Sound over-approximation methods have been proved effective for guaranteeing the absence of errors, but inevitably they produce false alarms that can hamper the programmers. Conversely, under-approximation methods are aimed at bug finding and are free from false alarms. We introduce Sufficient Incorrectness Logic~(SIL), a new under-approximating, triple-based program logic to reason about program errors. SIL is designed to set apart the initial states leading to errors. We prove that SIL is correct and complete for a minimal set of rules, and we study additional rules that can facilitate program analyses. We formally compare SIL to existing triple-based program logics. Incorrectness Logic and SIL both perform under-approximations, but while the former exposes only true errors, the latter locates the set of initial states that lead to such errors. Hoare Logic performs over-approximations and as such cannot capture the set of initial states leading to errors in nondeterministic programs -- for deterministic and terminating programs, Hoare Logic and SIL coincide. Finally, we instantiate SIL with Separation Logic formulae (Separation SIL) to handle pointers and dynamic allocation and we prove its correctness and, for loop-free programs, also its completeness. We argue that in some cases Separation SIL can yield more succinct postconditions and provide stronger guarantees than Incorrectness Separation Logic and can support effective backward reasoning.

We formulate, in lattice-theoretic terms, two novel algorithms inspired by Bradley’s property directed reachability algorithm. For finding safe invariants or counterexamples, the first algorithm exploits over-approximations of both forward and backward transition relations, expressed abstractly by the notion of adjoints. In the absence of adjoints, one can use the second algorithm, which exploits lower sets and their principals. As a notable example of application, we consider quantitative reachability problems for Markov Decision Processes.

Static analyses are mostly designed to show the absence of bugs : if the analysis reports no alarms then the program won’t exhibit any unwanted behaviours. To this aim they manipulate over-approximations of program semantics and, inevitably, they often report some false alarms. Recently, O’Hearn proposed Incorrectness Logic, that is based on under-approximations, as a formal method to find bugs that only reports true alarms. In this paper we aim to answer one important question raised by O’Hearn, namely which role can Abstract Interpretation play for the development of under-approximate tools for bug catching. In principle, Abstract Interpretation based static analyses can be defined for computing over-approximations as well as under-approximations, but in practice, most techniques exploited the former while few attempts developed the latter. To show why it is difficult to design effective under-approximation abstract domains, we first propose the new definitions of non emptying functions and highly surjective function family and then we formally prove the limits of under-approximation analysis by showing the non existence of abstract domains able to approximate such functions in a non trivial way. Our results outline the limits of under-approximation Abstract Interpretation and clarify, for the first time, why over- and under- approximation analyzers exhibited such a different development.

Reaction Systems (RSs) are a successful natural computing framework inspired by chemical reaction networks. A RS consists of a set of entities and a set of reactions. Entities can enable or inhibit each reaction, and are produced by reactions or provided by the environment. In a previous paper, we defined an original labelled transition system (LTS) semantics for RSs in the structural operational semantics (SOS) style. This approach has several advantages: (i) it provides a formal specification of the RS dynamics that enables the reuse of many formal analysis techniques and favors the implementation of tools, and (ii) it facilitates the definition of extensions of the RS framework by simply modifying some of the SOS rules in a modular way. In this paper, we demonstrate the extensibility of the framework by defining two quantitative variants of RSs: with reaction delays/durations, and with concentration levels. We provide a prototype logic programming implementation and apply our tool to a RS model of Th cells differentiation in the immune system.

Verification of C/C++ programs has seen considerable progress in several areas, but not for programs that use these languages’ mathematical libraries. The reason is that all libraries in widespread use come with no guarantees about the computed results. This would seem to prevent any attempt at formal verification of programs that use them: without a specification for the functions, no conclusion can be drawn statically about the behavior of the program. We propose an alternative to surrender. We introduce a pragmatic approach that leverages the fact that most math.h/cmath functions are almost piecewise monotonic: as we discovered through exhaustive testing, they may have glitches , often of very small size and in small numbers. We develop interval refinement techniques for such functions based on a modified dichotomic search, which enable verification via symbolic execution based model checking, abstract interpretation, and test data generation. To the best of our knowledge, our refinement algorithms are the first in the literature to be able to handle non-correctly rounded function implementations, enabling verification in the presence of the most common implementations. We experimentally evaluate our approach on real-world code, showing its ability to detect or rule out anomalous behaviors.

Gene regulatory networks represent the interactions among genes regulating the activation of specific cell functionalities. They have been successfully modelled using Boolean networks, where a set of Boolean variables model the activation state of each gene, and Boolean functions model positive and negative influences among genes. Moreover, when the effect of such influences is additive, threshold Boolean networks, in which Boolean functions are replaced by simpler threshold functions, turned out to be particularly effective. In this paper we propose a systematic translation of threshold Boolean networks into Ehrenfeucht and Rozenberg's reaction systems. Our translation produces a non redundant set of reactions, each using a minimal set of objects. This translation allows us to simulate the behaviour of a general threshold Boolean network by simply executing the (closed) reaction system we obtain, and to investigate causality relations among genes by applying tools available for reaction systems. We implemented our translation in an open-source tool and applied it in two case studies: the gene regulation network of segment polarity in Drosophila melanogaster and the one controlling the differentiation of Th cells in the immune system. In both case studies, we investigate causalities among genes in the reaction system obtained from the translation by applying a tool for the computation of formula based predictors. In the context of the second case study, we show that also Boolean networks with non-additive influences and modelling genes with multiple expression levels can be dealt with by our approach.

In this paper we generalise the notion of extensional (functional) equivalence of programs to abstract equivalences induced by abstract interpretations . The standard notion of extensional equivalence is recovered as the special case, induced by the concrete interpretation. Some properties of the extensional equivalence, such as the one spelled out in Rice’s theorem, lift to the abstract equivalences in suitably generalised forms. On the other hand, the generalised framework gives rise to interesting and important new properties, and allows refined, non-extensional analyses. In particular, since programs turn out to be extensionally equivalent if and only if they are equivalent just for the concrete interpretation, it follows that any non-trivial abstract interpretation uncovers some intensional aspect of programs. This striking result is also effective, in the sense that it allows constructing, for any non-trivial abstraction, a pair of programs that are extensionally equivalent, but have different abstract semantics. The construction is based on the fact that abstract interpretations are always sound, but that they can be made incomplete through suitable code transformations. To construct these transformations, we introduce a novel technique for building incompleteness cliques of extensionally equivalent yet abstractly distinguishable programs: They are built together with abstract interpretations that produce false alarms. While programs are forced into incompleteness cliques using both control-flow and data-flow transformations, the main result follows from limitations of data-flow transformations with respect to control-flow ones. A further consequence is that the class of incomplete programs for a non-trivial abstraction is Turing complete. The obtained results also shed a new light on the relation between the techniques of code obfuscation and the precision in program analysis.

One of the main goals of systems biology is to understand the behaviour of (bio)chemical reaction networks, which can be very complex and difficult to analyze. Often, dynamical properties of reaction networks are studied by performing simulations based on the Ordinary Differential Equations (ODEs) models of the reactions' kinetics. For some kinds of dynamical properties (e.g. robustness) simulations have to be repeated many times by varying the initial concentration of some components of interest. In this work, we propose sufficient conditions that guarantee the existence of monotonicity relationships between the variation of the initial concentration of an "input" biochemical species and the concentration (at all times) of an "output" species involved in the same reaction network. Our sufficient conditions allow monotonicity properties to be verified efficiently by exploring a dependency graph constructed on the set of species of the reaction network. Once established, monotonicity allows us to drastically restrict the number of simulations required to prove dynamical properties of the chemical reaction network.

Reaction systems are a qualitative formalism for modeling systems of biochemical reactions. They describe the evolution of sets of objects representing biochemical molecules. One of the main characteristics of Reaction systems is the non-permanency of the objects, namely objects disappear if not produced by any enabled reaction. Reaction systems execute in an environment that provides new objects at each step. Causality properties of reaction systems can be studied by using notions of formula based predictor. In this context, we define a notion of opacity that can be used to study information flow properties for reaction systems. Objects will be partitioned into high level (invisible) and low level (visible) ones. Opacity ensures that the presence (or absence) of high level objects cannot be guessed observing the low level objects only. Such a property is shown to be decidable and computable by exploiting the algorithms for minimal formula based predictors.

Code protection technologies require anti reverse engineering transformations to obfuscate programs in such a way that tools and methods for program analysis become ineffective. We introduce the concept of model deformation inducing an effective code obfuscation against attacks performed by abstract model checking. This means complicating the model in such a way a high number of spurious traces are generated in any formal verification of the property to disclose about the system under attack. We transform the program model in order to make the removal of spurious counterexamples by abstraction refinement maximally inefficient. A measure of the quality of the obfuscation obtained by model deformation is given together with a corresponding best obfuscation strategy for abstract model checking based on partition refinement.

In this paper we investigate dynamic causalities in membrane systems by proposing the concept of "predictor", originally defined in the context of the reaction systems by Brijder, Ehrenfeucht and Rozenberg. The goal is to characterise sufficient and necessary conditions for the presence of a multiset of molecules of interest in the configuration of a P system at a given evolution step (independently from the non-deterministic choices taken). These conditions can be used to study causal relationships between molecules and, therefore, to predict some aspects of future development of multiset rewriting systems. To achieve this goal, we introduce the new concept of "multiset pattern" representing a logical formula on multisets. A sufficient predictor can be expressed as a pattern characterising initial multisets that will surely evolve, after the given number of evolution steps, into a multiset containing the molecules of interest. On the other hand, a necessary predictor models initial multisets that may evolve after the given number of evolution steps, into a multiset containing the molecules of interest. Necessary predictors can be used to characterise initial multisets that will surely not evolve (in the required number of steps) into a multiset that contains such molecules. We inductively define operators able to compute these predictors. The patterns obtained from our operators are sound (sufficient or necessary) predictors, but, in general, they are not complete. (C) 2018 Elsevier B.V. All rights reserved.

In reaction systems, preimages and n-th ancestors are sets of reactants leading to the production of a target set of products in either one or n steps, respectively. Many computational problems on preimages and ancestors, such as finding all minimum-cardinality n-th ancestors, computing their size, or counting them, are intractable. In this paper we propose a characterization of n-th ancestors as a Boolean formula, and we define an operator able to compute such a formula in polynomial time. Our formula can be exploited to solve all preimage and ancestors problems and, therefore, it can be directly used to study their complexity. In particular, we focus on two problems: (i) deciding whether a preimage/n-th ancestor exists (ii) finding a preimage/n-th ancestor of minimal size. Our approach naturally leads to the definition of classes of systems for which such problems can be solved in polynomial time.

The main goal of systems biology is to understand the dynamical properties of biological systems by investigating the interactions among the components of a biological system. In this work, we focus on the robustness property, a behaviour observed in several biological systems that allows them to preserve their functions despite external and internal perturbations. We first propose a new formal definition of robustness using the formalism of continuous Petri nets. In particular, we focus on robustness against perturbations to the initial concentrations of species. Then, we demonstrate the validity of our definition by applying it to the models of three different robust biochemical networks.

In this paper we investigate dynamic causalities in membrane systems by proposing the concept of “predictor”, originally defined in the context of Ehrenfeucht and Rozemberg’s reaction systems. The goal is to characterize sufficient conditions for the presence of a molecule of interest in the configuration of a P system after a given number of evolution steps (independently from the non-deterministic choices taken). Such conditions can be used to study causal relationships between molecules. To achieve our goal, we introduce the new concept of “multiset pattern” representing a logical formula on multisets. A predictor can be expressed as a pattern characterizing the initial multisets that will surely lead (sufficient condition) to the presence of the molecule of interest after the given number of evolution steps. We define also an operator that computes such a predictor.

In Norway, cervical cancer prevention involves the participation of as many eligible women aged 25-69 years as possible. However, reaching and inviting every eligible women to attend cervical cancer screening and HPV vaccination is difficult. Using social nudging and gamification in modern means of communication can encourage the participation of unscreened people. Simula Research Laboratory together with the Cancer Registry of Norway have developed FightHPV, a mobile app game intended to inform adolescent and eligible women about cervical cancer screening and HPV vaccination while they play and, to facilitate their further participation to prevention campaigns. However, game design and health information transfer can be hard to reconcile, as the design of each game episode is more guided by the release of information than gameplay and playing difficulty. In this paper, we propose a constraint-based model of FightHPV to evaluate the difficulty of each episode and to help the game designer in improving the player experience. This approach is relevant to facilitate social nudging of eligible women to participate to cervical cancer screening and HPV vaccination, as shown by the initial deployment of FightHPV and tests performed in focus groups. The design of this mobile app can thus be regarded as a new application case of Artificial Intelligence techniques such as gamification and constraint programming

In this paper we propose a static analysis for Brane Calculi [1], based on Abstract Interpretation [2] techniques. Our analysis statically approximates the dynamic behaviour of Brane systems, by providing a description of the possible hierarchical structure of membranes and of the processes possibly associated to each membrane, together with global occurrence counting information. Our analysis can be computed in polynomial time. We apply it to investigate several biological systems in which occurrence counting information plays a crucial role. In particular, our case study concerns the formation of the haemoglobin polymer in presence of alterations and investigate the influence that such alterations have on the ability of the haemoglobin polymer to bind oxygen molecules.

Verification of C++ programs has seen considerable progress in several areas, but not for programs that use these languages' mathematical libraries. The reason is that all libraries in widespread use come with no guarantees about the computed results. This would seem to prevent any attempt at formal verification of programs that use them: without a specification for the functions, no conclusion can be drawn statically about the behavior of the program. We propose an alternative to surrender. We introduce a pragmatic approach that leverages the fact that most math.h/cmath functions are almost piecewise monotonic: as we discovered through exhaustive testing, they may have glitches, often of very small size and in small numbers. We develop interval refinement techniques for such functions based on a modified dichotomic search, that enable verification via symbolic execution based model checking, abstract interpretation, and test data generation. Our refinement algorithms are the first in the literature to be able to handle non-correctly rounded function implementations, enabling verification in the presence of the most common implementations. We experimentally evaluate our approach on real-world code, showing its ability to detect or rule out anomalous behaviors.

Floating-point computations are quickly finding their way in the design of safety- and mission-critical systems, despite the fact that designing floating-point algorithms is significantly more difficult than designing integer algorithms. For this reason, verification and validation of floating-point computations is a hot research topic. An important verification technique, especially in some industrial sectors, is testing. However, generating test data for floating-point intensive programs proved to be a challenging problem. Existing approaches usually resort to random or search-based test data generation, but without symbolic reasoning it is almost impossible to generate test inputs that execute complex paths controlled by floating-point computations. Moreover, as constraint solvers over the reals or the rationals do not natively support the handling of rounding errors, the need arises for efficient constraint solvers over floating-point domains. In this paper, we present and fully justify improved algorithms for the propagation of arithmetic IEEE 754 binary floating-point constraints. The key point of these algorithms is a generalization of an idea by B. Marre and C. Michel that exploits a property of the representation of floating-point numbers.

Reaction systems are a qualitative formalism for modeling systems of biochemical reactions characterized by the non-permanency of the elements: molecules disappear if not produced by any enabled reaction. Moreover, reaction systems execute in an environment that provides new molecules at each step. Brijder, Ehrenfeucht and Rozenberg investigated dynamic causalities in reaction systems by introducing the idea of predictors. A predictor of a molecule s, for a given n, is the set of molecules to be observed in the environment in order to determine whether s is produced or not by the system at step n.In this paper, we continue the investigation on dynamic causalities by defining an abstract interpretation framework containing three different notions of predictor: Formula based predictors, that is a propositional logic formula that precisely characterizes environments that lead to the production of s after n steps; Multi-step based predictors, that consist of n sets of molecules to be observed in the environment, one for each step; and Set based predictors, that are those proposed by Brijder, Ehrenfeucht and Rozenberg, and consist of a unique set of molecules to be observed in all steps.For each kind of predictor we define an effective operator that allows predictors to be computed for any molecule s and number of steps n. The abstract interpretation framework allows us to compare the three notions of predictor in terms of precision, to relate the three defined operators and to compute minimal predictors. We also discuss a generalization of this approach that allows predictors to be defined independently of the value of n, and a tabling approach for the practical use of predictors on reaction systems models. As an application, we use predictors, generalization and tabling to give theoretical grounds to previously obtained results on a model of gene regulation. (C) 2015 Elsevier B.V. All rights reserved.