Pictorial languages, while intuitive and descriptive, are rarely used as the primary reasoning language in program verification due to lack of precision. In this paper, we introduce a precise pictorial language for specifying array invariants that preserves visual perspicuity. The language extends Reynold’s partition diagrams with the notion of a coloring, allowing assertions over portions of an array to be expressed by color-coding. The semantics of a coloring is given by a legend, mapping a colored partition of an array into a universally quantified predicate over the array. The pictorial syntax is an extension toinvariant diagrams, transition graphs where preconditions, postconditions and invariants, rather than the program code, determine the main program structure. We demonstrate the approach with three examples, verified using the Why3 theorem prover frontend.

Invariant-based programming is a correct-by-construction programming methodology in which programs are expressed as graphs of situations connected by transitions. Such graphs are called invariant diagrams. The situations correspond to the pre- and postconditions and loop invariants of the program, while the transitions correspond to the program statements. The situations are developed before the transitions, and each transition is verified at the time it is added to the diagram. The correctness conditions for the transitions are derived using Hoare-like rules. In this paper, we present an embedding of invariant diagrams in the higher-order logic framework Isabelle/HOL for both proving the verification conditions in the Isabelle proof assistant, as well as generating code that is operationally consistent with the verification semantics by constructing a proof that the generated code is correct with respect to the situations of the invariant diagram. We describe a mechanic translation of the transitions of an invariant diagram into a collection of mutually recursive functions and an associated correctness theorem stating that the value computed by the functions satisfies the final situation. We show that the proofs of the correctness theorem and the well-foundedness of the recursive functions can be built mechanically. The verification conditions are lemmas in the proofs. The collection of recursive functions is a refinement of the original invariant diagram, and is in a form that can be directly converted to executable code by Isabelle. This allows proof-producing compilation of invariant diagrams into any of the languages supported by Isabelle code generator. We illustrate our approach with a case study, and show that full proof automation can be achieved. This work is a step towards verified compilation of invariant diagrams.

Invariant-based programming is a correct-by-construction approach to program development in which the invariants of a program are written before the actual code. Socos is an environment for graphically constructing invariant-based programs (as statechart-like diagrams) and verifying their correctness (by invoking an automatic theorem prover). It borrows the specification language, logical framework and proof tactics from the PVS system. In this paper, we describe an extension to Socos for animating invariant-based programs in the logical framework of PVS. An invariant-based program is represented as an abstract datatype encoding the program state coupled a small-step state transition function encoding the operational semantics of the program. Socos visualizes the execution, allowing the user to inspect the current state and identify invalid assertions through test cases. Since programs are executed within the theorem prover framework (rather than translated into another language or compiled to machine code), failed test cases are logically sound refutations of the verification conditions. Invariants not executable in the general (e.g., containing unbounded quantification) can be handled for bounded test cases by introducing custom evaluation functions. While such functions provide no correctness guarantees, they can increase the assurance of a correctness condition before doing the actual proof. We illustrate this workflow through a verification exercise with non-trivial verification conditions, arguing that animation of invariant diagrams serves as an important stepping stone towards a fully verified program.

Invariant-Based Programming (IBP) is a diagram-based correct-by-construction programming methodology in which the program is structured around the invariants, which are additionally formulated before the actual code. Socos is a program construction and verification environment built specifically to support IBP. The front-end to Socos is a graphical diagram editor, allowing the programmer to construct invariant-based programs and check their correctness. The back-end component of Socos, the program checker, computes the verification conditions of the program and tries to prove them automatically. It uses the theorem prover PVS and the SMT solver Yices to discharge as many of the verification conditions as possible without user interaction. In this paper, we first describe the Socos environment from a user and systems level perspective; we then exemplify the IBP workflow by building a verified implementation of heapsort in Socos. The case study highlights the role of both automatic and interactive theorem proving in three sequential stages of the IBP workflow: developing the background theory, formulating the program specification and invariants, and proving the correctness of the final implementation.

In vitro assembly of intermediate filaments from tetrameric vimentin consists of a very rapid phase of tetramers laterally associating into unit-length filaments and a slow phase of filament elongation. We focus in this paper on a systematic quantitative investigation of two molecular models for filament assembly, recently proposed in (Kirmse et al. J. Biol. Chem. 282, 52 (2007), 18563-18572), through mathematical modeling, model fitting, and model validation. We analyze the quantitative contribution of each filament elongation strategy: with tetramers, with unit-length filaments, with longer filaments, or combinations thereof. In each case, we discuss the numerical fitting of the model with respect to one set of data, and its separate validation with respect to a second, different set of data. We introduce a high-resolution model for vimentin filament self-assembly, able to capture the detailed dynamics of filaments of arbitrary length. This provides much more predictive power for the model, in comparison to previous models where only the mean length of all filaments in the solution could be analyzed. We show how kinetic observations on low-resolution models can be extrapolated to the high-resolution model and used for lowering its complexity.

Invariant based programming is an approach where we start to construct a program by first identifying the basic situations (pre- and post-conditions as well as invariants) that could arise during the execution of the algorithm. These situations are identified before any code is written. After that, we identify the transitions between the situations, which will give us the flow of control in the program. Data refinement is a technique of building correct programs working on concrete data structures as refinements of more abstract programs working on abstract data types. We study in this paper data refinement for invariant based programs and we apply it to the construction of the classical Deutsch–Schorr–Waite graph marking algorithm. Our results are formalized and mechanically proved in the Isabelle/HOL theorem prover.

Invariant based programming is an approach where we start to construct a program by first identifying the basic situations (pre- and postconditions as well as invariants) that could arise during the execution of the algorithm. These situations are identified before any code is written. After that, we identify the transitions between the situations, which will give us the flow of control in the program. The transitions are verified at the time when they are constructed. The correctness of the program is thus established as part of constructing the program. The program structure in invariant based programs is determined by the information content of the situations, using nested invariant diagrams . The control structure is secondary to the situation structure, and will usually not be well-structured in the classical sense, i.e., it is not necessarily built out of single-entry single-exit program constructs. We study in this paper the semantics and proof rules for invariant-based programs. The total correctness of an invariant diagram is established by proving that each transition preserves the invariants and decreases a global variant. The proof rules for invariant-based programs are shown to be correct and complete with respect to an operational semantics. The proof of correctness and completeness introduces the weakest precondition semantics for invariant diagrams, and uses a special construction, based on well-ordered sets, of the least fixpoint of a monotonic function on a complete lattice. The results presented in this paper have been mechanically verified in the PVS theorem prover.

The heat shock response is a primordial defense mechanism against cell stress and protein misfolding. It proceeds with the minimum number of mechanisms that any regulatory network must include, a stress-induced activation and a feedback regulation, and can thus be regarded as the archetype for a cellular regulatory process. We propose here a simple mechanistic model for the eukaryotic heat shock response, including its mathematical validation. Based on numerical predictions of the model and on its sensitivity analysis, we minimize the model by identifying the reactions with marginal contribution to the heat shock response. As the heat shock response is a very basic and conserved regulatory network, our analysis of the network provides a useful foundation for modeling strategies of more complex cellular processes.

We describe a foundation for refinement calculus where pro- grams and systems are described as contracts, carried out by a collection of interacting agents. The contract states explicitly what the agents are allowed to do, and who is to blame if things go wrong. A contract can be analyzed from the point of view of any participating agent or coalition of agents, to see what kind of goals the agents can achieve by following the contract. We give an intuitive overview of contracts in this setting, and then continue to describe the mathematical and logical foundations of the calculus. We show how contracts provide a unified framework for a number of seemingly different paradigms in computer science, such as concurrency, interactivity, games, temporal behavior vs input-output computation and high level system design.

Invariant Based Programming (IBP) is a formal method in which the invariants are developed before the code. IBP leads to programs that are correct by construction, provides a light formalism that is easy to learn, and supports teaching formal methods. However, like other verification methods it generates a large number of lemmas to be proved. The Socos tool provides automatic verification of invariant based programs: it sends the proof obligations to an automatic theorem prover and reports only the unproven conditions. The latter may be proved interactively in a proof assistant. In this paper, we describe the Socos embedding of invariant based programs into the theorem prover PVS. The tool generates verification conditions and applies a strategy to decompose the conditions into fine grained lemmas. Each lemma is then attacked with the SMT solver Yices. Socos supports incremental development and allows reasoning in arbitrary program domains through the use of background theories. A background theory is a PVS theory pertaining to a specific programming domain. We give an example of a verification in our system, which demonstrates how background theories improve the degree of proof automation. This work is a step towards scaling up IBP by allowing existing collections of PVS theories to be used.

Structured derivations were introduced by Back and von Wright as an extension of the calculational proof style originally proposed by E. W. Dijkstra and his colleagues. Structured derivations added nested subderivations and inherited assumptions to this style. This paper introduces further extensions of the structured derivation format, and gives a precise syntax and semantics for the extended proof style. The extensions provide a unification of the three main proof styles used in mathematics today: Hilbert-style forward chaining proofs, Gentzen-style backward chaining proofs and algebraic derivations and calculations (in particular, Dijkstra’s calculational proof style). Each of these proof styles can now be directly presented as a structured derivation. Even more importantly, the three proof styles can be freely intermixed in a single structured derivation, allowing different proof styles to be used in different parts of the derivation, each time choosing the proof style that is most suitable for the (sub)problem at hand. We describe here (extended) structured derivations, feature by feature, and illustrate each feature with examples. We show how to model the three main proof styles as structured derivations. We give an exact syntax for structured derivations and define their semantics by showing how a structured derivation can be automatically translated into an equivalent Gentzen-style sequent calculus derivation. Structured derivations have been primarily developed for teaching mathematics at the secondary and tertiary education level. The syntax of structured derivations determines the general structure of the proof, but does not impose any restrictions on how the basic notions of the underlying mathematical domain are treated. Hence, the style can be used for any kind of proofs, calculations, derivations, and general problem solving found in mathematics education at these levels. The precise syntax makes it easy to provide computer support for structured derivations.

In this paper, we continue our previous work on evaluating the use of structured derivations in the mathematics classroom. We have studied student justifications in 132 exam solutions and described the types of justifications found. We also discuss the results in light of Skemp's (1976) framework for relational and instrumental understanding.

The verification of the Deutsch-Schorr-Waite graph marking algorithm is used as a benchmark in many formalizations of pointer programs. The main purpose of this mechanization is to show how data refinement of invariant based programs can be used in verifying practical algorithms. The verification starts with an abstract algorithm working on a graph given by a relation next on nodes. Gradually the abstract program is refined into Deutsch-Schorr-Waite graph marking algorithm where only one bit per graph node of additional memory is used for marking.

The invariant based programming is a technique of constructing correct programs by first identifying the basic situations (preand post-conditions and invariants) that can occur during the execution of the program, and then defining the transitions and proving that they preserve the invariants. Data refinement is a technique of building correct programs working on concrete datatypes as refinements of more abstract programs. In the theories presented here we formalize the predicate transformer semantics for invariant based programs and their data refinement.

In this article, we present the results from a qualitative study on students' initial reactions to the use of structured derivations in mathematics education. Our findings suggest that the approach increases the clarity of solutions and facilitates debugging of proofs. It also has potential to increase students' self-perceived level of understanding. Our findings indicate that the main drawbacks experienced by the students are related to time and length. Nevertheless, the overall feedback on the approach was found to be positive, thus encouraging further use of structured derivations in mathematics education.

Invariant based programming is an approach where we start to construct a program by first identifying the basic situations (pre- and postconditions as well as invariants) that could arise during the execution of the algorithm. These situations are identified before any code is written. After that, we identify the transitions between the situations, which will give us the flow of control in the program. Data refinement is a technique of building correct programs working on concrete data structures as refinements of more abstract programs working on abstract data types. We study in this paper data refinement for invariant based programs and we apply it the the construction of the classical Deutsch-Schorr-Waite graph marking algorithm. Our results are formalized and mechanically proved in the Isabelle/HOL theorem prover.

Elevated temperatures cause proteins in living cells to misfold. They start forming larger and larger aggregates that can eventually lead to the cell’s death. The heat shock response is an evolutionary well conserved cellular response to massive protein misfolding and it is driven by the need to keep the level of misfolded proteins under control. We consider in this paper a recently proposed new molecular model for the heat shock response in eukaryotes, consisting of a temperature-induced activation mechanism, chaperoning of misfolded proteins and self-regulation of the chaperon synthesis. We take in this paper a control driven approach to studying this regulatory network. We modularize the network by identifying its main functional modules. We distinguish three main feedback loops. The main question we are addressing is why is this level of complexity needed for implementing what could in principle also be achieved with an open-loop design. We answer the question by comparing the numerical behavior of various knockdown mutants where one or more feedback loops are missing. We also discuss a new approach for a biologically-unbiased model comparison.

Program verification is usually done by adding specifications and invariants to the program and then proving that the verification conditions are all true. This makes program verification an alternative to or a complement to testing. We describe here another approach to program construction, which we refer to as invariant based programming , where we start by formulating the specifications and the internal loop invariants for the program, before we write the program code itself. The correctness of the code is then easy to check at the same time as one is constructing it. In this approach, program verification becomes a complement to coding rather than to testing. The purpose is to produce programs and software that are correct by construction. We present a new kind of diagrams, nested invariant diagrams , where program specifications and invariants (rather than the control) provide the main organizing structure. Nesting of invariants provide an extension hierarchy that allows us to express the invariants in a very compact manner. We have studied the feasibility of formulating specifications and loop invariants before the code itself has been written in a number of case studies. Our experience is that a systematic use of figures, in combination with a rough idea of the intended behavior of the algorithm, makes it rather straightforward to formulate the invariants needed for the program, to construct the code around these invariants and to check that the resulting program is indeed correct. We describe our experiences from using invariant based programming in practice, both from teaching programmers how to construct programs that they prove correct themselves, and from teaching invariant based programming for CS students in class.