5,853 research outputs found
A mechanized proof of loop freedom of the (untimed) AODV routing protocol
The Ad hoc On-demand Distance Vector (AODV) routing protocol allows the nodes
in a Mobile Ad hoc Network (MANET) or a Wireless Mesh Network (WMN) to know
where to forward data packets. Such a protocol is 'loop free' if it never leads
to routing decisions that forward packets in circles. This paper describes the
mechanization of an existing pen-and-paper proof of loop freedom of AODV in the
interactive theorem prover Isabelle/HOL. The mechanization relies on a novel
compositional approach for lifting invariants to networks of nodes. We exploit
the mechanization to analyse several improvements of AODV and show that
Isabelle/HOL can re-establish most proof obligations automatically and identify
exactly the steps that are no longer valid.Comment: The Isabelle/HOL source files, and a full proof document, are
available in the Archive of Formal Proofs, at
http://afp.sourceforge.net/entries/AODV.shtm
ReLoC Reloaded:A Mechanized Relational Logic for Fine-Grained Concurrency and Logical Atomicity
We present a new version of ReLoC: a relational separation logic for proving
refinements of programs with higher-order state, fine-grained concurrency,
polymorphism and recursive types. The core of ReLoC is its refinement judgment
, which states that a program refines a program
at type . ReLoC provides type-directed structural rules and symbolic
execution rules in separation-logic style for manipulating the judgment,
whereas in prior work on refinements for languages with higher-order state and
concurrency, such proofs were carried out by unfolding the judgment into its
definition in the model. ReLoC's abstract proof rules make it simpler to carry
out refinement proofs, and enable us to generalize the notion of logically
atomic specifications to the relational case, which we call logically atomic
relational specifications.
We build ReLoC on top of the Iris framework for separation logic in Coq,
allowing us to leverage features of Iris to prove soundness of ReLoC, and to
carry out refinement proofs in ReLoC. We implement tactics for interactive
proofs in ReLoC, allowing us to mechanize several case studies in Coq, and
thereby demonstrate the practicality of ReLoC.
ReLoC Reloaded extends ReLoC (LICS'18) with various technical improvements, a
new Coq mechanization, and support for Iris's prophecy variables. The latter
allows us to carry out refinement proofs that involve reasoning about the
program's future. We also expand ReLoC's notion of logically atomic relational
specifications with a new flavor based on the HOCAP pattern by Svendsen et al
Automatic Probabilistic Program Verification through Random Variable Abstraction
The weakest pre-expectation calculus has been proved to be a mature theory to
analyze quantitative properties of probabilistic and nondeterministic programs.
We present an automatic method for proving quantitative linear properties on
any denumerable state space using iterative backwards fixed point calculation
in the general framework of abstract interpretation. In order to accomplish
this task we present the technique of random variable abstraction (RVA) and we
also postulate a sufficient condition to achieve exact fixed point computation
in the abstract domain. The feasibility of our approach is shown with two
examples, one obtaining the expected running time of a probabilistic program,
and the other the expected gain of a gambling strategy.
Our method works on general guarded probabilistic and nondeterministic
transition systems instead of plain pGCL programs, allowing us to easily model
a wide range of systems including distributed ones and unstructured programs.
We present the operational and weakest precondition semantics for this programs
and prove its equivalence
Mechanized semantics
The goal of this lecture is to show how modern theorem provers---in this
case, the Coq proof assistant---can be used to mechanize the specification of
programming languages and their semantics, and to reason over individual
programs and over generic program transformations, as typically found in
compilers. The topics covered include: operational semantics (small-step,
big-step, definitional interpreters); a simple form of denotational semantics;
axiomatic semantics and Hoare logic; generation of verification conditions,
with application to program proof; compilation to virtual machine code and its
proof of correctness; an example of an optimizing program transformation (dead
code elimination) and its proof of correctness
The automated proof of a trace transformation for a bitonic sort
AbstractIn his third volume of The Art of Computer Programming, Knuth presents Batcher's bitonic sorting network. With concurrency, this sorting network can be executed in logarithmic time. Knuth suggests a formal argument for the correctness of the bitonic sorting algorithm (as an exercise), but addresses the question of concurrency only informally. We develop a program for the bitonic sort by (1) deriving a stepwise refinement from Knuth's informal description of the algorithm, (2) deriving from the refinement a sequential execution or ‘trace’ of order O (n log n) in the length n of the sequence to be sorted, and (3) transforming the sequential trace into a parallel trace of order O(log n) while preserving its semantics. We shall be informal in Steps 1 and 2—although these steps can be formalized. But we will provide a formal treatment of Step 3 and report on the certification of this treatment in a mechanized logic. This work is a contribution to the optimization of programs (via concurrency) through transformation and the automation of program proofs
Uranium dioxide fuel cladding strain investigation with the use of CYGRO-2 computer program
Previously irradiated UO2 thermionic fuel pins in which gross fuel-cladding strain occurred were modeled with the use of a computer program to define controlling parameters which may contribute to cladding strain. The computed strain was compared with measured strain, and the computer input data were studied in an attempt to get agreement with measured strain. Because of the limitations of the program and uncertainties in input data, good agreement with measured cladding strain was not attained. A discussion of these limitations is presented
- …