We consider the problem of a module interacting with an external interface (environment) where th... more We consider the problem of a module interacting with an external interface (environment) where the interaction is expected to satisfy some system specification Φ. While we have the full implementation details of the module, we are only given a partial external specification for the interface. The interface specification being partial (incomplete) means that the interface displays only a strict subset of the behaviors allowed by the interface specification. Based on the assumption that interface specifications are typically incomplete, we address the question of whether we can tighten the interface specification into a strategy, consistent with the given partial specification, that will guarantee that all possible interactions resulting from possible behaviors of the module will satisfy the system specification Φ. We refer to such a tighter specification as Φ-guaranteeing specification. Rather than verifying whether the interface, which is often an off-theshelf component, satisfies t...
Abstract: There is a growing awareness, both in industry and academia, of the crucial role of for... more Abstract: There is a growing awareness, both in industry and academia, of the crucial role of formally verifying the translation from high-level source-code into low-level object code that is typically performed by an optimizing compiler. Formally verifying an optimizing compiler, as one would verify any other large program, is not feasible due to its size, ongoing evolution and modification, and, possibly, proprietary considerations. Translation validation is a novel approach that offers an alternative to the verification of translators in general and compilers in particular: Rather than verifying the compiler itself, one constructs a validation tool which, after every run of the compiler, formally confirms that the target code produced in the run is a correct translation of the source program. The paper presents voc, a methodology for the translation validation of optimizing compilers. We distinguish between structure preserving optimizations, for which we establish a simulation r...
1 Introduction Uniform verification of parameterized systems is one of the most challenging probl... more 1 Introduction Uniform verification of parameterized systems is one of the most challenging problemsin verification today. Given a parameterized system S(N) : P [1]k * * * kP [N] and aproperty p, uniform verification attempts to verify S(N) | = p for every N> 1. Oneof the most powerful approaches to verification which is not restricted to finite-state
A major challenge of Transactional memory implementations is dealing with memory accesses that oc... more A major challenge of Transactional memory implementations is dealing with memory accesses that occur outside of transactions. In previous work we showed how to specify transactional memory in terms of admissible interchanges of transaction operations, and gave proof rules for showing that an implementation satisfies its specification. However, we did not capture non-transactional memory accesses. In this work we show how to extend our previous model to handle non-transactional accesses. We apply our proof rules using a PVS-based theorem prover and produce a machine checkable, deductive proof for the correctness of implementations of transactional memory systems that handle non-transactional memory accesses.
We present a temporal logic for reasoning about uncertainty in distributed systems that contain b... more We present a temporal logic for reasoning about uncertainty in distributed systems that contain both probabilistic and nondeterministic transitions. Probabilistic transitions model randomness in the processes of the system and in the fault model. Nondeterministic transitions model lack of information about the true faulty behavior of the system and the progress of the computation. We demonstrate the naturalness of our approach by offering new analyses and solutions to some classical fault-tolerant distributed computing problems, namely the coordinated attack problem and authenticated Byzantine agreement problem.
ABSTRACT Counterexample-guided abstraction refinement (CEGAR) is an important method for tuning a... more ABSTRACT Counterexample-guided abstraction refinement (CEGAR) is an important method for tuning abstractions to properties to be verified. The method is commonly used, for example in selecting predicates for predicate abstraction. To date, however, it has been applied primarily to powerset abstractions, which allow one to speak of an abstract transition system and abstract states. Here, we describe a general framework for CEGAR in non-disjunctive abstractions by introducing a generalized notion of abstract counterexample, and methods for computing such counterexamples. We apply this framework to Indexed Predicate Abstraction (IPA), a promising technique for synthesizing quantified inductive invariants of infinite-state systems. In principle, it can be applied to other non-disjunctive abstractions occurring in program analysis.
Transactional memory is a programming abstraction intended to simplify the synchronization of con... more Transactional memory is a programming abstraction intended to simplify the synchronization of conflicting memory accesses (by concurrent threads) without the difficulties associated with locks. In a previous work we presented a formal framework for proving that a transactional memory implementation satisfies its specifications and provided with model checking verification of some using small instantiations. This paper extends the previous work to capture nontransactional accesses to memory, which occurs, for example, when using legacy code. We provide a mechanical proof of the soundness of the verification method, as well as a mechanical verification of a version of the popular TCC implementation that includes non-transactional memory accesses. The verification is performed by the deductive temporal checker TLPVS.
We consider the problem of a module interacting with an external interface (environment) where th... more We consider the problem of a module interacting with an external interface (environment) where the interaction is expected to satisfy some system specification Φ. While we have the full implementation details of the module, we are only given a partial external specification for the interface. The interface specification being partial (incomplete) means that the interface displays only a strict subset of the behaviors allowed by the interface specification. Based on the assumption that interface specifications are typically incomplete, we address the question of whether we can tighten the interface specification into a strategy, consistent with the given partial specification, that will guarantee that all possible interactions resulting from possible behaviors of the module will satisfy the system specification Φ. We refer to such a tighter specification as Φ-guaranteeing specification. Rather than verifying whether the interface, which is often an off-theshelf component, satisfies t...
Abstract: There is a growing awareness, both in industry and academia, of the crucial role of for... more Abstract: There is a growing awareness, both in industry and academia, of the crucial role of formally verifying the translation from high-level source-code into low-level object code that is typically performed by an optimizing compiler. Formally verifying an optimizing compiler, as one would verify any other large program, is not feasible due to its size, ongoing evolution and modification, and, possibly, proprietary considerations. Translation validation is a novel approach that offers an alternative to the verification of translators in general and compilers in particular: Rather than verifying the compiler itself, one constructs a validation tool which, after every run of the compiler, formally confirms that the target code produced in the run is a correct translation of the source program. The paper presents voc, a methodology for the translation validation of optimizing compilers. We distinguish between structure preserving optimizations, for which we establish a simulation r...
1 Introduction Uniform verification of parameterized systems is one of the most challenging probl... more 1 Introduction Uniform verification of parameterized systems is one of the most challenging problemsin verification today. Given a parameterized system S(N) : P [1]k * * * kP [N] and aproperty p, uniform verification attempts to verify S(N) | = p for every N> 1. Oneof the most powerful approaches to verification which is not restricted to finite-state
A major challenge of Transactional memory implementations is dealing with memory accesses that oc... more A major challenge of Transactional memory implementations is dealing with memory accesses that occur outside of transactions. In previous work we showed how to specify transactional memory in terms of admissible interchanges of transaction operations, and gave proof rules for showing that an implementation satisfies its specification. However, we did not capture non-transactional memory accesses. In this work we show how to extend our previous model to handle non-transactional accesses. We apply our proof rules using a PVS-based theorem prover and produce a machine checkable, deductive proof for the correctness of implementations of transactional memory systems that handle non-transactional memory accesses.
We present a temporal logic for reasoning about uncertainty in distributed systems that contain b... more We present a temporal logic for reasoning about uncertainty in distributed systems that contain both probabilistic and nondeterministic transitions. Probabilistic transitions model randomness in the processes of the system and in the fault model. Nondeterministic transitions model lack of information about the true faulty behavior of the system and the progress of the computation. We demonstrate the naturalness of our approach by offering new analyses and solutions to some classical fault-tolerant distributed computing problems, namely the coordinated attack problem and authenticated Byzantine agreement problem.
ABSTRACT Counterexample-guided abstraction refinement (CEGAR) is an important method for tuning a... more ABSTRACT Counterexample-guided abstraction refinement (CEGAR) is an important method for tuning abstractions to properties to be verified. The method is commonly used, for example in selecting predicates for predicate abstraction. To date, however, it has been applied primarily to powerset abstractions, which allow one to speak of an abstract transition system and abstract states. Here, we describe a general framework for CEGAR in non-disjunctive abstractions by introducing a generalized notion of abstract counterexample, and methods for computing such counterexamples. We apply this framework to Indexed Predicate Abstraction (IPA), a promising technique for synthesizing quantified inductive invariants of infinite-state systems. In principle, it can be applied to other non-disjunctive abstractions occurring in program analysis.
Transactional memory is a programming abstraction intended to simplify the synchronization of con... more Transactional memory is a programming abstraction intended to simplify the synchronization of conflicting memory accesses (by concurrent threads) without the difficulties associated with locks. In a previous work we presented a formal framework for proving that a transactional memory implementation satisfies its specifications and provided with model checking verification of some using small instantiations. This paper extends the previous work to capture nontransactional accesses to memory, which occurs, for example, when using legacy code. We provide a mechanical proof of the soundness of the verification method, as well as a mechanical verification of a version of the popular TCC implementation that includes non-transactional memory accesses. The verification is performed by the deductive temporal checker TLPVS.
Uploads
Papers by Lenore Zuck