Verification of forward simulations with thread-local, step-local proof obligations

The B Method is a full spectrum formal software development method that covers the software process from specification to implementation. The method uses state machines, defined using logic and set theory with a notation similar to that of Z, that export operations. The method supports a notion of refinement and implementation, which is based on the notion of refinement in the refinement calculus with the exception that there is no distinction between procedural and data refinement. The B Toolkit is a configuration tool that manages developments under the B Method, generating proof obligations and supporting tools for the discharge of those proof obligations. There is also support for the generation of documentation, and for the browsing of developments.

Recent trends have led hardware manufacturers to place multiple processing cores on a single chip, making parallel programming the intended way of taking advantage of the increased processing power. However, bringing concurrency to average programmers is considered to be one of the major challenges in computer science today. The difficulty lies not only in writing correct parallel programs, but also in achieving the required efficiency and performance. For parallel programs, performance is not only about obtaining low execution times on a fixed number of cores, but also about maintaining efficiency as the number of available cores is increased. Ideally, programmers should have in their toolkit techniques that can be used when designing parallel programs, before any code is available for testing on production hardware, and which are then able to predict scalability once the program is implemented. Existing methods are either unreliable at predicting scalability, such as the case of disjoint-access parallelism, or do not apply to lock-based programs, which currently make up a large part of existing concurrent programs. Furthermore, using some of these techniques is so complicated that it outweighs the time required to implement, debug and test the program on real hardware. In this thesis we study the problem of predicting the scalability of concurrent programs without implementing them. This allows programmers in the design phase of a concurrent algorithm to choose only one or a few promising solutions that will be implemented, debugged and tested on production hardware. We first consider disjoint-access parallelism, an existing property that applies only to a very restricted class of programs. After an extensive practical evaluation spanning across a variety of scenarios, we find it to be ineffective at predicting scalability. For predicting the scalability of more general concurrent algorithms, we propose the obstruction degree, a new scalability metric based on the consistency requirements of algorithms. It applies to programs using locks, invalidation primitives and transactional memory. Our metric allows programmers to compare two given algorithms as well as predict their scalability limit, the maximum number of processors to which they can scale, thus allowing programmers to choose the appropriate size hardware for running their programs. We also examine the composition of relaxed memory transactions in order to combine the ease of programming offered by transactional memory with the increased scalability of transactions that circumvent the traditional transactional model. We present outheritance, a property we show to be both necessary and sufficient for ensuring the correct composition of relaxed transactions, and we show how to calculate the obstruction degree of compositions that use this new property. We use outheritance to build OE-STM, a new software transactional memory algorithm having elastic transactions that correctly compose.

The ultimate goal of program verification is not the theory behind the tools or the tools themselves, but the application of the theory and tools in the software engineering process. Our society relies on the correctness of a vast and growing amount of software. Improving the software engineering process is an important, long-term goal with many steps. Two of those steps are the KeY tool and this KeY book. The material is presented on an advanced level suitable for graduate courses and, of course, active researchers with an interest in verification. The underlying verification paradigm is deductive verification in an expressive program logic. The logic used for reasoning about programs is not a minimalist version suitable for theoretical investigations, but an industrial-strength version. The first-order part is equipped with a type system for modelling of object hierarchies, with underspecification, and with various built-in theories. The program logic covers full Java Card (plus a bit more such as multi-dimensional arrays, characters, and long integers). A lot of emphasis is thereby put on specification, including two widely-used object-oriented specification languages (OCL and JML) and even an interface to natural language generation. The generation of proof obligations from specified code is discussed at length. The book is rounded off by two substantial case studies that are included and presented in detail.

Preface: Volume 50, Issue 4

A data structure is said to be persistent when any update operation returns a new structure without altering the old version. This paper introduces a new notion of persistence, called semi-persistence, where only ancestors of the most recent version can be accessed or updated. Making a data structure semi-persistent may improve its time and space complexity. This is of particular interest in backtracking algorithms manipulating persistent data structures, where this property is usually satisfied. We propose a proof system to statically check the valid use of semi-persistent data structures. It requires a few annotations from the user and then generates proof obligations that are automatically discharged by a dedicated decision procedure.

Automata-Driven Automated Induction

The paper describes the CARE toolset for interactive development of verified programs from formal specifications. The software engineer begins by giving a characterization of the application domain in the form of a mathematical theory. CARE tools are then used to progressively design a program by sketching out the program structure and gradually filling in the details. At any stage the correctness of the partial design can be checked by using one of the CARE tools to generate proof obligations. Another tool gives access to pre-proven parameterised design templates which encapsulate useful programming knowledge. When the design is complete, a third CARE tool is used to automatically synthesize a source code program which-if all the proof obligations can be discharged-is guaranteed to meet its formal specification. The knowledge base of CARE can be extended by users in a soundness-preserving manner to include reusable domain theories, library routines, design templates and proof tactics. The CARE toolset includes a fully automatic resolution-based theorem prover which will discharge many of the simpler proof obligations, and a general-purpose interactive theorem prover for the rest.

Integration of SMT-solvers in B and Event-B development environments

A general automaton model for timing-based systems is presented and is used as the context for developing a variety of simulation proof techniques for such systems. As a first step, a comprehensive overview of simulation techniques for simple untimed automata is given. In particular, soundness and completeness results for (1) refinements, (2) forward and backward simulations, (3) forward-backward and backward-forward simulations, and (4) history and prophecy relations are given. History and prophecy relations are new and are abstractions of the history variables of Owicki and Gries and the prophecy variables of Abadi and Lamport, respectively. As a subsequent step, it is shown how most of the results for untimed automata can be carried over to the setting of timed automata. In fact many of the results for the timed case are obtained as consequences of the analogous results for the untimed case.

Proving correctness of concurrent systems is quite difficult because of the high level of nondeterminism, especially in large and complex ones. AMC is a model checking system for verifying asynchronous concurrent systems by using branching time temporal logic. This paper introduces the techniques of the modelling approach, especially how to construct models for large concurrent systems with the concept of hierarchy, which has been proved to be effective and practical in verifying large systems without a large growth of cost.

Anisotropic mesh adaptation is a powerful way to directly minimise the computational cost of mesh based simulation. It is particularly important for multi-scale problems where the required number of floating-point operations can be reduced by orders of magnitude relative to more traditional static mesh approaches. Increasingly, finite element/volume codes are being optimised for modern multicore architectures. Inter-node parallelism for mesh adaptivity has been successfully implemented by a number of groups using domain decomposition methods. However, thread-level parallelism using programming models such as OpenMP is significantly more challenging because the underlying data structures are extensively modified during mesh adaptation and a greater degree of parallelism must be realised while keeping the code race-free. In this thesis we describe a new thread-parallel implementation of four anisotropic mesh adaptation algorithms, namely edge coarsening, element refinement, edge swapping and vertex smoothing. For each of the mesh optimisation phases we describe how safe parallel execution is guaranteed by processing workitems in batches of independent sets and using a deferredoperations strategy to update the mesh data structures in parallel without data contention. Scalable execution is further assisted by creating worklists using atomic operations, which provides a synchronisation-free alternative to reduction-based worklist algorithms. Additionally, we compare graph colouring methods for the creation of independent sets and present an improved version which can run up to 50% faster than existing techniques. Finally, we describe some early work on an interrupt-driven work-sharing for-loop scheduler which is shown to perform better than existing workstealing schedulers. Combining all aforementioned novel techniques, which are generally applicable to other unordered irregular problems, we show that despite the complex nature of mesh adaptation and inherent load imbalances, we achieve

A population protocol is one of distributed computing models for passively-mobile systems, where a number of agents change their states by pairwise interactions between two agents. In this paper, we investigate the solvability of the self-stabilizing leader election in population protocols without any kind of oracles. We identify the necessary and sufficient conditions to solve the self-stabilizing leader election in population protocols from the aspects of local memory complexity and fairness assumptions. This paper shows that under the assumption of global fairness, no protocol using only n−1 states can solve the self-stabilizing leader election in complete interaction graphs, where n is the number of agents in the system. To prove this impossibility, we introduce a novel proof technique, called closed-set argument. In addition, we propose a self-stabilizing leader election protocol using n states that works even under the unfairness assumption. This protocol requires the exact knowledge about the number of agents in the system. We also show that such knowledge is necessary to construct any self-stabilizing leader election protocol.

For many decades formation evaluation and petrophysics have relied on electric conductivity (or resistivity) to input to saturation models for water saturation. However, water salinity strongly affects this estimate and may lead to incorrect results. Electromagnetic propagation measurements have enhanced the conductivity measurement by dielectric permittivity to a complex-valued conductivity-permittivity pair. At measurement frequencies of about 1 MHz and above the permittivity becomes increasingly less sensitive to water salinity in low clay formations, and so facilitates a more reliable water saturation. Directional drilling/well placement in both conventional reservoirs and unconventional resource plays requires an early, reliable prediction of water saturation, immune to uncertainty in water salinity. Such an early water-saturation estimate then permits drilling through and staying in the reservoir “sweet spot” and allows early quantification of potential producible hydrocarbon for near-term operating decisions in the expensive rig-on-location time frame. Logging While Drilling tools include propagation-resistivity measurements, which operate from a few 100 kHz up to 2 MHz. The tools provide phase shift and attenuation measurements from a radio wave between a pair of receivers. Traditionally, these two independent measurements were converted to two, independent, apparent resistivities. More recently, the two measurements were also simultaneously inverted for apparent conductivity and permittivity. Permittivity is also very dispersive: it rapidly diminishes with increasing frequency because of several unrelated and competing effects. We propose to investigate utilizing dielectric dispersion at LWD frequencies for similar derivations without the complications of shallow wireline measurements and potential operations impacts. We have implemented a recently published mechanistic model that describes wideband EM phenomena in earth formations. For practical application, we present case examples where we input petrophysical analysis results from field logs to this model and simulate logs of dielectric permittivity and conductivity at LWD frequencies, and in some cases where wireline dielectric and array induction inverted dielectric properties are available, at these tool frequencies also. This study presents utilization of this new forward-simulation and the new LWD inversion algorithm. These two complementary algorithms relate the measured conductivity and permittivity and attendant dispersion to water-filled porosity, salinity, and other key reservoir properties such as CEC, formation factor, and permeability. The results are self-consistent: the forward simulation followed by the inversion reliably reproduces the original input results and vice versa. The new algorithm offers critical and reliable low-clay-formation water-saturation estimates and other properties from LWD propagation-resistivity and porosity measurements in real and during the drilling and well-placement process.

We argue that high-level Petri nets are well suited for the representation of distributed algorithms as well as for correctness proofs. To this end, we provide a simple definition of high-level Petri nets, a way to formulate message passing algorithms in this notion, a temporal logic style language for the formulation of properties, and a proof technique which combines techniques from Petri net theory and from temporal logic. As a nontrivial case study we present a variant of Raymond's (1989) message passing mutual exclusion algorithm that works on arbitrary connected networks.

Smart contracts play a critical role in blockchain applications, managing vast amounts of valuable assets. However, they are often vulnerable to attacks due to the inherent difficulties in modifying their code once deployed. Existing security analysis tools and verifiers primarily focus on single-contract verification, while many real-world blockchain applications involve multiple contracts and transactions. In this paper, we introduce an automated verifier, iCon, for inter-transaction properties of smart contracts on the Tezos blockchain platform. iCon is based on our program logic, which verifies inter-transaction properties in the presence of both known and unknown contracts. We present an abstraction technique for unknown contracts and propose a proof technique to ensure that an inter-transaction property holds for any existence of unknown contracts. The proof technique supports the correctness of our verification approach. We have implemented iCon on top of the Why3 verification framework, demonstrating its effectiveness through several case studies, including the decentralized exchange service Dexter2, of which a previous version had a flaw in its implementation.