122171625
The small model property: how small can it be?
Efficient decision procedures for equality logic (quantifier-free predicate calculus + the equality sign) are of major importance when proving logical equivalence between systems. We introduce an efficient decision procedure for the theory of equality based on finite instantiations. The main idea is to analyze the structure of the formula and compute accordingly a small domain to each variable such that the formula is satisfiable iff it can be satisfied over these domains. We show how the problem of finding these small domains can be reduced to an interesting graph theoretic problem. This method enabled us to verify formulas containing hundreds of integer and floating point variables that could not be efficiently handled with previously known techniques.
14822655
Translation Validation
15882359
Deciding Equality Formulas by Small Domains Instantiations
We introduce an efficient decision procedure for the theory of equality based on finite instantiations. When using the finite instantiations method, it is a common practice to take a range of [1..n] (where n is the number of input non-Boolean variables) as the range for all non-Boolean variables, resulting in a state-space of nn. Although various attempts to minimize this range were made, typically they either required various restrictions on the investigated formulas or were not very effective. In many cases, the nn state-space cannot be handled by BDD-based tools within a reasonable amount of time. In this paper we show that significantly smaller domains can be algorithmically found, by analyzing the structure of the formula. We also show an upper bound for the state-space based on this analysis. This method enabled us to verify formulas containing hundreds of integer and floating point variables.
43742881
Erratum ("The small model property: how small can it be?" Volume 178, Number 1 [2002], pages 279-293)
9192328
Translation Validation for Synchronous Languages
Translation validations an alternative to the verification of translators (compilers, code generators). Rather than proving in advance that, the compiler always produces a target code which correctly implements the source code (compiler verification), each individual translation (i.e. a run of the compiler) is followed by a validation phase which verifies that the target code producted on this run correctly implements the submitted source program. In order to be a practical alternative to compiler verification, a key feature of this validation is its full automation.
7986917
Translation Validation: From DC+ to C*
Translation validation is an alternative to the verification of translators (compilers, code generators). Rather than proving in advance that the compiler always produces a target code which correctly implements the source code (compiler verification), each individual translation (i.e. a run of the compiler) is followed by a validation phase which verifies that the target code produced on this run correctly implements the submitted source program. In order to be a practical alternative to compiler verification, a key feature of this validation is its full automation. 
 
In this paper we demonstrate the feasibility of translation validation for industrial code generators from DC+ -a widely used intermediate format for synchronous languages- to C. We explain the compilation pattern from DC+ to C and advocate new abstraction techniques for a fragment of first order logic as part of the automation of our approach.
14385577
Context mediation on Wall Street
The paper reports on a practical implementation of a context mediator for the fixed income securities industry. The authors describe industry circumstances and the data and calculation services (DCS) mediator developed and deployed in the early 1990s. The mediator was designed as an interpretive engine controlled by a static declarative knowledge structure and client preference data. In addition to heterogeneous, autonomous data sources, the mediator integrated autonomously developed local and remote procedural components. Client access to both data and computational resources were provided through an active conceptual model. Structural and semantic context conversions were used to integrate disparate components and to support varying client needs. Lessons learned from the implementation and usage of this mediator provide insight into the requirements for a successful context mediator.
1155385
Implementing statecharts in PROMELA/SPIN
We translate statecharts into PROMELA, the input language of the SPIN verification system, using extended hierarchical automata as an intermediate format. We discuss two possible frameworks for this translation, leading to either sequential or parallel code. We show that in this context the sequential code can be verified more efficiently than the parallel code. We conclude with a discussion of an application of the resulting translator to a well-known case study, which demonstrates the feasibility of linear temporal logic model checking of statecharts.
1616949
An Active Conceptual Model for Fixed Income Securities Analysis for Multiple Financial Institutions
The practical implementation and use of a mediator for fixed income securities analysis demonstrated the potential for extending the application of conceptual modeling from the system design stage to providing query access to both data and computational resources. The mediator product was designed as a general interpretive engine specialized and controlled by the declarative knowledge from the conceptual model. The fixed income conceptual model included securities ranging in complexity from Treasury bills to collateralized mortgage obligations, as well as standard and proprietary analytic methodologies and calculations. All information, whether computed or retrieved from databases, was offered to clients in the form of attributes of conceptual entities. Client preference entities and attributes were used to control selection among conceptually interchangeable source data and procedural components. Experience from this implementation provides insight into the requirements for successful application of a conceptual model in mediating among heterogeneous, autonomous users and information resources.
14282197
Knowledge representation architecture for context interchange mediation: fixed income securities investment examples
We examine a knowledge representation architecture to support context interchange mediation. For autonomous receivers and sources sharing a common subject domain, the mediator's reasoning engine can devise query plans integrating multiple sources and resolving semantic heterogeneity. Receiver applications obtain the data they need in the form they need it without imposing changes on sources. The KR architecture includes: 1) data models for each source and receiver, 2) subject domain ontologies, containing abstract subject matter conceptualizations that would be known to experienced practitioners in the industry, and 3) context models for each source and receiver that explain how each source or receiver data model implements the abstract concepts from a subject domain ontology. Examples drawn from the fixed income securities industry illustrate problems and solutions enabled by the proposed architecture.
30791016
Extending the Limits of Sequentially Phased Reasoning
Verification via abstraction is the topic of concluding correctness of a complicated program from correctness of an abstraction of this program. Principles for sequentially phased reasoning are examples of verification via abstraction. They use permutation equivalences to abstract concurrent programs which logically work in phases to considerably simpler variants which perform these phases sequentially. It is shown in this paper that there are classes of concurrent programs, such as self-stabilizing ones, which logically work in phases but cannot be abstracted to a sequentialized version using permutation equivalence. A new class of so-called Ω-equivalences is defined which generalizes permutation equivalence and stutter equivalence. It is proved that both equivalences are indeed special cases of Ω-equivalences. A verification strategy based on Ω-equivalences is formulated and compared with existing approaches for sequentially phased reasoning. The strategy is applied to a self-stabilizing coloring program that can neither be abstracted by permutation nor by stutter equivalences to a sequentialized version.