Results 1  10
of
21
Inductive assertions and operational semantics
 CHARME 2003. Volume 2860 of LNCS., SpringerVerlag
, 2003
"... Abstract. This paper shows how classic inductive assertions can be used in conjunction with an operational semantics to prove partial correctness properties of programs. The method imposes only the proof obligations that would be produced by a verification condition generator but does not require th ..."
Abstract

Cited by 29 (8 self)
 Add to MetaCart
(Show Context)
Abstract. This paper shows how classic inductive assertions can be used in conjunction with an operational semantics to prove partial correctness properties of programs. The method imposes only the proof obligations that would be produced by a verification condition generator but does not require the definition of a verification condition generation. The paper focuses on iterative programs but recursive programs are briefly discussed. Assertions are attached to the program by defining a predicate on states. This predicate is then “completed ” to an alleged invariant by the definition of a partial function defined in terms of the state transition function of the operational semantics. If this alleged invariant can be proved to be an invariant under the state transition function, it follows that the assertions are true every time they are encountered in execution and thus that the postcondition is true if reached from a state satisfying the precondition. But because of the manner in which the alleged invariant is defined, the verification conditions are sufficient to prove invariance. Indeed, the “natural ” proof generates the classical verification conditions as subgoals. The invariant function may be thought of as a statebased verification condition generator for the annotated program. The method allows standard inductive assertion style proofs to be constructed directly in an operational semantics setting. The technique is demonstrated by proving the partial correctness of simple bytecode programs with respect to a preexisting operational model of the Java Virtual Machine. 1
A Program Logic for Resource Verification
 In Proceedings of the 17th International Conference on Theorem Proving in HigherOrder Logics, (TPHOLs 2004), volume 3223 of LNCS
, 2004
"... We present a program logic for reasoning about resource consumption of programs written in Grail, an abstract fragment of the Java Virtual Machine Language. Serving as the target logic of a certifying compiler, the logic exploits Grail's dual nature of combining a functional interpretation w ..."
Abstract

Cited by 22 (9 self)
 Add to MetaCart
(Show Context)
We present a program logic for reasoning about resource consumption of programs written in Grail, an abstract fragment of the Java Virtual Machine Language. Serving as the target logic of a certifying compiler, the logic exploits Grail's dual nature of combining a functional interpretation with objectoriented features and a cost model for the JVM. We present the resourceaware operational semantics of Grail, the program logic, and prove soundness and completeness. All of the work described has been formalised in the theorem prover Isabelle/HOL, which provides us with an implementation of the logic as well as confidence in the results. We conclude with examples of using the logic for proving resource bounds on code resulting from compiling highlevel functional programs.
Combining theorem proving with static analysis for data structure consistency
 In International Workshop on Software Verification and Validation (SVV 2004
, 2004
"... Abstract We describe an approach for combining theorem proving techniques with static analysis to analyze data structure consistency for programs that manipulate heterogeneous data structures. Our system uses interactive theorem proving and shape analysis to verify that data structure implementation ..."
Abstract

Cited by 22 (16 self)
 Add to MetaCart
(Show Context)
Abstract We describe an approach for combining theorem proving techniques with static analysis to analyze data structure consistency for programs that manipulate heterogeneous data structures. Our system uses interactive theorem proving and shape analysis to verify that data structure implementations conform to set interfaces. A simpler static analysis then uses the verified set interfaces to verify properties that characterize how shared objects participate in multiple data structures. We have successfully applied this technique to several programs and found that theorem proving within circumscribed regions of the program combined with static analysis enables the verification of largescale program properties.
Executable JVM Model for Analytical Reasoning: A Study
, 2003
"... To study the properties of the Java Virtual Machine(JVM) and Java programs, our research group has produced a series of JVM models written in a functional subset of Common Lisp. In this paper, we present our most complete JVM model from this series, namely, M6, which is derived from a careful study ..."
Abstract

Cited by 21 (6 self)
 Add to MetaCart
To study the properties of the Java Virtual Machine(JVM) and Java programs, our research group has produced a series of JVM models written in a functional subset of Common Lisp. In this paper, we present our most complete JVM model from this series, namely, M6, which is derived from a careful study of the J2ME KVM[16] implementation. On the one hand, our JVM model is a conventional machine emulator. M6 models accurately almost all aspects of the KVM implementation, including the dynamic class loading, class initialization and synchronization via monitors. It executes most J2ME Java programs that do not use any I/O or floating point operations. Engineers may consider M6 an implementation of the JVM. It is implemented with around 10K lines in 20+ modules. On the other hand, M6 is a novel model that allows for analytical reasoning besides conventional testing. M6 is written in an applicative (sideeffect free) subset of Common Lisp, for which we have given precise meaning in terms of axioms and inference rules. A property of M6 can be expressed as a formula. Rules of interference can be used analytically to derive properties of M6 and the Java programs that run on the model, using a mechanical theorem prover. We argue
Java Program Verification via a JVM Deep Embedding in ACL2
 Theorem Proving in Higher Order Logics (TPHOLS ’04
, 2004
"... In this paper, we show that one can "deepembed" the Java bytecode language, a fairly complicated language with a rich semantics, into the first order logic of ACL2 by modeling a realistic JVM. We show that with proper support from a semiautomatic theorem prover in that logic, one can rea ..."
Abstract

Cited by 18 (5 self)
 Add to MetaCart
(Show Context)
In this paper, we show that one can "deepembed" the Java bytecode language, a fairly complicated language with a rich semantics, into the first order logic of ACL2 by modeling a realistic JVM. We show that with proper support from a semiautomatic theorem prover in that logic, one can reason about the correctness of Java programs. This reasoning can be done in a direct and intuitive way without incurring the extra burden that has often been associated with hand proofs, or proofs that make use of less automated proof assistance. We present proofs for two simple Java programs as a showcase.
Verification Condition Generation via Theorem Proving
 Proceedings of the 13th International Conference on Logic for Programming, Artificial Intelligence, and Reasoning (LPAR 2006), Vol. 4246 of LNCS
, 2006
"... Abstract. We present a method to convert (i) an operational semantics for a given machine language, and (ii) an offtheshelf theorem prover, into a high assurance verification condition generator (VCG). Given a program annotated with assertions at cutpoints, we show how to use the theorem prover di ..."
Abstract

Cited by 15 (4 self)
 Add to MetaCart
(Show Context)
Abstract. We present a method to convert (i) an operational semantics for a given machine language, and (ii) an offtheshelf theorem prover, into a high assurance verification condition generator (VCG). Given a program annotated with assertions at cutpoints, we show how to use the theorem prover directly on the operational semantics to generate verification conditions analogous to those produced by a custombuilt VCG. Thus no separate VCG is necessary, and the theorem prover can be employed both to generate and to discharge the verification conditions. The method handles both partial and total correctness. It is also compositional in that the correctness of a subroutine needs to be proved once, rather than at each call site. The method has been used to verify several machinelevel programs using the ACL2 theorem prover. 1
Proof styles in operational semantics
 Proceedings of the 5th International Conference on Formal Methods in ComputerAided Design (FMCAD 2004), volume 3312 of LNCS
, 2004
"... Abstract. We relate two wellstudied methodologies in deductive verification of operationally modeled sequential programs, namely the use of inductive invariants and clock functions. We show that the two methodologies are equivalent and one can mechanically transform a proof of a program in one meth ..."
Abstract

Cited by 11 (6 self)
 Add to MetaCart
(Show Context)
Abstract. We relate two wellstudied methodologies in deductive verification of operationally modeled sequential programs, namely the use of inductive invariants and clock functions. We show that the two methodologies are equivalent and one can mechanically transform a proof of a program in one methodology to a proof in the other. Both partial and total correctness are considered. This mechanical transformation is compositional; different parts of a program can be verified using different methodologies to achieve a complete proof of the entire program. The equivalence theorems have been mechanically checked by the ACL2 theorem prover and we implement automatic tools to carry out the transformation between the two methodologies in ACL2.
ProofPattern Recognition and Lemma Discovery in ACL2
 In 19th Logic for Programming Artificial Intelligence and Reasoning (LPAR19
"... Abstract. We present a novel technique for combining statistical machine learning for proofpattern recognition with symbolic methods for lemma discovery. The resulting tool, ACL2(ml), gathers proof statistics and uses statistical patternrecognition to preprocesses data from libraries, and then ..."
Abstract

Cited by 9 (8 self)
 Add to MetaCart
(Show Context)
Abstract. We present a novel technique for combining statistical machine learning for proofpattern recognition with symbolic methods for lemma discovery. The resulting tool, ACL2(ml), gathers proof statistics and uses statistical patternrecognition to preprocesses data from libraries, and then suggests auxiliary lemmas in new proofs by analogy with already seen examples. This paper presents the implementation of ACL2(ml) alongside theoretical descriptions of the proofpattern recognition and lemma discovery methods involved in it.
A Symbolic Simulation Approach to Assertional Program Verification
, 2005
"... 3 1 ..."
(Show Context)
Integrating CCG analysis into ACL2
 In Eighth International Workshop on Termination, August 2006. Part of FLOC ’06
"... ACL2 [6–8] is a powerful, industrial strength theorem proving system, which has been used on ..."
Abstract

Cited by 3 (3 self)
 Add to MetaCart
(Show Context)
ACL2 [6–8] is a powerful, industrial strength theorem proving system, which has been used on