On algebraic array theories

In this paper we present a new shape analysis algorithm. The key distinguishing aspect of our algorithm is that it is completely compositional, bottom-up and non-iterative. We present our algorithm as an inference system for computing Hoare triples summarizing heap manipulating programs. Our inference rules are compositional: Hoare triples for a compound statement are computed from the Hoare triples of its component statements. These inference rules are used as the basis for a bottom-up shape analysis of programs.Specifically, we present a logic of iterated separation formula (LISF) which uses the iterated separating conjunct of Reynolds [17] to represent program states. A key ingredient of our inference rules is a strong bi-abduction operation between two logical formulas. We describe sound strong bi-abduction and satisfiability decision procedures for LISF.We have built a prototype tool that implements these inference rules and have evaluated it on standard shape analysis benchmark programs. Preliminary results show that our tool can generate expressive summaries, which are complete functional specifications in many cases.KeywordsModel CheckInference RuleAuxiliary VariableShape AnalysisCompose RuleThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Separation logic (SL) is a logical formalism for reasoning about programs that use pointers to mutate data structures. It is successful for program verification as an assertion language to state properties about memory heaps using Hoare triples. Most of the proof systems and verification tools for ${\textrm{SL}}$ focus on the decidable but rather restricted symbolic heaps fragment. Moreover, recent proof systems that go beyond symbolic heaps are purely syntactic or labelled systems dedicated to some fragments of ${\textrm{SL}}$ and they mainly allow either the full set of connectives, or the definition of arbitrary inductive predicates, but not both. In this work, we present a labelled proof system, called ${\textrm{G}_{\textrm{SL}}}$, that allows both the definition of cyclic proofs with arbitrary inductive predicates and the full set of SL connectives. We prove its soundness and show that we can derive in ${\textrm{G}_{\textrm{SL}}}$ the built-in rules for data structures of another non-cyclic labelled proof system and also that ${\textrm{G}_{\textrm{SL}}}$ is strictly more powerful than that system.

We combine first-order dynamic logic for reasoning about possible behaviour of hybrid systems with temporal logic for reasoning about the temporal behaviour during their operation. Our logic supports verification of hybrid programs with first-order definable flows and provides a uniform treatment of discrete and continuous evolution. For our combined logic, we generalise the semantics of dynamic modalities to refer to hybrid traces instead of final states. Further, we prove that this gives a conservative extension of dynamic logic. On this basis, we provide a modular verification calculus that reduces correctness of temporal behaviour of hybrid systems to non-temporal reasoning. Using this calculus, we analyse safety invariants in a train control system and symbolically synthesise parametric safety constraints.Keywordsdynamic logictemporal logicsequent calculuslogic for hybrid systemsdeductive verification of embedded systems

Prawitz suggested expanding a natural deduction system for intuitionistic logic to include rules for classical logic constructors, allowing both intuitionistic and classical elements to coexist without losing their inherent characteristics. Looking at the added rules from the point of view of the Gödel-Gentzen translation, led us to propose a general method for the coexistent combination of two logics when a conservative translation exists from one logic (the source) to another (the host). Then we prove that the combined logic is a conservative extension of the original logics, thereby preserving the unique characteristics of each component logic. In this way there is no collapse of one logic into the other in the combination. We also demonstrate that a Gentzen calculus for the combined logic can be induced from a Gentzen calculus for the host logic by considering the translation. This approach applies to semantics as well. We then establish a general sufficient condition for ensuring that the combined logic is both sound and complete. We apply these principles by combining classical and intuitionistic logics capitalizing on the Gödel-Gentzen conservative translation, intuitionistic and S4 modal logics relying on the Gödel-McKinsey-Tarski conservative translation, and classical and Jaśkowski’s paraconsistent logics taking into account the existence of a conservative translation.

Research on the automatic verification of heap-manipulating programs (HMPs)--programs that manipulate unbounded linked data structures via pointers --has blossomed recently, with many different approaches all showing leaps in performance and expressiveness. A year ago, we proposed a small logic for specifying predicates about HMPs and demonstrated that an inference-rule-based decision procedure could be performance-competitive, and in many cases superior to other methods known at the time. That work, however, was a proof-of-concept, with a logic fragment too small to verify most real programs. In this work, we generalize our previous results to be practically useful: we allow the data in heap nodes to be mutable, we allow more than a single pointer field, and we add new primitives needed to verify cyclic structures. Each of these extensions necessitates new or changed inference rules, with the concomitant changes to the proofs and decision procedure. Yet, our new decision procedure, with the more general logic, actually runs as fast as our previous results. With these generalizations, we can automatically verify many more HMP examples, including three small container functions from the Linux kernel.

The ternary T-gate can be used as a basic building block to construct both combinational and sequential circuits. Since the T-gate is one kind of tree-type universal logic module, any combinational circuit can be built up with modular logic arrays. For constructing ternary memory elements, however, the T-gate is required to be static hazard-free. A theoretical study is done on the necessary conditions for the practical realization of the static-hazard-free T-gate. On the basis of the result obtained, the static-hazard-free T-gate is realized using the ECL technique. The static-hazard-free T-gates obtained here can be used as building blocks to construct memory elements. Various memory elements such as D flip-flap-flop (FFF), D master-slave FFF, B master-slave FFF, and counting FFF is constructed easily. Using these memory elements, three different types of ternary counters can be designed and realized. They are an asynchronous signed ternary counter, a synchronous signed ternary counter, and a counter based on a shift register. Their design methods are discussed. These ternary counters are superior to the binary ones in that the up-down cotnting can easily be carried out by one input signal.

A common feature in Answer Set Programming is the use of a second negation, stronger than default negation and sometimes called explicit, strong or classical negation. This explicit negation is normally used in front of atoms, rather than allowing its use as a regular operator. In this paper we consider the arbitrary combination of explicit negation with nested expressions, as those defined by Lifschitz, Tang and Turner. We extend the concept of reduct for this new syntax and then prove that it can be captured by an extension of Equilibrium Logic with this second negation. We study some properties of this variant and compare to the already known combination of Equilibrium Logic with Nelson’s strong negation.

Research in automated program verification against specifications written in first-order logic has come a long way. Ever-faster Satisfiability Modulo Theories (SMT) solvers [Barrett et al. 2010] promise to verify program instructions quickly against specifications. Unfortunately, aliasing still prevents automated program verification tools from easily and soundly verifying interesting programs. This paper introduces the use of symbolic permissions as the basis for sound automated program verification. Symbolic permissions provide a simple alias control mechanism with expressiveness similar to the well-known fractional permissions [Boyland 2003]. The paper shows that symbolic permissions can be enforced with a linear refinement typechecking procedure. Once permissions are checked, aliasing can essentially be ignored for the purposes of program verification, which allows taking full advantage of SMT solvers for doing the heavy verification lifting. The paper shows that a verification tool based on symbolic permissions can easily verify a design pattern with inherent aliasing challenges.

We present an abstraction of Hoare logic to traced symmetric monoidal categories, a very general framework for the theory of systems. We first identify a particular class of functors – which we call ‘verification functors’ – between traced symmetric monoidal categories and subcategories of Preord (the category of preordered sets and monotone mappings). We then give an abstract definition of Hoare triples, parametrised by a verification functor, and prove a single soundness and completeness theorem for such triples. In the particular case of the traced symmetric monoidal category of while programs we get back Hoare’s original rules. We discuss how our framework handles extensions of the Hoare logic for while programs, e.g. the extension with pointer manipulations via separation logic. Finally, we give an example of how our theory can be used in the development of new Hoare logics: we present a new sound and complete set of Hoare-logic-like rules for the verification of linear dynamical systems, modelled via stream circuits.

We introduce an extension of first-order logic that comes equipped with additional predicates for reasoning about an abstract state. Sequents in the logic comprise a main formula together with pre- and postconditions in the style of Hoare logic, and the axioms and rules of the logic ensure that the assertions about the state compose in the correct way. The main result of the paper is a realizability interpretation of our logic that extracts programs into a mixed functional/imperative language. All programs expressible in this language act on the state in a sequential manner, and we make this intuition precise by interpreting them in a semantic metatheory using the state monad. Our basic framework is very general, and our intention is that it can be instantiated and extended in a variety of different ways. We outline in detail one such extension: A monadic version of Heyting arithmetic with a wellfounded while rule, and conclude by outlining several other directions for future work.

The design of asynchronous sequential circuits is commonly related to the problem of observing some specific timing constraints to avoid unreliable behaviour. State assignment and hazard-free construction of the combinational circuits for the state transition equations are the most essential topics to investigate. They contribute significantly to the design, particularly in comparison with that of synchronously operated systems. On the other hand, the application of digital circuitry for solving control tasks implies more and more asynchronous interaction between the controller and the controlled unit, and also the use of modern, highly-integrated modules. This paper investigates the possibility of applying arbitrarily chosen, but unique, codes for state assignments, using l.s.i. memories and programmable logic arrays for implementing more complex asynchronous sequential circuits than is possible with discrete or s.s.i/m.s.i. components. A basic model is derived to describe the time properties of such matrix arrays, and design rules are established to decide easily by some simple measurements, if a given module may be used in that application. The results of a broad investigation into available memories and field-programmable logic arrays show that reliable asynchronous sequential circuits may be implemented without having hazard problems and the need for special state-assignment procedures.

After some general remarks about program verification, we introduce separation logic, a novel extension of Hoare logic that can strengthen the applicability and scalability of program verification for imperative programs that use shared mutable data structures or shared-memory concurrency.

The Toolkit for Accurate Scientific Software (TASS) is a suite of tools for the formal verification of MPI-based parallel programs used in computational science. TASS can verify various safety properties as well as compare two programs for functional equivalence. The TASS front end takes an integer n ≥ 1 and a C/MPI program, and constructs an abstract model of the program with n processes. Procedures, structs, (multi-dimensional) arrays, heap-allocated data, pointers, and pointer arithmetic are all representable in a TASS model. The model is then explored using symbolic execution and explicit state space enumeration. A number of techniques are used to reduce the time and memory consumed. A variety of realistic MPI programs have been verified with TASS, including Jacobi iteration and manager-worker type programs, and some subtle defects have been discovered. TASS is written in Java and is available from http://vsl.cis.udel.edu/tass under the Gnu Public License.

These are the notes to accompany a course at the Marktoberdorf PhD summer school in 2011. The course consists of an introduction to separation logic, with a slant towards its use in automatic program verification and analysis.

Mission-critical systems require increasing capability for fault handling and self-adaptation as their system complexities and inter-dependencies increase. Organic Computing (OC) architectures utilize biologically-inspired self-x properties which include self-configuration, self-reorganization, and self-healing which comprise the focus of this paper. To provide OC architectures with sufficient capability for exhibiting self-adaptive behavior, reconfigurable logic devices offer a suitable hardware platform. SRAM-based Field Programmable Gate Array (FPGA) logic devices can realize self-adaptation within their reconfigurable logic fabric using Evolvable Hardware techniques based on crossover, mutation, and iterative selection with intrinsic fitness assessment of the underlying hardware resources. In this paper, a dual-layer Organic Computing architecture called the Organic Embedded System (OES) is prototyped on a Xilinx FPGA reconfigurable fabric and assessed for maintainability metrics of completeness of repair, repair time, and degraded throughput during the repair phase. The approach used extends a widely known generic OC platform consisting of two layers: the Functional Layer and the Autonomic Layer. The Autonomic layer contains Autonomic Elements (AEs) that are responsible for correct operation of the corresponding Functional Elements (FEs) present on the Functional Layer. Innovations include autonomously degraded online throughput during regeneration, spare configuration aging and outlier driven repair assessment, and a uniform design for AEs despite the fact that they monitor different types of FEs. Using the OES approach; a malfunctioning or faulty AE among the population can be distinguished by its discrepant performance. The OES approach is implemented using high-level Hardware Description Language (HDL) which directs a Supervisor Element (SE) to function as a fault management unit through the collection of AE information. Experimental results show that the OES Autonomic Layer demonstrates 100% faulty component isolation for both FEs and AEs with randomly injected single faults. Using logic circuits from the MCNC-91 benchmark test set, throughput during repair phases averaged 75.05%, 82.21%, and 65.21% for the z4ml (2-bit adder), cm85a (high fan-in combinational logic), and cm138a (balanced I/O combinational logic) circuits respectively under stated conditions.