## D.: Partial Clock Functions in ACL2 (2004)

Venue: | 5th ACL2 Workshop. (2004 |

Citations: | 4 - 3 self |

### BibTeX

@INPROCEEDINGS{Matthews04d.:partial,

author = {John Matthews},

title = {D.: Partial Clock Functions in ACL2},

booktitle = {5th ACL2 Workshop. (2004},

year = {2004}

}

### OpenURL

### Abstract

Abstract J Moore has discovered an elegant approach for verifying state invariants of imperative programs without having to write a verification condition generator (VCG) or clock function. Users need only make assertions about selected cutpoint instructions of a program, such as loop tests and subroutine entry and exit points. ACL2's rewriter is then used to automatically propagate these assertions through the intervening instructions.

### Citations

112 |
A complete method for the synthesis of linear ranking functions
- Podelski, Rybalchenko
- 2004
(Show Context)
Citation Context ... proving termination of imperative programming languages. For example, Podelski and Rybalchenko have given a complete method for proving termination for non-nested loops with linear ranking functions =-=[13]-=-. Dams, Gerth, and Grumberg have given a heuristic for automatically generating ranking functions [4]. Finally, Col'on and Sipma have developed two algorithms for proving termination. One synthesizes ... |

57 | Practical methods for proving program termination
- Colón, Sipma
- 2002
(Show Context)
Citation Context ...ion. One synthesizes linear ranking functions, but is limited to programs of few variables. The other is more heuristic in nature, but tends to converge faster to the invariants which it can discover =-=[2, 1]-=-. However, none of these develop general methods for reasoning about termination. They instead focus on decidable subsets of the termination problem by using decision procedures to develop linear rank... |

51 |
Concurrency Verification: Introduction to Compositional and Noncompositional Methods
- Roever, Boer, et al.
- 2001
(Show Context)
Citation Context ...ms [8, 9]. Researchers have studied for decades appropriate ways to structure partial- and total-correctness proofs for higher-level imperative programming languages. A recent text by de Roever et al =-=[5]-=- describes some of these techniques. It also introduces a general framework based on inductive assertions that can be directly adapted to cutpoint-based reasoning. There have been several promising me... |

50 |
Synthesis of linear ranking functions
- Colón, Sipma
(Show Context)
Citation Context ...ion. One synthesizes linear ranking functions, but is limited to programs of few variables. The other is more heuristic in nature, but tends to converge faster to the invariants which it can discover =-=[2, 1]-=-. However, none of these develop general methods for reasoning about termination. They instead focus on decidable subsets of the termination problem by using decision procedures to develop linear rank... |

31 | Partial functions in ACL2
- Manolios, Moore
(Show Context)
Citation Context ...ne using tail recursive partial functions, which are admissable to ACL2 due to the work of Manolios and Moore who proved that every such partial function has an admissable total function as a witness =-=[10]-=-. In this paper, we present a variation on this method, built on the same concepts, which can easily be extended to reason about the termination of imperative programs. As with Moore's method, these t... |

30 |
Reasoning about Terminating Functional Programs
- Slind
- 1999
(Show Context)
Citation Context ... applied to smaller values according to the well-founded relation. If succcessful, the library generates the pattern matching equations as theorems, as well as 17sa function-specific induction scheme =-=[15, 17]-=-. These techniques can be used to model imperative programs in the same way that ACL2 does, as state-passing functions. However, many imperative algorithms call themselves recursively multiple times i... |

26 | Inductive assertions and operational semantics
- Moore
- 2003
(Show Context)
Citation Context ...to terminate. 1 Introduction In his paper Inductive Assertions and Operational Semantics, J Moore describes a simple and elegant method for proving partial correctness results for imperative programs =-=[12]-=-. What interests us most about his approach is the fact that it requires no clock function or verification condition generator. This frees the user from the headache of defining state invariants by pr... |

11 | Verifying BDD algorithms through monadic interpretation
- Krstic, Matthews
- 2002
(Show Context)
Citation Context ...re powerful termination proof techniques [16]. Krsti`c and Matthews explore using inductive invariants to tackle these proofs in the context of verifying imperative Binary Decision Diagram algorithms =-=[8, 9]-=-. Researchers have studied for decades appropriate ways to structure partial- and total-correctness proofs for higher-level imperative programming languages. A recent text by de Roever et al [5] descr... |

9 | Ordinal arithmetic in acl2
- Manolios, Vroon
- 2003
(Show Context)
Citation Context ...s a topic in last year's ACL2 workshop with Manolios and Vroon's paper implementing a new ordinal notation and ordinal arithmetic library which are now the foundation of termination reasoning in ACL2 =-=[11]-=- Most theorem provers for higher order logics provide some level of support for admitting wellfounded (i.e. terminating) function definitions. Classical higher order logic is strong enough for these f... |

9 | Proof styles in operational semantics
- Ray, Moore
- 2004
(Show Context)
Citation Context ...related to Ray and Moore's work on the formal correspondence between the inductive invariants method and the clock functions method of proving partial and total correctness results for state machines =-=[14]-=-. Specifically, Ray and Moore show that given valid theorems of total (respectively, partial) correctness in terms of either method, then the required definitions and theorems to prove total (partial)... |

7 | Another Look at Nested Recursion
- Slind
- 2000
(Show Context)
Citation Context ...ned state value of the first recursive call is used as the state parameter to the second recursive call. These nested recursive function definitions require more powerful termination proof techniques =-=[16]-=-. Krsti`c and Matthews explore using inductive invariants to tackle these proofs in the context of verifying imperative Binary Decision Diagram algorithms [8, 9]. Researchers have studied for decades ... |

5 |
Wellfounded Schematic Definitions
- Slind
- 2000
(Show Context)
Citation Context ... applied to smaller values according to the well-founded relation. If succcessful, the library generates the pattern matching equations as theorems, as well as 17sa function-specific induction scheme =-=[15, 17]-=-. These techniques can be used to model imperative programs in the same way that ACL2 does, as state-passing functions. However, many imperative algorithms call themselves recursively multiple times i... |

4 | Inductive invariants for nested recursion
- Krstic, Matthews
- 2003
(Show Context)
Citation Context ...re powerful termination proof techniques [16]. Krsti`c and Matthews explore using inductive invariants to tackle these proofs in the context of verifying imperative Binary Decision Diagram algorithms =-=[8, 9]-=-. Researchers have studied for decades appropriate ways to structure partial- and total-correctness proofs for higher-level imperative programming languages. A recent text by de Roever et al [5] descr... |

1 |
Information on Cryptol can be found at http://www.cryptol.net. [4
- Dams, Gerth, et al.
- 2000
(Show Context)
Citation Context ...this a practical reality. We intend to apply these techniques in a certifying compiler we are building at Galois Connnections, Inc. for the CryptolU* domain-specific executable specification language =-=[3]-=-. Cryptol allows encryption algorithms to be specified declaratively and at a higher level of abstraction than can be done in conventional imperative programming languages, while still allowing effici... |