Conference PaperPDF Available

The SSP: An Example of High-Assurance Systems Engineering.

January 2004

DOI:10.1109/HASE.2004.1281741

Source
DBLP

Conference: 8th IEEE International Symposium on High-Assurance Systems Engineering (HASE 2004), 25-26 March 2004, Tampa, FL, USA

Authors:

Greg Wickstrom

Sandia National Laboratories

Show all 5 authorsHide

The SSP is a high assurance systems engineering effort spanning both hardware and software. Extensive design review, first principle design, n-version programming, program transformation, verification, and consistency checking are the techniques used to provide assurance in the correctness of the resulting system.

Content uploaded by Victor L. Winter

Content may be subject to copyright.

       

  

  ! "

#     $



% #&

' 

#  ( 



&  )

  ! "

#     $



& *

'&     

#  ( 



+  

'&  !"  ,

#  ( 





        

      

 ! "  !   

!  ! "!  

    #   

       

 

   ! "-  .   

$  &    

/ "    

     

      "$

0 1  " "  "2   $  

   &3  &  

/   &  $ 

 & 

4  $  " &  

  & 

 $ $    "  '  # 

      ( #(567689555 

    "  "   ( 

-    ) (-   '  #

    +  $   

" !:  " ((*545 708;

< $ &  "  3 

  

6    " &    

    "$  & 

  " &   

  $&  "  

9  -  $& 

 &    

=    "- $  

" "   " 

*/ >0? &     &

    ! "3 

    : -   

  $ "    "  $

&  $   $ "   

$ &     ,&- 

 @    &  

 $ @" ,   

&  . $   & @"

 & A 1   -  $

/  "$  $  $ 

     &  $ 

*/ >4?  ><? &   

       & 

 */ >4?   / 

  (  (BB $   

  - &   3 @-

 "    $     

 */ ><?     

   $  3   A

  3   & %&       

 &      

"  "     



$%      

&   '     

   %     '

     

   ()*+

%&    - &   $ &

      -

    &   

 :  &  -   

" &  %& & (  (BB  

      "  &

$     C;D %& 

 &      %&  

$      " 

%&   $ /  @"

 " &       ( 

(BB    : - %&

   -  & 

-      

 %&        " 3

  "    : 

&    &  

     & "  &

     $  :  &

 $ &-  "  "

&  " %&E    &  3 

 $ &    & 

     ( $ &  /&

"& $       

  $  & : 

$ "      "

 $

,  -     3

%&  "  "   

>   $  $? */ >9?

     &   

   &  $   

    $    

 :- / >=? $ " 2

 @   $ " A   $

 >- - 3 -  ? " 

&  "    -  

$      " "   %&

+ ) >%+)?    $ 

 & $     

 >?      

-   &     

  $   %&

     

  %&   - 

"    &   

     

    

  -   %&

 - "     " 



  %&  " $

& "    "  - " $

      

     

   "   

 1 -      

   $     

    

       / F

        

&      

 "  

     

@     -  @ 

   "   

      &

        G3 H

  %&    @ 

 3      

  $&-      

$  @  

 ! "  &  

        

   %& "-    

   " $&- &  

 $        - 

$ "      %& "

$ "        

       " "2 

  

 "      "  

 %&E  "  " : -

    3 &  $   

      "  $

"  "        

        3 "

    "    

 "     "  

>- " ?   -  

      "       

$    $ > : 4? 

 &    >0?    $ 

 3     @" -

>4?    $     

    $- ><?  *,) 

  "       & 

 @      3-  >6? 

   $  " &   &

 I   -     

  "   &3

SSP Hardware

SSP Class Loader

JVM

classfile

classfile classfile

classfile

ROM Image

class

class class

class

Java Source

Commercial Java Compiler

dynamic

static

Typical JVM Environment

SSP Environment

: 4 :  (      

 $

# $%& ' (()

'  -   $ !, 

   - "    

      $    "

- -  @" 1    

 $      " 

- "   &   $ 

 $ :  -     

 "     "   

$  &  <9J     

 >   "  ?

  "     49)@

SSP Chip

SSP Core

Heap

mem

Stack

mem

State

mem

Prog

mem

State

Stack

Heap

ALU

Prog

: < ,&&$    

      "   

   $   

      $  

   -      

$  3 &   %& & 

 : -    $  

  3   %+)-   

&  $      

      "   

  1   $    $ 

   "  "    

         

        

 "       

        

   :-  " 

    "& $  

       &- 

 2   3   C4;D

1   $     

-         

     $ 

        

       "

  "       

%+) : < "$ $  "  

  !        

       

.

# ' * (

  $     1( 

    005J   $ 005J " 

  " $     $

"   <9J     

        

"  "     1( $ 

"     2  

 1K, " $     

 .   $ $  $ 

  $ "  " @  

     &-     

  $ /    $  "

  ""    

     $ 2  

< $- $ " @ 1(   

   =  08   

$     $ 055L   8555 

 $ & "     7

 -  & 78L     $

/  $  $   

  $   ;5L  &-   

 = $  &      79L

& 1      $ @  &

   & &    49)@

   & -    

      &-    "

 $

 1(  . $   "

  A     " 

 <4 " "      

 A   "  @

## $% 

+      $     &

   @   $

  3    $ " 

&    $ &   3 

%& & / 1 -  !& 

 C0D  $        

 3 $ "   .

 &     

   .    "

"

+# I   $    "

        $

%&       I   &

"2  %&    "

  

)   I   & )  

 "   )    

 $  

    $   

  %&     

%&   "     

& &    $    

 "   "     

&      &

         !

  $ " & "   & 

"   &     : 

-   &  &  

   $ <4"   & 

&   $     $ <4"

   &F$   '

     "   

 

 " "  $  "

"  >- - /- ?

 &   >-  

?

     '  >-

 - -  -  &- - - ?

    '  >&F$-

 F$?

     

    3 "  "

  >-  - &  " @-  

   " - ?

     $  

        04-8;;

"      $ &  

      "   

       07=-409

"  1    $  

        3 

  1        

     3     >-

--   ?  $  &

      

 &      3

  $  "    G 

 H : -   /

     "  " F $

  "     

/    &  " F

     " $  

        $  &

$   &  "  &

$   3     *

@ -   $        

       

        

   "  3     .

     : - 

 G H " -  +#  $

        -  

 G H   GH  %&  ) 

 $     & . 

   $ 

FPGA SSP

Execution

Log

Execution

Log

Execution

Log

Execution

Log

SSP requirements

and

Bytecode definitions

ML VSSP

Java VSSP

VHDL SSP

coverage

feedback

Design

Coverage

Monitor

Comparison

Testing

Results

Selftesting

Code

Test Vector

File

ASIC SSP

: 6 #  !& 

1 -  %&  )  $

  "    " "

     "    

 / $&-      

+#      +#

   " -   - 

       &  

      "  

  -  +#  $

  "    "  &

      

"   &     

 $         

        &

      "&  "  

    G$H "  $ $ 

      @@  

   G$H "   "  "

  -   "   

        "   

   M    && - 

 $ /   +# 

   "   $  

        

    G"  " H

     $  

"  "   

     .  

 -   $    3   

       "K 

      3 

%& "  C06D    /

    / &"    

   (-  

$      "  

 "     &" > 

   &?   "  

 "  -     

 $&-  A -  

       3-

     "  

 "   $    3 

$    "    $

     3  "  " 

 /& : 6    

   : 6  $ $  

      $ &   

1( 

  $    $ !& 

 C05D-  &      

   " & C=D- 

$   &      

 C00D      !

& &  -    $  

  &       : 

-     $     %+)

 $ >   ?   $ > 

 $?      E   

   $     

          $

!         

$     $     

 &    "     1 -

      " A

         $ 

     $ $   

2  $ &   -  $

$     $ & 

 -  $  &   

    $    , "   &

     :  - 

 "     $  

  $   "   

  $  $    &

        

   "      

 "     $   

  "     "

 >     ?  "& 

 " . "$ %&K)  

   $    "2& >

 & A?  A   2 

 1   &-  " . "

$ )  %&   "  

 $        

"    "    & 

   $  !& &  

$

1 -      !&

$ $   &  /& &

  "- "   /& 

+ (%& ' * "

 3   %+)    

"   &"     &   

  /       

   3   %+)   3  

"         "

 %&      " "

$    >0? &3- >4? 

-  ><?  +3   

  $    && 

       

"2    &   

 *      

"     $  

 &  $ 

 2"         

 %&  3    "  

 "        

    $   ,-. -  

 $    

0 *& "     

      .  

       

  $0

4 (     

%&      3 



0,   /      2  "   

 "$     &   

 &   M  & /  

 $       &  

   @ "   & 

< &  "    &

  

6 (  "

+  ', 

          "

  $  %& $&-   .

  $        

C4=D   "  

  &   3    

  E   "   

     

 &     $   

   E  :- 

    "  " 

&3         $

      (4 

 - "    " 

       

    %&      

 $   "  %&  "

     "      %&

          

   &     -

          

        

       

 "     - $     

         

         

$     *,)   

         3  

" 

+ '

      $

& -  -  "   

 /  "  " /  

          $

"      "  " 

G/&H     1  

 $-    " 

3  $      

  "    " "

  "  $ $ 

   

      

     $  

&      

C4DC6DC04DC0<DC4<DC46DC49D    &  

 $   $   

 3  "  "      

$  $ @    E 



1       -   

   $   "   :

- $   &    

      "   

  -   

:  &   -

    "   "  

$ 

( 3   

# /    " " "$

  $   3 : 

-        

" " &  3   

#     " " "$ 

$     

  " " $  

      " 

"    

1   - $ & @ 

   " $   

$       

  "  &

+# $,- '

:      A

   "   "$ 

    - & 

   "  

$ -  @ $  3  $

"     &- $

   $ "  

&     $  

 " 3  >-  3  

          .

   3 ? '-  " 

3    "  " >-

.  3 $ &   .

 ? 1  3  -   

       

@        -

"   .     

$  - @-  

       "  

.       

   " $&-  "  " & 

    $ $ 1  

-   & . "   $

    3  $  >

 ?  "   

   - @-  

   " "   

   ,  & $ C48D

     $-  " 

   "   I 

         

 - $ & &    

   C4=D     

" 

+# )!    *

"

      $     

   (   %& 

      3   & 

"      & 

      %&   

  &      ,&

-    &   $

     "    

 - "   " /-  

    "       

3   $  &  "

. $  &     

 "      ,  

&   $  >0? "- $

    &  " 

    -  >4? - $ 

   &       

    

+# .

: &3 &   $ $  

"         

     1  -

        

  &&        

 >     ? 

        &&

        &  

     "&  /  

         

  >0? 3     & 

 -  >4? 3      

"   >-     

     ?    

"      - 

    A  / 

   

       &3 

$ &  " (4   & 

"     (4 C8DC7D   

 "   & "  (

 1  -   " "

   $  (4     

   &  "  (4

 1  "   &  

  $    

F   C<DC45D )   

"   &     

%+) C0;DC08DC07DC40D

,         

"   &   C<DC0;DC08DC07DC40D

 $    "     

  1  -      

" &    "  "

&  $& ""  C0=D

) -       "  

 "  "&   "

   %& "  1  - $ 

       & $   

   . "   1

      - $     3

  %&       

       

 %+)    &   "  

   /& "$ 

       " 3  

       

      3

      "  

     $ /  

        

-   -    $ 

 

 $    &3   

"       -   

  &     & 

     $    >-

     ? 1     -

        3- (-  "

 %&        3

"  %+) 3      %+) 

3    >3 ?  

       

       3 

"&         3 

3    ,-. - $ $   

      3 "    

$-      & 

( ( -    "   ( N

>(? 1   $- $  "

$   

           

 " "&  "  " 3

  /   -      

   (    

  3    $  &

3 $ /  0 

"   $    

1  -    @ 

   &     

   3  (     

     -  

      3 "

  -  /  3&  

  & " 3  :  

-    & -  -

   2  "  

 /  2

        

 

  

  

$       &  

  $    " 

-  -    

  

+## .

:  &  & -     

&$    3  *,)   $

$   / 1   

      %&  3-  

"   >"? *,)   " 

   " &   

 /  " *,)   " "

2         

%&  3 " "   &3  *,) 1

 ( >*1(?  " &  

   "      "

    "   $ *,) 

      3 $ 

      " $  

"  "   &3

' /-  *0  * 1

( >*1(?   $  "  

  *,)  I    -    

      3-    

   *,)     

- *1(       & 

 > -  "-  - 

 -  3 -   ? 

 - &      

         &

"$

         > 5 

,"2?

   &       

 

:   

0        

      " 

      

 

4 )  3 $  &  

&      $ 

        

       

,     *,)   " 

  ,"2

 "  "     & 

 

 "         

 

  - & 85    &  &

 "       

      $ $   "

  &

' * "  *0  

   " *1(   

    *,) 1  " $  

$&-  *1(       "

   - *1(      

     :  - $ & 

3       "$ *,) 1

   3  $    

    &   $ 

 (   1 ( >(1(?  3

  (1(E     *1(  

*,)  1 *1(       & *,)

-  (1(     %&  3 >

3 "  ?  $  *,)   

 & "      3 & "

 -     "$   3

  *,)     " "

$ - $     

 "  > *,)   $ 

    $     

? (1(      

  3 "  %&  3 $ 

    *,)  -  

  3   &3   "$ 

$ 

!"- (1(  - & 

    &  "    

 : -    & 

  & -      

      M   

   G " H   

 $   3   - (1(  

 "      & 075

'  *0   > 

 44? $ &   *,)  "  

         3  "

   $      $

$   $- $     

3 )    $  $ 

    *1(K(1(- "  .  

 "      $ "  

3

    "   

- " $ $    " "   

 2 $ $   $ "   (1( $

  $ >     9;

    0@  <?-   $ & 

  / F & "   *,) 

 >   ? "    $ *,)

      !" *,) 

  "         

     *,)    $

"     $  !

!      - $ .  "

  "    *,)   

$  " (1(     $ "  

     "F    $

-     *,)  /

$    $  *1(  $ " 

  ;5L   -  (1( $ "

  055L !   3   

    I  .   

$   .  , -   

   (1(  055L  -   

$ "        $ (1(

  

 $       

" F        

 (1(E  $     

  $   &  "&

   3 "- & -   

 "  (1( $  " "  

!&-     "   &

  (1(  "     

 

(  " 1  

 (1( &3 &    

"      $-    "

  G "  AH  

    3    

" /  I  $   "  

  "       

  *,)   $  (1( &3

*1(  (1(  & -  

  " =;55   "  -

$ %&  

O *1(K(1(       

      &    

 &    %&  

     :-   $ &

  *1(  (1(-  & " 

  -  $  & 1  - 

"       " & 3

>$ <4J"  -   & 4P4=5555 

" ?

1 *

  .     $ 3

 .  "   "$  $  $

)        " " 

 &      $ "

&   >0?  - >4?  $ 

  &- >4? $   &

-  ><?     - 

"      &  

  /    @

"

 .       

        &

   >-     %&

-       & &

    - ? , &  

   .   $    

/

C0D  &@ 1 2 %   

 1 $ - &00- !04- #

0789

C4D  M&- ( J-  J- 

 )-  ( * % - 

3%1 1 ( J   J-  - 1

   *$    

- & 09   !  

 ( - :- 0778 &



C<D *"  M  O O %  

       %

   ()- 6<>0?0==074- % 077=

C6D ) &  M -  J-  % +2 

     *

 !*5040- ( &    1

- 4550

C9D % (  %& & 1   #

 (, %- 4948- % 455<

C=D #      #  H  M

     )& $ "

2  (  -H 1   

$ - & 00-  04-  09000;-

0789

C;D %    )  '

3 4 % 5 

KK2&K K$K&K 

C8D ) J-  )-  %  )

/ % ,4 % % J$

  "- % 4555

C7D ) J-  )-  %  )-  

 / % ,4 / 

J$   "- % 4555

C05D % ( J  !  & % 3 

 6 1 2  # 

 :(09 : 1 

  : (- % 0789

C00D  J  ! & %    

   7 8 3  ()

1,: $  !- 09>0?49I

<9- % 0775

C04D * Q  9  5 

,  %    

" - + 96-  0I=6- 455<

C0<D * Q-  +-  % +  

   #

C06D     : O  ' 2 .

 " :    -

* - )- 0777

C09D %  )( %   ; ! 

 % ,  - < /#

      1 1

    

- !& 4555

C0=D %  )  = % . 2"

% 3 J$   "-

077=

C0;D %  )    '  

 1 * ,   M .-  - 

  * 1   &-

 0<70=4-  "- 0777 !( 0;05

C08D %  )    ' 

 '2.  %/3: ) - "  

  $- ) M  ) @

> ?- 1, -  -  44;475- 455<

C07D %  )  *"  M .0

; ,    /

. 1 * +. > ?-  *

  1      

 - )1 - 077=

C45D %  )-  -  ) J %

. /    / 

 7   %.>*7?@ ;  >

 % 1   (-

6;>7?-  70<74=- - 0778

C40D %  )    ' 

 1 * ,   M .-  - (

  #* 1   &-

!( 0;05-  0<70=4 +- M

0777

C44D    "  

 4 % ; %   >

 + 0775

C4<D  +     1 ) &

 M  * +-  - * M 

 >*'E50?- & 97K6  

!   (  &

 "- " 4550

C46D  + 3 6  

  1 % %-  -

    >E55?-

  - - % 4555

C49D  +   . 1 *$

 /   >* E77?-

-  !  (  >0777?

C4=D  I KK K$K

KMK 

C4;D +  - % ) (&-   % #

%    < /# 

 1 ( + <0- ! 6- - 0778-

 <9<=

C48D + -  *-  

 - 4 % >

 .  < % 

 &  ( & 98-  

A Transformational Overview of the Core Functionality of an Abstract Class Loader for the SSP.

Conference Paper

Full-text available

Jan 2005

The SSP is a hardware implementation of a subset of the JVM for use in high consequence embedded applications. In this context, a majority of the activities belonging to class loading, as it is defined in the specification of the JVM, can be performed statically. Static class loading has the net result of dramatically simplifying the design of the SSP as well as increasing its performance. The functionality of the class loader can be implemented using strategic programming techniques. The incremental nature of strategic programming is amenable to formal verification. This article gives an overview of the core class loading activities for the SSP, their implementation in the strategic programming language TL, and outlines the approach to formal verification of the implementation.

The Tyranny of the Vital Few: The Pareto Principle in Language Design

Article

Full-text available

Jan 2011
JSEA

Victor L. Winter

Modern high-level programming languages often contain constructs whose semantics are non-trivial. In practice however, software developers generally restrict the use of such constructs to settings in which their semantics is simple (programmers use language constructs in ways they understand and can reason about). As a result, when developing tools for analyzing and manipulating software, a disproportionate amount of effort ends up being spent developing capabilities needed to analyze constructs in settings that are infrequently used. This paper takes the position that such distinctions between theory and practice are an important measure of the analyzability of a language.

Technology Enablers for Identifying Fundamental Units in Neuroscience and Describing their Aggregation Across Scales

Technical Report

Full-text available

Feb 2009

Chris Forsythe

Within neuroscience, there is need for a unifying theoretical framework encompassing foundational units and their aggregation at different scales. This paper asserts that the absence of such a framework is not due to a lack of brilliant scientists or the thoughtfulness of research and theoretical development, but the result of inadequate tools. Three emerging technologies are described that will provide an enabling landscape for identifying fundamental units and developing a theoretical framework explaining the interrelationships between different scales of observation. Advances in nanotechnology, combined with techniques for measuring at larger scales, will enable simultaneous, in vivo measurement of brain processes at different scales. Second, neural engineering will allow hypotheses identifying basic foundational units and their aggregation to be tested through controlled manipulation of the connectivity and functionality of neural circuits. Third, precise, noninvasive stimulation of brain circuits will enable hypotheses linking neural phenomena to behavioral observation to be tested with intact subjects.

An Abstract Class Loader for the SSP and its Implementation in TL

Article

Full-text available

Jan 2004

The SSP is a hardware implementation of a subset of the JVM for use in high consequence embedded applications. In this context, a majority of the activities belonging to class loading, as it is defined in the specification of the JVM, can be performed statically. Static class loading has the net result of dramatically simplifying the design of the SSP as well as increasing its performance. Due to the high consequence nature of its applications, strong evidence must be provided that all aspects of the SSP have been implemented correctly. This includes the class loader. This article explores the possibility of formally verifying a class loader for the SSP implemented in the strategic programming language TL. Specifically, an implementation of the core activities of an abstract class loader is presented and its verification in ACL2 is considered.

Verifying Transformation Rules of the HATS High-Assurance Transformation System: An Approach

Conference Paper

Full-text available

Jan 2004

In high-consequence systems, there is a high cost associated with failure. Thus, there should be strong evidence that the systems will not fail in field. Such evidence cannot be obtained by traditional verification methods such as testing. Transformation-oriented programming (TOP) is a promising formal software development technique. In TOP, a source file that represents a correct formal specifications is continuously refined to pro- duce an implementation. The High-Assurance Transformation System (HATS) is an ex- ample of TOP that takes as input a source file and a transformation language program (TLP) which represents a sequence of actions to be applied to the source file. HATS users express these actions as a sequence of transformation rules and control strategies. HATS has been used to develop an application for a high-consequence system, namely the San- dia Secure Processor (SSP). The application is the SSP-classloader in which a source file (class file) is incrementally refined through five canonical forms until it becomes a ROM image that will be executed by the SSP hardware. In this paper, we introduce an approach to proving the correctness of the TLPs that produce the five canonical forms using ACL2. Our goal is to verify that a TLP that pro- duces a canonical form preserves the semantics of a class file. To achieve this goal, a se- mantic function that describes the behavior of the TLP must be identified. We have suc- cessfully built a simplified model of the TLP that produces the first canonical form, de- veloped a semantic function for this model, and proved that the model preserves the se- mantic of the class file.

Program Transformation Using HATS 1.84

Conference Paper

Full-text available

Jan 2005

This article gives an overview of a transformation system called HATS { a freely available platform independent IDE facilitating experimentation in transformation-oriented software development. Ex- amples are discussed highlighting how the transformational abstractions provided by HATS can be used to solve various problems.

Generative programming techniques for Java library migration

Conference Paper

Full-text available

Oct 2007

Embedded systems can be viewed as scaled-down versions of their stand-alone counterparts. In many cases, the software abstractions and libraries for embedded systems can be derived from libraries for stand-alone systems. One such example is the Java library for Java Virtual Machines. An embedded system does not always support all features as in the case of an embedded JVM that does not support floating-point operations. In such cases, an existing library needs to be migrated to the embedded platform. Libraries are large collections of code and manual migration is a daunting task. In this paper, we provide an automated approach to the library migration problem using program transformations. The solution developed in this paper enables rapid adaptation and re-targeting of Java libraries in the presence of evolving libraries and evolving embedded platforms.

Using Program Transformation, Annotation, and Reflection to Certify a Java Type Resolution Function

Conference Paper

Jan 2014

In Java, type resolution is a function that takes a reference to a type occurring in a given context as input and returns the canonical name of that type. This information is fundamental to static analysis—a “must have” function underlying virtually all forms of semantic-based analysis. In the case of Java, this function is also complex and it is quite common to encounter tools where it is implemented incorrectly. This paper presents a novel approach for certifying the correctness of a given type resolution function with respect to an arbitrary Java source code base. The approach uses program transformation to instrument a subject code base in such a way that reflection can then be used to certify the correctness of the type resolution function against the function used by the Java compiler. In this form of certification, the type resolution function of the Java compiler serves as the test oracle.

A higher-order strategy for eliminating common subexpressions

Article

Dec 2009
COMPUT LANG SYST STR

Optimizing compilers often perform an operation known as common subexpression elimination to improve code efficiency. Typically this is accomplished either by pruning a directed acyclic graph to replace eliminated subexpressions by memory fetches of stored values or by using partial-redundancy elimination, a data-flow analysis method. In this paper a higher-order strategic method is presented that rewrites expression trees to eliminate common subexpressions using equivalences in the lambda calculus. This approach offers several advantages—it is intuitive, transformations can be defined and applied within a high-level rewrite system, and it uses transformations for which correctness preservation can be proven.

Inducing Constructor Systems from Example-Terms by Detecting Syntactical Regularities

Article

Full-text available

Apr 2007
Electron Notes Theor Comput Sci

Abstract We present a technique for inducing functional programs from few, well chosen input/output-examples (I/O-examples). Potential applications for automatic pro- gram or algorithm induction are to enable end users to create their own simple programs, to assist professional programmers, or to automatically invent com- pletely new and ecient,algorithms. In our approach, functional programs are represented as constructor term rewriting systems (CSs) containing recursive rules. I/O-examples for a target function to be implemented are a set of pairs of terms (F(ii),oi) meaning that F(ii)—denoting application of function F to input ii— is rewritten to oi by a CS implementing the function F. Induction is based on detecting syntactic regularities between example terms. In this paper we present theoretical results and describe an algorithm for inducing CSs over arbitrary signa- tures/data types which consist of one function defined by an arbitrary number,of rules with an arbitrary number of non-nested recursive calls in each rule. Moreover, we present empirical results based on a prototypical implementation. Key words: inductive program synthesis, rule-based programming, functional programming, constructor systems

The Java Language Environment: A White Paper

Article

Full-text available

Jan 1995

Computer-Aided Reasoning for the Masses

Article

Full-text available

Jan 2000

Panagiotis Manolios

A good test of the usability of formal verification techniques and tools is whether they can be successfully integrated into the under-graduate curriculum. Widespread use of formal verification techniques at the undergraduate level will require that we convince our colleagues that such techniques benefit our students more than the material they replace. Widespread use of formal verification tools will not only require robust, mature, and usable tools, but will highlight the true remaining usability issues. At Northeastern University, we embarked down this path several years ago. We introduced a required freshman class that teaches students how to reason about the programs they write using ACL2s, the ACL2 Sedan. So far, over 200 undergraduate students have taken the class.

Specification and Transformation of Programs

Book

Jan 1990

Helmut A. Partsch

Typed Generic Traversal With Term Rewriting Strategies

Article

May 2002

Ralf Lämmel

A typed model of strategic term rewriting is developed. The key innovation is that generic traversal is covered. To this end, we define a typed rewriting calculus S'_{gamma}. The calculus employs a many-sorted type system extended by designated generic strategy types gamma. We consider two generic strategy types, namely the types of type-preserving and type-unifying strategies. S'_{gamma} offers traversal combinators to construct traversals or schemes thereof from many-sorted and generic strategies. The traversal combinators model different forms of one-step traversal, that is, they process the immediate subterms of a given term without anticipating any scheme of recursion into terms. To inhabit generic types, we need to add a fundamental combinator to lift a many-sorted strategy $s$ to a generic type gamma. This step is called strategy extension. The semantics of the corresponding combinator states that s is only applied if the type of the term at hand fits, otherwise the extended strategy fails. This approach dictates that the semantics of strategy application must be type-dependent to a certain extent. Typed strategic term rewriting with coverage of generic term traversal is a simple but expressive model of generic programming. It has applications in program transformation and program analysis.

Proving theorems about Java and the JVM with ACL2

Article

Jan 2003

J.S. Moore

Passive safety in high-consequence systems

Article

Apr 1998
COMPUTER

In "Passive Safety in High-Consequence Systems," Victor L. Winter, John M. Covan, and Larry J. Dalton discuss the design principles behind passive safety, which means that a system is not required to initiate any action to arrive at a safe state.

Typed generic traversal with term rewriting strategies

Article

Feb 2003
J LOGIC ALGEBR PROGR

Ralf Lämmel

A typed model of strategic term rewriting is developed. The key innovation is that generic traversal is covered. To this end, we define a typed rewriting calculus S γ ' . The calculus employs a many-sorted type system extended by designated generic strategy types γ. We consider two generic strategy types, namely the types of type-preserving and type-unifying strategies. S γ ' offers traversal combinators to construct traversals or schemes thereof from many-sorted and generic strategies. The traversal combinators model different forms of one-step traversal, that is, they process the immediate subterms of a given term without anticipating any scheme of recursion into terms. To inhabit generic types, we need to add a fundamental combinator to lift a many-sorted strategy s to a generic type γ. This step is called strategy extension. The semantics of the corresponding combinator states that s is only applied if the type of the term at hand fits, otherwise the extended strategy fails. This approach dictates that the semantics of strategy application must be type-dependent to a certain extent. Typed strategic term rewriting with coverage of generic term traversal is a simple but expressive model of generic programming. It has applications in program transformation and program analysis.

Piton: a mechanically verified assembly-language

Article