@inproceedings{4470, abstract = {Giotto is a platform-independent language for specifying software for high-performance control applications. In this paper we present a new approach to the compilation of Giotto. Following this approach, the Giotto compiler generates code for a virtual machine, called the E machine, which can be ported to different platforms. The Giotto compiler also checks if the generated E code is time safe for a given platform, that is, if the platform offers sufficient performance to ensure that the E code is executed in a timely fashion that conforms with the Giotto semantics. Time-safety checking requires a schedulability analysis. We show that while for arbitrary E code, the analysis is exponential, for E code generated from typical Giotto programs, the analysis is polynomial. This supports our claim that Giotto identifies a useful fragment of embedded programs.}, author = {Henzinger, Thomas A and Kirsch, Christoph and Majumdar, Ritankar and Matic, Slobodan}, booktitle = {Proceedings of the 2nd International Conference on Embedded Software}, isbn = {9783540443070}, location = {Grenoble, France}, pages = {76 -- 92}, publisher = {ACM}, title = {{Time-safety checking for embedded programs}}, doi = {10.1007/3-540-45828-X_7}, volume = {2491}, year = {2002}, } @inproceedings{4471, abstract = {The sequential synthesis problem, which is closely related to Church’s solvability problem, asks, given a specification in the form of a binary relation between input and output streams, for the construction of a finite-state stream transducer that converts inputs to appropriate outputs. For efficiency reasons, practical sequential hardware is often designed to operate without prior initialization. Such hardware designs can be modeled by uninitialized state machines, which are required to satisfy their specification if started from any state. In this paper we solve the sequential synthesis problem for uninitialized systems, that is, we construct uninitialized finite-state stream transducers. We consider specifications given by LTL formulas, deterministic, nondeterministic, universal, and alternating Büchi automata. We solve this uninitialized synthesis problem by reducing it to the well-understood initialized synthesis problem. While our solution is straightforward, it leads, for some specification formalisms, to upper bounds that are exponentially worse than the complexity of the corresponding initialized problems. However, we prove lower bounds to show that our simple solutions are optimal for all considered specification formalisms. We also study the problem of deciding whether a given specification is uninitialized, that is, if its uninitialized and initialized synthesis problems coincide. We show that this problem has, for each specification formalism, the same complexity as the equivalence problem.}, author = {Henzinger, Thomas A and Krishnan, Sriram and Kupferman, Orna and Mang, Freddy}, booktitle = {Proceedings of the 29th International Colloquium on Automata, Languages and Programming}, isbn = {9783540438649}, location = {Malaga, Spain}, pages = {644 -- 656}, publisher = {Springer}, title = {{Synthesis of uninitialized systems}}, doi = {10.1007/3-540-45465-9_55}, volume = {2380}, year = {2002}, } @inproceedings{4472, abstract = {We present a methodology and tool for verifying and certifying systems code. The verification is based on the lazy-abstraction paradigm for intertwining the following three logical steps: construct a predicate abstraction from the code, model check the abstraction, and automatically refine the abstraction based on counterexample analysis. The certification is based on the proof-carrying code paradigm. Lazy abstraction enables the automatic construction of small proof certificates. The methodology is implemented in Blast, the Berkeley Lazy Abstraction Software verification Tool. We describe our experience applying Blast to Linux and Windows device drivers. Given the C code for a driver and for a temporal-safety monitor, Blast automatically generates an easily checkable correctness certificate if the driver satisfies the specification, and an error trace otherwise.}, author = {Henzinger, Thomas A and Necula, George and Jhala, Ranjit and Sutre, Grégoire and Majumdar, Ritankar and Weimer, Westley}, booktitle = {Proceedings of the 14th International Conference on Computer Aided Verification}, isbn = {9783540439974}, location = {Copenhagen, Denmark}, pages = {526 -- 538}, publisher = {Springer}, title = {{Temporal safety proofs for systems code}}, doi = {10.1007/3-540-45657-0_45}, volume = {2404}, year = {2002}, } @article{4473, abstract = {The simulation preorder on state transition systems is widely accepted as a useful notion of refinement, both in its own right and as an efficiently checkable sufficient condition for trace containment. For composite systems, due to the exponential explosion of the state space, there is a need for decomposing a simulation check of the form P ≤s Q, denoting "P is simulated by Q," into simpler simulation checks on the components of P and Q. We present an assume-guarantee rule that enables such a decomposition. To the best of our knowledge, this is the first assume-guarantee rule that applies to a refinement relation different from trace containment. Our rule is circular, and its soundness proof requires induction on trace trees. The proof is constructive: given simulation relations that witness the simulation preorder between corresponding components of P and Q, we provide a procedure for constructing a witness relation for P ≤s Q. We also extend our assume-guarantee rule to account for fairness constraints on transition systems.}, author = {Henzinger, Thomas A and Qadeer, Shaz and Rajamani, Sriram and Tasiran, Serdar}, issn = {0164-0925}, journal = {ACM Transactions on Programming Languages and Systems (TOPLAS)}, number = {1}, pages = {51 -- 64}, publisher = {ACM}, title = {{An assume-guarantee rule for checking simulation}}, doi = {10.1145/509705.509707}, volume = {24}, year = {2002}, } @article{4474, abstract = {The simulation preorder for labeled transition systems is defined locally, and operationally, as a game that relates states with their immediate successor states. Simulation enjoys many appealing properties. First, simulation has a denotational characterization: system S simulates system I iff every computation tree embedded in the unrolling of I can be embedded also in the unrolling of S. Second, simulation has a logical characterization: S simulates I iff every universal branching-time formula satisfied by S is satisfied also by I. It follows that simulation is a suitable notion of implementation, and it is the coarsest abstraction of a system that preserves universal branching-time properties. Third, based on its local definition, simulation between finite-state systems can be checked in polynomial time. Finally, simulation implies trace containment, which cannot be defined locally and requires polynomial space for verification. Hence simulation is widely used both in manual and in automatic verification. Liveness assumptions about transition systems are typically modeled using fairness constraints. Existing notions of simulation for fair transition systems, however, are not local, and as a result, many appealing properties of the simulation preorder are lost. We propose a new view of fair simulation by extending the local definition of simulation to account for fairness: system View the MathML sourcefairly simulates system View the MathML source iff in the simulation game, there is a strategy that matches with each fair computation of View the MathML source a fair computation of View the MathML source. Our definition enjoys a denotational characterization and has a logical characterization: View the MathML source fairly simulates View the MathML source iff every fair computation tree (whose infinite paths are fair) embedded in the unrolling of View the MathML source can be embedded also in the unrolling of View the MathML source or, equivalently, iff every Fair-∀AFMC formula satisfied by View the MathML source is satisfied also by View the MathML source (∀AFMC is the universal fragment of the alternation-free μ-calculus). The locality of the definition leads us to a polynomial-time algorithm for checking fair simulation for finite-state systems with weak and strong fairness constraints. Finally, fair simulation implies fair trace containment and is therefore useful as an efficiently computable local criterion for proving linear-time abstraction hierarchies of fair systems.}, author = {Henzinger, Thomas A and Kupferman, Orna and Rajamani, Sriram}, issn = {0890-5401}, journal = {Information and Computation}, number = {1}, pages = {64 -- 81}, publisher = {Elsevier}, title = {{Fair simulation}}, doi = {10.1006/inco.2001.3085}, volume = {173}, year = {2002}, } @inproceedings{4476, abstract = {One approach to model checking software is based on the abstract-check-refine paradigm: build an abstract model, then check the desired property, and if the check fails, refine the model and start over. We introduce the concept of lazy abstraction to integrate and optimize the three phases of the abstract-check-refine loop. Lazy abstraction continuously builds and refines a single abstract model on demand, driven by the model checker, so that different parts of the model may exhibit different degrees of precision, namely just enough to verify the desired property. We present an algorithm for model checking safety properties using lazy abstraction and describe an implementation of the algorithm applied to C programs. We also provide sufficient conditions for the termination of the method.}, author = {Henzinger, Thomas A and Jhala, Ranjit and Majumdar, Ritankar and Sutre, Grégoire}, booktitle = {Proceedings of the 29th ACM SIGPLAN-SIGACT symposium on Principles of programming languages}, isbn = {9781581134506}, location = {Portland, OR, USA}, pages = {58 -- 70}, publisher = {ACM}, title = {{Lazy abstraction}}, doi = {10.1145/503272.503279}, year = {2002}, }