight. In particular, UL features nonterminal summaries ---inductive facts that characterize recursive nonterminals (analogous to procedure summaries in Hoare logic). In this work, we design the first UL proof synthesis algorithm, implemented as Wuldo. Specifically, we decouple the problem of deciding how to apply UL rules from the problem of synthesizing/checking nonterminal summaries by computing proof structure in a fully syntax-directed fashion. We show that Wuldo, when provided nonterminal summaries, can express and prove verification problems beyond the reach of existing tools, including establishing how infinitely many programs behave on infinitely many inputs. In some cases, Wuldo can even synthesize the necessary nonterminal summaries. Moreover, Wuldo can reuse previously proven nonterminal summaries across verification queries, making verification 1.96 times as fast as when summaries are instead proven from scratch.

We present the verification of the normalization of a binary decision diagram (BDD). The normalization follows the original algorithm presented by Bryant in 1986 and transforms an ordered BDD in a reduced, ordered and shared BDD. The verification is based on Hoare logics and is carried out in the theorem prover Isabelle/HOL. The work is both a case study for verification of procedures on a complex pointer structure, as well as interesting on its own, since it is the first proof of functional correctness of the pointer based normalization process we are aware of.

The object of this study is the process of automatic formation of fuzzy production rules on the basis of a training sample for solving the classification problem. The problem of automatically creating and then checking the correctness of a fuzzy inference model for a classification task is solved. The result is an automatically constructed correct database of rules for solving the classification problem. Analysis of the correctness of the knowledge base is carried out using the criteria of completeness, minimality, coherence, and consistency. To prove the completeness of the rule base, Hoare logic and the resolution method are used. The quality of the classification is assessed using such metrics as accuracy, precision, recall, f1-score. The dependence of the classification result on the size of the training sample is considered. The expert system has the following features: the ability to learn from data; high level of accuracy; the correct knowledge base. The knowledge base is formed using the objects of the training sample on the basis of linguistic variables and term sets. A production model of knowledge representation is applied, combining the Mamdani and Takagi-Sugeno-Kang models. It is assumed that the left parts of the production rules describe combinations of the features of objects, and the right parts correspond to classes. The matrix representation of the antecedents of the rules is used. Consequents are represented as a column vector. For the automatic construction of the matrix of antecedents, it is proposed to use the Cartesian product. The formation of the consequent vector is carried out automatically using domain data and a training procedure. The resulting expert system can be used to solve the problems of classification, clustering, data mining, and big data analysis

By combining program logic and static analysis, we present an automatic approach to construct program proofs to be used in Proof-Carrying Code. We use Hoare logic in representing the proofs of program properties, and the abstract interpretation in computing the program properties. This combination automatizes proof construction; an abstract interpretation automatically estimates program properties (approximate invariants) of our interest, and our proof-construction method constructs a Hoare-proof for those approximate invariants. The proof-checking side (code consumer’s side) is insensitive to a specific static analysis; the assertions in the Hoare proofs are always first-order logic formulas for integers, into which we first compile the abstract interpreters’ results. Both the property-compilation and the proof construction refer to the standard safety conditions that are prescribed in the abstract interpretation framework. We demonstrate this approach for a simple imperative language with an example property being the integer ranges of program variables. We prove the correctness of our approach, and analyze the size complexity of the generated proofs.

A new first-order logic, functional logic, was proposed recently by Staples, Robinson and Hazel. The logic provides a formal means of describing and reasoning about dependence on an implicit parameter, a prime motivation being the unification of the Hoare logic used to reason about procedural programs with the powerful and well established techniques of classical logic. Viewed more abstractly, independently of possible applications, functional logic may be described as a logic with primitives, axioms and inference rules appropriate for reasoning about the properties of mathematical functions. In this paper, the completeness of functional logic is proved; that is, it is shown that any term of a theory in the logic which is true in all models is a theorem.

This paper presents a type system for logic programs that supports parametric polymorphism and subtypes. This system follows most knowledge representation and object-oriented schemes in that subtyping is name-based , i.e., τ 1 is considered to be a subtype of τ 2 iff it is declared as such. We take this as a fundamental principle in the sense that type declarations have the form of subtype constraints. Types are assigned meaning by viewing such constraints as Horn clauses that, together with a few basic axioms, define a subtype predicate. This technique provides a (least) model for types and, at the same time, a sound and complete proof system for deriving subtypes. Using this proof system, we define well-typedness conditions which ensure that a logic program/query respects a set of predicate types. We prove that these conditions are consistent in the sense that every atom of every resolvent produced during the execution of a well-typed program is consistent with its type.

We present a novel program verification approach based on coinduction, which takes as input an operational semantics. No intermediates like program logics or verification condition generators are needed. Specifications can be written using any state predicates. We implement our approach in Coq, giving a certifying language-independent verification framework. Our proof system is implemented as a single module imported unchanged into language-specific proofs. Automation is reached by instantiating a generic heuristic with language-specific tactics. Manual assistance is also smoothly allowed at points the automation cannot handle. We demonstrate the power and versatility of our approach by verifying algorithms as complicated as Schorr-Waite graph marking and instantiating our framework for object languages in several styles of semantics. Finally, we show that our coinductive approach subsumes reachability logic, a recent language-independent sound and (relatively) complete logic for program verification that has been instantiated with operational semantics of languages as complex as C, Java and JavaScript.

interpretation is a well-known and extensively used method to extract over-approximate program invariants by a sound program analysis algorithm. Soundness means that no program errors are lost and it is, in principle, guaranteed by construction. Completeness means that the abstract interpreter reports no false alarms for all possible inputs, but this is extremely rare because it needs a very precise analysis. We introduce a weaker notion of completeness, called local completeness , which requires that no false alarms are produced only relatively to some fixed program inputs. Based on this idea, we introduce a program logic, called Local Completeness Logic for an abstract domain A , for proving both the correctness and incorrectness of program specifications. Our proof system, which is parameterized by an abstract domain A , combines over- and under-approximating reasoning. In a provable triple ⊦ A [ p ] 𝖼 [ q ], 𝖼 is a program, q is an under-approximation of the strongest post-condition of 𝖼 on input p such that their abstractions in A coincide. This means that q is never too coarse, namely, under some mild assumptions, the abstract interpretation of 𝖼 does not yield false alarms for the input p iff q has no alarm . Therefore, proving ⊦ A [ p ] 𝖼 [ q ] not only ensures that all the alarms raised in q are true ones, but also that if q does not raise alarms, then 𝖼 is correct. We also prove that if A is the straightforward abstraction making all program properties equivalent, then our program logic coincides with O’Hearn’s incorrectness logic, while for any other abstraction, contrary to the case of incorrectness logic, our logic can also establish program correctness.

A methodology for developing sound proof systems for program verification is demonstrated by the development of a proof system for reasoning about concurrent programs based on the unity logic of K.M. Chandy and J. Misra (1988). This proof system has been validated by an automated theorem prover, a computer program that checks the correctness of proofs. The Boyer-Moore logic in which the proof system is formalized and the Boyer-Moore theorem prover which mechanizes this logic are described. The motivation behind the unity logic and the way in which it may be used to prove the correctness of concurrent programs are examined. A proof system for concurrent programs based on the unity logic system is provided as an example. An operational semantics of concurrency is formalized in Boyer-Moore logic by use of the transition system model. Unity's proof rules are proved as theorems about this operational semantics. The proofs of these theorems are mechanically checked. The entire proof system has been verified by the Boyer-Moore prover, making it possible to prove mechanically the consequence of other concurrent programs.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

Some natural structures which fail to possess a sound and decidable hoare-like logic for their while-programs