Environnement d'assistance au développement de transformations de graphes correctes

Les travaux de cette thèse ont pour cadre la vérification formelle, et plus spécifiquement le projet ANR Blanc CLIMT (Categorical and Logical Methods in Model Transformation) dédié aux grammaires de graphes. Ce projet, qui a démarré en février 2012 pour une durée de 48 mois, a donné lieu à la définition du langage Small-tALC, bâti sur la logique de description ALCQI. Ce langage prend la forme d’un DSL (Domain Specific Language) impératif à base de règles, chacune dérivant structurellement un graphe. Le langage s’accompagne d’un composant de preuve basé sur la logique de Hoare chargé d’automatiser le processus de vérification d’une règle. Cependant, force est de constater que tous les praticiens ne sont pas nécessairement familiers avec les méthodes formelles du génie logiciel et que les transformations sont complexes à écrire. En particulier, ne disposant que du seul prouveur, il s’agit pour le développeur Small-tALC d’écrire un triplet de Hoare {P} S {Q} et d’attendre le verdict de sa correction sous la forme d’un graphe contre-exemple en cas d’échec. Ce contre-exemple est parfois difficile à décrypter, et ne permet pas de localiser aisément l’erreur au sein du triplet. De plus, le prouveur ne valide qu’une seule règle à la fois, sans considérer l’ensemble des règles de transformation et leur ordonnancement d’exécution. Ce constat nous a conduits à proposer un environnement d’assistance au développeur Small-tALC. Cette assistance vise à l’aider à rédiger ses triplets et à prouver ses transformations, en lui offrant plus de rétroaction que le prouveur. Pour ce faire, les instructions du langage ont été revisitées selon l’angle ABox et TBox de la logique ALCQI. Ainsi, conformément aux logiques de description, la mise à jour du graphe par la règle s’assimile à la mise à jour ABox des individus (les nœuds) et de leurs relations (les arcs) d’un domaine terminologique TBox (le type des nœuds et les étiquettes des arcs) susceptible d’évoluer. Les contributions de cette thèse concernent : (1) un extracteur de préconditions ABox à partir d’un code de transformation S et de sa postcondition Q pour l’écriture d’une règle {P} S {Q} correcte par construction, (2) un raisonneur TBox capable d’inférer des propriétés sur des ensembles de nœuds transformés par un enchaînement de règles {Pi} Si {Qi}, et (3) d’autres diagnostics ABox et TBox sous la forme de tests afin d’identifier et de localiser des problèmes dans les programmes. L’analyse statique du code de transformation d’une règle, combinée à un calcul d’alias des variables désignant les nœuds du graphe, permet d’extraire un ensemble de préconditions ABox validant la règle. Les inférences TBox pour un enchaînement de règles résultent d’une analyse statique par interprétation abstraite des règles ABox afin de vérifier formellement des états du graphe avant et après les appels des règles. A ces deux outils formels s’ajoutent des analyseurs dynamiques produisant une batterie de tests pour une règle ABox, ou un diagnostic TBox pour une séquence de règle

A Precondition Calculus for Correct-by-Construction Graph Transformations

We aim at assisting developers to write, in a Hoare style, provably correct graph transformations expressed in the ALCQ Description Logic. Given a postcondition and a transformation rule, we compute the weakest precondition for developers. However, the size and quality of this formula may be complex and hard to grasp. We seek to reduce the weakest precondition’s complexness by a static analysis based on an alias calculus. The refined precondition is presented to the developer in terms of alternative formulae, each one specifying a potential matching of the source graph. The developer chooses then the formulae that correspond to his intention to obtain finally a correct-byconstruction Hoare triple

Measuring progress and projecting attainment on the basis of past trends of the health-related Sustainable Development Goals in 188 countries: an analysis from the Global Burden of Disease Study 2016

The UN’s Sustainable Development Goals (SDGs) are grounded in the global ambition of “leaving no one behind”. Understanding today’s gains and gaps for the health-related SDGs is essential for decision makers as they aim to improve the health of populations. As part of the Global Burden of Diseases, Injuries, and Risk Factors Study 2016 (GBD 2016), we measured 37 of the 50 health-related SDG indicators over the period 1990–2016 for 188 countries, and then on the basis of these past trends, we projected indicators to 2030

Global, regional, and national under-5 mortality, adult mortality, age-specific mortality, and life expectancy, 1970–2016: a systematic analysis for the Global Burden of Disease Study 2016

BACKGROUND: Detailed assessments of mortality patterns, particularly age-specific mortality, represent a crucial input that enables health systems to target interventions to specific populations. Understanding how all-cause mortality has changed with respect to development status can identify exemplars for best practice. To accomplish this, the Global Burden of Diseases, Injuries, and Risk Factors Study 2016 (GBD 2016) estimated age-specific and sex-specific all-cause mortality between 1970 and 2016 for 195 countries and territories and at the subnational level for the five countries with a population greater than 200 million in 2016. METHODS: We have evaluated how well civil registration systems captured deaths using a set of demographic methods called death distribution methods for adults and from consideration of survey and census data for children younger than 5 years. We generated an overall assessment of completeness of registration of deaths by dividing registered deaths in each location-year by our estimate of all-age deaths generated from our overall estimation process. For 163 locations, including subnational units in countries with a population greater than 200 million with complete vital registration (VR) systems, our estimates were largely driven by the observed data, with corrections for small fluctuations in numbers and estimation for recent years where there were lags in data reporting (lags were variable by location, generally between 1 year and 6 years). For other locations, we took advantage of different data sources available to measure under-5 mortality rates (U5MR) using complete birth histories, summary birth histories, and incomplete VR with adjustments; we measured adult mortality rate (the probability of death in individuals aged 15-60 years) using adjusted incomplete VR, sibling histories, and household death recall. We used the U5MR and adult mortality rate, together with crude death rate due to HIV in the GBD model life table system, to estimate age-specific and sex-specific death rates for each location-year. Using various international databases, we identified fatal discontinuities, which we defined as increases in the death rate of more than one death per million, resulting from conflict and terrorism, natural disasters, major transport or technological accidents, and a subset of epidemic infectious diseases; these were added to estimates in the relevant years. In 47 countries with an identified peak adult prevalence for HIV/AIDS of more than 0·5% and where VR systems were less than 65% complete, we informed our estimates of age-sex-specific mortality using the Estimation and Projection Package (EPP)-Spectrum model fitted to national HIV/AIDS prevalence surveys and antenatal clinic serosurveillance systems. We estimated stillbirths, early neonatal, late neonatal, and childhood mortality using both survey and VR data in spatiotemporal Gaussian process regression models. We estimated abridged life tables for all location-years using age-specific death rates. We grouped locations into development quintiles based on the Socio-demographic Index (SDI) and analysed mortality trends by quintile. Using spline regression, we estimated the expected mortality rate for each age-sex group as a function of SDI. We identified countries with higher life expectancy than expected by comparing observed life expectancy to anticipated life expectancy on the basis of development status alone. FINDINGS: Completeness in the registration of deaths increased from 28% in 1970 to a peak of 45% in 2013; completeness was lower after 2013 because of lags in reporting. Total deaths in children younger than 5 years decreased from 1970 to 2016, and slower decreases occurred at ages 5-24 years. By contrast, numbers of adult deaths increased in each 5-year age bracket above the age of 25 years. The distribution of annualised rates of change in age-specific mortality rate differed over the period 2000 to 2016 compared with earlier decades: increasing annualised rates of change were less frequent, although rising annualised rates of change still occurred in some locations, particularly for adolescent and younger adult age groups. Rates of stillbirths and under-5 mortality both decreased globally from 1970. Evidence for global convergence of death rates was mixed; although the absolute difference between age-standardised death rates narrowed between countries at the lowest and highest levels of SDI, the ratio of these death rates-a measure of relative inequality-increased slightly. There was a strong shift between 1970 and 2016 toward higher life expectancy, most noticeably at higher levels of SDI. Among countries with populations greater than 1 million in 2016, life expectancy at birth was highest for women in Japan, at 86·9 years (95% UI 86·7-87·2), and for men in Singapore, at 81·3 years (78·8-83·7) in 2016. Male life expectancy was generally lower than female life expectancy between 1970 and 2016, an

Global, regional, and national disability-adjusted life-years (DALYs) for 333 diseases and injuries and healthy life expectancy (HALE) for 195 countries and territories, 1990–2016: a systematic analysis for the Global Burden of Disease Study 2016

BACKGROUND: Measurement of changes in health across locations is useful to compare and contrast changing epidemiological patterns against health system performance and identify specific needs for resource allocation in research, policy development, and programme decision making. Using the Global Burden of Diseases, Injuries, and Risk Factors Study 2016, we drew from two widely used summary measures to monitor such changes in population health: disability-adjusted life-years (DALYs) and healthy life expectancy (HALE). We used these measures to track trends and benchmark progress compared with expected trends on the basis of the Socio-demographic Index (SDI). METHODS: We used results from the Global Burden of Diseases, Injuries, and Risk Factors Study 2016 for all-cause mortality, cause-specific mortality, and non-fatal disease burden to derive HALE and DALYs by sex for 195 countries and territories from 1990 to 2016. We calculated DALYs by summing years of life lost and years of life lived with disability for each location, age group, sex, and year. We estimated HALE using age-specific death rates and years of life lived with disability per capita. We explored how DALYs and HALE differed from expected trends when compared with the SDI: the geometric mean of income per person, educational attainment in the population older than age 15 years, and total fertility rate. FINDINGS: The highest globally observed HALE at birth for both women and men was in Singapore, at 75·2 years (95% uncertainty interval 71·9-78·6) for females and 72·0 years (68·8-75·1) for males. The lowest for females was in the Central African Republic (45·6 years [42·0-49·5]) and for males was in Lesotho (41·5 years [39·0-44·0]). From 1990 to 2016, global HALE increased by an average of 6·24 years (5·97-6·48) for both sexes combined. Global HALE increased by 6·04 years (5·74-6·27) for males and 6·49 years (6·08-6·77) for females, whereas HALE at age 65 years increased by 1·78 years (1·61-1·93) for males and 1·96 years (1·69-2·13) for females. Total global DALYs remained largely unchanged from 1990 to 2016 (-2·3% [-5·9 to 0·9]), with decreases in communicable, maternal, neonatal, and nutritional (CMNN) disease DALYs offset by increased DALYs due to non-communicable diseases (NCDs). The exemplars, calculated as the five lowest ratios of observed to expected age-standardised DALY rates in 2016, were Nicaragua, Costa Rica, the Maldives, Peru, and Israel. The leading three causes of DALYs globally were ischaemic heart disease, cerebrovascular disease, and lower respiratory infections, comprising 16·1% of all DALYs. Total DALYs and age-standardised DALY rates due to most CMNN causes decreased from 1990 to 2016. Conversely, the total DALY burden rose for most NCDs; however, age-standardised DALY rates due to NCDs declined globally. INTERPRETATION: At a global level, DALYs and HALE continue to show improvements. At the same time, we observe that many populations are facing growing functional health loss. Rising SDI was associated with increases in cumulative years of life lived with disability and decreases in CMNN DALYs offset by increased NCD DALYs. Relative compression of morbidity highlights the importance of continued health interventions, which has changed in most locations in pace with the gross domestic product per person, education, and family planning. The analysis of DALYs and HALE and their relationship to SDI represents a robust framework with which to benchmark location-specific health performance. Country-specific drivers of disease burden, particularly for causes with higher-than-expected DALYs, should inform health policies, health system improvement initiatives, targeted prevention efforts, and development assistance for health, including financial and research investments for all countries, regardless of their level of sociodemographic development. The presence of countries that substantially outperform others suggests the need for increased scrutiny for proven examples of best practices, which can help to extend gains, whereas the presence of underperforming countries suggests the need for devotion of extra attention to health systems that need more robust support. FUNDING: Bill & Melinda Gates Foundation

Erratum: Global, regional, and national comparative risk assessment of 84 behavioural, environmental and occupational, and metabolic risks or clusters of risks for 195 countries and territories, 1990–2017: a systematic analysis for the Global Burden of Disease Study 2017

Interpretation: By quantifying levels and trends in exposures to risk factors and the resulting disease burden, this assessment offers insight into where past policy and programme efforts might have been successful and highlights current priorities for public health action. Decreases in behavioural, environmental, and occupational risks have largely offset the effects of population growth and ageing, in relation to trends in absolute burden. Conversely, the combination of increasing metabolic risks and population ageing will probably continue to drive the increasing trends in non-communicable diseases at the global level, which presents both a public health challenge and opportunity. We see considerable spatiotemporal heterogeneity in levels of risk exposure and risk-attributable burden. Although levels of development underlie some of this heterogeneity, O/E ratios show risks for which countries are overperforming or underperforming relative to their level of development. As such, these ratios provide a benchmarking tool to help to focus local decision making. Our findings reinforce the importance of both risk exposure monitoring and epidemiological research to assess causal connections between risks and health outcomes, and they highlight the usefulness of the GBD study in synthesising data to draw comprehensive and robust conclusions that help to inform good policy and strategic health planning

Assistance framework for writing correct graph transformations

Les travaux de cette thèse ont pour cadre la vérification formelle, et plus spécifiquement le projet ANR Blanc CLIMT (Categorical and Logical Methods in Model Transformation) dédié aux grammaires de graphes. Ce projet, qui a démarré en février 2012 pour une durée de 48 mois, a donné lieu à la définition du langage Small-tALC, bâti sur la logique de description ALCQI. Ce langage prend la forme d’un DSL (Domain Specific Language) impératif à base de règles, chacune dérivant structurellement un graphe. Le langage s’accompagne d’un composant de preuve basé sur la logique de Hoare chargé d’automatiser le processus de vérification d’une règle. Cependant, force est de constater que tous les praticiens ne sont pas nécessairement familiers avec les méthodes formelles du génie logiciel et que les transformations sont complexes à écrire. En particulier, ne disposant que du seul prouveur, il s’agit pour le développeur Small-tALC d’écrire un triplet de Hoare {P} S {Q} et d’attendre le verdict de sa correction sous la forme d’un graphe contre-exemple en cas d’échec. Ce contre-exemple est parfois difficile à décrypter, et ne permet pas de localiser aisément l’erreur au sein du triplet. De plus, le prouveur ne valide qu’une seule règle à la fois, sans considérer l’ensemble des règles de transformation et leur ordonnancement d’exécution. Ce constat nous a conduits à proposer un environnement d’assistance au développeur Small-tALC. Cette assistance vise à l’aider à rédiger ses triplets et à prouver ses transformations, en lui offrant plus de rétroaction que le prouveur. Pour ce faire, les instructions du langage ont été revisitées selon l’angle ABox et TBox de la logique ALCQI. Ainsi, conformément aux logiques de description, la mise à jour du graphe par la règle s’assimile à la mise à jour ABox des individus (les nœuds) et de leurs relations (les arcs) d’un domaine terminologique TBox (le type des nœuds et les étiquettes des arcs) susceptible d’évoluer. Les contributions de cette thèse concernent : (1) un extracteur de préconditions ABox à partir d’un code de transformation S et de sa postcondition Q pour l’écriture d’une règle {P} S {Q} correcte par construction, (2) un raisonneur TBox capable d’inférer des propriétés sur des ensembles de nœuds transformés par un enchaînement de règles {Pi} Si {Qi}, et (3) d’autres diagnostics ABox et TBox sous la forme de tests afin d’identifier et de localiser des problèmes dans les programmes. L’analyse statique du code de transformation d’une règle, combinée à un calcul d’alias des variables désignant les nœuds du graphe, permet d’extraire un ensemble de préconditions ABox validant la règle. Les inférences TBox pour un enchaînement de règles résultent d’une analyse statique par interprétation abstraite des règles ABox afin de vérifier formellement des états du graphe avant et après les appels des règles. A ces deux outils formels s’ajoutent des analyseurs dynamiques produisant une batterie de tests pour une règle ABox, ou un diagnostic TBox pour une séquence de règlesThe overall context of this thesis is formal verification, and more specifically the ANR Blanc CLIMT project (Categorical and Logical Methods in Model Transformation) dedicated to graph grammars. This project, which started in February 2012 for 48 months, gave rise to the development of the Small- tALC language, a graph transformation language based on the ALCQI description logic. This language takes the form of an imperative DSL (Domain Specific Language) based on rules; from each rule structurally derives a graph. It goes with a proof component based on Hoare's logic designed to automate the process of rule verification. However, it must be assumed that not all developers are familiar with formal methods of software engineering, and that graph transformations are complex to write. In particular, using exclusively the prover, the Small- tALC developer must write a Hoare triple {P} S {Q} and wait for the feedback in the form of a counterexample graph in case of failure. This counter-example is sometimes difficult to interpret, and so it does not allow to easily locate the error within the triple. Moreover, the prover validates only one rule at once, without considering all the transformation rules and their execution order. This fact led us to propose an assistance framework for Small- tALC to help developers write their triples and prove their transformations, providing them more feedback than the prover does. To this purpose, the Small- tALC instructions have been reviewed according to the ABox and TBox aspects of the ALCQI logic. Thus, in accordance with description logics, updating the graph by the rule corresponds to the ABox updating of individuals (nodes) and their relationships (edges) of a TBox terminology domain (nodes concepts and edges labels) that is also expected to evolve. The contributions of this thesis concern: (1) an ABox precondition extractor from a transformation code S and its post-condition Q in order to produce a correct by construction rule {P} S {Q}, (2) a TBox reasoner to infer properties on sets of nodes transformed by a rule sequence {Pi} Si {Qi}, and (3) other ABox and TBox diagnostics based on tests to identify and locate errors in programs. The static analysis of the code of a transformation rule, combined with an alias calculus of the variables that can not designate the same nodes of the graph, allows to extract a set of ABox preconditions validating the rule. TBox inferences related to a sequence of rules result from a static analysis by abstract interpretation of the ABox rules. These inferences formally check graph states before and after rule calls. Beside these two formal tools, the framework features dynamic analyzers that produce test cases for an ABox rule, or a TBox diagnosis for a sequence of rule

Reasoning about Global Graph Properties from Local Graph Transformation Rules (KMOTS 2019), Guilin, Chine, 01/07/19)

International audienc

An Auto-active Approach to Develop Correct Logic-based Graph Transformations

International audienceWe aim at assisting developers to write, in a Hoare style, provably correct graph transformations expressed in the ALCQ Description Logic. Given a postcondition and a transformation rule, we compute the weakest precondition for developers. However, the size and quality of this formula may be complex and hard to grasp. We seek to reduce the weakest precondition’s complexness by a static analysis based on an alias calculus. The refined precondition is presented to the developer in terms of alternative formulae, each one specifying a potential matching of the source graph. By choosing some alternatives that correspond to his intention, the developer can interact with an auto-active program verifier, which continuously ensures the correctness of the resulting Hoare triple