O'Hearn's Incorrectness Logic (IL) has sparked renewed interest in static analyses that aim to detect program errors rather than prove their absence, thereby avoiding false alarms-a critical factor for practical adoption in industrial settings. As new incorrectness logics emerge to capture diverse error-related properties, a key question arises: can combining correctness and incorrectness techniques enhance precision, expressiveness, automation, or scalability? Notable frameworks, such as outcome logic, UNTer, local completeness logic, and exact separation logic, unify multiple analyses within a single proof system. In this work, we adopt a complementary strategy. Rather than designing a unified logic, we combine IL, which identifies reachable error states, with Sufficient Incorrectness Logic (SIL), which finds input states potentially leading to those errors. As a result, we get a more informative and effective analysis than either logic in isolation. Rather than sequencing them, our key innovation is reusing heuristic choices from the first analysis to steer the second. In fact, both IL and SIL rely on under-approximation and thus their automation legitimizes heuristics that avoid exhaustive path enumeration (e.g., selective disjunct pruning, loop unrolling). Concretely, we instrument the proof rules of the second logic with derivations from the first to inductively guide rule selection and application. To our knowledge, this is the first rule format enabling such inter-analysis instrumentation. This combined analysis aids debugging and testing by revealing both reachable errors and their causes, and opens new avenues for embedding incorrectness insights into scalable, expressive, automated code contracts.

Local Completeness Logic (LCL) is a proof system for program analysis rooted in abstract interpretation. The program semantics is under-approximated by any provable postcondition, like incorrectness logic does, but it is also over-approximated by a (locally) complete abstraction of such a postcondition, like Hoare logic does. Therefore, any derivable triple will either prove the program to be correct or unveil true bugs. While the completeness of a program's function with respect to an abstract domain is inherently extensional, LCL's rules demand the preservation of local completeness throughout the abstract interpreter's computations. This characteristic renders LCL analysis intensional, meaning it depends on the way the program is written. Consequently, LCL proof system may not derive all the valid triples. This paper addresses this discrepancy by: 1) designing new rules that allow one to perform part of the intensional analysis in different (complete) abstract domains whenever necessary; and 2) to compare their expressiveness. Notably, some of these new rules enable the derivation of all extensionally valid triples, thereby decoupling the set of provable properties from the way the program is written.

Sound over-approximation methods are effective for proving the absence of errors, but inevitably produce false alarms that can hamper programmers. In contrast, under-approximation methods focus on bug detection and are free from false alarms. In this work, we present two novel proof systems designed to locate the source of errors via backward under-approximation, namely Sufficient Incorrectness Logic (SIL) and its specialization for handling memory errors, called Separation SIL. The SIL proof system is minimal, sound and complete for Lisbon triples, enabling a detailed comparison of triple-based program logics across various dimensions, including negation, approximation, execution order, and analysis objectives. More importantly, SIL lays the foundation for our main technical contribution, by distilling the inference rules of Separation SIL, a sound and (relatively) complete proof system for automated backward reasoning in programs involving pointers and dynamic memory allocation. The completeness result for Separation SIL relies on a careful crafting of both the assertion language and the rules for atomic commands.

Cause/effect analysis of complex systems is instrumental in better understanding many natural phenomena. Moreover, formal analysis requires the availability of suitable abstract computational models that somehow preserve the features of interest. Our contribution focuses on the analysis of Reaction Systems (RSs), a qualitative computational formalism inspired by biochemical reactions in living cells. The primary challenge lies in dealing with inhibition mechanisms. On the one hand, inhibitors enhance the expressiveness of the computational abstraction; on the other hand, they can introduce nonmonotonic behaviors that can be computationally hard to deal with in the analysis. We propose an encoding of RSs into an equivalent formulation without inhibitors (called Positive RSs, PRSs for short) that is easier to handle, because PRSs exhibit monotonic behaviors. The effectiveness of our transformation is witnessed by its impact on two different techniques for cause/effect analysis. The first, called slicing, allows detecting the causes of some unforeseen phenomenon by reasoning backward along a given computation. Here, PRSs can be exploited to improve the quality of the analysis. The second technique, predictor analysis, is addressed by introducing a novel tool called MuMa, which is based on must/maybe sets, whence the tool name, an original abstraction for approximating ancestor formulas. MuMa exploits PRSs to improve the performance of the analysis.

The coexistence of multiple medical conditions in an individual presents a complex challenge in healthcare. This research aims to enhance the analysis of comorbidity treatment plans by capturing nuanced interactions between different medical conditions and treatment interventions. Reaction systems provide a formal framework for modelling and analysing systems in which the dynamics is driven by promotion/inhibition mechanisms and external intervention of context processes. This study explores the integration of guards into context processes to increase the expressiveness of the formalism in order to analyse treatment plans for comorbidities. Through the analysis of combined clinical guidelines for atrial fibrillation and hypertension, we demonstrate the applicability and utility of this approach in optimizing patient care and improving health outcomes in the context of complex medical scenarios.

This paper forges a strong connection between two well known computational frameworks for representing biological systems, in order to facilitate the seamless transfer of techniques between them. Boolean networks are a well established formalism employed from biologists. They have been studied under different (synchronous and asynchronous) update semantics, enabling the observation and characterisation of distinct facets of system behaviour. Recently, a new semantics for Boolean networks has been proposed, called most permissive semantics, that enables a more faithful representation of biological phenomena. Reaction systems offer a streamlined formalism inspired by biochemical reactions in living cells. Reaction systems support a full range of analysis techniques that can help for gaining deeper insights into the underlying biological phenomena. Our goal is to leverage the available toolkit for predicting and comprehending the behaviour of reaction systems within the realm of Boolean networks. In this paper, we first extend the behaviour of reaction systems to several asynchronous semantics, including the most permissive one, and then we demonstrate that Boolean networks and reaction systems exhibit isomorphic behaviours under the synchronous, general/fully asynchronous and most permissive semantics.

Abstract interpretation is a well-known and extensively used method to extract over-approximate program invariants by a sound program analysis algorithm. Soundness means that no program errors are lost and it is, in principle, guaranteed by construction. Completeness means that the abstract interpreter reports no false alarms for all possible inputs, but this is extremely rare because it needs a very precise analysis. We introduce a weaker notion of completeness, called local completeness , which requires that no false alarms are produced only relatively to some fixed program inputs. Based on this idea, we introduce a program logic, called Local Completeness Logic for an abstract domain A , for proving both the correctness and incorrectness of program specifications. Our proof system, which is parameterized by an abstract domain A , combines over- and under-approximating reasoning. In a provable triple ⊦ A [ p ] 𝖼 [ q ], 𝖼 is a program, q is an under-approximation of the strongest post-condition of 𝖼 on input p such that their abstractions in A coincide. This means that q is never too coarse, namely, under some mild assumptions, the abstract interpretation of 𝖼 does not yield false alarms for the input p iff q has no alarm . Therefore, proving ⊦ A [ p ] 𝖼 [ q ] not only ensures that all the alarms raised in q are true ones, but also that if q does not raise alarms, then 𝖼 is correct. We also prove that if A is the straightforward abstraction making all program properties equivalent, then our program logic coincides with O’Hearn’s incorrectness logic, while for any other abstraction, contrary to the case of incorrectness logic, our logic can also establish program correctness.

Abstract interpretation is a framework to design sound static analyses by over-approximating the set of program behaviours. While over-approximations can prove correctness, they cannot witness incorrectness because false alarms may arise. An ideal, but uncommon, situation is completeness of the abstraction that can ensure no false alarm is introduced by the abstract interpreter. Local Completeness Logic is a proof system that can decide both correctness and incorrectness of a program: any provable triple ⊢ _A[P] [Q] in the logic implies completeness of an intensional abstraction of program on input P and is such that Q can be used to decide (in)correctness. However, completeness itself is an extensional property of the function computed by the program, while the above intensional analysis depends on the way the program is written and therefore not all valid triples can be derived in the proof system. Our main contribution is the study of new inference rules which allow one to perform part of the intensional analysis in a more precise abstract domain, and then to transfer the result back to the coarser domain. With these new rules, all (extensionally) valid triples can be derived in the proof system, thus untying the set of provable properties from the way the program is written.

Completeness of an abstract interpretation is an ideal situation where the abstract interpreter is guaranteed to be compositional and producing no false alarm when used for verifying program correctness. Completeness for all possible programs and inputs is a very rare condition, met only by straightforward abstractions. In this paper we make a journey in the different forms of completeness in abstract interpretation that emerged in recent years. In particular, we consider the case of local completeness, requiring precision only on some specific, rather than all, program inputs. By leveraging this notion of local completeness, a logical proof system parameterized by an abstraction A, called $$\textrm{LCL}_A$$ , for Local Completeness Logic on A, has been put forward to prove or disprove program correctness. In this program logic a provable triple $$[p]~ \textsf{c}~[q]$$ not only ensures that all alarms raised for the postcondition q are true ones, but also that if q does not raise alarms then the program $$\textsf{c}$$ cannot go wrong with the precondition p.

Reaction systems (RSs) are a successful natural computing framework inspired by chemical reaction networks. A RS consists of a set of entities and a set of reactions. Entities can enable or inhibit each reaction and are produced by reactions or provided by the environment. In this paper, we define two quantitative variants of RSs: the first one is along the time dimension, to specify delays for making available reactions products and durations to protract their permanency, while the second deals with the possibility to specify different concentration levels of a substance in order to enable or inhibit a reaction. Technically, both extensions are obtained by modifying in a modular way the Structural Operational Semantics (SOS) for RSs that was already defined in the literature. Our approach maintains several advantages of the original semantics definition that were: (1) providing a formal specification of the RS dynamics that enables the reuse of many formal analysis techniques and favours the implementation of tools, and (2) making the RS framework extensible, by adding or changing some of the SOS rules in a compositional way. We provide a prototype logic programming implementation and apply our tool to three different case studies: the tumour growth, the Th cell differentiation in the immune system and neural communication.

Many biochemical processes in living cells involve clusters of particles. Such processes include protein aggregation and the development of intracellular concentration gradients. To study these mechanisms, we can apply coagulation-fragmentation models describing populations of interacting components. In this context, the Becker-Döring equations - theorized in 1935 - provide the simplest kinetic model to describe condensations phenomena. Experimental works on this model reveal that it exhibits robustness, defined as the system’s capability to preserve its features despite noise and fluctuations. Here, we verify the robustness of the BD model, applying our notions of initial concentration robustness ( α -robustness and β -robustness), which are related to the influence of the perturbation of the initial concentration of one species (i.e., the input) on the concentration of another species (i.e., the output) at the steady state. Then, we conclude that a new definition of robustness, namely the asymptotic robustness, is necessary to describe more accurately the model’s behavior.

The Abstract interpretation provides an over-approximation of program behaviours that is used to prove the absence of bugs. When the computed approximation in the chosen abstract domain is as precise as possible, we say the analysis is complete and false alarms cannot arise. Unfortunately for any non trivial abstract domain there is some program whose analysis is incomplete. In this paper we want to characterize the classes of complete programs on some non-trivial abstract domains for studying their expressiveness. To this aim we introduce the notion of bounded domains for posets with ascending chains of bounded length only. We show that any complete program on bounded domains can be rewritten in an equivalent canonical form without nontrivial loops. This result proves that program termination on the class of complete programs on bounded domain is decidable. Moreover, semantic equivalence between programs in the above class can be reduced to determining the equivalence of a set of guarded statements. We show how our approach can be applied to a quite large class of programs. Indeed, abstract domains defined on Boolean abstractions that are complete for the same functions can be composed by preserving boundedness and completeness also w.r.t. any expressible guard. This suggests that new complete bounded abstract domains can be tailored on the guards and functions appearing in the program. Their existence is sufficient to prove decidability of termination and program equivalence for such programs.

Abstract interpretation is a sound-by-construction method for program verification: any erroneous program will raise some alarm. However, the verification of correct programs may yield false-alarms, namely it may be incomplete. Ideally, one would like to perform the analysis on the most abstract domain that is precise enough to avoid false-alarms. We show how to exploit a weaker notion of completeness, called local completeness, to optimally refine abstract domains and thus enhance the precision of program verification. Our main result establishes necessary and sufficient conditions for the existence of an optimal, locally complete refinement, called pointed shell. On top of this, we define two repair strategies to remove all false-alarms along a given abstract computation: the first proceeds forward, along with the concrete computation, while the second moves backward within the abstract computation. Our results pave the way for a novel modus operandi for automating program verification that we call Abstract Interpretation Repair (AIR): instead of choosing beforehand the right abstract domain, we can start in any abstract domain and progressively repair its local incompleteness as needed. In this regard, AIR is for abstract interpretation what CEGAR is for abstract model checking.

Verification of programs using floating-point arithmetic is challenging on several accounts. One of the difficulties of reasoning about such programs is due to the peculiarities of floating-point arithmetic: rounding errors, infinities, non-numeric objects (NaNs), signed zeroes, denormal numbers, different rounding modes, etc. One possibility to reason about floating-point arithmetic is to model a program computation path by means of a set of ternary constraints of the form and use constraint propagation techniques to infer new information on the variables' possible values. In this setting, we define and prove the correctness of algorithms to precisely bound the value of one of the variables x, y or z, starting from the bounds known for the other two. We do this for each of the operations and for each rounding mode defined by the IEEE 754 binary floating-point standard, even in the case the rounding mode in effect is only partially known. This is the first time that such so-called filtering algorithms are defined and their correctness is formally proved. This is an important slab for paving the way to formal verification of programs that use floating-point arithmetics.

Motivation: A Chemical Reaction Network (CRN) is a set of chemical reactions, which can be very complex and difficult to analyze. Indeed, dynamical properties of CRNs can be described by a set of non-linear differential equations that rarely can be solved in closed-form, but that can instead be used to reason on the system dynamics. In this context, one of the possible approaches is to perform numerical simulations, which may require a high computational effort. In particular, in order to investigate some dynamical properties, such as robustness or global sensitivity, many simulations have to be performed by varying the initial concentration of chemical species. Results: In order to reduce the computational effort required when many simulations are needed to assess a property, we exploit a new notion of monotonicity of the output of the system (the concentration of a target chemical species at the steady-state) with respect to the input (the initial concentration of another chemical species). To assess such monotonicity behavior, we propose a new graphical approach that allows us to state sufficient conditions for ensuring that the monotonicity property holds. Our sufficient conditions allow us to efficiently verify the monotonicity property by exploring a graph constructed on the basis of the reactions involved in the network. Once established, our monotonicity property allows us to drastically reduce the number of simulations required to assess some dynamical properties of the CRN.

We present in silico modeling methods for the investigation of dynamical properties of biochemical pathways, that are chemical reaction networks underlying cell functioning. Since pathways are (complex) dynamical systems, in-silico models are often studied by applying numerical integration techniques for Ordinary Differential Equations (ODEs), or stochastic simulation algorithms. However, these techniques require a rather accurate knowledge of the kinetic parameters of the modeled chemical reactions. Moreover, in the case of very complex reaction networks, in silico analysis can become unfeasible from the computational viewpoint. Consequently, in the last few years several approaches have been proposed that focus on estimating or predicting dynamical properties from the analysis of the structure of the biochemical pathway. This means that the analysis focuses more on the interaction patterns than on the kinetic parameters, and this usually makes it possible to deduce the role of each molecule and how each molecule qualitatively influences each other, by abstracting away from quantitative details about concentrations and reaction rates.

We introduce the notion of local completeness in abstract interpretation and define a logic for proving both the correctness and incorrectness of some program specification. Abstract interpretation is extensively used to design sound-by-construction program analyses that over-approximate program behaviours. Completeness of an abstract interpretation A for all possible programs and inputs would be an ideal situation for verifying correctness specifications, because the analysis can be done compositionally and no false alert will arise. Our first result shows that the class of programs whose abstract analysis on A is complete for all inputs has a severely limited expressiveness. A novel notion of local completeness weakens the above requirements by considering only some specific, rather than all, program inputs and thus finds wider applicability. In fact, our main contribution is the design of a proof system, parameterized by an abstraction A, that, for the first time, combines over- and under-approximations of program behaviours. Thanks to local completeness, in a provable triple ⊢A [P ] c [Q], the assertion Q is an under-approximation of the strongest post-condition post[c](P ) such that the abstractions in A of Q and post[c](P ) coincide. This means that Q is never too coarse, namely, under mild assumptions, the abstract interpretation of c does not yield false alerts for the input P iff Q has no alert. Thus, ⊢ A [P ] c [Q] not only ensures that all the alerts raised in Q are true ones, but also that if Q does not raise alerts then c is correct.

Robustness is an observable property for which a chemical reaction network (CRN) can maintain its functionalities despite the influence of different perturbations. In general, to verify whether a network is robust, it is necessary to consider all the possible parameter configurations. This is a process that can entail a massive computational effort. In the work of Rizk et al., the authors propose a definition of robustness in linear temporal logic (LTL) through which, on the basis of multiple numerical timed traces obtained by considering different parameter configurations, they verify the robustness of a reaction network. In this paper, we focus on a notion of initial concentration robustness ($\alpha$-robustness), which is related to the influence of the perturbation of the initial concentration of one species (i.e., the input) on the concentration of another species (i.e., the output) at the steady state. We characterize this notion of robustness in the framework proposed by Rizk et al., and we show that, for monotonic reaction networks, this allows us to drastically reduce the number of traces necessary to verify robustness of the CRN.

Gene regulatory networks represent the interactions among genes regulating the activation of specific cell functionalities and they have been successfully modeled using threshold Boolean networks. In this paper we propose a systematic translation of threshold Boolean networks into reaction systems. Our translation produces a non redundant set of rules with a minimal number of objects. This translation allows us to simulate the behavior of a Boolean network simply by executing the (closed) reaction system we obtain. This can be very useful for investigating the role of different genes simply by “playing” with the rules. We developed a tool able to systematically translate a threshold Boolean network into a reaction system. We use our tool to translate two well known Boolean networks modelling biological systems: the yeast-cell cycle and the SOS response in Escherichia coli. The resulting reaction systems can be used for investigating dynamic causalities among genes.

We present in silico modeling methods for the investigation of dynamical properties of biochemical pathways, that are chemical reaction networks underlying cell functioning. Since pathways are (complex) dynamical systems, in-silico models are often studied by applying numerical integration techniques for Ordinary Differential Equations (ODEs), or stochastic simulation algorithms. However, these techniques require a rather accurate knowledge of the kinetic parameters of the modeled chemical reactions. Moreover, in the case of very complex reaction networks, in silico analysis can become unfeasible from the computational viewpoint. Consequently, in the last few years several approaches have been proposed that focus on estimating or predicting dynamical properties from the analysis of the structure of the biochemical pathway. This means that the analysis focuses more on the interaction patterns than on the kinetic parameters, and this usually makes it possible to deduce the role of each molecule and how each molecule qualitatively influences each other, by abstracting away from quantitative details about concentrations and reaction rates.