Specialized Predictor for Reaction Systems with Context Properties

This paper presents a correct and complete algorithm that translates propositional linear time temporal logic (PTL) formulae to event-based automata for finitary control synthesis. It proposes the translation algorithm as a specification interface to well-established automata-theoretic control synthesis methods for discrete-event systems (DES’s). This allows control requirements to be more easily described and understood in an expressive and readable language that temporal logic is widely recognized as. Adding such a translation interface effectively combines specifiability and readability in temporal logic with prescriptiveness and computability in automata. The former temporal logic features support specification while the latter automata features support the prescription of DES dynamics and algorithmic computations. A practical implementation of the interface has been developed, providing an enabling technology for writing more readable control specifications in PTL that it translates for finitary control synthesis in automata. A simple example illustrates the use of the proposed temporal logic interface. Practical implications of the complexity of the translation algorithm are discussed.

This paper presents an approach to simulate and verify the CTCS-3 (Chinese Train Control System 3) protocol with a Modeling, Simulation and Verification Language (MSVL) which is an executable subset of Projection Temporal Logic (PTL). First, the syntax and semantics of PTL and MSVL are briefly introduced. Then, CTCS-3 protocol is briefly presented and a simplified CTCS-3 protocol described by an MSVL program is given, and the property to be verified is specified by a Propositional Projection Temporal Logic (PPTL) formula. Finally, the simulation is conducted by means of the interpreter of MSVL. A dynamic graph showing behavior of train is depicted. Based on the graph, we can verify whether or not the protocol satisfies the property.

We present a new procedure for the translation of propositional linear-time temporal logic (LTL) formulas to equivalent nondeterministic Buchi automata. Our procedure is based on simulation relations for alternating Buchi automata. Whereas most of the procedures that have been described in the past compute simulation relations in the last step of the translation (after a nondeterministic Buchi automaton has already been constructed), our procedure computes simulation relations for alternating Buchi automata in an early stage and uses them in an on the-fly fashion. This decreases the time and space consumption without sacrificing the potential of simulation relations. We present experimental results that demonstrate the advantages of our approach: Our procedure is faster than TMP but produces, on the average, automata of about the same size; LTL2BA is faster than our procedure but produces larger automata.

In this paper, we propose a DSE based model checking approach (DSE-MC) for verifying programs written in Modelling, Simulation and Verification Language (MSVL) [1, 3]. For doing so, we adopt a DSE method to execute an MSVL program to generate a symbolic execution tree (SEtree) which is used as the abstract model of the program. Further, a property to be verified is specified by a Propositional Projection Temporal Logic (PPTL) formula [8, 13]. To check whether or not the program satisfies the property, first the SEtree and the negation of the property are both described in Labelled Normal Form Graphs (LNFGs) [21], then the product of two LNFGs is produced. As a result, a counter example is encountered if the product is not empty. Otherwise, we cannot determine if the program satisfies the property. In this case, the verification process could be restarted with new inputs. In this way, a software system written in C can also be verified since the C program can be transformed to an MSVL program automatically by using toolkit MSV [19] developed by us.KeywordsDSEConstraintsTemporal logicMSVLModel checking

Subject of Research. The paper presents the study of vulnerability exploitation techniques in the implementation of dynamic memory allocation algorithms (glibc library allocator): Poisoned Null-byte, Overlapped Chunks, Fastbin Attack,Unsafe Unlink, House of Einherjar, House of Force, House of Spirit, House of Lore, Unsorted Bin Attack. Examples of vulnerability exploitation code and classification of the presented techniques are given in accordance with the Common Weakness Enumeration list. The modern methods and means of vulnerabilities detection are studied; their advantages and disadvantages are shown using the Heap Hopper framework as an example. Modern methods of appropriate software verification are considered. Method. The proposed software verification method combines the approaches of static analysis and symbolic execution using an accurate model of algorithms for dynamic memory allocation. In the compilation process of program being tested, the Kripke structure is created. Dynamic memory vulnerabilities are described by temporal logic formulas. The resulting structure and formulas are passed at the input of the model checking algorithm. Concrete-symbolic execution of the assembled binary file is performed. Vulnerability conditions expressed in the form of propositional logic formulas are checked for symbolic execution paths. Main Results. The practical use of the proposed approach to detection of dynamic memory vulnerabilities in software applications is shown. Symbolic execution is implemented in the form of a low-level debugger, which reduces the operating time of algorithms due to the execution of the application being tested on a real processor. Practical Relevance. The paper presents an integrated approach for solving the problem of automatic vulnerabilities detecting at different stages of the software development life cycle. This approach is applicable for verification of the similar implementations of dynamic memory allocators, such as ptmalloc, dlmalloc, tcmalloc, jemalloc and musl.

Our terminology and notation is the same as that of [1], of which this note is a sequel.We wish to show that if we take the natural deduction system (N) described in [1], and delete the rules for the quantifiers, we obtain a complete system for propositional logic. [Of course we now construe “X”, “Y”, “Z” as syntactic variables ranging over formulas of propositional logic, rather than sentences of quantification theory.] Moreover the system serves as a neat decision procedure.

In this paper we describe a teaching tool for proving equivalences between propositional logic formulae, using rewrite rules such as De Morgan’s laws and double negation. This tool is based on an earlier tool for rewriting logical formulae into disjunctive normal form (DNF). Both tools make use of a rewrite strategy, which specifies how an exercise can be solved stepwise. Different types of feedback can be calculated automatically from such a strategy specification. We describe a strategy for constructing expert-like equivalence proofs, and present two techniques for improving the proofs that are generated by the strategy.Keywordspropositional logicequivalencese-learningfeedback

Space Bounds for Resolution

On the hydra number of disconnected graphs

AI systems often need to deal with inconsistent information. For this reason since the early 2000s some AI researchers have developed ways to measure the amount of inconsistency in a knowledge base. By now there is a substantial amount of research about various aspects of inconsistency measuring. The problem is that most of this work applies only to knowledge bases formulated as sets of formulas in propositional logic. Hence this work is not really applicable to the way that information is actually stored. The purpose of this paper is to extend inconsistency measuring to real world information. We first define the concept of general information space which encompasses various types of databases and scenarios in AI systems. Then, we show how to transform any general information space to an inconsistency equivalent propositional knowledge base, and finally apply propositional inconsistency measures to find the inconsistency of the general information space. Our method allows for the direct comparison of the inconsistency of different information spaces, even though the data is presented in different ways. We demonstrate the transformation on three general information spaces: a relational database, a graph database, and a Blocks world scenario, where we apply several inconsistency measures after performing the transformation.

We describe an incremental algorithm for computing interpolants for a pair ϕ A , ϕ B of formulas in propositional logic. In contrast with the common approaches, our method does not require a proof of unsatisfiability of ϕ A ∧ ϕ B , and can be realized using any SAT solver as a black box. We achieve this by combining model enumeration with the ability to easily generate interpolants in the special case that one of the formulas is a cube.

Cut formulas in propositional logic

A catalog of Boolean concepts

In bounded model checking (BMC) a system is modeled with a finite automaton and various desired properties with temporal logic formulae. Property verification is achieved by translation into boolean logic and the application of SAT-solvers. bounded satisfiability checking (BSC) adopts a similar approach, but both the system and the properties are modeled with temporal logic formulae, without an underlying operational model. Hence, BSC supports a higher-level, descriptive approach to system specification and analysis. We compare the performance of BMC and BSC over a set of case studies, using the Zot tool to translate automata and temporal logic formulae into boolean logic. We also propose a method to check whether an operational model is a correct implementation (refinement) of a temporal logic model, and assess its effectiveness on the same set of case studies. Our experimental results show the feasibility of BSC and refinement checking, with modest performance loss w.r.t. BMC.

We demonstrate the first Recurrent Neural Network architecture for learning\nSignal Temporal Logic formulas, and present the first systematic comparison of\nformula inference methods. Legacy systems embed much expert knowledge which is\nnot explicitly formalized. There is great interest in learning formal\nspecifications that characterize the ideal behavior of such systems -- that is,\nformulas in temporal logic that are satisfied by the system's output signals.\nSuch specifications can be used to better understand the system's behavior and\nimprove design of its next iteration. Previous inference methods either assumed\ncertain formula templates, or did a heuristic enumeration of all possible\ntemplates. This work proposes a neural network architecture that infers the\nformula structure via gradient descent, eliminating the need for imposing any\nspecific templates. It combines learning of formula structure and parameters in\none optimization. Through systematic comparison, we demonstrate that this\nmethod achieves similar or better mis-classification rates (MCR) than\nenumerative and lattice methods. We also observe that different formulas can\nachieve similar MCR, empirically demonstrating the under-determinism of the\nproblem of temporal logic inference.\n