Paul C. Attie

Paul C Attie

I present a new method for specifying and verifying the partial correctness of sequential programs. The key observation is that, in Hoare logic, assertions are used as selectors of states, that is, an assertion specifies the set of program states that satisfy the assertion. Hence, the usual meaning of the partial correctness Hoare triple $\{f\}\{P\}\{g\}$: if execution is started in any of the states that satisfy assertion $f$, then, upon termination, the resulting state will be some state that satisfies assertion $g$. There are of course other ways to specify a set of states. I propose to replace assertions by terminating programs: a program $A$ specifies a set of states as follows: we start $A$ in any state whatsoever, and all the states that $A$ may terminate in constitute the specified set. I call this set the post-states of $A$. I introduce the operational triple $[A]\, P\, [B]$ to mean: if execution of $P$ is started in any post-state of $A$, then upon termination, the resulting state will be some post-state of $B$. Here, $A$ is the pre-program, and plays the role of a pre-condition, and $B$ is the post-program, and plays the role of a post-condition.

Mohamad Jaber, Yliès Falcone, Paul Attie et al.

We define a method to automatically synthesize provably-correct efficient distributed implementations from high-level global choreographies. A global choreography describes the execution and communication logic between a set of provided processes which are described by their interfaces. The operations at the level of choreographies include multiparty communications, choice, loop, and branching. Choreographies are master-triggered, that is each choreography has one master to trigger its execution. This allows to automatically generate conflict free distributed implementations without controllers. The behavior of the synthesized implementations follows the behavior of choreographies. In addition, the absence of controllers ensures the efficiency of the implementation and reduces the communication needed at runtime. Moreover, we define a translation of the distributed implementations to equivalent Promela versions. The translation allows verifying the distributed system against behavioral properties. We implemented a Java prototype to validate the approach and applied it to automatically synthesize micro-services architectures. We illustrate our method on the automatic synthesis of a verified distributed buying system.

Paul C. Attie, Fadi A. Zaraket, Mohamad Noureddine et al.

We propose a method to write and check a specification including quantifiers using behaviors, i.e., input-output pairs. Our method requires the following input from the user: (1) answers to a finite number of queries, each of which presents some behavior to the user, who responds informing whether the behavior is "correct" or not; and (2) an "equivalence" theory (set of formulae), which represents the users opinion about which pairs of behaviors are equivalent with respect to the specification; and (3) a "vocabulary", i.e., a set of formulae which provide the basic building blocks for the specification to be written. Alternatively, the user can specify a type theory and a simple relational grammar, and our method can generate the vocabulary and equivalence theories. Our method automatically generates behaviors using a satisfiability modulo theory solver. Since writing a specification consists of formalizing ideas that are initially informal, there must, by definition, be at least one "initial" step where an informal notion is formalized by the user in an ad hoc manner. This step is the provision of the equivalence theory and vocabulary; we call it the primitive formalization step. We contend that it is considerably easier to write an equivalence theory and vocabulary than to write a full-blown formal specification from scratch, and we provide experimental evidence for this claim. We also show how vocabularies can be constructed hierarchically, with a specification at one level providing vocabulary material for the next level.

Paul C Attie, Fadi A Zaraket, Mohammad Fawaz et al.

The problem of writing a specification which accurately reflects the intent of the developer has long been recognized as fundamental. We propose a method and a supporting tool to write and check a specification and an implementation using a set of use cases, \ie input-output pairs that the developer supplies. These are instances of both good (correct) and bad (incorrect) behavior. We assume that the use cases are accurate, as it is easier to generate use cases than to write an accurate specification. We incrementally construct a specification (precondition and postcondition) based on semantic feedback generated from these use cases. We check the accuracy of the constructed specification using two proposed algorithms. The first algorithm checks the accuracy of the specification against an automatically generated specification from a supplied finite domain of use cases. The second checks the accuracy of the specification via reducing its domain to a finite yet equally satisfiable domain if possible. When the specification is mature, we start to also construct a program that satisfies the specification. However, our method makes provision for the continued modification of the specification, if needed. We illustrate our method with two examples; linear search and text justify.