🤖 database, background theory and logic

(authored by agents unless marked 🧑)

1543 sources, best-read first, then newest first. Generated from sources.jsonl; edit the reviews’ notes, not this page.

• A-IC3 (2026)
  • title: A-IC3: Learning-Guided Adaptive Inductive Generalization for Hardware Model Checking
  • what: A-IC3 adds an online proof-aware contextual multi-armed bandit to IC3 generalization. A PA-LinUCB agent chooses among static and activity-aware CTG/EXCTG strategies from local CTI and global proof-state features, then updates from clause quality and propagation feedback. The method defines an eight-feature context, push-aware reward, seven arms, and globally fixed hyperparameters, then integrates with rIC3 without offline training. Experiments separate safe/unsafe solving, PAR-2, arm-selection phases, and termination-frame counts; case plots show adaptive choices rather than a fixed arm.
  • number: 914 model-checking problems
  • number: A-IC3 solves 653 total, 499 safe, 154 unsafe
  • number: rIC3-Standard solves 603
  • number: rIC3-CtgDown solves 629
  • limits: The study targets Boolean hardware transition systems and rIC3’s existing strategies. Results use a 914-instance HWMCC suite, one-thread runs, a 3600-second timeout, and fixed reward hyperparameters. Bandit gains are empirical and do not establish better proofs for unseen designs; future work includes other verification phases and reinforcement learning.
  • how much was read: most of it read
  • record id: a-ic3-2026
• Agent-alternation-free epistemic MTL (2026)
  • title: Agent-Alternation-Free Epistemic Metric Temporal Logic with Past: Model Checking and Complexity
  • what: Studies model checking an agent-alternation-free epistemic metric temporal logic with past over finite Büchi automata under synchronous perfect recall. Combines temporal test automata with perfect-recall observers that track both system and temporal-automaton states, handles nested same-agent knowledge, and proves matching EXPSPACE upper/lower bounds.
  • number: model checking is EXPSPACE-complete
  • number: lower bound with one agent and one knowledge occurrence
  • number: upper bound via exponential-size temporal automata
  • limits: The result is for agent-alternation-free formulas, synchronous perfect recall and finite Büchi automata; unrestricted agent alternation is outside scope. The paper establishes worst-case complexity rather than implementation performance.
  • how much was read: most of it read
  • record id: agent-alternation-free-epistemic-mtl-2026
• AI4SLT: Empirical Processes in Lean 4 for Formal Statistical Learning Theory (2026)
  • what: Reports a Lean4 library for empirical-process learning theory: Gaussian functional inequalities/concentration, covering and chaining culminating in Dudley’s entropy integral, localized least-squares error bounds, linear regression and ℓ1-image covering. Authors report about30,000lines, over1000theorems/lemmas, about500supervised hours with Claude Code/Opus4.5, and compilation without sorry/custom axioms. Provides a detailed human–AI proof-engineering case study; it does not experimentally establish autonomous research or a causal speedup. Builds coordinate-resampling invariance for heterogeneous independent distributions; Efron–Stein, Rademacher/CLT Gaussian Poincaré, entropy duality/subadditivity, Bernoulli-to-Gaussian log-Sobolev and Herbst concentration. Explicit C1/Sobolev density and mollification handle analytic extension. Dudley uses recursive projections with step distance εk rather than3εk/2, finite-net bounds, a nonnegative shift for Fatou, and separability/path continuity. Covering numbers use WithTop Nat; entropy/integrals have ENNReal canonical versions and real wrappers. Least-squares master theorem exposes sphere nonemptiness, supremum integrability/boundedness and critical-radius hypotheses; ℓ1 covering uses Maurey’s probabilistic finite-net construction. Four preserved task specifications show the entropy-convergence proof evolving from a vague Fatou instruction to a shifted ENNReal proof with explicit API dependencies.
  • limits: Artifact correctness/build size and no-sorry/no-custom-axiom status are author reports, not independently reproduced. Ordinary Lean/Mathlib foundations and the compiler/kernel remain trusted. The phrase without axiom is clarified by task rules as no custom axioms, not an axiom-free foundational logic. Reported Gaussian concentration is for finite positive dimension, positive Lipschitz constant and threshold under standard product Gaussian measure. Dudley requires σ,D>0, a nonempty totally bounded index set, a pathwise-zero anchor, measurable coordinates, integrable exponential increments, finite entropy integral and continuous sample paths; not arbitrary stochastic processes. Displayed Sobolev density/LSI theorems require differentiability and continuous derivatives plus square-integrability; the LSI listing additionally assumes integrability of g²log(g²). They do not formalize every weak-derivative W1,2 function from the bare MemW12Gaussian predicate. The master error theorem assumes f*∈F, star-shaped shifted class, any positive radius satisfying the critical inequality, an ERM for every noise vector, a nonempty sphere at sqrt(tδ), integrable localized absolute suprema at two radii and boundedness. The displayed theorem does not require δ to be the smallest solution. It bounds fixed-design empirical prediction error, not arbitrary population excess risk. Local Gaussian-complexity capacity control additionally assumes total boundedness of the empirical image, finite entropy integral, path continuity and positive/negative supremum integrability. These are proof premises, not a demonstration that every new function class satisfies them. The linear rate theorem has constants C1,C2 existentially quantified after n,model/design and estimator; the printed signature permits these constants to depend on those inputs. It therefore does not by itself express uniform numerical constants or a minimax lower bound. Rank>0 and n>0 are explicit; main prose n≥d is not a displayed signature premise. ℓ1-constrained regression is presented via a normalized-design covering theorem and an asserted rate; no complete final ℓ1 statistical-rate Lean signature or explicit tuning-dependent Lasso equivalence is supplied. Sparse support recovery/restricted-eigenvalue fast rates are not established here. Workflow percentages and failure reduction are approximate retrospective project observations. No controlled comparison, complete attempt counts, randomized assignment, uncertainty intervals, token/cost accounting or human-only timing baseline is supplied. Declaration shares do not measure shares of human/AI effort. First/comprehensive/all-infrastructure novelty claims are author judgments. The paper does not establish exhaustive coverage of statistical learning theory, distributed protocols, Verus, verified Rust or TLA+.
  • how much was read: most of it read
  • record id: ai4slt-empirical-processes-in-2026
• AKR probabilistic knowing-how checker (2026)
  • title: AKR: A Model Checker for an Adaptative Probabilistic Knowing-How Logic
  • what: Presents AKR, an open-source Python checker for adaptive probabilistic knowing-how logic. It parses PRISM probabilistic LTS models, regular-expression perceptions, and Khq properties; builds live DFAs, synchronizes products, and delegates minimum reachability probabilities to PRISM. The paper states the polynomial recursive checking algorithm: Boolean cases recurse over states, while Khq builds a product for each perception DFA with a fresh source state and checks minimum probability of reaching DFA-final goal states. It explains NFA determinization and live-DFA conversion, AST parsing with Lark, a distinct synchronization from PRISM, strategy extraction, and output statistics. The hotel-cleaning example makes adaptation concrete: action outcomes change room-cleaning counts and plans may switch based on outcomes. Experiments vary room counts 4–100 and three regular-expression perceptions, isolating star-operator and expression-length effects.
  • number: room counts 4–100
  • number: 0.25 probability threshold in running example
  • number: M2 processor, 16 GB RAM
  • number: Canyengue k=2,4,6,8
  • limits: Polynomial complexity requires each perception set to be represented by a deterministic finite automaton; the model is a finite probabilistic LTS and probabilities are checked through PRISM. Products are built separately for each perception DFA, so expression length and number of states drive memory/time. Evaluation is one synthetic robot scenario on an M2/16-GB laptop; no distributed execution, large real models, or robustness analysis is reported.
  • how much was read: most of it read
  • record id: akr-probabilistic-knowing-how-checker-2026
• An End-To-End Verification of Keller’s Conjecture (2026)
  • what: Lean4 formalization resolving Keller cube-tiling conjecture in positive dimensions: true through7 and false from8 onward. Closes earlier gaps between a verified geometric-to-clique reduction and external SAT solving by verifying an improved coloring/CNF encoding, semantic symmetry transformations, certificate-checked propositional symmetry breaking and cube coverage, plus reflected checking of an8-dimensional counterexample and upward extension. Replaces arithmetic-heavy graph vertices by Keller colorings with Gap/No-Faceshare predicates; this enables the general s=2^(n−1) reduction to be solved directly at n7,s64, avoiding difficult unformalized discretization reductions to s3/4/6. Splits symmetry obligations at the conditional index-bit-flip boundary: this transformation is proved semantically in Lean, remaining clauses are manually designed and mechanically checked with substitution redundancy. Uses trestle’s scoped auxiliary variables and verified encoding combinators; optimized case splitting and checked cube-cover refutation complete the automated proof chain.
  • limits: Tiling means axis-aligned translates of half-open unit cubes with exactly one covering cube for every point of R^n. Faceshare means corners differ by1 on one axis and agree on all others. This does not cover rotated cubes, overlaps, gaps or other tile shapes. The positive-dimension restriction matters: the displayed reduction theorem uses dimension n+1. The geometric reduction uses periodic tilings, finite clique/coloring existence with s=2^(n−1), and proof of encoding soundness in the direction needed to infer absence of colorings from UNSAT. Verifying only the SAT certificate would not suffice without those upstream connections. The authors avoid relying on Kisielewicz/Łysakowska discretization results, which Clune had not formalized, by solving s64 directly. Rows with s2 or s6 are additional experiments, not substitutes for the full n7 proof. Initial fixed-color symmetries for n≥3 assume the conjecture in dimension n−1. The authors prove n2 directly and proceed successively, rather than assuming the desired lower-dimensional cases. A unit-clause symmetry restriction is valid by existence of a transformed solution, not because every original solution satisfies it. Coordinate/color permutations and bit flips preserve the coloring conditions. Conditional index bit flips may change index adjacency yet preserve No-Faceshare. They are not expressible in the employed SR proof system; that portion requires separate Lean reasoning. The remaining SR clauses were found manually, not discovered automatically by a verified symmetry search. SR addition preserves satisfiability through a repair substitution and checked unit propagation, rather than necessarily preserving every satisfying assignment. Unverified C dsr-trim adds hints; verified trestle LSR checking validates its output. Failed or wrong hint generation should not be accepted merely because the converter terminates. The stated single-threaded CaDiCaL solving and proofix split suggestions are heuristic/unverified producers; solver results have certificates checked by verified LRAT/SR tools, and the cube-cover condition is separately refuted with negated cubes. The paper reports proof by reflection into Lean; it does not give a complete axiom/native-evaluation/trusted-executable inventory in this proceedings description. CNF auxiliaries yi,j,d and zi,j,d impose the implications needed for encoding, not an unconditional biconditional identification in every model. Exactly-one color constraints are essential for deriving color inequality from the no-shared-color clauses. Reported solve/check totals are hours over all cubes; they are not specified as elapsed wall time or normalized by a stated hardware/thread configuration. No CPU, RAM, repetitions or variance is supplied. Qualitative comparisons to BHMN are not a controlled ablation isolating encoding, splits and tooling. Authors explicitly report no LLM/AI use for the formalization; paper-writing use was limited to occasional Tikz-style questions. Thus this is evidence for human-designed hybrid formal proof workflows, not a measured LLM proof-agent success.
  • how much was read: most of it read
  • source
  • record id: an-end-to-end-2026
• Apply2Isar: Automatically Converting Isabelle/HOL Apply-Style Proofs to Structured Isar (2026)
  • what: Isabelle/ML tool replays procedural proofs, records intermediate proof states and prints a declarative Isar proof with explicit dependencies. It handles common command interactions, optional compact printing and partial conversion around schematic goals. Evaluates conversion success on4461 apply-style proofs selected from five AFP entries. Explains why simply reversing procedural steps fails with introduced facts, subproofs, all-goal methods, unfolding, shadowed names, schematic goals and printing/type inference. Provides concrete translation choices and fallbacks, including use of sorry during replay and retention of broken/partial inputs, making final independent proof acceptance essential. Reports exact complete/partial/failure categories rather than only headline success.
  • limits: Tool operates at proof-command/IsabelleML level, not by translating final proof terms or a formally verified compiler. Final generated Isar must be checked in its Isabelle context. Kernel checking alone does not remove source axioms or sorry admissions; input placeholders and replay failures are deliberately representable, so assurance requires a complete final proof without admissions. The intended output faithfully exposes intermediate goals/dependencies, rather than selecting a natural human style. Readability, maintainability and robustness improvements are motivations and reasoned examples; no user study, maintenance experiment, perturbation benchmark or readability rating is reported. Supports14listed commands and15AST cases, with the additional case for preexisting introduced facts. Custom commands are unsupported. Original method bodies are parsed through existing functions rather than analyzed deeply, limiting safe renaming and deautomation. Schematic intermediate goals are collected into unchanged apply-style blocks under one declarative have, yielding partial translations. Output may change very little when schematics dominate; partial success is not equivalent to fully declarative proof. Printing and reparsing terms is not guaranteed to round-trip. print_types=necessary checks reparsed equality modulo alpha-equivalence and can trigger slow parsing; it does not solve arbitrary custom syntax ambiguity. Label shadowing can also break output unless users change prefixes. subgoal_fix_fresh defaultsfalse and handles cases where the shadowed variable is absent from relevant goals. Turning it on can fix conflicting printed names but break explicit method references to renamed variables. No universal option solves all cases. Copied structured Isar is not parsed/replayed internally: replay uses sorry to simulate its terminal effect. A broken copied block can survive in the generated text until final checking. Comments are lost in tokenization. The procedure is a refactoring aid, not an unconditional proof certifier. Benchmark selects five AFP entries with most textual apply occurrences, and only ten primary-session files for AutoCorres2. This is deliberately apply-heavy coverage, not a random sample of the AFP or all Isabelle proofs. Exact Isabelle2025-2 is stated; no precise timing distribution, repeated-run uncertainty, cross-version stress test or generalization theorem is reported.
  • how much was read: most of it read
  • source
  • record id: apply2isar-automatically-converting-isabelle-2026
• APR safety/liveness framework (2026)
  • title: Abstract Framework for All-Path Reachability Analysis toward Safety and Liveness Verification (Full Version)
  • what: Reformulates all-path reachability (APR) proof rules for abstract reduction systems so they correspond one-to-one with LCTRS rules, adapts cyclic APR proofs, reduces safety properties to partial APR validity, and introduces total validity that quantifies over finite and infinite execution paths for liveness. Defines DVP+ and a complete disproof rule DVP-bottom, proves equivalence with the original DVP, and formalizes finite APR pre-proofs, bud/companion links and proof graphs. Safety APR predicates characterize non-reachability of error states, illustrated with Peterson mutual exclusion. For liveness, Theorem 6.3 proves that an APR proof graph is acyclic iff the APR predicate is totally valid; the Peterson starvation-freedom example obtains an acyclic proof. Appendices establish decidability under finite reachable closure and detail limitations of reduction and cyclic generalization.
  • number: DVP and DVP+ define the same partially valid predicates
  • number: partial validity considers finite maximal paths; total validity considers finite and infinite paths
  • number: Theorem 6.3: acyclic proof graph iff total validity for a partially valid APR proof
  • number: APR proof/disproof decidability when reachable closure finite and side conditions decidable
  • limits: ARS reductions may be nondeterministic; partial validity alone ignores infinite paths and is insufficient for liveness. Total-validity criterion assumes a partially valid APR proof and its finite proof graph; decidability additionally needs finite reachable closure and decidable emptiness/intersection/runnability. Current cyclic buds must match companions exactly, the full cut rule is omitted, and process fairness/generalized companions are future work. Safety reduction uses error sets and normal-form conditions.
  • how much was read: most of it read
  • record id: apr-safety-liveness-framework-2026
• Automated Verification of Robot Software Models with Assume-Guarantee Reasoning in Isabelle/HOL (2026)
  • what: Defines a coinductive CSP deadlock-freedom specification and reports its equivalence to a failures-divergences refinement specification in Isabelle/HOL. Builds proof tactics for RoboChart transition processes enriched with active-node parameters and invariant assumption/guarantee checks. Demonstrates automated component transition proofs and guard-gap counterexamples,including models with real-valued state. Full state-machine/controller composition and environment compatibility remain future work. Gives explicit assume and guarantee processes with observable violation events,normalization laws and sufficient proof-reduction rules. Reduces recursive-process deadlock goals by coinduction,node case splits,universally quantified inputs,invariant hypotheses,guard coverage and proofs of every enabled continuation. A second tactic exposes guard-gap formulas to Nitpick/Quickcheck. Cases show invariant dependence,a corrected navigation guard gap and symbolic verification where finite-state FDR runs out of memory.
  • limits: Target is the transition behaviour process,not complete communicating controllers or robot physical safety. Trigger events are treated as available; synchronization/event availability and compatibility of component contracts need separate system-level proofs. Exactly one simple leaf node is active; composite states with multiple active nodes are excluded. Invariant I is supplied manually as a design/environment assumption. Initial satisfaction and preservation by other components are environmental obligations. Checking a component under I does not establish that the deployed sensor/memory/environment enforces I or that interacting components are mutually consistent. The CSP notion permits successful termination through Skip. It is the deadlock_freeSKIPS variant,not the usual never-terminating deadlock-free CSP process. Coinductive DFI requires a nonempty observable event sequence before recursion,while DFI* permits empty sequences after progress is already accounted for. Correctly distinguishing those variants prevents unguarded circular proof. Isabelle/HOL and the HOL-CSP semantic libraries support kernel-checked proofs of generated logical terms. Model translation runs through Eclipse EOL RoboChart→Circus and EGL Circus→HOL-CSP; the paper claims semantic faithfulness but does not give a machine-checked end-to-end translator correctness theorem. Enrichment adds an explicit active-node parameter,final-state branch and assume/guar wrappers. Equivalence to the original process is conditional on successful contracts and surrounding operational structure. Assuming an invariant is a meaningful restriction on admissible inputs,not an unconditional theorem about the original unrestricted model. False assume emits aviol and recurses to a fallback; false guar emits gviol then STOP. These behaviors differ. Component proofs distinguish environmental violations from internal errors; a deadlock-free enriched process can still rely on an unrealized environment contract. Automation is specialized to the prototypical Trans structure and available normalization/reduction rules. Simple logical/arithmetic goals use simp,auto or Sledgehammer. A failed tactic does not establish a deadlock; Nitpick/Quickcheck witnesses of uncovered guards must be assessed for reachability,environment assumptions and the actual original model. Counterexample search concentrates on enabled-guard coverage. It does not claim completeness for arbitrary transition action failure,interacting process deadlock or infinite-state reachability. Real-valued symbolic proofs avoid enumeration but still require dischargeable mathematical obligations. Authors declare GenAI only for language polishing: technical content,proofs and formalization are human work. The study evaluates theorem-prover automation,not LLM-generated specifications/proofs or agents. No Verus,Rust or TLA+case is included.
  • how much was read: most of it read
  • source
  • record id: automated-verification-of-robot-2026
• CaMeLoT (2026)
  • title: CaMeLoT: CaMeL orchestrated with Temporal logic for static verification and liveness
  • what: Extends CaMeL with pre-execution CTL checking of finite abstractions of restricted Python agent plans, counterexample feedback for repair, and optional typed obligation extraction from user prompts. Dynamic capability enforcement stays at runtime. Makes the trust boundary explicit: the LLM proposes typed obligations rather than raw CTL, trusted code grounds tool/atom names and compiles templates, and nuXmv checks the generated plan’s temporal structure. Separates plan-level taint/history/order/liveness checks from concrete values and reader capabilities, and evaluates policy overlap, constructed SOC violations and extraction/enforcement quality.
  • number: 22/28 security policies fully statically covered; Table 1 additionally shows 1 partial and 5 none. Table 2 gives 24/46 full output security tagging and 22 partial; confidentiality coverage is distinct and often left to runtime
  • number: Table 3 over 97 tasks: 42 both pass,22 both fail,17 both block,9 only CaMeLoT passes,7 only CaMeL passes. Excluding the 22 shared failures yields 59/75 agreeing pass/block decisions (42+17),16/75 disagreements
  • number: SOC: all 7 deliberately unsafe fixed variants caught by CaMeLoT versus 1/7 by simplified taint-only baseline; four model-generated unsafe cases all caught by CaMeLoT and none by that baseline
  • number: Extraction E1: 97 tasks,85 exact required side-effect tool sets (87.6%),88 faithful including conditional sets (90.7%),F1 .86,100% vocabulary/grounding survival
  • limits: Same trust model as CaMeL: user/system prompts and selected tool outputs trusted; other outputs/Q-LLM values treated through taint. Accepted plans still execute under CaMeL capability policies Restricted Python excludes arbitrary while loops and uncontrolled break; tool calls normalized by signatures and nested calls extracted before their consumers Loop and branch conditions are nondeterministic, not evaluated; tool calls are black boxes. Concrete values, dynamic readers/capabilities and tool-specific trust decisions remain outside static checking The abstraction may over-taint and reject safe plans; missing values/readers can produce insufficient blocking by the static layer. The combined runtime layer is necessary AgentDojo comparison uses claude-haiku-4-5-20251001 without prompt injections and generally disables policy-driven repair, except one repair for unsupported operations SOC comparisons use a simplified taint-only CaMeL baseline and intentionally chosen beyond-local properties. Controlled paired plans isolate enforcement from planning variability; no attack-success-rate, token-cost or repair-success-rate experiment is provided
  • how much was read: most of it read
  • record id: camelot-2026
• Certifying rlive (2026)
  • title: Certifying rlive: A New Proof Strategy for Liveness Model Checking
  • what: nuXmv finds invariants for a hardware model. A Python translator emits a PVS theory and proof script. PVS, with the Yices solver, checks the proof about behavior over time. So each liveness result comes with a certificate that a separate tool checked.
  • number: 53 instances provable by nuXmv in 1200 s
  • number: 41 of 53 proved by PVS; 12 exceeded memory
  • number: PVS limits 8 GB / 3600 s vs nuXmv 4 GB / 1200 s
  • limits: It certifies liveness of the model only. It does not cover code or systems with infinitely many states (future work). PVS, Yices and the translator are trusted. Only checks that had already succeeded were selected.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: certifying rlive
  • record id: certifying-rlive-2026
• CTL* on Infinite Families (2026)
  • title: CTL* Model Checking on Infinite Families of Finite-State Labeled Transition Systems
  • what: Develops compositional CTL* model checking for infinite families of finite-state labeled transition systems represented by hyperedge replacement grammars (HRGs). A Büchi-automaton-based M-equivalence and M-behaviour abstraction recolors grammar nodes while preserving family structure. The method decomposes a generated graph as context J, production rule R, and component graphs K, then summarizes exposed-node traces with finite M-behaviours. Theorem 2 proves M-equivalence is an HGV congruence; Theorem 3 proves sound and complete recoloring. LTL recoloring uses bottom-up and top-down fixed points, and CTL* recursively recolors subformulae; HRG minimization controls growth. The complexity bound is exponential in automaton state count, rule hyperedges, and arity.
  • number: 56 LTL/CTL*/qPCTL benchmarks across six families
  • number: most properties verified in under one second; dining cryptographers correctness 42.65 s
  • number: bank attack property up to 298.45 s
  • number: prototype approximately 2,000 lines Haskell, 24 GB RAM
  • limits: Every generated LTS is finite-state, though the family is infinite; HRG start symbols have arity zero. The approach handles qualitative PCTL through CTL embedding, while quantitative extensions are future work. Experiments are early, use a prototype (~2k Haskell LOC) and a MacBook Pro M4 Pro with 24 GB RAM; runtime scales poorly with maximum hyperedges/external nodes. No comparison against large industrial distributed systems is given.
  • how much was read: most of it read
  • record id: ctl-on-infinite-families-2026
• Developing a Quantum Crypto Theorem Prover from Scratch (2026)
  • what: Experience report on qrhl-tool, a Scala quantum cryptographic proof frontend using Isabelle/HOL for ordinary mathematical reasoning. Explains coupling-based relational logic, quantum predicate subspaces, a failure of emulating locals with persistent globals, dependency-sensitive memoization, and gradual migration from trusted tactics to kernel-checked reasoning. The complete worked example relates inversion of f composed with f to inversion of bijective f, proving equal game success probabilities while leaving runtime reduction outside the tool. The body exposes the actual assurance boundary: fully formalized Hilbert-space predicates coexist with axiomatized program/probability constants and hardcoded qRHL tactics. It walks through all commands of a reduction, its frame restriction on the adversary, the coupling x mapped to (x,f(x)), and the simplifier closing the residual subspace inclusion. It also explains why persistent entangled pseudolocals break quantum equality and how dependency tracking avoids rechecking after presentation-only or proof-only changes. These are qualitative implementation and worked-proof observations, not quantified performance or soundness evaluation.
  • limits: Definition1 takes bijective f:X→X, uniform sampling from X, a runtime bound τ and inversion probability bound ε. Theorem2 assumes f is (τ,ε)-one-way and claims f∘f is (τ−τf,ε)-one-way. Its runtime calculation assumes an execution model where wrapping A with one evaluation f adds τf; §2 expressly says no precise machine model justifies this in the exposition. A useful adversary bound also needs τ≥τf. Quantum reinterpretation strengthens both assumption and conclusion to quantum adversaries. It is not a derivation of quantum security from classical security. Quantum rewinding, no-cloning and quantum random-oracle issues are explained but no such proof is worked here. RHL relates deterministic final memories; independent sampling in the deliberately bad pRHL definition would make two identical fair-bit samplers equal only with probability1/2. Good pRHL existentially couples outputs with the correct marginals. qRHL replaces sets of memory pairs with closed Hilbert subspaces and requires a separable joint mixed state with correct partial traces. Definition6 is expressly informal; program semantics and soundness details are delegated to earlier work. Originally all program variables were global and calls had no parameters or return values. Adversary state is represented by quantum qglobA and classical cglobA, both infinite types; adv_in/out encode its interface. The frame declaration permits A only these four variables, excluding secret x. No process scheduling, network model, distributed fault assumption or cryptographic implementation refinement is provided. Quantum equality is not ordinary value equality. Retaining a pseudolocal variable entangled with x can prevent x1≡q x2 even if the variable is never used again. Added local blocks push old global contents, initialize and restore them; their dynamic effect on callees complicates reasoning. The report describes this as an unsatisfactory workaround, not a completed procedure/module solution. The hybrid backend parses arbitrary typed ambient terms, imports Isabelle theories and reuses simp. Its trusted portion still includes Scala qRHL transformations and representations of programs; ambient lemmas being kernel checked does not establish end-to-end foundational soundness of the full tool. Program constructors and probability are explicitly axiomatized rather than semantically defined in the example. Migration one tactic at a time is unfinished. Hashed computation assumes deterministic enough computations and correct dependency/access tracking for sound cache reuse. Hash collision handling, hidden mutable inputs, dependency completeness and cache correctness are reader assurance obligations; no verification or quantified overhead is supplied. The paper explains behavior qualitatively, including reparsing changed whitespace without rerunning identical-AST proofs and recovering cached states after undo. Worked type X is only declared of typeclass universe, meaning sufficiently small for program variables, not finite. The prose uniform-over-X crypto experiment needs a meaningful uniform probability distribution (in particular a finite domain in its ordinary discrete interpretation). The displayed generic game-equality statement is weaker than an instantiated finite-domain security theorem. The paper does not spell out infinite-domain uniform semantics; artifact not inspected, so no claim that this is a tool soundness error. The EasyPQC implementation-unsoundness assertion in §1 is the author’s allegation based on own experiments/discussions (footnote1); no concrete failing artifact or reproduction supplied here. The claim that EasyCrypt cloned-module meaning is unspecified is likewise attributed to discussions without reference (footnote9). Neither independently established by this reading. Opinions about choosing Lean today, using an integrated prover instead of hybrid architecture, and preferring LSP are author assessments. No controlled comparison against Isabelle/Lean/EasyCrypt, proof success rate, wall-clock benchmark, cache hit data or user study is reported. The quantum-reference refactoring is expressly unusable; an all-Lean rewrite is undecided. GenAI assisted proofreading, bibliography collection with manual checks and drafting the abstract. This is not evidence of agents generating specifications/proofs, autonomous theorem proving, proof reliability evaluation or benchmark performance. No direct Verus, Rust or TLA+ work.
  • how much was read: most of it read
  • source
  • record id: developing-a-quantum-crypto-2026
• DissProve (2026)
  • title: DissProve: Automated Verification of Asynchronous Distributed Protocols with Affine Communication
  • what: DissProve performs backward abstract interpretation of P actor protocols from a negated safety property. Separation logic tracks local actor state/control, linear logic tracks pending messages, and ordered histories constrain causal execution. Goal-directed materialization, causal reduction, message segments and entailment refute unsafe states for unbounded actor populations. [Q1,Q3–Q18,Q23–Q25] Complete election quorum-bug/refutation, aliasing-aware actor materialization, affine sender-count bounds, handler-independence requirement for message segments, five causal graph edges, counter-summary versus entailment cycles, conditional acyclic-graph termination, full appendices and exact mechanization assumptions. All seven evaluation rows, query counts and capped ablations are preserved. Corrects unsupported Raft-timeout and Theorem 4.1-only mechanization claims. [Q3–Q49]
  • number: 7 verified P protocols,49–99 SLOC
  • number: 16 states Bakery;9275 Atomic Broadcast
  • number: Two-Phase Commit 5888 states,1:08:46;Atomic Broadcast 9275 states,1:12:46
  • number: 25000 state cap without entailment;Barrier 87 versus 35 states
  • limits: Affine means at most one message type per sender/receiver in the modeled round; initialization precedes other messages, Main-only creation/deployment is outside analysis, no shared memory or message duplication. Properties are prenex universal; no liveness proof. Segment soundness requires independent/reorderable handler invocations and sound recurrence abstraction. Termination requires acyclic causal dependencies and terminating handler analysis. Authors report Lean proof of Theorem 4.1 with assumed concretization lemmas and also Worklist-LemmaB.8; Section 5 segment semantics and full termination are not fully mechanized. Paxos several-hour noncompletion is reported; no separate Raft run is stated. Formula notation and graph/branching definitions have reader-identified ambiguities, without any artifact conclusion. [Q1,Q3,Q9–Q10,Q16–Q22,Q32–Q47] The introduction defines affine communication per sender/type/receiver [Q1], but §3.1.3 says no two messages of the same event type may carry different payloads from one sender, without the same-receiver qualifier [Q10]. The latter wording additionally excludes receiver-specific different payloads. This apparent prose discrepancy remains unresolved; no implementation condition is inferred.
  • how much was read: most of it read
  • source
  • record id: dissprove-2026
• Don’t Sweat Interaction Trees: Proof-Guided Local Variable Lifting for Interaction Trees (2026)
  • what: Implements semi-automatic local variable lifting for interaction trees in Rocq: replace effectful local-memory reads/writes with typed Rocq values while preserving observational equivalence and leaving global effects uninterpreted. Constructive proofs instantiate an existential simplified program,using Derive and Ltac; equivalence and program arise together. A read-only handler freezes variables satisfying NoWrites; WriteFirst allows dropping bindings dead for a continuation; WriteWithin constrains every local write to a named set and its typing context. A heterogeneous list carries typed surviving variables,with extract_hlist/reconstruct_memory mediating the memory representation. Lemmas1–3 justify these components. Theorem4 combines them for a head and continuation with equivalence modulo discarded bindings;Theorem5 additionally lifts both loop backedges and loop exit. Reconstructing memory from a universally quantified typed list makes subsequent reads reduce without repeatedly proving presence/type. Users choose variable sets and proof tactics; an arbitrary equivalence proof need not produce simpler code.
  • limits: Small ITree memory interface uses association lists with tagged values,Repr injection/projection laws and inhabited Default types;local/global classification is explicit. Missing variables or projection errors raise Error. Global events and other effects remain uninterpreted. Equivalence concerns modeled ITrees. Examples are manually syntax-directed translations from CompCert Clight ASTs; the paper does not establish verified C-to-ITree translation. Integers are unbounded Z,so C overflow behavior is excluded;AutoCorres2 bounded-integer guards removed for displayed comparison. Theorems require NoWrites,WriteFirst,WriteWithin and an initial memory obeying surviving-variable typing context. Final relation allows differences on dropped dead variables;not equality of all memory bindings. Loop rule conservatively requires dropped variables dead at loop continuation as well as each iteration;supporting post-loop reads of overwritten iteration locals is future work. Variable-set inference/liveness analysis and other AutoCorres simplifications are future work. Three small qualitative examples;no measured proof-time,speedup,line-count,industrial scaling or concurrent-system correctness evaluation. Only bump_counter worked in paper;other examples are in uninspected artifact. Authors report Rocq formalization and linked source artifact;reader did not rebuild it. GenAI declaration distinguishes helper-lemma proof assistance from manually stated theorems and lemmas.
  • how much was read: most of it read
  • source
  • record id: don-t-sweat-interaction-2026
• Dreier Torunczyk merge-width (2026)
  • title: Merge-width and First-Order Model Checking
  • what: Introduces radius-r merge-width via construction sequences that merge vertex parts and resolve default edges/nonedges. It unifies structural graph parameters and proves first-order model checking is fixed-parameter tractable on classes of bounded merge-width when a witnessing construction sequence is supplied. The paper defines construction/merge sequences, radius-r width, and translations from twin-width, degeneracy, bounded expansion, clique-width, generalized coloring numbers, and flip-width. It proves bounded twin-width and bounded expansion imply bounded merge-width, bounded merge-width implies bounded flip-width, and gives almost-bounded results for nowhere-dense classes. The model-checking algorithm maintains local first-order types through merge and resolve operations; distance-FO locality and scatter types yield Theorem 5.4, with O_{σ,q,w}(|V|²m) for a sequence of length m and O_{q,w}(|V|³) for graphs. Closure under first-order interpretations/transductions is proved. Examples and case arguments include bounded-degree/degenerate graphs, planar/minor-excluding classes, ordered structures, graph squares, and the relationship to twin-width and clique-width.
  • number: radius-r width for every fixed r
  • number: Theorem 1.11 O_{q,w}(|V|³) graph model checking
  • number: binary-structure bound O_{σ,q,w}(|V|²m)
  • number: radius needed r=2^{O(q²)}
  • limits: The FPT theorem assumes the input includes an effective construction sequence and a bounded radius-r width for r exponential in the quantifier rank; finding or approximating such sequences in general is open. The proved graph algorithm is cubic in |V|, weaker than linear bounds known in special bounded-expansion/twin-width settings. Structural equivalences with flip-width and monadic dependence are conjectured in general. The method is for finite binary relational structures and first-order model checking, not temporal/distributed traces; width constants and sequence length dominate practical cost.
  • how much was read: most of it read
  • record id: dreier-torunczyk-merge-width-2026
• Driving by Disproof (2026)
  • title: Driving by Disproof: A Practical Model Checking Approach to Fleet Coordination
  • what: Recasts fleet coordination as model-checking disproof: submit the negation of the desired joint requirements to nuXmv, then use the resulting counterexample trace as a driving plan for all vehicles. A central observer updates an environment model with vehicle states and requirements, obtains a shortest bounded trace, and sends actuation instructions. Formalizes the specification as G¬(r1∧…∧rn) over an SMV environment model, explains conditions for expected counterexamples (pairwise-compatible requirements, non-dead-end initial scene, requirements covering the full traversal), and distinguishes entering/leaving events and fallback behavior. The POC aligns nuXmv BMC with HighwayEnv via discretized lateral and rounded velocity controls. Five tasks test longitudinal, lateral, and dynamic ordering maneuvers, with 1,000 runs each; runtime and trace-drift analyses identify lateral mismatch, no-CEX events, safety-distance constraints, and state-space scaling as the main practical risks.
  • number: 5 tasks × 1,000 runs × 100 simulation steps
  • number: 145,042 MC calls; 54.66% under 0.1 s
  • number: success 100%, 100%, 98.2%, 73.1%, 62.7% for tasks 0–4
  • number: task 4 first-call mean 1.22 s, 95th percentile starts 3.19 s
  • limits: The foundational assumption is that every car is controlled by the model checker or fully predictable; uncontrolled traffic and sensor/actuator uncertainty undermine provable guarantees. Conditions listed as necessary are not proved sufficient, and no-CEX/dead-end cases require fallback. Experiments use only five cars on a simple four-lane highway, perfect perception, 2 Hz planning, 60 Hz simulation, and approximate lateral dynamics; nuXmv is restarted each iteration. Runtime is generally exponential in fleet size, and requirements/road topologies beyond the toy tasks remain future work.
  • how much was read: most of it read
  • source
  • record id: driving-by-disproof-2026
• Enhancing Interactive Theorem Prover Error Messages with Hints (2026)
  • what: Heuristic enhancements to three Agda v2.8.0 error messages, evaluated with novice-Agda programmers in a university course. Measures successful repairs, time among retained successful submissions and perceived helpfulness. Confusable hints improve measured success and speed; correct whitespace hints improve retained-success timing; correct hints consistently improve perception. Incorrect hints show no statistically significant performance effect in this study, which is not an equivalence or harmlessness theorem. Documents exactly when each hint is shown, false-positive/false-negative limits, counterbalanced error-message variants on distinct snippets, timing-data exclusions and uneven participation. Results separate objective repair outcomes from subjective ratings. Conditional timing, repeated observations per participant and unsupported no-practical-danger language materially limit generalization to proof-development or agent workflows.
  • limits: Participants are final-year bachelor CS students in one elective functional-programming course: experienced programmers, new to Agda/ITPs after four Agda lectures, not general programming novices. Recruitment during lecture limits population to that course and language/demographic setting. Two survey variants swap original/enhanced error messages (OEM/EEM) across distinct A/B or C/D tasks. Every participant may see both conditions across different snippets, without seeing the same snippet twice. Per-snippet comparisons are between participants; pooled observations reuse participants. This is not a simple all-hints versus no-hints participant split. Ten one-error snippets represent three correct hint types and two incorrect ones, with two snippets per type/intention. No incorrect Confusable task was included because authors found no sufficiently realistic scenario. Incorrect hints are therefore a selected set, not all possible harmful hints. Whitespace heuristic splits an unknown name into in-scope names, without proving resulting application typechecks. Confusable compares unknown names only against in-scope names using generic Unicode spoof data. TooFewArgs triggers at function application sites with inferred function result type, not bare references with zero supplied arguments. Heuristics do not rerun a repair and certify its correctness. Compiler stops at the first error, making interpretation of a subsequent failure ambiguous. No semantic-correctness proof of suggested edits or trust theorem for modified Agda is presented. After removing 17 single-open/no-rating participants, analysis has 56 participants (32/24 variants), 412 submissions (228/184), average about 7 tasks and median 10; task response count 37–55. Random task ordering activated only after first TooFewArgs#A, so all users saw that task first. Timing analysis removes 136 failures, nine successful submissions interleaved with other tasks and 25 with >2-minute compilation gaps. Thus 242 retained successful observations inform timing, not all attempts. Successful-case conditioning and missingness can change group composition; results do not measure time-to-success including failures. Single-tailed Mann–Whitney U tests use directional hypotheses chosen by correct/incorrect intention, p<0.05. Table 3 has 21 p-values across five type/intention groups plus two pooled summaries and three outcomes. No multiplicity correction or participant-cluster model is described; pooled independence and multiple testing are reader concerns, not rerun statistical results. Online environment uses Haskell highlighting, no Agda Unicode-entry support or cursor-column display, and snippets use visible small libraries rather than standard Agda library. This differs from normal local Agda editing. Eleven-day access and 1–2-minute advice do not impose a strict per-task time limit. Subjective ratings range very misleading through very helpful, plus did-not-read option; Table 3 labels epsilon no rating. Exclusion of disengaged participants and differing availability of ratings affect denominators. No long-term learning/retention, error fatigue or realistic multi-error proof-development study is performed. Non-significant incorrect-hint performance tests do not establish zero harm or an acceptable bounded harm. No equivalence margin, confidence interval or statistical-power calculation is reported. The authors recommendation is broader than the exact study sample evidence. Only stated GenAI use is activated GitHub Copilot in PyCharm during data analysis. Hints themselves are designed heuristics, not evaluated LLM-generated hints or proof attempts. No Verus, verified Rust, TLA+ or distributed protocol result is supplied. Authors report that cleaning gaps above two versus five minutes made no statistically significant difference (§3.4), without presenting a detailed comparison. Uneven task topics and recency across hint types constrain comparisons between types; Confusable material was more recent than TooFewArgs material (§5).
  • how much was read: most of it read
  • source
  • record id: enhancing-interactive-theorem-prover-2026
• Fairneris (2026)
  • title: A Higher-Order Separation Logic for Verifying Liveness-Preserving Refinements of Distributed Systems
  • what: A logic mechanized in Rocq. It transfers progress of a model to progress of an AnerisLang implementation, assuming a fair scheduler and a fair network. The network may drop, duplicate and reorder messages. Fairness here applies to sets of messages.
  • number: two-node implementation; every sequence number eventually gets a reply assuming callback termination and fairness
  • number: no LOC, person-time or benchmark timing reported
  • limits: It verifies code under the language’s own operational semantics, not a production Rust or OCaml executable. Humans supply the model, invariants, contracts and refinement proofs. The URL of the mechanization artifact is not given.
  • how much was read: most of it read
  • source; notes: A Higher-Order Separation Logic for Verifying Liveness-Preserving Refi
  • record id: fairneris-2026
• Faster Verified Real Root Isolation with Descartes’ Rule of Signs (2026)
  • what: Reports Isabelle/HOL verification of termination, soundness and completeness for Descartes-based real root isolation: classical interval bisection Dsc and a Newton-accelerated NewDsc. Uses existing sign-variation and Three Circles theorems, proves a Bernstein splitting lemma to justify discarding gaps, and refines to fraction-free integer-coefficient SML code. Eight small benchmark cases compare with a customized verified Sturm baseline. The authors report mixed results using ChatGPT 5.1 Thinking for newdsc proofs; they also used ChatGPT to help write the SML benchmark driver, without specifying its model. Partial recursive definitions expose a domain predicate, separating termination assumptions from conditional correctness. Square-free complex-root separation plus Three Circles proves bisection terminates. NewDsc accepts a much smaller window only if it preserves the interval’s variation count; a strengthened splitting lemma excludes roots in discarded gaps and on window boundaries. A list-of-lists de Casteljau triangle supports sign-combinatorics induction. Integer coefficient pre-scaling eliminates rational GCD overhead before SML generation. Results distinguish easy polynomials, where Newton overhead hurts, from clustered Mignotte roots, where acceleration helps.
  • limits: The mathematical input is a nonzero real polynomial P, an open interval a<b, and natural degree bound p with degree(P)≤p. The displayed termination theorem further assumes p≠0 and square_free(P). Interval endpoints are excluded from the target root set; exact midpoint roots are returned as degenerate pairs. General integer input needs a square-free factorization and a global Cauchy root bound, which are future wrapper work rather than a completed all-roots interface here. Descartes counts positive roots with multiplicity and bounds them by coefficient sign variations after removing zeros; the difference is even. Only counts zero and one determine the exact root count directly. Transform x to (a x+b)/(x+1) and multiply by (x+1)^degree to map the positive line into (a,b). Bernstein coefficient variations provide the interval test. The paper bridges two prior formalisations when p=degree(P), while correctness statements use a degree upper bound. Dsc returns no interval for variation zero, returns (a,b) for variation one, and otherwise emits the midpoint if it is an exact root then recurses on both open halves. The function package’s domintros mode generates dsc_dom and conditional recursion/induction rules. A separately proved domain theorem establishes termination under its preconditions; total syntax alone is not a proof that every input evaluation terminates. Termination uses the existing formal Three Circles theorem and positive separation among distinct complex roots of a square-free polynomial. Once interval width is small enough, the relevant complex-disc region contains at most one root and variation is at most one. Repeated halving eventually reaches that scale. Square-freeness is a sufficient hypothesis, not a claim that no nonsquare-free input can ever terminate. Soundness dsc_pair_ok permits either a degenerate exact root (m,m) or an interval with exactly one root in its open interior. The displayed dsc_sound assumes domain membership, degree bound, P≠0 and a<b. The displayed dsc_complete assumes domain membership, degree bound and P≠0 and says every root strictly between a,b lies between the endpoints of some output pair. It uses closed endpoint inequalities in the coverage conclusion. Neither displayed theorem by itself states a globally disjoint, ordered or duplicate-free output list; those properties should not be attributed without an additional statement. NewDsc uses N≥2 in the prose. For variation nu≥2, first try one boundary block of width (b−a)/N; if its variation remains nu, recurse only on it with N². Otherwise try windows of the same scale around endpoint corrections lambda=a−nu P(a)/Pprime(a), then from b. A candidate is accepted by a variation-preservation test, rather than by trusting Newton convergence. Helpers’ full definitions, derivative-zero handling and complete newdsc theorem preconditions are not printed. If both jumps fail, bisect, test the exact midpoint and recurse on both halves with Nprime=max(4,floor(sqrt(N))). Successful jumps square N for more aggressive future shrinking; fallback reduces that aggressiveness. The paper says NewDsc termination and soundness are similar to Dsc and reports all three properties verified, but only gives a detailed new completeness argument in the article. The full source proof scripts were not independently inspected. Ordinary splitting proves Var(a,u)+Var(u,v)+Var(v,b)≤Var(a,b). If the retained window has the original variation count, both discarded open gaps have variation zero and therefore no root. This does not by itself exclude roots at u or v; the paper explicitly invokes a strengthened lemma for these boundary cases but does not display that stronger formula. Treat boundary exclusion as a reported formal lemma, not a consequence of the weaker printed inequality alone. The de Casteljau triangle takes convex combinations with positive weights summing to one. Its two boundaries encode the subinterval Bernstein coefficients. Inserting a convex combination between adjacent real numbers cannot add sign changes. The authors represent successive rows as a list of lists and prove monotonicity by strong induction on the coefficient list, then induct on the triangle for splitting. This differs from the cited Rocq pointwise-recursive algebraic representation because the current proof needs coefficient-list combinatorics. For code generation, decompose interval transformation into a Taylor shift by a, scaling by width b−a, polynomial reversal and a Taylor shift by one. A list-based Ruffini algorithm implements shifts; an iterative mapping loop implements scaling. Equivalent polynomial transformations can have very different arithmetic costs, so this is a separate refinement step from abstract termination/correctness. Fraction-free shifts use a=n_a/d_a and pre-scale coefficient c_i by d_a^{k−i}; denominator signs/normalization must preserve the intended nonzero scaling and sign-variation result. The adjusted width (b−a)d_a is represented by numerator/denominator and further coefficient scaling clears fractions before they appear. The text reports verified integer root tests and partial tail-recursive dsc_int/newdsc_int suitable for SML. It does not give all refinement equations or the complete integer implementation in the paper. Benchmark baseline is Joosten/Thiemann/Yamada’s verified Sturm isolate, customized to remove square-free factorization and algebraic-number packaging. Thus timings compare core isolation on already suitable inputs, not complete algebraic-number pipelines. Four random polynomials P1–P4 come from [22]; four Mignotte-type polynomials have form x^n−2(2^tau x−1)^2 and tight root clusters. This is a targeted eight-case experiment, not a broad random-distribution benchmark. Runs use Poly/ML 5.9.2 on an Apple M4 CPU with 16 GB memory. Table 1 gives milliseconds, median of five runs or average of 100 runs when runtime is below 10 ms. No spread/confidence intervals, memory/GC measurements, exact M4 model, optimization flags or Isabelle build version are specified here. No comparison with an unverified state-of-the-art root isolator is reported; approaching that performance is future work. Table 1 has two side-by-side groups: P1–P4 compare isolate,dsc_int,newdsc_int,dsc_exec; Mignotte cases compare isolate,dsc_int,newdsc_int,newdsc_exec. The unoptimized column is different in the two groups. The author claim of 10–200 times optimization speedup is rounded: P2 has dsc_exec/dsc_int=6.7/0.5=13.4 and M32,32 has newdsc_exec/newdsc_int=88617/449≈197.4. Do not treat cross-group unoptimized timings as the same algorithm. Direct GenAI report: ChatGPT 5.1 Thinking received corresponding dsc proofs as reference for newdsc proofs. Authors call its generated soundness proof largely correct with a few Sledgehammer-repaired errors, and say the other generated proofs were less valuable and not worth using overall. The SML experimental runner was also written with ChatGPT help. There is no trial count, prompt transcript, proof acceptance rate, cost, human-time measurement or controlled comparison. This is a specific qualitative human-assisted proof-reuse report, not autonomous end-to-end theorem proving. Formal artifact is linked at https://github.com/Aeacu2/Dsc with a Software Heritage snapshot and artifact DOI 10.4230/artifacts.26768. Isabelle kernel/library assumptions, the code-generator/compiler/runtime boundary and correctness of the experimental driver remain part of the trusted or uninspected execution chain for this reading. Reported machine checking is author evidence; no local build or artifact audit was performed. Future work includes square-free/all-root wrappers, dyadic rationals, approximate arithmetic and refinement to LLVM using Isabelle/LLVM. These are not current measured deliverables. There is no distributed-system protocol, verified Rust, Verus or TLA+ result; relevance to proof agents comes from the explicit LLM report and the distinction between abstract correctness, completeness boundaries and executable refinement.
  • how much was read: most of it read
  • source
  • record id: faster-verified-real-root-2026
• Find, Use, and Conserve Tools for Formal Methods (2026)
  • what: # FM-Tools conservation and execution metadata: whole reading (authored by agents unless marked 🧑) Dirk Beyer’s Find, Use, and Conserve Tools for Formal Methods is a 2026 chapter in On the Pursuit of Insight and Elegance, LNCS14765, pp.75–91, DOI10.1007/978-3-032-13711-1_5. Both the publisher and PDF identify 2026; the saved inventory’s 2002/FM metadata is incorrect. All 17 pages were read, including five main sections, §§2.1–2.6/3.1–3.2, Figures1–5, inline command examples, data/funding statements, acknowledgments, references1–77 and the open-access notice. Raw extraction displaces some page footers, DOI links and one directory-description continuation; rendered pages were used to recover their reading order. This is a repository/schema/integration description, not a new program-verification theorem or comparative performance experiment. [Evidence: Q0, frontmatter/abstract/publisher2026identity, PDF pp.1–1; Q1, §1 introduction/contributions, PDF pp.1–3; Q3, §2 repository structure/Figure1/presentations/schema, PDF pp.3–4; Q15, dataavailability/funding/acknowledgments/displacedDOIextraction, PDF pp.11–12; Q16, complete references1–77 with extraction-order caveat, PDF pp.12–17; Q17, CCBY4openaccessnotice, PDF pp.17–17; exact source and character/LF/page anchors in quotes.json.] The problem is conserving enough information to find and run formal-methods tools after their original environment disappears. FM-Tools keeps metadata in GitLab, identifies executable archives at Zenodo by version-specific DOIs, and links papers/project documentation. The reported adoption is SV-COMP and Test-Comp, with Ultimate tools as an early example; §2.6 reports metadata for 91 tools “at the time of writing.” These are author-reported historical counts and adoption, not this reader’s live inventory or a claim of exhaustive coverage of all tools. The contribution also includes CoVeriTeam/CoVeriTeam-Service/FM-Weck integration and a packaged demonstration artifact. [Evidence: Q0, frontmatter/abstract/publisher2026identity, PDF pp.1–1; Q1, §1 introduction/contributions, PDF pp.1–3; Q9, §2.6 FAIR/91tools/historicalclaims/licensing, PDF pp.8–9; Q15, dataavailability/funding/acknowledgments/displacedDOIextraction, PDF pp.11–12; exact source and character/LF/page anchors in quotes.json.] The repository separates presentations, tool data, CI scripts and a scripts submodule. schema.yml specifies tool-description YAML; tool IDs use lowercase letters, digits and hyphens. Presentations have paired PDF/A and SPDX-license files. CODEOWNERS controls changes using entry-maintainer GitLab identities. Figure1’s UAutomizer example records name, C input, project/source URLs, LGPL-3.0-or-later, the ultimateautomizer.py BenchExec tool-info module, format2.0 and an entry maintainer. The adapter assembles the command line and interprets output; metadata syntax by itself does not establish correct interpretation of a solver verdict. [Evidence: Q3, §2 repository structure/Figure1/presentations/schema, PDF pp.3–4; Q4, §2.1 tool fields/BenchExec adapter/entrymaintainers/placementofFigure2, PDF pp.4–5; exact source and character/LF/page anchors in quotes.json.] Section2.2/Figure2 separates tool maintainers from metadata-entry maintainers: the former have ORCID, name, institution, country and homepage. Section2.3/Figure3 binds each named tool version to an archive DOI, developer-recommended options, Ubuntu package requirements, and either base or full OCI container images. The base-image path installs the packages first; the full-image path needs no further package installation. UAutomizer uses openjdk-11-jre-headless with ubuntu:22.04 as a base, or the competition user:2024 image. These are declared execution environments, not a new proof that every listed tool will run on every future host. [Evidence: Q5, §2.2 tool maintainers, PDF pp.5–5; Q6, §2.3 versionDOI/options/basefullcontainers/completeFigure3, PDF pp.5–6; exact source and character/LF/page anchors in quotes.json.] Figure3 makes the archive/configuration distinction concrete. The svcomp24, svcomp24-correctness and svcomp24-violation configurations share archive DOI10.5281/zenodo.10203545 but use different witness options. The post-deadline YAML wrapper-fix configuration points instead to DOI10.5281/zenodo.10223333. A tool name or even an executable archive alone therefore does not identify the requested verification task: command-line options and wrapper behavior matter. The figure abbreviates the registry path using literal ellipsis; its caption supplies the complete path, so the shortened display is not an executable image reference. This reading did not download or run those archives/images. [Evidence: Q6, §2.3 versionDOI/options/basefullcontainers/completeFigure3, PDF pp.5–6; exact source and character/LF/page anchors in quotes.json.] Section2.4/Figure4 maps SV-COMP2024 Verification, Correctness-Witness1.0/2.0 and Violation-Witness1.0 tracks to their explicit tool versions and jury representative. Correctness2.0 uses the post-deadline wrapper-fix configuration; the other tracks select the corresponding svcomp24 variants. The author says the DOI, options and environment make it possible to reproduce competition results. Reader qualification: these metadata describe how to launch a tool; reproducing a particular experiment also requires its input program, property, data model, resource limits, measurement setup and interpretation of outputs. The paper later explicitly acknowledges incomplete reproducibility rather than providing a universal guarantee. [Evidence: Q7, §2.4 SVCOMP2024trackbindings/completeFigure4, PDF pp.6–7; Q12, §3.2 complete local walkthrough/twomodes/limits, PDF pp.9–10; exact source and character/LF/page anchors in quotes.json.] Section2.5/Figure5 records technique keywords and literature DOI/title/year. The UAutomizer example includes CEGAR, predicate abstraction, bit-precise/lazy abstraction, interpolation, automata-based analysis, concurrency, ranking functions, selection and portfolios. The redundant title/year fields are for human reading, with DOI consistency intended to be checked by CI. Section2.6 explains FAIR as findable, accessible, interoperable and reusable: public search/generated pages/Software Heritage; HTTP without read authentication and Zenodo snapshots; YAML schema/CI plus DOI/ORCID identifiers; and CC-BY4.0 metadata/community competition standards. The metadata license does not override each tool’s separate license, which remains the tool developers’ choice. FAIR compliance is the author’s structured assessment, not an independently measured certification here. [Evidence: Q8, §2.5 techniques/literature/completeFigure5, PDF pp.7–8; Q9, §2.6 FAIR/91tools/historicalclaims/licensing, PDF pp.8–9; exact source and character/LF/page anchors in quotes.json.] Section3.1 describes remote execution through CoVeriTeam-Service: input files go to a server, which downloads/installs/runs the selected tool and returns results. Its concrete walkthrough chooses UAutomizer svcomp24, no-overflow and AdditionIntMax.i. The author reports false(no-overflow), meaning a signed-integer overflow, with cvt-output containing resource measurements, stdout and possibly a verification witness. No CPU/wall-time/memory numbers, repeated-run design or output-validation study is supplied. This is a reported usage example, not a reader reproduction or a demonstrated latency/speedup result. Claims of safe/secure isolation describe the intended infrastructure; this chapter has no security proof or adversarial isolation evaluation. [Evidence: Q10, §3 integration introduction, PDF pp.9–9; Q11, §3.1 complete remote walkthrough/verdict/resourceoutput, PDF pp.9–9; exact source and character/LF/page anchors in quotes.json.] Section3.2’s local FM-Weck walkthrough assumes GNU/Linux and working Podman, installs FM-Weck via pip, then selects uautomizer:svcomp24 with no-overflow.prp, LP64 and AdditionIntMax.i. It reports the same verdict as the remote example and allows custom options through -m. Its two modes either install requirements into a base image or use a ready full image, while obtaining the tool from the DOI archive. The author hopes these preserved environments remain executable after many years but states, “Full reproducibility is not yet achieved up to now, partially because tools are not easy to execute, which is the concern that FM-Weck tries to address.” Reader qualification: named images/package requirements record dependencies; continued availability, compatible host/container runtime, fixed versions and experimental inputs still affect future repeatability. The chapter does not evaluate those conditions across future systems. [Evidence: Q12, §3.2 complete local walkthrough/twomodes/limits, PDF pp.9–10; exact source and character/LF/page anchors in quotes.json.] Section4 describes a generated site at fm-tools.sosy-lab.org for tools, contacts, techniques, papers, archives and competition links. The CEGAR walkthrough gives a definition, three literature references and a displayed list of tools, including UAutomizer, CPAchecker, Theta, JayHorn and portfolio tools. That list demonstrates navigation by technique; it does not rank tools, establish identical supported semantics or measure effectiveness on a common workload. The chapter’s prior-work comparison attributes 67 entries to the last available 2011 Yahoda snapshot and 384 to ProVerB, emphasizes maintenance problems, and proposes tying upkeep to recurring competitions. Those different counts are not a controlled coverage comparison; the novelty claim that prior approaches do not ensure future execution is the author’s assessment. [Evidence: Q13, §4 complete generatedwebsite/CEGARwalkthrough, PDF pp.10–11; Q2, §1 RelatedWork/metadata maintenance/novelty claim, PDF pp.3–3; exact source and character/LF/page anchors in quotes.json.] The conclusion separates findability, reuse, reproducibility and conservation. The data-availability statement points to FM-Tools2.0 snapshots, Software Heritage and Internet Archive mirrors, and artifact DOI10.5281/zenodo.11193820 containing CoVeriTeam1.2.3 plus FM-Tools2.0 as a submodule. The archived material is a reproducibility resource; it was not executed or independently tested in this reading. The evidence consists of concrete YAML records, two command walkthroughs, repository/adoption reports and an artifact pointer. There is no benchmark table, latency/throughput experiment, preservation-failure rate, controlled user study or theorem proving tool/verdict correctness. Referenced competitions supply context; this chapter does not independently rerun their results. [Evidence: Q14, §5 conclusion/findabilityreuseconservation, PDF pp.11–11; Q15, dataavailability/funding/acknowledgments/displacedDOIextraction, PDF pp.11–12; Q16, complete references1–77 with extraction-order caveat, PDF pp.12–17; Q11, §3.1 complete remote walkthrough/verdict/resourceoutput, PDF pp.9–9; Q12, §3.2 complete local walkthrough/twomodes/limits, PDF pp.9–10; exact source and character/LF/page anchors in quotes.json.] For a local knowledge database and LLM proof-agent evaluation, the useful addition is an explicit separation between tool identity, versioned archive, execution options, environment, specification and result interpretation. Reader proposals are to preserve those fields alongside Verus/Rust/TLA+ evaluations, keep the selected program/property/data model with each run, and distinguish a reported verdict, a witness and an independently validated proof. A conserved executable makes such work easier to repeat but does not establish that an agent wrote the right specification or that a distributed-system model matches its implementation. No Verus, Rust, TLA+, distributed-protocol or LLM-agent experiment is reported here. No author code or scientific-result artifact was executed/imported/loaded, and no compiler, checker, solver, prover or model checker was run. [Evidence: Q4, §2.1 tool fields/BenchExec adapter/entrymaintainers/placementofFigure2, PDF pp.4–5; Q6, §2.3 versionDOI/options/basefullcontainers/completeFigure3, PDF pp.5–6; Q7, §2.4 SVCOMP2024trackbindings/completeFigure4, PDF pp.6–7; Q11, §3.1 complete remote walkthrough/verdict/resourceoutput, PDF pp.9–9; Q12, §3.2 complete local walkthrough/twomodes/limits, PDF pp.9–10; Q14, §5 conclusion/findabilityreuseconservation, PDF pp.11–11; exact source and character/LF/page anchors in quotes.json.]
  • limits: declaredarchive/options/OCI/packages/adapters/hostruntime/inputs/property/datamodel/resources;authordesignandadoptionreports/notprooforindependentreproduction;futureavailabilityandpreservationnotguaranteed
  • how much was read: most of it read
  • source
  • record id: find-use-and-conserve-2026
• Formalization of a Realistic Verification-Condition Generator for an Intermediate Verification Language (2026)
  • what: Reports Dafny definitions and soundness proofs for a B3 intermediate verification language, an executable verification-condition generator (VCG), and a coinductive reference semantics supporting nondeterminism, unbounded loops, scopes, abrupt exits and recursive calls. Proves valid generated conditions imply procedure correctness for a closed set of procedures. A structural invariant/specification semantics makes most proofs amenable to SMT automation; a separate coinductive refinement connects it to reference execution. The authors report Cursor auto-completion only, without an LLM evaluation. Postcondition stacks model escape depth while continuation stacks guide VCG control flow and variable removal. Fresh variable incarnations distinguish assignment histories from current program states. The general statement theorem connects an arbitrary symbolic context, incarnation map and continuation stack to a reconstructed scoped statement; procedure soundness is derived from an assume-pre/body/check-post wrapper. Mutual coinduction handles both recursive procedure calls and loop unrolling. The paper explicitly separates the verified formal generator from incremental SMT interaction and evolved public B3, and excludes user axiom definitions.
  • limits: Only source-IVL-to-VC generation is proved sound. Source-to-B3 translation, B3-expression-to-SMT translation and actual solver validity remain outside the theorem. The conclusion is conditional on mathematical validity of every generated VC, not on any unchecked SMT response. Dafny, its own verification pipeline, logic and underlying SMT automation are trusted for the author-reported proofs; no independently checked small-kernel certificate or self-verifier proof is supplied here. The paper simplifies the grammar: Boolean/integer/uninterpreted types; mathematical operations, quantified expressions and function calls; check/assume, assignment, nondeterministic choice, conditionals, unbounded loop, vars scopes and escape depths. It assumes unique variable declarations with no shadowing. Only distinct-variable inout parameters are shown; the accompanying formal implementation handles all parameter kinds, as does B3. Interpreted-function semantics and expression refinements are described but omitted from printed formal definitions. Correctness is partial: nontermination is permitted, and the work does not prove termination of B3 loops or recursive source procedures. VCG itself is reported terminating by measures on statements and continuations. Assertions must hold on relevant execution prefixes; reference omnisemantics is not merely an arbitrary overapproximation that can hide a failing check, since Check demands both the expression and post-state membership. Omnisemantics relates a statement and initial state to a sequence of overapproximating post-state sets. Its head handles normal completion; index i handles escape i. A scope duplicates the current head, adds arbitrarily initialized fresh locals, and lifts every post-set by allowing those locals and projecting them away. An escape does not execute the rest of its current statement sequence: it targets the indexed enclosing-scope postcondition. Escape zero is a no-op. A loop introduces no control-flow scope. To break out, wrap it in vars and use escape 1. Structural loop semantics existentially chooses any suitable invariant state set containing the initial state and preserved by normal body completion; body escapes still answer to the unchanged tail of enclosing postconditions. The syntactic invariant annotation is ignored by the semantics and is separately validated by VCG. Reference loop semantics instead unrolls body;loop using a greatest fixed point. Structural call semantics checks the instantiated precondition and universally considers post-states satisfying the instantiated postcondition, with the same domain and all nonargument variables unchanged. It omits checking the callee body. Reference call semantics adds RefMeetsSpec for the callee. A procedure without a body is treated as meeting its specification; its specification remains an assumption, not a proved implementation. Aliased inout actuals are excluded by the displayed distinct-variable requirement. Theorem 1 requires a closed set of procedures: every called procedure belongs to that set. Valid VCs for every procedure imply all reference MeetsSpec predicates. Recursive specifications may be assumed modularly only because all available bodies are checked and the mutually recursive reference predicates are coinductive. The article does not present a global liveness theorem or a termination argument for arbitrary recursion. Proof decomposition: Lemma 2 derives structural MeetsSpec from one procedure’s valid VCs; Lemma 3 derives reference MeetsSpec for a closed, structurally correct procedure set. Theorem 4 is the generalized statement-level VCG invariant used for Lemma 2. Several prose cross-references call Lemmas 2/3 Theorems 2/3; the numbered statement labels remain Lemma 2 and Lemma 3. VCG state contains incarnation map I, symbolic path context C and stack B of (introduced variables, continuation statements). Check generates C implies substituted E and leaves C unchanged; assume conjoins substituted E. Assignment creates a globally fresh incarnation xprime, constrains it to E evaluated under the old map, then updates I. This freshness and substitution bookkeeping is part of soundness, not a source-level assignment simplification. Conditional generation follows each branch with its continuation under opposite guard assumptions and unions the VC sets. Scope entry allocates local incarnations and pushes its following statement with its local-variable set. Normal and abrupt scope exit remove local entries from I, while accumulated formulas may still mention their incarnation values. The paper describes this symbolic-execution choice as more stable for automation but potentially producing more VCs; it gives no comparative measurement. Theorem 4 assumes all free variables in S and B are mapped by I; each jump depth fits its corresponding continuation suffix; the stated VCG judgment holds; every VC is valid; and incarnation state ist satisfies C. It concludes structural correctness of mkScope(S,B) from AdjustState(ist,I) against the universal post-set. AdjustState projects current program values from I-selected incarnations; conflating it with the full symbolic-history state would misstate the theorem. Printed equation (2) gives mkScope(S,B)=mkScope(Bprime,(vars nu in S);Sprime) in the nonempty case, reversing the declared statement/continuation argument order. Reader diagnosis: the type-consistent intended recurrence is mkScope((vars nu in S);Sprime,Bprime). This is a presentation issue; no claim is made that the Dafny implementation contains the same error. The detailed inductive proof of Theorem 4 is delegated to the artifact. Coinductive SemRefine and MeetsSpecRefine are mutually recursive greatest lemmas. Structural loop-unrolling first proves Sem(body;loop,…); the coinductive hypothesis gives RefSem of that unrolling. Calls invoke the procedure refinement, which in turn invokes statement refinement for all precondition states. Recursive interpreted expressions require a similar omitted refinement. About 100 manually supplied proof lines connect the semantics; this is not the size of the full soundness proof. The formal AST/state, semantics, generator and proofs total about 4.7 kLoC: about 2.0 kLoC AST/state, 660 LoC omnisemantics, and about 2.0 kLoC VCG/proofs. Roughly 1.5 kLoC are actual code and 3 kLoC annotations/proofs. Authors report four months by one person previously inexperienced with Dafny proofs. These are rounded development-effort reports without timing trials, benchmark corpus, proof acceptance rates or independent reproduction. Manual proof work concentrated in incarnation/substitution chains, sequence folds for continuation unwinding, and quantified/uninterpreted expression semantics. The paper calls these higher-order semantics difficult for SMT. It does not measure how much automation replaced manual work or compare alternative provers. The GenAI declaration says only Cursor auto-completion was used; it gives no model, prompts, accepted-completion counts or agent autonomy evidence. The formalized VCG stays close to the public B3 generator but is not a verified release of every public-tool path. Public B3 sends branch contexts incrementally to SMT and has evolved; integrating proofs into a release remains future work. User-defined axiom definitions are excluded; public lazy delivery of axioms and interpreted-function definitions is also future work. Thus the abstract phrase realistic features does not mean all current B3 features are covered. Artifact is linked at https://github.com/dafny-lang/b3, Software Heritage swh:1:dir:1795668a148637332f93759bb96a4cd4283d6e32, DOI 10.4230/artifacts.27039. No artifact files, source-build logs, generated binary or model of the compiler/runtime were inspected. Related claims about HOL4/Dafny, core Why3, Viper, Boogie certification and Featherweight VeriFast are author comparisons, not independent re-evaluations in this reading.
  • how much was read: most of it read
  • source
  • record id: formalization-of-a-realistic-2026
• Formally Verified Linear-Time Invertible Lexing (2026)
  • what: ZipLex is a Scala/Stainless lexer that verifies maximal munch with rule-order tie breaking and lossless lexing/printing under explicit token transformation and separability conditions. It refines simple list/regex specifications to zipper derivatives, tail recursion, balanced sequences and mutable memoization. Experiments compare adversarial and JSON grammars and hash-table variants. Explains why arbitrary token concatenation is not invertible, how an all-rule prefix test yields a sufficient adjacent-token invariant, why a natural zipper induction fails, how an explicit stack preserves tail recursion while filling a cache, and which proof/resource and runtime claims remain conditional. Retains the untokenized suffix, client injectivity obligations, collision qualification, sparse-cache parameters, proof-count discrepancies and combined runtime/memoization ablation.
  • limits: §2: lex returns tokens and a possibly untokenized suffix. The informal print(lex(s))=s notation must retain all consumed text and any suffix appropriately; printing just successfully recognized tokens cannot reconstruct an arbitrary unrecognized suffix. Maximal munch picks the longest prefix and earliest rule on ties. Non-nullable rule expressions ensure each emitted token consumes input. §§2–3.1: alphabet elements have arbitrary type. Each rule must supply transform/charsOf and a client proof of charsOf(transform(s))=s on its required domain. Surjectivity is unnecessary for values created through transform. A noninjective semantic conversion can retain the original string alongside the value. This is a precondition on clients, not automatic correctness of arbitrary user token constructors. §§3.2–3.4: lex(print(ts))=ts does not hold for arbitrary token lists. PrintableTokens carries a sufficient R-Path separability invariant over suitable valid tokens; it is not a maximally permissive condition. Relation sep(t1,t2) rejects a boundary when any rule has a word with prefix text(t1) followed by the first character of text(t2). All rules matter, not only the producing rules. Nonempty tokens justify first-character access. §3.3: R-Path means the relation holds at each adjacent pair. Slicing preserves it. Concatenating nonempty paths needs one boundary relation check; empty sequences need their ordinary boundary-free cases. The displayed indexing equivalence omits that qualification. A constant number of relation checks is not constant character work: prefixMatch traverses the first token plus one character and considers rule languages, with rule/token/cache costs. §3.5: disjoint-character separator tokens provide a sufficient special case. Programming-language whitespace also occurs within strings/comments, so that approach is restrictive. The all-rule R-Path method is more general; it does not prove every possible token rearrangement printable. §4: regular expressions use explicitly enumerated character sets, concatenation, union and star. No richer regex feature such as arbitrary complement or lookaround is established. A zipper is a set of contexts, each a list interpreted as concatenation. Correctness relates matchZ to matchR(unfocus(z),s), and matchR to ghost matchRSpec. Reachable derivative finiteness is discussed through cited prior work, not independently audited here. §§5–7: verified equivalence steps connect list recursion to tail recursion and BalanceConc (balanced trees, immutable array leaves, default N=512, zero-copy leaf slices). No universal constant-time concatenation or machine-level JVM resource guarantee follows from functional equivalence. The proof relies on Stainless, SMT reasoning, compilation/runtime and prior verified LongMap. §6.1: generic HashMap[K,V] decorates LongMap[List[(K,V)]], indexed by hashes; collision buckets are linked lists. Functional correctness tolerates collisions, while performance explicitly requires reasonable collisions. Memoization invariant is that each stored (k,v) satisfies v=f(k). Mutation avoids threading an immutable cache through all functions/proofs. §6.2: longest-prefix memoization works on full input and indices. An explicit stack records parameters; after the tail-recursive result returns, cached values for recorded calls are filled. The paper cites Reps for O(n) longest-match time. For fixed rules/finite derivative state space and appropriate cache/hash assumptions this supports linear input-length reasoning; no separate machine-checked resource theorem or adversarial-hash worst-case constant lookup proof is shown. §6.2: sparse caching stores one of every k calls for inputs longer than M, default k=10,M=10^6. Pure opaque parameter functions may depend on input/rules, and functional correctness is agnostic to their settings. Arbitrary such functions do not automatically preserve a uniform linear-time bound. Turning memoization off in the JSON experiment relinquishes the general anti-backtracking guarantee. §7: authors report 21961 VCs, including 8802 cache hits, approximately 130 minutes, 44 VCs above 10 seconds and slowest 58 seconds. Final 100-line SMT-LIB query for the slowest VC rechecks in under a second with cvc5; that does not mean its original unfolding/approximation run took under a second. Aside from simple VSCode completions, authors explicitly report no LLM reliance. §7/Table1: 1915 executable lines and 13200 specification/proof lines sum to 15115; computed ratio is about 6.89, whereas prose says roughly ten times. §6.1 says approximately 1600 additional lines for hash-table work, while Table1 mutable HashMap excluding LongMap totals 2790. Scopes are not reconciled by the paper; retain both without inventing an explanation. §8: sequential benchmark algorithms on Linux, two 24-core AMD EPYC9254 sockets,96 virtual processors,128GB,2.9GHz base/up to4.15GHz. JMH/OpenJDK21.0.2; 99.9% confidence intervals. Figures are selected grammar/JSON workloads, not arbitrary parser or communication-protocol verification. The paper supplies no independent reproduction here. §8: full memoized ZipLex is about 3.5 times slower than Coqlex on JSON in detailed prose, rounded to 3 times in conclusion, and approximately two orders faster than Verbatim++. Verbatim++ incurs roughly two seconds DFA preprocessing. No-memo GraalVM21.0.11 variant is 1.37 times slower than Coqlex; this changes both runtime and memoization, so the improvement cannot be attributed solely to GraalVM. ASCII specialization/boxing is a hypothesis, not established causal attribution. §8: map benchmark inserts N random pairs, removes half and reinserts/updates all N. Generic verified mutable HashMap is slower than standard mutable HashMap, faster than standard immutable HashMap; LongMap is also plotted. This workload does not establish superiority for arbitrary key distributions or adversarial collisions. Data Availability: authors report artifact evaluation for Zenodo version4 DOI10.5281/zenodo.20084365, 1.35GB SMT-LIB, Bolts lexers/regex and nightly CI. These are author reports; no current CI status, artifact proof replay or extended arXiv2510.18479 verification was performed. Formal verification of distributed protocols, Verus/Rust, TLA+ and LLM proof generation are not evaluated.
  • how much was read: most of it read
  • source
  • record id: formally-verified-linear-time-2026
• Fractional Separation Logic in Isabelle LLVM (2026)
  • what: A shallow Isabelle/HOL fractional separation logic with unbounded positive rational scaling and nominal resource labels. Labels preserve a concrete resource witness so arbitrary labeled assertions can be split and recombined. A kernel-checked VCG automates fractions/labels/frame inference,integrates with fork-join Isabelle LLVM,and verifies shared-input/disjoint-output parallel matrix-vector multiplication. Defines fractional separation algebra type classes,scaling of assertions by inverse resource scaling,and a uniform same-label recombination equality. Extends concrete-state abstraction and access-report frame compatibility to distinguish shared reads from exclusive writes/frees. Gives bottom-up refinement rules and normalization/matching automation,then an explicit recursive proof with shrinking input fractions,fixed labels,decreasing index,and ownership extraction/reinsertion for output elements.
  • limits: Fractions in the algebra are arbitrary positive rationals and compatible equal-valued resources can sum above1. Physical ownership is bounded by embedding assertions and frame into sα of a concrete state,which assigns fraction1 at each allocated-block address. Introductory sum≤1 intuition concerns realizable states,not a global restriction on the algebra. Uniform recombination requires the same label/resource witness;arbitrary unlabeled assertions remain noncombinable in general. Labels may be introduced existentially and forgotten,but two independently chosen witnesses cannot simply be assumed equal. Extended labels include undef,and annotations explicitly require l≠undef. Hoare triples quantify over frames and require successful termination in Isabelle LLVM semantics,with frame-compatible access reports. Reads cannot intersect frame-full addresses,writes/frees cannot intersect even partially framed addresses. Race freedom follows because modeled data races are semantic errors;this is relative to the trusted semantics. Trusted boundary includes Isabelle inference kernel plus Isabelle LLVM semantics and code generator. Frame inference,VCG,and derived separation rules produce kernel-checked proofs. Paper does not provide an end-to-end proved target-compiler/OS/hardware theorem or re-establish the LLVM backend soundness here. Concurrency supported here is fork-join parallel function calls with shared immutable resources and disjoint writes. Additional concurrency patterns,full Sepref stepwise parallel refinement,and higher-level map-reduce rules are future work. No verified Rust borrowing semantics or distributed/network protocol is supplied. User supplies inductive pre/postconditions,termination relation,and separate pure lemmas registered with simplifier. Explicit sep_split/sep_join annotations guide sharing;the paper’s fully automatic final proof is conditional on that setup,not automatic invariant/specification discovery. Matrix dimensions and storage use natural-number abstractions of signed fixed-width indexes,with m*n<2^63 and width representation in mtxA. Result array must own every index initially. Executable version uses64bit entries,but the paper does not spell out an unbounded-integer no-overflow theorem for entry multiplication/addition;do not conflate index bounds with arithmetic bounds. Constructors for the data structures are proved correct to address vacuous preconditions. This supports their realizability under constructor preconditions;it does not establish satisfiability of every arbitrary user assertion or external intended specification. Case-study generality remains limited to a few examples.
  • how much was read: most of it read
  • source
  • record id: fractional-separation-logic-in-2026
• Freer de Finetti human-steered Lean agents 2026 (2026)
  • title: Three Roads to de Finetti’s Theorem in Lean 4
  • what: Freer reports a Lean 4 formalization of the de Finetti–Ryll-Nardzewski equivalence for infinite random sequences: contractability iff exchangeability and conditional identical independent distribution. Three routes converge on one finite conditional-factorization interface; only reverse martingales cover general standard Borel targets, while the L2 and Koopman routes assume real square-integrable variables. Human-selected definitions, architecture and accepted edits guided Claude proof generation and GPT review/repair. The reported 42,745-line research artifact builds on a pinned Lean/mathlib toolchain, but needs substantial library refactoring. A reusable skill records proof patterns, concrete instance-management failures, LSP feedback and library search. Records exact theorem hypotheses; shared-interface inputs and kernel outputs; route-specific generality and indicator/embedding/L1/L2 transport obligations; human versus model responsibilities and model versions; original 2.5-page informal source and early common-ending design; reported build and axiom command; full Table 1 data and reader arithmetic discrepancy; code duplication/refactoring categories; skill size and repeated instance-pollution timeouts; absence of controlled proof-agent evaluation.
  • limits: Figure 1 assumes StandardBorelSpace Ω, measurable/standard-Borel nonempty target α, probability measure µ and each X i measurable, with X indexed by natural numbers. It concludes Contractable µ X ↔ Exchangeable µ X ∧ ConditionallyIID µ X. The theorem concerns infinite sequences. The Ω standard-Borel assumption is explicitly attributed to Lean conditional-expectation infrastructure; this reading does not claim it is a minimal mathematical necessity (§2, Figure 1). Exchangeability is invariance under arbitrary index permutations; equivalence with finite-support finite-marginal invariance is also reported formalized. Contractability compares equally long increasing subsequences. Conditional i.i.d. is relative to a directing random probability kernel, not unconditional independence. The paper also reports the converse conditional-i.i.d.-to-contractable direction. Exact formal definitions of all predicates and complete proof bodies are not printed here (§2). The common ending takes a sub-sigma algebra G and conditional factorization for each finite initial block, constructs a G-measurable probability kernel and packages ConditionallyIID. It centralizes measurability/product-measure uniqueness. Three routes sharing this interface reportedly exposed definition/support-lemma drift; reader inference: this checks agreement between routes, but is not an independent oracle for intended semantics, and common definitions/ending can share an error (§3.1, §5). Route A alone handles general standard Borel target spaces. Contractability supplies reverse-filtration symmetries; reverse martingale convergence supplies factorization. Real-valued conditional expectations must be converted to event indicators and transported through measurable embeddings back to arbitrary target-valued finite blocks. Supporting work includes Levy downward convergence, time reversal of filtrations and demonstrating the reversed process is a forward martingale (§1, §3.2). Route B has stronger real-valued square-integrability premises. Correlation bounds from contractability and Cesaro/L2 convergence give factorization. Its 12,476 local lines do not mean mathlib lacked CDF/Stieltjes theory. Existing StieltjesFunction, MeasurableStieltjes, conditional-CDF and CDFToKernel APIs overlap. Local code connects particular L1 empirical indicator limits to rational-cut monotonicity, normalization, right continuity, conditioning measurability and finite-block factorization. Authors recommend refactoring against existing APIs before considering upstream contributions (§3.3). Route C is also real square-integrable. On path space a shift induces the Koopman L2 operator; mean ergodic convergence identifies the Cesaro limit as projection onto the invariant subspace. Formal work connects that subspace to the invariant sigma algebra, converts L2 convergence into L1 conditional-expectation/set-integral identities for finite indicator products, and packages the common interface. These three proofs are not equally general (§3.4, Figure 2). Human directed architecture, mathematical interfaces, main definitions/theorem statements and acceptance of edits. Primary proof generators were Sonnet 4/4.5 and Opus 4.5 in Claude Code, with Lean CLI/LSP MCP feedback and the skill; GPT Codex reviewed/repaired, GPT Pro occasionally helped mathematics. Opus 4.5/4.6 collated about 4,000 commit messages for writing history; GPT Codex 5.3, GPT 5.5 and Claude 4.7 reviewed paper text. Paper-writing models must not be conflated with proof-generation models. Skill was also written under human direction using Claude (§GenAI declaration). Project began from approximately 2.5 pages of Kallenberg proofs, without a detailed blueprint. LLMs suggested auxiliary lemmas/interfaces/proof structure and filled proof holes, followed by review/refactoring/golfing. The common ending was formalized early. Authors qualitatively call route efforts comparable, but report no per-route human/model time breakdown. Three months is calendar duration, not autonomous proof runtime or quantified human labor (§1, abstract). Author reports Lean 4.27.0-rc1, pinned mathlib, lake build, and #print axioms deFinetti returning only propext, Quot.sound and Classical.choice. That checked name differs from the exact equivalence name in Figure 1; this paper alone does not establish an independently audited dependency list for every route variant. Reader did not execute a build or axiom command. Kernel acceptance with standard axioms does not itself certify intended theorem selection, minimal assumptions or reusable code quality (§1 artifact). Table 1 reports 42,745 lines, 112 files and 783 declarations. Reader independently added printed component rows: 43,512 lines, 112 files, 783 declarations. Line discrepancy is 767. All values visually verified; printed total preserved rather than silently corrected. No checkout establishes which line count reflects the archived artifact, whether categories overlap or why the discrepancy occurs. Rows group project role, not mathematical novelty (Table 1). Library is explicitly a checked research formalization, not mathlib-ready code. Four categories: existing-mathlib replacement candidates, wrappers/adapters, reusable bridges needing refactoring, exploratory route-specific code. First triage replaces/deletes overlap, keeps needed adapters and extracts reusable lemmas. Naming, imports and slow generated proofs need checks. Reported code volume is not evidence of necessary proof complexity or agent efficiency (§3 assessment). Skill contains 36 domain references, 6 slash-command recipes, 4 role prompts plus hooks/scripts. Concrete repeated failure is measure-theory instance pollution causing timeouts; guidance covers sub-sigma-algebra instances, conditional expectations, domain patterns, error-to-fix mapping, LSP goals/diagnostics and mathlib search to avoid reimplementation. Claude-compatible packaging was also exercised through Codex. Reported other-project reuse, including Numina setup installing the skill, is qualitative and not independently checked here (§4, §1 related work). Formalization reference identifies v1.2; software archive 294caf4a04e4d205a7d1de2dd52dc1cbbc0691e9 and skill archive a332440301a2ed286a4051f57ece1e3eed09cc9e are author-provided reproducibility pointers. No artifact commands were run. Reading the described skill does not install or adopt its instructions (§front matter, Reference 7). No controlled baseline, success/pass rate, failed-attempt dataset, token/cost accounting, human effort measurement, skill ablation or proof-throughput benchmark is supplied. Main evidence is a reported completed checked artifact plus qualitative development history. No distributed protocol, safety/liveness proof, Rust/Verus or TLA+ implementation appears. Direct relevance is evaluating human-steered LLM proof construction, semantic supervision, library reuse and maintenance; generalization beyond this mathematical case remains unmeasured.
  • how much was read: most of it read
  • source
  • record id: freer-de-finetti-human-steered-lean-agents-2026-2026
• Generalised bit-vector quantum circuit verification (2026)
  • title: Generalised Bit-Vector Abstractions for Formal Verification of Quantum Error-Detection and Entanglement Circuits over {H, X, C-NOT}: CSS Constructions, Soundness, and Mutation-Based Validation
  • what: Extends a two-bit-vector abstraction for H, X, and C-NOT quantum circuits to parametrized repetition/concatenated codes, arbitrary CSS syndrome extraction, a formally characterized sound fragment, mutation validation, and large GHZ circuits. The abstraction separates superposition tags from basis-state XOR behavior and reduces verification to bit-vector SMT constraints. The paper defines fragment F conditions under which the abstraction is sound, proves an explicit invariant theorem, gives necessity counterexamples, and differentially tests against exact state-vector simulation. Properties cover arbitrary error patterns, detection limits, and classical-decoder recovery; tested codes include Steane, [[15,7,3]], [[15,1,3]], and rotated surface codes. Direct Z3 encoding uses bit-vectors, XOR code-word constraints, and cardinality-bounded error variables. Evaluation finds all 12,000 in-fragment random circuits agree with state-vector simulation, while unrestricted circuits agree only about 55%; all 622 non-equivalent single mutants are detected. GHZ verification reaches 262,144 qubits, but random dense parity networks become very hard as depth/support grows.
  • number: All 12,000 in-fragment differential tests agreed with exact simulation; unrestricted tests about 55%
  • number: 682 mutants generated, 60 equivalent, 622 non-equivalent; all 622 detected
  • number: Largest GHZ star 262,144 qubits: 9.01 s solve, 46.1 s build, 1,397 MiB peak RSS
  • number: At 32 qubits, depth 4 solve 0.033 s versus depth 7 27.5 s; depth 8 had timeouts
  • limits: Soundness is only for fragment F: no non-phase gate between Hadamards and no Hadamard after a qubit has interacted; S/Z gates, genuine Y stabilizers, entangled-qubit Hadamards, and general stabilizer circuits are outside scope. Logical circuit faults are modeled, not hardware noise, decoherence, measurement errors, or fault propagation/hook errors. Code-word preconditions and error-location assumptions are explicit. Mutation coverage is single-modification classes only; the 100% rate is not complete fault coverage. GHZ scale is family/solver-specific; Python term construction and memory dominate at large sizes, and comparison with prior work is observational.
  • how much was read: most of it read
  • record id: generalised-bit-vector-quantum-circuit-verification-2026
• Gholami-Sarjoughian Constraint-DEVS (2026)
  • title: Constraint-Driven Modeling Enabling Dual Model Checking and Simulation for Discrete Event Systems
  • what: Introduces Constraint-DEVS, a bounded variant of Parallel DEVS, and extends DEVS-Suite so the same component models support simulation and exhaustive reachability/model checking. A state-exploration protocol wraps one-cycle simulation, with bounded state variables, bounded ports, discrete-time events, selective state exploration, and transducer-based trace/property analysis. NoC and circular-buffer models demonstrate the framework. The paper gives concrete finiteness conditions and an algorithm: state and port values are specified by regular expressions, input events include an explicit null value, and a Q/V/U exploration loop injects every possible input into each reachable state, using simulation for one cycle. It defines explorable versus unexplorable variables to reduce state space without changing simulation behavior, and reuses an experimental-frame generator/transducer for state, path, and QoS-like checks. The circular buffer verification catches a simultaneous-event bug; NoC experiments compare round-robin and adaptive task distribution and quantify the severe state-explosion tradeoff. An appendix details VerifiableAtomic, StateVar/PortState, VerificationEngine, and integration with existing simulator classes.
  • number: circular buffers: 3,200, 12,600, 201,600 states
  • number: circular-buffer times: 4.55, 14.90, 273.78 s
  • number: adaptive distributor: 15x state-space increase; 15.78 to 245.20 s
  • number: NoC 4x3: 25,255,495 states and 39,211.6 s
  • limits: Exhaustive checking requires finite bounded state variables, bounded port values, discrete external-event times, finite time-advance values, and no converging time-advance sequences. Selective state exploration can omit information needed by a property, and complex Java data/trace processing raises cost. Results are reachability checks, not automatic proof of an unbounded DEVS model. NoC models simplify packet/data behavior and rely on abstraction; the framework does not remove state explosion: a 4x4 network was not completed, and authors propose partial verification and multiresolution modeling. Property expressiveness through an experimental frame may itself require validation.
  • how much was read: most of it read
  • record id: gholami-sarjoughian-constraint-devs-2026
• Guidelines for Producing Concise LNT Models, Illustrated with Formal Models of the Algorand Consensus Protocol (2026)
  • what: # Whole-paper read: Guidelines for Producing Concise LNT Models, Illustrated with Formal Models of the Algorand Consensus Protocol (authored by agents unless marked 🧑) Hubert Garavel. MARS2026, EPTCS443,pp43–83,doi10.4204/EPTCS.443.5;arXiv2604.05006,41pages. The paper refactors a finite LNT model of Algorand’s BBA* phase and reports equivalence/model checks. Its strongest directly measured result is model compaction with strong bisimilarity checked for two four-node configurations. It supplies a detailed transformation sequence, printed model code and property scripts. It does not establish correctness of the deployed Algorand implementation or arbitrary-size Byzantine consensus. [Q0,Q1,Q2,Q10,Q11] ## What changes, and what is preserved The original Urbino model has967LNT lines. Application-specific changes produce U0 with769lines. These changes include new observations, merged/split events, a different attacker and a fair-coin correction; the paper explicitly says many “do not preserve bisimilarity properties.” Thus equivalence of U0–U4 does not imply equivalence with the original967-line model. [Q2,Q11,Q14] Four generic transformations then produce U1–U4: extract shared modules, replace duplicated control branches with data parameters, merge common sequences, and replace mutually recursive tail calls with assignments and explicit loops. Strong bisimilarity means corresponding states can match every labelled transition in both directions. Authors report BCG_CMP checks for A4,0(four honest nodes) and A2,2(two honest/two malicious), with incremental checks after individual changes. They give structural/algebraic explanations, not a mechanized theorem covering every use of every transformation. The common-suffix choice law is explicitly qualified as failing for common prefixes. [Q3,Q4,Q5,Q6,Q7] The §2.2 table gives total/nonblank-noncomment lines: U0=769/705,U1=607/552,U2=320/282,U3=288/250,U4=250/212. U0→U4 therefore removes67.49%of total lines and69.93%of substantive lines, ratios3.076and3.325 respectively; these are reader arithmetic. The original967→250comparison also includes semantic changes. Readability and reduced maintenance effort are the author’s qualitative judgments; there is no reader study or maintenance-cost experiment. [Q3,Q11] State counts illustrate that fewer source lines need not produce fewer unminimized states. For the honest-node/malicious-node/A4,0/A2,2 LTSs, U0 has1740/3190/24230/42509states; U1 is identical; U2 has1761/3190/24599/42509;U3 has1681/3046/20665/34679;U4 has1723/3130/20905/35059. After strong-bisimulation minimization every version has558/840/12059/19486states. Identical minimized counts alone would not prove bisimilarity; the reported equivalence checks supply that evidence. No runtime or memory benchmark is given. [Q3] ## Concrete transformation cases U1 extracts duplicated node/counter code and splits data definitions into types/constants/channels. U2 merges honest, malicious and disguised behaviors using a MORALITY parameter; node IDs≤H identify honest nodes. U3 factors common suffixes/prefixes and reduces NODE’s process calls22→9. Its final branch-factorization example is acknowledged as harder to understand despite being shorter. U4 exposes an inner three-step coin loop inside an outer block-processing loop, replacing12recursive calls across node/counter code with3loops. [Q4,Q5,Q6,Q7] The loop discovery uses pairs of control location and step residue, rather than control locations alone. The initial random-bit process had combined graded-consensus abstraction with a later fair coin; separating these roles restores the nested-loop structure. The earlier probability P_H used for the later coin is corrected to0.5 among the specific changes before the equivalence-preserving sequence. The counter independently accepts propagated/self-propagated bits, increments K0/K1 and resets them after TALLY. AnnexB prints U2/U3/U4 node code and recursive/imperative counter variants, enabling direct comparison. [Q7,Q14,Q15,Q16] ## What is verified Visual checking first hides irrelevant events and minimizes by branching bisimulation, which allows matching behavior across internal steps. Four-node models have roughly12000–20000strongly minimized states,43000–69000transitions and131labels. SYNC-only slicing exposes alternating BEGIN/END barriers. The block interface exposes proposal bits0/1 and commit-proposed/commit-empty events: for H≥T the observed model allows acceptance or rejection; for H<T the illustrated attacker systematically rejects bit1 proposals. Earlier pre-v5models have visible deadlock traces. These are observations of the stated abstract models and attacker, not an arbitrary-fault resilience theorem. [Q8] Equivalence checks compare sliced systems with small hand-written expected processes: TALLY events form a cyclic four-dimensional hypercube; SELF_PROPAGATE has a more involved loop with optional per-node propagation. Hidden bit/counter values are renamed toX, so those checks establish event-pattern behavior after abstraction, not correctness of discarded values. SET_BIT slices remain difficult to inspect, motivating value-passing MCL formulas. [Q9,Q10] AnnexC reports16named property scripts checked on both U4configurations: P1deadlock absence;P2SYNC alternation;P3aTALLY counter sum≤4 andP3bhypercube;P4a/bPROPAGATE patterns;P5a/bSELF_PROPAGATE patterns;P6a/bselection P_IN/P_OUTpatterns;P7a/bP_ZERO/P_ONEpatterns;P8ablock-interface classification;P9a/b/cper-node SET_BITinitialization and step progression. The latter formulas require an eventual next bit-setting event or, in P9b, a new proposal, without intervening conflicting events. They are local sequencing checks. The conclusion leaves formulas connecting all nodes’ votes to the expected consensus decision as future work. The printed P9cdescription is grammatically incomplete, while its formula explicitly targets SET_BIT(ID,0,any). [Q17,Q18,Q19,Q20] The models have infinite loops. Absence of deadlocks does not itself prove eventual block commitment. The paper does not report probabilistic model checking or almost-sure termination; probability values occur in observable choice labels, and probabilistic verification is proposed as future work. The evaluated equivalences and MCL results should not be turned into a quantitative probability-of-failure guarantee. Larger configurations of6,8,10nodes are mentioned as explored compositionally, without this paper providing comparable property outcomes or resource measurements for them. [Q10,Q11,Q15,Q16] ## Model assumptions and limits AnnexA fixes node population, honesty and equal stake; omits money/rewards, cryptography and leader election; abstracts graded consensus by a probability; reduces step numbers modulo3; and synchronizes every voting phase with global BEGIN/ENDbarriers. Committees are independently selected possibilities ranging from0toNmembers rather than fixed sizeC. The attacker does not fork: it manipulates votes to reject selected proposed blocks. U0 replaces shared BOYCOTT synchronization with independent malicious behavior triggered by proposal bit1. Therefore the model covers one censorship-style strategy, not all Byzantine behavior or dynamic corruption. [Q12,Q13,Q14] Two documented interpretation choices are fresh committees per step rather than per round, and a persistent per-node bit across steps. Printed constants use N=4,C=3,T=2,H=2(or4),P_V=C/N,and P_H=p²(1+p−p²),p=H/N. The main process synchronizes nodes on proposals, propagation, barriers and both commit events. Reader observation: agreement at those shared commit events is constrained by the model composition; the paper’s checks do not independently establish all implementation behaviors fit that composition. Relaxing synchrony and moving from historical BBA* to deployed ABFT remain future work. [Q12,Q13,Q15,Q16,Q11] For this collection, the paper contributes a concrete workflow for simplifying distributed-system specifications while checking equivalence and targeted temporal properties. Its relevance to LLM-generated specifications is my inference: proposed cleanup should retain an explicit preservation target, and success on self-chosen event slices should not substitute for the intended protocol guarantee. The paper has no Verus, Rust, TLA+ or LLM experiment. ## Read and evidence scope Read all41pages, §§1–8,29reference entries and AnnexesA–C, including all32specific changes,9model-code subsections,16property scripts and auxiliary processes. Inspected all5figures, the full §2.2table and dense formula/code renderings; complete extracted text supplied the remaining material. No external author artifact was linked or acquired beyond the full code printed in the paper. Official arXiv and inventory PDFs are byte-identical. Publisher PDF differs in66bytes but yields identical raw extracted text; hashes and comparison saved. No author code, compiler, model checker, solver or generated LTS was executed or loaded. All reported tool results remain attributed to the author.
  • limits: boundedfixedsynchronousmodel;restrictedattacker;abstractGC/crypto;equivalenceamongrefactoringsnotoriginal/deployedprotocol
  • how much was read: most of it read
  • source
  • record id: guidelines-for-producing-concise-2026
• HSTL automotive model checking (2026)
  • title: Hybrid Spatiotemporal Logic for Automotive Applications: Modeling and Model-Checking
  • what: Defines Hybrid Spatiotemporal Logic (HSTL), combining temporal next/until, grid-neighbor spatial modalities, and hybrid nominals/binders that name vehicle positions over time. It gives semantics, modeling idioms for vehicle assumptions, a memoized formula evaluator, and baseline, globally optimized, and motion-aware trace generators. HSTL nominals name grid positions rather than worlds and can be static, relatively moving, or fixed-motion vehicles. The evaluator is proved correct with O(|t|²|φ|) runtime. The motion checker is correct under partitioned consistent assumptions and has trace bound O(s·Σ_{k=0}^{n−1}∏_v b_v^k), where static/dependent branching is 1 and fixed motion branches by |M|. Specifications cover safe following, hazard evasion, intersection crossing, overtaking and platooning; motion assumptions dramatically reduce traces.
  • number: formula evaluator O(|t|²·|φ|)
  • number: 22 table tests
  • number: 10-minute timeout
  • number: platooning 3/4/5/6 nominals: 1.75/6.66/25.5/101.45 s
  • limits: Models use finite discrete grid graphs and finite traces; atomic propositions and nominal assignments are explicit. Motion algorithm requires consistent assumption partitions, no nominal both dependee/dependent, and each dependent nominal in one relative assumption. It is intended mainly for offline planning/test generation; discretization omits continuous vehicle dynamics and uncertainty, and experiments use a 10-minute timeout and wall-clock measurements.
  • how much was read: most of it read
  • record id: hstl-automotive-model-checking-2026
• Hybrid synchronous refinement types (2026)
  • title: Towards Formal Verification of Hybrid Synchronous Programs with Refinement Types
  • what: Defines operational semantics and a refinement-type verification system for synchronous programs combining discrete reactions, ODE evolution, and zero-crossing-triggered resets, and proves type safety. The paper gives a modular zero-crossing definition, hybrid stream operational rules for finite and non-terminating continuous segments, and typing rules that combine differential invariants with an Active predicate for guards known to interrupt flow. Type-preservation lemmas show safety throughout continuous traces and after resets; appendices provide detailed proofs and worked water-tank and automatic-braking derivations.
  • number: zero-crossing case analysis identifies 85 subcases in the appendix taxonomy
  • number: two worked examples are verified in §8 with detailed proofs in Appendix E
  • number: no runtime or benchmark aggregate is reported
  • limits: Safety is an invariant over reachable continuous traces and reset states, under the stated Zélus-style semantics and differentiable guard/flow assumptions. The Active predicate only captures guards whose initial value and derivative establish activity; zero-crossing choice is semantic and syntactic-order dependent. The authors explicitly make no liveness claim for Zeno executions, and the paper is a formal development with examples rather than a scalability benchmark.
  • how much was read: most of it read
  • record id: hybrid-synchronous-refinement-types-2026
• HyperQB 2.0 (2026)
  • title: HyperQB 2.0: A Bounded Model Checker for Hyperproperties
  • what: Introduces a Rust push-button bounded model checker for synchronous HyperLTL and asynchronous A-HLTL over NuSMV and Verilog, using SMT or QBF encodings and returning counterexamples or existential witnesses. HyperQB2.0 unifies NuSMV and Verilog into a program-graph IR, supports unbounded integer/array domains through Z3 ASTs, and adds loop-condition encodings for completeness on finite-state fragments. It offers pessimistic/optimistic and halting bounded semantics, three interfaces, asynchronous trajectory-position quantification, synthesis of existential traces, and explicit/implicit simulation encodings for ∀∃ and ∃∀ loops. Case studies cover information flow, linearizability, robotics, fairness, co-termination, deniability, cache attacks and hardware constant-time properties.
  • number: three interfaces (CLI, desktop GUI, web)
  • number: SMT and QBF backends
  • number: A-HLTL LP benchmark SMT timeout at 1800 s; prior loop benchmark 5000 s
  • number: Verilog examples include 9–311 IR transitions
  • limits: Bounded semantics provide sound conclusions for their stated bug-hunting or witness objectives but do not imply unrestricted unbounded verification; loop simulation assumes a finite state space. Verilog support is inherited from Yosys’s supported 2005 fragment. Solver results can be unknown, time out or run out of memory; HyperQB is optimized for rapid bug finding while AutoHyper targets full verification. The paper reports no broad completeness beyond the implemented loop conditions.
  • how much was read: most of it read
  • record id: hyperqb-2-0-2026
• Improving LLM Code Reasoning via Semantic Equivalence Self-Play with Formal Verification (2026)
  • what: # Improving LLM Code Reasoning via Semantic Equivalence Self-Play with Formal Verification (authored by agents unless marked 🧑) Poon Tsz Nok and Antonio Valerio Miceli Barone use generated Haskell program pairs to train a language model to reason about code. Alice generates a transformed program and either an equivalence proof (SEQ) or a distinguishing input (SINQ). Bob judges equivalence. The paper evaluates rejection-based supervised fine-tuning and downstream benchmarks. It supplies no new soundness theorem for Liquid Haskell or the complete training pipeline. Its reported verifier labels require an additional qualification: the inspected current wrapper does not independently enforce that the model submitted the intended equality obligation. This record covers arXiv:2604.17010v2, dated 3 May 2026, all 20 pages, 34 references, 19 figures, eight tables, two numbered listings and Appendices A–H. The official and inventory PDFs are byte-identical. ACL Anthology lists “Findings of the Association for Computational Linguistics: ACL 2026,” July 2026, pages32273–32292, DOI10.18653/v1/2026.findings-acl.1615 (saved publication metadata). That publication metadata is separate from the arXiv version actually read. The paper does not identify an experimental repository revision. Static findings below concern commit 490fe084d705cb501e0fe34e592f17db2eb44a7b, not an authenticated historical run. ## What the method establishes The reference corpus starts with OpenCodeInstruct programs translated into Haskell by DeepSeek-R1-Distill-Llama-70B. Compilation and execution on a generated input filter the candidates, yielding about 28,000 functions (§3.2, Figure2). Passing that filter establishes that a particular candidate compiled and executed on one input under the filter. It does not prove that the translation preserves the original task, that the reference function meets its intended specification, or that it behaves correctly on every input. AppendixA’s recursive versus fold-based reverse example illustrates alternative Haskell implementations; its typing discussion does not establish that every Haskell program is pure, total or safe. SEQ asks Alice to generate Q and a Liquid Haskell proof of equality with P for all inputs of the declared type. The intended mechanism uses reflected definitions and proof by logical evaluation (PLE). SINQ asks for an input on which their observations differ. AppendixB’s SEQ example compares double x = x + x with double' x = 2 * x; its SINQ example distinguishes "zero" from "non-positive" at zero. These are concrete proof and witness examples, not distributed-system specifications. Conditional equality in the checker semantics remains distinct from a specification of the original natural-language task. Bob samples answers, normally ten, and difficulty is 10 * (1 - N_success/N) (§3.4). Alice generates with target difficulty10 and separately learns to predict observed difficulty. The paper retains hard generator cases and a smaller easy sample, difficulty-prediction examples, and successful proof-generation traces. Bob is fixed throughout seven Alice rounds and fine-tuned once afterward. Each Alice training round restarts from the original base model on accumulated examples; generation uses the previous adapter. This is supervised fine-tuning with rejection sampling. AppendixC discusses reinforcement learning as a possible extension; it is not the evaluated implementation. The base model is DeepSeek-R1-Distill-Qwen-7B, with LoRA adapters. AppendixE gives temperature0.6, top-p0.95, top-k20, presence penalty1.5 and a32,768-token context. The actual reported hard threshold is3, rather than the example/default5. A main run takes “about 3 days on 4 NVIDIA L40S GPUs” (AppendixE.4). That is an author-reported duration, not a reproduced measurement. ## Static checks of the verification and selection boundaries Seven selected repository files were read completely: root and SEQ_v2 READMEs, run_liquidhaskell.py, SEQ.py, the seven-round launcher, the dataset compiler filter and the EquiBench evaluator. The full nontruncated repository tree was used only as metadata. Stored datasets, predictions, checkpoints and scientific result JSON were not loaded. No author code was imported or executed; no GHC, Liquid Haskell, solver or training run was performed. The main equivalence wrapper accepts a generated code block, post-thinking response or entire response as the proof body (generate_proof_body). Its fixed refinement lemma template is commented out. It inserts the model’s text into a module containing reflected P and Q, rejects an empty body, invokes GHC with the LiquidHaskell plugin and returns "proved" on exit0 (verify_equivalence). No inspected check independently requires a refinement annotation asserting the intended equality, fixes the proposition outside model control, or rejects model-supplied additional assumptions/options. A successful process exit alone therefore does not show that this wrapper submitted and checked the target equality. This is a static obligation-integrity issue, not a demonstrated successful bypass or evidence that any reported training example was mislabeled. The small run_liquidhaskell.py example overwrites its initial annotated double example with an addNumbers proof lacking an explicit equality refinement annotation; it is source text, not a saved successful run. The paper’s second few-shot proof example has the same omission. The inequivalence wrapper rejects a Q compilation error and accepts different successful stdout. It also accepts one successful and one failed execution, or differing failure statuses (check_divergence). Runtime and timeout statuses can thus contribute to labels. An observed timeout is not proof of semantic nontermination. Reference compilation is checked separately, but that does not remove every execution failure. The record does not infer the frequency or historical impact of these cases. Selection differs from the paper in the pinned driver. Both generator branches append candidates only when difficulty is at least the threshold; the later easy-generator sample therefore has no candidates. The difficulty-prediction sample takes at most 0.5 * n_hard easy items, at most one third of the resulting subset, rather than half the subset. SEQ generation training retains the original target10 prompt; SINQ generation training rebuilds its prompt with observed Bob difficulty. Both difficulty-prediction branches use observed difficulty as their output label. The source uses >=, while the paper’s hard-case definition uses >. The launcher sets threshold1, versus the paper’s reported3 and README example5. Its base-model restart and single final Bob training do support the described schedule. These differences do not identify the configuration actually used for the paper’s experiments. parse_bob_output normally returns a Boolean, but a missing match falls through as None and an exception returns (None,None). run_bob uses truthiness: ordinary missing output is treated as an inequivalence answer; the exception tuple is treated as an equivalence answer. That can affect difficulty and training selection. No stored-output audit establishes how often either case happened. The selected dataset validator checks function-binding heuristics and compilation; its input-argument filter is commented out. It does not itself implement the paper’s one-input execution stage, which may occur elsewhere. The EquiBench evaluator uses a Haskell-specific system prompt on the loaded benchmark pairs, extracts the first regex match rather than necessarily the final answer, and skips parse failures/exceptions before computing accuracy, precision, recall and F1. It saves parsed/unparsed counts, but the paper tables do not give those counts. These are current evaluation-path limitations, not a reanalysis of stored experimental outputs. ## Evaluation and numerical evidence The main E0 regime attempts SEQ/SINQ50/50 over500 reference programs per round. E1 is SINQ-only with500, E2 is96/4 with500, and E3 is SINQ-only with40 (Table1). Tables6/8 and Figures6/12/15/18/19 report total accepted pairs: - E0:34SEQ and903SINQ, total937 - E1:1,839SINQ - E2:62SEQ and78SINQ, total140 - E3:156SINQ AppendixF estimates E0 yields as34/1750≈1.94% and903/1750=51.6%, using expected branch-attempt counts. It defines expected accepted volume K=P*(p*r_SEQ+(1-p)*r_SINQ), predicts E2≈19.632 pairs per round and chooses E3≈38.04 references, rounded to40. This controls an estimated pair count. It does not equalize actual accepted counts, proof tokens, difficulty, class balance or compute. E2 and E3 actually have140 and156 pairs. The text’s “isolates the causal effect” and “fixed compute resources” claims exceed that control. The paper itself acknowledges residual difficulty/class differences and small samples, and asks for stronger statistical evidence (§7). No independent training-seed replication or uncertainty for those causal differences is established by averaging16 evaluation samples/trials. Intrinsic Bob accuracy increases87.57→91.34% on training-split generated challenges and88.24→88.79% on unseen-split challenges (Table2). The latter is0.55 percentage points. The seven overall difficulty means are0.50,0.50,0.65,0.87,0.66,0.93,1.18 (Figure3); they increase overall but not monotonically. Figure7’s SEQ means end1.89, after2.17,3.00 and1.00, so AppendixH’s “2.0−3.0 in later ones” is only a loose description of some rounds. Difficulty is performance relative to this Bob and these accepted cases, not an independent measure of semantic complexity. Table3 reports Haskell HumanEval Bob Pass@1 rising17.7→26.4%, with compilation errors130→110; final Alice is26.3%/104errors. On MBPP Bob rises26.7→36.9%, errors250→203; Alice is34.3%/218errors. Figure9 labels final Alice MBPP errors212 instead of Table3’s218. This discrepancy remains unresolved. Plot averages over16 trials do not establish independent repetitions of the complete training process. EquiBench’s largest E0 accuracy increase is OJ_V56.5→69.8%, or13.3points (Figures4–5). OJ_A rises50.2→57.4, OJ_VA55.8→55.9, STOKE48.0→51.8; DCE falls55.1→51.9 and TVM51.7→50.1. F1 improves on OJ_A/OJ_VA/OJ_V/STOKE and declines on DCE/TVM. PySecDB accuracy rises67.6→68.8 and F151.3→54.0 (Table4). CodeXGlue accuracy rises48.8→50.5, while recall falls51.1→41.7 and F147.9→43.2 (Table5). The authors describe near-random defect detection; no statistical chance-baseline analysis is supplied. Table7 does not support universal dominance by the mixed or volume-controlled SEQ arms. E0 loses to E1 on MBPP Bob36.9 versus38.8 and Alice34.3 versus39.3, and HumanEval Alice26.3 versus28.1. E2 loses to E3 on OJ_V accuracy63.2 versus65.8/F161.5 versus64.7, TVM accuracy48.8 versus50.8/F133.5 versus33.9, and CodeXGlue F144.1 versus48.5; PySecDB accuracy ties68.7. E2 wins several other comparisons, including the four Haskell generation scores. These small, mixed results support investigating complementary supervision, not a general proof that SEQ uniquely improves reasoning. The validated-count plots contain percentage-denominator errors. Figures12,15,18 divide labels by250, even though E1 uses500SINQ attempts, E2 expects480SEQ/20SINQ attempts, and E3 uses40SINQ attempts. E1 consequently prints yields above100%. For example248/500=49.6%, not99.2%; E3’s26/40=65%, not10.4%. Figure15’s actual branch counts are random, so480/20 are expected denominators rather than authenticated attempt totals. The reported raw accepted counts and Table8 totals need not be wrong merely because the percentage labels are wrong. Figure19 reuses the raw counts. All figures, tables, count trajectories and these qualifications are retained separately. ## Contribution and limits The useful contribution is a concrete way to generate semantic reasoning tasks and combine proof-oriented examples with distinguishing-input examples. The study exposes low positive-equivalence yield, verification-wrapper obligations, label handling and the need to compare training volumes and costs carefully. Its strongest direct relevance is to evaluating LLM agents that write proofs: successful verifier invocation must be tied to a fixed intended theorem, and benchmark gains require checks beyond accepted proof labels. The paper explicitly notes proof-generation failures, Liquid Haskell/reflection limitations, partiality/nontermination and the gap to low-level, stateful and memory-manipulating programs (§8). There is no Verus, Rust, TLA+ or distributed-protocol experiment. Applying these ideas to distributed verification is a reader inference. The record claims a whole paper and selected static-source read, not a fresh proof, experimental reproduction, exhaustive repository audit, historical configuration recovery or verification of every generated item.
  • limits: checker-semantics/inputtypes/termination/reflection/currentwrapperdoesnotfixexpectedtheorem/expectedpairmatchingnotcomputecontrol/smallmixedablations/currentpinnotauthenticatedhistoricalrun
  • how much was read: most of it read
  • source
  • record id: improving-llm-code-reasoning-2026
• Jedelský FO variable parameterization (2026)
  • title: On first-order model checking parameterized by the number of variables
  • what: Characterizes graph classes where FO model checking parameterized by the number of variable names is FPT in monotone settings, gives a kernel for shallow colored trees, and proves AW[]-hardness already on paths and on monotone classes of unbounded tree-depth. A recursive kernel keeps fewer than s isomorphic branches at each depth and yields an FO-equivalent tree of size g(s,k,c), computable in linear input time for fixed depth. Backwards interpretations extend this to bounded tree-depth/SC-depth and shrub-depth. A formula encoding a graph adjacency matrix into distances on a path proves AW[]-hardness with only a bounded variable set; applications include an FPT homomorphism algorithm parameterized by pattern tree-width and target SC-depth.
  • number: kernel size g(s,k,c)
  • number: Theorem 3.2 O(f(s,k,c)(|T|+|phi|))
  • number: AW[*]-hard on paths
  • number: MSO hardness with 2 set variables
  • limits: FPT algorithms depend on bounded depth/shrub-depth and computable structural witnesses (tree-models/SC-depth). Hereditary unbounded-shrub-depth hardness requires either efficiently constructible flipped half-graphs or layerwise path flips; the general hereditary case remains open and is stated as a conjecture. MSO with two set-variable names is AW[]-hard even on disjoint unions of stars unless FPT=AW[].
  • how much was read: most of it read
  • record id: jedelsky-fo-variable-parameterization-2026
• KindHML Smart Contracts (2026)
  • title: KindHML: formal verification of smart contracts based on Hennessy-Milner logic
  • what: Introduces CHML, a first-order Hennessy-Milner-based logic for strategic temporal smart-contract properties, and KindHML, an automated Solidity-to-Lustre/Kind 2 verification toolchain. The encoding handles an expressive purified Solidity fragment, action modalities, first-order quantification and past operators. Benchmarks cover Bank, Vault and Bet contracts with liquidity, additivity, reversibility, front-running, drainability, non-inflation and winnability properties; mutations provide ground truth violations.
  • number: 3GHz Xeon Gold 6136, 64 GB RAM
  • number: 1,000 s per verification task
  • number: counterexamples always under 1 s
  • number: Bank liquidity valid cases take 333.8–668.7 s
  • limits: KindHML abstracts some Solidity semantics, so guarantees are relative to KindHML semantics and do not directly guarantee behavior on full Ethereum. The current tool is single-contract and omits contract-to-contract calls, loops and gas; validity proofs can be expensive under a 1,000-second task limit.
  • how much was read: most of it read
  • record id: kindhml-smart-contracts-2026
• Lawyer (2026)
  • title: Lawyer: Modular Obligations-Based Liveness Reasoning in Higher-Order Impredicative Concurrent Separation Logic
  • what: Lawyer proves fair termination (every fairly scheduled run finishes) in Rocq/Iris. It uses a logical transition system of obligations. A well-founded hierarchy orders the dependencies to rule out cycles. The authors verify a ticket-lock module and its client separately, against a fair-lock interface that obliges the holder to release.
  • limits: Finite sets of levels limit lock-coupling structures that grow without bound. Progress for independent modules, and liveness of programs that never terminate, are future work. The notes found no effort count.
  • how much was read: most of it read
  • source; notes: Iris: Trillium, Lilo, Lawyer
  • record id: lawyer-2026
• Lazy Proof Automation for Separation Logic (2026)
  • what: Yolo separates a fast unverified heap-entailment simplifier from later Lean proof reconstruction. Mixed native-expression/list syntax and extensible operator tags retain host-language terms and permit operator-specific simplification and proofs. Integrates with Iris-Lean and relational LGTM; evaluates interactive and reconstructed runtimes against several separation-logic automation systems. Details how CFML-style six-component symbolic simplification becomes list manipulation with a recorded tacticScript, followed by replay of list-based soundness lemmas. Extensible plain-tag trees avoid positivity restrictions of recursively parameterized functor encodings. Explains the distinction between adding unverified operator behavior and supplying reconstruction lemmas. Shows Iris modality work remaining after core simplification and LGTM’s extra indexed-family cancellation.
  • limits: Fast hsimp.yolo=true mode does not generate proof terms and therefore does not certify final claims. The documented workflow sets it false and rechecks the file, reconstructing terms for Lean. Trust rests on successful checked reconstruction, Lean’s kernel and the instantiated logic/laws/context; the complex simplifier need not itself be proved correct. No full formal correctness theorem for all metaprogramming code is presented in the paper. Generic integration requires MoSeL BIBase/BI instances and the algebraic/soundness lemmas used by handlers. Adding an operator’s unverified Eval/equality/parsing instances is insufficient for foundational certification; each simplification handler needs its proof justification. The implementation only automates supported core operators and registered extensions. Unknown connectives remain unchanged. Iris-specific modalities in the example still require IPM tactics. Generic extensibility does not establish automatic proof search or completeness for arbitrary separation logics. Native Lean Expr and isDefEq retain polymorphic/dependent host terms, but definitional matching is heuristic and does not establish arbitrary semantic equivalence. The positivity-safe opT tree carries a plain operator tag and arbitrary argument list; its type alone does not enforce an operator’s arity. Checked reconstruction is the relevant boundary. Table1 baseline is Splean’s Lean port of CFML-style xsimpl, not a direct Rocq CFML execution comparison. Timings instrument tactic work inside selected proofs, not full project build time or user productivity. The small selected set is not a representative corpus claim. Synthetic competitors share only shuffled conjunction cancellation. HTT uses equality of disjoint heap unions, while other frameworks prove entailments. Different logics, host languages, tactic interfaces and measurement methods limit ranking beyond those tasks. Pulse comparison is against Yolo’s unverified phase; Bedrock/iFrame figures explicitly include reconstruction. Machine: Dell Ubuntu workstation,5.4GHz Intel i7-14700. No repetition counts, confidence intervals, random seeds, complete software revisions, memory results or controlled ablation of each design change are reported. Zenodo software link and GitHub are provided but were not inspected or executed by reader. The paper does not evaluate verified C/Rust execution, distributed protocols, TLA+, liveness, LLM agents or generated specifications. Iris is a concurrency-capable framework, but integration and entailment benchmarks do not by themselves prove a concurrent application correct.
  • how much was read: most of it read
  • source
  • record id: lazy-proof-automation-for-2026
• Lean on Vampire Proofs (2026)
  • what: Extends Vampire to emit Lean-checkable first-order equality proofs,reconstructing preprocessing,saturation inferences and AVATAR/SAT refutations. Generated Lean lemmas and final theorem shift proof validity to Lean kernel plus SAT proof checking. In TPTP experiments most emitted refutations reconstruct,but this is a supported fragment/proof format,not all Vampire inference rules or a demonstrated Lean hammer. Proof file has symbol preamble,per-inference Lean theorems and final conjecture proof. Tactics handle literal AC reordering/equality symmetry;Vampire replays inference to recover most general unifiers,instantiates ground premises,then grind reconstructs terms. Modified syntactic Skolemization depends on all bound variables to facilitate reconstruction with Classical.skolem and prenexing. AVATAR clause labels are explicitly defined and propagated;final propositional contradiction uses bv_decide,which calls SAT then checks certificate in Lean. Drops proof-search ordering/redundancy restrictions when checking paramodulation instances,as only soundness of resulting implication matters.
  • limits: Standard first-order logic with equality and inhabited domain. Multi-sorted FOL and theories are future work;around200 Vampire rules exist but only core subset supported. Missing-unifier variables instantiate domain default element. Trust applies to actual generated Lean theorem from translated input assumptions;proof search/tactics need not be trusted when their proof terms/certificates check. Paper explicitly includes Lean kernel and trustworthy SAT proof-checker in boundary;reader did not inspect/rebuild implementation. Evaluation on TPTP CNF/FOF cannot establish performance on dependent-type-theory translation or Lean user goals. Authors explicitly say hammer efficacy not yet clear. 99% is approximately reconstruction success conditional on Vampire-emitted refutations under modified settings,not99% of all17603input problems. Baseline vs new search settings differ in Skolemization and pure-predicate removal as well as proof output. Lean timeout1000s/64GB differs from Vampire100giga-instruction≈30s/16GB single-core limit. Figure2a measures Vampire overhead only;total end-to-end includes Lean startup/reconstruction/checking. No bugs found in Vampire in tested set;absence is not a soundness proof of prover. Linked Github/SoftwareHeritage artifacts and previous arXiv version uninspected.
  • how much was read: most of it read
  • source
  • record id: lean-on-vampire-proofs-2026
• Lee Dubey Hückelheim CIVL CIC (2026)
  • title: Developing a Numerical Algorithm with CIVL Model Checking in the Loop
  • what: Reports a CIVL-in-the-loop workflow for designing a cloud-in-cell particle-deposition algorithm intended for Flash-X. A compact C model abstracts the Flash-X Grid API; symbolic particle positions and assertions check mass conservation, first-moment deposition location, memory safety, MPI deadlock freedom, and data races before porting to Fortran. The paper gives the abstraction boundary (~400-line grid model plus ~150-line driver), four staged development workflow (1D uniform, cross-rank, 2D, multi-level AMR), exact CIVL driver assertions, and a concrete counterexample: ranks with no real particles could receive multiple virtual particles, overflowing a one-slot buffer. The fix sizes the pool from an MPI_Allreduce global particle count. CIVL proves identities for all symbolic positions but only fixed AMR topologies/rank bounds. Tables quantify runtime/state/prover-call growth from 1D seconds to 2D 1,000–3,000 seconds and multi-million states.
  • number: ~400 lines grid abstraction
  • number: ~150 lines CIVL driver
  • number: 150k lines original Grid unit
  • number: 1D runtimes ~10–23 s
  • limits: CIVL models floating-point doubles as mathematical reals, so it does not catch floating-point rounding errors. Proofs apply to the self-contained C abstraction and fixed grid configurations, not the 150k-line Flash-X Fortran Grid implementation or dynamic AMR topologies. Single-particle physical assertions rely on additivity and do not exercise particle-count-dependent buffer behavior; conventional tests cover that dimension. Abstraction fidelity and later C-to-Fortran port are assumptions; 3D/symbolic topology are future work.
  • how much was read: most of it read
  • record id: lee-dubey-hu-ckelheim-civl-cic-2026
• Liveness certificates (2026)
  • title: Liveness Proofs for Hardware Model Checking
  • what: Certificates for checking hardware liveness (k-liveness, liveness-to-safety, rLive, stabilizer extraction). They are validated by eight SAT obligations on a witness circuit.
  • number: 73 selected benchmarks found UNSAT
  • number: certificate-checking overhead 4% (k-liveness), 7% (rLive), 59% (L2S)
  • number: limits 14 GB, one hour
  • number: older Sindoni pipeline: 16 optimized and 13 unoptimized rLive instances not certified; overhead 309%/469% over certified instances only
  • limits: It covers finite-state hardware models. The soundness proof is mathematical, not mechanized. The aigunfair converter and the SAT checker are trusted.
  • how much was read: most of it read
  • source; notes: Liveness Proofs for Hardware Model Checking
  • record id: liveness-certificates-2026
• Loom (2026)
  • title: Foundational Multi-Modal Program Verifiers
  • what: A Lean framework that derives a verification-condition generator, proved sound, from a language’s executable semantics. It is used for Veil 2.0 (protocol safety) and Velvet (imperative programs).
  • number: 17 specifications of 15 distributed protocols in Veil
  • number: 10 Velvet case studies
  • number: sparse matrix reasoning 300-400 lines
  • number: Veil: 17 specifications of 15 different distributed protocols
  • limits: It does not infer the guarantee that was intended. Leftover goals are left to the user. There is no liveness over time. The NOPaxos model fixes the leader and omits view change.
  • how much was read: most of it read
  • source; notes: Foundational Multi-Modal Program Verifiers; notes: Foundational Multi-Modal Program Verifiers
  • record id: loom-2026
• MARL policy distillation verification (2026)
  • title: Formal Verification of Learned Multi-Agent Communication Policies via Decision Tree Distillation
  • what: Distills neural multi-agent communication policies into decision trees, translates trees with complete feature/state correspondence into PRISM, and verifies PCTL properties compositionally via pairwise decomposition and union-bound aggregation. Monte Carlo validates transfer of verified safety properties to original neural policies. Domain-specific features encode neighbor messages and target geometry; discrete VQ-VIB communication improves fidelity over continuous methods. Pairwise models reduce exponential multi-agent state spaces, with empirical neighbor modeling for remaining agents. Verified trees satisfy all safety thresholds in a 5-agent drone gridworld.
  • number: Tree fidelity 97.9% ±1.2%
  • number: 18 temporal properties; 88.9% property satisfaction; all five safety thresholds
  • number: Collision probability 0.3% vs 1% threshold; connectivity 94.3% vs 90% threshold
  • number: Neural/tree safety transfer deviation ≤0.6 percentage points (95% CI)
  • limits: Decision-tree fidelity is empirical, not semantic equivalence; transfer relies on Monte Carlo confidence. Gridworld and discrete messages simplify deployment; continuous dynamics, larger teams and communication radius changes may invalidate results. Union-bound composition can be conservative.
  • how much was read: most of it read
  • record id: marl-policy-distillation-verification-2026
• Mechanized JavaScript Regex Semantics (2026)
  • title: Formal Verification for JavaScript Regular Expressions: A Proven Mechanized Semantics and Its Applications (Extended Version)
  • what: Defines and mechanizes a complete backtracking-tree semantics for modern JavaScript regular expressions, proves equivalence to an embedding of ECMAScript semantics, and formally verifies the PikeVM matching algorithm. The semantics records all possible matches and priority rather than only the top match. Rocq proofs establish contextual-equivalence rewrites and a chain from regex semantics through PikeTree to compiled PikeVM bytecode; the paper proves PikeVM correctness against the ECMAScript specification and examines optimizer rewrites, including counterexamples.
  • number: Regex-equivalence proof development exceeds 6,000 lines of Rocq
  • number: All definitions and results are mechanized in Rocq
  • number: Theorem 16 proves PikeVM correctness; no runtime benchmark table is reported
  • limits: The mechanization targets the specified modern JavaScript regex feature set and leaves several extensions (for example additional engine features and termination/complexity questions) as future work. Contextual equivalence is intentionally stronger or more directional than simple observational equivalence in some cases; performance benchmarking is not the paper’s focus. Section 7 explicitly leaves verification of a concrete implementation and a proof of linear step complexity to future work.
  • how much was read: most of it read
  • record id: mechanized-javascript-regex-semantics-2026
• Model Checking Matrix Product States against Linear Chain Logic (2026)
  • what: Introduces Linear Chain Logic (LCL) for spatial, size-indexed properties of periodic matrix product states and approximate model-checking algorithms based on completely positive transfer maps, irreducible decomposition and semilinear evidence sets. The paper reduces periodic-MPS squared norms to tr(M_E^N), decomposes the CP map into irreducible blocks, and uses cyclic peripheral spectra to derive eventual periodic behavior. LCL has interval-valued atomic predicates over MPS observables and spatial X/E/G operators; evidence sets are sets of chain lengths. Algorithm 1 recursively propagates over/under evidence approximations, while Algorithm 2 splits residue classes, projects peripheral modes, checks second spectral radii and computes finite thresholds. Theorem 1 gives O(|Φ|·D^8) time. Examples show exact odd/even behavior and a tight threshold for positivity.
  • number: Algorithm complexity is O(|Φ|·D^8).
  • number: Synthetic stress tests use D=16,32,64,128; physical spin-chain tests use D=16,32.
  • number: Synthetic tables include timeouts at D=128 for some near-critical formulas; all 42 physical instances complete within the 3600-second timeout.
  • number: Parameters are ε=0.01, γ=1.0, δ=0.01, k=2 and J=1; experiments run on a 10-core Apple M4 with 24 GiB unified memory.
  • limits: The system is a periodic, translation-invariant MPS represented by fixed D×D matrices; spectral and threshold calculations are numerical and atomic sign determination can be undecidable, so unknown gaps remain between over- and under-approximations. Peripheral cyclicity relies on irreducible CP maps and normalized spectral-radius reasoning. Experiments use synthetic CPTP tensor-power families up to D=128 and physical TFIM/XXZ/Kitaev MPS up to D=32; all physical instances finish within 3600 seconds, but some synthetic cases time out or return U.
  • how much was read: most of it read
  • record id: model-checking-matrix-product-2026
• ModelWisdom TLA+ toolkit (2026)
  • title: ModelWisdom: An Integrated Toolkit for TLA+ Model Visualization, Digest and Repair
  • what: Presents ModelWisdom, an interactive toolkit that links TLC state graphs to TLA+ source, folds and compacts large graphs, summarizes subgraphs with LLMs, and iteratively repairs syntax/property errors using TLC feedback. ModelVisualizer colorizes violated states and properties, supports click-through transition-to-code links, tree layouts, node/edge folding, and lazy rendering. ModelDigest preprocesses graph structure and prompts LLMs with full specifications plus initial/terminal/cycle/frequency summaries. ModelRepair supports single-pass and multi-pass repairs with a history panel, repeatedly feeding TLC errors and revised models.
  • number: implementation comprises approximately 7,000 lines of typed TypeScript and Python
  • number: ModelVisualizer renders one tree at a time and uses lazy rendering/folding
  • number: demonstrations show correction of white-bean decrement from −1 back to −2
  • number: no controlled accuracy, runtime, or benchmark evaluation is reported
  • limits: The toolkit is an interpretability and repair aid around TLC, not a replacement for TLC’s correctness checking; LLM explanations and fixes require human review. Demonstrations use the CoffeeCan example and a deliberately altered postcondition, with no quantitative benchmark of repair accuracy or scalability. Future work targets Promela, Alloy, NuSMV, UPPAAL, and other languages.
  • how much was read: most of it read
  • source
  • record id: modelwisdom-tla-toolkit-2026
• MOPMC real-time DRL switch (2026)
  • title: Fault-Tolerant Design and Multi-Objective Model Checking for Real-Time Deep Reinforcement Learning Systems
  • what: Introduces a formal design pipeline for real-time deep-reinforcement-learning controller switches: timed automata model switching and clocks, incremental synchronized composition adds counters/metric recorders, syntactic conversion produces an MDP, and a convex-query algorithm synthesizes schedulers balancing hard safety and soft cost/reward objectives. MOPMC implements CPU/GPU policy/value iteration and exports schedulers. The TA-to-MDP conversion separates mutually exclusive branching guards (probabilistic underdetermination) from equivalent-guard choice states (design nondeterminism), estimates guard probabilities from distributions or simulation, and encodes controller cost, lane departure, TTC and headway as total rewards. The HighwayEnv case trains DDPG without delay, then injects fixed/random observation-action delays; at 0.30 s average random delay, no-switch lane departure is 0.2849. A four-configuration switch and convex query find a minimum-MSE point (ExpCTL 1.9, PRTTC .0377, PRHW .2189, ProbLD .1720), and exported schedules improve TTC/headway while increasing lateral departure risk. Perturbing transition probabilities ±1.5–15% gives stable median outputs. Runtime experiments vary switch size, objective count to 100, and the Team Formulation Protocol, showing GPU gains on large models but mixed results on small ones.
  • number: HighwayEnv fixed/random delay table, 0.00–0.50 s delays
  • number: at 0.30 s random delay: no-switch P10TTC 12.7368, P50HW 4.2904, ProbLD 0.2849
  • number: convex-query point: ExpCTL 1.9, PRTTC .0377, PRHW .2189, ProbLD .1720
  • number: 40 perturbed data points per transition-probability level, ±1.5–15%
  • limits: Timed-automata guards are assumed mutually exclusive or equivalent at multi-action states; MDP conversion assumes Markovian state and requires estimated transition probabilities. The fallback controllers and metric thresholds are hand-designed, while the DDPG is trained in a no-delay environment and evaluation uses one HighwayEnv domain. Sensitivity is empirical rather than a formal uncertainty bound; the authors note probabilities, dynamics, chosen metrics, controller quality and latency-aware training threaten validity. Convex queries currently target total rewards, not full temporal/mean-payoff properties, and no safety proof for the neural controller itself is provided.
  • how much was read: most of it read
  • source
  • record id: mopmc-real-time-drl-switch-2026
• Move higher-order MVP (2026)
  • title: Formal Verification of Imperative First-Class Functions in Move
  • what: Extends the Move Prover to imperative first-class functions that can be passed, stored in structs and persisted in global storage. Behavioral predicates (requires/aborts/ensures) and state labels specify function-value effects and intermediate memory snapshots; SMT dispatch splits known callees and uses predicates for unknown closures. The verifier supports mutable references/global writes under Move’s alias-free resource model, two-state predicates and quantified state labels. Weakest-precondition inference over Move bytecode generates behavioral specifications for function-valued code, with validation tests covering closures, stored dispatch and state transitions. Static separation of Move memory avoids separation-logic encodings for these calls.
  • number: Closure suite: 19 test modules, about 240 verified functions and 66 expected-error diagnoses
  • number: Tests complete under 5 minutes on GitHub runners; default 40 seconds per verification condition
  • number: Move version 2.4 and MVP Aptos commit pinned in paper
  • number: No larger open benchmark yet; higher-order Move shipped late 2025
  • limits: Function-value dispatch currently enumerates all closure variants reaching a call site, so open or dynamically loaded modules may not scale. State labels are individually bound; sequences of labels and fold-like higher-order iteration remain future work. Nonlinear arithmetic may require user proof hints. Evaluation is a test suite, not a broad benchmark, and Move-specific resource/alias assumptions differ from Rust.
  • how much was read: most of it read
  • record id: move-higher-order-mvp-2026
• MPBMC GNN property clustering (2026)
  • title: MPBMC: Multi-Property Bounded Model Checking with GNN-guided Clustering
  • what: MPBMC learns overlapping property clusters from graph-neural-network representations and runtime design statistics, then transfers useful clusters to a structurally similar new circuit to improve bounded-model-checking progress. Offline databases hold cone-of-influence data, DeepGate2 embeddings and the best influencing cluster per property. Online selection matches circuit/property cone sizes and transfers clusters. A six-category status-gain ordering prefers newly solved properties; cluster runs receive T times cluster size.
  • number: 15-minute per-property base timeout, DeepGate2 2.0.1; approximately 600 MB databases. Reported average depth gains 13.61%–430.23% and maxima 34.37%–2647.76% across ten circuits. Offline embeddings average 210 s/design; clustering 28 s k-means, 121 s k-medoids.
  • limits: Evaluation targets undetermined HWMCC properties and primarily reports increased explored depth, which is not an unbounded proof. Offline data collection and transferred-cluster usefulness are empirical assumptions. Prose says more than 51% gain and 1.5k–16k gates, while Table II includes 36% and 1,691,790 gates; do not silently harmonize them. No experiments reproduced.
  • how much was read: most of it read
  • record id: mpbmc-gnn-property-clustering-2026
• Multi-Objective SMC with LSS (2026)
  • title: Multi-Objective Statistical Model Checking using Lightweight Strategy Sampling
  • what: Introduces the first statistical model-checking approach for multi-objective Pareto queries. It samples deterministic strategies with lightweight strategy sampling (LSS), estimates all objective values by Monte Carlo confidence intervals, and constructs convex-hull underapproximations and incremental overapproximations of the achievable/Pareto set. The paper formalizes simultaneous confidence boxes across strategies and objectives using Bonferroni/union-bound error allocation. Its incremental algorithm assigns geometrically shrinking error budgets to batches and almost surely converges, under ideal LSS on finite contracting MDPs, to a confidence band of precision sqrt(2d) epsilon. Three fixed-budget algorithms (weight-vector refinement, fixed-iteration budget, fixed-strategy budget) combine strategy-discarding heuristics with an independent evaluation phase to retain sound lower bounds. The modes implementation evaluates 40 instances from quantitative-verification and reinforcement-learning benchmarks, and reports when SMC remains usable while Storm PMC times out.
  • number: 2160 fixed-budget experiments (3 configurations x 40 instances x 6 heuristics x 3 algorithms), each repeated for seeds 1,2,3
  • number: fixed strategy budget generally performed best; simple heuristic had highest hypervolume for most algorithms
  • number: SMC solved all fixed-budget runs where PMC timed out on large RL cases; e.g. 26.1M-state deep-sea and 40.6M-state breakable-bottles instances were handled in seconds
  • number: configuration 3 (3333 initial strategies, n=30 runs, I=10) won most heuristic/algorithm comparisons
  • limits: Models are finite contracting MDPs, so runs terminate almost surely and deterministic memoryless strategies suffice; objectives are reachability probabilities or undiscounted reachability rewards. The theory assumes ideal LSS eventually samples every deterministic strategy, while implementation uses 32-bit identifiers and can miss strategies. Finite-time sampling cannot soundly overapproximate the Pareto front because an optimal strategy may never be sampled; only underapproximations have finite-time statistical guarantees. Results use three seeds, 40 instances, fixed confidence alpha=0.1, and arbitrary hypervolume reference points, so cross-model comparisons are not meaningful.
  • how much was read: most of it read
  • record id: multi-objective-smc-with-lss-2026
• Multi-Threaded Software Model Checking via Parallel Trace Abstraction Refinement (2026)
  • what: Parallelizes trace-abstraction CEGAR in Ultimate Automizer by assigning distinct counterexample traces to worker threads while a coordinator serially applies interpolant-automaton refinements and uses diverse trace selection. The paper formalizes sequential trace abstraction over automata of syntactic error paths, then observes that feasibility checking and interpolant generation are independent and sound with stale abstractions. A coordinator tracks assigned traces, workers perform SMT checks and interpolant automata, and a recursive selector prioritizes paths that diverge early from previously selected traces. The Java implementation uses fixed thread pools and CompletionService. Evaluation on 14,560 SV-COMP 2025 unreach-call C tasks compares 1/2/4/6 workers, the competition sequential configuration and DSS, reporting correctness, solved tasks, speedups and validity threats.
  • number: 14,560 tasks: 11,158 property-satisfying and 3,402 violating; each run is capped at 8 cores, 15 minutes and 30 GB.
  • number: Correct alarms/proofs are SEQ-UA 1,128/3,377; PAR-1 1,140/3,695; PAR-2 1,241/3,747; PAR-4 1,243/3,860; PAR-6 1,245/3,858.
  • number: PAR-2 is faster on 49% (2,369/4,787) commonly solved tasks, PAR-4 on 43% (2,002/4,760), and PAR-6 on 34% (1,619/4,735); speedups >3, >5 and >7 occur for 67, 42 and 31 tasks.
  • number: Against DSS on 1,395 jointly correct tasks, DSS is faster on 66% by a median 7.1 s, largely due to Ultimate startup overhead; the paper reports its approach as more effective.
  • limits: Soundness relies on the trace feasibility/interpolant machinery; stale abstractions may waste work but are argued sound. Parallel workers require memory-expensive copies and can analyze redundant traces; one incorrect PAR-6-UA alarm was observed and attributed tentatively to reused Ultimate functionality. Results cover only sequential C, unreach-call safety tasks under 8 cores, 15 minutes and 30 GB; generalization to other languages/properties/resources is uncertain. PAR-6 can lose proofs due to overhead when PAR-1 solves a task with fewer traces.
  • how much was read: most of it read
  • record id: multi-threaded-software-model-2026
• Occupation invariants probabilistic loops (2026)
  • title: Generating Functions Meet Occupation Measures: Invariant Synthesis for Probabilistic Loops (Extended Version)
  • what: Introduces occupation invariants, dual to probabilistic martingales, for exact posterior distributions and positive almost-sure termination, with template-based synthesis of rational generating functions. The paper proves semantic equivalence between posterior-measure and operational Markov-chain semantics, relates occupation measures to expected runtime, gives a proof rule for exact posterior measures, and implements ProDiGy with breadth-first rational templates, symbolic backends GiNaC/SymPy, and positivity heuristics.
  • number: most successful benchmark synthesis times are below one second
  • number: thirds_geometric takes 6.681842 s; subdist_enter 0.568013 s
  • number: nontermination and sequential_loops fail
  • number: runs use Apple M3 Pro with 18 GB RAM; core synthesis only
  • limits: Template enumeration is theoretically exhaustive only if a rational invariant exists at finite degree; positivity checking uses sufficient heuristics because general rational FPS nonnegativity is difficult. Benchmarks are small to mid-sized, and two cases fail due to template/positivity limitations; reported times exclude preprocessing.
  • how much was read: most of it read
  • record id: occupation-invariants-probabilistic-loops-2026
• PerF fault-aware performance prediction (2026)
  • title: A Formal Framework for Predicting Distributed System Performance under Faults (Extended Version)
  • what: Introduces PerF, a Maude framework that composes a distributed-system model with a reusable actor-based fault injector and uses statistical model checking to predict throughput, latency and other metrics under configurable single or combined faults. The paper defines seven fault types (message loss, duplication, delay, tampering, equivocation, node crash, partition) as message-manipulating actors. A scheduler samples normal latency and orders in-flight messages; a priority-aware controller selects eligible behaviors; handlers can modify, duplicate, delay, drop or trigger environment changes. Composition preserves system rules and proves absence of nondeterminism (AND), enabling PVeStA/QuaTEx analysis. Preprocessing labels message-producing rules; transformation adds event monitors for throughput/abort metrics. The six-system study spans 2PC+CTP, Raft, PowerDNS, Cassandra, RAMP/OPW and Fast-HotStuff, and explicitly evaluates mixed equivocation+partition faults.
  • number: Six case studies; model/implementation LoC: 2PC 314/354, Raft 536/1400, PowerDNS 2200/4887, Cassandra 465/1402, RAMP 2523/7977, Fast-HotStuff 304/4247. PVeStA uses 95% confidence and 0.01 error margin on 2.4-GHz quad-core Xeon Emulab machines. Model curves for throughput/latency align closely with deployment evaluations; RAMP shows markedly higher latency than OPW as loss increases; Fast-HotStuff throughput declines with more equivocators and only moderately with combined partition.
  • number: six systems evaluated with model-versus-deployment curves
  • number: PerF uses 95% statistical confidence and 0.01 error margin
  • number: formal models range from 220 to 2,523 LoC and implementations from 354 to 7,977 LoC
  • limits: Maude probabilistic rewrite semantics and absence-of-nondeterminism are required for SMC. Delays come from user-chosen distributions (lognormal, Weibull, exponential), and fault rates/times/targets are configured abstractions. Accuracy is judged by curve trends up to an unknown deployment/model time-scale factor, not absolute values. The framework models faults as message interception, so faults outside message effects or inaccurate distributions are not covered. Experiments use six systems, one deployment per system and 95% confidence/0.01 error; deployment implementations and models differ in size and platform. Dynamic actor/message populations challenge automata-based alternatives but are not claimed solved generally.
  • how much was read: most of it read
  • source
  • record id: perf-fault-aware-performance-prediction-2026
• Phawade 2D-BMC DCModelChecker (2026)
  • title: Two dimensional bounded model checking for unbounded Petri nets
  • what: Introduces two-dimensional bounded model checking (2D-BMC) for unbounded Petri nets, bounding both execution length and token count, and implements SMT encodings in DCModelChecker 2.0 for LTL with linear integer arithmetic (LTLLIA) under interleaved and concurrent firing semantics. Sections 2–3 define interleaving versus concurrent firing, LTLLIA counting syntax/semantics, and loop/no-loop bounded semantics. Section 4 gives Algorithm 2, which enumerates macro-bound k and all (lambda,kappa) time/token pairs, plus SMT encodings for markings, loops, arithmetic terms and temporal operators. Section 5 describes PNML/ANTLR preprocessing, Z3 workflow and counterexample traces. Experiments compare 352 MCC fireability instances with ITS-Tools, test 320 fireability-cardinality properties across 20 models, and evaluate five synthetic unbounded nets against DCModelChecker 1.0, ITS-Tools and TAPAAL.
  • number: 2D bound k=lambda+kappa
  • number: 352 comparison instances; 7 false positives; confidence 0.90
  • number: 320 properties, 20 benchmarks, 1,280 runs
  • number: bound 100 explored without counterexample in workflow example
  • limits: 2D-BMC is bounded and incomplete: UNSAT means only that all traces within the explored bound satisfy the property. Current DCModelChecker 2.0 does not use truly concurrent execution on every run, and its encoding/tool is slower than ITS-Tools/TAPAAL in some categories. Formula translation caused seven false positives among 352 comparison instances (confidence 0.90). Concurrent firing removes intermediate interleaving markings, so semantics must match the intended system.
  • how much was read: most of it read
  • record id: phawade-2d-bmc-dcmodelchecker-2026
• Pischke-Yoshida top-down bottom-up (2026)
  • title: Top-down = Bottom-up: Sound and Complete Characterisations of Liveness by Multiparty Global Protocols
  • what: Develops a principal global-type synthesis algorithm from safe-and-live local typing contexts and proves that top-down global-type projection and bottom-up local verification characterize exactly the same live multiparty sessions (Ptop = Pbot) under precise synchronous subtyping, balanced global types, and coinductive full-merging projection. Beyond the headline equivalence, the paper gives operational semantics for processes, local contexts, and global types; a deterministic fair round-robin scheduler that linearizes independent interactions; termination and balancedness proofs for synthesis; a combined projection/subtyping relation establishing trace inclusion and principality; and a complexity bound O(n^2 b |Delta|^n) for graph synthesis. The Monte Carlo MapReduce example shows why subsumption removes an unused crash branch. The implementation includes four projection algorithms, process/local inference, safety/liveness checking, and global synthesis, and benchmarks literature protocols including MapReduce, independent workers, rings, wallets, e-voting, and binary counters.
  • number: Ptop = Pbot
  • number: PSPACE-complete synchronously
  • number: undecidable in the asynchronous semantics
  • number: O(n^2 b |Δ|^n) graph synthesis bound
  • limits: Assumes synchronous session semantics, finite guarded recursive local types, finite labels, safe-and-live input contexts, fair scheduling, precise synchronous subtyping, and balanced global types. Process-level liveness is undecidable, so bottom-up checks context properties that soundly imply it; synchronous context checking is PSPACE-complete and asynchronous liveness is undecidable. Synthesis can incur exponential syntactic expansion because recursive syntax cannot share branch subterms; benchmarks show stack overflow/timeouts on largest coinductive-full cases. Tool results cover representative examples rather than production deployments.
  • how much was read: most of it read
  • record id: pischke-yoshida-top-down-bottom-up-2026
• PLSemanticsBench (2026)
  • title: LLMs Lean on Priors, Not Programming Language Semantics (PLSemanticsBench)
  • what: A benchmark that tests whether LLMs follow explicitly given semantics of small imperative programs when the meanings of operators are changed. Models predict final states, rules or execution traces.
  • number: 162 human-adapted, 165 model-translated, 165 fuzzer-generated programs; median sizes 19, 106, 794 lines
  • number: 11 frontier LLMs; standard final-state accuracy about 90%, drops of 40-60 points under semantic changes
  • number: full-trace accuracy nonzero for only four models, best just 35%
  • number: 11 frontier LLMs; final-state accuracy about 90% on standard semantics, drops of up to 40–60 points under changes
  • limits: It uses one-shot prompting, not proof search with compiler feedback. It is not an upper bound for agents with tools.
  • how much was read: most of it read
  • source; notes: LLMs Lean on Priors, Not Programming Language Semantics (PLSemanticsBe; notes: LLMs Lean on Priors, Not Programming Language Semantics (PLSemanticsBe
  • record id: plsemanticsbench-2026
• Pono 2.0 (2026)
  • title: Pono 2.0: A Versatile SMT-Based Model Checker for Safety and Liveness
  • what: Presents an open, solver-agnostic SMT model checker supporting Btor2/SMV/VMT-LIB, multiple safety engines (BMC, k-induction, interpolation, IC3, CEGAR) and new liveness-to-safety and k-liveness engines. Version 2.0 adds VMT-LIB, Btor2 justice, ISMC/DAR interpolation engines, broader CEGAR and witness generation, portfolios and configurable Smt-Switch backends.
  • limits: Transition systems may be finite or infinite over SMT theories; properties are LTL safety or liveness. Completeness varies by engine: bounded BMC and k-liveness checks can be inconclusive, finite-index CEGP is explicitly incomplete, and correctness witnesses are not exported (invariants can be internally checked). Results depend on solver support and fixed resource limits.
  • how much was read: most of it read
  • record id: pono-2-0-2026
• Probabilistic OPA model checking (2026)
  • title: Model Checking Probabilistic Operator Precedence Automata
  • what: Introduces probabilistic Operator Precedence Automata (pOPA) for recursive probabilistic programs and model-checks context-free Precedence Oriented Temporal Logic. For the separated POTL fragment POTLfχ, it gives qualitative and quantitative algorithms and extends the construction to LTL. The paper defines support chains and separated ωOPBA, characterizes product-graph SCCs accepted by formulas, proves correctness and optimal complexity, and implements the algorithms in POPACheck/OPPAS. A Schelling coordination example demonstrates qualitative and quantitative checking and exposes the difficulty of solving nonlinear termination-probability equations.
  • number: qualitative POTLfχ model checking is EXPTIME-complete when threshold is 1
  • number: quantitative threshold <1 uses EXPSPACE
  • number: motivating pOPA has 288 states and 786 nonlinear equations
  • number: Z3 and cvc5 time out after 20 minutes; numerical approximation takes under 1 second
  • limits: The optimal results apply to the POTLfχ fragment and pOPA semantics; full POTL and some past operators remain open. Quantitative checking has exponential-space complexity and the prototype relies on numerical approximation when SMT solvers time out. The empirical study is one motivating program rather than a broad benchmark.
  • how much was read: most of it read
  • record id: probabilistic-opa-model-checking-2026
• Proof-based coverage (2026)
  • title: From Execution to Necessity: Proof-Based Metrics for Code Coverage (Short Paper)
  • what: Introduces proof-based coverage: translate a C program with an assertion to SSA and an SMT formula, extract an unsatisfiable core proving the assertion, and map core constraints back to source statements. Proof line coverage measures statements necessary for validity rather than merely executed. Defines Trace(P) and Proof(P), line coverage LC(P)=|Trace(P)|/|N(P)| and proof line coverage PrLC(P,T)=|Proof(P)|/|N(P)|. The prototype translates a restricted loop-free C subset to SSA/SMT and marks a minimal unsat core. The paper adds non-trace conditions using undefined-variable metadata, states Lemma 1 and Theorem 1 that proof statements share one execution trace, and derives PrLC≤LC. A Siemens TCAS experiment found lines repeatedly execution-covered but never proof-covered; replacing the relevant if with result=0 left all tests outputs unchanged.
  • number: TCAS source about 75 lines
  • number: about 500 TCAS test cases
  • number: fan example LC=11/15≈0.69
  • limits: Integer arithmetic approximates machine arithmetic; language subset omits loops and translation details. Minimal unsat cores are assumed and the solver is assumed deterministic despite generally returning non-minimal/multiple cores. Current encoding does not model short-circuit evaluation (sound but coverage may change), and scaling to larger datasets may be problematic. Theorem 1/PrLC≤LC rely on added non-trace conditions.
  • how much was read: most of it read
  • record id: proof-based-coverage-2026
• Pushdown Intersection Lower Bounds (2026)
  • title: Pushdown Model Checking Above the Cubic Bottleneck
  • what: Studies non-emptiness/model checking for a pushdown automaton intersected with k−1 NFAs over a constant-sized stack alphabet, proving conditional lower bounds that match known algorithms. The paper gives gadget reductions from k-clique, introduces the 2NPDA(k) hypothesis to explain cubic barriers, proves a linear-time equivalence framework for hardest fixed languages, and extends the lower-bound picture to constant alphabets and related language-theoretic problems.
  • number: Conditional lower bound O(n^{2k}|Σ| + n^{3k}) for PDA ∩ NFA^{k−1}
  • number: For constant-sized alphabets, conditional lower bound n^{3(k−1)}
  • number: Theorem 15 uses 3(k−1)-Clique hypothesis; no empirical runtime benchmark
  • limits: Main bounds are conditional on the combinatorial 3k-Clique hypothesis or the new 2NPDA(k) hypothesis. Results concern fixed k and pushdown/NFA intersection non-emptiness; they do not give faster algorithms or unconditional lower bounds. The cubic bottleneck is measured in automaton-state/input-size parameters.
  • how much was read: most of it read
  • record id: pushdown-intersection-lower-bounds-2026
• Qoreo (2026)
  • title: Qoreo: Choreographic Programming for Quantum Distributed Systems
  • what: Introduces Qoreo, a choreographic language for quantum distributed protocols combining local quantum computation, classical/quantum communication and linear typing, with endpoint projection to node processes. The paper proves local and choreographic type safety, endpoint-projection soundness and completeness, and deadlock freedom for well-typed projected networks. A Rocq mechanization and NetQASM extraction pipeline support simulation/deployment, with QKD-style examples and a runtime API.
  • number: Metatheory in Sections 3–5 is fully formalized in Rocq
  • number: Extraction emits Python/NetQASM processes for each participant
  • number: No quantitative performance benchmark is reported
  • limits: Deadlock-freedom and projection guarantees require well-typed/projectable choreographies and stated communication restrictions; not every choreography is projectable. The paper’s future work includes knowledge of choice and larger protocol families; extracted execution depends on NetQASM runtime/platform support.
  • how much was read: most of it read
  • record id: qoreo-2026
• Quantum protocols in UPPAAL (2026)
  • title: Analysis and Verification of Quantum Communication Protocols in UPPAAL
  • what: Defines a UPPAAL methodology for quantum protocol models: stabilizer-state locations for noiseless Clifford verification, and external C++ density-matrix functions plus statistical model checking for arbitrary noise and timing. Sender/receiver/quantum/monitor automata model Beyond Superdense Coding (BSDC); circular bit buffers check unbounded streams because of synchronization. Exact queries A[] not deadlock and A[] not Monitor.Error verify noiseless BSDC in under 0.1 s. Noisy models use 4-qubit 512-float density matrices, Kraus operators and decoherence; BBPSSW entanglement-distillation loops add timing/error effects. Reproduced NetSquid throughput (~1.5 bits/qubit) and error (~0.9), then explored IBM Miami timing data with 1,000-slot SMC runs.
  • number: Noiseless deadlock/correctness checks <0.1 s; throughput approaches 1.5 bits/qubit and mean error ~0.9 in NetSquid reproduction; optimal no-distillation slot 1 μs gives error 0.106; one distillation round slightly helps below 0.16 μs; 1,000-slot runs; exponential runtime 0.08/2.15/81.13/4,631 s for 4/5/6/7 qubits
  • limits: UPPAAL lacks exact probabilistic model checking, so noisy results are statistical and depend on floating-point C++ calls. Noiseless exact model is limited to finite Clifford stabilizer states; arbitrary density matrices scale exponentially (4 qubits 0.08 s, 5 2.15 s, 6 81.13 s, 7 4631 s). Model abstracts gate errors and currently assumes EPR generation on demand; hardware specifications are unavailable.
  • how much was read: most of it read
  • record id: quantum-protocols-in-uppaal-2026
• Rafieioskouei et al. HyPOLE 2026 (2026)
  • title: HyPOLE: Hyperproperty-Guided Multi-Agent Reinforcement Learning under Partial Observation
  • what: HyPOLE turns finite HyperLTL relational/temporal objectives into quantitative robustness rewards for value-based centralized training and decentralized execution. Universally quantified trace policies use local histories; existential traces use learned Skolem-witness/history representations, aided by a predictor of other agents’ state prefixes. Authors claim satisfaction-optimal policies under exact path reconstruction, optimal value learning and Individual–Global–Max factorization; simulations compare against shaped rewards across SMAC, MessySMAC and WildFire. The printed proof does not establish several required equivalences, recorded below. Complete witness/predictor construction, finite semantics, robustness equations, conditional theorem/proof chain, practical neural approximations, seven supplied tactic specifications, repeated-run performance and runtime overhead. Separates stronger semantic claims from the evidence and records concrete mismatches among path-consistency, logical satisfaction, maximum robustness, expected return and empirical pair frequency.
  • limits: Definition 3.1 uses a finite-state/action POMDP with initial distribution, transition/observation functions, state labels and discount γ∈(0,1]. Policies map observation-action histories to fixed actions. The logic uses finite episodes, strong-next length checks and until before the shortest assigned trace ends. Each quantified trace variable ranges over behaviors of its corresponding policy, not automatically all possible executions of a deployed system (§§3–4). A hyperproperty relates several executions; HyperLTL quantifies trace variables then applies a temporal formula to their joint behavior. ∀∃ allows a later existential witness to depend on preceding universal traces, while ∀∀ requires all combinations to satisfy the inner body. This changes the requirement itself, not merely an algorithmic tuning parameter. Claims that ordinary shaped rewards are inherently universally quantified are authors’ framing, not an established general limitation of arbitrary reward design (§§1–3.2). The semantic objective in Figure 3 maximizes the probability that sampled trace sets satisfy a HyperLTL formula, with histories drawn from each policy and mapped to most-likely paths using Φ. The sample-set cardinality and probability measure are not fully specified. This is not a model-checking guarantee over all reachable traces or a statistical lower confidence bound on satisfaction (§4). Skolemization gives one trace function f_i for each existential quantifier, depending only on preceding universally quantified trace variables; with no preceding universal it is constant. An ordered union preserves variable indices; zip combines traces pointwise, truncated to the shortest prefix. The proof relies on witness traces being realizable under the corresponding policy and history map, not arbitrary unrelated traces (§5.1, Equations 1–3, Appendix C). Section 5.3 defines H(t) as histories whose selected most-likely path induces t, assumes H(t) nonempty and chooses Ω(t)=Sel(H(t)). The ideal existential policy consumes Ω(f_i(…)), requiring preceding universal paths. At decentralized execution these paths are unavailable, so the implementation predicts them from its local history and learns the composite Ω∘f_i using an RNN. No general finite-state synthesis or causal realizability algorithm for arbitrary trace Skolem functions is proved (§5.3, Appendix D.2). Training uses global state/other-agent information through CTDE, with local execution using VDN, QMIX or QTRAN utility decomposition. Independent Q-learning is evaluated only for universal formulas. IGM (Individual–Global–Max) means joint greedy maximizing actions equal the tuple of local greedy maximizing actions. Theorem 5.3 assumes an actually optimal joint Q satisfying IGM; it does not prove neural training reaches that optimum. General Q need not fit additive/monotone factorization (§5.3, Definition 5.2, Theorem 5.3). Theorem 5.1 author claim: path-consistent Φ and policy tuples optimizing the Skolemized formula also optimize original-formula satisfaction probability. Theorem 5.3 author claim: optimal IGM-compatible joint Q induces decentralized policies optimizing Skolemized satisfaction. Appendix A.2 adds a material premise absent from the theorem box: during execution f_enc-dec accurately reconstructs the universal trace prefixes needed by witnesses. No finite predictor-error, sample-complexity, failure-probability or convergence-rate guarantee is provided (§§5.2–5.3, Appendix A). Path reconstruction gap, reader inference: §4 defines path-consistency only as the true generating path belonging to argmax Φ(h,·). Appendix A.1 strengthens this to the selected argmax coinciding with that actual path. Membership does not ensure a unique maximizer or trace-equivalent ties. Two hidden states labeled p and ¬p with the same observation and constant Φ have both paths in argmax; any fixed selected path is wrong for one latent case. Exact reconstruction needs uniqueness or an appropriate equivalence/tie assumption; arbitrary partial observation does not supply it (PDF3,13). Robustness equivalence gap, reader inference: Figure 9 defines atomic robustness c−f(L(s)), with min/max for conjunction/disjunction/temporal aggregation, but §§5.2/C.2 and Appendix A.1 assert satisfaction iff robustness converges to ρmax. A satisfying predicate can have any positive margin below the global maximum: with c=1 and f=.9, a constant satisfying trace has robustness .1, not 1 if another reachable state has f=0. Maximizing margin is stronger than Boolean satisfaction; the paper supplies no normalization making every satisfying finite trace attain a common maximum. Thus the asserted equivalence is not established by Figure 9. Return-to-probability gap, reader inference: Appendix A.2 moves from expected discounted cumulative robustness to maximizing the probability of satisfying the formula (or reaching maximum robustness). IGM only preserves greedy decisions for the learned Q and cannot justify that objective change. One-step fully observed example: a safe action always yields predicate margin .1; a risky action yields margin 1 with probability .9 and −.1 with probability .1. Expected robustness favors risky (.89>.1), while Boolean satisfaction favors safe (1>.9). This uses the atomic Figure 9 semantics and demonstrates the missing equivalence; no artifact run. Horizon/discount and repeated prefix rewards can introduce additional preferences (§5.3, Appendix A.2). Sample-set versus pair-frequency mismatch, reader inference: Appendix B says three of four pairs satisfy its ∀∀ inner body and reports .75. Under §3.2’s universal trace-set semantics, a fixed set containing a violating pair fails the ∀∀ formula as a Boolean statement. A .75 uniformly sampled-pair frequency is a different probability, requiring an explicit distribution/sampling event. The example’s ∀∃ witness and all-pairs proportion illustrate useful dependencies but do not resolve the Figure 3 set-satisfaction probability definition (PDF3–4,14). Finite-semantics boundary qualification: Figure 9 evaluates always/eventually/until over [ℓ,k), although the path segment and pointwise zip are described with endpoints through k; strong-next is stated only for k>ℓ. Its empty-trace convention and final-position cases need an explicit consistent convention before building a verified monitor. The supplied text contains no machine-checked equivalence between its Boolean monitor and quantitative monitor (PDF3,5,16). Specifications are supplied manually in Appendix G. Focus-fire combines all allies being in range of a common enemy, enemy health decrease, increasing kill count and eventual victory. Medivac adds staying near the lowest-health ally and comparing allied/enemy health loss, with universal versus existential healer. Corridor holds a choke point until damage/kills/win. Defense always keeps enemies outside observation range and allies above a health threshold. WildFire requires progress toward fire/victims, extinguishing/rescuing, drone range constraint and Med avoiding fire until mission completion (PDF19–20). Printed kiting formula uses ¬ready_i ∨ conjunction_j(dist(pos_i,enemy_j)<s_range_j), plus aggregate enemy damage/kills/victory; prose describes attacking only when the weapon is ready. The formula is a spatial/readiness condition and does not itself contain an explicit action predicate enforcing that attack description. The WildFire display also has duplicated dist( syntax. These are reasons to check the monitor implementation against the intended tactic, not evidence here that the evaluated implementation is wrong (Appendix G). Negative specification case: φ_bad removes explicit enemy-health-decrease guidance from focus-fire while retaining geometric/final victory terms; selected 3m results show almost zero win rate. Defense instead learns retreat/survival and nearly zero casualties rather than prioritizing victory. These show task metrics depend on the supplied requirement; a syntactically formal objective can still provide poor learning guidance (§6 Figure 8, Appendix G, Figure 20). Implementation on PyMARL uses ε exploration 1→.05 over 50,000 steps, replay capacity 5,000 and target-update interval 200 for all four learners; QMIX/QTRAN mixing dimension 64, with printed opt_loss=1,nopt_min_loss=.1. Feedforward predictor has three-layer encoder/decoder MLPs, ReLU hidden units, 256-unit second hidden layer, tanh output in [−1,1], Adam 10^−3 and MSE. Predictor buffer holds 10,000 recent observation/global-state pairs; minibatch 32, one gradient update as described. Loss-based intervals 50/100/1000 environment steps use thresholds 9×10^−5 and 9×10^−6. The text also says after each episode, leaving exact interaction with that schedule unclear (Appendix D.1–D.2). Nine SMAC maps: 3m,8m,2s3z,3s5z,MMM,5m_vs_6m,MMM2,bane_vs_bane,corridor. Five MessySMAC maps add observation noise ϕ=.15 and random initial K steps: K10 for3m, K12 for8m/2s3z/3s5z/MMM. Four two-drone WildFire maps:5×5 with1fire/1victim or3fires/2victims,8×8 and10×10 with3fires/2victims. Table1 lists8m as3Marines versus3Marines; preserve that printed inconsistency rather than deriving its unit count from the table (Appendices D–F, Tables1–2). SMAC baseline is its shaped damage/kill/win reward; preliminary sparse win/loss rewards reportedly performed worse. WildFire baselines give +20 per saved victim/extinguished fire and −10 for out-of-range/Med-in-fire; second adds +100 mission completion, third also −50 mission failure. These compare against three selected hand-built reward functions, not every reward design. WildFire observations contain movement/own/time features and visible relative entity coordinates/types/last actions; moves are Up/Down/Left/Right (Appendices E–F). Plots use median and 25th–75th percentiles across ten random-seed runs for SMAC/WildFire and five for MessySMAC. Each checkpoint uses32 test episodes in SMAC/MessySMAC and30 in WildFire, in test_mode for the combat environments. Appendix D.3 says train each agent for10k steps (SMAC/MessySMAC) or5k (WildFire), whereas plot axes extend to .5–5million total environment steps; this wording does not clearly distinguish checkpoint interval from total budget. No seed-level formal satisfaction confidence interval is supplied. Selected outcomes: corridor HyPOLE+QMIX reaches≈60% median win versus vanilla<5% after5million steps; Messy8m HyPOLE+QMIX/QTRAN reaches up to≈25% while vanilla gets no wins. ∀∃ healer in MMM and firefighter in WildFire can outperform universal variants; WildFire8P_3F2V VDN author reports convergence≈500K versus800K steps. These are selected curves, not uniform gains: 3m is similar across methods; 5m_vs_6m and some learner/map combinations offer little benefit or regress; MMM2 QTRAN remains0% wins; WildFire5P_3F2V QTRAN with baseline rewards2/3 beats its HyPOLE variant (§6, Appendix H, Figures5–8,10–19). Evaluation metrics are combat win rate, dead allies/enemies and WildFire steps to save/extinguish, plus qualitative strategy snapshots. They are not direct independent model checking of HyperLTL over all executions, nor proof that learned Skolem/predictor outputs meet their ideal premises. Quantifier variants change requirement strength and network inputs jointly; the supplied experiments do not separately isolate exact reconstruction error or formal witness validity (§6, Appendix H). Runtime overhead: Table3 on MMM reports baseline times2202/4294/6305/8377/10385 at200K/400K/600K/800K/1000K steps; universal HyPOLE2211/4453/6637/8918/11100; existential CTDE3366/6821/10260/13659/16871. Table gives no explicit time unit. Last-column arithmetic gives≈6.9% and62.5% overhead; authors say about6% and62%. Existential row averages only VDN/QMIX/QTRAN, whereas other rows are labeled MARL, so it is not a clearly identical-method aggregate comparison. Measurement uses EPYC7742 and one RTX A6000; overall experiments also use RTX8000 and RTX PRO6000 Blackwell machines (Appendix D.3/H.4, Table3). Authors limit current implementation to discrete-action value methods and identify writing precise specifications as a main difficulty; AI specification generation is proposed future work. This paper does not evaluate LLM-written specifications/proofs or provide Verus, Rust, TLA+ or a mechanized theorem artifact. Its relevance is direct to formal specification of multi-agent behavior, semantic preservation and evaluating conditional guarantees versus observed task success. No artifact execution.
  • how much was read: most of it read
  • source
  • record id: rafieioskouei-et-al-hypole-2026-2026
• REAL Ramsey elimination (2026)
  • title: Fast Ramsey Quantifier Elimination in LIRA (with applications to liveness checking)
  • what: Presents REAL (Ramsey Elimination for Arithmetic Logic), a solver-agnostic implementation eliminating Ramsey quantifiers from existential LIA, LRA, and LIRA formulas, with SMT-LIB extension and Alchemist translation from FASTer/Armoise reachability relations. The resulting existential formulas can be solved by standard SMT solvers to check liveness/termination. The paper defines the infinite-clique semantics and gives a worked arithmetic elimination argument using arithmetic progression witnesses. REAL adds SMT-LIB parsing/export, formula sharing and normalization, and compact Boolean/theory encodings. The FASTer pipeline verifies McCarthy91 termination and checks liveness of sliding-window, Lamport bakery, and cache-coherence protocols (SYNAPSE, Berkeley, Dragon, futurbus, MOESI). On eight pipeline benchmarks, REAL elimination/solving times and formula sizes are reported; parameterized integer/real families scale near-linearly in elimination, with solving dominating, and comparison to the prototype shows orders-of-magnitude speedups.
  • number: eight liveness benchmarks
  • number: dimensions 10, 100, 1000
  • number: McCarthy91 REAL 7.834s elimination and 853.53ms solving
  • number: futurbus FAST 125.95s and REAL 28.570s
  • limits: Ramsey elimination applies to existential linear arithmetic; liveness claims depend on FASTer computing a sound reachability relation and on the encoded fairness/model assumptions. The Lamport bakery starvation check fails without fairness assumptions. Mixed LIRA has substantial overhead because integer and real variables are separated; large benchmark solving times reach hundreds of seconds. The paper does not provide completeness beyond the supported arithmetic fragment or direct comparison on identical prototype benchmarks.
  • how much was read: most of it read
  • record id: real-ramsey-elimination-2026
• Reality Is the Final Verifier: On Two Key Gaps in Agentic Software Engineering (2026)
  • what: Argues that verification stops short in two places. The written requirements may not match what the stakeholder wants (the requirement gap). The model used to evaluate code may not match the real environment (the model gap). Proposes an inner loop, which revises code against the requirements, the environment model and the evaluator. Proposes an outer loop, which uses observations from deployment to revise those inputs.
  • number: no new theorem, experiment, or implementation proof; Table 2 incidents are cited from other reports
  • number: No measured completion rate or human-hours; Table 2 incidents are cited from other reports
  • limits: A proposed architecture. No measured rate of autonomous completion and no human-hours result.
  • how much was read: most of it read
  • source; notes: Reality Is the Final Verifier: On Two Key Gaps in Agentic Software Eng; notes: Reality Is the Final Verifier: On Two Key Gaps in Agentic Software Eng
  • record id: reality-is-the-final-2026
• Robot supervisor synthesis audit (2026)
  • title: Realizability Is Not Enough: Encoding, Liveness, and Auditing of Synthesized Robot Supervisors
  • what: Builds an open-source ROS2/FlexBE pipeline that generates capability-based GR(1) specifications, performs well-separation analysis, synthesizes with slugs, audits explicit Mealy strategies, merges equivalent states with a proof, and emits executable HFSM supervisors. Four domains compare one-hot versus enumerated capability encodings and Fair-Outcome versus System-Goal liveness. Formalizes activation/outcome protocols and pending memory, explains how Fair-Outcome assumptions can be falsified by system-controlled retry bookkeeping, and introduces a post-synthesis explicit-state auditor. The auditor is sound and complete for protocol violations, deadlocks, bounded-failure violations and goal-unreachable SCC traps under completed exploration. A reducer is proven to preserve core capability output traces while explicitly documenting that pending propositions and full GR(1) winning status need not be preserved. Experiments expose ordering sensitivity and the gap between realizability, structural progress and executable deployment.
  • number: Two-Rivers one-hot raw 37 states and reduced 23; enumerated raw 26 and reduced 23
  • number: P0 2FP/3FP: all 44 trials flagged GOAL_UNREACHABLE_TRAP
  • number: P1 one-hot System-Goal 25,841.977 s versus enumerated 235.193 s in reported fixed ordering
  • number: Crazyflie System-Goal: one-hot 19.730 s and 76.7 reduced states; enumerated 9.275 s and 106 reduced states
  • limits: Results are for the GR(1) fragment, slugs/CUDD backend, sequential one-active-capability protocol, finite explicit strategies, and specified goal labels. Well-separation diagnoses game-level assumption falsification but is not a deployment certificate; the auditor is not a general fairness/liveness verifier and leaves SCCs with optional exits unflagged. Reduction preserves capability-level traces, not all auxiliary propositions. Physical correctness and indefinitely failing capabilities remain outside guarantees.
  • how much was read: most of it read
  • record id: robot-supervisor-synthesis-audit-2026
• Rocq MPST liveness (2026)
  • title: Formally Verified Liveness with Multiparty Session Types in Rocq
  • what: Reports Rocq mechanization of safety, deadlock freedom and liveness for a synchronous multiparty session calculus. Uses coinductive local/global type trees, process-oriented subtyping, plain-merge projection and association of local environments to balanced, well-formed, projectable global types. Operational correspondence plus induction on finite grafting contexts proves associated environments live on fair paths; session typing transfers guarantees to processes. Authors report about14K added Rocq lines, with public/archived source and classical choice/excluded-middle assumptions explicitly used in path construction. Records exact balancedness, well-formedness and projectability standing assumptions; asymmetric label matching under subtyping; environment versus session liveness quantifiers; mixed fixed-point path encoding; graft-height proof and its constructive_indefinite_description use; fair-session-path construction with excluded_middle_informative; stuck-recursion definition repair; precise output safety and synchronous reactive-semantics limits. Earlier record omitted axioms and conflated environment path guarantees with the existential session definition.
  • number: About 14K lines of Rocq
  • limits: Simple synchronous, rendezvous communication calculus, not asynchronous network queues. Guarded recursion, finite nonempty labeled branch sets, conditionals, sends/receives and inactive processes; values/expressions include bool/int/nat and nondeterministic choice. No crashes, Byzantine behavior, loss, timeout or network implementation are modeled. Subsorting is reflexive with nat≤int. Communication payloads are typed but do not encode arbitrary dependent data properties. Processes/sessions are inductive syntax, recursive variables encoded with natural indices; local/global types are possibly infinite coinductive trees corresponding to guarded recursive syntax. Continuations are lists of optional branches: label index k exists only for Some, not None/out-of-bounds. Raw Rocq constructors allow lists without valid branches; environment well-formedness tctx_wf imposes nonempty well-formed local trees. Participant maps use natural-number keys, disjoint domains for composition, and MMaps extensional equality M.Equal. Standing assumptions after Remark3.8: global types satisfy wfgC, encompassing inherited well-formedness/balancedness, and projectableA. Balancedness: for every subtree there is a finite depth k by which each participant in that subtree appears on every path long enough or ending. This is a structural protocol requirement, not scheduler fairness. Theorem5.8/6.9 concise statements suppress these standing conditions; arbitrary global trees or any collection of locally typed processes do not receive the theorem. Projection is coinductive plain merge. A participant at a root send/receive gets corresponding local branch; an uninvolved participant must project all continuations to the same local type. Absent participants project end. Stronger full merge is future work; projectability is assumed rather than proved for every global syntax. Process-oriented subtype may receive more labels and wider input sorts, or send fewer labels and narrower output sorts; continuations subtype coinductively. Association Γ⊑G requires every participant of G in Γ with Γ(p) subtype of its projection; any extra environment participant is absent or end. Local environments have individual send/receive readiness and synchronized reductions requiring compatible sorts. Global reduction permits root branch selection and disjoint communication in all branch continuations; printed GR-Ctx also requires both root participants in every continuation. Association is more than matching syntax, and must be preserved under reduction. Theorem4.8 soundness: if G can communicate between p/q under labelℓ, Γ can communicate between the same participants with possibly different labelℓprime, and both resulting objects remain associated. It does not simulate every exact global choice. Theorem4.9 completeness: each Γ synchronized step has the same-label G step preserving association. Counterexample in Remark4.10 has a sender restricted toℓ0 while the global type allowsℓ0/ℓ1. Calling this bidirectional same-label bisimulation would be inaccurate. Environment safety coinductively requires every mutually ready sender/receiver to synchronize using the sender label and compatible payload sorts, preserved under all synchronized reductions. It does not require a counterpart ready for every unilateral request; safety is distinct from progress. Example5.2 int sender/nat receiver is unsafe because int is not a subtype of nat. Associated environments satisfy Theorem5.3. Paths may be finite or infinite. Fairness Definition5.4: whenever synchronized pair(p,q) is enabled at positionn, some later communication of that same ordered pair occurs, possibly with a different label. It is pair fairness, not fairness of every branch label. Live paths require every unilateral send or receive request eventually gets its corresponding pair communication. An environment is live if every fair path from every reachable reduct is live. The universal condition is over fair paths only; unfair starvation schedules are excluded. Paco encodes coinductive predicates as greatest fixed points of parameterized inductive relations. Paths are cosequences with conil/cocons; eventual is inductive least fixed point, alwaysCG coinductive greatest fixed point. This avoids explicit index bookkeeping and Rocq native cofix guardedness limitations. These are proof representations, not a runtime scheduler or finite model checker. Balancedness supplies a finite p-grafting context containing no p, with holes beginning at p-related communication or end. Theorem5.8 first proves liveness for direct projections (actual Rocq uses equivalent global enabledness predicate), using height of p-grafting versus q-grafting as a decreasing induction measure until the pair becomes enabled, then fairness forces communication. Proof transfers to subtyped Γ by associating paths pointwise and preserving transition labels. Detailed grafting/projection definitions and inherited results are referred to [16]/[20]. Theorem5.8 path lifting extracts witnesses of Theorem4.9 from Prop to construct a CoFixpoint cosequence, explicitly using constructive_indefinite_description. Theorem6.9 additionally constructs a fair session path using constructive_indefinite_description and excluded_middle_informative. Thus reported machine checking has these logical assumptions; do not describe the whole development as axiom-free or constructive merely because it uses coinduction. Full artifact assumption audit/build was not performed. Reactive semantics folds finite internal conditional evaluation/recursion unfolding into communication transitions using an unfolding relation; no explicit τ-only LTS transitions. Structural congruence rearranges parallel composition/unit. This lets subject reduction match each session communication with exactly one same-label environment step, rather than a weak simulation with silent stuttering. Does not establish equivalence to arbitrary calculi with internal divergence or a concrete distributed runtime. Table2 session rule requires each component process be typed by an environment already associated with a suitable global type. Lemma6.1 preserves typing through unfolding. Theorem6.2 sends every session step to a same-label type step; Theorem6.3 permits a type step to be matched by a same-participant session/type step with potentially different label. Theorem6.5 explicitly guarantees the sender label belongs to the waiting receiver branch set in every reachable unfolded typed session. Theorem6.6 says a typed session either can communicate or every unfolding can further reach all-inactive processes, not global termination. Session liveness Definition6.7 is an existential continuation property at every reachable unfolded send/receive: from that unfolded state there exists a finite reduction sequence reaching the corresponding continuation. It is not syntactically the environment definition quantifying every fair path. Authors identify it as Padovani lock-freedom/lock-freedom under full fairness; Theorem6.9 proves it by choosing a fair session path, lifting it to a fair live environment path, then extracting a finite communication prefix. No bounded latency or unconditional all-schedules termination theorem is claimed. Remark6.8 repairs a prior liveness formulation that started its required continuation at the pre-unfolded state. In stuck sender µX.q!ℓ(0).X with q inactive, the original state coincides with the apparent post-send recursion, allowing zero steps to fake progress. Their definition starts at the unfolded pending-send state, excluding that example. This is a semantic definition correction, not a discovered bug in their checked theorem. Printed Table1 R-comm has p receiving from q but labels the communication(p,q), whereas Definition4.2 and environment/global send rules use(p,q) for p sending to q. Read literally this reverses the sender/receiver order and conflicts with same-label subject reduction for a one-way session. Likely presentation convention/typo; this reading has not checked artifact definitions and does not establish a Rocq inconsistency. Endpoint order should be checked before transcribing the rule into another verifier. Examples4.4/4.7/5.6 use G=p→q:{ℓ0(int).G,ℓ1(int).q→r:ℓ2(int).end}. The infiniteℓ0 path is fair under pair fairness, since p/q always communicate, but r waits forever. G is projectable and associated yet unbalanced. This is an explicit negative example outside standing balancedness, demonstrating why association alone is insufficient for liveness. The finiteℓ0,ℓ1,ℓ2 path terminates and is fair/live. Reported contribution around14K lines is added code on top of prior subject-reduction development [16], not necessarily whole artifact size. Proofs of subject reduction/deadlock freedom were rewritten for environment-based typing; operational correspondence, environment safety/liveness new. No checking-time, memory, theorem counts, admitted-proof count, dependency audit, industrial protocol benchmark or verified endpoint extraction measured here. Paper links GitHub omerskeskin/mpstlive and an SWH archive; reader has not built or audited artifact. First mechanization claims are author-qualified to their knowledge and not independently surveyed here. No completeness theorem saying every live session typable is provided. Fair termination is explicitly stronger; stronger liveness under instruction fairness or justness may require different global types/projection. Full merge, other calculi and weak simulation support are future work, not delivered extensions. Crash-stop/asynchronous association results mentioned are other work. Explicit declaration says no AI-generated text or code is present. This is authors stated provenance, not an independent audit. No Verus, Rust or TLA+ implementation delivered. For the human goal the value is a checked metatheory template with explicit fairness, logical-choice, model and correspondence assumptions; connecting it to verified Rust/network execution requires additional refinement and runtime proofs. Entire supplied21-page conference PDF read; no separate arXiv2605.23633 or cited background paper read in this batch. Existing multi-source record replaced, preserving aliases and archived original rather than treating prior abstract/incomplete text as a fresh whole read. Confidence about mechanized results is based on paper and reported source availability, not a fresh Rocq build.
  • how much was read: most of it read
  • source
  • record id: rocq-mpst-liveness-2026
• RustyDL: A Program Logic for Rust (2026)
  • what: Presents RustyDL, a source-level dynamic logic and sequent calculus for a safe Rust subset, plus a Rusty KeY prototype. The logic models ownership moves, shared and mutable references, arrays, integer overflow, loops and non-standard control flow directly over Rust compiler HIR, aiming to support inspectable human-in-the-loop proofs instead of translating to an intermediate language. RustyDL maps Rust primitive, array and reference types to logical sorts, uses mutating updates for mutable borrows, and treats moved values with fresh constants. Dynamic-logic box/diamond modalities express partial/total correctness; updates decompose deterministic state changes. Symbolic-execution rules split conditionals, model moves and borrow/deref/mutation operations, branch on debug-mode overflow versus panic, and check array bounds. Loop-scope rules record break/continue/return exits and permit invariants for Rust loops that compile to unconditional loops. The prototype implements taclets in KeY and demonstrates borrowing, loops, arrays, tuples and enums; a binary-search proof is reported.
  • number: 4,260 rule applications for binary-search proof in 2.1 s
  • number: safe-Rust subset; lifetimes, traits, iterators, pattern matching and generic functions deferred
  • limits: The logic focuses on safe Rust and assumes unsafe code is encapsulated and separately verified. It covers primitive values, shared/mutable references and arrays; structs/enums are analogous, while unions, smart pointers, traits, lifetimes and a fuller specification language remain future work. Rust programs are assumed deterministic; the Rust transition function is left abstract and rule soundness is described as relative to ongoing formal semantics. Integer rules target debug semantics and must prove absence of overflow. The KeY proof system is not foundational and relies on integer/sequence theories. Verification is a proof of concept with limited automation, not a mature benchmarked verifier.
  • how much was read: most of it read
  • source
  • record id: rustydl-a-program-logic-2026
• SA interval abstraction (2026)
  • title: Effective Stochastic Automata Model Checking by Interval Abstraction (extended version)
  • what: Presents a dedicated stochastic-automata model-checking method that abstracts continuous timer distributions into probability intervals and applies big-time-step semantics to construct an MDP. Value iteration returns lower and upper bounds on minimum and maximum reachability probabilities. The paper defines the abstraction and refinement process, extends Modest and Jani input support, and supplies a Rust prototype. Evaluation covers small stochastic automata, bounded M/M/1/100 and Weibull/Erlang queues, and file-server models compared with mcsta’s STA digital-clocks approach. The study reports how interval granularity affects accuracy, state-space size and runtime.
  • number: M1 at pI=0.01: result [0.245, 0.755], 82,657 MDP states, 1.6 s
  • number: M5: result [0.117, 0.883], 260,395 states, 20.6 s
  • number: queue 150/200 jobs: M/M/1 total runtime 95.0/143.8 s; Weibull total runtime 96.8/137.4 s
  • number: queue abstractions have 2,229,270–3,334,270 MDP states
  • limits: The abstraction produces bounds whose tightness depends on per-interval probability and interval generation; smaller intervals can cause large MDPs. The queue experiments use finite buffers and bounded arrival counts, and the file-server model replaces continuous nondeterminism and an initially uniform queue with specific distributions/empty-queue initialization. The implementation is a prototype; exponential interval choices can be much slower and run out of memory, and future work includes deterministic delays and time-bounded properties.
  • how much was read: most of it read
  • record id: sa-interval-abstraction-2026
• Schirrmacher et al. FO+dp (2026)
  • title: Model Checking Disjoint-Paths Logic on Topological-Minor-Free Graph Classes
  • what: Proves an algorithmic meta-theorem: model checking first-order logic extended with vertex-disjoint-path predicates is fixed-parameter tractable on graph classes excluding a fixed graph as a topological minor, with runtime f(H,phi)*n^3 and a witness tuple when the formula is true. Proof strategy decomposes graphs into strongly unbreakable tree decompositions, collapses FO+dp predicates to FO on unbreakable regions containing large clique minors, computes bounded-size folio/type-preserving representatives for boundaried subgraphs, proves compositionality under gluing, and runs a bottom-up dynamic program. The collapse uses generic folio and partition-linkedness lemmas; replacement preserves topological-minor exclusion, unbreakability, and annotated types. The result improves the earlier minor-free theorem and yields O(f(k)n^3) applications such as F-Topological Minor Deletion when a large clique certifies a no-instance.
  • number: f(H,phi)*n^3
  • number: O(f(k)*n^3) F-Topological Minor Deletion
  • number: q(k) in 2^{O(k)} decomposition bound
  • number: extended folio representative size computable
  • limits: Assumes a finite colored graph and an excluded fixed topological minor H; the parameter dependence f(H,phi) is computable but can be very large. The algorithm is uniform and does not need H as input, although runtime depends on it. It handles subgraph-closed topological-minor-free classes; dense non-subgraph-closed classes and constant-time postprocessing queries remain open. The dynamic program relies on deep decomposition, irrelevant-vertex, folio, and bounded-treewidth machinery; no implementation benchmark is reported.
  • how much was read: most of it read
  • record id: schirrmacher-et-al-fo-dp-2026
• Schwarzweller GALOIS_4 finite correspondence 2026 (2026)
  • title: The Fundamental Theorem of Galois Theory
  • what: Schwarzweller completes a Mizar series formalizing the finite Galois correspondence. Intermediate fields K correspond bijectively and with reversed containment to subgroups Aut(E,K); the inverse sends a subgroup to its fixed field. The article proves degree/order/index formulas, isomorphism–conjugacy equivalence, normality criteria and a restriction quotient theorem. It also shows that the two maps exchange joins and meets for binary and nonempty families. Records the finite-Galois guard, the extension-of-isomorphisms dependency, distinct assumptions for defining restriction versus proving it onto, and nonempty-family scope. Distinguishes normality of K/F from E/K being Galois, and generated lattice joins from set unions. Separates this culmination of imported results from an independently rerun artifact or comparison with Lean.
  • limits: MML GALOIS_4 version 8.1.15 5.100.1509 identifies the article. The Introduction calls it the last of five articles and cites earlier Mizar field extensions, simple extensions and splitting-field work. It points to a similar Lean development but offers no measured comparison of proofs, automation or checker performance (pp.9,16). Results 1–3 characterize a normal subgroup by conjugation invariance and, for strict subgroup H, by being a homomorphism kernel. Definition 1 packages subgroup index as a cardinal; Definition 2 packages conjugacy for groups that are subgroups of the ambient group. These representation/strictness guards are retained rather than identifying arbitrary isomorphic subgroup records literally (p.10). Definitions 3/4 form h(K) as the induced subfield on the range of h restricted to carrier K. For finite E/F and normal intermediate K/F, results 4–6 make each F-fixing E-automorphism restrict to an F-fixing K-automorphism, preserve composition under restriction, and stabilize K as a field. Result 7 gives a fixed-field inclusion. Normality and finite-extension premises are explicit, not assumed for all intermediate fields (p.11). Result 8 uses a normal extension represented as a simple algebraic adjunction to identify it as a splitting field of the generator’s minimal polynomial. Result 9, for finite Galois E/F, extends any F-fixing isomorphism K1→K2 between intermediate fields to an F-fixing E-automorphism. Its sketch chooses a primitive generator and invokes splitting-field extension results. The imported extension-equivalence symbol and proofs of those dependencies were not independently audited (pp.11–12). Results 10/11 transport fixing groups and fixed fields under an automorphism using the corresponding conjugate subgroup; their inverse/conjugation order depends on the imported convention. The record uses these as stated, without silently treating conjugated subgroups as equal or an F-isomorphism of fields as literal field equality (p.12). Results 12/13 identify the existing maps Ψ_E(K)=Aut(E,K) and Φ_E(G)=Fix(E,G). Under finite Galois E/F, 14–16 make them inverse bijections; 17/18 recover every intermediate field/subgroup by applying both maps; 19/20 give reversed containment in both directions. The correspondence is over intermediate fields inside this E and subgroups of Aut(E,F), not over all abstract fields/groups (pp.12–13). Result 21 gives [E:K]=|Aut(E,K)| and [K:F]=[Aut(E,F):Aut(E,K)]. Result 22 equates F-isomorphism of K1,K2 with conjugacy of their fixing subgroups in Aut(E,F), using 9,17,11. Isomorphism does not force the intermediate fields to coincide in general; nor does subgroup equality mean merely equal order (p.13). For every intermediate K of a finite Galois E/F, 23 says E/K is Galois. Result 24 says K/F is Galois iff K/F is normal; separability comes from the enclosing finite Galois setting. Results 25/26 equate this normality with invariance under every F-fixing E-automorphism and with Aut(E,K) normal in Aut(E,F). It would be wrong to infer every K/F is Galois merely because E/K always is (p.13). Definition 5 defines the restriction homomorphism ρ(K):Aut(E,F)→Aut(K,F) for finite E/F and normal K/F, without requiring E/F Galois. Results 27/28 give the associated fixed-field inclusion and kernel Aut(E,K). Surjectivity in 29 adds finite Galois E/F. Result 30 therefore obtains Aut(K,F) isomorphic to Aut(E,F)/H when H=Aut(E,K) is normal, using 26,28,29 (p.13). Results 31/32 give binary field/subgroup lattice inclusions for arbitrary extensions. Under finite Galois E/F, 33/34 upgrade them to equalities: field meet becomes subgroup join, field join becomes subgroup intersection, and fixed fields exchange the analogous operations. Join means the smallest containing field/subgroup, generally not the set union; a union of two subgroups may not even be a subgroup (p.14). Definitions 6/7 collect the pointwise Ψ/Φ images of nonempty families; 35/36 identify those image families explicitly. Results 37/38 recover a family by both maps under finite Galois E/F. Results 39/40 give general-extension lattice inclusions; 41/42 give equality and reversal for nonempty families in the finite Galois case. The article’s printed square union/intersection notation and raw extraction S/T must be read as lattice join/meet, consistent with its Introduction, not arbitrary set operations (pp.10,14–15). The family theorems explicitly require nonempty M. Empty-family top/bottom conventions are not handled by their printed statements. In 42, M is a family of subgroups of Aut(E,F), not a mere subset of individual automorphisms; the Introduction’s shorthand wording is less precise than the typed theorem (pp.10,14–15). Reading example, not printed: E=Q(sqrt2,sqrt3), F=Q has group C2×C2. For K=Q(sqrt2), its fixing subgroup consists of identity and the sign change of sqrt3; [E:K]=2 and [K:F]=2 match order and index. K1=Q(sqrt2), K2=Q(sqrt3) have meet Q and join E, while their order-2 fixing subgroups generate the full group and intersect in identity. Every subgroup is normal, so these quadratic intermediate extensions satisfy the quotient conclusion. Reading scope check, not printed: E=Q(cuberoot2) is finite but not normal over Q and has only the identity Q-automorphism. Its full fixed field is E, not Q, so the recovery identity 17 cannot be generalized to every finite extension. The article does not state the infinite-Galois correspondence or its topology/closed-subgroup qualifications. All eight pages, seven definitions, 42 results with every clause and supplied sketches, registrations, 15 references and dates read; both sheets and enlarged p.15 inspected. Quotations are exact plaintext excerpts, with separately labelled visual transcriptions for lattice formulas damaged by extraction. This reading did not execute formal artifacts. The paper reports no proof time/size, empirical or automation benchmark, and no distributed/Verus/Rust/TLA+/LLM-agent experiment.
  • how much was read: most of it read
  • source
  • record id: schwarzweller-galois-4-finite-correspondence-2026-2026
• Second-Order Hyperproperty Complexity (2026)
  • title: Complexity of Model Checking Second-Order Hyperproperties on Finite Structures
  • what: Analyzes Hyper2LTL model checking on finite tree-shaped and acyclic structures and its Fixpoint Hyper2LTLfp fragment, proving decidability and tight complexity bounds. The paper proves PSPACE-completeness on trees and EXPSPACE-completeness on acyclic models for unrestricted Hyper2LTL, while the fixpoint fragment is P-complete on trees and EXP-complete on acyclic models. It also gives alternation hierarchy results and combined-complexity bounds, motivating the fragment for monitoring growing trace sets.
  • number: PSPACE-complete on trees
  • number: EXPSPACE-complete on acyclic models
  • number: P-complete Fixpoint fragment on trees
  • number: EXP-complete Fixpoint fragment on acyclic models
  • limits: General Hyper2LTL model checking is undecidable on unrestricted structures; the tractability results rely on finite tree/acyclic shape. Formula-size complexity analysis is preliminary/incomplete and left for future work.
  • how much was read: most of it read
  • record id: second-order-hyperproperty-complexity-2026
• Securing the Foundations of an Intermediate Language for Probabilistic Program Verification (2026)
  • what: Formalizes in Lean/mathlib a chain from probability spaces for discrete-time Markov chains through optimal expected costs of MDPs and sound expectation calculi to correctness of HeyVL encodings for probabilistic programs. Covers unbounded loops,nondeterminism,resource ticks and failed observations. Adds a fault-tolerant calculus to establish liberal-preexpectation soundness with conditioning,and idle k-(co)induction that preserves values of variables unmodified by the loop. Provides a deep embedded verification-condition generator and a small interactive proof case. This is foundational encoding/logic verification,not end-to-end verification of the production Caesar implementation or a new distributed-protocol case study. Theorem3 constructs a probability measure over infinite valid paths with cylinder probabilities equal to finite transition products; reconciles textbook path cylinders with mathlib measure cylinders via successor-of-finite-path spaces,Ionescu-Tulcea and pushforward. History-dependent deterministic schedulers induce Markov chains whose states are paths. Expected nonnegative extended-real cost is a supremum of finite-horizon path sums. Theorem12 gives angelic/maximizing Bellman least-fixed-point equality generally; Theorem19 gives demonic/minimizing equality for finitely branching MDPs by constructing an optimal memoryless scheduler,avoiding an unjustified interchange of infimum and supremum. pGCL has dependent typed states and shallow function-valued expressions inside a deep program syntax; small-step rules lead to a sink-extended operational MDP. The soundness recipe sandwiches an expectation transformer against a higher-order Bellman least fixed point. wp includes tick costs and a least loop fixed point; wlp uses one-bounded expectations,a greatest loop fixed point and ignores ticks. wfp uses least loop fixed points and counts failed observations; complementing expectations and swapping the nondeterminism optimization relates it to wlp. Conditional expectation is defined as wp/wlp(1),rather than a compositional transformer. Idle induction checks states agreeing with the initial values of all unmodified variables. HeyLo is deeply embedded with Nat,ENNReal,Bool variable types; HeyVL is loop-free and its computable vp produces formulas. Syntax-level spGCL loops carry invariants. Encoded wp overapproximates wp; encoded wlp underapproximates wlp. Assuming a candidate bound,encoding the program and asserting the postexpectation yields a sound bound when the VC is valid. Loop encodings use modified-variable havoc and validate,with dual operations for upper bounds.
  • number: {‘supplied_PDF_pages’: 21, ‘figures’: 8, ‘NatLog_proof_lines_reported_approx’: 11, ‘displayed_loop_encoding_k’: 0}
  • limits: MDP transitions are PMFs: discrete probabilities,not arbitrary continuous-distribution kernels. Every state has an enabled action. Costs are nonnegative extended reals; state space may be infinite. General angelic Bellman theorem and finitely-branching demonic theorem have different assumptions. Finitely branching means both successor states and enabled actions are finite at each state; the pGCL operational model satisfies finite-step branching. Memoryless optimal scheduler construction is for the demonic cost problem,not a universal optimality theorem for all objectives. wlp and wfp operate on expectations bounded by1; wlp loop invariants and wlp postexpectations must respect this bound. Failed observations are distinguished from nontermination and successful termination. Conditional rescaling is defined via wp/wlp,not given an independently compositional rule. wp soundness for expected cost does not by itself prove that every program terminates: unbounded loops/nontermination remain represented by the semantics. Almost-sure termination and finite expected runtime are distinct,as the introduction explicitly warns. HeyLo embedding limits variable types to Nat,extended nonnegative reals and Bool for expression reification,while underlying pGCL state types are more general. HeyVL has no loops/recursion; loop reasoning depends on encoded invariant rules. Authors report formalization on Lean/mathlib and provide a Zenodo DOI and linked Paper.lean theorem index. This reading did not inspect source axioms/admissions,recheck Lean,run Caesar or audit correspondence with the actual Caesar implementation. The proved embedding/encodings do not establish SMT/model-checker implementation correctness. Related almost-sure termination verification for randomized distributed algorithms is cited as a prior Caesar application,not verified as a concrete case in this paper. GenAI declaration limits LLM use to formatting code snippets; no LLM proof-agent experiment.
  • how much was read: most of it read
  • source
  • record id: securing-the-foundations-of-2026
• Simplicial Actions for Distributed Protocols (2026)
  • what: # Simplicial Actions for Distributed Protocols (authored by agents unless marked 🧑) Philip Sink represents distributed communication steps as actions on simplicial models of knowledge and belief. The main contribution is a mathematical representation, with worked examples and six claimed structural results. It is not an implemented verifier or an experimental comparison. Some universal protocol claims need qualifications: the printed proofs do not establish that every input perspective has an output, and the revision proof confuses one preimage with all preimages. Concrete reader counterexamples are given below, separately from the author’s claims. This read covers arXiv:2608.16881v1, 17 August 2026: all 31 pages, 24 references, 37 figures, definitions and all proofs in §8. All page renders were inspected through eight contact sheets; pages 2,16,20,29,30,31 were additionally viewed at full size. The official and inventory PDFs are byte-identical. The only PDF hyperlink is its arXiv page. No implementation or supplementary artifact is claimed here; simulation is explicitly future work. ## Definitions and intended results A node is an agent’s local perspective; its color identifies the agent. A face is a compatible set of perspectives, and a facet is a maximal such face. The paper assumes uniquely colored facets (UCF): every facet has exactly one node per agent. Node assignments give each propositional atom one of three values: true, false or unspecified. A global facet is propositionally consistent. Knowledge quantifies over facets sharing the agent’s node. Belief instead quantifies over an agent-specific subcomplex, permitting a false view of the world (§2). If no considered facet shares a node, the universal belief condition can hold vacuously; seriality is not separately imposed. The protocol definition uses an input complex, an output complex and an execution map from input faces to collections of output faces (§3, Definition 3.1). It requires monotonicity, preservation of intersections, equality of the input and output color sets, and coverage of the output by the execution map. Those are structural representation conditions, not agreement, termination, validity or resilience specifications for a consensus implementation. Section 4 first explains ordinary Kripke action models. Output worlds are compatible input/action pairs; accessibility intersects the input and action relations. It then translates message sending, uncertain receipt and an uninformed third party into that setting. Its first alternating-message construction deliberately fails on the second step because it lacks the persistent sender/receiver state needed to stop after a lost message. This motivates postconditions in the simplicial construction. A simplicial action carries colored action nodes, literal preconditions and postconditions (§5, Definition 5.1). Mode3, the chosen compatibility rule, rejects explicit contradictions but allows an unspecified input value to be filled by a precondition. A postcondition overrides an input value; otherwise the precondition fills an unspecified value, and an existing specified input value survives. The paper restricts preconditions and postconditions to atomic information/literal assignments. General non-atomic and modal conditions are not implemented by this definition. For knowledge, an output facet consists of compatible same-color input/action pairs whose two projections are input and action facets and whose updated assignments are consistent. Theorem 5.1, proved as 8.1, shows that every admitted output facet retains UCF. Its argument uses full projected facets and injective coloring; it does not establish nonempty output or survival of every input node. Theorem 5.2/8.2 claims the resulting execution map Ξ(F)={X in I[A] | π0(X) subset F} always forms a protocol. Monotonicity, intersection preservation and output coverage follow directly for this map, but the printed equality-of-colors claim has the missing-survival condition described below. Belief updates use one facet family and execution map per agent (§5.2, Definitions 5.2–5.3). Theorems 5.3/8.3 and 5.4/8.4 repeat UCF preservation and the protocol claim. The belief protocol preserves only the relevant agent’s projected intersections. Color preservation still requires equality of all colors for each input face; the same survival issue applies. Revision changes which facets are retained (Definition 5.4). For each full input/action product facet X, R_a(X) chooses consistent candidates Y that preserve the a-colored node and maximize the number of nodes retained from X. Ties are all retained. Candidates need an action-facet projection but need not have a facet projection in the agent’s original belief complex. That permits belief change. Theorem 5.5/8.5 establishes UCF by restricting candidates to UCF facets. Theorem 5.6/8.6 claims a belief protocol for an execution map requiring every preimage of an output face to project inside the input face. This universal condition is material to the proof problem below. ## Concrete protocol cases The two-agent alternating-message protocol starts with private bits and uncertainty about the other bit (§§3–5.1). One designated sender sends its true bit; after successful receipt the roles switch. A lost message stops further sending. The final action has ten perspectives. S and R flags distinguish sending, receiving and an inactive state, and postconditions change those flags. A central edge preserves inactivity. The paper gives one- and two-step outputs and an induction describing a square with four extending alternating-color strings. The sender differs between the preliminary examples; the construction is symmetric, so that is not a contradiction. The layered-message protocol is synchronous: both agents send each interval, at most one fails in an interval, and agents stop after observing failure. A six-perspective restricted action assumes a=0,b=1; stitching four bit combinations yields a sixteen-perspective action (§5.1, Figures 22–29). Additional bit preconditions/postconditions prevent receiving a bit and later its opposite. The author acknowledges that these constraints seem overly restrictive and leaves a better encoding open. The text’s side-length formulas disagree: it prints 2n-1, then assumes 2(n+1) in the induction. Visually, the initial square has one edge per side, the one-step output three, and the two-step output five. With n counting completed steps, those drawings have 2n+1 edges or 2(n+1) vertices per side. No formula was silently repaired. Both examples also conflict with the printed consistency rule. Section 2,p2 requires jointly consistent assignments across every facet; §5,p11 repeats that no atom may be true at one node and false at another. Yet §5.1,p13 assigns b the shared flags “S and ¬R” and a “¬S and R”. Every displayed alternating input edge therefore contains S/¬S and R/¬R; its action edges likewise mix contradictory flags. They are not facets of the stipulated maximal complex. For the layered output, Figure 24,p16 joins (a,5)(¬Pa,¬S) to (b,4)(¬Pa,Pb,S); that outer edge, and the other end’s outer edge, are excluded by Definition 5.1’s consistency requirement. Thus the drawings and their induction are intended constructions, not established instances under the printed literal assignments. Agent-specific flags S_a/R_a and S_b/R_b might repair this, but the paper does not supply that encoding. Footnote1,p3’s remark about lifting examples to local variables does not define it. This reader observation survives the injective-color correction below. A three-agent belief example models a sending its bit to b with possible loss while c falsely believes nothing was sent (Figures 30–31). Adding two facets to c’s action complex changes that to uncertainty among successful sending, failed sending and no sending. This illustrates belief-state modeling, not an empirical advantage of revision. The final example compares a→b→c→a communication with a broadcasting to b and c (§6, Figures 32–37). In the cited structure-aware, known-message setting, the cyclic protocol complex remains connected while broadcast separates the two possible decision values. It illustrates a topological obstacle and a successful broadcast case under those assumptions. It is not a general consensus solution under asynchronous loss, Byzantine faults or hidden schedules. The paper explicitly leaves complete representation of the distributed local model and the scope of action-model expressiveness unresolved. ## Reader checks of the universal claims These are hand-derived observations about the printed definitions and proofs. No solver, prover, model checker or author implementation was run. The flag-consistency problem above concerns the printed encodings of the examples; the following witnesses concern universal structural claims. First, the maximal-complex formula on page2 prints forall u,v in x: V(u) != V(v) without restricting u and v to distinct nodes. Taken literally, u=v makes every nonempty witness x impossible. The preceding UCF definition correctly states injectivity: equal colors imply equal nodes. The following counterexamples use that intended injective-color reading; otherwise the printed foundational formula already fails to describe its examples. Second, compatible actions need not cover every input perspective. Take one agent a and atom p. Let the input have two singleton facets {x0} and {x1}, with p false at x0 and true at x1. Let the action have one a-colored node y requiring p, with no postcondition. Both structures satisfy intended UCF. The update is nonempty but contains only (x1,y). The execution map at {x0} has no nonempty output face. Its input color set is {a} and its output color set is empty, contradicting Definition 3.1’s equality. Theorem 8.2’s singleton proof starts “if X ∈ Ξ({n})” and shows the color of an existing output; it does not prove an output exists. Taking all agent-specific belief complexes equal gives the same issue for Theorem 8.4. An applicability/coverage assumption or a weaker definition is needed before accepting these universal statements. Third, the revision map’s output-coverage proof uses one preimage where its definition quantifies over all. On page31 it selects X' from the inverse relation, observes that π0(X') is an input face, and concludes X ∈ Ξ_a,BR(π0(X')). A different preimage may project outside that face. The following finite example demonstrates this problem under the intended inherited-color interpretation of product preimages. Let agents be a,b, with nodes u colored a and v1,v2,v3 colored b. Atom p is unspecified at u, false at v1 and v2, and true at v3. Let the global complex S have all three facets {u,vi}. Let a’s belief complex have just {u,v1} and {u,v2}; b’s can be S. Let the action have the single facet {α,β}, with colors a,b, p unspecified at α, p true at β, and no postconditions. Both action belief complexes contain that facet. All stated consistency and UCF conditions hold under the intended coloring convention. The compatible output node set is {(u,α),(v3,β)}. For a, the raw product facets are X1={(u,α),(v1,β)} and X2={(u,α),(v2,β)}. Each has the unique consistent replacement Y={(u,α),(v3,β)}: it retains the a-node and the maximum possible overlap, one node. Consequently a’s revised complex has facet Y and both X1 and X2 are preimages of Y. For Y to belong to Ξ_a,BR(F), F must contain both {u,v1} and {u,v2}. No face of a’s input complex does. Thus Y belongs to the revised output but to no execution-map image, contradicting the output-coverage requirement. At input face {u,v1}, the a-singleton survives, but the b-singleton has preimages through both v1 and v2 and is excluded. The output therefore loses color b. This is a reader counterexample to the universal claim as interpreted, not a machine-checked theorem. There is a typing ambiguity here too: the inverse-face definition applies V[A]BR to raw product preimages that may lie outside N[A]BR. The natural extension assigns a product pair its input color, as the proofs implicitly do. Without that extension the inverse definition is not fully typed; with it the example above applies. The record does not assume an unprinted alternative inverse or execution map that could repair the theorem. Other presentational problems include using facet projections on general faces/sets without fully spelling out their extension, leaving L(x) instead of L(x)(P) in a scalar assignment branch, and inconsistent figure references in the cycle-versus-broadcast discussion. These should not be confused with the substantive existence and universal-preimage issues. UCF preservation of admitted facets remains distinct from these stronger protocol claims. ## Evaluation, limitations and contribution The evidence is mathematical definitions, paper proofs and small worked diagrams. There are no runtime, memory, scalability, proof-effort or protocol-success measurements, no mechanized proof artifact inspected, and no implemented simulation reported. Section 6 proposes testing larger models; §7 says implementation and controlled comparisons with/without revision are future work. The author asks: “Firstly, does belief revision actually help with fault tolerance? If so, how? In what contexts?” (§7, p27). Forthcoming NASA gossip-protocol work is mentioned but not supplied or evaluated in this paper. The direct contribution to distributed-system verification is a reusable representation of communication and uncertainty, including incorrect beliefs, and the separation of a repeated action from its input state. It does not verify a production protocol or establish revision-based resilience. The record preserves the claimed structural theorems with the reader’s explicit qualifications. There is no Verus, verified Rust, TLA+ or LLM proof-generation evaluation. Using these constructions as specifications for such tools would require an explicit semantics translation, fixed task properties and repaired structural assumptions; that is a reader inference, not a reported result.
  • limits: intendedinjectivecolorUCF/finiteagents/literalconditions/compatibleproducts;universalprotocolclaimshaveinputsurvivalandallpreimagecoveragecounterexamples;noprotocolperformanceorresilienceevaluation;printed alternating/layered flags violate global facet consistency;agent-specific repair is not supplied
  • how much was read: most of it read
  • source
  • record id: simplicial-actions-for-distributed-2026
• Spatiotemporal robustness for STL (2026)
  • title: Spatiotemporal Robustness of Temporal Logic Tasks Using Multi-Objective Reasoning
  • what: Defines spatiotemporal robustness (STR) for discrete-time temporal-logic tasks as the Pareto-maximal set of jointly admissible spatial and temporal perturbation magnitudes. It gives sound under-approximating robust semantics with min/max operations over Pareto sets, predicate-level algorithms and case studies for fighter-jet and robotaxi trajectories. STR treats spatial noise and asynchronous per-signal time shifts as separate objectives; a scalar pair of independent robustness values can be unsound. For STL in positive-normal form, robust semantics recursively combine predicate STR using downward-closure min/max. Theorem 1 proves every robust-semantic point is dominated by a true STR point, yielding sound task satisfaction but conservative margins. Predicate STR is reformulated as a monotone worst-case-margin constraint; Algorithm 1 scans temporal shells and solves robust spatial optimization, with a signed-distance shortcut from 1-Lipschitzness. Algorithm 2 propagates Pareto envelopes through parse trees.
  • number: F-16 path length 1848; temporal perturbation up to 50 and spatial Gaussian variance [100,100,10] in illustration
  • number: F-16 predicate runtimes: avoidance 53.23 s, threat 2.91 s, climb 13.62 s; conjunction 0.0001 s
  • number: robotaxi runtimes 0.67 s (vehicle+pedestrian) and 0.03 s (fixed pedestrian)
  • number: F-16 limiting subformula changes at temporal budget ΔT=30
  • limits: Signals are discrete-time and nominal; temporal perturbations are integer vectors and spatial budget uses the infinity signal norm. The robust semantics require STL positive-normal syntax and can under-approximate true STR. General predicate functions induce nonconvex/bilevel optimization; complexity grows with signal dimension and temporal horizon. Signed-distance results assume closed sets (tight for convex sets). Case studies are illustrative and use finite traces, not closed-loop dynamical guarantees.
  • how much was read: most of it read
  • record id: spatiotemporal-robustness-for-stl-2026
• Specification-Guided Path Shortcutting (2026)
  • title: Specification-Guided Path Shortcutting for Efficient Probabilistic Model Checking
  • what: Presents specification-guided path shortcutting for Markov chains: acceptance-preserving transition sequences are replaced by single transitions for a fixed omega-regular/LTL property, reducing model-checking state spaces. The method constructs maximal compatible path sets and removes erasable states with soundness guarantees, integrates with Storm and compares against direct Storm, no-abstraction and bisimulation variants. Six PRISM benchmarks and 30-run means evaluate runtime, state/transition reductions and sensitivity to the path bound K.
  • number: six benchmarks
  • number: 30 runs per benchmark
  • number: NAND φ1: 18,826,082 to 7,879,952 states and 1064.97 to 493.50 s
  • number: BRP/CROWDS/EGL/Leader/HM reductions reported in Table II
  • limits: Shortcutting is property-specific and preprocessing can add overhead or increase product transitions; one Leader formula became slower despite removing 17 states. The bounded MCCS search uses K and experiments are limited to six benchmarks and selected LTL formulas.
  • how much was read: most of it read
  • record id: specification-guided-path-shortcutting-2026
• Sprout Network-Parametric Implementability (2026)
  • title: Implementability of Global Distributed Protocols modulo Network Architectures
  • what: Characterizes implementability of global message-passing protocols across peer-to-peer FIFO, senderbox, mailbox, monobox and bag architectures using network-parametric coherence conditions and operational buffer axioms. The paper proves architecture relationships, co-NP-completeness for finite protocols, and symbolic decision procedures. The network-parametric Sprout(A) tool instantiates the conditions for five architectures and checks existing plus architecture-separating benchmarks through MuVal.
  • number: Finite-protocol implementability is co-NP-complete for all five architectures
  • number: Sprout(A) runs on a 2024 MacBook Air M3/16 GB, averaged over 10 runs; average times p2p 6.7 s, sb 5.8 s, mb 7.6 s, monob 7.1 s, bag 12.6 s
  • number: Table uses 15 s per-muCLP timeout; bag is generally slowest due to relaxed ordering
  • limits: Soundness/completeness of Sprout(A) is relative to MuVal, which may diverge because symbolic-protocol implementability is undecidable. Evaluation uses finite benchmark suites, a 15-second timeout per muCLP instance, and manual inspection for selected results; performance varies with message-buffer state-space size.
  • how much was read: most of it read
  • record id: sprout-network-parametric-implementability-2026
• Structural Liveness of Conservative Petri Nets (2026)
  • what: Proves EXPSPACE-completeness of structural liveness for conservative and structurally bounded Petri nets, with doubly-exponential bounds on minimal live markings. The paper models Petri nets as action vectors and develops a proof chain: reversible virtual reachability is represented by bounded linear systems; conservative, structurally bounded and live-bottom-SCC properties are related; dead markings are represented by disjunctions of bounded restricted markings; quasi-dead markings and extractor cases reduce non-liveness to linear-system constraints. Small-solution theorems then yield a 2-exp bound on a live marking, enabling an exponential-space nondeterministic algorithm. A strengthened EXPSPACE lower bound completes hardness for conservative nets and transfers it to structurally bounded nets. The proof extends integer-solution bounds with divisibility constraints.
  • number: The complexity result is theorem-based; no runtime data or benchmark suite.
  • number: Linear-system dimension in the construction is d·2^d; solution norms are bounded by (2+||A||)^{2^{poly(d)}}.
  • number: The upper-bound algorithm guesses a binary-encoded live marking and checks liveness in polynomial space in that encoding.
  • limits: Results concern standard finite-dimensional Petri nets with nonnegative markings and conservative/structurally bounded subclasses; general structural liveness complexity remains open. Bounds are doubly exponential and not practical algorithms. Several technical ingredients are cited from prior work (Rackoff/Leroux), and the proof uses virtual reachability, reversibility and large-component extractors. No implementation or experimental evaluation is reported.
  • how much was read: most of it read
  • record id: structural-liveness-of-conservative-2026
• Symbolic vector sets for Petri-net CTL (2026)
  • title: Symbolic Model Checking using Intervals of Vectors
  • what: Introduces symbolic vector sets: generalized interval-like pairs of lower and excluded upper vectors with canonicalization and homomorphic operations, enabling global CTL model checking over Petri-net markings, including infinite sets. The paper formalizes non-strict partial-order vectors, symbolic-vector membership, join/difference/union/pre operations, mergeability/shareability, and canonical forms. It proves the operations support CTL fixed-point evaluation without decoding, adds saturation and query-reduction optimizations, implements SVSKit, and explains why canonical-operation recursion and number of places limit scalability.
  • number: CircadianClock capacity 6: saturation 3.2 s versus 19,000 s without saturation
  • number: saturated runs keep peak symbolic vectors below 29 and final count 26 in Table 1
  • number: N=100,000 fireability queries: all 16 answered in about 30 minutes
  • number: MCC tools answered at most 9/16 CircadianClock queries within 60 minutes
  • limits: Markings are vectors over naturals with componentwise partial order; correctness concerns CTL global model checking and relies on finite-state or convergent symbolic fixed-point computations. Canonical operations can grow exponentially with places, so experiments select relatively small-place nets. The reported implementation is Swift and results are not directly comparable to MCC hardware limits.
  • how much was read: most of it read
  • record id: symbolic-vector-sets-for-petri-net-ctl-2026
• Synthesizing Update Schedules with Game-Based Extension of Bounded Model Checking (2026)
  • what: Defines a quantified SMT/BMC encoding that synthesizes fixed absolute-time update schedules for safety-critical timed systems modeled as two-player timed games. Universal system/environment behavior is combined with existential global update times to guarantee reachability of update completion while avoiding the mode being updated. The paper formalizes timed automata composition, robust plans, deterministic linear update automata, reach-safety encoding, z-based conservative transitions for bounded paths, quantified formula phi(k,n), soundness relative to the bound, and an iterative Z3 algorithm. A trajectory-planner example synthesizes times 5 and 15 ms for a 10 ms Construction Zone update, with detailed discussion of why absolute time and over-approximation are needed.
  • number: Z3 reports unsat for k<6 and returns tg1=5,tg2=15 at k=6
  • number: plans longer than 35 ms cannot be generated in the example
  • number: encoding has quantifier prefix ∃times ∀system,clock ∃update execution; unsat is only bounded
  • limits: The core assumption is a linear deterministic update automaton with a fixed number of transitions; fixed schedules are weaker than reactive strategies. BMC is bounded and unsatisfiability only means no plan up to kmax. z-transitions conservatively over-approximate. The trajectory planner cannot robustly schedule updates longer than 35 ms; no scalability study or comparison to reactive synthesis is provided.
  • how much was read: most of it read
  • record id: synthesizing-update-schedules-with-2026
• TACO threshold automata verification toolsuite (2026)
  • title: TACO: A Toolsuite for the Verification of Threshold Automata
  • what: Introduces Taco, a modular toolsuite for developing and verifying threshold-based distributed algorithms modeled as monotonic or extended threshold automata, with SMT, ZCS/BDD, and ACS/WSTS model checkers plus semi-decision support for reset/decrement extensions. The paper specifies TA configurations, resilience conditions, guards and updates, and ELTL_FT safety specifications, then details a preprocessor and three algorithms. SMT encodes steady paths in existential Presburger arithmetic; ZCS abstracts thresholds to finite (0,1)-counter systems and checks BDD error graphs; ACS uses WSTS fixed points. TACO accepts ByMC .ta/.eta and a TLA+ fragment, emits traces, uses safe Rust crates and interchangeable SMT/BDD backends, and reports about 97% line coverage.
  • number: ~97% line coverage
  • number: 19 MTA benchmark instances plus ETA sets
  • number: 20-minute timeout; 2 AMD EPYC 7773x processors, 2 TB RAM
  • number: safe Rust implementation
  • limits: Monotonic TA permit only increasing shared variables and have decidable parameterized verification. Extended TA with decrements/resets are generally undecidable; ZCS/ACS are semi-decision procedures, and ACS does not support empty-target specifications. TACO currently supports safety ELTL_FT, not liveness.
  • how much was read: most of it read
  • record id: taco-threshold-automata-verification-toolsuite-2026
• TEMPORA MITL pointwise model checking (2026)
  • title: TEMPORA: Efficient Verification of Metric Temporal Properties with Past in Pointwise Semantics
  • what: Presents Tempora, a tool for satisfiability and model checking of MITL with past and future modalities under pointwise timed-word semantics, translating formulas to optimized networks of timed or generalized timed automata and checking reachability/liveness. The paper defines synchronous networks with instantaneous-program transitions and concurrent-read owner-write shared variables, adds the deterministic detMITL+p fragment with past inner operators, extends the GTA translation to full MITL+p using shared clocks and future-clock predictions, and integrates a Couvreur SCC liveness procedure. Engineering optimizations share clocks, automata, and witness predictions; the implementation supports finite and infinite words and complete model checking of timed models.
  • number: 72 benchmarks
  • number: Fischer 3–7 processes
  • number: Fischer 5-process mutual exclusion: 527,829 nodes, 15,514 ms
  • number: 8-philosopher property falsified in 0.01 s
  • limits: Semantics are pointwise timed words rather than dense signals. Determinism is guaranteed only for detMITL+p; general MITL+p uses nondeterministic GTA and future clocks. Experiments are prototype-scale; continuous semantics and monitoring are future work.
  • how much was read: most of it read
  • record id: tempora-mitl-pointwise-model-checking-2026
• Tessa tensor PMC (2026)
  • title: Tensor Probabilistic Model Checking of Finite-Horizon Markov Chains
  • what: Defines a modular probabilistic model language (PML), maps DTMC state distributions and transitions to dense tensors and tensor transformers, proves the mapping sound for finite-horizon reachability, and implements it as Tessa using JAX/XLA. The paper gives explicit PML semantics for synchronized commands and overlapping guards, a masked tensor recurrence for reachability, and Theorems 5.1–5.3 connecting tensor transformers to standard DTMC transitions and probabilities. Evaluation on dense Queues, Weather Factories, and Herman benchmarks compares Storm Sparse/MTBDD, Dice, and Geni on an RTX 2080 Ti. Tessa exceeds 100x speedups at hardest solvable baseline instances and 300x on Herman at H=500. A Knuth–Yao parameter-search experiment minimizes KL divergence and converges to p=q=0.5 within 100 gradient steps.
  • number: RTX 2080 Ti 11 GB, Intel i7-7820X, 128 GB RAM
  • number: over 100x at Queues K=10, Weather N=16, Herman N=17
  • number: about 40x faster than Storm at Queues H=500
  • number: over 300x faster on Herman H=500
  • limits: The method retains exponential state growth and targets dense transition dynamics; sparse models are generally more space-efficient in Storm. Experiments use selected Rubicon benchmarks and a single older 11-GB GPU, with compilation included in first-run timings. Tessa is limited by VRAM and does not replace state-space reduction methods.
  • how much was read: most of it read
  • record id: tessa-tensor-pmc-2026
• The Cooperating Proof Calculus: Comprehensive Proofs for an SMT Solver (2026)
  • what: CPC is an evolving external Eunoia signature describing cvc5 theory symbols and585proofrules in8025lines. Instrumented cvc5 emits detailed refutations for supported proof-producing configuration;Ethos checks applications and executable side conditions. Paper surveys calculus,optimized chain resolution/normalization,partial verification of rules,and large UNSAT proof-generation/checking study. Explains explicit signature/checker trust,computation/variable-capture semantics,nondefault feature exclusions,fragment-specific Lean/Isabelle reconstruction,SMT rule-validation and SyGuS bug finding. Supplies complete category counts,runtime/size table,conditional success denominators and two incompatible checking cases. Complete proof traces do not entail a fully verified checker/calculus.
  • limits: §§1–2: external checker reduces trusted code from~363kC++ solver to~10kC++Ethos plus~8kEunoiasignature;linecount is not formal assurance. Rules supplied as input are trusted semantically unless separately proved. Correct encoding of source verification obligations remains necessary;external refutation does not validate a bad specification. §2: Eunoia extendsSMT-LIB2.7syntax using typed higher-order logic/dependent types,pure orderedpattern programs,eager evaluation and builtin literal operations. No builtin proof rules does not mean no trusted computation/type machinery;builtins and parser/checker remain trusted. §2.1–2.2: step checks derived Bool and agreement with optional stated conclusion;assume introduces premise. Refutation false is relative to input assumptions;localassume-push/step-pop discharge mostrecent assumption. Proof-hole-free does not mean assumption-free. §2.3: userprograms can diverge or getstuck;sumexample diverges on negative n. Checking requires complete evaluation of computational terms;termination not automatically enforced. Formal operational/type semantics still underdevelopment;no universal total checker theorem. §3:177nativefunctionsymboltypes,585rules;424rewrite rules partition164strings,135BV,38arithmetic,19sets,6arrays,8arith/BVconversion,41Boolean,13core. Counts pertheory subsection may include rewrites already counted;do not sum all narrative categories as disjoint585. §§3.2–3.4:21CNFrules treat formulas themselves as literals rather than explicitTseitinvariables;28additionalBooleanrules;binaryresolution plus twochainvariants. Chainmultiset program checks final clause with duplicate/factoring/reordering support;optimized multiset operations trusted. RUP/LRATtranslation based on cited work,not this paper proving everySATsolver correct. §3.5: arithmetic polynomial normalization122lines uses dynamically established deterministictermorder;insertion-sort-like best-case remark is not general linear-time guarantee. Nonlinearcoverage incremental linearization only,not cylindricalalgebraiccoverings. Tangent/sign/magnitude rules do not solve allNRA. §§3.6–3.10:BVsingle-stepbitblasting540lineprogram;arrays3read-over-write+extensionalitywith@diff witness;stringswordequations/regexderivatives/extendedfunctionreductions;datatypes10rules;setsrewrite/extensionality. These summarize displayed signature,not independent source-level audit of all8025lines. §3.11: quantifiers represented byuninterpretedconstructors takingvariablelist/body,requiringmanualcaptureguardedsubstitution(~30lines),lexicalshadowing andalpha-renaming. A syntactically accepted substitution withoutthese semantic conditions neednot be sound. §3.12 normalization/evaluationprograms mustalso be correct. §4: successfulEthoschecking still admitschecker orsignature bugs. Lean180rules support selectedarithmetic/UF/quantifiers;~115translateddirectly,othersreflection/specializedtactics. ~20xslower claim not accompanied by separatebenchmarktable here. This reconstructs acceptedproofs inLean,not formalproof of allCPCrules. §4:IsaRareverified338RARErules versus217prior,found6faultyrulesamended. Isabelleproofreconstruction viaAlethe coversspecificfragments;translation/reconstruction evidence doesnotdirectly entail alloriginalCPCrulescorrect. No claim all585verified orcoverageunion known. §4:SMTtranslation~3.5kC+++1.3kEunoia produces571VCs;14unencodedinternals. Z3v4.13.4 solves139,cvc5v1.3.2 solves238(including99unique),60s;41VCs cvc5-specific. Union238 impliesZ3successsubsethere,not139+238independentvalidatedrules.333of571unsolved plus14unencoded;unsolved isnotfaulty. SameSMTtrust mayremain. §4:SyGuSfoundcounterexamples to10olderrules,4confirmedIsabelle/6outsidecurrenttranslation;all10fixed. Do not addthese10to6Nitpickbugs as16distinctwithoutoverlapdata. Confirmedbugs showusefulcrosschecking,not exhaustiveabsenceofremainingbugs. §5:59nonFPlogiccategories,310830benchmarks screened;baseline153188UNSATwithin60s. Proofgenerationrerun onlythosebaselineUNSATs,600s;thenproof+check600s. Doesnotprove allSMT-LIBbenchmarks solvable/checkable orSATmodelvalidation. FP/SymFPUwordblasting proofs absent. 427/585rules exercised,158unexercisedincludingnonstandardsets/operators;coverageof585notfull. §5:safeconfiguration disablesexpert/nonprooftechniques,includingdefaultQF_UFsymmetrybreaking,CaDiCaLforBV,andCAcoverings. Safehere meansproofsupportconfiguration,notprovedsemanticproperty. Defaultsolves156407UNSATversus153188safe;17.1%averageslowdownonsolvedintersection,9.9%excludingQF_BV. Cannotconflateproofgenerationoverhead withconfigurationchange. §5/Table1:152382proofs and151571checked;authorreports99.4%/98.9%relative153188baseline. Readerdivisionfirst=99.4738%,normallyrounds99.5%;preserveauthor99.4withoutchangingcounts. Mostlossestimeouts,twoincompatibilitycasesfailEthoschecking. Proofholeabsencecoversgeneratedproofs,notallrequestedbenchmarks. §5:ratios5.11x/7.11xcomputedoncommonlysolvedinstances;tabletimescumulativeonsuccessfulsets,roundedk;ratiosnotquotientoftheseunequalsets. +Checkmeansgenerationpluschecking,notchecker-onlyruntime. Averagingmethodnotfullyspecified;do notinventgeometricmean.913.4millionstepsincludesassumesteps;proofsizemeansnotproofdepth. §5:XeonE5-2686v4/2.6GHz/252GB,developmentcvc5v1.3.2;no repeatvariance/memorybudgettable,checkerrevision orfull perbenchmarkdata here. Tablecontainsallcategories,but noassuranceindependenceofSMT-LIBinstances. Fig1hasmanysubsecond fixed-overheadcases;do notsummarizeeverycaseas≤10x. §6:completeformalverificationofCPCandverifiedcheckerfuturework. DataartifactZenodo19867026/otherpapers/manualnotreadorsoftwareexecuted. NoVerus/Rust/TLA+/distributedprotocolorLLMexperimentreported.
  • how much was read: most of it read
  • source
  • record id: the-cooperating-proof-calculus-2026
• The Rocq-NN-Roll Prover: Soundly Verifying Hyperproperties of Neural Networks in Rocq (2026)
  • what: Reports a Rocq implementation and soundness/completeness proof for checking rational piecewise-affine feed-forward neural networks against finite-arity universal relational specifications. Reduces a network plus hyperproperty to a joint piecewise-affine function, enumerates affine segments and searches each segment for a negative satisfaction value by a verified mixed-strictness Fourier–Motzkin solver. Provides monotonicity/robustness examples and a small nine-network runtime experiment. Printed solver theorem and robustness example contain concrete inconsistencies, which this record separates from uninspected artifact correctness. A computational real-subset interface and reduced-rational dependent type support evaluation while retaining embeddings into reals. Total piecewise-affine functions prevent partial-domain gaps from vacuously proving network properties. The formal specification restricts input preconditions to a convex polyhedron and both generator/satisfaction maps to total piecewise-affine functions. A specification-equivalence proof guards manual encoding, then verified decomposition, segment splitting and strict-negative feasibility compose into the final boolean iff theorem. Prototype limits and differing GitHub/evaluated-artifact content are explicit.
  • limits: Targets feed-forward, finite piecewise-affine networks with rational arithmetic, exemplified by affine Linear and elementwise ReLU layers. It does not support arbitrary sigmoid/nonlinear activations, recurrent cycles, training correctness or deployed floating-point/parallel semantics. The formal interface generalizes to ordered real subsets with suitable operations; its computable exact solver requires division. Exact mathematical soundness does not remove a mismatch with finite-precision inference. RealSubsetOAM packages an embedding into real numbers preserving order, addition and multiplication; Coquelicot algebra/matrix support is extended around it. QDEP is the dependent subtype of rationals fixed by rational reduction, removing multiple representatives. The authors explicitly assume proof irrelevance to identify equal reduced-rational values under standard Rocq equality. Rationals with division support FME; merely being an integer subset is not enough for the solver’s division interface. AffineSegment pairs a convex polyhedron with an affine map. Segments can be partial and domain membership is tested. Total piecewise-affine functions (TPWAFs) have composition/concatenation preserving totality. Neural-network affine decomposition returns a total function. Segments can overlap at activation boundaries; a function representation must agree there, not count each segment as a distinct execution. The supported hyperproperties quantify universally over finitely many executions of the same deterministic network. Arity r is fixed in the specification. This is a finite-input/output relational class, not arbitrary temporal hyperlogic, probabilistic fairness or infinite-trace properties. The paper uses monotonicity, robustness and individual fairness as examples of this class; only monotonicity and one-dimensional robustness receive worked formal encodings. Informal NNDH uses input tuples X generated from W by netIn and output acceptance netSat>=0. Formal NNHyperproperty narrows W to a convex polyhedron, netIn to a total piecewise-affine generator and netSat to a scalar total piecewise-affine map over the restricted real subset. Thus not every mathematical relation or arbitrary precondition is accepted. Rational instances quantify through the chosen representation/embedding; no theorem about floating-point inputs is supplied. Specifications are manually translated into the framework. The recommended method first writes a natural predicate and proves equivalence to the encoded hyperproperty. Monotonicity1d uses r=w=2, precondition x1<=x2, identity generator and affine netSat=y2−y1; the paper displays monotonicity_1d_correct. This protects the property encoding when the equivalence is proved, but the prover does not infer the human’s intended specification. joint_pwaf composes netSat with concatenated netIn and r copies of the network composed with netIn. Because concatenation takes separate inputs, evaluation duplicates x as colvec_concat x x, explaining the 2w segment input dimensions. The network-to-piecewise semantics theorem asd_preserves_satisfiability connects this construction to natural network satisfaction. Partial pwaf_eval None is treated as True; using total network/generator/satisfaction components is essential to avoid certifying an undefined input. Segment splitting universally requires satisfaction on each segment under W. Linear constraints combine W, segment domain and strict violation of the required nonnegative scalar output. Feasibility gives a counterexample; infeasibility for every segment proves the universal property. A zero satisfaction value is allowed, so the negated output condition is strictly<0 rather than<=0. Mixed strict/non-strict inequality support is therefore a correctness requirement. Fourier–Motzkin solver returns Some assignment when feasible and None when infeasible according to the intended algorithm and subsequent equivalence theorem. Reader visually confirmed that displayed fme_correct on p.494 instead says None => exists sol,is_linear_system_solution sys sol, missing negation. Both printed branches assert feasibility. This cannot be the claimed correct theorem for an inconsistent system such as0<0; record it as a printed theorem defect. Artifact proof may differ and was not inspected. The final verify_hyperporperty_correct states boolean true iff nn_satisfies_nndh, composing decomposition, split and linear-system correctness. The counterexample interface returns a solver assignment on first failing segment; None across the finite list yields boolean true. Correctness is author-reported machine formalization, not established here by executing the shown code. Some displayed type parameters/dimensions and theorem names are abbreviated or inconsistent; this record does not treat the printed snippets as a compilable standalone artifact. Robustness predicate on p.496 has parameter order (epsilon,delta), and requires |x1−x2|<=delta implies |N(x1)−N(x2)|<=epsilon. For fixed epsilon, robustness is downward closed in delta. The prose on p.497 claims robust for delta=.096,epsilon=.1 but not for smaller delta=.0959,epsilon=.1, which contradicts that order property. The theorem calls actually supply first arguments .096/.0959 and second .1, so they instead vary epsilon with delta=.1; the prose swaps meanings. The displayed example_not_robust2 statement on p.498 also omits negation before is_robust_1d, while its proof starts by introducing the positive property and deriving contradiction. That script shape proves a negated proposition. These are source presentation defects, not reader evidence that the kernel accepted contradictory proofs. Reader Figure3 check after independent visual review: the middle output weight is −.3. The network is ReLU(.66 ReLU(−x+.1)−.3 ReLU(x+.25)+.99 ReLU(.7x)+.1). Its four slopes on regions divided at−.25,0,.1 are−.66,−.96,−.267,.393, and its outer ReLU stays positive. Hence it is globally .96-Lipschitz, consistent with the positive call epsilon=.096,delta=.1. Inputs−.2 and−.1 produce .283 and .187, differing exactly .096; this refutes epsilon=.0959,delta=.1. These are exact reader calculations, not artifact execution. The earlier record misread the negative weight and has been corrected. Robustness encoding uses two halfspaces for |x1−x2|<=delta and a two-segment output absolute-value function; the paper reports equivalence to is_robust_1d. Robustness example was added during two-stage review after artifact evaluation. GitHub includes it, but peer-evaluated Zenodo artifact explicitly does not. It must not be described as checked in the evaluated artifact or as evidence that all published snippets compiled. Authors give O(2^n) network segments for n ReLU activations, O(n) constraints per segment, and O(2^(nr)) systems of O(rn) constraints when r network copies are combined. These estimates suppress complexity contributed by netIn/netSat and W, so should be read for fixed/simple specifications. FME has exponential elimination blow-up; no polynomial-time performance claim is made for the full prover. Replacement by a polynomial linear-feasibility solver is future work. Runtime evaluation uses nine positive-weight networks with1–9 activations, at most3layers, weights sampled in[1,2], biases in[0,1], rounded to3decimals to ensure monotonicity. Each monotonicity check repeats5times. This is a synthetic guaranteed-positive benchmark, not a diverse trained-network suite, hyperproperty variety study or adversarial/counterexample evaluation. No comparison with state-of-the-art solver timings is provided; authors acknowledge slower performance. Hardware is32GB RAM and Intel Core Ultra7 155H at3.80GHz. The figure plots mean seconds on a log scale, rising from roughly10^-3 at one ReLU to roughly10^3 at nine. Values are graphical orders of magnitude, not exact spreadsheet measurements. Ten or more activations take over an hour and often exhaust Rocq memory. Raw data.xlsx, software version/OS, precise seeds, error bars and per-run values were not inspected or specified in the paper. FME formalization exceeds3000 Rocq lines; no total-development size, labor time, proof-acceptance rate or formal trust audit is reported. Proof scripts demonstrate rewriting semantic equivalences then vm_compute/reflexivity for a small monotonicity example. This is executable decision-procedure automation inside Rocq, not an LLM proof agent or empirical theorem-proving model evaluation. Artifact locations are https://github.com/verinncoq/rocq-nn-roll-prototype and DOI10.5281/zenodo.19798155. A prior verified ONNX converter is cited as an import path; its theorem, parser coverage and correspondence to inference engines were not independently inspected. Rocq kernel, real-number assumptions, proof irrelevance, imported libraries and any extraction/compiler boundaries remain part of the stated or uninspected trust chain. Future work includes clipping by precondition, incremental polyhedral generation, symmetry, faster verified linear solver, abstract interpretation, floating-point library Flocq and parallel verification library SyDPaCC. Extraction of verified networks/prover is proposed, not delivered as a verified efficient execution pipeline. No Rust, Verus, TLA+ or distributed protocol is verified in this paper.
  • how much was read: most of it read
  • source
  • record id: the-rocq-nn-roll-2026
• three-layer agent-skill capability verification (2026)
  • title: Methods for Formal Verification of Agent Skills: Three Layers Toward a Mechanically Checkable Capability-Containment Proof
  • what: Defines two-sided semantics for agent skills—deterministic script-side and nondeterministic LLM-side—and composes three verification layers: static capability analysis, refinement-typed tool-call envelopes, and SMT-bounded checking of runtime traces. A proof-carrying skill bundle is rechecked at bootstrap. Separates script and LLM projections of traces, states containment against declared capabilities, proves soundness and incompleteness for each method, and gives a composition theorem whose sole residual is the LLM’s refusal-to-act surface handled by the runtime biconditional. The implementation includes JavaScript modules, signed evidence files, a bootstrap checker, and a worked SKILL.md example.
  • number: 53-test unit suite and end-to-end CLI (§Abstract, §8.4)
  • number: All 53 tests pass (§8.4)
  • number: Layer 3 takes a few seconds per skill at Kmax=100; bootstrap re-check runs in milliseconds (§9.6)
  • number: Implementation ships as zero-runtime-dependency JavaScript modules (§Abstract)
  • limits: The paper explicitly does not verify model weights, training data, or decoding stochasticity; the LLM is treated as an adversarial nondeterministic oracle constrained by typed dispatch. Method C is bounded by transaction-buffer horizon Kmax, while methods A/B cover only their respective script and dispatch surfaces. Soundness depends on the underlying analyzers, type system, SMT encoding, and runtime biconditional.
  • how much was read: most of it read
  • record id: three-layer-agent-skill-capability-verification-2026
• Timers (2026)
  • title: Verifying First-Order Temporal Properties of Infinite-State Systems via Timers and Rankings
  • what: Turns a claim about time into a termination problem by adding timers that predict when formulas become true. A human supplies the model, the claim, the implicit ranking, the invariant and finite-set approximations. Z3 checks the generated conditions.
  • number: 17 tasks in Table 2, e.g. Ticket: 2 s, 20 invariant conjuncts, 256 proof tokens
  • number: Paxos: 101 s, 238 tokens; ABP: 4 s, 539 tokens; HRB-Correct: 135 s, 99 tokens; Dijkstra k-State: 64.8 s, 213 tokens
  • number: Ivy proof sizes for six tasks: 407, 521, 860, 446, 593, 748 tokens (Ticket, Paxos, ABP, HRB-Correct, HRB-Relay, Ackermann)
  • number: runtime is Z3 validation on Apple M1 Pro, Z3 4.13.3
  • limits: The guarantees cover first-order transition-system models, not deployed code. Rankings and invariants are not discovered automatically. Sizes count proof tokens, not human effort.
  • how much was read: most of it read
  • source; notes: Verifying First-Order Temporal Properties of Infinite-State Systems vi
  • record id: timers-2026
• Transition Invariants Revisited: Termination Witnesses and Their Validation (2026)
  • what: Extends the standard machine-readable proof format that program verifiers hand to each other so it can carry termination proofs. The proof is a transition invariant: a relation between any earlier and later state of a run that must decrease in a well-founded way. Three checkers re-validate such proofs independently of the tool that made them.
  • number: Evaluated on all SV-Benchmarks programs expected to terminate, 900 s CPU and 15 GB per run
  • number: Witnesses validated by at least one validator: CPAchecker 366 of 422 (87%), CPAchecker-TransVer 192 of 200 (96%), UAutomizer-TransVer 375 of 389 (96%), Goblint-TransVer 176 of 286 (62%)
  • number: Validators solved about 40 programs that CPAchecker’s own verification mode could not, using other tools’ witnesses
  • number: Validation often faster than verification (Wilcoxon p = 2.1e-10 and 1.1e-13 for the two CPAchecker validators on ranking-function witnesses)
  • limits: Termination of sequential C programs only; the authors say “We do not consider other reasons for non-termination, such as deadlocks.” One reduction route needs finite state spaces and TransVer has limited support for arrays and structs. Witnesses with many invariants (Goblint) often could not be validated within limits. Not about fairness or liveness of concurrent or distributed systems.
  • how much was read: most of it read
  • source; notes: Transition invariants as termination witnesses (2026)
  • record id: transition-invariants-revisited-termination-2026
• Transitive Relation Learning (TRL) (2026)
  • title: Infinite State Model Checking by Learning Transitive Relations
  • what: Transitive Relation Learning (TRL) extends bounded model checking with learned transitive relations and blocking clauses so that finite-depth search exhaustion can prove safety of an infinite-state transition system. Uses model-driven conjunctive variable projection to select transition cases, recurrence-based transitive projections, loop detection, redundancy checks and backtracking. Learned relations need not over- or under-approximate a loop’s full transitive closure. Soundness instead depends on blocking only paths covered by the learned relations. Section 5 recursively substitutes accelerated under-approximations to validate possible counterexamples. Appendix A proves Theorems 22 and 28.
  • number: 626 unique LIA-Lin CHC competition 2023/2024 problems, 300 s and 10560 MiB each. TRL solves 386 (267 safe/119 unsafe), GSpacer 373 (287/86), ABMC 272 (142/130). Unique-proof counts depend on which overlapping solver configurations are excluded.
  • limits: May diverge; finite-image projection does not ensure complete loop closure. Implementation is limited to linear integer arithmetic; reals, arrays, bitvectors and temporal verification are future work. Main algorithm can return unknown when an error is reachable only through learned transitions. Author empirical and proof claims were read but neither code execution nor machine-checked proof was performed.
  • how much was read: most of it read
  • record id: transitive-relation-learning-trl-2026
• Tridirectional Reentrancy Guard Verification (2026)
  • title: Tridirectional Discriminating-Power Formal Verification of Smart Contract Reentrancy Defense Against Production-Deployed Solidity Source
  • what: Formalizes the OpenZeppelin reentrancy-guard pattern against a Lean 4 state-machine model of production Solidity source. Three machine-checked directions cover a DAO 2016 negative attack instance, Compound v2 positive correctness, and an Aave V3 flashLoan boundary mutant; a capstone composes the sealed protocol proofs. The proof discipline separates source-level predicates, protocol instantiation theorems, and a no-retrofit conjunction capstone. The corpus has 13 theorems across four layers, CI checks theorem and axiom records, and a minimal-diff Aave mutant tests sensitivity to one structural regression. The authors publish tagged Lean source and reproduction commands.
  • number: 13 machine-checked theorems
  • number: zero sorry and zero user-introduced axioms
  • number: [propext]-only axiom records
  • number: approximately 8,538 Lean lines
  • limits: Correctness is relative to the Lean state-machine abstraction and its Solidity/source-faithfulness and compilation assumptions. The model assumes honest protocol-internal accounting; borrowers may be adversarial. Scope is one attack class and one defense pattern, with live cross-protocol evidence confined to lending-family Compound v2 and Aave V3 plus DAO history; read-only/cross-function reentrancy and other OpenZeppelin patterns remain future work. The boundary mutant is hand-constructed (N=1).
  • how much was read: most of it read
  • record id: tridirectional-reentrancy-guard-verification-2026
• ULTIMATE heterogeneous stochastic-world-model checker (2026)
  • title: ULTIMATE: A Tool for the Verification and Synthesis of Stochastic World Models
  • what: # ULTIMATE: A Tool for the Verification and Synthesis of Stochastic World Models: supplementary reading (authored by agents unless marked 🧑) The38-page official supplement supplies formal definitions, four theorem arguments, verification/synthesis pseudocode and detailed case models. Its most consequential additions are a conditional asymptotic synthesis claim, numerical-solver obligations behind the verification theorem, and printed mismatches between synthesis tables, prose and model parameter owners. Inherited formal253 complete 16-page CAV2026 main-paper account, including main measurements; no fresh full main reread is claimed. New complete 38-page standalone prose supplement, Appendices A–G and references 1–47 through EOF: Definitions 1–17, Theorems 1–4, Algorithms 1–2, all 24 numbered equations A.1–G.24, Figures D.1/F.2, Tables F.1/G.2 and printed Listings 1.1–1.7. ## D1: Recovery and new reading scope The Zenodo record20173421, titled ULTIMATEv1.1 with Supplementary Material, exposes a standalone38-page supplementary PDF and a 9,353,586,306-byte CAV-AE-2026.zip. Only the prose PDF was fetched/read, not the ZIP. All Appendices A–G, references 1–47, Definitions 1–17, Theorems 1–4, printed Algorithms 1–2, EquationsA.1–G.24, Figures D.1/F.2, Tables F.1/G.2 and Listings 1.1–1.7 were read. Embedded model listings are paper illustrations, not separate author implementation files. The earlier16-page main account is inherited. Exact source anchors: S1, S38 in quotes.json, with section, PDF page, literal character and LF offsets. ## D2: Formal model background and assumptions A defines finite DTMCs with nonnegative rewards/PCTL, CTMC transition rates/exponential holding times/CSL, MDPs with nondeterminism and policies, POMDPs with observation-based strategies, and stochastic multiplayer games/coalition rPATL. It distinguishes deterministic memoryless policies from broader randomized/history-dependent policy classes; same-observation POMDP states must allow the same actions. Conclusions concern the supplied models and observation/parameter semantics, not an automatically faithful physical-system model. Exact source anchors: S1, S2, S3, S4, S5, S6, S7 in quotes.json, with section, PDF page, literal character and LF offsets. ## D3: Parametric model checking capability boundary B permits rational-function transition/rate/reward parameters across model types, but says parametric checking supports selected fragments: DTMC properties without nested probability operators and nontransient CTMC properties; bounded-time CTMC reachability is unsupported by that branch. Tool modeling expressivity is wider because estimates and numerical repeated nonparametric checking can fill parameters. Do not call every supported model/property parametric-checkable. Exact source anchors: S7, S12, S13, F5 in quotes.json, with section, PDF page, literal character and LF offsets. ## D4: World-model definition and composition boundary C defines U=(M,D,E,I): each model has pairwise disjoint dependency/external/internal parameter sets; exactly one definition is required per parameter. Dependency definitions reference a property of a different model; external definitions specify inference over observations; internal definitions give Boolean/discrete/continuous decision domains. These are scalar property dependencies between separate models. They do not themselves supply a joint synchronized transition system or prove independence/correlation assumptions appropriate for a real deployment. Exact source anchors: S8, S9 in quotes.json, with section, PDF page, literal character and LF offsets. ## D5: Verification procedure D assembles the dependency graph/SCC condensation and verifies lower dependency levels recursively, estimates external parameters, solves simultaneous equations within a nontrivial SCC, sets parameters and calls the probabilistic checker for the requested property. Parametric-feasible dependencies yield algebraic equations; other dependencies use repeated nonparametric model checking inside numerical residual minimization. Tarjan graph/SCC construction is described as linear in graph size; checker and solver cost dominate the stated abstract complexity. Exact source anchors: S10, S11, S12, S13 in quotes.json, with section, PDF page, literal character and LF offsets. ## D6: Concrete cyclic equation example Figure D.1 top is a mutually dependent pair ofDTMCs with x=.5+.5y and y=.1+.2x. Reader arithmetic gives x=11/18≈.611111,y=2/9≈.222222, not a rerun of the authors’ solver. Bottom substitutes CTMCm1-prime with a bounded-time property and uses black-box pmc equations. Its caption calls the CTMCm2 although the pictured CTMC is m1-prime; preserve that label discrepancy. Exact source anchors: S13 in quotes.json, with section, PDF page, literal character and LF offsets. ## D7: Verification theorem versus numerical obligations Theorem 1 states Verify terminates and returns the correct property value, proving induction on SCC dependency level. For nontrivial SCCs, it takes the relevant solution obtained at line34 as given. D.2 proposes analytic polynomial solving/Newton–Raphson or Powell derivative-free minimization of squared residuals. Reader qualification: universal exact correctness/termination needs solver termination, existence and selection of an admissible fixed point, uniqueness or specified selection semantics, residual/precision guarantees and correct checker/inference helpers. Numerical optimizers alone do not discharge these requirements. No mechanized solver-correctness theorem is supplied here. Exact source anchors: S11, S13, S14, S15, F1, F2 in quotes.json, with section, PDF page, literal character and LF offsets. ## D8: Verification complexity theorem scope Theorem 2 states neTe+max{ndTparam+Tsolve1(nd),nd+Tsolve2(nd)}+Tpmc. It assumes all models lie in oneSCC as its worst scenario, external estimates cached/reused, and parameter/graph/assembly overhead negligible; solver cost is an abstract input function. This is a conditional accounting formula for those operations, not a polynomial-time bound for arbitrary cyclic stochastic-model verification or a proof that numerical equations always converge. Exact source anchors: S15, S16 in quotes.json, with section, PDF page, literal character and LF offsets. ## D9: Synthesis problem and finite algorithm result E defines Cartesian products of internal parameter domains, constraints and multiple maximize/minimize objectives. Algorithm 2 randomly initializes N candidates, checks constraints/objectives through Verify, evolves using a MOGA, stops at convergence or MAXGEN, filters feasible candidates from the final population and returns those not dominated by other feasible final candidates. Finite N/MAXGEN supplies no exhaustive dominance comparison with unexplored domain values. Feasibility itself inherits Verify/model/solver assumptions. Exact source anchors: S16, S17, S18, S19 in quotes.json, with section, PDF page, literal character and LF offsets. ## D10: Asymptotic theorem and inherited-main qualification Theorem 3 explicitly states termination assuming correct terminating helper functions and convergence toward a Pareto-optimal set as both N andMAXGEN increase. Its proof appeals to established MOGA mechanisms designed to converge, without precise mutation/coverage/ergodicity/probability conditions or a specified continuous-domain convergence theorem. The inherited main§4 explicitly says its heuristic does not provide formal global-optimality guarantees. Retain both statements: the supplement adds a conditional asymptotic claim, while the evaluated finite runs do not acquire a certified global Pareto front. Do not repeat the old unqualified claim that no such theorem is stated, or promote the printed theorem into a complete universal convergence proof. Exact source anchors: S17, S18, S19, F3, F4 in quotes.json, with section, PDF page, literal character and LF offsets. ## D11: Synthesis complexity theorem scope Theorem 4 gives MAXGEN*(N*(c+o)Tverify+Tevolve(N,o))+NcTverify. It accounts for each candidate’s constraint/objective verification, population evolution and final feasibility checks, assuming initialization,SCC computation, fitness/convergence, instantiation and final dominance comparisons negligible. It is an operation-cost expression under those assumptions, not a full bound on every component asN/domain/model size grows. Exact source anchors: S19, S20 in quotes.json, with section, PDF page, literal character and LF offsets. ## D12: Verification case inventory F contains four verification families: RAD, smart motion detection, RoboFleet andDPM-FX. Table F.1 lists component models, dependencies/external parameters and checked properties. The timing/results are referred to the main paper, not a new supplemental timing table. Main hierarchical scalability studies, model sizes13–3984 and.57–8.25 s verification measurements remain inherited, as do main synthesis settingsN=100/generations=10 and reported14–39 minute fronts. No new empirical reproduction was performed. Exact source anchors: S20, S21, S26, S27, S28, F6 in quotes.json, with section, PDF page, literal character and LF offsets. ## D13: RAD cycle and probability semantics F.1 has a garment-pickingCTMC, user-monitorDTMC, monitor-controllerDTMC and dressingPOMDP. Monitor/controller form a cycle; the POMDP depends on garment success within 90 s and monitor results. True user state is initially ok/notok with probability.5 each. F.15 computes joint probabilities of correctok and correctnotok, not conditional accuracy; the controller uses recall=2pOkCorrect and precision=pOkCorrect/(.5+pOkCorrect−pNotOkCorrect), and the workflow observation step also uses the factor2. This distinction matters when specifying parameter meaning. Exact source anchors: S21, S22, S23, S24, S25, S26 in quotes.json, with section, PDF page, literal character and LF offsets. ## D14: RAD policies and observability The workflow POMDP observes only step variable s and predicted user state predOk; trueok remains hidden. The policy chooses dressSlow/dressFast with different success/cost/time assumptions, may retry after a failed dressing attempt if allowed, and fails if picking fails or retry is disallowed. Minimizing eventual failure is a policy optimization within that observation model. External garment-rate/accuracy observations and inference are modeled inputs, not supplied uncertainty guarantees about their estimated values. Exact source anchors: S23, S24, S25, S26 in quotes.json, with section, PDF page, literal character and LF offsets. ## D15: Printed RAD model/prose mismatches F.1 prose onp22 says a failed pick remains at s0 for retry or fails at s2; printedListing1.1 instead goes to recalibrations2, returns tos0, or fails ats3. G.1’s later prose describes that listing consistently. F.17 and Table F.1 use step=6 while printed Listings 1.4/1.7 declare variable s and label fail at s6. Printed listings contain ellipses and are illustrative excerpts. These are unexecuted representation differences, not demonstrated errors in an unseen artifact implementation. Exact source anchors: S21, S22, S25, S29, S30, S32 in quotes.json, with section, PDF page, literal character and LF offsets. ## D16: SMD concrete closed dependency The smart-motion case couples night motion sensing and smart lighting: sensor detection depends on illumination; lighting changes every 30 s based on current illumination and detector output; sensor sampling is every few seconds. Low/medium illumination parameters are fractions of expected accumulated rewards over 3600 s, and motion detection is conditioned on a large object. Table F.1 supplies pLargeObject=.05. This exemplifies performance/dependability dependencies, not a distributed-consensus safety result. Exact source anchors: S21, S26, S27 in quotes.json, with section, PDF page, literal character and LF offsets. ## D17: RoboFleet and DPM-FX concrete dependencies RoboFleet uses N separate gridMDPs with obstacle-dependent stuck probabilities; a supervisorDTMC attempts remote maneuvers up tonAttempts then a more costly high-success reset, tracking expected failures and human cost. The illustrated sweep hasN=2,nAttempts=1–4. DPM-FX couples a financial-workflowDTMC and disk-powerCTMC: expected disk operations drive disk behavior and average queued operations affect service workflow; idle-to-sleep probability controls power mode. These scalar circular dependencies require fixed-point solution under the modeled semantics. Exact source anchors: S21, S27, S28 in quotes.json, with section, PDF page, literal character and LF offsets. ## D18: RAD synthesis specification differs within the supplement G.1 removes the monitor controller and uses 3 models with 4 internal parameters: picking retrypRetry plus 3 model-selection probabilities summingto1. It requires 90 s garment success>=.9 and minimizes energy until picking success/failure and best-policy dressing-failure probability. Table G.2 instead reuses the 4-model Example2, lists only pRetry, prints an unbounded-value query asC1 and includes both maximize and minimize dressing-failure objectives. The main paper also described three objectives including best/worst failure. Preserve these distinct printed specifications; do not silently turn them into one unambiguous experiment configuration. Exact source anchors: S21, S25, S28, S29, S30, S31, S32, S33, F7 in quotes.json, with section, PDF page, literal character and LF offsets. ## D19: RAD parameter owner and energy details G.1’s internal-parameter definitions attach pModel1/pModel2/pModel1_2 to the dressing modelmdp, but Listing 1.6 declares/uses those selection parameters in the monitoringDTMCmum. Their domains are dependent distributions summingto1, not 4 independent unrestricted continuous coordinates. Picking/recalibration energy reward rates are27/8 W. These details matter for a typed formal specification and faithful energy objectives. Exact source anchors: S29, S30, S31, S33 in quotes.json, with section, PDF page, literal character and LF offsets. ## D20: Casino synthesis and summary-table mismatch G.2’s cheater chooses boldness (probability of cheating), dice weighting (six probability when cheating), and gameG1/G2. Fair six probability is 1/6; G1 win probabilityp6/payout1.3, G2 .8*p6/payout1; casino perceptiveness is detection chance if cheating wins, set.3 in Table G.2. Prose maximizes winnings and minimizes being caught. Table G.2 lists onlygame/boldness as internal and instead maximizes steady-state cheating with a noticed query listed asC1. Treat these as specification discrepancies, not equivalent objective formulations. Exact source anchors: S28, S33, S34 in quotes.json, with section, PDF page, literal character and LF offsets. ## D21: SmartFarm synthesis G.3 models 2grid MDP robots plus a human supervisor/systemDTMC and collision-sensingDTMCs, trading sensor accuracy/computational cost and retry/cost/success. Three retry counts have domains 1..5. G.24 maximizes eventual joint mission completion and minimizes expected accumulated mission cost until each actor succeeds/fails. Figure 4 Pareto fronts are in the inherited main paper; no separate new supplemental measurements or field trial is supplied. Exact source anchors: S28, S34, S35 in quotes.json, with section, PDF page, literal character and LF offsets. ## D22: Evaluation and formal verification relevance: reader inference The supplement strengthens the mathematical/model description and exposes solver/convergence and specification-alignment obligations, rather than independently confirming main timings. For a Verus/TLA+ or agent workflow, distinguish correctness of a checker on an input model, sound parameter estimation/fixed-point selection, faithful system modeling and finite-search optimality. None follows automatically from the others. No distributed-system implementation, Rust/Verus proof or TLA+ model is evaluated here; the prior theory paper and external artifact implementation remain unread. Exact source anchors: S7, S8, S11, S13, S14, S15, S18, S19, S20, S28, S33 in quotes.json, with section, PDF page, literal character and LF offsets. ## Exact quotation F1 Appendix D.3 Definition 17/Example1/Theorem 1; PDF page 14. > Theorem 1. Function Verify from Algorithm 1 terminates and returns the > correct value of property ϕv of model mv. ## Exact quotation F2 Appendix D.3 Theorem 1 proof and operation costs; PDF page 15. > The > relevant solution to these equations (obtained in line 34) is used to set the values > of all dependency parameters of all the models from SCC(mv) in lines 35–37, > after which VerifySCC exits, enabling the Verify function to then obtain and > return the value of property mv in line 15, and to terminate. ## Exact quotation F3 Appendix E.3 Theorem 3/convergence proof/cost definitions; PDF page 19. > Theorem 3. Assuming that the basic auxiliary functions from Algorithm 2 > ( InitialisePopulation, ExtractSCC, Converged and Instantiate) are > correct and terminate, function Synthesise terminates. Furthermore, as the > population size N and the maximum number of generations MAXGEN increase, > the function returns a non-dominated set of internal-parameter valuations that > converges towards the Pareto-optimal solution set with respect to optimisation > objectives (E.10), while strictly satisfying constraints (E.9). ## Exact quotation F4 Appendix E.3 Theorem 3/convergence proof/cost definitions; PDF page 19. > using established MOGA mechanisms guaranteed to terminate and > designed to converge (as N and MAXGEN grow) towards the set of solutions > that are Pareto-optimal with respect to the optimisation objectives provided > to the MOGA. ## Exact quotation F5 Appendices A.5/B parametric models/checking; PDF page 7. > It is important to distinguish between the modelling capabilities of our tool > and the combinations of model and property types supported by parametric > model checking. Thus, our tool allows the assembly of stochastic world models > comprising a wider range of parametric models than those currently handled > by parametric model checking. This is possible because the parameters of our > models can be estimated via statistical inference from sources such as lab testing > and runtime monitoring, derived by applying probabilistic model checking to > non-parametric models, or synthesised using evolutionary computing methods. ## Exact quotation F6 Appendices E.3/F.1 Theorem 4 and verification case introduction; PDF page 20. > This appendix includes four case studies from different domains whose depen- > dency relationships and verification results are shown in Figures 2 and 3 from > our CAV 2026 conference paper [4]. Table F.1 summarises the stochastic world > models for each case study, and Table 1 from the conference paper [4] provides > timing results. ## Exact quotation F7 Appendix G.1/G.2 internal parameters/EquationsG.22–G.23/Casino; PDF page 33. > Given this RAD stochastic world model with four internal parameters, the > ULTIMATE synthesis problem mentioned informally at the beginning of the > section involves finding a set of valid valuations for these parameters such that > the associated stochastic world model instances satisfy the constraint The main-paper record is preserved in main_record_inherited.json. New source quotations, diagnoses and evaluation facts concern the prose supplement. No implementation was inspected or executed; no scientific artifact dataset, stored result or checkpoint was opened; no formal tool was run. No new independent review or reproduction is claimed. Defines dependency, external-observation and internal-choice parameters. The orchestrator uses dependency-graph SCCs to order analysis, PRISM/PRISM-games/Storm for component properties, and SciPy solvers for circular dependencies. Newton-Raphson solves rational parametric equations where supported; Powell optimization repeatedly calls model checkers otherwise. Synthesis searches constrained multi-objective parameter valuations with a genetic algorithm. Lazy evaluation and caching avoid irrelevant or repeated subtasks. The full paper demonstrates five verification and three synthesis cases and separates model-checker cost from orchestration overhead.
  • number: 75 FX models with 529,239 states each: over 39 million component states, 184.50 s
  • number: Synthetic crowds 10,633,591-state DTMC + cluster 9,465,876-state CTMC + wlan6 5,007,548-state MDP: 72.14 s total, 71.81 s in Storm (99.5%)
  • number: Acyclic verification requires at most #D+1 model-checking tasks; MOGA multiplies SWM verification by constraints/objectives, population and iterations
  • limits: Supplied finite stochastic models and parameter semantics must faithfully represent the intended system; observations/inference, checker fragments, solver termination/fixed-point admissibility/selection/precision and helper correctness qualify conclusions. Main§4 denies a formal global-optimality guarantee for heuristic search; supplementTheorem 3 states conditional asymptotic convergence but does not specify a full generic MOGA convergence theorem. Finite N/MAXGEN outputs are feasible and nondominated only relative to retained candidates, under Verify assumptions. The supplement is now fully read; prior theory paper/artifact implementation unread. Tables/prose/parameter-owner inconsistencies and model-listing abbreviations preserved. Main confidence intervals/incremental verification remain future work. AppendixA.1 literally defines bounded until with “some x < k” and unbounded until with “the first x > 0 states”. With its one-based path indexing, these exclude satisfaction exactly at stepk and at the initial state, respectively. Standard non-strict until includes both endpoints. Treat these as printed background-definition discrepancies before reusing the prose as a formal specification; no defect in the uninspected checker follows.
  • how much was read: most of it read
  • source
  • record id: ultimate-heterogeneous-stochastic-world-model-checker-2026
• Unit proofs study (2026)
  • title: Do Unit Proofs Work? An Empirical Study of Compositional Bounded Model Checking for Memory Safety Verification
  • what: Studies a systematic bottom-up method for compositional CBMC unit proofs. Analysts iteratively build harnesses, ensure termination, increase coverage, and refine models of unknown variables/functions from error traces; objective completeness requires graceful termination, full reachable-line coverage, and resolution of every memory-safety violation. The study selects 73 functional units from 89 known defects across FreeRTOS, Zephyr, Contiki-ng and RIOT. Initial harnesses set loop bounds to one; coverage gaps trigger larger bounds or allocation limits, while error traces drive minimal preconditions and function models. The blind construction protocol separates defect identification from proof writing. Analyses quantify model types, loop bounds, development/execution cost, comparison with engineer-authored FreeRTOS proofs, and generalizability to larger functions.
  • number: 66/89 known defects (74%) exposed systematically; +8 (9%) after interventions; 15 (17%) not exposed
  • number: 19 new defects: 12 out-of-bound reads, 5 out-of-bound writes, one null dereference, one arithmetic underflow
  • number: Mean proof 20 LOC, 5 variable models and 2 function models; median development 72 min, execution 25 s
  • number: Average development 82 min and execution 61 s; 87.67% execute under 60 s
  • limits: CBMC bounded proofs only cover modeled scopes and chosen loop/data bounds; fixed or overly restrictive models can hide defects. The bottom-up angelic-modeling strategy may miss bugs when preconditions are too strong, and 15/89 known defects were not exposed. Authors note proof writers knew units were defective, and results study one unit-proof operationalization on four embedded OSes. Findings do not establish unbounded memory safety or generalize to other BMC tools.
  • how much was read: most of it read
  • record id: unit-proofs-study-2026
• VeGo Go deductive verification (2026)
  • title: VeGo: Direct Deductive Formal Verification of Go Programs for Computer Science Education
  • what: VeGo embeds Hoare contracts, invariants, variants, recursive measures, relational state assertions, and preservation blocks in Go comments while compiling and executing as ordinary Go; it verifies the code through preprocessing, CFG/SSA, weakest-precondition VCs, and native HM[X] constraint solving. The specification language includes clopen interval and slice-range quantifier desugaring, primed multi-state variables, contract-precision checks via weakest/strongest preconditions, and an LSP workflow with diagnostics. The implementation avoids a third-party prover by solving VCs over SSA with native HM[X]/Fourier–Motzkin components, and the case studies distinguish compact-array, sparse-array, and boxed tree/heap encodings plus sorting permutation properties.
  • number: all algorithms and data structures in the listed CLRS, KT, Okasaki, and Knuth suites are reported 100% verified under –strict
  • number: six sorting implementations are checked for sortedness and multiset permutation preservation
  • number: verification pipeline has four stages: preprocessing/desugaring, CFG/SSA, wp VC generation, native HM[X] solving
  • number: no comparative runtime benchmark table is reported
  • limits: The strict guarantees apply to Go programs and specifications accepted by VeGo’s current language and native solver. The educational benchmark covers textbook algorithms and data structures, while concurrency support for goroutines/channels is presented as a roadmap rather than evaluated functionality. Contract precision still depends on the student stating non-vacuous predicates such as permutation preservation.
  • how much was read: most of it read
  • record id: vego-go-deductive-verification-2026
• Veil issue 26 (2026)
  • title: With veil.smt.trust false, a transition’s obligation errors but #check_invariants still prints success
  • what: The issue reports that Veil can print a checkmark even when an SMT obligation errors under the no-trust setting.
  • number: Issue reproducer shows an obligation error paired with successful-looking text output.
  • limits: Open issue; pre-release/main revisions are named in the report.
  • how much was read: most of it read
  • source
  • record id: veil-issue-26-2026
• Velvet (2026)
  • title: Velvet: A Foundational Multi-Modal Verifier for Imperative Programs in Lean
  • what: Embeds imperative programs and contracts in Lean. Verification conditions are generated automatically. When automation fails, it leaves ordinary Lean goals, and humans or AI tactics finish them.
  • number: On average 3.3x fewer total lines than Dafny on manually verified case studies (Section 4, pp. 9-11)
  • number: 27 VERINA benchmarks; 618 non-comment LOC
  • number: 21 automatic, 6 manual
  • number: 3.67x slower than Dafny; all under 45 s
  • limits: The evaluation is manual verification, not an LLM benchmark. No evidence that agents succeed more often.
  • how much was read: most of it read
  • source; notes: Loom/Velvet paper and technical boundary
  • record id: velvet-2026
• VerCors data-parallel scalability (2026)
  • title: Scalable Deductive Verification of Data-Level Parallel Programs
  • what: Improves VerCors scalability for array/matrix data-parallel programs with three linked techniques: rewrite nested quantified array expressions into equivalent single-variable forms with usable SMT triggers, use unique type qualifiers to rule out array aliasing, and use immutable qualifiers to model unchanged arrays as mathematical sequences. Kernel-body extraction further reduces solver context. Section 2 explains permission-based separation logic, Viper translation and nested GPU parallel blocks through OpenCL XswapFast and PVL examples. Section 3 defines a bijective inverse for linear index expressions, states conditions for correctness, and reports a 2,500-line Lean 4 proof of the rewrite theorem; nonlinearity and unsupported modulo patterns remain limits. Section 4 explains Viper quantified heap chunks and snapshot comparisons, then defines immutable and unique typing, including struct/pointer examples. Section 5 evaluates CLBlast BLAS kernels, earlier Halide/HaliVer benchmarks and a Radio Telescope Pipeline containing the Padre algorithm. On an i7-11800H/32GB Ubuntu 23.04 machine, ten runs per experiment and one-hour timeout show all techniques up to 150× speedup, 8.5× total Level-1 and 10.8× Level-2 CLBlast speedups, more than 1.9× on earlier experiments, and previously unverifiable xger/xher2 and Padre cases becoming verifiable. The rewriter was essential for every reported experiment; gemm_3 failed because modulo is unsupported.
  • number: 2,500 lines Lean 4 rewrite proof
  • number: average 9× GPU-kernel speedup
  • number: up to 150× outlier speedup
  • number: 8.5× Level-1 and 10.8× Level-2 CLBlast total speedup
  • limits: Correctness assumes injective linear indexing and the stated bounds/sign/stride conditions; generated triggers still depend on SMT solver behavior. VerCors specifications must provide permission annotations; unique qualifiers are sound only when non-aliasing claims hold, and immutable coercion consumes positive permissions. Experiments use fixed thread-block sizes, Silicon symbolic execution, x86_64 targets, 60-second assertion and one-hour total timeouts, and selected GPU/CPU kernels. Results do not establish correctness of arbitrary GPU code or Rust concurrency.
  • how much was read: most of it read
  • source
  • record id: vercors-data-parallel-scalability-2026
• Verified Romanov Triplet Logic (2026)
  • title: Formal verification of Romanov’s triplet logic: A verified filter for sliding-window 3-CNF with application to structured formulas
  • what: Mechanizes Romanov’s Triplet Logic in Rocq, verifies translation/clearing/SVI operations, and extracts a verified filter plus exponential post-check for well-formed sliding-window 3-CNF. The work identifies a precise correctness boundary: SVI is a sound one-sided filter in general, while aligned intersection and a strong CTF predicate restore completeness for the structured sliding-window fragment. The VFR prototype combines machine-checked polynomial filter stages with post-check search and validates outputs against SAT/brute-force oracles.
  • number: Rocq development exceeds 23,000 lines across 17 files, with 424 proved lemmas/theorems and zero admitted goals
  • number: 100% agreement with brute-force oracle on random sliding-window instances for n≤6
  • number: Polynomial filter stages plus exponential post-check; verified permutation search practical only for n≤8
  • limits: Completeness is restricted to well-formed sliding-window/grouped structures; weak CTF can be incomplete and clearing can destroy valid paths. The CNF-to-CTF grouped-window translation remains unverified, post-check is exponential, and verified permutation search is practical only up to n≤8. General 3-SAT still needs external verified solvers/certificates.
  • how much was read: most of it read
  • record id: verified-romanov-triplet-logic-2026
• Verus-TLA repository (2026)
  • title: verus-tla export (BasisResearch/verus PR #51)
  • what: This crate embeds TLA temporal predicates in Verus and provides state-machine structures, fairness predicates and verified helper lemmas for safety and liveness proofs.
  • number: 8 states
  • limits: README-level documentation; no independent proof audit was run.
  • how much was read: most of it read
  • source; notes: R02. Verus temporal libraries, 2025–2026 repository leads
  • record id: verus-tla-repository-2026
• VyZX verified ZX calculus (2026)
  • title: VyZX: Formal Verification of a Graphical Quantum Language
  • what: Presents VyZX, a Rocq-verified inductive library for ZX-calculus diagrams, semantics and rewrite rules, plus ZXViz visualization and circuit interoperability. VyZX represents variable-arity diagrams inductively with explicit casts for dependent dimensions, defines matrix semantics in QuantumLib, and proves proportionality/equality composition lemmas. It formalizes Jeandel et al.’s complete equational theory including connectivity, spider fusion, Hopf, bialgebra, state-copy and self-loop rules; proves scalar and matrix universality through diagrammatic scalar gadgets and controlizer-based addition; ingests SQIR circuits and verifies Bell-state preparation and peephole optimizations. ZXViz renders nested proof states in VSCode/rocq-lsp and automation handles color swaps, transposes and casts.
  • number: variable input/output arities
  • number: complete ZX equational theory
  • number: arbitrary complex linear maps
  • number: QuantumLib semantics
  • limits: Correctness is relative to QuantumLib’s complex matrix semantics and ZX diagrams are generally identified up to nonzero scalar proportionality, with stricter equality tracked when needed. Dependent natural-number dimensions require casts and proof-automation support; very large universality diagrams can be exponential. The paper demonstrates examples and a complete rule library rather than quantitative proof-performance benchmarks, and focuses on quantum graphical languages, though principles generalize to symmetric monoidal categories.
  • how much was read: most of it read
  • record id: vyzx-verified-zx-calculus-2026
• Weak simplicial bisimilarity (2026)
  • title: Weak Simplicial Bisimilarity and Minimisation for Polyhedral Model Checking
  • what: Introduces the weaker spatial logic SLCS_eta and matching weak simplicial/weak plus-minus bisimilarities, proves Hennessy–Milner characterisations and a semantics-preserving minimisation procedure for polyhedral cell-poset models. SLCS_eta requires the source point and intermediate path points to satisfy the reachability condition, making it strictly weaker than SLCS_gamma. The paper proves the continuous polyhedral and discrete cell-poset interpretations coincide (Theorem 3.20), then proves weak simplicial bisimilarity and weak plus-minus bisimilarity coincide with logical equivalence (Theorems 4.9 and 4.12). A three-step construction encodes a poset as an LTS, minimises by branching bisimulation (mCRL2), and reconstructs a Kripke model whose SLCS_eta formulas are preserved/reflected (Theorem 5.12). The prototype maps results back to meshes for visualisation.
  • number: 2,619-cell maze reduced to 7 equivalence classes
  • number: other tested mazes have 3,568/21, 6,145/38 and 13,375/21 cells/classes
  • number: model checking original versus minimised 3x3x3 maze takes 8.76 s versus 0.02 s
  • number: for 5x5x5, original versus minimised checking is 671.30 s versus 0.03 s
  • limits: Models are finite polyhedra generated by finite simplicial complexes and finite labelled cell-posets; the results concern SLCS_eta and do not preserve modalities such as standard possibility that SLCS_gamma can express. Minimal models need not be posets or transitive, so a modified checker is required. The toolchain is proof-of-concept, depends on mCRL2 and dynamic state-label bookkeeping, and the authors leave a fully fledged implementation and efficiency study for future work.
  • how much was read: most of it read
  • record id: weak-simplicial-bisimilarity-2026
• WERR procedural neural synthesis (2026)
  • title: Zero-Storage Procedural Neural Synthesis via Boundary Dynamics: Formal Verification in Lean 4 and Bare-Metal Gauntlet Validation
  • what: Defines a procedural Mandelbrot-boundary decision kernel with a 24-byte seed, Q16.16 arithmetic, ZMod 9 phase projection, and CPU/EVM two-tier execution. A Lean 4/Mathlib module proves bounded fuel, ring closure, overflow safety, non-constant quadrant sensitivity and a parametric gas bound; bare-metal and ablation telemetry test throughput and behavior. The monograph includes the complete WerracleProof.lean listing and an axiom audit. It corrects a prior fuel-base-case ambiguity, proves escape bounds for 9 and 12 steps, enumerates a nonconstant escape spectrum and (5,7,9,8) quadrant case, proves Q16.16 square bounds, and models gas as 21000+100+7n_gridmax_iter+113. It reports a 3-arm Pollard/Brent versus Cauchy-jump ablation and an EVM fee-hook comparison.
  • number: 100,000 decisions in 6.4946 s, 15,397.4 decisions/s, 15.15x baseline speedup
  • number: MCD4 suppresses 100% U(2.5,6.0) spikes while preserving 89.60% clean Gaussian signal
  • number: gas bound 22,557 <= 24,000
  • number: semi-prime ablation: classical and seeded arms 100% factoring, Cauchy-jump arm 0%
  • limits: Proofs establish properties of the specified finite Lean model, not correctness of the broader Mandelbrot or trading claims. Overflow theorem assumes |z|<=2 in Q16.16; gas theorem assumes grid size 16 and iteration k<=12. Benchmark comparisons use one dual-Xeon server and supplied datasets; zero-storage means a coordinate seed, not zero computation. The authors disclose patent interests and use of generative AI for typesetting/proof structuring.
  • how much was read: most of it read
  • record id: werr-procedural-neural-synthesis-2026
• Why Agentic Theorem Prover Works: A Statistical Provability Theory of Mathematical Reasoning Models (2026)
  • what: Develops a statistical theory for finite-budget agentic theorem proving. It models verifier-backed proof search as a deterministic finite-horizon reachability MDP and defines statistical provability as the probability that a specified prover reaches a verified proof within a verifier-call budget on a problem distribution. Under a faithful state abstraction, optimal MDP success equals budgeted syntactic provability. For offline depth-wise action-value regression followed by greedy proving, Theorem3.1 bounds the gap to the optimal prover by an occupancy-weighted sum of value-estimation errors; the multiplier is the learned prover’s average truncated proof length. Error terms separate approximation, training-region coverage geometry and Monte Carlo rollout noise, with a faster rate under an action-gap margin condition. Defines full proof states as multisets of open goals so branching remains Markov, deterministic verifier transition F, solved set G, hitting time TG, budgeted value V and average truncated length Len. Assumption3.1 requires compact concentration sets, Lipschitz optimal values and hypothesis classes, local-mass coverage of i.i.d. query pairs, conditionally independent binary rollout labels with mean Q*, and minimax regression. Theorem3.1 gives εt=approximation+covering term+Hoeffding rollout noise and regret 2Σ unsolved-mass×ε. A margin condition changes ε to ε^(β+1). Budget allocation balances Nt and mt under total labels nt=Ntmt. Appendices prove deterministic MDP, faithful abstraction, Bellman recursion, greedy regret, covering and uniform regression; truncation adds overflow penalty δW. Appendix C proposes representation selection by Bellman-certificate tightness and a complexity penalty; Appendix D interprets scaling through horizon, effective dimension and margins.
  • number: Main bound: best success probability minus learned prover’s is at most 2 times (worst per-step value error) times the learned prover’s average number of checker calls before success or budget end
  • number: Under an action-gap margin condition the dependence on error improves to a fast rate
  • limits: Faithful abstraction assumes e(FR(r,a))=F(e(r),a) and exact preservation of solved states. The equality between optimal MDP success and syntactic provability follows this assumption; arbitrary learned embeddings need not be faithful. The theory is trace-local. Compact concentration Ct must cover both training queries and learned-prover comparisons, and the candidate region must retain at least one globally optimal action. The paper explicitly says a new prover leaving the occupied region is no longer certified without added coverage assumptions. Binary rollout labels are idealized verifier-backed success labels with conditional mean Q*. The paper says practical-target bias can be absorbed into ε, but the stated theorem assumes exact Q* labels and its approximation term is relative to Q*. Biased targets require an explicit allowance; reader derivation using the supplied minimax proof adds2bt when label means differ uniformly by≤bt. Repeating suboptimal-policy rollouts reduces sampling noise, not this bias. No empirical calibration is supplied. The exact minimax regression optimizer is an idealization. Numerical optimization error ξt can be added, but no practical learner, neural architecture or training algorithm is evaluated. The verifier transition is deterministic, while policy decoding, retrieval and exploration may be random. The theory addresses greedy proving; beam search, backtracking, top-k and decomposition need extra retention/suboptimality assumptions. The finite-horizon result does not remove undecidability, worst-case hardness or unknown proof existence. Statistical provability depends on q0, so a biased library workload can be easy while adversarial or uniform hard instances remain difficult. The effective dimension dt, coverage ct, Lipschitz constants, action-gap tails and occupancy curve are theoretical quantities. The paper proposes estimating them from traces as future work and reports no benchmark measurement. No Verus/Rust/TLA+/distributed-system experiment is supplied. Transfer to systems verification is an inference about replacing proof-state/verifier interfaces, not a measured claim.
  • how much was read: most of it read
  • source; notes: Why Agentic Theorem Prover Works (2026)
  • record id: why-agentic-theorem-prover-2026
• WMC-PMC correspondence (2026)
  • title: Reasoning with Probabilities: Relating Weighted Model Counting and Probabilistic Model Checking
  • what: Establishes mappings between cycle-free parametric Markov chains and arithmetic circuits, reducing reachability probabilities to weighted model counting, and maps a probabilistic subclass of arithmetic circuits back to pMCs. Defines correspondence between WMC literals/weights and PMC states/transitions, proves preservation of reachability semantics, and discusses transferring bisimulation minimization and optimization techniques between frameworks.
  • number: no empirical benchmark reported
  • number: semantic mappings and proofs are the evaluation basis
  • limits: The forward mapping targets cycle-free pMCs and the reverse mapping only a subclass of arithmetic circuits with probabilistic semantics. The contribution is foundational and does not report an implementation or empirical runtime evaluation.
  • how much was read: most of it read
  • record id: wmc-pmc-correspondence-2026
• Zero-knowledge model checking (2026)
  • what: Introduces zero-knowledge model checking (ZKMC), proving that a secret reactive system satisfies a public temporal specification without disclosing its transition relation, via explicit-state KZG commitments or symbolic Farkas witnesses and folded sigma/range proofs. The framework certifies LTL/ω-regular model checking by ranking functions for the product with a complementary Büchi automaton. The explicit-state scheme commits to secret initial states/transitions and batch-proves that public counterexample states cannot be in the secret model; its certificate is two group elements while prover work is quadratic in state count. The symbolic scheme restricts systems to linear guarded commands, translates initiation/step/fairness obligations to linear-inequality unsatisfiability, uses Farkas dual witnesses, Pedersen matrix commitments, zkMatrix multiplication, Bulletproof range proofs and a Salem–Spencer one-shot fold. The prototype tests handshake, DHCP and round-robin protocols and reports separate enumeration/setup/prover/verifier timings, showing complementary scaling regimes.
  • number: explicit-state runs up to about 2^12 states in the stated two-hour budget; symbolic runs up to about 2^20.9 states and 2^13.7 obligations
  • number: explicit back-end is preferable below about 2^11.8 states; e.g. exb_i4a3 prover 2 s versus symbolic 1 min
  • number: symbolic dhcp_10000_3_10 (2^20.9 states) completes in under half an hour while explicit enumeration times out
  • number: round-robin rr_5 reaches 2^10.2 states and 38,427 obligations; symbolic verifier is OOM
  • limits: Soundness relies on binding/hiding commitments, knowledge-sound zkmm/zkeq/zkrp, Fiat–Shamir random-oracle modeling and field bounds avoiding integer wraparound; Farkas completeness can fail when only rational or out-of-bound witnesses exist. Explicit-state verification exposes quadratic state-space costs; symbolic verification requires linear guarded-command models, integer coefficients and piecewise-linear rankings. Public specifications/certificates can themselves leak the secret model, and side channels are out of scope. A negative verification result does not imply the property is false.
  • how much was read: most of it read
  • record id: zero-knowledge-model-checking-2026
• A Formal Proof of Complexity Bounds on Diophantine Equations (2025)
  • what: Formalizes in Isabelle/HOL a transformation from natural-number Diophantine representations to equivalent equations with eleven integer unknowns and a computed upper bound η(ν,δ) on total degree. Proves the conditional universal-pair theorem (ν,δ)N⇒(11,η(ν,δ))Z. Combines digit coding, Lucas/Pell equations, a bridge theorem and relation combining, then eliminates a final nonnegative unknown with a three-squares formula. Proof-producing tools translate ordinary polynomial terms to multivariate polynomials and calculate degree bounds. Concrete numerical pairs retain assumed natural-number universal pairs. Tracks parameter versus unknown count, natural versus integer solution domains, imported versus checked universality, zero/constant cases, polynomial substitutions and weighted degree environments, proof-producing automation and actual locale assumptions. Records numerical bounds, author-reported errors discovered during concurrent mathematics/formalization, and discrepancies between printed informal statements and formal theorem domains. Current AFP source confirms both numerical corollaries remain conditional; no independent certification performed.
  • limits: A Diophantine equation is a polynomial equation with integer coefficients; unknowns here may range over N or Z. A parameter a ranges over N and is not counted among eleven existential unknowns. A universal pair (ν,δ) bounds the number of unknowns and total polynomial degree for every Diophantine set of natural parameters. This is undecidability for a class of equations, not a solver runtime, bit-complexity result, or proof that every particular equation is undecidable. Theorem1/Listing18: given a natural-number universal pair, produce an integer universal pair with eleven unknowns and η=15616+233856δ+233952δ(2δ+1)^(ν+1)+467712δ²(2δ+1)^(ν+1). η is an upper bound obtained by compositional inequalities, not a minimal degree or exact degree for every input polynomial. Source Universal_Pairs separately handles total_degree P=0 with the original constant polynomial; positive-degree construction uses Q_tilde. Numerical pairs depend on external universality hypotheses. (58,4)N yields exact integer degree bound1681043235226619916301182624511918527834137733707408448335539840, rounded upward as1.68105×10^63. (32,12)N yields950817549694171759711025515571236610412597656252821888, bounded by9.50818×10^53. Both are conditional in current AFP universal_pair_1/2. Paper says only the latter natural pair lacks a published proof, but neither natural universality proof is formalized here. Outlook explicitly proposes formalizing Jones’ natural pairs. Corollary2’s undecidability for ≤11 unknowns and degree≤1.69×10^63 thus combines checked transformation with external mathematical input; it is not established here as an assumption-free end-to-end machine theorem. Formal polynomial type α mpoly is a finite coefficient map from finite natural-exponent maps. Coefficient ring is commutative and unital; integer coefficients are used for main construction. Polynomial variable indices are natural numbers. max_vars is greatest used index with zero inserted for constants, not cardinality of vars; index0 is the parameter, so max_vars≤11 means at most eleven unknown indices1..11. Gaps in indices need attention when interpreting counts, although this construction uses consecutive indices. Total degree is max monomial exponent sum, with degree0 for the zero polynomial. Product degree equality needs nonzero factors and a suitable coefficient domain; the weaker inequality deg(PQ)≤degP+degQ works even for zero factors and general coefficient rings. Paper’s emphasis on upper bounds avoids unnecessary hypotheses and exact-cancellation analysis. Evaluation/substitution correctness says insertion z (poly_subst f P)=insertion ((insertion z)∘f)P; variable support after substitution lies in the union of supports of substituted polynomials. Weighted total_degree_env assigns a degree to each variable and takes maximal weighted monomial degree. Updating this environment during nested substitution supplies a compositional upper bound. Cancellations may lower the actual degree. poly_extract turns a curried ordinary Isabelle polynomial function into int mpoly plus an evaluation-equivalence theorem; it supports constants, variables, addition, multiplication, natural-number powers and already translated terms. It is not a translator for arbitrary computations. poly_degree produces a degree-bound term and a correctness theorem for its supported arithmetic/substitution syntax. No separate trusted numerical oracle is described; kernel checking of generated theorems is the intended assurance boundary, but kernel/build and tool implementation were not audited here. Three-squares formula used here is n=x²+y²+z²+z for every nonnegative n, with x,y,z arbitrary integers. Conversely x²+y²+z(z+1)≥0 for all integers, so substitution introduces no negative values. It replaces one final N-valued unknown by three Z-valued unknowns: eight unrestricted integers plus three yields eleven. Do not confuse this formula with asserting every natural is a sum of three plain squares. Relation combining first illustrates x>0 and y≠0 iff xy² is a positive integer, representable as a²+b²+c²+c+1; this uses three auxiliary integers instead of six separate witnesses. General Matiyasevich–Robinson Lemma6 combines S|T, R>0 and q square predicates into one polynomial with one nonnegative witness, assuming q>0 and S≠0. Formalization specializes to q=3, explicitly defining M3; it does not establish the fully general q formula. Square roots in the displayed general product cancel; that cancellation proof is omitted in the paper. Coding packs bounded nonnegative unknowns zi<b into digits at spaced exponent positions in base b, a power of two. A polynomial-derived factor places the value at a selected digit; digit-zero tests become no-carry tests and binomial divisibility. Footnote2 restricts the simple explanation to nonnegative coefficients and adds a correction for general integer coefficients. Constructed polynomial definitions are mostly deferred to the mathematical article; the conference text gives architecture and formal interfaces, not every term or proof step. CodingTheorem8 requires natural parametera, f>0, b(a,f) a power of two; formal locale additionally assumes δ>0. Forward witnesses are bounded g∈[b,γb^α), while reverse direction allows g∈[0,2γb^α). Listing10 also bounds every assignment entry, including z0=a, byb; these bounds require the coding construction’s lower bounds and must not be erased as harmless syntax. Current inspected definitions give b(a,f) depending on a,f rather than arbitrarybaseb. Source nine-unknown proof preprocesses P through suitable_for_coding, establishing positive degree and suitable coefficients before invoking the locale. Full preprocessing lemmas not audited. Lucas sequences obey xn+1=A xn−xn−1 with ψ0=0,ψ1=1 and χ0=2,χ1=A. Negative indices use ψ−n=−ψn and χ−n=χn. These supply polynomial Pell constraints for exponential coding. Printed Lemma10 says all integer solutions of X²−(A²−4)Y²=4 are exactly (χn,ψn), which omits negative X: at A=3,(-2,0) is a solution but χn(3)≥2 for every integern. Displayed formal lemmas/source instead prove that sequences solve Pell and that existence of either square root for a givenY is equivalent to Y=ψm. This weaker projection handles sign and is sufficient; the paper’s exact-pair prose should not replace the actual theorem. BridgeTheorem12 requires b≥0, X≥3b, Y≥max(b,256), g≥1. It equates b being a power of two and Y dividing binomial(2X,X) with six auxiliary integers h,k,l,w,x,y each≥b satisfying square, divisibility and inequality conditions. Forward implication needs only X≥b. Many intermediate variables U,V,A,…,T enforce technical bounds; the formal displayed relation clears denominators to (4gC−4glYJ)²<J². Equivalence with rational inequality (C/J−lY)²<1/(16g²) needs nonzeroJ andg; formal construction/conditions supply necessary side obligations rather than treating division by zero as ordinary arithmetic. Printed Definition11 lists two square conditions, DFI and (U^4V²−4)J²+4, plus divisibility S|T and rational inequality. Relation-combining formal specialization uses three square predicates; the actual combined construction supplies the needed additional square encoding and bounds. The conference exposition does not list every substitution, so do not infer a complete executable polynomial directly from Definition11 alone. Theorem14/Listing15 transforms natural-number solutions of P into eight integer witnesses plus one nonnegative integern. The printed introduction’s Theorem3 instead writes original unknowns overZ. Section7 proof actually starts with N-valued unknowns, and Listing16 assumes is_diophantine_over_N_with A P. Targeted current source confirms the same N-to-Z construction. Thus the shown transformation Q_tilde(P) is not demonstrated here to preserve arbitrary integer solutions of the sameP. One can separately encode integers into natural variables first, but that is a distinct transformation and changes input degree/variable bounds. The universal-pair theorem only needs the correctly formalized N-to-Z direction. Reader domain example P(z)=z+1: it has integer root−1 but no natural root. The displayed N-to-Z contract therefore makes Q_tilde(P) unsatisfiable, whereas literal Theorem3 with unchangedP and integer original unknowns would require it satisfiable. This is a scope mismatch between printed construction claim and shown mechanization, not a proof that some eleven-variable equivalent equation for integerP cannot exist. Section7 prose also calls the _over_N predicate equivalent to integer existence without nonnegativity, conflicting with its own Listing15. Keep formal domain explicit. Bayer/David report formalizing while mathematics was still being developed by a student workgroup. Formalization helped expose inaccurate inequalities, missing hypotheses and a wrong degree formula, also present in an early preprint. For a separate technical lemma, the formalization team independently supplied a correct proof without noticing the fallacious original argument. Final manuscript review identified that argument and its overlooked dependence on Sun1992 Lemma10; the already complete formalization then supplied a corrected handwritten proof. This is qualitative author testimony, not a controlled productivity study or measured automated discovery rate. Named human contributors built tools and proofs; no LLM contribution or evaluation is reported. Targeted AFP current browser pages were fetched17October2026 and saved with URLs/timestamps/ETags where present; served files say last-modified6February2026. They are later current sources, not established identical to July2025 artifact or conference version. Entire Eleven_Unknowns_Z and Universal_Pairs source text read; only relevant theorem/context passages from other fetched theories read. No dependency-closure audit, axiom/admission scan, version-pinned certification, source execution or build performed. Separate arXiv2506.20909 mathematical article and cited papers were not read as part of this record. Claims of first nontrivial integer universal pair and current open ranges are authors’ historical assessments. The result does not settle rational Hilbert10, degree3, or integer unknown counts2..10. It gives no distributed algorithm, Verus/Rust safety proof, TLA+ model or protocol verification. Its relevance is formal theorem strength, proof-producing automation, hypothesis tracking and human/formal proof feedback.
  • how much was read: most of it read
  • source
  • record id: a-formal-proof-of-2025
• A Layered Formal Methods Approach to Answering Queue-related Queries (2025)
  • what: QuASI decides whether any packet trace consistent with per-port received/sent/dropped counts can satisfy a queue query. The enqueue-rate abstraction removes packet origins. A cheap first layer uses a disjunction of necessary constraints, constructs a purported most-uniform trace per component and checks input consistency via Gale-Ryser binary-matrix existence; negative answers are intended conclusive. Positive answers proceed to an exact Z3 switch model. Simulation evaluates tighter queue/buffer upper bounds, burst exclusion and runtime. Records concrete switch/count/query semantics, conservation-derived cover constraints, exact representative/input-labeling reductions and supplied proofs, all benchmark configurations/results and ambiguity about matched FPerf measurements and selected-negative query populations. Separates possible history from actual measured history, first-layer upper bounds from second-layer model-relative exact maxima, and common-path early exits from general scalability. Reader checks expose printed pseudocode boundary conditions, a tie-dependent MUC counterexample and unsupported exact multi-switch composition claim without claiming reproduced artifact defects.
  • limits: Finite single output-queued switch model, N input ports/Nq output queues/T discrete steps, at most one packet per input/output port per step, negligible forwarding time, known finite queue capacity and drops at full queue. Initial queues may be nonempty; sent+dropped totals can exceed received totals. Counts are treated as accurate and interval-aligned; counter wrap/loss, heterogeneous packet sizes/link rates, internal pipeline delay, uncertain measurement error and real scheduling refinements are not modeled in detail. Existential feasibility question: Mi∩Mo∩Q nonempty, where Mi fixes all input counts and Mo fixes output/drop counts. A positive answer means a behavior is possible, not that it occurred in the observed execution. A negative answer rules it out only under the modeled switch assumptions. Queue length measured in packets after dequeue, as exposed by FPerf comparison; translating packet count into latency requires fixed packet/service assumptions. Query grammar permits bounded existential/universal time and queue quantifiers, conjunctions, comparisons of enq/cenq/qlen, queue sums or differences, against K or Kt. Packets within a queue are indistinguishable by input origin. Abstract A[q,t]=sum_i P[q,t,i] reduces symbolic variables from O(NNqT) to O(NqT). Losslessness depends on origin-insensitive query and switch semantics plus exact enforcement of realizable input labeling, not arbitrary traffic/routing policies. Layer1 CSG derives output/drop necessary constraints sum_q_in_port cenq(q,T)>=deq+drp-initial_upper_bound using conservation. Enq/cenq queries eliminate bounded quantifiers; qlen queries use upper initial and lower dequeued/dropped bounds. Nonzero-duration bound nz(K) assumes maximum possible arrival rate and minimum dequeue rate, splitting always-nonempty and once-empty histories. Complete transformations for every grammar case, scheduler and queue-difference constraint are not enumerated; lemma is a proof sketch of the construction schema. Cover is a disjunction of components, each supplied to MUC as per-step lower bounds (LB), cumulative lower bounds (CLB) and cumulative upper bounds (CUB). This overapproximates output/drop/query constraints; input consistency alone can admit false positives. Theorem5.1 no-false-negatives depends on valid cover generation, actual minimum-uniform representative for every nonempty component and correct consistency checker. It is a paper theorem, not a mechanized code proof. MUC first places all LB packets, then fills CLBs in increasing time-point order, then fills remaining packets to totalP. It chooses eligible time steps with smallest total column height subject to upper bounds. Printed most-uniform definition/LemmaB.3 compare each descending-height prefix against every trace satisfying the cover component, but Eq8 implicitly assumes all comparison traces have the same totalP. That restriction is absent from the printed definition. It suits the intended reduction because input-consistent traces have totalP; this is an implicit restriction/reader repair, separate from the equal-total greedy counterexample. LemmaB.3 asserts greedy construction has this property; its argument relies on the unproved assertion that local greedy placement globally maximizes packets in all low-height columns, without an explicit constrained exchange proof. Reader tie-dependent counterexample to unrestricted Algorithm2/LemmaB.3: T=2,two queues,N=2,P=2,CLB(q1,2)>=1,CLB(q2,2)>=1,CUB(q2,1)<=0,LB empty. At time2 processq1 first; both columns initially height0 so minHeightIndex may choose2. Then q2 is forced to2, giving heights[0,2]. Feasible A places q1 at1/q2 at2, heights[1,1]. With input counts[2,0], A is input-consistent and R is not. Thus arbitrary tie selection is insufficient for stated MUC representative theorem; earliest-time tie choice avoids this particular case. No evidence that generated production cover components or artifact use the failing tie, and no artifact bug was reproduced. AppendixB.2 balancing-shift proof moves a label occurring in a taller column but absent in a shorter one, preserving input counts and per-step origin uniqueness. Relabel transforms descending height vectors using excess packets and prefix dominance, then assigns labels to actual trace columns. This reduction is reasonable conditional on true majorization/equal total, independently of whether the displayed greedy algorithm always establishes it. Labels can be remapped among output queues because origin identity is unobservable. Theorem5.4 and AppendixC prove equivalence between labeling A and an N×T binary matrix with row sums rcv and column sums aggregate A. MCC sorts marginals and applies Gale-Ryser dominance against the conjugate partition. Printed Algorithm1 initializes prefix[0] then starts recurrence at i=0, reading index-1, lacks an explicit equal-total test and conjugate-zero-padding/zero-input handling. The mathematical theorem assumes equal totals, and intended MUC fillsP, so unequal totals are primarily a generic printed helper boundary, not automatically an end-to-end safety bug. Printed Algorithm2 final fill checks total>P but does not reject total<P if upper bounds prevent fillingP. Example T=1,N=1,P=1,CUB(q1,1)<=0,no lower bounds returns an empty trace though no trace has totalP satisfying constraints. LB phase likewise needs compatibility with upper bounds. Correct helper definitions/prevalidation/total checks may repair displayed omissions; implementation was not inspected. Do not treat printed pseudocode as a verified executable. Layer2 uses Z3 constraints for switch operation, measurements and query; SAT witnesses possibility, UNSAT excludes it in the finite model. The paper gives no full constraint encoding, solver version/options, timeout/unknown policy, independent certificate checker or code-refinement theorem. An unknown/time limit cannot be treated as UNSAT. Model-level exactness remains conditional on faithful encoding, complete consistency constraints and successful solver termination. §4.2 says adding exact per-switch maximum queuing delays yields the true maximum along a network path. Reader qualification: a sum of independently maximized delays is generally only an upper bound unless one jointly feasible trace/packet attains them all. Paper provides no cross-switch joint timing/routing proof; QuASI itself supports single-switch queries. Do not promote this proposed use to proved exact end-to-end latency. General evaluation uses ns-3 simulated star topology,8 ports,randomized UDP traffic,250-packet maximum per port/2000total,25 selected intervals of100steps. They ensure queue buildup is possible. No real deployment telemetry, simulator/model conformance study, benchmark hardware/CPU/RAM/software versions, repetition/seed confidence intervals or systematic positive/negative classification dataset is supplied. SLO case is separate:8ports/8Gbps,1KB packets→1microsecond steps,2500packet per-port capacity,12 five-minute intervals over one hour,300million steps each,query queue>=290 for289microsecond SLO. All first-layer negative, no SMT layer; total0.03s. This certifies modeled queue threshold under chosen service/latency convention, not a measured end-to-end application latency including all other delays. Burst evaluation deliberately includes only impossible-burst queries. QuASI1 rejects all25 within1s; heuristic incorrectly permits14/25. This is not broad evidence of zero empirical false negatives or sensitivity on true bursts. Conservative heuristic uses total packets, active-input maximum rate and minimum dequeue rules, including other ports. Both heuristic and first layer intend conclusive negatives; heuristic positive means unresolved possibility, not proof of actual SLO violation. Quantitative metrics are found via repeated Boolean threshold queries/binary search. Layer1 produces upper bounds; Layer2 computes exact maximum over all model-consistent histories, not necessarily the peak in the simulated actual history. Authors use Layer2 answers as ground truth for Layer1, so this is shared-model internal validation, not an independent oracle. Avg relative error0.25,up to58% tighter than heuristic,Layer1<1s;Layer2 queue<25min/buffer<15min on the25 selected100-step intervals. FPerf comparison modifies it by stopping after base-workload feasibility, encoding only input counts (cannot encode output/drop measurements) and adding quantitative queries; no Burst support. T reduced to10 over10 intervals, about1day cutoff. The paper does not clearly say whether QuASI comparison runs also omit output/drop counts. Thus matched measurement constraints are not established; feasible-set differences could contribute if QuASI retained those counts. FPerf queue lengths are before dequeue versus QuASI after, giving one-packet offset. Nine/ten queue runs finish within1day; average8.5h versus QuASI1<1s, claimed up to10^6 speedup. QuASI2 is plotted near1s, so headline speedup is principally the cheap first layer, not uniform exact-SMT speedup. For T10 MaxBuff, FPerf does not finish required searches in1day and returns an upper bound about9times QuASI2 maximum; running one example>2days did not improve it. QuASI2<15min,QuASI1 matches exact answers for these examples. Since the paper leaves matching output/drop constraints ambiguous, its loose feasible maximum should not be attributed solely to solver performance without resolving that setup detail. Scalability differs by query: Burst cover has O(T) components and empirical roughly quadratic runtime,75min at60000steps. QlenK millions/300million steps returns<1s because CSG detects empty cover and skips MUC/MCC/SMT. This early exit establishes useful chosen-negative-case scaling, not that full trace matrices/SMT can process300millionsteps or arbitrary queue/burst queries. General full first-layer algorithm iterates packets/steps and need not be constant-time. Figures include schematic/query-language/proof diagrams plus evaluation panels, not a numerical result table. Reportedup to58%/10^6/0.25 remain authors’ summary statistics; raw per-interval data and exact tightness/error formula are not given. No Verus/Rust/TLA+ or LLM-agent implementation/proof evaluation supplied. Initial-state bound caveat: §5.1p1295 universally justifies initial_upper<=deq, but a saturated interval deq=Tdeq (T1,L2,initial2,deq1). The analogous single-queue argument p1296 correctly requiresdeq<T. Resulting necessary output-count inequality can still hold through arrivals>=drops; this justification gap alone is not an end-to-end false-negative counterexample.
  • how much was read: most of it read
  • source
  • record id: a-layered-formal-methods-2025
• A Theorem Prover Based Approach for SAT-Based Model Checking Certification (2025)
  • what: The tools nuXmv and PdTRAV find invariants (facts that stay true in every reachable state) showing a hardware circuit is safe. Python turns the result into PVS theories. Then PVS and Yices check safety on the original model, even after the solver simplified the model first. It comes before the Certifying rlive work.
  • number: 105 distinct problem instances
  • number: 166 of 189 runs certified by PVS (runs include different transformations of the same benchmark)
  • number: certification limits 8 GB / 3600 s; solver 4 GB / 1800 s
  • number: invariants one to two orders of magnitude smaller than original benchmarks, in AND gates
  • limits: It covers only safety of circuit models (“something bad never happens”). Liveness (“something good eventually happens”) and verifying the translator are left as future work.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: certifying transformations as
  • record id: a-theorem-prover-based-2025
• A Verified Cost Model for Call-By-Push-Value (2025)
  • what: Defines time and peak-term-size semantics for a closed untyped core of call-by-push-value extended with pseq, and reports HOL4 proofs of constant-factor simulations by substitution/heap machines plus a weak-call-by-value translation. Handwritten Turing-machine simulations interleave substitution and heap evaluation to claim polynomial time and constant-factor space reasonableness, relying on prior WCBV results in the reverse direction. Distinguishes formalized intermediate results from unformalized interleaving; printed formulas and transition rules have concrete issues detailed below. Records exact syntax/reduction costs and unary index-sensitive size, machine compilation formats and bounds, size-versus-pointer explosion, compressed heap output, binary iteration/space argument, necessity conjecture for pseq, mechanization boundary and artifact pointer. Gives concrete reader checks of displayed size inequality, heap environment links and return-value correspondence without attributing these printed defects to unchecked HOL4 scripts.
  • limits: §§1–3, pp.2–5: reasonable means mutual polynomial-time/constant-space-factor simulation with Turing machines, above linear input-resource regimes; sublinear classes such as LOGSPACE excluded. Core calculus untyped and closed at top level, two mutually recursive syntactic categories: values var/thunk; computations lambda,app,force,ret,seq,pseq,let. General products/effects absent. Typed terms are a subset, but no theorem about an actual production-language cost model supplied. §3, pp.4–6: pseq m2 m1 n evaluates m1 then m2 and substitutes their values at indices0and1 in n. It binds two results without extra nested seq depth. Time charges lambda/ret0, application/seq/pseq/let1 plus premise costs, force(thunk m)2 plus subcomputation. Thus time is this defined weighted semantics, not simply number of all source syntactic nodes traversed or machine instructions. Big-step semantics only gives finite costs for terminating evaluations. §3, pp.5–6: term size counts each constructor1and variable indexxas1+x. Space is maximum intermediate syntax size with unevaluated context/results included in max formulas. Indices effectively cost unary space, not constant-size identifiers. Translation-induced index shifts can therefore cause quadratic growth even when constructor count grows linearly. Same unannotated evaluation underlies time and space judgments. §4, pp.6–7: substitution compiler gamma serializes syntax with delimiter tokens; heap gamma-prime differs by ret v→gamma-prime(v)++retT. Program size1+sum token sizes, with varT x costing1+x. Delimiter extraction scans nested marker pairs and is undefined on malformed unmatched input. Compiler/machine invariants must guarantee well-formed programs; extraction is not a unit-time Turing operation. §5.2, pp.8–9: substitution machine task/value stacks perform closed substitutions eagerly, discard empty task fragments and retain suspended values/computations in value stack. Variable rule included to simplify proofs, unreachable on closed compilation runs. Lemma9 claims at most3k+1machine transitions for source timek; Lemma10 source peakspace s≤machinepeakσ≤9s. These are abstract transition counts; one transition may copy or scan a large program. §5.3, pp.9–10: heap machine uses closures(program,environment-pointer), append-only heap cells(closure,previous-pointer), lookup traverses environment chain. No garbage collection shown. Gamma-prime result has different return treatment from substitution encoding. Lemma15 claims≤10k+3transitions, Lemma16 state size≤(3k+1)(4k+2|m|), a bound in steps/input size rather than constant factor of source peakspace. Printed pseq environment link and final ret correspondence need repair below. §§2/6.1, pp.3–4/11–14: substitution evaluation has exponential-time copying when source steps cause size explosion; heap sharing avoids that but pointer representation can exceed source-space factor. Interleave separately simulated Turing machines: binarykstarts0, σ=|s|p(k), run substitution for up toksteps/space cutoff, increasekif insufficient steps, otherwise try heap withsamekafter space cutoff. Return heap+closure representation of normal form, not necessarily materialized exponentially large output syntax. Turing-machine part is handwritten adaptation, not HOL4 proof. §6.1 Theorems17–20, pp.12–14: substitution simulator claimed O(k poly(min(σ,S)))time and O(min(σ,S)+logσ+logk)space; heap simulator O(poly(|s|,k))time,O(|s|poly(k))space. Interleaving theorem20 claims O(poly(|s|,T))time,O(S)space for terminating closed s, with counters to10T+3. No explicit polynomial degree or machine benchmark is supplied. Printed theorem17 success/budget inequalities are stronger than simulation lemmas justify; source uses inconsistent cutoff constants9/3/1. §6.1 Lemma21, p.15: log T∈O(S) is argued from finitely many bounded-size terms and deterministic terminating reduction not revisiting a term. This absorbs binary step-counter space in O(S). It must be restricted to terminating reductions; divergent deterministic terms can revisit a state. The printed counting proof uses a five-symbol recurrence inconsistent with the listed token alphabet, although a larger constant alphabet can still support an exponential-count argument. §6.2 Theorem22, pp.15–16: WCBV terms var/app/lambda with weak evaluation translate c(lambda t)=ret(thunk(lambda c(t))); application uses pseq c(u)c(t)(app(forcevar0)var1). Claims targettime≤5source steps and targetspace≤6source peak. Existing WCBV/Turing theorem supplies converse reasonableness. Translation is the formalized part; complete end-to-end Turing-machine invariance is not machine checked here. §6.2, pp.15–16: the standard nested-seq alternative c-prime introduces vacuous binders. The source family has O(n) occurrences of var0 under O(n) application-introduced binders and its translation gets Omega(n²) unary-index size. Pseq or products avoid this particular encoding blowup. The authors conjecture no reasonable space model for the calculus without pseq/products; one failed translation does not prove no alternative encoding exists. §6.2.1, p.16: natural reverse translation d flattens value/computation distinction and represents thunk withlambda. Claims time reasonableness but demonstrates quadratic size on nested-thunk term family. Literal displayed seq/direction formulas and concluding impossible sentence have transcription/semantic issues; a detour via Turing machines is offered as an alternative, so do not adopt universal encoding-impossibility claim. §2 p.4/§7 p.17: reports HOL4 formalization covers §§3–5 and6.2; Turing-machine connections and interleaving remain handwritten adaptations. Artifact https://github.com/ZhuoZoeyChen/cbpv-reasonable-HOL/, swh1dir df18377e9fa5e35255f2687ad66ddbc2f010b934, DOI10.4230/artifacts.24718. This is an author-reported mechanization claim without independent replay or artifact-source comparison. No measured performance, proof-size counts, solver-success dataset, distributed specification, Verus, Rust, TLA+ or LLM-agent result.
  • how much was read: most of it read
  • source
  • record id: a-verified-cost-model-2025
• Ahvonen-Jaakkola-Kuusisto MSC formula-size game (2025)
  • title: Formula size game and model checking for modal substitution calculus
  • what: Defines game-theoretic and formula-size semantics for MSC, GMSC, GGMSC and SC, then characterizes expressive power and model-checking complexity, including asynchronous variants and a universal reduction. The paper gives two co-inductive semantic games (bounded-round and global interpretation tracing) and proves their correctness, then builds formula-size games whose winning strategies characterize separation of classes of pointed Kripke models, including non-uniform finite-model strategies. It identifies asynchronous MSC/GMSC/GGMSC with corresponding modal mu-calculus and computation-logic fragments, and encodes deterministic linear-tape-bounded Turing machines over words. Detailed reductions establish PSPACE-completeness for standard MSC/GMSC/GGMSC and SC, PTIME-completeness for asynchronous variants, constant SC data complexity, SC satisfiability bounds, and a computable reduction from every recursively enumerable problem to MSC model checking when input padding is allowed.
  • number: PSPACE-complete standard MSC/GMSC/GGMSC model checking (combined and data)
  • number: PTIME-complete asynchronous MSC/GMSC/GGMSC
  • number: PSPACE-complete SC model checking and satisfiability
  • number: PTIME-complete asynchronous SC model checking; NP-complete asynchronous SC satisfiability
  • limits: Results are semantic and complexity-theoretic over finite or word-like Kripke models; asynchronous semantics omit iteration clocks. The universal reduction relies on padding/extended word models. Formula-size games characterize fixed program size but do not provide a practical verifier. Undecidability of MSC/GMSC/GGMSC satisfiability remains, and succinctness questions are open.
  • how much was read: most of it read
  • record id: ahvonen-jaakkola-kuusisto-msc-formula-size-game-2025
• Amazon Verus blog (2025)
  • title: Developing provably correct Rust code with Verus
  • what: Amazon explains Verus specifications on existing Rust code, human-supplied high-level proof guidance, fast solver feedback and current Amazon/open-source examples including Nitro, Anvil and storage systems.
  • number: The post says Verus can provide feedback in under a second in practice.
  • limits: The post is an engineering overview; it does not present a controlled benchmark or a complete deployment proof.
  • how much was read: most of it read
  • source; notes: AWS: production proofs exist; published accounts do not attribute them
  • record id: amazon-verus-blog-2025
• AMC effectivity-frame model checking (2025)
  • title: Efficient Model Checking for the Alternating-Time µ-Calculus via Effectivity Frames
  • what: Implements full alternating-time µ-calculus (AMC) model checking over concurrent game frames (CGFs) and equivalent effectivity frames (EFs). Conversion precomputes coalition capabilities so modal checks become set lookups; the paper measures whether this amortizes conversion cost and compares against direct CGF checking and MCMAS. It defines CGF and playable EF semantics, proves the induced-frame translation preserves every AMC formula, and instantiates local/game-based coalgebraic µ-calculus algorithms in COOL. Random formulas, castle games and modulo games separate regimes: EF conversion has an upfront exponential-in-agents/moves cost, while EF evaluation benefits when many joint moves have equivalent outcomes or fixpoints repeatedly revisit modalities. The full AMC implementation supports Büchi-style formulas unavailable in MCMAS; MCMAS instead benefits from symbolic OBDD representations on succinct cases.
  • number: EF/CGF random-formula break-even near formula size 16 for local variants and larger for game variants
  • number: Modulo conversion grows with moves_per_agent^|Ag|; EF model-checking runtime is essentially constant as moves increase
  • number: MCMAS outperforms COOL on castle games with few equivalent moves; EF can outperform MCMAS on modulo games as moves/agents grow
  • number: COOL is the only compared tool handling full AMC; EF implementations remain roughly constant on the modulo Büchi benchmark
  • limits: Models are finite; EF playability is required for CGF equivalence. COOL uses explicit-state representations while MCMAS is symbolic and supports only ATL for this comparison, so timings are not apples-to-apples. Conversion enumerates joint moves (domain size moves_per_agent^|Ag|), and small models/formula sets can lose to conversion overhead. Experiments run on AMD Ryzen 7 2700/32 GB, at least five hyperfine runs and 200-second timeout; artifact availability is stated rather than independently audited.
  • how much was read: most of it read
  • record id: amc-effectivity-frame-model-checking-2025
• Asynchronous agents perfect recall (2025)
  • title: Asynchronous Agents with Perfect Recall: Model Reductions, Knowledge-Based Construction, and Model Checking for Coalitional Strategies
  • what: Develops I/O concurrent game structures with imperfect information for asynchronous multi-agent systems, stuttering-invariant perfect-recall strategies, a knowledge-based subset construction, and partial-order reductions preserving strategic abilities for simple ATL* formulas without nested strategic modalities. The I/O iCGS semantics models agent choices, shared-event miscoordination, and silent epsilon loops. Knowledge states are epsilon-closed observational subsets; expansion simulates original paths and turns memoryless strategies in the expansion into finite-memory strategies in the original system. Theorem 4 gives sound (incomplete) model checking for positive one-strategy ATLiR; Theorem 5 transfers to perfect recall. POR defines invisibility/independence and DFS conditions C1–C3, proving stuttering equivalence and preservation of sATL* under iR semantics. The result is decidable approximation because unrestricted ATLiR perfect-recall checking is undecidable.
  • number: three strategy classes ir, iF and iR
  • number: POR conditions C1–C3
  • number: sATL* excludes nested strategic modalities
  • number: ATLiR perfect recall is undecidable in general
  • limits: Finite local states/events and deterministic local evolution; imperfect information is local-state based; strategies are stuttering-invariant. Knowledge construction is sound but incomplete and may expand substantially. POR preservation excludes nested strategic modalities and next-step sensitivity (uses LTL-X/stuttering). Reactive-semantics characterization is conjectured and left for future work.
  • how much was read: most of it read
  • record id: asynchronous-agents-perfect-recall-2025
• ATLAS (2025)
  • title: Constrained LTL Specification Learning from Examples.
  • what: ATLAS learns LTL formulas (formulas about behavior over time) from good and bad example traces. It also takes user constraints and priorities, and solves with MaxSAT, an optimizing solver. It uses no LLM. Cases: Peterson mutual exclusion, a voting machine, robot-arm repair, and weakening an invariant.
  • number: Table I: 30/30 tasks mean 43.65 s (Peterson); 10/10, 3.08 s (voting); 20/20, 37.25 s (robot arm); 53/78, 66.75 s (invariant weakening)
  • limits: It finds the best formula only within the formula-size bound. A formula that fits the traces may not capture what the user meant. The benchmarks were built around the authors’ use cases. Using it needs formal-methods expertise.
  • how much was read: most of it read
  • source; notes: Constrained LTL Specification Learning from Examples (ATLAS)
  • record id: atlas-2025
• Automatically Generalizing Proofs and Statements (2025)
  • what: Lean proof-term generalization tactic that takes an existing proof and a selected constant, then returns a more abstract statement with a proof when transformation typechecks. It generalizes repeated occurrences independently, discovers related constants through type mismatches/antiunification, and abstracts composite proof fragments into hypotheses. Demonstrations include arithmetic, set cardinality, algebraic cancellation and Bézout. Six-stage description explains separate metavariables per occurrence, hypothesis abstraction from inferred types, iterative detection of dependent constants, unification to recover required equalities, metavariable-to-binder extraction, and type inference for the resulting statement. Contrasts accepted proof with useful/general/nonvacuous generalization, and shows how definitional computation or opaque proof steps obstruct extraction. Distinguishes implemented tactic from ideal future proof-discovery uses.
  • limits: Requires an existing formal Lean proof and user-selected expression/constant, optionally occurrence controls. Soundness relies on successful final proof typechecking in its Lean environment and the assumptions of referenced declarations. It is not a stand-alone axiomatic proof of the algorithm, an audit of input axioms, or a guarantee that a formal statement matches human intent. Accepted result is a provable conditional statement. This alone does not establish weakest hypotheses, nonvacuity, strict generality, novelty, usefulness or a canonical mathematical abstraction. Paper explicitly describes a true output hypothesis that forces n=2 and thus adds no genuine generality. Outputs depend on the exact proof, including how facts are encoded, not just the original theorem statement. The transformation operates on proof terms and loses tactic-script structure. Default abstracts all occurrences; coincidental equality may change output, and user can restrict occurrences. Dependent-constant search uses syntactic antiunification and a heuristic favoring fewer metavariables. No completeness, optimality, termination or runtime complexity theorem is reported. Related mismatches may remain unresolved, especially when generalized types lose definitional equality. Definitional-equality example fails when generalizing integers because divisibility no longer unfolds as the required existential. An explicit rewrite via Int.dvd_def records the connection as a proof step and permits an added divisibility-definition hypothesis. Merely unfold does not change the proof term and therefore does not provide that evidence. Computation can erase the dependency trace needed for abstraction:paper’s reduceMul example leaves 6 rather than how 2*3 produced it. Generalizing proofs cannot independently solve newly exposed mathematical subproblems. Original specialized computations may need to become hypotheses instead. Bézout output is a long collection of sufficient algebraic/size/quotient/remainder conditions from a particular proof, not a recovered canonical Euclidean-domain definition. Typeclass simplification and simultaneous generalization from two proofs are future work. Several application sections discuss an ideal algorithm or mathematical motivation rather than demonstrated execution:inductive proof discovery, intermediate-value abstraction, conjecture generation, learning from counterexamples, and interesting-question generation. No integrated LLM/automated proof-discovery evaluation is reported.
  • how much was read: most of it read
  • source
  • record id: automatically-generalizing-proofs-and-2025
• b-invariant regular model checking (2025)
  • title: Regular Model Checking Upside-Down: An Invariant-Based Approach
  • what: Reverses regular model checking direction: intersects all inductive b-invariants represented by CNF formulas with at most b clauses, obtaining regular over-approximations converging to reachability. Defines regular transition systems with finite-word configurations and length-preserving transducers, then constructs automata for IndInv_b. For every b, unsafe-intersection emptiness is in EXPSPACE; b=1 has an exponential NFA and PSPACE-completeness. The proof uses tables/separation languages and a reduction from polynomial-space Turing machines. MONA experiments compute minimal DFAs for IndInv_1 across classic parameterized protocols and inspect cases needing b>1.
  • number: IndInv_1 proves 46/59 benchmark properties
  • number: minimal DFA and MONA times range <1 ms to 1920 ms
  • number: b=1 PSPACE-complete; every b EXPSPACE upper bound
  • number: dining philosophers with fork ownership needs b=1; unlabelled forks require b=3
  • limits: Only length-preserving finite-state transducer transitions and regular initial/unsafe sets are covered; safety problem for RTS is generally undecidable. EXPSPACE result is an upper bound and authors conjecture EXPSPACE-completeness for b≥2. IndInv_1 can be too coarse (e.g., some mutual exclusion/cache properties), while manual reasoning shows b=2 or b=3 can suffice.
  • how much was read: most of it read
  • source; notes: Regular Model Checking Upside-Down (2025)
  • record id: b-invariant-regular-model-checking-2025
• Bolotina et al. rotor/bitme CFLOBDDs (2025)
  • title: Bounded Model Checking of RISC-V Machine Code with Context-Free-Language Ordered Binary Decision Diagrams
  • what: Presents rotor, which generates BTOR2 bit-precise models of user-space 32/64-bit RISC-V integer machines, and bitme, which unrolls those models for bounded checking using Z3/Bitwuzla and byte-oriented ADD/CFLOBDD domain propagation. The paper defines rotor models as (states, initial states, transition, bad states, good constraints), k-satisfiability, and a reachability correspondence proposition, while explicitly marking formal proof of rotor correctness as future work. Bitme tracker algebra maps bounded input domains to state values; soundness/completeness are conditional on correct BDD and SMT implementations and only hold modulo timeout and bound k. Arrays are flattened to bitvectors for propagation. In 18 microbenchmarks, most samples time out under SMT or constant propagation but finish with BDD propagation; ROABVDD is faster, whereas CFLOBVDD memory scales better on increasing input complexity. The study also identifies regressions and array-unfolding limitations.
  • number: 18 sample programs
  • number: 900 s timeout
  • number: three runs per sample
  • number: RV32I/RV64I with about 100 integer instructions
  • limits: Rotor models only user-space RV32I/RV64I plus M, compressed instructions, selected system calls, segmented 4GB memory, and bounded input bytes; floating point, more system calls/failure modes, liveness/fairness, symbolic console arguments, concurrent code and program equivalence remain future work. The reachability proposition assumes read consumes one byte per call. Bounded checking says nothing beyond k. Domain propagation is limited to input bitvectors up to 8 bits and arrays are not natively handled; fixed input order can cause exponential BDD growth. Experiments average three runs, use an unreported 18-program supplementary suite, and impose a 900-second timeout.
  • how much was read: most of it read
  • record id: bolotina-et-al-rotor-bitme-cflobdds-2025
• Budde et al. sound SMC (2025)
  • title: Sound Statistical Model Checking for Probabilities and Expected Rewards
  • what: Surveys statistical methods used by SMC tools, identifies unsound confidence procedures, recommends Clopper–Pearson for probabilities and DKW for bounded rewards, and introduces theoretical bounding-set and limit-PAC methods for unbounded reachability rewards implemented in modes. The paper distinguishes fixed-k and sequential PAC settings and requires worst-case coverage over all true probabilities, exposing why CLT/Wald, Wilson/CC and Chow–Robbins procedures can be unsound. It proves the DKW confidence band yields a tighter expected-reward interval than Hoeffding, derives bounds for instantaneous, cumulative and reachability rewards, and shows a finite-state DTMC geometric path-length construction is theoretically sufficient but often unusably large. DKW-E-Lower is a new lower-bound procedure for any nonnegative finite-expectation random variable, with a limit-PAC theorem. A survey of tools shows no sound and efficient default for sequential probabilities or fixed reward estimation before their modes implementation.
  • number: 44 benchmark instances
  • number: gamma=0.95, k=1000, m=5000 coverage test
  • number: Okamoto k=18,445 versus Clopper–Pearson worst-case k=9,701 at gamma=.95, epsilon=.01
  • number: DKW/Hoeffding comparison k=500,000
  • limits: PAC guarantees assume independent samples and known confidence level. Unbounded expected rewards cannot have sound finite-sample two-sided intervals without additional structure; reachability construction assumes finite DTMC, almost-sure goal reachability, lower-bounded transition probabilities and bounded state rewards, and can be astronomically conservative. DKW/Hoeffding require known support bounds for two-sided reward intervals. Empirical QVBS evaluation turns unbounded reachability rewards into manually bounded ones, uses DTMC semantics for MDPs, excludes unsupported models, and does not establish universal practical convergence.
  • how much was read: most of it read
  • record id: budde-et-al-sound-smc-2025
• Canonical for Automated Theorem Proving in Lean (2025)
  • what: Presents Canonical, a Rust implementation of backward type-inhabitation search linked to Lean, using beta-normal eta-long terms, explicit substitutions, equational constraints, arbitrary argument refinement order and entropy-guided parallel iterative deepening. On an adapted Natural Number Game with manually selected premises, solves 62/74 statements versus Aesop 27 and Duper 45; reports 51 seconds for the 62 successes. Also solves 46 of the first 50 Lean Prelude statements under a specified inhabitant-equality criterion. Search supports higher-order premises, indexed types and induction, but the translation omits universes and quotients, and default iota pruning is incomplete. Separates source-dependent type theory, Rust search, translation obligations and returned Lean terms; records universe-erasure unsoundness admitted by the authors, iota/structure-eta incompleteness, manually chosen premises and benchmark adaptations, per-world results, exact proof-size metric, successful-proof timing denominator, Prelude success definition, and examples requiring supplied lemmas or generalized recursors. Distinguishes proposed LLM integration from measured proof search.
  • limits: §§3.1–3.2, pp.5–6: terms are beta-normal eta-long and have parameter bindings, simultaneous let declarations, a local head and arguments. Types annotate bindings. Parameters/lets may refer to each other circularly; the encoder must supply a signature valid in the target theory. A missing variable type prevents its use in proof construction; a missing let body makes it an opaque constant. Recursor and projection annotations add reduction behavior. Static arity is an input-format property, not a general property of Lean expressions. §3.2, p.6: start with a goal metavariable, choose a local head and create all its argument metavariables together. Refinement creates typing and definitional-equality constraints. Violations undo a head assignment; metavariable choice need not be backtracked because any completed term admits arbitrary refinement order. This is a structural algorithm argument, not a mechanized implementation-correctness theorem. §3.3, pp.6–7: de Bruijn indices with explicit substitutions permit partial beta reduction without knowing a metavariable’s eventual free variables. Reduction either exposes a rigid head/arguments or becomes stuck. Different rigid heads violate equality; equal heads yield subterm equations. Refinement revisits equations stuck on that metavariable and undo restores them. There is no separate dedicated unification algorithm; constraints guide the same search. §3.3.1, p.8: equality of a blocked recursor/projection and a rigid term may become true after the major argument is instantiated. Default mode treats it as violated, deliberately sacrificing completeness. Program-synthesis mode (+synth) treats it as stuck, admitting more search. A constructor cannot be chosen as the major-argument head of a recursor/projection because that would create a reducible term outside canonical form. This paper does not establish completeness for all Lean definitional equality. §§3.4–3.4.1, pp.8–9: iterative deepening DFS bounds a custom entropy product, mutates assignments in place and runs large branches with fork-join parallelism. Successive thresholds aim to double node counts. Refined metavariables contribute branching factors; unrefined ones use empirical completion estimates from bins keyed by source type ignoring explicit substitution and rigid-equation status. Estimated chance of later rigid equality mixes entropy 1 with average completion refinements; each metavariable estimate is capped at 1000, and unsuccessful refinements incur an extra penalty. Independence is an estimating assumption, not a proved property of dependent subgoals. §3.4.2, pp.9–10: prefer rigid equations for propagation and early failure, then statistically likely impossible metavariables, then high estimated entropy and later arguments whose types constrain earlier values. Meta-level choice and head-level choice serve different purposes. No general theorem of optimality, fair coverage under changing statistics, or global resource bound accompanies this heuristic. §4, pp.10–11: Rust solver communicates through Lean FFI and translated Term/Typ structures. Translation follows Lean Expr constructors, uses lets to retain beta-redexes, and replaces universe-indexed sorts by a single declaration Sort : Sort. The authors explicitly admit possible unsoundness by Girard’s paradox. This affects the search abstraction; a returned term accepted by Lean’s kernel would still have to satisfy Lean’s original universe rules. The paper supplies no mechanized translator-correctness proof or separate measured return-path/kernel-rejection experiment. Rust implementation alone is not evidence of verified Rust or Verus use. §§4–4.1, p.11: Pi structure packages function-valued terms to enforce static arity, with Pi.f/Pi.mk wrappers and eta expansion. Unfolds Set, Not, reducible definitions and typeclass instances where possible to avoid excess wrappers. Literal constants are generally opaque; only natural literals at most 5 receive constructor definitions. Quotient types and universe levels are outside the translation’s supported scope. §4.2, p.12: recursively include constant definitions down to primitives; provide recursor definitions as usable abstractions while hiding types of certain definition-only constants to reduce redundant expressions. Inductive declarations bring constructors/recursors, structures bring projections; local assumptions are included and users supply extra constants in brackets. Recursive expansion can violate abstraction and explode for real numbers. Relevance filtering and automatic premise selection over all Mathlib are outside scope. §5, pp.12–13: Natural Number Game has 79 levels across 9 worlds but 74 unique statements. Authors replace its pedagogical custom naturals/axiomatic operations with standard Nat. Premises are manually selected, mostly from reference solutions and earlier levels. Added Nat.le.intro/dest convert inequality definitions; one level needs Classical.byContradiction; an If structure lets Canonical encode implication induction predicates. Report results for this adapted benchmark, not the untouched game or an unseen randomly sampled theorem library. §5, p.13: Aesop uses default options, Duper portfolio mode, Canonical timeout 15 seconds. Natural-number simp attributes are removed until the corresponding game level, while Duper gets needed definitional equations. Hardware Mac Mini M4 Pro, 24GB RAM; Lean/Mathlib 4.16.0, Duper 0.0.23. No complete matching CPU/thread/time budget table for all solvers. Artifact reference 45 names CanonicalLean v4.22.0, distinct from the benchmark Lean version. §5, pp.13–14: 62/74 Canonical, 27/74 Aesop, 45/74 Duper. Authors attribute much advantage to induction support absent from the compared tactics. 51 seconds is explicitly the time to generate 62 successful proofs; it does not include all failed attempts as a benchmark-total wall-time measurement. On nine successes taking over one second, averages are 23 million attempted refinements/s, 2.1 million/s without equation violation and 1.2 million/s below threshold, branching factor 1.6, final iteration 17% of solve time. §5, p.14: proof length counts constants, free/bound variables, sorts, literals and projections, excluding lambda/let binder types. On common successes Canonical proofs average 251 times shorter than Duper and 18 times shorter than Aesop. Available constants and use of domain-specific lemmas differ. This metric does not measure human readability, checking time, bytes, or whole-benchmark proof-size performance. §5, p.14: Prelude test uses first 50 statements, not a random held-out set. Nonpropositions allow multiple generated inhabitants; success requires one definitionally equal to the library implementation. Constructor-disequality proofs supplied instead of noConfusion. 46 successes; three failures due to missing structure eta encoding, one due to iota incompleteness. Per-problem timeouts and count limits are not comprehensively tabulated. §§6–8, pp.15–16: compares its approach with sauto, Agda inhabitant tools, TWELF, hammers and tactic prediction. Cut-free backward search does not invent local lemmas, call domain solvers on partially instantiated goals, share conflict clauses or table results; branches mostly share statistics. Learned forward reasoning, tactic integration, other DTT languages, AI data generation and LLM use are future directions, not evaluated contributions. No distributed protocol, TLA+, Verus or LLM-agent experiment.
  • how much was read: most of it read
  • source
  • record id: canonical-for-automated-theorem-2025
• CNML (2025)
  • title: Learning Representations through Contrastive Neural Model Checking
  • what: Introduces Contrastive Neural Model Checking (CNML), a self-supervised bi-encoder that embeds LTL specifications and AIGER circuits into a shared latent space using model-checking satisfaction as the contrastive signal. Provides scalable dataset generation, cross-modal and intra-modal retrieval tasks, downstream model-checking fine-tuning, and formula-splitting experiments testing generalization from simple to multi-guarantee formulas. The architecture is syntax-agnostic across formal languages.
  • number: CNML-base dataset has 96,940 training and 12,262 test examples
  • number: Contrastive augmentation creates 295,665 samples
  • number: Reports Recall@1% and Recall@10%, MRR and mean rank across 20 test batches of 1,000
  • number: CNML outperforms algorithmic and neural baselines on cross- and intra-modal retrieval and transfers to downstream tasks
  • limits: Retrieval quality is measured on industry-inspired datasets rather than direct proof correctness; embeddings can exploit dataset distributions, and generalization is tested on selected formula transformations. Downstream benefits depend on pretraining and fine-tuning choices.
  • how much was read: most of it read
  • record id: cnml-2025
• DπFR weak-recovery calculus (2025)
  • title: A Behavioral Theory for Distributed Systems with Weak Recovery
  • what: Introduces DπFR, a distributed pi-calculus with dynamic nodes and links, crash failures, weak recovery, imperfect local knowledge, and incarnation numbers; defines reduction and labelled-transition semantics and proves weak bisimilarity fully abstracts weak barbed congruence. The calculus models recovery by restarting a location with an arbitrary process set and a higher incarnation number, while local views may be stale. Network state explicitly tracks alive/dead incarnation, links, and per-node beliefs; spawn succeeds only when links and incarnation beliefs align. The authors prove preservation of closed well-formed systems, define weak barbs and an LTS including external network actions, and prove Theorem 4.11 (weak barbed congruence iff weak bisimilarity). Case analyses show the ideal server servD is bisimilar to a fault-masking recovered server servDFR, whereas stale-view variants are distinguishable. Docker/Erlang experiments reproduce a rapid unlink/kill/recreate/relink sequence where a spawn targets an old incarnation and fails, matching the calculus trace.
  • number: Theorem 4.11 full abstraction: S ≈̇ R iff S ≈ R
  • number: WrongSp reaches m incarnation 2 while n retains belief m↦1, so final spawn fails
  • number: Docker experiment executes six events and reports Erlang warning Can not start erlang:self,[] on old node
  • number: calculus has Sections 3-7 semantics, theory, examples and Erlang experiments
  • limits: Recovery is weak: process state need not survive, only node identity/incarnation distinguishes instances. Systems are closed and well formed; communication is asynchronous via spawn and local channels. The full-abstraction congruence ranges over system-level parallel composition and restriction, not arbitrary input-operator contexts. Safety/equivalence is behavioral; no liveness or quantitative performance analysis is provided. Erlang experiments use Docker containers and a companion implementation, so they validate corner-case correspondence rather than exhaustively test all executions.
  • how much was read: most of it read
  • record id: d-fr-weak-recovery-calculus-2025
• Daenerys (2025)
  • title: Destabilizing Iris
  • what: Extends Iris so assertions can directly mention program expressions that are deterministic, terminating and read-only. Connects Z3 results, obtained by hand, to Rocq proofs.
  • number: earlier RefinedC bitmap proof needed about 300 lines of bitvector reasoning; Daenerys proves not a single bitvector lemma manually
  • number: ports of existing Iris examples took at most a few hours each
  • number: RefinedC bitmap proof needed around 300 lines of manual bitvector reasoning; Daenerys proves not a single bitvector lemma manually
  • number: Porting existing Iris examples took at most a few hours each
  • limits: Trusts Z3 for facts obtained outside Rocq. Automatic conversion between Rocq and SMT is out of scope. Works on a defined ML-like language, not deployed code. Reports no solver run times.
  • how much was read: most of it read
  • source; notes: Destabilizing Iris (Daenerys); notes: Destabilizing Iris (Daenerys); notes: Concrete problem records
  • record id: daenerys-2025
• Deterministic Client: Enforcing Determinism on Untrusted Machine Code (2025)
  • what: Deterministic Client (DeCl) accepts an adversarial x86-64 or Arm64 binary only when its instructions, control flow and configured sandbox rules establish deterministic execution within that ISA. A trusted native-code verifier replaces trust in a compiler/JIT for this property. It handles undefined instruction results/flags, instruction bundling, deterministic metering and load-address independence, and integrates with Groundhog. Evaluation measures selected SPEC integer benchmarks, payment-contract scalability, startup and Rust zero-knowledge proof-verification code. No machine-checked correctness proof of DeCl is reported. Preserves precise runtime/hardware trust assumptions, ISA differences and undefined-input/flag guards, the full conservative two-pass dataflow algorithm, CPU-fuzzer coverage limit, gas accounting/overcharging and timer observability condition, position-oblivious register/pointer/flag handling, verifier passes and padding treatment. Includes all five tables, fixed-resource/compiler/runtime benchmark qualifications, startup aliasing and cryptography comparisons, portability and hardware bug limits.
  • limits: §2.1: Threat is an adversarial binary, not just output of a benign compiler. Verifier may conservatively reject deterministic programs. Guarantee covers valid microarchitectures within one chosen ISA, not agreement between separately compiled x86 and Arm programs. Hardware must implement accepted ISA correctly; required extensions such as BMI2 restrict deployment. Deterministic runtime call API, no shared-memory multiprocessing and deterministic sandbox initialization are assumed. Runtime API implementation, input state and memory protection remain trusted. §§2.1/2.2: Memory isolation is necessary to prevent reading external nondeterministic data; hardware or software isolation can provide it. Sandbox code cannot be writable and executable by untrusted code. Arm64 fixed-width alignment prevents executing alternate instruction decodings; x86 uses 32-byte instruction bundles, no spanning instructions, aligned direct targets and masked aligned indirect targets. Code/data must be separated. Unknown instruction encodings are rejected. Runtime can use a separate writable alias for loading code; this trusted action must not expose mutable code while the sandbox executes. §2.1: On Arm64, torn store straddling mapped/unmapped boundary may or may not partially alter mapped memory. DeCl terminates after a memory fault rather than simulating precise stores. This termination rule alone does not define a deterministic post-fault sandbox memory snapshot; runtime must respect the stated externally visible-effect boundary. Side-channel paragraph claims removal of in-sandbox timers/parallelism/atomic timing vectors; it does not provide an empirical side-channel evaluation or establish that an external observer cannot measure execution time. §3: Integer and integer SIMD subset only; floating-point instructions excluded because some permit implementation-dependent approximations. Armv8.0 supports approximately180 base plus430SIMD instructions by chosen decoder classification; rejects malformed SBZ/SBO, unpredictable/unallocated/undefined encodings except intentional udf#0 trap. Rejects exclusive-monitor atomics like stxr and writeback/base conflicts like ldr x0,[x0],#16. Enforces16-byte stack alignment and chosen16KiB logical page size; smaller physical pages may emulate this. §3.2: x86 starts from fully enumerated Fadec-encodable set represented by <200KiB binary decision diagram, then narrows to approximately100 base plus125SSE2 instructions. Branch metering additionally needs BMI2SHRX. Extra/spurious prefixes rejected except canonical NOP padding. Shift-double instructions need count guards; bit scan requires nonzero source guard. Despite October2024 manual prose changing BSR/BSF zero-input behavior to unchanged, conflicting pseudocode/other sections lead authors to retain conservative undefined-result handling. §3.2.2/Algorithm 1: Undefined-flags analysis tracks set U through each basic block: reject read of U, clear defined flags, add undefined flags. Initialize every block IN to all-undefined, analyze without reporting, union predecessor OUT sets, analyze again with reporting. Indirect jumps are preceded by AND alignment which defines observable flags, so static-branch CFG suffices; AF remains undefined but accepted instructions cannot observe it. A full fixpoint could accept more programs; two-pass algorithm may falsely reject but is claimed sound, and author-compiled LLVM/GCC cases pass within two. No mechanized soundness proof or machine-code refinement accompanies this claim. §3.3: Fuzzer generates random candidate instructions, filters through verifier, concatenates verified basic blocks into MB–GB programs and compares final register/memory state across5+microarchitectures for each architecture. It generates no branches; authors manually analyze roughly10branch instructions. Relaxing checks quickly exposes undefined-result/flag differences. This tests handwritten verifier/ISA understanding; it is not necessary trusted enforcement, exhaustive ISA validation or proof of all accepted programs. No precise campaign duration, samples, machine list or verified-code bug count reported. §§4/4.1: Gas is instruction accounting, not real elapsed CPU duration; instruction timing varies. Meter register x23/%r12 decremented at block epilogue. Bundling prevents jumps past required accounting: x86 already32B, Arm branch16B/timer8B with x24 aligned-target register. Initial gas/counter arithmetic, runtime calls and periodic interrupt handling must satisfy implementation constraints. No arbitrary wall-clock bound follows from a gas count alone. §4.2/Figure 3: Branch scheme checks high sign bit after decrement and traps on negative. Arm SUB/TBZ/BRK preserves flags; x86 flag-preserving LEA/PUSH RCX/MOV0x3f/SHRX/JRCXZ/INT3/POP sequence is costlier than SUB/JNS/INT3 when flags may be clobbered. Indirect jumps into middle of a statically recognized block may be charged for its full length, deterministically overcharging. Forward-branch gas checks can be elided if whole program size N bounded (example10M instructions); at most N further instructions until checked backwards branch or termination. This is not exact preemption at precisely the requested instruction count. §4.3/Figure 4: Timer scheme keeps gas decrement but removes per-block sign checks; runtime checks sign before every externally visible call effect, and timer interrupt terminates negative-gas programs. Execution may continue nondeterministically after gas exhaustion for at most timer slice t, while external call trace stays deterministic. Requires calls be the only observable effects and program memory be externally invisible. Short slices add overhead; tiny gas budgets may favor branch metering. No timer-slice setting or finite-counter wraparound argument is reported. §§5.1/5.2: LFI places each sandbox in4GiB-aligned4GiB region, accesses via32-bit offsets plus reserved base; typical guard gaps80KiBArm/40GiBx86. Ordinary LFI leaks absolute load/stack/code addresses and therefore lacks determinism. Position-oblivious code allows only low32-bit observations of absolute-address registers, zeros high bits after PC-relative address formation, and requires runtime-returned pointers be offsets too. This is stronger than ordinary position-independent executable code. §5.2: x86 CALL stores absolute return address, so POC replaces it with LEAL/PUSH/JMP; returns are aligned masked indirect branches re-adding base. String instructions must zero high32bits of RSI/RDI afterward. OR-based branch target guard flags must not reveal base: PF depends only low byte, SF requires same address-space half, ZF requires never allocating zero sandbox; LEA guard can avoid flags changes if both halves needed. POC supports same-process sandbox relocation/fork only under runtime’s address-hiding obligations. §§5.3/6: Runtime call table moved outside sandbox, first metadata page unmapped; new dedicated call register x25/%r13 prevents reading nondeterministic metadata. Simplified redundant-guard elimination saves reserved registers. Compiler/rewrite/assembler/linker are untrusted for determinism because final code is checked, but rejection or changed source-program semantics remains possible. Section8 explicitly permits replacing unwanted FP instructions with NOPs; acceptance then establishes the altered binary’s restricted behavior, not faithful implementation of original FP source. §6.2: Trusted standalone linear-time verifier decodes enumerated subset, checks instruction/configuration safety, bundle control flow, LFI addressing/reserved registers and x86 flags. Meter validation uses leader construction (entry/post-branch/direct target), checks debit immediate against block size, same-bundle epilogue/branch, exclusive meter-register operations and aligned targets. Unmetered fallthrough padding may merge with next block and be charged, introducing deterministic overcharging. No verifier LOC/TCB-size count, formal proof, verification throughput benchmark, or comprehensive adversarial bypass results reported. §7.1: Eight supported SPECrate CPU2017 integer C/C++ programs compiled Musl/LLVM19.1.4+LTO; excludes unsupported languages/toolchain cases and floating point, uses rate instead of speed because LFI4GiB versus16GiB requirement. Platforms AMD7950XUbuntu and bare-metal M2DebianAsahiLinux, fixed base clock/shielded core. SPEC runtime intentionally supplies nondeterministic APIs including time, so this experiment measures transformation overhead, not end-to-end deterministic program execution. No trial count/confidence intervals supplied. §7.1/Table 4: Figure6 means include eight programs; Figure7 means only four WebAssembly-supported ones. DeCl-HWx86 overhead4.40%/5.47% in table differs from rounded prose∼3%; retain actual table values. Wasmtime24.0.0 uses deterministic fuel/128-bitSIMD. Reduced overhead by>2× does not mean total runtime or throughput improves>2×: compare 1+overhead, and distinguish SPEC subset from separate cryptography runtime measurements. §7.2.1: Groundhog replaces wasm3 with metered DeCl-LFI using picolibc/freestanding contracts and specific runtime storage/block APIs. Preallocates128KiBRXcode+128KiBRWdata, zeros on reuse, writable runtime alias avoids mmap/mprotect/TLBshootdowns. Arm instruction-cache flush dominates empty-program startup15µsM2 versus2µsAMD. Larger1MiBregions can make clearing a bottleneck; variable pool sizes and code caching proposed, code caching not implemented. Fixed tiny-region empty-program latency is not a general arbitrary-contract load bound. §7.2.2: Payment evaluation on one192-coreAWS c7a.metalAMD or c8g.metalGraviton4, nohyperthreading, batches100000, transfers between uniformly selected1Maccounts; each verifies oneEd25519,80–90%compute. Plots compare library crypto inside sandbox versus native runtime call. DeCl scaling is measured for this workload/hardware, not network consensus or failure recovery. Wasmtime’s startup bottleneck and wasm3’s slow sandbox crypto explain selected tradeoff; ZKexperiment uses SP1no_stdRust verifier for Groth16/Plonk proofs, without verifying that Rust implementation’s correctness. §8: Native binary portable only within its ISA; cross-ISAtranslation adds trusted complexity and cited estimated25–65%overhead, not measured DeCl result. Toolchain cannot yet combine software FP with nativeSIMD cleanly. Hardware correctness assumed; faults/errata can violate property, requiring patching verifier and disabling/emulating existing code. Since code can read itself, transparent patch/emulation must preserve old-code illusion. Claim hardwarefaults sufficiently independent for surrounding BFT is qualitative, not established failure analysis. No distributed safety/liveness theorem, Rust/Verus verification, TLA+ model or LLM evaluation. Table 5/p.645 printed inconsistency: Arm64 Plonk native .338s and Wasmtime-fuel 1.08s imply approximately3.20×, while printed factor is3.07×. Preserve all reported values; no raw timing data establishes which is mistaken.
  • how much was read: most of it read
  • source
  • record id: deterministic-client-enforcing-determinism-2025
• digital-twin CMC/SMC verification (2025)
  • title: Verification of Digital Twins using Classical & Statistical Model Checking
  • what: Combines classical model checking (CMC) and statistical model checking (SMC) to verify digital-twin runtime behavior. A UPPAAL model of an autonomous-driving truck is checked for deadlock freedom, functional correctness, liveness, and timeliness, with CMC covering exhaustive qualitative properties and SMC covering stochastic timing behavior. Compares CMC and SMC on modeling fidelity, state exploration, runtime, and result interpretation. The study reports that the twin satisfies deadlock-freedom and functional-correctness properties but fails timeliness, and explains a CMC/SMC disagreement for one property caused by timing-distribution abstraction.
  • number: All but one listed property were verified; one was blocked by state-space explosion (§6)
  • number: CMC and SMC had broadly comparable CPU/memory performance in the case study (§5)
  • number: CMC explored fewer states than SMC for all properties except property 7 (§5)
  • number: Property 11 was satisfied by SMC but not by CMC due to timing abstraction (§5)
  • limits: The case study lacks complete structured documentation, so authors selected properties they judged relevant and reuse a previous behavioral model. CMC suffers state-space explosion; SMC supplies probabilistic guarantees only and cannot establish exhaustive deadlock/liveness properties. Results concern one autonomous-truck digital twin and UPPAAL setup.
  • how much was read: most of it read
  • record id: digital-twin-cmc-smc-verification-2025
• DTMC Path Abstraction (2025)
  • title: DTMC Model Checking by Path Abstraction Revisited (extended version)
  • what: Revisits path abstraction for discrete-time Markov-chain reachability, proves that sequential abstractions over arbitrary finite subsets preserve the result of direct abstraction, and supplies numerical recipes plus a PARI/GP reference implementation. The free-monoid formulation yields monotonic absorption: if S1⊆S2 then abstracting S1 then S2 equals abstracting S2, and any finite sequence inside a final set can be reordered without changing the result. The paper handles subsets containing bottom strongly connected components through substochastic DTMCs, links the result to counterexample refinement, and gives matrix-based computation and a compact implementation.
  • number: Theorem 3 covers any nested pair S1⊆S2
  • number: Corollary 1 covers any finite sequence S1,…,St inside K
  • number: reference example uses an 8×8 transition matrix
  • number: path abstraction never generates more transitions
  • limits: The theory assumes finite state spaces and total reachability over DTMCs; the reference implementation is intentionally high-level and not practically efficient. Complexity is left for future work, numerical calculations may use approximate arithmetic, and the authors propose future Isabelle/HOL formalization and optimized implementations.
  • how much was read: most of it read
  • record id: dtmc-path-abstraction-2025
• Extended threshold automata (2025)
  • title: Parameterized Verification of Round-Based Distributed Algorithms via Extended Threshold Automata.
  • what: Extends threshold automata with decrements and resets of shared variables, develops sound and complete semi-decision procedures for general coverability and reachability, and evaluates an implementation on fault-tolerant distributed algorithm models. The counter-system model retains arbitrary process counts satisfying a linear-arithmetic resilience condition. Parametric intervals abstract shared counters; an abstract counter system leaves location counts unbounded. Lemmas 1–2 relate concrete paths to non-spurious abstract paths using quantifier-free linear-integer constraints, including acceleration multiplicities. Lemmas 3–4 establish a well-structured system with effective predecessor bases. Algorithm 1 must preserve transitions from subsumed states to enumerate all abstract error paths, because one spurious path cannot settle verification. Corollary 2 and Lemma 5 give soundness/completeness; Theorem 1 proves termination for nonnegative updates without resets. A second abstraction keeps only occupied/empty location bits, allowing zero tests in reachability specifications; PRA implements this symbolically. General coverability can express two leaders at the same location, whereas ordinary positive-location coverability cannot. Experiments reveal the narrower scope of the phase-king and full Red Belly results than the abstract suggests.
  • number: PRA vs ByMC: bosco validity 0.73s vs 42.22s; cf1s validity 0.42s vs 380.81s
  • number: c1cs 0.23s, RB 1.03s, RB-Simpl 61.77s with ByMC timing out at 1.5h
  • number: PRA slower on nbacg 0.36s vs 0.18s and RB-bc 0.49s vs 0.32s
  • number: multiR-floodMin 0.3s; multiR-RelBrd 0.1s; multiR-RB-Simpl 6859s; multiR-RB timeout at 2h
  • limits: Results concern threshold-automaton models, not executable protocol code. Finite local locations/shared-variable sets, nonnegative counter values, parameter-linear threshold guards, and linear-integer resilience conditions are assumed; the standard example is n > 3t and t >= f with n-f modeled correct processes. All possible finite orders of parametric thresholds must be considered. Abstract transitions can be spurious and require SMT concretization. The extended model is undecidable; error-path unfolding can diverge on cycles containing decrements/resets. Termination holds for monotone increments/no resets, acyclic error graphs, or cycles without decrements/resets. Detailed formal proofs are referred to the extended version, rather than machine-checked proof artifacts here. Evaluated properties are selected safety/reachability properties, not full liveness or implementation refinement. Full multi-round Red Belly times out; phase-king validation is partial correctness and a bug in an incorrect model.
  • how much was read: most of it read
  • source
  • record id: extended-threshold-automata-2025
• First-Order Automata (2025)
  • what: The paper defines an automaton that recognizes finite traces of a first-order temporal sentence over a background theory. It gives results on expressiveness and closure, and decision procedures that work under conditions.
  • number: no experiments, benchmarks or repository reported
  • limits: It covers finite traces only. Extending it to infinite words is future work, so it does not give liveness over infinite executions. Checking non-emptiness is only a semi-decision procedure (it may never answer).
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: First-Order Automata
  • record id: first-order-automata-2025
• Formal Verification of Parameterized Systems based on Induction (2025)
  • what: # Formal Verification of Parameterized Systems based on Induction (authored by agents unless marked 🧑) Jiaqi Xiu and Yongjian Li, arXiv 2503.18030v1, 23 March 2025. This is a whole-paper record: all nine PDF pages, 23 references, two figures, four algorithms, nine numbered equations and both tables were read. All pages were visually inspected, including six dense pages at 1900px. No appendix or checklist appears. The acquired official PDF and pool copy are byte-identical. quotes.json supplies exact passages with section/page pointers; tables.json preserves the complete table pages, and the two row sidecars transcribe all cells. Cited papers were not independently read for this assignment. The paper presents wiseParaverifier, a system for discovering and generalizing auxiliary invariants of parameterized safety protocols. Its main contribution is a search procedure: use small protocol instances and counterexamples to suggest invariants, select quantifiers, merge related formulas, and ask Ivy to prove the parameterized result. It reports success on seven cache-coherence and ten distributed protocol models. The evidence is an algorithm description and benchmark measurements. The paper contains no numbered theorem, lemma or complete end-to-end soundness, completeness or termination proof. I did not run a solver, checker or author program, and acquired no generated proof files or verification logs. Section I p1 states the central limitation of starting small: an invariant’s inductiveness on a small instance “does not imply that these invariants will retain their inductive characteristics when applied to larger scale system concretizations” (Q1). The workflow addresses that gap with two stages. invFinder constructs concrete auxiliary invariants; Verifier generalizes them and checks induction (§III p2, Q2). Figure 1 p3 adds an essential detail: a successful Ivy proof yields “Passed”; a failed proof increases N and returns to invariant discovery. Thus the intended acceptance condition is parameterized induction, not agreement at two finite instance sizes. The paper says, “wiseParaverifier employs Ivy for automatic inductive verification” (§III.C p5, Q15). No acquired artifact lets this reading independently check that step. The initial concretization is based on overlap between parameters in an invariant F and transition rule R (§III.A.1 pp2–3). With two invariant parameters and one rule parameter, the rule may use either existing index or a fresh third index, so N=3 represents the listed overlap cases. With two rule parameters, representatives can require N=4, including the all-fresh pair. These are concrete examples of reducing redundant parameter instantiations. The stated selection principle requires the concrete protocol to simulate the same or symmetric transition behavior under arbitrary parameters (Q4). The article does not prove a general cutoff theorem or define a complete supported protocol language that makes that principle automatic. For each rule/invariant pair, the system constructs indOblg, a formula involving the rule guard, assignments, unchanged-variable equations and a violated postcondition (§III.A.2 p3, Eq1). Z3 satisfiability produces an assignment used to propose an auxiliary invariant by negating the conjunction of its state equations; unsatisfiability eliminates that obligation (Q7–Q10). Rules that do not change relevant invariant variables can be filtered. Candidate invariants are checked through a client/server service wrapping Murphi, NuSMV and NuSMV-BMC (§III.A p2, Q3). The server retains information about previously executed protocols, a detail relevant to interpreting timings (§IV p7, Q24). The heuristic Generalize search uses earlier invariants to narrow which equations matter (§III.A.3 pp4–5, Figure 2 and Algorithms 1–2). Shared terms form join; terms unique to the current counterexample form diff. It tests join plus increasingly large subsets of diff, then removes unnecessary terms or uses an increasing search to obtain a smaller checked candidate. It falls back to nonheuristic search if that fails (Q11–Q14). This is a useful concrete distinction: previous formulas guide candidate generation, while an external checker checks candidates against the concrete model. Although the paper repeatedly calls the result “most concise,” it gives no global minimality proof or formula-length/readability evaluation. Quantifier promotion uses type saturation γ(t)=#(Ω,t)/C(t), the number of concrete values of type t in a clause divided by that type’s concrete domain size (§III.C p5, Eq3). An unsaturated type is proposed as universally quantified. A saturated type triggers a check at N+1; a surviving clause can receive universal quantification, while failure prompts existential or finer mixed grouping. Equations 4–7 describe extending groupings and expressing existential alternatives. The following page says existentially treated groups may be joined by disjunction (Q16–Q20). These tests generate candidate quantifiers. They do not by themselves establish correctness at every size; the final Ivy induction check in Figure 1 remains necessary. The merger has three distinct cases (§III.C p6, Q21). Equivalent parameterizations share a representative. If one existing invariant implies the whole conjunction, Eq8 permits retaining it. Eq9 permits a strictly stronger replacement that implies the old conjunction while the converse fails. A stronger formula still needs an invariant proof: implication alone does not establish that initial states satisfy it or that transitions preserve it. Algorithms 3–4 add another optimization, generating symmetric formulas and asserting already accepted auxiliary invariants and their images to prevent redundant counterexamples. The paper distinguishes unrestricted universal-type permutations from restricted existential and mixed cases (Q22–Q23); a transfer must preserve those quantifier distinctions and the modeled protocol’s symmetry. Several printed details limit treating this presentation as a fully specified formal argument. Eq2 p3 writes f_k = eq_i ∨ ¬eq_i. Read literally as logical disjunction, each factor is a tautology and its negated conjunction is false. That conflicts with the surrounding candidate-invariant explanation; a notation or presentation error is plausible, but its intended repair was not established. Eq1 does not explicitly include a prestate F conjunct, so this record does not silently substitute the conventional F ∧ R ∧ ¬F′ formula. Algorithm 1 p4 line12 shows a function index without recursive arguments, and line24 converts solution while iterating over subS. These details were visually checked. They are unresolved presentation issues, not an independently demonstrated failure of an implemented verifier. reader-diagnostics.json separates these observations from the authors’ claims. The evaluation has a 17-model comparison and a four-strategy ablation (§IV pp7–9). The cache models are MutualExNodata, MutualEx, MutualEx_M2, GermanNodata, German, FlashNodata and Flash. The distributed models are Decentralized_lock, Lock_server, Multi_lock_server, Ricart-Agrawala, Shard, Two_phase_commit, two client/server variants and two consensus variants. Four distributed rows require mixed universal/existential quantifiers. The paper does not print the benchmark safety formulas, instance sizes, full transition models or failure/network assumptions. Verifying a model named Flash or Consensus_epr therefore supports that model-level claim; it does not establish correctness of a deployed cache implementation or every consensus variant. Experiments used an 18-core Intel Gold 6254 CPU at 3.10GHz. Table I reports completion seconds and final parameterized-invariant counts for wiseParaverifier, Paraverifier, DuoAI and IC3PO. Counting numeric successful entries gives 17, 7, 14 and 12, respectively; these are reader counts. “error” means compilation failed after modeling, while “fail” means verification could not complete (Q25). Neither means a discovered safety violation. The prose says Paraverifier failed on all distributed models (§IV.A p7, Q26), but its Two_phase_commit row succeeds in 6.18 seconds with ten invariants. The table supports one distributed success and nine compilation errors. That conflict is preserved rather than resolved in favor of the prose. The comparative gains vary. Flash takes wiseParaverifier 585.68 seconds and 135 invariants versus Paraverifier’s 589.23 seconds and 162 invariants; DuoAI and IC3PO fail. GermanNodata takes 19.14 seconds/39 invariants versus DuoAI’s 535.80 seconds/892, about 28× less time by reader arithmetic. On Consensus_epr, however, DuoAI takes 28.88 seconds/seven invariants, wiseParaverifier 43.10/16, and IC3PO 1248.26/eight. Coverage and low invariant count therefore do not imply universal speed or concision superiority. Table II compares simple increasing, simple decreasing, heuristic increasing and heuristic decreasing search using seconds and NuSMV calls. They complete 15, 15, 16 and 17 models; “/” denotes more than 86,400 seconds with continuing counterexample discovery. Heuristic decreasing is fastest or tied on 15 rows. For FlashNodata it reduces heuristic increasing’s 1669.69 seconds/1818 calls to 329.91/674. On Consensus_epr, simple increasing takes 183.23 seconds/2909 calls versus 43.10/753. The tradeoff reverses on small Ricart-Agrawala: simple decreasing takes 0.43 seconds/eight calls versus heuristic decreasing’s 0.54/ten. These are author-reported measurements, with no stated repetitions, seeds, variability or error bars. Software versions, memory use and a clear cold/warm-server timing boundary are absent. GermanNodata, Lock_server and Ricart-Agrawala have differing timings across Tables I–II; the row sidecars retain each printed value. Bibliographic provenance also needs care: §II’s “I4 [20]” points to a listed 2003 cache-coherence paper, “Ivy [21]” to Ironfleet, and reference13 retains a literal placeholder venue. This record does not treat those mappings as validated provenance. No author repository, model, log or certificate URL was identified in the paper or acquired arXiv metadata; this was not an exhaustive artifact search. The arXiv TeX and experimental HTML links were not acquired. For distributed-system verification, the paper contributes a practical combination of counterexample formulas, earlier-invariant-guided search, mixed-quantifier proposals and symmetry blocking, evaluated across two protocol categories. It presents no Verus or verified-Rust implementation, TLA+ experiment or LLM-agent study. A reader proposal for agents writing specifications and proofs is to reuse earlier invariant terms as search hints, make quantifier changes explicit, and require an independent parameterized induction check before accepting them. Its measurements suggest evaluating completion coverage, checker calls, runtime and formula size separately, while separating compilation failures, verification failures and timeouts. Those are transfers from the method and evaluation, not capabilities demonstrated for LLM agents by this paper. Whole9pages/23references/2tables/2figures/4algorithms/9equations. Reconstructs overlapcase concretizations, Z3CTIformulas, join/diffheuristic andfallback, type-saturationN+1quantifier proposals, three merging cases, quantifier-aware symmetry blocking and finalIvyfeedbackloop. Alltablecells transcribed, coveragecounted, representative speed/call/invariant tradeoffs and printedformula/pseudocode/citation/table/prose inconsistencies retained.
  • limits: Parameterized protocol safety models and representative overlap/symmetry cases; trustworthy translation and final symbolic Ivy induction. SmallN/N+1checks alone do not prove all sizes. No complete end-to-end soundness/completeness/termination theorem or acquired authorcode/models/logs/certificates.17successesauthorreported; no execution/reproduction. NoVerus/Rust/TLA+/LLMagentstudy.
  • how much was read: most of it read
  • source
  • record id: formal-verification-of-parameterized-2025
• Formally Verifying a Vertical Cell Decomposition Algorithm (2025)
  • what: Rocq/Mathematical Components verification of a functional sweep algorithm returning triangular/trapezoidal cells whose interiors and specified lateral doors avoid nonvertical segment obstacles. The proof handles vertically aligned events without producing zero-width cells and proves each returned cell has an interior center. Complete free-space coverage and shared-door completeness remain unproved. Preserves precise obstacle/numeric model, executable/proof representation split, two-stage safety contracts, orphaned events, four scan branches, hazard inheritance and six levels of invariants. Explains ownership plus obstacle-boundary coverage as the safety argument. Distinguishes nonempty individual cells from nonvacuous output coverage, empirical trajectory usability from a planner correctness/completeness proof, and event alignment from excluded vertical obstacles.
  • limits: §§1–2/4.5, pp.1–4/9–10: input obstacles are finite straight segments, not filled polygons. Endpoints can be shared, but other intersections are excluded; duplicates are excluded. Each edge has strictly increasing x from left to right, so vertical and zero-length segments cannot satisfy the proof edge type. A well-formed bounding box has distinct lateral sides and low/high edges; every obstacle point must lie inside it. This is point motion in a 2D scene, without finite robot shape, dynamics, sensors or uncertain coordinates. §2.1/5.1, pp.3–4/11: proofs assume a Mathematical Components real field, with exact arithmetic and boolean equality/order. Rational numbers suffice; no completeness of the real numbers is required. The generic executable accepts a number type, four arithmetic operations and two comparisons. Its user must instantiate them consistently with field laws. Ordinary floating point does not satisfy that exact model; no rounding-error theorem is given. §2.1, pp.4–5: a determinant computes signed area for above/below/collinear tests using ring operations. Vertical-cylinder tests ensure projections lie within segment x range. Vertical projection is the only operation using division, returning an option outside its range. The edge_below relation is transitive for outgoing edges sharing a left endpoint, but is not a global partial order. §2.2/5.4.1, pp.5/13: cells store low/high edges and ordered unique left/right boundary point lists. Closed cells have both sides; open cells have no right side yet. Safe part consists of strict interior plus lateral points strictly between low/high edges excluding recorded unsafe points. Owned part excludes bottom and left boundaries, allowing unique ownership even when cells meet. Safety is not a claim that every boundary point is free. §§3–4, pp.5–8: scan state stores vertically arranged open cells as prefix/last/suffix, closed cells with the last one separate, and cached last x/high edge. Initial processing needs a first event strictly beyond the left boundary to construct a first closed cell. Event preparation uses insertion sort merging equal positions, then separately sorts outgoing edges when processing each event. Recursion consumes the finite event list; no asymptotic complexity theorem is reported. §4, pp.6–8: event order is lexicographic in x then y. Four branches distinguish x advance, same x above the last high edge, same x below it, and same x on it. Same-x handling updates/discards would-be zero-width cells and preserves old unsafe-side points. Vertical alignment of separate events is supported, while vertical obstacle segments remain excluded. §4.5/second_phase_safety, pp.9–10: eight prerequisites are well-formed box, permitted endpoint-only intersections among boundaries/edges, inside-box events, strict lexicographic event ordering, outgoing edges starting at their event, later events covering right endpoints, no event in an edge interior, and duplicate-free outgoing lists. Each resulting cell has center strictly inside, well-formed side lists and safe part disjoint from unsafe events/edges. Isolated events are supported by this more general contract. §4.5/two_phase_safety, p.10: composing preparation with processing reduces prerequisites to well-formed box, unique edges, endpoint-only intersections including box edges, and all edge points inside the box. The conclusion gives interior center, side well-formedness and obstacle avoidance for every returned cell. Input preparation must preserve the original edges, since safety relative only to the generated event set could otherwise omit an obstacle. §5.1, p.11: generic_trajectories avoids Mathematical Components structures and drops the dependent edge proof field for extraction. Proof files instantiate this same generic algorithm with field operations via notations and generalize theorems across sections. Rational implementation uses integer numerator/positive denominator. No verified foreign-function wrapper, machine-integer overflow proof or independent extraction replay is provided in this reading. §5.2, pp.11–12: six nested invariant groups describe open cells/remaining events; cache consistency and event/edge relationships; special last open cell; disjointness/nonempty cells; coverage of processed obstacles by high boundaries; and safe lateral-side exclusions. A preliminary proof under no vertically aligned events verified fewer branches; the main result described here is the stronger proof including degeneracies. §5.3, pp.12–13: pairwise order of all earlier/later open-cell high edges replaces relying on adjacent sortedness under a nontransitive relation. Projection comparisons require the point x coordinate to be in both edge cylinders. These assumptions make local geometric order reasoning sound. §5.4, pp.13–15: unique owned parts and coverage of each processed obstacle by cell high boundaries imply interior safety by contradiction. An interior point on an obstacle would belong to its own cell and a distinct boundary-covering cell. Separate invariants show events appear in side lists, and inherited side hazards survive degenerate replacements. Disjoint ownership does not imply closed cells have no shared boundary. §§1/6.1, pp.3/16–17: proof does not establish union of owned parts covers the box or that adjacent cells with a safe passage share a represented door. Tests reportedly support both properties, with no described count/distribution/ground truth. Missing either could cause the application to miss an existing path. Per-cell nonemptiness does not prove the output list is nonempty or complete. §6, pp.16–17: integration in a larger path tool assesses usability, but path search, smoothing with Bezier curves and full trajectory proof are outside this paper. Proof effort is almost 15000 lines in 12 files. No runtime, memory, compilation time, hardware, systematic benchmark or independently reproduced build is reported. Adjacency lookup currently scans all cells; cached neighbours, vertical/crossing obstacles and trajectory verification are future work.
  • how much was read: most of it read
  • source
  • record id: formally-verifying-a-vertical-2025
• FRAIG-BMC (2025)
  • title: FRAIG-BMC: Functional Reduction to Speed Up Bounded Model Checking
  • what: Introduces FRAIG-BMC, an on-the-fly functional-reduction procedure integrated into each BMC unrolling. It simplifies trivial logic, reuses structurally hashed nodes, and SAT-checks simulation-equivalent nodes before CNF encoding, reducing variables and clauses while preserving the BMC property check. The algorithm maintains an unrolled-AIG-node to SAT-variable map and performs three ordered reductions: constant/idempotent AND simplification, structural hashing, then simulation equivalence classes checked by SAT. Equivalences are checked across time frames, which a standalone pre-BMC FRAIG cannot exploit. For constrained properties Ck, the paper adds filtered random simulation over the constraint cone of influence and a SAT-sampling alternative with blocking clauses and optional random unit clauses. Large equivalence classes are capped and treated as unique to avoid excessive checking. The implementation extends AIGER aigbmc with CaDiCaL and compares it to CaDiCaL-backed baseline and ABC-BMC3 on SEC, partial-retention (PartRet), and information-flow (IFC) benchmarks.
  • number: SEC Table I includes 17 named cases; FRAIG-BMC reaches bound 243 on i2c and 907 on ss pcm
  • number: SEC cases show hundreds of thousands to over one million trivial/structural merges (e.g., des3 area 597,798 trivial and 1,069,415 structural)
  • number: time limit 3,600 seconds; server Intel Xeon 8375C, 256 GB memory
  • number: PartRet 61 cases and IFC 56 cases according to figure captions
  • limits: The method targets bit-level AIG transition systems and safety properties checked to finite bounds; it does not establish unbounded safety. Functional equivalence is relative to the current simulation candidates and then validated by SAT, while constrained simulation assumes constraints can be represented and sampled from their cone. An excessively large equivalence class is deliberately not fully checked, trading possible reductions for runtime. Benchmarks contain repeated circuit copies and all runs use a 3,600-second timeout on one 256-GB Xeon server, so gains may depend on structural redundancy and hardware.
  • how much was read: most of it read
  • record id: fraig-bmc-2025
• Ganesha-Chakrabarti CRV SEU hardening (2025)
  • title: A Formal Verification Approach to Safeguard Controller Variables from Single Event Upset
  • what: Defines conditionally relevant variables (CRVs): variables whose single-event-upset bit flip can change a controller safety-property result. It combines static slicing with CBMC bounded model checking, instrumenting a shadow program and one nondeterministic bit flip per candidate variable; a counterexample establishes relevance while no violation establishes irrelevance within the bound. The paper gives a two-case formal CRV definition covering both upset-induced violation and upset-masked violation, a concrete instrumentation algorithm that duplicates the program and asserts XOR disagreement of safety outcomes, and a compiler-facing selective-hardening workflow. In three C benchmarks, slicing retained 4 relevant variables in each case; CBMC removed 1, 2, and 1 false positives for motivating, temperature-control, and fan-speed programs respectively, with reported efficiencies of 25%, 50%, and 25%.
  • number: three benchmarks
  • number: 4 sliced variables per benchmark
  • number: 1, 2, 1 additional non-CRVs eliminated
  • number: 25%, 50%, 25% efficiency
  • limits: Exact CRV discovery is stated undecidable. Safety is a domain-provided output property, often weaker than functional correctness; the method models one bit flip at one use and uses bounded model checking. Experiments are three small single-procedure C programs (30 or 45 LoC), Frama-C 30.0 and CBMC 5.12; no industrial-scale or complete-state-space validation. Future work is interprocedural analysis, other model checkers, and automated safety-property derivation.
  • how much was read: most of it read
  • record id: ganesha-chakrabarti-crv-seu-hardening-2025
• GOL in GOL in HOL: Verified Circuits in Conway’s Game of Life (2025)
  • what: HOL4 proof that an infinite tiling of Game of Life mega-cells simulates ordinary Game of Life. A compiler maps arbitrary initial GOL states to detailed circuits; after n×60×586 low-level steps, sampling one designated pixel per 3150×3150 mega-cell recovers exactly n original steps. Modular I/O semantics, symbolic gate proofs, delayed-signal abstraction and proof-producing circuit assembly account for geometry and signal propagation. Records the exact sampling theorem, three coordinate/time scales, partial I/O runs and cancellation, phase-dependent port ownership, exact versus approximate signal semantics, delayed half-adder issue, deferred crossover/connection proof obligations, infinite tiling, external symbolic discovery versus kernel confirmation, and 512-case high-level truth check. The result includes transport delays and clock windows but not physical hardware or asynchronous execution.
  • limits: §§1.1/3.1, pp.2/7: states are sets of live cells over the unbounded integer plane. All cells update synchronously under standard eight-neighbour B3/S23 rules. The theorem quantifies over arbitrary input sets, not only finite patterns. No bounded-grid boundary, stochastic update, asynchronous schedule, physical implementation or finite machine overflow model is included. §2/4.1, pp.5/9: tiles are 150×150 low-level cells; coordinates for ports/gates use 75-cell half-tile units, and gate centers are double-even. A mega-cell is 21×21 tiles, or 3150×3150 cells. One circuit tick is 60 GOL generations. One simulated update takes 586 ticks, hence 35160 low-level generations. Spatial scale is not a count of live cells or a measured memory footprint. §3.2, p.7: the area of influence includes all cells within Chebyshev distance one of a live cell. Disjoint influence regions suffice for one-step evolution of a union to equal the union of evolutions. This condition is deliberately stronger than necessary. Runs need composition arguments; disjointness at time zero alone is not a perpetual noninteraction theorem. §§3.3–3.4, p.8: io_step first requires influence within the owned region, executes ordinary step, checks specified output-region contents, then deletes outputs/inserts inputs. It is functional but partial: an assertion or boundary failure prevents a run. run requires every finite prefix to exist under the prescribed modifier sequence. Assertions express observed behaviour; indefinite run is part of the proved component specification. §4.2, pp.9–10: each tick has two 30-generation phases. North/south port transfer occurs halfway through; east/west transfer occurs after 60. Ownership flips between producer and consumer around transfers. This phase separation and 60 rather than 30 generation stream spacing permit noncolliding crossovers; identical geometric crossings without timing assumptions are not valid. §4.3, pp.10–11: binary composition requires disjoint owned tile areas and matching port direction/position/entire signal at internal boundaries. The result unions areas, ports and initial patterns. Internalization removes matched ports from both input/output sets without changing initial pattern; at modifier level matching assertions, insertions and deletions recover ordinary GOL. Infinitary composition handles arbitrary sets of circuits. §4.4, pp.11–12: delays do not generally commute with logical identities involving repeated signals at different ages. The raw half-adder formula depends on a at delays 12/15 and b at delays 15/18; one cannot simply erase delay annotations and claim exact XOR at all ticks. Approximate values allow arbitrary transients and track settling deadlines within each simulated-clock stability budget. §4.4, p.12: approximate values are boolean expressions over nearby simulated cells, indexed by mega-cell position. Refinement means inclusion of the sets of permitted streams; a smaller settling deadline refines a larger one. Exact values are limited combinations of clock and current-state signals, with integer time shifts extending into the past. This supports negative shifts mathematically without negative low-level simulation steps. §4.4/5.2, pp.12/16: the exact clock is high for 22 ticks per period of 586. The current-state signal holds each macro-state for 586 ticks. Delayed gates consume the stability window, and an exact clock/latch masks transient data and retains the next state. Special rules require timing inequalities and equality with the particular nextCell formula. Values outside supported operations become top, which admits every stream and therefore cannot certify a meaningful sampled result by itself. §§4.5–4.6, pp.13–15: floodfill tracks occupied even half-tile positions within [0,42)², multisets of unmatched inputs/outputs, pending crossover ports and gate placements. Adding regular gates matches all input values against known outputs; crossovers can be staged one input at a time. Teleport reindexes streams across copies separated by 42 half-tiles; it is neighbour communication in an already infinite tiling, not physical instantaneous transport. §4.6, pp.14–15: floodfill has existential input/output streams and universal admissible crossover streams, plus position/direction uniqueness and conditional matching obligations. Intermediate placement can leave unresolved outputs, but the circuit_run consequence is guarded by connection completeness. Unmatched outputs are proof obligations; the final cancellation discharges them. Individual gate validity is also required. §5.1, pp.15–16: SML first searches for a symbolic steady state outside kernel inference. The proof assistant then checks one complete tick of that symbolic state and confirms equality with every variable aged by one, yielding arbitrary repeated-tick behaviour. Boolean cell updates enumerate all assignments to relevant local variables, simplify to expressions, and use fast kernel computation. Discovery code need not be trusted for correctness of accepted theorems. §5.2, p.16: an SML program parses an ASCII gate diagram, inserts initial clock/latch gates, traverses outputs depth first, stages crossings and reindexes boundary outputs. It repeatedly applies proved floodfill lemmas and simplifies concrete side conditions. nextCell correctness is checked over all 512 configurations of center plus eight neighbours. The final two outputs match and cancel the two initial inputs. Final theorem, p.17: for every n and input S, step^n(S)=read_mega_cells(step^(n×60×586)(build_mega_cells S)). Sampling selects p when 3150p+(1726,599) is live. Two mega-cell variants differ in latch state. The theorem guarantees sampled-state equality at designated times, not that intermediate circuitry resembles the macro-state at all times or that off-the-shelf simulator code itself is verified. §6, p.17: roughly 9500 LOC is author-reported proof effort. No benchmark timings, build duration, hardware, gate count, live-cell counts, formalization-person effort or independent simulator replay is provided. The source snapshot is available; no source inspection or kernel replay was done in this reading. Formal links to traditional universality models and generalization to other automata/hardware remain future work.
  • how much was read: most of it read
  • source
  • record id: gol-in-gol-in-2025
• GPS Summary-Guided Search (2025)
  • title: Software Model Checking via Summary-Guided Search (Extended Version)
  • what: Introduces GPS, a model-checking search guided by compositional summaries that prune infeasible paths and generate tests toward unexplored states, with instrumentation for refutation completeness. GPS combines breadth-first and concolic search, summary-directed testing, dead-end detection/interpolation and safety proofs/counterexamples. The evaluation compares GPS/GPSLite against Impact, CRA, VeriAbs, Symbiotic and CPAchecker on SV-COMP, literature and synthetic suites.
  • number: GPS solves 280/297 Impact-comparison benchmarks; GPS-nogas solves 273/297
  • number: CRA safe results 156/200→GPS 189/200 (21.2% improvement)
  • number: GPS best performance in number solved and running time across all benchmark suites; solves all but one Lock&Key benchmark
  • number: 600 s timeout and 15 GB memory limit
  • limits: Benchmarks use a 600-second timeout and 15 GB memory on selected high-performance cores. GPS can time out in summary generation (one 23-state Lock&Key benchmark); results depend on static-analysis summaries and benchmark distribution, and refutation completeness is eventual rather than bounded-time.
  • how much was read: most of it read
  • record id: gps-summary-guided-search-2025
• HornStr (2025)
  • title: sfHornStr: Invariant Synthesis for Regular Model Checking as Constrained Horn Clauses.
  • what: HornStr synthesizes regular-language inductive invariants for string-theory CHCs using SAT-based DFA learning or L* active learning. Standard SMT-LIB2.6 string solvers check initiation,transition closure and bad-state exclusion; reachability enumeration supports active membership and inductive-counterexample handling. It connects parameterized-protocol regular model checking to existing string solvers and generates string-query benchmarks. Describes restricted unary-predicate problem,learning/refinement flow,DFA-to-regex translation,heuristic reachability cutoff,incremental solver sessions and separate membership/equivalence backend choice. Reports complete query-solver and protocol results,including active-learner timeouts,unlisted hard protocols and prose/table inconsistencies. No general completeness theorem or verified implementation is supplied.
  • number: 18 benchmark protocols (Table 2); SAT-based learner solved all 18, mostly in under a second; MU puzzle 11.01 s with a 3-state automaton
  • number: The active learner timed out on 6 of the 18 (Burns, Mux-Array, Eqdist, MU Puzzle, Water-Jug, Dining-Crypt)
  • number: Z3-noodler solved all 848 non-incremental equivalence queries; cvc5, Z3, Z3-alpha solved 403 to 457
  • number: Generated more than 30000 string constraints (abstract) or more than 10,000 (Sec 5); the paper gives both numbers
  • limits: §2: one unary unknown predicate over strings; sought solutions regular languages. General CHC definition allows more predicates/nonlinearity, but that syntax is not evidence that implemented solver handles all general string CHCs. Symbolic alphabets and broader CHC support deferred in §5. §§2.1–2.2: safety expressed by initial inclusion,transition closure,error exclusion; configurations are modeled words. Correctness of protocol→CHC modeling/automatic translation assumed,not mechanized here. Arbitrary number of processes does not establish real Rust implementation correctness. §2.1: reachable/bad-predecessor languages can be nonregular while a separating inductive invariant is regular. Failure to find a regular invariant need not mean unsafe; no complete procedure for all infinite-state systems. §3: SAT unsat means current DFA size cannot fit examples and triggers larger size; string-query unsat means no violation of the particular checked clause. These are different meanings,not contradictory CHC conclusions. §3: active membership enumerates reachable words and may answer negative after same-length exhaustion or fixed cutoff. Explicit heuristic inspired by length preservation; bounded failure to find a word does not generally prove unreachable in length-changing rewriting. Could impair learning/completeness. Final all-clause validation remains distinct,conditional on solver correctness and handling of unknown/timeouts. §3: DFA→regex uses Brzozowski/McCluskey state elimination; induction counterexamples can be converted to positive/negative via reachability following strict-but-generous teacher. No in-paper full correctness/termination proof,complexity bound,formalized checker or proof-producing string backend. §3/Fig1: learners exchange regex equivalence queries and reachability membership queries through independent interfaces. Each CHC can have dedicated incremental solver thread with push/pop; optional single solver. Trust includes parsers,translation,learners,regex conversion and SMT solvers; artifact not executed. §4.1: query families have unequal counts: incremental523membership/396equivalence versus nonincremental30902/848. Raw aggregate runtimes cannot isolate causal per-query incrementality benefit without matched workloads. Table excludes timeouts from times; lower solved-time can simply reflect fewer solved queries. §4.1: prose calls523membership queries an average109.7s and says other solvers slightly higher runtimes. Table1 labels Time(s),caption solved time;Z3 33.7,cvc5 97.8,Z3-alpha86.4 are lower than109.7. Preserve table and inconsistent prose;109.7s as per-query average would exceed stated30s timeout. No silent correction or invented timing definition. §4.1: visual PDF p.8 confirms disequality x≠c; text extraction drops stroke and yields x=c. Regular-expression simplifier/flags marginal or harmful overall,not robust improvement;no quantitative ablation table. §4.2:18listed protocols all solved by SAT;active12solved/6timeouts. Kanban/German timeout60s in prose but absent from Table2;therefore SAT success on every listed row does not mean all benchmark protocols solved. Full-suite count and which learners timeout on unlisted protocols not supplied. §4/Table2: automaton sizes and learning seconds;no printed invariant automata/independent certificate or unsafe-trace count per row. MU3states/11.01s is reported discovery,not this reader rerunning solver or inspecting artifact invariant. First-solver claim is authors’ claim,not independently established priority. §4:IntelCorei7-10510U1.8GHz/16GB/Windows11.30s query and60s protocol limits;solver revisions,repeat counts/variance,full timeout overhead,independent baseline RMC comparison and frontend correctness unreported here. §§abstract/5:abstract says more than30000newQF_S constraints;conclusion says more than10000. Compatible lower bounds but inconsistent specificity;do not sum query categories as disjoint unique files. Liveness,bisimulation,further CHCs future work. No Verus/Rust/TLA+ or LLM experiments. Full version[30]arXiv2505.15959 and artifact[31]Zenodo15195124 contain deferred detail;not read/executed. This is proceedings-paper read only.
  • how much was read: most of it read
  • source; notes: ## HornStr (2025)
  • record id: hornstr-2025
• HornStr invariant synthesis (2025)
  • title: HornStr: Invariant Synthesis for Regular Model Checking as Constrained Horn Clauses (Technical Report)
  • what: Introduces HornStr, a solver that casts regular-model-checking invariant synthesis as constrained Horn clauses over SMT-LIB 2.6 strings. It combines SAT-based automata enumeration or active learning with string solvers answering membership and equivalence queries. HornStr parses parameterized protocols and string-rewriting systems into CHCs, uses incremental solver contexts, and supports Z3, Z3-alpha, Z3-noodler, cvc5 and OSTRICH. The evaluation separates string-solver oracle performance from end-to-end invariant learning across distributed protocols, MU and EqDist puzzles, and other benchmarks.
  • number: incremental membership: Z3-noodler solves 523 benchmarks in 109.7 s
  • number: incremental equivalence: Z3-noodler solves 396 queries in 15.5 s
  • number: non-incremental equivalence: Z3-noodler solves 848 queries in 17.9 s
  • number: membership query pool contains 30,902 benchmarks
  • limits: The learner represents invariants as regular constraints over strings and the active learner uses a bounded exploration heuristic for negative membership answers. Solver performance is sensitive to regex equivalence queries and a 30-second per-query timeout; some active-learning protocols hit a 60-second overall timeout. The paper covers safety-style invariant synthesis and leaves general CHCs, liveness and bisimulation for future work.
  • how much was read: most of it read
  • record id: hornstr-invariant-synthesis-2025
• Imandra certified Marabou checker (2025)
  • title: A Certified Proof Checker for Deep Neural Network Verification in Imandra
  • what: Implements and formally proves a checker for Marabou UNSAT certificate trees in the Imandra functional language and interactive theorem prover. DNN queries are represented as affine tableau equations, bounds and ReLU constraints. The checker parses inductive proof trees with ReLU or single-variable splits, updates child bounds, and checks Farkas contradiction vectors at leaves. A polynomial Farkas lemma and its DNN specialization connect negative linear combinations to UNSAT; covering lemmas show every satisfying assignment falls into one split child, enabling functional induction over the tree. The formalization includes 2,113 lines and 267 auxiliary lemmas. SAT assignments remain directly checkable; this work certifies UNSAT trees.
  • number: 2,113 formalization LOC
  • number: 267 auxiliary lemmas
  • number: 293/213 generated proofs
  • number: 276/180 timed proofs
  • limits: The formal model covers affine weights, piecewise-linear activations (implemented ReLU and identity), linear input/output properties, real arithmetic and well-formed dimensions. It does not verify Marabou’s certificate production or all optimizations; disabled bound-tightening optimizations were used in evaluation. Imandra’s arbitrary-precision arithmetic avoids floating-point error but costs time and uses list-based structures. Evaluation uses only UNSAT collision-avoidance and robotics queries, with proof sizes under 5 MB. Certified compilation from original DNN or higher-order specification to query constraints remains future work; checker soundness is relative to the supplied well-formed query.
  • how much was read: most of it read
  • record id: imandra-certified-marabou-checker-2025
• Implicit rankings (2025)
  • title: Implicit Rankings for Verifying Liveness Properties in First-Order Logic.
  • what: The method compares old and new states through formulas, instead of computing a number that must shrink (a ranking function). Constructors combine them pointwise, lexicographically, by multiset or permutation, and across a whole domain. Z3 checks the conditions that result. It verifies toy stabilization, a binary counter, token-ring non-starvation, Chang-Roberts leader election, SAT backtracking and abstract CDCL termination. It also verifies Dijkstra’s k-, 4- and 3-state stabilization and Ghosh’s 4-state stabilization.
  • number: all examples verified within 10 minutes (§6, p.388)
  • number: all examples verified within 10 minutes
  • number: Dijkstra 3-state DomPerm(k=4) creates 18 existential quantifiers
  • number: toy stabilization bound n^2
  • limits: The user supplies how the ranking is composed, the other proof-rule formulas, and sometimes hints for existential witnesses. Domains are finite but unbounded. It does not cover unrestricted infinite domains in full. The review notes found no person-month figures.
  • how much was read: most of it read
  • source; notes: LVR and implicit ranking functions; notes: Ivy, ranking, Coq, and Iris case index
  • record id: implicit-rankings-2025
• Improving the SMT Proof Reconstruction Pipeline in Isabelle/HOL (2025)
  • what: Adds cvc5 to Isabelle/HOL’s SMT proof reconstruction through Alethe, refactors reconstruction modules, extends the format and supported rules, registers generated rewrite lemmas, and adds standalone certificate checking and proof slicing for testing. Evaluates proof generation, reconstruction, rewrite-step checking and Sledgehammer portfolio gains. Explains concrete CPC-to-Alethe translation mismatches, incompatible fresh-term steps, typed numeral changes, previously veriT-specific parser/replayer behavior, checked assertion matching, and debugging slices that intentionally trust boundary steps. Separates solver success from kernel reconstruction and short-budget portfolio benefit. Tables expose a contradiction between the rewrite-lemma comparison’s prose conclusion and most reported rows.
  • limits: Reconstruction uses Isabelle/HOL’s logic and kernel plus the existing theory context and original goal encoding. Successful external solving alone does not establish an Isabelle theorem: assertions must match and proof steps must be reconstructed. Solver, translator and unverified Carcara need not be trusted for an ordinary completely reconstructed result. This paper does not formally verify the whole translation pipeline. Alethe here targets quantified linear real/integer arithmetic with uninterpreted functions. cvc5’s broader bit-vector, string/regular-expression and finite-set capabilities are future reconstruction targets, not supported successes of this work. CPC rules introducing unjustified fresh terms cannot be translated and leave holes. The paper calls this rare without enumerating a failure taxonomy/count. Alethe hole and lia_generic steps can be expensive; reconstruction can fail or time out. No completeness guarantee follows. The Carcara slice tool’s basic configuration inserts hole steps with argument “trust” at cut boundaries and for the final empty clause; these are deliberately skipped during Isabelle testing. Passing such a sliced unit test validates the targeted step in this test setup, not the original whole refutation. The alternative premise/negated-conclusion configuration supports many steps outside subproofs; general subproof slicing remains future work. The direct reconstruction-function testing method excludes rules introducing subproofs because of nontrivial context dependencies. Registered IsaRARE or handwritten lemmas must already be proved in Isabelle; lemma generation/registration is not permission to accept arbitrary rewrite axioms. Benchmarks originate from the same 5000 AFP goals with seven fact budgets, so the 35000 configurations are not independent goals. Tests intentionally do not sample the general SMT-LIB library, whose structural profile differs. No distributed-system, Verus/Rust, TLA+ or LLM experiment is reported. Proof sizes are average line counts on the common solved subset, not bytes, node counts or step complexity. Generation totals and reconstruction averages are conditioned on common solved problems, and cannot establish unconditional end-to-end speedup. Reconstruction has a much larger budget than the final Mirabelle experiment. The supplied paper gives hardware and selected veriT release context, but no complete exact revision/configuration manifest, raw-data artifact link, repeated-run dispersion or significance test. The author expectation that optimized cvc5 would surpass veriT at short budgets is prospective.
  • how much was read: most of it read
  • source
  • record id: improving-the-smt-proof-2025
• Inductive Predicates via Least Fixpoints in Higher-Order Separation Logic (2025)
  • what: Explains least/greatest predicate fixpoints encoded internally in higher-order separation logic using persistent premises and magic wand. Applies least fixpoints to heap predicates not aligned with mathematical structural recursion and to Iris total weakest preconditions. Provides a Rocq-Elpi prototype generating fixpoints, constructor/induction lemmas and an induction tactic from inductive-looking specifications, with kernel validation of generated declarations. Records exact fixedpoint/iteration/induction laws, persistent monotonicity and ordinary-conjunction resource sharing, deleted-list/search-tree/nested-rose cases, total-WP adequacy and scheduler/timeless-invariant restrictions, elaboration pipeline, extensible variadic signatures, tactic-port trust boundary and full size evidence. Identifies a concrete cons-tail typo in printed generated definition and limits prototype/performance claims.
  • limits: §2, pp.4–6: framework is higher-order predicate separation logic with persistence modality, abstracted as Modal BI. iProp describes owned resources and is embedded within Rocq rather than native Prop. Impredicative quantification over iProp predicates is essential. Iris’s affine presentation identifies separating unit with True; general Modal BI distinguishes Emp/True and its persistence/intuitionistic modalities, as footnote1 notes. Theorem1, pp.5–6: F:(A->iProp)->A->iProp must satisfy persistent internal monotonicity: box(forall x,Phi1 x wand Phi2 x) wand forall x,F Phi1 x wand F Phi2 x. Persistence allows reuse for multiple recursive children. Least fixedpoint mu F x=forall Phi,box(forall y,F Phi y wand Phi y) wand Phi x. Gives both unfold/fold entailments and iteration. These are logical equivalences, not definitional reductions of a native inductive datatype. §2, p.6: strengthened induction supplies Phi y AND mu F y for each recursive occurrence. Ordinary conjunction shares the same resource evidence; separating conjunction would wrongly require duplicate disjoint ownership. There is no dependent elimination/computation principle for iProp predicates. Greatest fixpoint dual is existential predicate plus persistent post-fixedpoint proof and separating witness; coinductive command generation remains future work. §3, pp.6–8: representation predicates may recurse through deleted nodes without shortening abstract list, or partition finite sets into tree children without syntactic structural decrease. Least fixpoints need monotonicity rather than a visible mathematical-size argument. Parameters (tail pointer, element relation, type) stay fixed during induction; indices change. Nested predicate uses require explicit Proper monotonicity instances in prototype. §4, pp.8–9: total wp(e,Phi) means all operational executions terminate safely and return values satisfying Phi. Safety excludes stuck expressions and invalid accesses. Hoare triple is persistent precondition wand wp. Nonvalue case combines reducibility and universally quantified one-step preservation using state interpretation and ghost update modality. Least fixpoint handles recursion without emitting later modality or requiring explicit numerical step bound. Theorem2, p.9: a closed triple [True] e [Phi] implies strong normalization of(e,h) for any heap h. This is a meta-level adequacy result under the Iris logic/language setup, not arbitrary scheduler fairness or universal correctness of every concurrent program. Strong normalization does not by itself state one uniform numeric bound or asymptotic runtime, especially for general nondeterministic branching. §4, p.10: ordinary partial WP puts recursive continuation under later; guarded Banach fixpoint requires contractiveness rather than positivity. Löb induction may prove partial wp of a diverging program with false postcondition because it never returns. Removing later and using least fixpoint changes termination obligations; total implies partial, reverse does not follow. §4, p.10: invariant-opening for total correctness is limited to timeless assertions; general nested invariants/WP-containing assertions cannot be opened unrestrictedly without later. Landin’s knot demonstrates why the restriction matters. Logic supports limited ghost state/invariants/concurrency, not full usual Iris reasoning power for total correctness. §4, p.10: concurrent total WP requires termination for every scheduler. Busy waiting that terminates only under fair scheduling cannot be verified. Paper explicitly leaves fair scheduler integration for future work; no distributed-protocol liveness or eventual network-delivery assumption is supplied. §5.1, pp.11–12: command parses familiar Inductive syntax as raw bound-variable-aware terms, turns top-level constructor wands into separating conjuncts, binders into existentials, cases into disjunctions, abstracts parameters/recursion/indices, replaces recursive calls with rec, turns the constructor conclusion into index-equality constraints, and simplifies trivial equalities. Higher-order abstract syntax helps binder substitution. Rocq elaborates holes and type-checks resulting declarations. §§5.1–5.2, pp.12–13: generated curried fixpoints avoid tuple plumbing and recognize required nonexpansive OFE morphisms for higher-order predicate arguments. Signature relations live in iProp; combinators express equality, wand, persistent relation, contravariance flip and respectful function relation. Proper instances in Rocq typeclasses make monotonicity extensible beyond a fixed syntactic positivity checker. §5.2, p.13: solver normalizes quantifiers/wands/modalities, then closes equal terms, applies hypotheses or searches signature/Proper rule and recurses. It is goal-directed proof generation, not complete decision procedure for monotonicity. New nested predicates may need manual instances; improved automation/errors are future work. §5.3, pp.13–14: IPM separates persistent and spatial named hypotheses. Proving object-logic wand is not a Rocq lambda introduction; tactics apply derived context-manipulation lemmas. Elpi port manages typed holes, controls typeclass resolution, reduces context functions and checks fresh names. It reimplements selected Ltac wrappers because bridge changes contexts inefficiently; declarations remain subject to Rocq validation. §§5.4–5.5/7, pp.15/17: Elpi database records generated induction theorem, parameter/constructor counts; iInduction queries it and opens case hypotheses. Prototype2106LOC=345Rocq+1761Elpi. Evaluation redefines totalWP and derives its existing proof rules without changing user signatures; no runtime timings, proof-speed comparison, broad benchmark suite or user study. Production integration unresolved due partial duplicated IPM wrappers. §§6–7, pp.16–17: native Rocq Inductive can target unfolded heap->Prop predicates but not Iris’s Sigma-bundled iProp arity; this is not a universal impossibility for all separation logic embeddings. Mere semantic positivity/monotonicity is more general than syntactic strict positivity, with no real-life strictness-gap case claimed. Source code is archived but not built here; no Verus/Rust/TLA+ or LLM proof-generation evaluation.
  • how much was read: most of it read
  • source
  • record id: inductive-predicates-via-least-2025
• LAW (2025)
  • title: The LAW theorem: Local Reads and Linearizable Asynchronous Replication
  • what: The paper proves that no replicated register can have all three of these: a local read (a read with no messages), linearizability, and a guarantee that operations finish despite async delays and one crash. It designs almost-local reads (batched read validation) in Hermes, ZAB and Raft variants.
  • number: Raft-ALR 2.6x baseline throughput at 2% writes, 1.8x at 5%; up to 156 million requests/s
  • number: ZAB-ALR within 4% of ZAB at 1% writes; Hermes-ALR within 11% at 1% writes
  • number: 5 CloudLab servers, one million keys; reads batched up to 128
  • limits: A human wrote a mathematical proof about a mathematical register (deterministic servers, one active operation each, at most one crash). The correctness of the read algorithms is argued in prose. The Raft baseline relaxes linearizability, so the performance comparison is an upper bound. There is no LLM, no code proof and no person-hours.
  • how much was read: most of it read
  • source; notes: Added related work: The LAW theorem: Local Reads and Linearizable Asyn
  • record id: law-2025
• LeanLTL (2025)
  • title: LeanLTL: A Unifying Framework for Linear Temporal Logics in Lean
  • what: Presents a Lean 4 temporal-logic library with a shared semantic representation for finite and infinite nonempty traces, arbitrary Lean propositions/data expressions, LTL-like macro notation, and preliminary simplification-based automation. Gives machine-checked embeddings of LTL and LTLf and a traffic-light safety/liveness example. Trace uses an Option-valued sequence N→Option σ, extended natural length, nonemptiness proof, and a proof that values are defined exactly before length. TraceSet is a predicate on traces; TraceFun maps a trace to Option α, with strong/weak get interpreting undefined values as False/True. The LLTL macro recursively rewrites host connectives, pushes next into trace-function arrows, binds strong gets before weak gets, and coerces remaining propositions/predicates into trace sets. The push_ltl simp set translates satisfaction into first-order semantics so existing Lean tactics can finish arithmetic obligations; Figure 1 proves an invariant of the recurrence n=5 initially and n_next=n² by globally_induction and nlinarith. LTL/LTLf embeddings use inductive syntax, evaluation, translation, and a satisfaction-equivalence theorem. The traffic-light example includes queue arithmetic and environment assumptions, proving exactly one light green globally and both lights green infinitely often for traces satisfying those assumptions.
  • number: 9-page short paper; Lean 4; tagged artifact vITP25
  • number: two traffic lights with queue/arrival/departure fields
  • number: no empirical performance or agent-evaluation numbers
  • limits: Discrete linear time; all traces are nonempty. Finite-trace strong/weak next and exceptional TraceFun accesses need deliberate truth-value handling. Arbitrary Lean theories improve expressivity but do not provide general decidability or a fully automated procedure. Automation is an initial simp-based prototype; integration of LTL/LTLMT solvers, formal embeddings for LTLMT/LTLfMT, and past/bounded-time operators are future work. The traffic-light system behavior is assumed from external specifications; complete example/embedding proofs are in the cited software repository rather than fully printed in the short paper. No repository execution, solver speed comparison, distributed implementation, or agent evaluation was performed in this reading.
  • how much was read: most of it read
  • source
  • record id: leanltl-2025
• Lilo (2025)
  • title: Lilo: A Higher-Order, Relational Concurrent Separation Logic for Liveness
  • what: Lilo is a Coq logic for the liveness of shared-memory programs. It uses obligations (promises to finish) and progress credits. The authors give proofs for a spinlock, a ticket lock, Treiber and elimination stacks, and infinite message passing.
  • limits: Stratified propositions limit contracts that refer to themselves. Logically atomic triples for the elimination stack are future work. It is not a result about networks or crashes.
  • how much was read: most of it read
  • source; notes: Iris: Trillium, Lilo, Lawyer
  • record id: lilo-2025
• LTL prior-knowledge simplification (2025)
  • title: Simplifying LTL Model Checking Given Prior Knowledge
  • what: Uses a knowledge automaton for an already-known system property to simplify the automaton for a new LTL property before product emptiness checking. Boolean bounds, stutter-insensitive restriction/relaxation, and structural tests produce a replacement automaton B whose product with the system preserves the answer. The MCC-derived evaluation measures definite answers, automaton simplification, runtime, and timeout behavior across nearly 98k problems.
  • number: 49% of retained MCC formulas solved using only low-complexity procedures/knowledge
  • number: 97,950 benchmark problems, average runtime 35.6 ms
  • number: strategies exceed 10 s on only 470 and 522 problems
  • number: 46,934 unsolved-by-simple-strategies problems receive automaton simplification
  • limits: The method assumes sound prior knowledge K with L(S)⊆L(K); simplifications remain language-safe under the stated theorems. Benchmark formulas come from colored Petri-net models and random transformations, and remaining cases still require ordinary LTL checking.
  • how much was read: most of it read
  • record id: ltl-prior-knowledge-simplification-2025
• $\text{textsc}\mathbf{PyCaliper}$: Python-Embedded Infrastructure for RTL Verification and Specification Synthesis. (2025)
  • what: # Whole reading: PyCaliper (authored by agents unless marked 🧑) This CAV 2025 paper supplies hardware specification/synthesis infrastructure and two case studies. Its directly relevant LLM result is GPT-4o ordering existing invariant candidates under formal-oracle checks. The record below separates source reports from reader interpretations and preserves scope limits. Source report: PyCaliper is a Python-embedded domain-specific language (DSL) and infrastructure for register-transfer-level (RTL) hardware specification, verification-backend integration and invariant synthesis. The paper contributes an extensible common specification/oracle interface and two case studies. Its algorithms build on existing incremental invariant synthesis and counterexample-guided inductive synthesis (CEGIS). Reader assessment: no new soundness/completeness theorem, mechanized correctness proof of the framework, or general distributed-system verification result is presented. The framework delegates checks to existing proof engines. [Q1, Q2, Q13] Source excerpt — §1 Related Work and Figure 1; physical PDF p.3, printed p.410, paper.raw.txt:96: text PyCaliper on the other hand, is not a verification tool in itself: our main contribution is Python-embedded infrastructure that enables programmatic RTL specification and interfaces with (SVA and BTOR2)-based verification engines. We use these verifiers as oracles to implement invariant synthesis techniques such as syntax-guided synthesis via CEGIS [3] and incremental invariant synthesis [11,36] (the latter itself uses an approach based on PDR). Source report: SpecModule/Struct/Group/Logic/LogicArray mirror RTL modules and signals. input, state and output mean global assumptions, state invariants and output assertions. A miter is two copies of the design; eq and conditional eq relate their signals, while inv is a single-copy assertion. The displayed inductive obligation is input(S) ∧ state(S) ∧ T(S,S′) ⇒ state(S′) ∧ output(S′). Reader qualification: this is preservation under the assumed invariant; the formula does not itself show that every reachable initial state satisfies state. The SVA harness includes clock/reset assumptions, but the paper does not provide a separate base-case proof or a complete initialization-semantics argument. Correct results depend on correct assumptions, RTL mapping, translation, solver and oracle handling. [Q3, Q4, Q7, Q8] Source excerpt — §2.1 Specifications and Figure 2; physical PDF p.4, printed p.411, paper.raw.txt:141: text Inductive Specification. Inductive specifications in PyCaliper consist of three components: input, state, and output blocks. These correspond to global assumptions, the state invariants, and output assertions, respectively. In general, the input, state, and output functions can be thought of as predicates over the state of the RTL design. Source examples: Figure 2 gives a parameterized FIFO specification for no stale-data leakage: equal control signals and pushed input data, equal pointers and selected live storage entries, and equal output data when nonempty. These are printed schematic examples with omitted code, not separately measured case studies. Figure 3 uses @unroll(2): assume two chosen input constants at step 0 and assert the adder output at step 1 while reset is deasserted. Reader qualification: the printed Python randomly chooses constants before the bounded check, so that illustration alone does not cover every input pair. It computes sum(vals) % MAX with 32-bit constants, but MAX is undefined in the displayed excerpt; the exact wrap modulus is unspecified. [Q3, Q5] Source excerpt — §2.1 bounded specifications, Figure 3; §2.2; physical PDF p.6, printed p.413, paper.raw.txt:197: text Example 1. Figure 3 provides an exam- ple for an Adder module in which the simstep function specifies that the output with two (randomly chosen) inputs a and b equals a + b modulo wrap-around. Source report: elaboration introspects Python objects and resolves hierarchical paths, e.g. a UART tx_fifo.wr_ptr. Parameterized FIFO depth/width can be packaged as a Python library. Section 2.3 presents input-side and output-side implication obligations under a relation R and illustrates FIFO refinement to a Counter. Only synchronous lock-step module transitions are currently supported; stuttering is discussed as a more general form. Reader qualification: the displayed implications alone are not a full transition-simulation proof; initialization and preservation of R are not separately established in this paper. The printed FIFO/Counter relation is preserved in rendered transcriptions without correcting its direct pointer/incdec equalities. [Q5, Q6, Q7] Source excerpt — §2.3 lock-step restriction; §3.1; Figure 4; physical PDF p.8, printed p.415, paper.raw.txt:264: text PyCaliper currently supports refinement proofs where both M1 and M2 mod- ules transition synchronously in lock-step. In general, refinement relations may allow one module to stutter, i.e., not transition while the other module tran- sitions. Such stuttering refinement [16,32] can be used to relate two modules that have similar functional behaviors but different timing behaviors. For exam- ple, Burch-Dill refinement [33] allows verification of a pipelined processor design against its non-pipelined counterpart. Source report: the SVA backend emits a clock/reset harness and a k-step counter, compiles assumptions and assertions, and invokes the licensed Jasper FPV App through TCP/Tcl. Its oracle enables/disables assumptions, covers/checks properties and retrieves traces. The BTOR2 backend uses Yosys lowering with memory flattening, hierarchy removal and technology mapping, retains signal-name correspondence, symbolically unrolls the design and checks bit-vector formulas with Boolector. Other engines/solvers are proposed through interface/operator extensions; the paper does not report an implemented SymbiYosys backend. Reader assessment: the comparison measures two concrete integrations; it does not verify translation correctness or establish equivalence of all engine results independently. [Q7, Q8] Source excerpt — §3.1 oracle; §3.2 BTOR2; §4.1; Table 3; physical PDF p.9, printed p.416, paper.raw.txt:306: text PyCaliper currently supports the (licensed) Jasper Formal Property Ver- ification (Jasper FPV) App [13] as the proof engine. However, we can enable support for other engines (e.g., open-source tools such as SymbiYosys [15]) by implementing the oracle interface. PyCaliper interacts with Jasper FPV via a TCP interface which is used to send Tcl commands (e.g., prove P_asrt for a check queries) and receive responses. Source report: ceqhole searches for a conjunction of conditional equalities selected from a supplied signal list. Its fuel-limited incremental search maintains speculative assumptions and relatively inductive assertions, adds candidates via a strategy, saturates provable assertions, backtracks, and succeeds only when a self-inductive set proves output. Running out of candidates or fuel can fail. ctrlhole searches a bounded-size control-to-dependent-signal lookup table using traces, then checks inductiveness; counterexamples refine the trace set, and unsatisfiable trace constraints increase table size up to a bound. Reader qualification: these are template-restricted searches; unsuccessful bounded search does not show no invariant exists. The two reported experiments do not benchmark ctrlhole/CEGIS. [Q4, Q9, Q10] Source excerpt — §4.2 strategy/failure; §4.3 CEGIS; Figure 6; physical PDF p.11, printed p.418, paper.raw.txt:402: text If verification fails, the trace counterexample is added to the set of traces, and the process is repeated again (up to a limit). Adding the trace guarantees that the (incorrect) lookup table candidate will not be produced in a subsequent iteration. Rendered source: Figure 5 prints the dive guard |assrts| − |assms| > f*, but the surrounding §4.2 text says fuel bounds |assms| − |assrts| and that candidates are added only with fuel remaining. Reader diagnosis: the operand order and inequality do not match that prose interpretation. Both versions are saved, including the full four-rule transcription and image crop. This is a discrepancy in the paper presentation; author code was not inspected, so the implemented guard and its behavior are unknown. No repaired rule is asserted. [Q9, Q10] Source excerpt — §4.1 synthesis target; §4.2 incremental synthesis; Figure 5; physical PDF p.10, printed p.417, paper.raw.txt:364: text The algorithm admits a fuel parameter f∗ that imposes an upper bound on |assms| − |assrts| during the search. Intuitively, a higher f∗ allows for more speculative guessing (with higher coverage), while a lower f∗ forces the algorithm to be more conservative. Source report: domain tags are added to an open-source TAGE indirect-branch predictor so an entry is used only in its creating privilege domain. The stated checked property assumes privileged true targets targ_i < BDRY and an invariant that every PRIV-tagged table target is below BDRY; it asserts prev_mode = PRIV ⇒ targ_o < BDRY. Both backends reportedly verify this using 2-induction. Reader qualification: the formal claim is a privileged-target range property under those assumptions. It does not itself assert full target correctness, independence from all attacker-controlled state, whole-processor security, or complete prevention of every branch-target-injection behavior. No attack experiment, independent proof-certificate check or reproduction was performed here. [Q11, Q12] Source excerpt — §5.1 IsoTAGE security property and two backends; physical PDF p.12, printed p.419, paper.raw.txt:428: text We formalize this as a property that says that provided the true branch target in privileged mode (PRIV) is in the valid kernel-code segment (less than a boundary BDRY), the generated prediction is also in the valid kernel-code segment. Formally, we iden- tify the inductive specification: Source measurements: Table 4 varies BHT_WIDTH from 4 through 9. SVA total/solve/parse seconds are 4.0/2.6/1.4 at width 4 and 12.7/11.4/1.3 at width 9. BTOR2 is 3.6/2.6/1 at width 4 and 753.9/11.9/742 at width 9; all six rows are saved in evaluation.json. BTOR2 program statements grow 5,465→116,186 and elements 598→14,486. Solving times are comparable in these cases; total BTOR2 time becomes dominated by parsing, and is slightly lower than SVA only at width 4. The authors call the Python-based parser a likely cause; no parser ablation establishes causation. Hardware, software versions, repetitions, run uncertainty and precise timing boundaries are not supplied. These figures support a bottleneck diagnosis for this benchmark family, not a broad solver ranking. [Q11, Q12] Source excerpt — §5.1 IsoTAGE security property and two backends; physical PDF p.12, printed p.419, paper.raw.txt:438: text Interestingly, we observe that the solving times (ST) of the BTOR2 backend (using the Boolector solver [12]) is comparable to SVA backend using the Jasper FPV App. However, the parse time (PT) is where BTOR2 backend falls behind. This is likely due to the fact that we currently use a Python-based btor2 parsing library - we plan to report this result and improve the parsing performance. This insightful comparison was possible due to PyCaliper’s compatibility with both verification backends. Source report: DAWG dynamically partitions cache ways to prevent cross-domain information leakage, formulated as noninterference. Prior work manually supplied invariants. This experiment synthesizes k out of 8 cache-way invariants for k=2,3,4 as invariant width increases. It compares built-in random ordering against GPT-4o ordering of existing candidates, given current invariants and the partitioning property. The authors report about 80 Python lines and 30 minutes of human effort to add that strategy. Reader qualification: this LLM supplies a search heuristic; it is not reported to invent the desired property, write arbitrary invariants, prove a theorem or produce a verified Rust/TLA+ specification. Backend oracle checks determine acceptance. [Q12] Source excerpt — §5.1 Table 4; §5.2 DAWG and GPT-4o strategy; Table 5; physical PDF p.13, printed p.420, paper.raw.txt:467: text We attempt two strategies for selecting the invariant candidate order: random (in-built) and a custom (rudimentary) neural strategy. In the latter, we prompt an LLM (gpt-4o) to provide an order of candidates, providing the current set of invariants and the cache partitioning property as context. Implementing this strategy with PyCaliper required ∼80 lines of Python code and around 30 min of human effort. Source measurements: Table 5 reports means ±σ over 20 runs using the SVA backend and Jasper FPV. For k=2, random/neural verification calls are 16.7±2.3 / 14.3±2.6 and nodes 5.5±0.6 / 4.9±0.9. For k=3, calls are 101.6±47.1 / 54.0±21.8 and nodes 13.3±5.5 / 8.5±3.9. For k=4, calls are 785.7±91.2 / 163±74.2 and nodes 54.3±4.8 / 11.6±8.6. Reader assessment: this shows lower mean search/oracle effort in three configurations on this design. The paper does not report end-to-end wall time, LLM/API cost, exact prompt/model snapshot/temperature, random seeds, fuel setting, success/failure counts or held-out designs. It supplies no statistical significance test or measured generalization claim. These counts cannot establish overall speedup or cost savings after LLM overhead. [Q12] Source excerpt — §5.1 Table 4; §5.2 DAWG and GPT-4o strategy; Table 5; physical PDF p.13, printed p.420, paper.raw.txt:484: text We use the SVA-backend with the Jasper FPV App as the verification engine. We see that even our very rudimentary neural strategy outperforms the random strat- egy, likely by being able to detect a pattern in the invariants using the provided context. The takeaways from this experiment are twofold. Firstly, PyCaliper allows leveraging industry-scale backends as verification oracles in an invariant synthesis task. Secondly, PyCaliper uses the Python ecosystem to enable easy prototyping of new ideas. Reader synthesis: directly useful for LLM-assisted formal-verification evaluation: separate a heuristic candidate proposal/order from a trusted verification oracle, constrain the search language, expose assumptions and search budgets, and distinguish oracle-call count from end-to-end runtime/cost. Its specification reuse, two-trace security properties and assume-guarantee/refinement interfaces are adjacent to distributed-systems proof engineering. No distributed-system, Verus, verified Rust or TLA+ case is evaluated; transfer to those settings is an inference requiring separate implementation and evidence. In particular, its lock-step-only refinement would not by itself cover the stuttering commonly needed when relating systems with differing step granularity. The strongest topic-specific evidence is the measured GPT-4o candidate-ordering experiment, not autonomous specification/proof generation. [Q6, Q7, Q9, Q10, Q12] Source excerpt — §5.1 Table 4; §5.2 DAWG and GPT-4o strategy; Table 5; physical PDF p.13, printed p.420, paper.raw.txt:490: text Secondly, PyCaliper uses the Python ecosystem to enable easy prototyping of new ideas. Reading audit: all 18 physical PDF pages (printed 408–425) and all 784 LF of the complete layout extraction were read, including §§1–6, acknowledgments, disclosure, references 1–56 and the license through EOF. All six figures and five tables were inspected in their rendered pages; the remaining pages were viewed in contact sheets after their text was read. No appendix occurs in this PDF; external publisher attachments were not queried. Literal physical-page quotes remain separate from rendered-math/table transcription. PDF metadata duplicates/omits author names, so identity follows the rendered title page. The title page displays artifact-available and reusable badges; no artifact execution or independent evaluation was done here. No author implementation file, scientific dataset/result artifact or checkpoint was inspected/loaded; no formal tool was run. Measurements and proof successes are source-reported. Independent source review and final aggregate acceptance remain for the parent. [Q0, Q1, Q2, Q3, Q4, Q5, Q6, Q7, Q8, Q9, Q10, Q11, Q12, Q13, Q14, Q15, Q16, Q17] Source excerpt — Open-access license; physical PDF p.18, printed p.425, paper.raw.txt:683: text Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License
  • limits: Source-reported backend success under input/state/harness assumptions; template- and fuel-limited invariant search; lock-step-only refinement; no separate framework soundness/translation proof; Figure 5 fuel-guard/prose discrepancy; privileged prediction range versus complete attack security; three DAWG synthesis settings averaged over 20 runs; no end-to-end LLM time/cost or generalization evidence; no reproduction.
  • how much was read: most of it read
  • source
  • record id: mathbf-textsc-pycaliper-python-2025
• Model Checking and Synthesis for Optimal Use of Knowledge in Consensus Protocols (2025)
  • what: # Model Checking and Synthesis for Optimal Use of Knowledge in Consensus Protocols (authored by agents unless marked 🧑) Alpturer, Huang and van der Meyden use MCK to check whether small synchronous consensus protocols decide as soon as their available information permits, and synthesize concrete decision predicates from knowledge-based programs. The contribution is empirical and methodological. They “do not attempt to give a full characterization or a proof” of general optimality (§1, p.3, Q3). The 22-page arXiv 2505.02353v1 is the full version of the PODC 2025 paper, ACM pp.131–140, DOI 10.1145/3732772.3733552 (Q37; saved arXiv metadata). No new parameterized proof or new synthesis engine is presented. ## Assumptions and specification (authored by agents unless marked 🧑) The system has synchronous message rounds and two layers: an information exchange defines observed state, messages and updates; a decision protocol chooses noop or a decision. Failures are crashes or sending omissions. A crashing agent can send an arbitrary subset of its messages in the crash round and then sends nothing; an omission-faulty agent can omit sends but receives messages sent to it (§3, pp.5–6, Q6–Q7). “Byzantine Agreement” names the coordination problem here; the experiments do not evaluate arbitrary malicious message values, asynchronous scheduling or a cryptographic implementation. The base simultaneous agreement specification requires at most one decision per agent, agreement at the same time among nonfaulty agents, and a decision value initially held by some agent, possibly faulty. The paper explicitly says “termination is not a requirement of this specification,” while reporting additional termination checks in its scripts (§4, p.6, Q8). Eventual agreement permits different decision times (§8, Q20). These distinctions matter when calling a synthesized result correct. Optimality is relative to the same information exchange and failure model, comparing runs with identical initial preferences and failure patterns (§4, p.7, Q9). The paper distinguishes an optimum protocol, which decides no later than every competitor, from an optimal protocol, which no competitor systematically improves. This is not optimality across arbitrary messaging designs or execution costs. The semantic order as printed compares every agent; this record does not silently narrow its quantifier to nonfaulty agents. MCK uses finite variables and ordered binary decision diagrams. The chosen clock semantics gives an agent its current observable variables plus the time, rather than perfect recall. Synthesis replaces boolean template variables with local predicates equivalent to knowledge tests (§6, pp.8–9, Q11–Q12). Uniqueness under clock semantics and the optimality characterizations are attributed to prior theory, not proved anew. EBA’s simpler knowledge-based program P0 also requires technical side conditions on information exchange: learning 0 through decision-message chains and suitable possibilities involving nonfaulty agents (§8, pp.11–12, Q20). ## Concrete cases and results (authored by agents unless marked 🧑) Four SBA information exchanges are modeled: FloodSet, FloodSet plus current received-message count, the Count variant plus previous count (“Diff”), and the concrete Dwork–Moses protocol. Two EBA exchanges, Emin and Ebasic, respectively send decision values and additionally send initial 1 messages with a count. The models have parameters n agents, t maximum failures and the decision-value set. The main FloodSet/Count timing table fixes two values (§§7–11, Q13–Q28). FloodSet retains values seen and broadcasts their union. The naive earliest-knowledge hypothesis t+1 fails at n=3,t=2. Revised Eq 2 uses time=n−1 when t≥n−1, otherwise t+1; model checking and synthesis agree in the instances checked (§7.1, pp.9–10, Q14–Q15). The authors report an all-n proof in companion work [7]; this read does not include that proof (Q17). Adding the current message count exposes the early condition count≤1, meaning only the agent’s own message was received (§7.2, Q16). Diff gave no stronger SBA stopping condition than Count in checked cases, although previous-count memory can help a different EBA specification (§7.3, Q18). The printed Count formula needs reconciliation at a boundary. Eq 3 uses “time = t” in its t≥n−1 branch (§7.2, p.10, Q16), whereas FloodSet Eq 2 uses time=n−1 (Q14). At n=3,t=3,time=2,count=3, Eq 2 is true and Eq 3 false. Count adds an observation while retaining FloodSet’s values and clock; its stated earliest condition should not require later knowledge on that account. No-crash histories allow count 3 even when t=3 is the failure upper bound. This is a reader-derived discrepancy in the printed conditions, not a replayed MCK counterexample or a refutation of the companion theorem. The benchmark inputs needed to resolve it were not obtained. The source’s formulas are retained unchanged in Q14/Q16 and static-witnesses.json. There is a second printed EBA ambiguity. Ebasic’s jd update stores 0 on receiving 0 and otherwise ⊥, but its decision 1 rule includes “jd𝑖 = 1” (§9.2, pp.12–13, Q22). Under that update description the jd=1 branch cannot be reached. I have not silently repaired the update or inferred which rule the actual model used. Appendix A gives a complete FloodSet synthesis example for n=3,t=1,two values. It uses finite time 0..3, communicates while time<2 and has four decision templates for knowledge times 1 and 2 (pp.18–21, Q32–Q35). The reported output makes both time 1 predicates false; at time 2 the predicate for v is values_received[v], with 0 taking priority in the decision code. The authors report that the accompanying formulas all hold (p.22, Q36). State at time m means information after round m; the decision follows in the next modeled round (§7, Q13). This accounts for the appendix’s AX3 completion check. The appendix checks ordinary and uniform agreement, validity and termination at AX3, and knowledge predicates. Its printed agreement formulas compare values when both agents have decided; they do not explicitly require simultaneous decided flags (Q34). Thus the displayed formulas alone are not a direct check of every SBA clause. The knowledge-based theory may establish simultaneity; no counterexample to the synthesized protocol is claimed. Likewise the finite AX3 termination check is not a general unbounded liveness proof. The appendix uses currently ALIVE agents in knowledge tests, which should not be casually substituted for permanently nonfaulty agents without the cited crash-theory correspondence. ## Evaluation and limits (authored by agents unless marked 🧑) The experiments used one core of a 3.7 GHz six-core Intel Core i5 with 256 KB L2, 9 MB L3 and 32 GB memory. The final run’s timeout was 10 minutes (§10, p.13, Q23). Early exploratory trials sometimes ran 5 hours or 2 days; those are not the table timeout. No MCK build/version, BDD variable ordering, repetition count, variance, raw trial set or memory measurements are supplied. The measured costs are model-checking and synthesis runtime, not consensus latency or deployment throughput. All three timing tables are transcribed with printed values and converted seconds in numeric-evidence.json: 16 parameter rows in Table 1, 15 in Table 2 and 6 in Table 3, totaling 118 timing cells. TO remains a timeout rather than a measured 600-second completion. Representative results show the steep scaling: - FloodSet at n=5,t=2: checking 34.635 seconds, synthesis 162.015 seconds; synthesis times out at n=5,t≥3. Checking still finishes at n=6,t=1 in 72.863 seconds, while n=6,t=2 times out (Table 1, Q24) - Count at n=4,t=2: checking 23.328 seconds, synthesis 120.892 seconds; synthesis times out for t=3/4 and both tasks time out at n=5 in the listed rows (Table 1) - Diff at n=3 takes roughly 258–304 seconds depending on failure bound/rounds; Dwork–Moses times out for every listed n=3 case. Both time out at n=4,t=1,one round (Table 2, Q26) - Emin EBA synthesis succeeds through the listed n=3 cases, with crash costs 31.219–178.142 seconds and omission costs 11.371–66.735 seconds. Every n=4,t=1 cell times out. Ebasic succeeds only at n=2 in Table 3 (Q28) Table 3’s prose says Emin scales to 4 agents before blowup, then names Emin again for the worse count-containing model. The table has no successful 4-agent row, and §9.2 attributes the extra count to Ebasic. This record preserves the cells and flags the prose ambiguity instead of recording 4-agent success or swapping labels without evidence. Receiving/general omissions are reported to have similar successful cases, but no separate timing rows are provided (§11, Q28). For comparison, the authors report 125 seconds for purely temporal SAT-based SBA checking of Dwork–Moses at n=5,t=4 (§13, p.16, Q30). This checks a different obligation with a different algorithm from the BDD epistemic runs, so it is not a like-for-like solver speedup. They suggest quadratic messages and BDD size explain the difficulty; the paper does not measure a causal ablation. Their conclusion is appropriately limited: “a manual proof of correctness and optimality will” still be needed for all numbers of agents and failures (Q30). ## Contribution to the requested topic and evidence scope (authored by agents unless marked 🧑) This adds concrete epistemic verification and protocol-synthesis benchmarks for distributed consensus, including examples where stronger local observations permit earlier decisions but make automated analysis harder. It supports a workflow of synthesizing small instances, checking hypotheses on larger finite instances, then proving the general claim manually. That workflow is the authors’ proposal; this paper does not demonstrate LLM agents. There is no Verus or verified Rust experiment. Appendix A calls its nondeterministic transition construct “refinement calculus/TLA action style” (Q33); it does not report TLA+/TLC verification. For LLM-generated specifications and proofs, I infer evaluation lessons from the record: state the failure and information-exchange scope, declare observation/recall semantics, distinguish agreement from simultaneous agreement, inspect every printed guard and boundary case, separate finite checking from general proofs, and retain timeouts and source/script mismatches. These are reader-derived lessons, not measured LLM results. Read every one of 1099 layout-text lines, all 22 pages, all 39 references and the complete appendix input/output. Inspected 11 contact sheets and fullsize pages 10,13–15,19–22; the paper has three tables and no figures. The bundle retains 44 literal excerpts with line/character/page anchors, 19 diagnostics, all 37 timing rows and raw hashes. Local/official PDFs are byte-identical. The paper identifies no benchmark archive/repository link. The primary MCK site links a related consensus demonstration. I read its page/loader and all 551 logical lines (550 newline characters) of four static source scripts: FloodSet, optimized FloodSet, Count and Dwork–Moses. They are pinned by content hashes and fetch times; no direct association with the paper’s benchmark version was established. The demo FloodSet/Count scripts read and update w in place, allowing later senders to forward values received earlier in the same round; Appendix A instead snapshots old_w before delivery. Demo FloodSet crash delivery is also selected per value. These differences prevent treating the demos as interchangeable benchmark inputs or evidence against the paper’s reported results (Q38–Q44, D19). No demo Verify action or stored .result output was invoked or loaded. Two MCK subpage links returned 404 and were not retried within five minutes. No author code, compiler, model checker, prover or solver was executed; no serialized scientific/model/results data were loaded. Reported checks and synthesis outputs are statically inspected author results, not independent reproductions.
  • limits: Synchronous rounds, crash or sending omissions, and finite MCK clock semantics using current observations and time. Optimality is relative to a fixed information exchange and failure model. Base SBA omits termination. EBA P0 requires technical information-exchange side conditions. The paper checks finite instances and supplies no all-n proof. Count Eq. 3, the Ebasic jd update and Table 3 prose have unresolved printed discrepancies; the appendix lacks an explicit simultaneity formula. Related static demo models differ from the appendix; the exact benchmark revision and independent reproduction are unavailable.
  • how much was read: most of it read
  • source
  • record id: model-checking-and-synthesis-2025
• MOKA abstract-interpretation checking (2025)
  • title: Model Checking as Program Verification by Abstract Interpretation
  • what: Introduces MOKA, a Kleene-algebra/fixpoint language encoding ACTL and universal modal µ-calculus formulas as programs that enumerate counterexamples, then combines sound abstract interpretation with local-completeness logic and abstraction repair to eliminate false alarms. MOKA programs operate on stacks of current and traversed states; the paper proves formula satisfaction iff the collecting MOKA semantics is empty. It lifts arbitrary state abstractions to stack abstractions, defines sound abstract interpreters, and extends Local Completeness Logic with least-fixpoint rules (µLCL). A failed local-completeness obligation guides Abstract Interpretation Repair by adding relational abstract elements; traffic-light and control-flow examples show a false alarm removed by refinement. The framework provides exact counterexample under-approximations when LCL triples derive, plus sound proofs of satisfaction when the abstract result is bottom.
  • number: ACTL and universal µ-calculus fragment
  • number: finite-state domains
  • number: MOKA KAF programs
  • number: µLCL fixpoint rules
  • limits: The main results cover ACTL and the universal single-variable µ-calculus without existential diamond, finite-state domains and collecting semantics. Abstract interpretation can over-approximate and raise false alarms until local completeness is established; repair may refine domains toward concreteness and can be expensive. No large implementation benchmark is provided; examples are toy traffic lights/control-flow graphs. Existential fragments, richer domains, and PDL extensions are future work.
  • how much was read: most of it read
  • record id: moka-abstract-interpretation-checking-2025
• Nanopass Back-Translation of Call-Return Trees for Mechanized Secure Compilation Proofs (2025)
  • what: Rocq-verified back-translation from a finite well-formed collection of finite call/return trace prefixes into generated source whole programs sharing a context. Organizes the construction as initialization plus four small compiler passes over call-return trees, using identifiers, ghost call stacks and flattened rules before code generation. Proves each requested prefix can be produced by the back-translated source program. Handles stateful, arbitrarily reentrant callbacks and returns separated from their calls by nested interactions. Private loc, is_call and res distinguish external callbacks from internal recursion and recover the correct branch after a return. Separates determinacy and stack invariants across intermediate semantics, then relates ghost locations/stacks to concrete memory/frames. Gives an informal path to stronger finite-relational security, while explicitly leaving integration into a complete compilation-chain security theorem unmechanized.
  • limits: Inputs are finite sets/lists of finite prefixes satisfying well-formedness, including deterministic context behavior: after the same visible history, a context in control cannot choose two different outgoing events. The exact well-formedness predicate is not reproduced. Arbitrary incompatible trace collections are not covered. Compartment interaction uses well-bracketed calls/returns with integer payloads, private state and procedures/interfaces. The exposition assumes one procedure per compartment; the actual development supports multiple procedures and records procedure identifiers in call events. Fine-grained sharing of secure data/code pointers is future work. Theorem3 establishes inclusion of each requested finite prefix in generated-program behavior. It neither states equality of all trace sets nor forbids extra generated behavior, and it does not establish infinite-trace/liveness properties. Finite-prefix witness preservation must not be inflated to arbitrary hyperproperty preservation. The proven artifact is the back-translation and its pass simulations, not a new full RFrSP theorem for the existing compiler or compartmentalized CompCert. Figure1 describes an adaptation requiring forward/backward compiler correctness, separate compilation and recomposition. §1 explicitly says mechanization of that integration is not yet done; §8 makes realistic SECOMP integration future work. RFrSP quantifies finite families of possibly different programs under one target context, requiring one shared source context for the corresponding prefixes. RSP has only one program/prefix. Pointwise independent source contexts would not meet the stronger quantifier order. The informal implication to full abstraction is qualified in §3.1 as a variant of the security-relevant direction, not an unconditional complete fully abstract compiler theorem. It relies on the chosen trace/context/source-target models and the remaining compilation-chain proof. Back-translation constructs whole source programs: a common context depends on the entire trace family, while each generated program depends on its own trace. It does not directly translate the syntax of an arbitrary low-level adversary or prove that every original source program already behaves like the generated replacement. Adding ghost-state conditions to intermediate semantics is justified by forward simulations, not by simply assuming invariants in the final source semantics. Proof obligations include initialization and invariant-preserving matching steps; finite-prefix simulations permit stuttering without establishing divergence preservation. Reuse across languages and proof-effort improvements are author expectations/experience reports. No controlled comparison of developer time, proof checking time, memory, runtime of generated contexts, scale benchmark or LLM-agent result is reported. Prover/library axioms were not audited by this reader.
  • how much was read: most of it read
  • source
  • record id: nanopass-back-translation-of-2025
• NDD: A Decision Diagram for Network Verification (2025)
  • what: A network-specific decision-diagram library factors Boolean network state by fields. Each NDD node branches on a whole field and each edge labels allowed field values with a BDD; reduced ordered NDDs merge equal residual functions. Per-field atomization replaces label BDD operations with atom-set operations, and an incremental update API splits affected atoms. A paper induction proves intended canonicity for fixed field grouping/order; Java integration into five verifiers measures time/memory, including packet rewriting and link-failure models. Benefits rely on field locality and are not uniform across workloads. Records three reduction rules, exclusive/exhaustive edge semantics, field/bit-order assumptions and full canonicity construction, atom minimality and update precondition, complete apply/exist/atomize/update algorithms and qualified listing concerns, hash/GC/cache/implicit-false details, all eight tables and complete scope of empirical results. Separates representation canonicity from implementation correctness and end-to-end network verification, and identifies workload, baseline and source-count discrepancies.
  • limits: §§3.1/6.6: Field locality means rules usually match few of many fields and different rules match different fields; values are sufficiently independent to create cross-product redundancy in monolithic BDDs. It is a performance assumption, not a logical restriction needed to represent correlated packet sets. Networks matching all fields can reverse advantage. NDDs can still grow exponentially and a node can have up to2^n outgoing edges for an n-bit field; pairwise apply may compare m×n successors. §3.3/AppendixC: Fixed grouping of consecutive bit variables into fields and fixed field order, plus canonical BDD labels with fixed internal bit order, underpin canonicity. Ordered nodes, uniqueness, removal of a sole true-labeled edge and merging edges with same successor are essential. Equivalent Boolean functions yield one reduced graph under these conventions; claim does not establish minimum graph size across groupings/orders or efficient construction in worst case. AppendixC proof: Generalize Shannon expansion by partitioning first-field assignments according to equal residual functions, recursively represent residuals, label each equivalence class with its BDD and merge equal successors. For uniqueness, compare an assignment shared by matching edges, invoke induction for successors, then no-duplicate-successor rule forces equal labels. Constants and unused fields reduce away. This is handwritten mathematical proof, not mechanized code refinement. §3.3 Definition1/AppendixC qualification: Formal edge conditions require disjoint/exhaustive labels but do not explicitly forbid false (empty) labels. Uniqueness argument chooses B1∈label(eu), implicitly requiring every retained edge nonempty. Without that convention, add an empty-labeled edge to an unused distinct later-field successor: represented function is unchanged while edge map differs and listed no-duplicate-successor rule still holds. Algorithm1 line7 does discard false intersections. Record this as a formal-statement convention to make explicit, not an implementation bug established by execution. §3.4: Atoms per field are nonempty, pairwise disjoint, exhaustive and minimum in number such that every relevant edge label is a union of atoms. Sum of per-field atoms is compared with number of whole-header equivalence classes; these counts represent different objects, so count reduction alone is not total-memory reduction. NDD graph stores inter-field correlations. Table3 measures actual JVM delta separately. §4.1/AppendixB Algorithm1: apply intersects labels of every successor pair, recursively combines successors and merges labels for equal output successors. Atomized mode uses set intersection/union. Pseudocode covers explicit false edges; source says or/diff need modifications with false-node removal. Trivial cases and mk reduction/unique-table behavior are delegated. These helpers are trusted unless separately verified. AppendixB Algorithm1 printed swap atlines11–12 is valid for commutative and/or but reverses operands for noncommutative diff when var(a)>var(b), unless direction is tracked elsewhere. Example fields f<g, a=(g=1), b=(f=1): intended a minus b is g1∧f0, swapping yields f1∧g0. No direction adjustment is shown. This is a visually confirmed pseudocode issue, not an executed-library failure. Literal translation into a proof/spec requires preserving operand order. §4.1/AppendixB Algorithm4: update(δ,a) requires δ⇒a, where a is already atomized. Traverse corresponding intersecting paths, split old atoms by new label BDDs, globally replace old IDs with new atoms, repeat until no split remains. Updates can overwrite split[ap] during one traversal; repetition can discover further subdivisions, so one pass alone is insufficient. Finite Boolean domains permit eventual refinement, but no practical complexity bound supplied. AppendixB Algorithm4 printed updateRec has cases δ=true, equal variables, and var(δ)<var(a), but no var(δ)>var(a) case. Precondition δ⇒a alone does not rule that case out: let f<g, with g a two-bit field, a=(f=0)∨(g∈{0,1}), δ=(g=0). Then δ⇒a, a starts atf andδ atg; g0 requires splitting existing g-atom{0,1}, yet listing has no branch. Terminal false/a=true behavior and initialization of atomized δ are also implicit. This is a source-listing completeness question, not a claim observed code is unsound. §4.2: Per-field BDDs are logically isolated namespaces but share the same underlying BDD node table, unlike separate-manager parallel EPVerifier design. Edge maps keyed by successor and per-field unique tables must compare labels too and hash independently of edge iteration order. Library uses Java HashMap; mutable-key correctness, hash collisions, reference counts and cache validity are implementation obligations not covered by canonicity proof. §4.2: Reference-count GC frees NDDs before BDD GC and decreases BDD references for freed edge labels. False-node/edge omission means false is implicit complement; not/or/diff/exist must retain full Boolean semantics. Most false-edge atom labels are huge in tested data, so omission saves space; this is not permission to drop default traffic from semantic graph. Operation cache gives>10x on reported SRE comparison, with no full ablation table/methodology supplied. §5/Table2: About2000 JavaLOC NDD plus100LOC JavaBDD factory integration. Five adapted verifiers are AP Verifier, APT, APKeep, SRE and Batfish; KatraR is separate BDD reimplementation, not a sixth NDD integration. SRE requires205addedLOC due custom BDD traversal, so drop-in means similar API and modest edits rather than zero modifications. LOC excludes trivial string replacement and is not development time or proof effort. AppendixA.1: KatraR reimplements BDD algorithm and adds VXLAN support; authors say confirmed correctness on Katra-style synthetic data but provide no exhaustive differential-test or theorem. APKeep/SRE original sources and APVerifier/APT public code used, Batfish JavaBDD factory changed. Benchmark conclusions concern these versions/configurations, not arbitrary BDD packages, parallel implementations or all network verifiers. §6.1/AppendixA.2 discrepancy: Main setup calls Stanford16nodes/Purdue1646nodes; Table4 lists Stanford124/Purdue2159. Internet2 agrees9. Paper gives no explicit reconciliation (e.g., router versus element counts), so retain both as source-reported values. Seven VXLAN sets are synthetic according to production networks; three WAN/campus datasets are existing real-network configurations; fat trees are synthetic BGP. §6.2/Table3: Failures/timeouts >24h and memory/table exhaustion are censored outcomes, not measured successful runtimes. Update experiments for unfinished snapshots are plotted at maximum because prerequisite failed; do not calculate exact per-update speedups from those bars. Dataset1 snapshot prose reports>10x overKatraR and10^5x overAPKeep(BDD), with exponent read from PDF. Header 100x speed/memory is representative, not universal guarantee. §§6.2/6.3: Single-layer Stanford/Internet2 times and memory comparable; Purdue roughly3x faster andhalf memory. In Table6 forwarding stage NDD14.87s is slower thanBDD13.88, ACL7.04vs22.37, propertycheck.88vs46.11. Memory is JVM before/after difference, not peak resident/whole-process bound. Repetitions, run-to-run variance, confidence intervals and broad independent result-equivalence suite are not reported. §6.2: Purdue update experiment inserts each one of2707ACL rules into a state with allothers already installed. BDDmost<50ms with1%300–2000ms, NDDall<150ms in that sequence;7updates create>3000BDD atoms versus≤24newper-field atoms. Datacenter Table3 newlycreated≤15 is a different workload, not contradictory. Neither bound is universal for arbitrary edits. §6.4: Synthetic NAT/twice-NAT rules attached to randomly selected otherwise-unconnected ports, testing src/dstIP rewriting. BDD OOM at80NATrules, NDD completes2000. Claimed10x at4 and100x at40 are source-reported approximate plot comparisons. This does not prove stateful NAT allocation, checksums, full device semantics or concurrent transformations. §6.5: All-pairs reachability under1/2/3link failures in fat trees20/80/180/320/500nodes. SRE groups links evenly into8fields,16for500nodes; Batfish divides32bitdstIP into four8bitfields, with synthesized shared16bitprefix10.0... This field choice/topology impacts performance. Batfish does not encode links likeSRE and improvements are limited. Failure-scenario model is inherited, not a new distributed-routing convergence theorem. §6.6/Figure13: Increasing ACLs that matchallfivefields makes NDDtime/atoms grow while whole-headerBDD becomes smaller once all2707rules are correlated exact matches; demonstrates loss/reversal of benefit. AppendixA.9 keeps dstIP before linkbits and randomizes link order only, reports800–1200sBDD vs88sNDD (referenceBDD1108s); it is not exhaustive over all variable orderings/groupings. AppendicesA.6–A.10: >99%nodes≤10edges/all≤75 applies to80nodeSREfat tree k1–3. False-edge85%/>95% and30%/>2000atoms are observations, not complexity limits. NQueens row-as-field gives19.109vs12.417s atN12 (~1.54x); one general benchmark does not establish broad dominance. BDD arrays experiment80nodeSRE can have10^2/10^3/10^4arrays for k1/2/3 andtimesoutk3. AppendixF: Packet rewriting models logical-port match then existentially forgets rewritten/decapsulated field and intersects action for rewrite/encapsulation; matching result must be the packet set transformed, despite prose using pkt for successive values. Required match-before-forget ordering and consistent field mapping are semantic obligations. This is stateless header transformation, not verification of arbitrary programs. §§7–9: Authors acknowledge NDD is a form of symbolic automata and contribution is library engineering, not fundamental new automata theory. Multiple terminals, distributed/parallel library and more verifiers are future work. Table8 candidate tools not adapted are prospective applicability only. No Verus/Rust/TLA+/LLM or executable correctness proof supplied.
  • how much was read: most of it read
  • source
  • record id: ndd-a-decision-diagram-2025
• Neural model checking with invariants (2025)
  • title: Let a Neural Network Be Your Invariant
  • what: For hardware designs, one small neural network is trained to be both an inductive invariant (a set of states that contains all reachable states and is closed under steps; this proves safety) and a ranking function (a number that drops each time something bad could recur; this proves liveness). A solver then checks the network exactly, so a yes answer is a real proof. Training uses a constraint solver (MILP) rather than gradient descent.
  • number: 634-task benchmark: 11 SystemVerilog designs; 206 safety, 219 liveness, 209 safety+liveness tasks
  • number: solved: 190/206 safety (92%), 192/219 liveness (88%), 172/209 safety+liveness (82%)
  • number: nuXmv solved 82% of liveness and 74% of safety+liveness tasks; rIC3 50% and 61%; ABC 36% and 46%; prior neural method NMC’24 79% of liveness
  • number: pure liveness: faster than the best other tool on 66% of tasks, 10x faster on 46%
  • limits: Only finite-state hardware-style systems (no arrays or strings of parametric length, no procedure calls or dynamic data); the benchmark is the authors’ own, built from textbook-level designs, so results may not carry to other workloads; relies on sign-activation feed-forward networks.
  • how much was read: most of it read
  • source; notes: Let a Neural Network Be Your Invariant (2025)
  • record id: neural-model-checking-with-invariants-2025
• NeuralSAT (2025)
  • title: NeuralSAT: A High-Performance Verification Tool for Deep Neural Networks.
  • what: Presents NeuralSATCAV25, a DPLL(T) verifier for neural-network safety and robustness: Boolean activation-pattern search is coupled to numeric bounds and LP/MILP theory solving, conflict learning, restarts and parallel search. The paper explains switching branching heuristics after restarts, retained conflict clauses, MILP neuron stabilization, and parallel disjoint search subspaces. It supports acyclic FC/CNN/residual computation graphs and multiple activation/layer types. Non-ReLU neurons require repeated interval splits. New CAV25 engineering changes reduce memory for large output constraints and try direct MILP for small fully connected ReLU networks. Evaluation compares the new version with the competition version and tuned/default alpha-beta-CROWN; the paper provides detailed verified/falsified counts and configuration costs.
  • number: NeuralSATCAV25: 1,296 verified, 981 falsified; tuned alpha-beta-CROWN: 1,298 verified, 982 falsified
  • number: Cifar100 solved: 76.5% vs prior NeuralSAT 64.5%; Tiny ImageNet 91.0% vs 72.5%; Safe NLP 98.1% vs 94.3%
  • number: VNN-COMP24 NeuralSAT ranks second; setup property count conflicts with aggregate Table 2 counts
  • limits: Guarantees concern the encoded network and input/output property; they depend on the supported numeric abstractions and solvers. Unknown/timeout is explicitly inconclusive. The new experiments use 500 s selected to approximate competition scores on different hardware, so they are not the competition run itself. The setup states 2,058 properties, but Table 2 reports 1,296+981 solved cases for NeuralSATCAV25; these counts exceed the stated property total. Record preserves this inconsistency rather than inferring a denominator. No independent proof-certificate checking or end-to-end distributed-system evaluation is presented.
  • how much was read: most of it read
  • source
  • record id: neuralsat-2025
• Nola (2025)
  • title: Nola: Later-Free Ghost State for Verifying Termination in Iris
  • what: A logic in Rocq and Iris, with later-free ghost state (proof-only state without step-indexing), for proving termination and functional correctness of core-Rust programs. The prototype is RustHalt. Examples include Ackermann variants and traversal of a mutable list.
  • number: one axiom: uniqueness of identity proofs
  • number: no LOC, runtime or person-time reported
  • limits: RustHalt is a prototype. Its re-mechanization of RustHornBelt is incomplete. It is not production Rust.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: Nola
  • record id: nola-2025
• Okazaki Mieno DUALSP07 separable Alaoglu 2025 (2025)
  • title: Formalization of Separable Version of Banach-Alaoglu Theorem.
  • what: Okazaki and Mieno formalize weak-star sequential compactness of closed norm balls in the dual of a separable real Banach space. They develop dense-span convergence criteria with uniform norm bounds,define weak and weak-star continuity by finite test families,and prove that a weak-star continuous real function on a nonempty weak-star sequentially compact set is bounded and attains its extrema. The displayed main theorem is sequential,assumes completeness/separability,and allows every nonnegative ball radius. Records bounded dual sequences,dense generating sets,the closed-ball bar,all-radius and zero-radius scope,finite-test/domain quantifiers,restriction equivalences and extrema via infimum approximating subsequences. Distinguishes sequential compactness from arbitrary bounded-set compactness and from the unrestricted Banach–Alaoglu theorem.
  • limits: MML DUALSP07 version8.1.15 5.98.1507 identifies the article. Theorem8 assumes separable real Banach X,not merely an arbitrary normed X,0≤M,and X0 exactly the closed ball centered0 in DualSp X. The overbar on Ball is visible in the rendering but missing from raw extraction. It proves weak-star sequential compactness,not a new general nonseparable topological compactness theorem (pp.231–233). Introduction recalls full Banach–Alaoglu for normed-space dual unit balls and then loosely says “weak* sequential compactness of bounded sets.” The formal result is for closed balls. Arbitrary bounded subsets need not contain limits: already in the one-dimensional dual,the sequence1−1/(n+2) in(0,1) has only limit1,outside the set. This counterexample is reading inference,not a printed example;no general bounded-set compactness claim is adopted (pp.232–233). Theorems1/2 show convergent evaluation sequences preserve addition/scaling and their limits. Here v#x denotes the scalar sequence evaluating each dual vector at x. Theorem3 extends convergence from a set X0 to its algebraic linear span by induction on finite linear-combination support size. Raw extraction omits the support-cardinality bar (p.232). Theorem4 assumes Banach X,a dense span of X0,and a uniform bound on the dual norms;convergence of evaluations on X0 then implies weak-star convergence. Standard reading explanation: approximate anyx by a span element and use the uniform norm bound to control all evaluation errors;pointwise limits remain bounded linear. The English statement cites3 without expanding all approximation details (p.232). Theorem5 constructs a coefficient function with singleton support for any prescribed nonzero coefficient at a vector. Theorem6 says the whole vector space spans itself. Theorem7 characterizes weak-star convergence over Banach X by uniform norm boundedness plus convergence on some dense generating set. Its reverse implication uses the normative boundedness property of pointwise-convergent dual sequences;the imported proof was not audited (pp.232–233). Why the Banach premise matters for the boundedness direction (reading inference):on incomplete c00 with sup norm,F_n(x)=n x_n is continuous with norm n,yet for every finitely supported x it is eventually0. Thus pointwise convergence alone need not uniformly bound dual norms on an incomplete domain. This does not weaken the paper’s Banach-scoped criterion (Theorem7). Definition1 requires every sequence of X0 to have a weak-star convergent subsequence in DualSp X whose weak-star limit belongs to X0. Limit membership is part of the contract. Theorem8 covers every M≥0,including M=0 yielding{0};nonempty X0 is also explicit. Its proof is a single application of imported subsequence/convergence results and a ball fact,not a displayed diagonal extraction construction (p.233). Definitions2/3 define weak continuity for real partial functions on X:for each epsilon>0,choose delta>0 and a finite nonempty family of dual test functionals,so simultaneous small evaluations of x−x0 imply a small output difference. Point continuity requires x0∈dom f and testsx∈dom f;continuity on X0 requires X0⊆dom f and testsx∈X0 (pp.233–234). Definitions4/5 are the weak-star analogue for partial functions on DualSp X,with a finite nonempty family of test vectors from X and small |(x−x0)(y)|. This swaps the location of tests,not the function’s real-valued codomain. Theorem9/10 equate continuity on a subset with point continuity of the restricted function at each subset point,retaining the subset-of-domain premise (p.234). Theorems11/12 show weak/weak-star convergent input sequences yield ordinary convergent scalar output sequences under the corresponding point continuity and rng sequence⊆dom f. Finite tests allow one index after which every required evaluation bound holds. No converse from sequential continuity to full weak/weak-star continuity is established (pp.234–235). Theorem13 needs only real normed X,a nonempty weak-star sequentially compact S,and weak-star continuity of a real partial f on S. It concludes an absolute bound and actual maximum/minimum points in S. It does not require S itself to be a dual ball or X separable/Banach;those assumptions are one route to obtaining S via8 (p.235). The13sketch obtains a bounded nonempty scalar range and a maximum,then explicitly builds points within1/(n+1) of its infimum. A weak-star convergent subsequence has limit in S;continuity of f restricted to S makes its scalar limit equal the value at that point. The increasing subsequence index tends to infinity,so the approximation error vanishes. The last step is reading completion of the abbreviated sketch;no optimizer uniqueness or convergence of all minimizing sequences follows (p.235). The keywords mention orthonormal complement and minimum norm,but the displayed results give general weak-star continuous real-function extrema,not a specific norm minimization algorithm or projection theorem. No executable subsequence extractor,numerical case,rate,proof/check-time statistics,automation benchmark or checker transcript appears. Coq/Isabelle developments are references,not compared experimentally (all pages). All six pages,Introduction,twosections,fivedefinitions,13theorems/all clauses/sketches,footnote,acknowledgement,12references and received/accepted dates read. Quote text follows raw extraction,not a visual mathematical transcription;closed-ball/cardinality bars,restriction U+0016,≤ as¬,weak-star glyphs and fractions may differ. Both sheets/enlargedp233checked. No MML/dependency/checker execution,distributed protocol,Verus/Rust/TLA+ or LLM-agent experiment.
  • how much was read: most of it read
  • source
  • record id: okazaki-mieno-dualsp07-separable-alaoglu-2025-2025
• On Temporal Verification of Stateful P4 Programs (2025)
  • what: Defines P4LTL temporal properties over completed packet processings while retaining register state between packets. Models arbitrary input packets and changing table actions, optionally constrained by symbolic control-plane assumptions. Constructs a Büchi transaction product in which the specification automaton advances only at packet return, reducing violations to fair feasible traces. A proof sketch establishes the abstract correspondence; p4tv implements P4-to-Boogie translation, ghost instrumentation and an Ultimate Automizer extension. Evaluation checks19 temporal tasks on nine programs plus assertion checks/scaling, identifying two naturally occurring property failures and three injected defects. Records exact packet-boundary/old/free-variable semantics, register initialization and control-plane scope, product transitions/acceptance and proof-sketch qualifications, refinement algorithm and implementation trust, all Table2/3 cells, actual versus injected bug distinction, p4v approximation and assertion instrumentation, rapid scaling growth, and source specification/prose inconsistencies including vacuous liveness formula. Separates local P4xos checks from whole Paxos consensus verification.
  • limits: §3: Environment is a serial infinite loop of complete packet processings, persistent registers outside loop, nondeterministic packet fields each iteration and metadata initialized per P4-16. Table applications are nondeterministic action choices. This abstracts a single programmed switch; no proof of interleaved pipeline concurrency, simultaneous register read/modify/write races, multiple switches, queue dynamics or actual hardware refinement is supplied. Packet time is not wall-clock time. §§2/3/7/8: Register initialization is part of each verification configuration. P4NIS failing task9 leaves count unconstrained; successful invariant/assertion examples assume valid/zero initialization or add recovery logic. Persistent arbitrary initial values differ from independently re-randomizing registers every packet. Results under initialization assumptions do not show a real deployment meets those assumptions. §§3.2/4: CPI constrains table keys/actions/parameters, allows symbolic sets of entries and changes between packets. Empty CPI permits every modeled rule. Property checked is assumption implies desired property; it can hold if assumption is impossible. Authors do not report systematic assumption satisfiability/vacuity checks or prove a real controller always enforces CPI. Table2 needs CPI for tasks6,7,8,16 only. §4.1: Predicates are evaluated at packet boundaries: terms normally after processing; old(t) at ingress start after parsing; valid(h) records validity after parsing, hit/apply record occurrence during processing. old(key) and old(para) expressly arbitrary. fwd(t) is egress_spec==t syntactic sugar, so packet-output/architecture correspondence matters. Free variables describe nondeterministic values intended to cover all names; scope/stability must be preserved when translating specifications. §§4/6/7.2: Boundary-only temporal properties can miss transient within-packet violations. Assertion checks use a shadow variable initialized true per packet and capture the assertion at its program point, then check its boundary value. This is an explicit instrumentation workaround; the native P4LTL language still cannot directly observe arbitrary internal events. Correct instrumentation and all relevant visits are part of the trust boundary. §5.1: Product keeps program/specification location pairs, updates specification only on TR(s), uses assume true on other statements, and accepting locations require spec acceptance plus TE/TR boundary. Fair means Büchi acceptance (infinitely recurring accepting states), not automatic network-delivery, scheduler or adversary fairness. Liveness assumptions about infinitely many particular packets are written explicitly in the property. Infinite repeated packet processing is the base execution model. §5.1/Appendix A: Theorem5.1/A.1 is an abstract correspondence with an informal proof sketch, not a mechanized proof of P4 semantics, Boogie translation, instrumenter or executable checker. Projection deletes only true steps imposed by non-return transitions; a return transition labelled true must remain. Appendix switches the named if/only-if directions, and reverse construction retains TE(s)∨TR(s) while operational product advances spec on TR(s) only. A rigorous proof should distinguish statement/boundary indexing and establish infinitely many returns; no concrete tool-unsoundness counterexample claimed. §5.2/6: Algorithm1 reuses counterexample-guided refinement from cited fairness-modulo-theory work: select accepting trace, test feasibility, return genuine trace or remove a generalized set of infeasible traces, finish when none remain. No universal termination/runtime bound or translation correctness theorem provided. Trust includes P4/Boogie modeling, ghost instrumentation, LTL conversion, automata/refinement/feasibility engine and underlying reasoning tools. Code/proofs not run in this reading. §6: Prototype fully supports V1Model but limited TNA/PSA. Authors claim model transferable with more detailed P4 processing; future architecture support is not demonstrated full support. State explosion remains. About10000C++/JavaLOC and selected small benchmark programs do not establish production-scale coverage. §8 pp.228–229: Printed P4NIS liveness consequence is conjunction over ports i of GF(phi_sp -> fwd(i)), under GF(phi_sp). This is weaker than GF(phi_sp AND fwd(i)): infinitely many non-specific packets satisfy every implication regardless of forwarding. Alternating specific/non-specific packets with no fwd(i) satisfies the displayed formula while violating the natural-language goal. This is a semantic observation about the printed specification, not a run of artifact specifications. §4’s earlier liveness example has a different stronger shape. §8: NDN weak-until formula is activated only after a data packet was forwarded; it then forbids repeated data forwarding until a matching forwarded interest. It does not by itself forbid the first unsolicited data forward before that trigger, nor require eventual forwarding because W permits no future interest. Task6’s separate property covers interest-before-data. Universal free hash variable is not a proof of hash collision freedom or data-name authentication. §5.1 Figure5/§7.2 Table3: Figure5 prose says status becomes0 when hdr.cnt<0, while listing/automaton tests>0; record follows code when describing example. Table3 says acceptor stored round strictly less than current round, while adjoining prose uses≤ under zero initialization. Strict< would fail on equal zeros; cannot silently interchange these properties. Printed description/code discrepancies do not establish implementation bugs. §7: Dataset has nine manually selected programs and manually authored properties; artificial bugs inserted in CPI/task8 and code/tasks15,18. Natural failures tasks9,13 are author-reported findings without external maintainer confirmation/production exploit in paper. 14 verified tasks and five counterexamples are outcomes for specified models, not whole programs certified correct. §7.2: Temporal comparison with four prior tools is a support limitation discussion; measured assertion comparison runs bf4 and an approximate p4v implementation from bf4 work because original p4v unavailable. Vera limited user assertions and Aquila unavailable. Spurious counterexamples are relative to chosen persistent-register configuration, not evidence prior tools unsound for their broader nondeterministic model. p4tv is much slower but more precise for these stateful examples. §7.3: Program and specification scaling varied separately on P4NIS ports and acceptor index clauses. Curves grow rapidly; Figure8 about8600s near64ports and Figure9 about24000s near32clauses, approximate visual readings only. Easy false properties return inabout90s for CNT8/16, so falsification speed does not imply comparable proof scaling. No cross-product scalability, latency budget or large production network study. §7: Hardware i5-12400 2.50GHz/32GB; no repeat counts, confidence intervals, error bars or user specification effort measurements given. Main temporal tasks10–1260s; assertion acceptor-safe1701s, so21min maximum applies only Table2. P4xos acceptor/learner predicates are local state/order/vote checks, not an end-to-end Paxos agreement/liveness proof under crash/message-loss/reconfiguration. No Verus/Rust/TLA+ implementation theorem or LLM-agent evaluation. §7.1/Table2 task8: Printed task8 checks property6, data is forwarded only after a corresponding interest. Reported trace receives interest then drops data. A dropped data packet alone cannot violate this only-if safety condition. Preserve author-reported counterexample outcome, but it does not demonstrate violation of the printed property without more trace/specification detail. This inconsistency does not establish tool unsoundness.
  • how much was read: most of it read
  • source
  • record id: on-temporal-verification-of-2025
• On Verifying Secret Control Flow Elimination (2025)
  • what: CompCert extension implementing and verifying a partial control-flow linearization transformation for an acyclic, call-free, initially memory-free subset of C/RTL. Intermediate PredRTL keeps original and transformed program counters to prove semantic preservation via postdominance. A taint analysis and new influence-region proof establish secret-independent control-flow traces at PredRTL. Separates semantic preservation, operation-definedness and two-execution control-flow security. Uses detour postdominance to align live states; instructions on dummy detours execute but discard effects, requiring safe defined operands. Taint includes both explicit data dependence and writes in secret-controlled regions. Chain invariants prove uniform vertices cannot be dummy. Security transfer to lower IRs/assembly remains unproved, while a proposed memory relaxation has an explicit axiom and inconsistent location wording. Supplement findings: The publisher identifies the GitHub CompCert-ct repository as the supplementary source. Its tree at commit 2d1369a4888cff6fd5fd29f28a059e9cf72b1a08, which is also the publisher’s Software Heritage revision anchor, contains constant-time/Supplement.pdf. Only tree metadata and this two-page prose PDF were read. PDF metadata names Supplement to “On Verifying Secret Control Flow Elimination” and its running header gives D. Knothe and O. Bringmann. The recovered prose is the same-paper deferred proof supplement, not a different paper or an implementation audit. Appendix A restates main-paper Claim 23 as supplement Claim 1. It defines c1≼c2 by ipd(c1)∈ir+(c2) and c1≺c2 by ipd(c1)∈ir(c2). Lemma 2 compares intersecting regions; Lemma 3 gives either a strict first comparison, a nonincreasing chain, or a shorter intersection chain. Strong induction proves that an intersection chain with ipd(c1)<idx ipd(ck) has some i with ipd(c1)∈ir(ci): the nonincreasing case contradicts the topological order, and the shorter case recurses. Figure 1 shows the three postdominator configurations. The text identifies development theorem chain_containment; no mechanized proof was opened or checked. Appendix B states recursive unicdep(v) through control-dependence edges c→w where v postdominates w but does not postdominate c, alongside uni(v) excluding secret conditions whose strict influence regions contain v. Lemma 5 maps control dependence into an influence region. Lemma 6 finds an appropriate controlling edge for influence-region membership. Theorem 7 proves ∀v, uni(v) iff unicdep(v), in both directions by topological-index induction; text names uni_cdep_equivalent in the development and says it is not required for the main proof. This establishes the stated equivalence with the notion in Hack and Moll’s Theorem 4.1 for the original graph under the inherited acyclic-graph setting. It does not extend security to lower IRs/assembly, arbitrary memory, loops or calls.
  • limits: Current transformation requires a finite acyclic CFG, fixed topological vertex permutation and unique entry/exit, with no calls or memory instructions in the principal safe-operation account. Unique exit may be obtained by gotos to a shared return. Semantics is simplified in the exposition; paper does not claim production C coverage. PCFL assumes a secret_cond labeling and guarantees a topological transformed graph, one successor at each secret condition, and detour_spec: each original edge v→w maps to v→detour(v,w), with w postdominating the new target. Postdominance alone needs progress/definedness and acyclicity to justify reaching the original target. Dummy PredRTL states preserve architectural register values but still evaluate operations/conditions, which must succeed. Safe operations on typed defined arguments must return a defined value; all registers are initialized to typed defaults. Safety/condition/progress lemmas have only been proved for x86, according to §3.3. CompCert semantic preservation permits improvement of source undefined behavior; it is not exact equivalence for every undefined source execution. Taint selection is irrelevant to preservation provided PCFL/operation premises hold; security additionally needs correct secret labeling and taint invariants. Control-flow security compares runs of the same transformed function with equal public parameters and arbitrary secret parameters, preserving equal public registers and equal program-point traces at equal trace lengths. It addresses control decisions, not constant runtime of individual operations, cache/data-access behavior, microarchitecture or leakage from output values. PredRTL security is proved; §4.2 explicitly says the cube simulation carrying security to SelRTL/RTL is not written. §7 says integration through downstream CompCert assembly passes is future work. Semantic simulation alone does not establish preservation of this two-run security property. Predication implements live/dummy state in a fresh v_orig_reg plus scratch registers, updating with select. Selects are assumed constant-time in the motivating account; x86 builtins are used. Bit-mask lowering is a suggested alternative with 0/1 conditions, not a machine-level constant-time proof. Security transfer would need to treat introduced registers as secret. §5 critical-register relaxation is neither implemented nor proved. Its proof-of-concept Iload extension explicitly assumes axiomatically that any successful load returns a value other than Vundef. This qualification must accompany claims about memory support; no sound arbitrary-memory guarantee is established. §7 proposals for shadow memory, safe division, function calls, global taint and uniform-exit loops are future work. Secret-exit loops may diverge after linearization even when source terminates; authors say existing PCFL variants cannot generally satisfy their preservation goal without extra guarantees or weaker simulation. No execution-time overhead measurements, leakage attacks/tests, benchmark cases, production programs or proof-check run are reported here. ~9000addedlines is an author development-size report including four transformations and graph theory, not performance data. Reader did not audit Coq assumptions or execute artifacts.
  • how much was read: most of it read
  • source
  • record id: on-verifying-secret-control-2025
• P2FGPT (2025)
  • title: Constructing formal models of cryptographic protocols from Alice&Bob style specifications via LLM
  • what: A prompt-based pipeline that reads a security protocol written as ‘A -> B: message’ steps and writes the declarations part (types and functions) of a ProVerif model. ProVerif is a security-protocol checker. A checker step runs ProVerif’s parser, and a repair step re-prompts the LLM on syntax errors.
  • number: dataset: 4 ProVerif demo protocols cut into 53 + 25 + 14 + 14 = 106 sub-protocols
  • number: syntax-correct rate with GLM4.0: 65% (generator alone) to 82% (with repair step)
  • number: repair step helped GLM4.0 only; it made no difference for Llama3-8b and little for Qwen2.5-7b
  • number: content score (BLEU/F1) with GLM4.0: BLEU 0.34 to 0.39, F1 0.58 to 0.62 with repair; Qwen2.5-7b BLEU 0.61, F1 0.60
  • limits: Generates only declarations, not the protocol steps or the security goals the user cares about; no check that the model says what the protocol says, only that it parses and looks like a reference text. Prompts were tuned by hand on GLM4.0 and transfer poorly to other models.
  • how much was read: most of it read
  • source; notes: P2FGPT, Alice&Bob to ProVerif (2025)
  • record id: p2fgpt-2025
• PBES evidence generation (2025)
  • title: Efficient Evidence Generation for Modal µ-Calculus Model Checking
  • what: Introduces a two-step PBES evidence method: solve the core PBES without evidence metadata, then use its proof graph/truth assignment to simplify solving the evidence-annotated PBES; proves correctness and implements explicit/symbolic-hybrid mCRL2 solvers. Defines LPE, modal µ-calculus, PBES proof/refutation graphs and evidence variables. The transformation removes superfluous evidence information, combines the core proof graph with evidence equations, and proves every resulting proof graph is valid for the original PBES. Explicit solver computes on demand; hybrid solver solves core symbolically then evidence PBES explicitly. Evaluation covers witness1000, SMS, WMS, IEEE 1394, ERTMS HL3, MLV, onebit and Hesselink models.
  • number: explicit expl comparable to n-expl; lower for small evidence, overhead for large evidence
  • number: symbolic hybrid symb outperforms n-symb and enables previously infeasible evidence
  • number: WMS symbolic evidence in 28–56 s versus original out-of-memory
  • number: MLV symbolic evidence ~1565–1827 s with trillion-scale relevancy graphs
  • limits: Evidence solving can still explore most/all state space when witnesses are large; explicit two-step method may double exploration. Symbolic implementation requires standard recursive form and over-approximated proof graph. Experiments use mCRL2 models, 64GB/1-hour limits and only single-node model-checking workflows; no distributed-system network semantics are introduced.
  • how much was read: most of it read
  • record id: pbes-evidence-generation-2025
• Perun PATL rocket verification (2025)
  • title: Formal Verification of Probabilistic Multi-Agent Systems for Ballistic Rocket Flight Using Probabilistic Alternating-Time Temporal Logic
  • what: Models SpaceForest’s Perun ballistic rocket as probabilistic multi-agent/state-transition models and verifies strategic safety properties in ATL/PATL using STV across deterministic, probabilistic perfect-information, and probabilistic imperfect-information models. The report defines asynchronous MAS and objective/subjective PATL semantics, builds transition probabilities by counting discretized historical telemetry plus simulator trajectories, and classifies states by time-aligned position/velocity/attitude deviation. Three models use 1.0, 0.5, 0.2 and 0.1 second precisions; properties cover eventual good finish, safe engine disengagement, and finish in a good or disengaged state. Deterministic Model A verifies all properties at every precision, whereas probabilistic Models B/C lose high-probability guarantees and time out as precision increases. Model C adds noisy integer-only observations, exposing imperfect-information cost.
  • number: state counts 1,102/2,209/5,602/11,210
  • number: probability thresholds 0.25, 0.5, 0.9
  • number: Model B phi1 timeout at 0.1 s precision
  • number: Model C phi2 p=.25 TRUE and p=.9 FALSE
  • limits: Finite iCGS/state model; memoryless uniform strategies and PATL objective/subjective semantics; transition probabilities are empirical frequencies from available flights/simulation and depend on discretization and chosen thresholds (example good threshold about 500 m equivalent deviation). Simulator validation and telemetry coverage are asserted but no uncertainty intervals or independent flight replication are reported. STV runs on one 64 GB Ryzen machine with four-hour timeout; high-fidelity finer models time out.
  • how much was read: most of it read
  • record id: perun-patl-rocket-verification-2025
• PGo issue 259 (2025)
  • title: Parsing Error Defaulting to CHOOSE
  • what: An open PGo issue reports that a malformed TLA+ operator produces a misleading parser error saying CHOOSE was expected. The issue includes a minimal module and the parser’s location and message.
  • limits: This is a parser usability bug report; it does not show a wrong verification result or a distributed implementation failure.
  • how much was read: most of it read
  • source
  • record id: pgo-issue-259-2025
• POPACheck: A Model Checker for Probabilistic Pushdown Automata (2025)
  • what: POPACheck translates finite-data recursive probabilistic MiniProb programs to probabilistic operator precedence automata and checks LTL plus a stack-aware POTL fragment. A support-chain semi-algorithm distinguishes positive nontermination from positively almost-sure termination using numerical upper bounds and expected-runtime certificates. Separated formula automata avoid determinization; experiments cover nested conditioning, games, branching populations and finite-array randomized search. Explains why numerical approximations alone cannot decide exact probability one, how finite expected time is stronger than almost-sure termination, why conditioned support-chain edges need probability ratios, and how stack-aware properties differ from ordinary trace order. Preserves finite data versus unbounded stack, incomplete decisions, all measured rows, two quantitative timeouts, approximate probabilities, formula/code mismatches and absent cross-tool comparison.
  • limits: §§1–2,4: pOPA is a subclass of probabilistic pushdown automata with finite control states and label-driven stack actions, while its induced Markov chain has unbounded stack configurations. MiniProb integers have a chosen finite bit width and arrays fixed size. Arbitrary chosen width does not mean unbounded integer values in a single model. Recursion/nested query depth can be unbounded; this is not arbitrary unbounded array or concurrent distributed-state verification. §2.1/Definition1: precedence matrix is total over labels; bottom symbol # yields to all program labels, so first move pushes. Push records current state/label, shift changes the top label, pop depends on current and saved state. The extra pop-label condition preserves precedence compatibility. Precedence relations are not assumed reflexive/transitive orders. These restrictions enable synchronized stack-aware formula products; do not replace the model by unrestricted pPDA and assume identical algorithms. §§1–2: observe failure rejects and restarts the current query. obs unwinds only to nearest qry boundary, preserving outer queries, so nested posterior sampling is modeled. A conditioning event of zero probability gives an ill-defined query, not an ordinary normalized posterior. Markov probabilities model specified sampling distributions; no adversarial scheduler or Markov decision-process strategy synthesis is evaluated. §2.2: supported logic is LTL and POTL_fχ, not all POTL. Atomic propositions include program events/function names and finite-variable arithmetic tests. Directional next and chain-future/until operators move through procedure frames. Call-return/postcondition matching can be context-free and beyond LTL. Full formal semantics/proofs are referred to [10,40], not fully redeveloped or mechanized here. §3.1: termination triple probabilities are least nonnegative fixed-point solutions of a monotone nonlinear polynomial system. Nontermination at node c is 1 minus the sum of termination outcomes. Support-chain states include only c with strictly positive nontermination; division by that positive quantity conditions push/shift/support probabilities. Support edges summarize finite nested runs. This chain captures limit behavior with the intended probabilistic construction, not a claim that all time-indexed observations can be erased without the formula-aware machinery. §3.1: upper bounds on termination give lower bounds on nontermination. A positive lower bound includes the node. Otherwise the algorithm tries a stronger certificate: stack symbol popped with probability one in finite expected time (PAST). A valid linear expected-time solution implies almost-sure termination (AST), excluding the node. Failure to prove PAST is inconclusive, not nontermination. AST with infinite expected time can fail this stronger test; no total decision procedure is claimed. §3.1: zero variables are removed through value iteration; decomposed Newton computes lower bounds. Upper bounds either satisfy lower<=v<=lower+epsilon and v>=f(v) in Z3, or come from optimistic value iteration initialized at the lower bound. SCC decomposition solves bottom-up. Exact epsilon, stopping tolerance, rational/floating implementation details and independent certificate validation protocol are not supplied in this tool paper, so printed approximate probabilities are not exact certified decimal values. §3.2: separated Büchi/omega-operator-precedence automata have disjoint languages from distinct starting states, allowing synchronized products without determinization. Qualitative checks analyze product SCCs; quantitative checks solve additional support-probability equations with OVI. Theoretical claims: singly exponential time in formula size, polynomial space in pOPA size for qualitative theory, and EXPSPACE for quantitative model checking, citing [40]. These are not guarantees that the implemented semi-algorithm terminates on every valid input. §4: function parameters pass by value or value-result; actual value-result arguments must be variable identifiers. Boolean operators treat zero as false. Bernoulli(e1,e2) has success probability e1/e2; Uniform(e1,e2) is stated half-open [e1,e2). Distributions need valid parameters; general C/Rust overflow, pointer aliasing and undefined behavior are not analyzed. Fig6 supports while, recursion, query and observe, not arbitrary source-language execution. §5: benchmark has three nested-query programs and 16 distinct Q formulas, yielding 20 program/formula rows, plus Sherwood with four S formulas and varied finite sizes. This is a demonstration suite, not a random production corpus. AMD 8-core 4.5GHz,64GB,Ubuntu24.04; one-hour timeout. No timing variance, independent replay or directly measured PRISM/Storm/PReMo/Pray comparison. PReMo/Pray are excluded because they only compute termination probabilities, which OVI handles below one second here. §5/Table3: all three OVI upper-bound runs are below one second, but Z3 times out on Schelling/Virus. Thus the blanket below-one-second prose concerns the chosen successful method, not every attempted solver. NT equation counts are those with circular dependency after SCC propagation, not all raw equations. Maximum SCC size, total equations and program control-state count measure different costs. §5/Table4: all 20 qualitative queries finish: nine hold almost surely and 11 do not. Of those 11, nine obtain approximate probabilities and Virus Q6/Q7 time out quantitatively; non-AS qualitative result does not give an exact probability or concrete counterexample probability by itself. A probability-one property may still admit measure-zero violating runs; do not equate AS with all-run deterministic correctness. §5/Schelling: two agents cannot communicate but know each other’s preferences perfectly. p controls recursion and its distribution is fixed to make the model AST. This is a sequential probabilistic model of recursive reasoning, not measured LLM behavior or a distributed protocol with message failures. Printed prose misidentifies Q13 as first Bob rejection even though Table1 Q13 mentions Alice and negated rejection; it also calls Q14 first Alice acceptance, while Table1 Q14 is a tic-tac-toe return-coordinate formula. Retain exact table/formula identifiers rather than adopting these prose descriptions. §5/Sherwood: K element bits in1..4 and M array size in1..7 are investigated; Figure10 has timeouts as state space grows, so range is not a universal completed result. Table2 gives seven selected quantitative S3 instances. Uniform divergence is assumed when left>right. Fig1 calls Uniform(left,right), whereas the language definition states exclusive upper endpoint; endpoint semantics must be checked before reusing this as a conventional inclusive-pivot algorithm. No universal all-K/M correctness theorem is proved by these finite experiments. §5/Table1: S1/S2 assert sorted-array partial return correctness for value present/absent. S3/S4 guard left<right and require a downward-compatible next step followed by ordinary eventuality of a recursive call, as ○ᵈ◇(call ∧ B). Prose p116 instead writes left<=right. Table2 probability one when M1 for S3 is consistent with its false strict guard. This is vacuous implication satisfaction, not proof that a singleton input recurses. The reported S1/S2/S4 AS behavior remains model/finite-instance scoped. §6: suggestion that determinization-based methods would not work follows from predicted formula blowup; no direct determinization experiment is reported. Lower-expressivity subclasses and more efficient algorithms are future work. Reusable/Available artifact badges appear on the PDF, but no artifact evaluation report, current build or repository commit was independently checked. No implementation proof, Verus/Rust/TLA+ or LLM-generated specification/proof experiment.
  • how much was read: most of it read
  • source
  • record id: popacheck-a-model-checker-2025
• Position: Formal Mathematical Reasoning—A New Frontier in AI (2025)
  • what: A position paper arguing that formal mathematics should complement language-model reasoning to supply checked reasoning steps, automatic training feedback and a path toward verified software/hardware generation. It organizes research challenges around data scarcity, faithful autoformalization, proof search, abstraction, retrieval, specification trust and proof maintenance. Its main original contribution is an agenda with separate levels for autoformalization, theorem proving, verified natural-language reasoning and verified system generation; it supplies no new proving algorithm, experiment or formal theorem. The paper separates producing a proof of a fixed formal statement from ensuring that the statement captures human intent. It proposes collecting human repairs and synchronizing informal/formal pairs, using semantic rather than string-match autoformalization metrics, comparing provers under explicit hardware/time budgets, growing libraries through useful subgoals and abstractions, and evaluating agents on projects and change histories. Software verification receives a distinct treatment: bespoke datatypes, repetitive case splits, large evolving codebases and specification management differ from isolated mathematical theorem proving. It discusses an alternative neural-only view and identifies self-verification and easy-to-hard generalization as unresolved prerequisites rather than demonstrated impossibilities.
  • limits: This is an explicitly selective position paper, not a systematic survey or controlled comparison. The claim that formal reasoning is indispensable and forecasts of lower verification cost are author positions, not results established by experiments in this paper. Formal proof checking establishes the exact encoded claim relative to the proof system, its assumptions and trusted implementation. The paper itself makes fidelity of generated specifications a key open problem; checker acceptance alone does not establish developer intent or correctness of the translation. The milestone levels are proposed organizing categories, with no validated thresholds, measured reliability requirements, human-cost study or proof that capability rises in the stated order. Theorem-proving level 2 explicitly includes human-built tactics without machine learning. Numbers about NuminaMath, Proof Pile, AlphaProof and seL4 are cited contextual examples, not new measurements. IMO 2025 claims are explicitly attributed to blogs/X without further details, and no such external evidence was fetched in this reading. The discussion of current systems is tied to the supplied 2025 proceedings version. Its model capability and benchmark-availability claims are historical author assessments, not a current exhaustive inventory. Arguments that informal scaling alone cannot resolve advanced mathematics and that neural-only self-verification remains weak draw on prior work; no impossibility theorem or decisive experiment rules out future neural-only systems. Software, hardware and mathematical verification are discussed broadly. Verus and AutoVerus appear as examples, but Rust memory/concurrency semantics, TLA+ specifications, distributed protocols and their fault assumptions are not evaluated. Formalizing or solving selected substeps while interleaving natural language does not by itself certify every unformalized claim or the full natural-language conclusion. This boundary follows from which parts are actually checked, not a new end-to-end guarantee shown here.
  • how much was read: most of it read
  • record id: position-formal-mathematical-reasoning-2025
• PoWER (2025)
  • title: PoWER Never Corrupts: Tool-Agnostic Verification of Crash Consistency and Corruption Detection
  • what: PoWER encodes crash consistency as a precondition on each storage write: every durable state introduced by a partial write must be permitted by a ghost permission. Prophecy-based storage views and recovery-equivalent writes simplify proofs. A bounded-bit corruption model and an eight-byte corruption-detecting Boolean support atomic data/checksum updates. CapybaraKV in Verus and CapybaraNS in Dafny demonstrate the method, with coarse concurrent KV variants and performance comparisons. Records exact permission quantification, prophecy flush semantics, state versus transition and blanket versus single-use permissions, all four write strategies and concurrency restrictions. Includes correspondence-proof trust boundaries, CRC corruption bounds, Tick-Tock counterexample and CDB protocol, full type/LOC/startup/resource tables, all workload setups and adverse performance cases. Separates conditional detection from arbitrary-media-error recovery and reported proofs from independent proof replay.
  • number: CapybaraKV 5,531 executable / 14,255 spec+proof / 5,244 trusted lines; CapybaraNS 278 / 673 / 414
  • number: verification 54 s single-thread, 23 s eight-thread for KV, 12 s for NS
  • number: Table 2 KV total: 5244 trusted, 14255 spec/proof, 5531 implementation lines; notary 414/673/278
  • limits: Core technique requires Hoare pre/postconditions, ghost variables and quantification over crash states. Each asynchronous write requires all chunk-wise old/new durable outcomes to satisfy its permission; executable annotations erase. Soundness depends on every actual storage mutation using the controlled API, correctness of the storage model and a meaningful allowed-recovery predicate. A permission that allows all states proves no useful crash property. Natural storage semantics distinguish readable last-written bytes from outstanding writes. Atomic persistence chunks can survive independently until flush. The prophecy model instead stores read_state and one prophesized durable_state; write updates all readable bytes and chooses a subset of chunk subwrites for durable state. Flush constrains these two states to agree without changing either in the ghost model. This is a logical modeling device, not a runtime ability to predict crash outcomes. The authors report a Verus proof implementing the prophecy model over a natural model using prophecy variables. The PoWER-to-Crash-Hoare-logic proof in Rocq/Perennial is metalogical and trusts a translation of PoWER semantics, since PoWER was not implemented in Rocq. The Verus correspondence to crash invariants is entirely machine-checked within Verus. Formal theorem bodies are in artifacts; this reading examined paper explanations only. Crash states can be specified through rec(bytes), commonly allowing pre-operation or post-operation abstract state. Transition permissions instead authorize pairs of durable states. Blanket permissions cover arbitrary recovery-equivalent transitions; single-use permissions authorize a mutating transition once and are consumed or invalidated. A blanket permission can manufacture single-use permissions only for its allowed transitions. Initial recoverability and all permission constructions remain proof obligations. Tentative writes change only addresses irrelevant to rec and need no value-specific proof. Committing writes are a single aligned atomic chunk, typically after flushing tentative data, so only old/new durable states matter. Recovery writes rely on idempotent recovery that overwrites all possibly torn bytes on retry. In-place writes can use weaker specifications with many allowed outcomes, but the authors have no verified examples or helper-library support for that category. Atomic PoWER adds durable ghost resources owned by atomic invariants, proof callbacks and completion objects for consumed transition permissions. Completions witness an issued/applied operation even if another thread later changes its key. This extension needs concurrency facilities beyond the minimal core features; a tool-agnostic core does not imply arbitrary concurrent proofs in plain sequential Dafny. Concurrency allows multiple readers, or disjoint statically allocated storage regions with exclusive access during writes. It excludes read/write or write/write overlap within one region because callers must know its current logical state. Sharded wrappers establish linearizable individual create/read/update/delete/list operations, not cross-shard transactions. The reusable inner implementation still supplies a transactional API to wrappers. Corruption is modeled by a fixed device bitmask with at most c potentially faulty physical bits. A zero mask bit reads correctly; a marked bit can return either value independently on each read. The trusted CRC axiom distinguishes byte strings at Hamming distance 1 through c. Current ECMA CRC-64 implementation uses c=1 for arbitrary lengths; the cited c=3 for data shorter than about1 GiB is not exploited. Detection is conditional on that device-wide bound, not a guarantee against arbitrary bursts, malicious rewrites, rollback or unbounded media failure. Reader qualification: integrity proofs must cover corrupted data and checksum bytes, repeated/noncontiguous address mappings, and the chosen CDB codeword distance under the same physical-bit bound. The paper reports verified checking and a trusted CRC library; it does not derive an unrestricted cryptographic collision-resistance guarantee. Detecting a mismatch permits reporting corruption, not necessarily repairing damage or preserving availability. Tick-Tock’s old-checksum/new-data mismatch after a crash is not a small-bit corruption event relative to the old data. CRC(D0) can collide with CRC(D1-prime) even if D1-prime differs by only bounded media corruption from D1, because D0 versus D1-prime may differ arbitrarily. The paper gives a logical counterexample to the algorithm in its model, not an independently reproduced NOVA-Fortis artifact exploit. CDB stores one of two known eight-byte values CRC(0) and CRC(1), with aligned crash atomicity and sufficient corruption separation assumed/proved for the primitive. Two data/CRC slots accompany it. Write the inactive slot and checksum, flush, atomically switch CDB, flush. The selector identifies the committed slot independently of potentially matching stale checksums. This costs extra storage and flushes; it does not remove hardware atomicity assumptions. CapybaraKV values contain a fixed-size item and a list of fixed-size elements, with fixed-size keys. The abstract state has on-abort and on-commit maps. Ordinary operations affect the latter; abort restores it from the former; commit publishes it to the former. A crash during commit may commit or abort, while other uncommitted operations abort. Reads within a transaction see tentative operations, so visible results need not already be durable. Implementation uses main/item/list tables, per-field CRCs, validity CDBs, copy-on-write updates and a physical redo journal. Journal commit writes a CRC of pending entries then flips a CDB; replay installs operations and clears the journal. Volatile key index and free lists rebuild on startup. Correctness depends on recovery traversal, bounds, allocation and CRC checks, not merely the commit selector. Capacity is statically allocated at initialization with maximum key/item/list counts and sizes. No dynamic resizing, partial-value updates or range queries. All keys reside in a volatile Rust HashMap and must be indexed again at startup. Designed target is small records on tens of GiB of dedicated PM in a cloud-storage service. Prototype integration into an Azure Rust system is reported, not evidence of production deployment of all verified variants. Trusted pmcopy bridges Verus and compiler-generated representations. It requires repr(C) and derive(PmCopy), implements PmSafe/PmSized/Clone/PartialEq, generates specifications and static layout assertions checked by Rust. PmSafe includes numeric types, bool and char; composites require safe fields. Casts still require correct layout, valid discriminants/values and prior corruption checks. Compiler assertions caught a u128/i128 layout change; this is a concrete consistency check, not a proof of the macro or compiler. CapybaraNS stores a 64-bit logical timestamp and last hash. Advance increments and atomically persists them using CDB; Sign signs their binding. A trusted C# wrapper supplies CRCs, cryptography and serialization. This paper does not supply a complete distributed-notary protocol, a cryptographic implementation proof, remote attestation argument or availability theorem. Counter overflow handling and full security assumptions require the external specification. PM model permits independent eight-byte chunk reorderings until flush; backend write uses PMDK non-temporal stores or mov followed by clflushopt/clwb, and flush uses sfence. It deliberately overapproximates strongly ordered clflush and same-cache-line hardware ordering, including potential compiler reorderings. Eight-byte alignment/atomicity, backend calls and hardware behavior remain trusted. PoWER can use other models; current model is not a universal storage-device specification. Table 2 counts unverified pmcopy source but not its generated code. KV trusted count includes mock byte-vector PM plus Windows/Linux backends, concurrency and sharding wrappers. Trusted versus proved LOC therefore should not be interpreted as executable core size alone. Reported proof/code ratios are2.6 KV and2.4 NS; LOC is not a measure of specification adequacy. KV design, implementation and verification took about1.5 years by a team of experts and newcomers; headcount and person-time are unspecified. After that experience, porting the PM spec to Dafny took under an hour, porting helper lemmas about an hour, and implementing/verifying NS about nine hours after its spec and C# wrapper were already written. This is author experience, not a controlled productivity comparison. On Linux6.9.3 with i7-11850H eight physical cores and32 GB RAM, KV verifies in54s with one thread or23s with eight; NS takes12s with one. Appendix expects KV1–2min serial or15–40s parallel on other hardware. Paper gives no independent proof replay in this reading and no controlled comparison against alternative verification approaches. Performance setup is a two-socket32-core machine with128 GB RAM and one128 GB Optane DC PMM, Debian Trixie/Linux6.12.10. All KV runs use the sharded variant with one shard per thread. Redis client/server run together but retain communication overhead; RocksDB uses memory-mapped files and non-temporal log appends; Viper preallocates enough capacity except in utilization measurement. Different supported features and durability architectures affect comparison. Microbenchmarks use25M records,64-byte keys,1 KiB values and8-byte list elements. Append adds16 elements per record in random order; read-list returns the entire list; trim removes it. Other operations run once per record. Figure2 uses logarithmic latency axes and95% confidence intervals. KV matches or beats RocksDB but Viper is faster on several operations, including most writes; Redis is slowest. Windows/Azure20 GiB battery-backed DRAM tests run only KV, with up to2× improvement; other systems lack Windows support. YCSB uses15M keys,24-byte keys,1140-byte values and five executions per system. RunE range queries are omitted and RunA/RunB partial updates become full-value updates. X is uniform75% updates,5% read-modify-write and20% reads; Y/Z use50/50 or5/95 read/update with90% accesses to10% records. LoadE is omitted only from Figure4 as similar to LoadA. These modified workloads must not be called an unmodified full YCSB suite. At one thread KV is broadly comparable to Viper and often slightly slower. At16 threads it substantially leads Viper on update/read-heavy run phases but not every load phase; the broad prose claim of outperforming other systems needs this figure-level qualification. Viper is tested on one non-interleaved NVDIMM despite optimizations for interleaved PM. Authors attribute scaling issues partly to CCEH semaphore costs nearly doubling1→16 threads. This is reported profiling attribution, not isolated causal proof. Figure 4 read-heavy B/C/D scale better than write-heavy phases. Approximate 16-thread throughput is RunC 3.5 Mops/s, RunB/RunD 3.0, RunA 1.25, LoadA 0.4, RunF 1.1, RunX 0.9, RunY 1.2, RunZ 0.8 and LoadX 0.4. Values are visual estimates. Hash sharding distributes hot keys across shards, so this does not demonstrate performance under all accesses contending on one shard. Full-instance startup fills each store to its own out-of-space point with64-byte keys/1 KiB values; capacities and record counts can therefore differ. KV/Viper startup is seconds because volatile indexes rebuild, whereas RocksDB is milliseconds. Full Redis startup fails with memory allocation error. Table3 utilization instead uses YCSB LoadA and optimally provisions KV at18 GiB with no further growth. Comparing those startup/resource numbers requires keeping these distinct experiments separate. Artifact branch osdi25-artifact and Zenodo15306499 include implementations, scripts and proof guidance; CHL formalization lives in the Perennial repository rather than being bundled. Exact performance reproduction requires at least128 GB Optane, with128 GB DRAM/32 cores recommended; emulation can check workflow but changes performance. Default artifact experiments are smaller than paper runs. No artifact or external proof was executed here; no LLM, TLA+ model-checking or distributed network liveness experiment appears.
  • how much was read: most of it read
  • source; notes: PoWER Never Corrupts: Tool-Agnostic Verification of Crash Consistency
  • record id: power-2025
• Program Logics à la Carte (2025)
  • what: It builds program logics in Coq by composing reusable descriptions of effects that are already proved. The effects are shared memory, scheduling, nondeterminism, failure and termination. It reconstructs the HeapLang and Islaris logics this way.
  • number: Islaris semantics from about 130 to about 90 lines; proof about 270 lines instead of about 450
  • number: Islaris semantic definition: around 130 LOC down to around 90 LOC
  • number: Proof size: around 270 LOC instead of around 450 LOC
  • number: No person-hours or benchmark pass rate reported
  • limits: It reuses verified components and does not infer anything. Program proofs are still written by humans. Three axioms are declared. No new assembly programs were verified.
  • how much was read: most of it read
  • source; notes: Program Logics à la Carte; notes: Program Logics à la Carte; notes: Concrete problem records
  • record id: program-logics-a-la-2025
• Proof-Producing DNN Abstraction (2025)
  • title: Abstraction-Based Proof Production in Formal Verification of Neural Networks
  • what: Introduces a modular framework that combines a proof-producing verifier for an abstract neural network with a formal proof that the abstraction over-approximates the original network. The paper gives proof rules for CORA neuron-merging abstractions, an abstraction-refinement algorithm that attempts proof generation after UNSAT, and a checker design that validates abstraction witnesses without reconstructing the abstract network. It explains how Marabou proofs can serve as the abstract-network component.
  • number: No empirical benchmark reported
  • number: Future evaluation targets proof size, verification time and proof-checking time
  • number: Proof construction is modular in two components: abstraction soundness and abstract-network verification
  • limits: The work is explicitly preliminary and has no reported implementation/evaluation on real-world benchmarks. Proof size depends on the number of abstraction splits; the framework requires a proof-producing verifier and a proof rule for each abstraction. Future work is implementation and measurement of proof, verification, and checking costs.
  • how much was read: most of it read
  • record id: proof-producing-dnn-abstraction-2025
• Prover Agent (2025)
  • title: Prover agent: An agent-based framework for formal mathematical proofs
  • what: A loop around three parts: a general reasoning LLM that writes an informal proof, a small prover model that turns it into Lean code, and Lean that checks it and returns errors. If the direct attempt fails, the reasoner proposes helper lemmas (special cases, facts from the assumptions), each is proved separately, and the proved lemmas are fed back for a final proof. No training; it is a prompt-and-control pipeline.
  • number: MiniF2F-test: 88.1% pass rate with a sample budget of 260 per problem
  • number: PutnamBench: 25 of 659 problems solved with budget 110 (best prior small-model entry in its table: 22 at 128 samples)
  • number: Goedel-Prover-V2-8B alone: 85.2% at 256 samples on MiniF2F
  • number: ablation: starting refinement from 1 or 10 first drafts is much worse than from the best of 50 drafts (fewest Lean errors)
  • limits: Mathematics only; formal statements come from humans. ‘Small model’ claims compare only against models of similar size. The theory (Sec 4, App C) rests on assumptions such as independent subgoal success and that given lemmas do not hurt the model. Extension to software verification is stated as future work, not tested.
  • how much was read: most of it read
  • source; notes: Prover Agent (2025)
  • record id: prover-agent-2025
• PyEuclid CAV 2025 (2025)
  • title: PyEuclid: A Versatile Formal Plane Geometry System in Python
  • what: Authors present PyEuclid, combining a synthetic deductive database (DD) with a Sympy algebraic system (AS), Z3 rule-instantiation enumeration and Gurobi proof-support minimization. They report 202/231 geometry proofs and 529/599 calculation tasks before manual benchmark corrections, 567/599 after correction. Geometry formalization includes diagram-derived assumptions; concise proof output and prospective LLM applications are separate from a machine-checked soundness theorem. Records diagram sampling and assumptions, three linear systems plus nonlinear subset solving, interactive auxiliary points, actual transposed support-minimization formula, Big-M qualifications, changed benchmark data, inconsistent five/six additional-case counts, printed midpoint-rule discrepancy, concrete proof comparisons and untested LLM prospects.
  • limits: Language has 43 metric/diagrammatic relations with points as basic entities. Metric relations include quantitative geometry, algebraic values, perpendicularity/parallelism/concyclicity. Diagrammatic relations include SameSide, OppositeSide and Between. Four input paths: precise coordinates with numerical extraction; inaccurate/absent coordinates with manual diagrammatic specification or correction; metric-only descriptions translated by enumerative rule search to ruler-and-compass constructions and sampled Matplotlib diagrams; explicit construction steps using same generation. Coordinate-free reasoning follows extracted assumptions, rather than removing numerical diagram extraction from the whole process (§2.1–2.2, Table 1). Generated diagrams are nondeterministic: one construction can yield different valid diagrammatic relations. Therefore results are conditional on supplied/extracted diagrammatic conditions, not a demonstrated universal equivalence across all configurations satisfying metric input alone. Paper does not provide a comprehensive adequacy/soundness audit of numerical extraction, degeneracy handling or branch selection. This is a reader scope observation, not evidence that the implementation is globally unsound (§2.2). DD rule conditions may be metric or diagrammatic; conclusions are metric. Cyclic-angle rule splits into supplementary angles for opposite sides versus equal angles for same side. Z3 enumerates matching rule instantiations, with point order such as A<B, P<Q, A<P removing equivalent permutations. Basic/intuitive definitions, standard linear/log-linear rules and complex nonlinear/trigonometric rules are distinguished. Users may customize rule subsets (§2.3, Appendix A). AS uses Sympy. Angles give one linear system; lengths give additive linear equations and logarithmic ratio equations, making three linear systems. Gaussian elimination simplifies/solves each. Mixed equations substitute these simplifications, solve single-variable cases or search subsets with at least as many equations as variables. Equation count alone does not establish solvability, uniqueness or completeness. Log lengths require positive/nondegenerate domains; paper does not prove comprehensive handling of those conditions or nonlinear solution branches (§2.4). Automatic mode saturates intuitive deductions, applies remaining standard/complex rules, caches new facts, runs AS, feeds resulting metric facts back to DD, repeats to goal. Interactive mode lets user add auxiliary points by construction rules, supply step conditions/conclusions, and optionally specify rule/diagrammatic justifications; DD/AS fills missing justifications then updates state. This describes user-directed auxiliary construction, not autonomous auxiliary-point search (§2.5–2.6). Every derived metric fact has dependency information: DD metric premises and rule; AS substituted/complex equations. Linear support optimization actually prints min ||X||_0 subject to [A|B]^T X=E, with augmented matrix m×(n+1), X∈R^m, E∈R^(n+1). Superscript transpose is visible in PDF p.8 but missing from flow extraction: no source dimensional-error claim. MILP minimizes sum of binary z_i with -Mz_i≤x_i≤Mz_i and sufficiently large M>0, solved by Gurobi. Finite coefficient bounds and solver numerics qualify support optimality; paper does not establish globally shortest human proof. Recursive dependencies and postorder traversal produce output, sometimes omitting intuitive rules (§2.7). Figure 2 illustrates Gaussian angle elimination yielding x=5π/36. Figure 3 gives a dependency graph and ten-step CE=CF proof using angles, cyclic quadrilaterals and isosceles geometry. Appendix B compares three cases: circumcircle/circumcenter/midpoint construction proving Concyclic(A,O,E,D), diameter/tangent construction proving supplementary angles ∠FDA+∠ADE=π, and angle-bisector/equal-length construction proving ∠BAF=∠ACF. PyEuclid displays respectively four, six and four numbered steps, with ellipses in some proofs. These are illustrative readability examples, not a reader study or systematic independent proof audit (Figs.2–3, Appendix B). Appendix B authors attribute DDAR ambiguity/incorrect reasoning to converting four-point full angles into ordinary three-point angles without preserving equal-versus-supplementary distinction. Red examples include ∠CAB=∠COH, signed expressions such as ∠(FG-DB), and ∠(AD-BC). Reader distinguishes presentation ambiguity and author criticism from an independently demonstrated unsoundness of DDAR’s internal calculus; neither system was replayed (Appendix B). Experiments use 30 CPU cores and 600-second timeout; no CPU model, versions, seeds, repetition/confidence estimates or per-case timing table supplied. Success means generating a valid proof or matching correct numerical answer; no independent checker or machine-checked metatheory is described. Page 1 bears CAV Artifact Available and Functional badges; these are source badges, not this reader’s reproduction. No artifact URL/version identified in article text (§3, PDF p.1). JGEX-AG-231 contains 231 construction/query problems from textbook to regional Olympiad, parsed into language and sampled diagram. Reported solved counts: PyEuclid 202, DD 152, Wu 173, DDAR 198. Five additional wins and one timeout loss explain net +4. Later same paragraph says six additional, inconsistent with earlier five; no per-instance table to resolve. Lost case attributed to explosion of three-point angle facts versus DDAR two-line full-angle representation. No invented case contingency (§3). Geometry3K test set 601, filtered to 599 calculation problems. Existing formalization parsed to metric relations, rough coordinates numerically parsed to diagrammatic relations. Initial 529/599≈88.31% (reader arithmetic). Manual inspection found 38 buggy problems: 21 wrong/self-contradictory values and 17 missing/wrong relations. After manual edits 567/599≈94.6578%, rounded 94.7%, leaving 32 timeouts all with>10 points. Difference+38 does not itself document the individual edited-case outcomes. Preserve original versus corrected-data performance (§3). The cited previous symbolic baseline 77.3% comes from prior work; paper does not report rerunning it on the manually corrected 599 cases. Headline 94.7% versus 77.3% therefore combines edited-data PyEuclid evaluation with cited prior baseline, rather than a demonstrated identical-input controlled rerun. No user study, detailed ablation, solver proof certification or reliability analysis reported (§3). No geometric inequalities supported; more points increase search space. Education, LLM auxiliary-construction/step prediction, synthetic reasoning training data and natural-language autoformalization are potential/future applications. No LLM-driven experiment or measured educational outcome in paper. No direct distributed protocol, Verus/Rust or TLA+ result (§4). Appendix A visually prints MidpointRatio with AB=AC, collinearity, Between(A,B,C), then BC/AC=1/2. If intent is A midpoint of BC, usual lengths instead give BC/AC=2. Under conventional B-between-A,C argument order the stated equal-length premise is incompatible with distinct collinear points. Paper does not fully define Between argument order here; reader flags apparent printed premise/conclusion mismatch rather than verified code bug. Other examples are Angle2Perp, EqualChordPerp and LawOfSines; EqualChordPerp follows because P,Q are endpoints of a diameter of the circle through A,B (Appendix A).
  • how much was read: most of it read
  • source
  • record id: pyeuclid-cav-2025-2025
• QSM-Cutoff (2025)
  • title: QSM-Cutoff: Systematic Derivation of Quantified Cutoff Formulas for Distributed Protocols
  • what: Enumerates reachable finite states using symmetry. Minimizes their logical description. Grows the domain sizes until a saturation test passes.
  • number: 19-model evaluation (Section 7, pp. 278-280), e.g. toy consensus forall: node=5, quorum=10, value=3
  • number: Pages 263-286
  • number: 19 protocols
  • number: 6000 s/run
  • limits: That the formula is a true reachability invariant for every size is still a conjecture. Ordered protocols such as Paxos and Bakery are future work.
  • how much was read: most of it read
  • source; notes: QSM-Cutoff: a full 19-model 2025 set
  • record id: qsm-cutoff-2025
• Reusable Formal Verification of DAG-based Consensus Protocols (2025)
  • what: # Reusable Formal Verification of DAG-based Consensus Protocols (authored by agents unless marked 🧑) Nathalie Bertrand, Pranav Ghorpade, Sasha Rubin, Bernhard Scholz and Pavle Subotić, arXiv2407.02167v2,18March2025. The inventory year2024 identifies the original submission; this read uses the retained2025revision. The authors report TLA+/TLAPS safety proofs for five protocol models by combining three DAG-construction components with two ordering components. The five are DAG-Rider, Cordial Miners, Hashgraph, Eventually Synchronous Bullshark and a minor variant of Aleph. The result concerns Integrity and Total Order; eventual delivery, probabilistic progress and implementation correctness remain outside it (Q0,Q1,Q2,Q12). ## Reading scope and source identity Read all21PDFpages, sections1–6 and51reference entries, all three figures including both panels of Figure2, seven listings and numerical Table1. Individually viewed pages6–16, covering the figures, listings, refinement mapping and numerical table. The paper refers to “Appendix ??” but includes no appendix. References were read as bibliography entries, not recursively read papers. Acquired the paper-linked repository’s complete nontruncated tree and22static blobs at9e4c9629eb283c7c34b6ffcf7956bc72a3e26e5d,22December2024, the latest retained commit before this paper revision. This selects a historical version without establishing that it produced the reported timings. Whole reads cover README and the five component Specification.tla files. Proof files and complete-protocol sources are inspected only in explicitly recorded ranges. Acquisition of a file does not imply its whole read. No author code, specification, checker or solver was executed/imported; no serialized experimental data or model was loaded. ## What is proved and how composition works A vertex embeds its entire rooted causal history, rather than only an opaque identifier. Thus two processes possessing the same vertex have identical histories for it. A separate anchor-agreement property requires processes that have selected anchors for a frame to select the same anchors. Delivering each frame’s previously undelivered causal-history vertices in a fixed deterministic order then prevents duplicate delivery and gives consistent delivery order. A lagging process may deliver a shorter prefix; the proof is not simultaneous equality of local delivery states (Q2,Q3). The decomposition is three construction models, reliable structured, unreliable structured and unreliable unstructured, plus Global Perfect Coin (GPC) and Virtual Voting (VV) ordering. Reliable construction ensures one agreed vertex per position. Unreliable structured construction allows equivocation and uses ratification to agree on a vertex at a position. GPC ordering separately agrees on leader positions; combining these properties establishes anchor agreement. Hashgraph first converts its unstructured events to a structured witness DAG. Reference consistency constrains witnesses’ predecessor references; VV establishes agreement on famous witnesses (Q4,Q6,Q7,Q8). The full protocol maps constants and new state variables into an INSTANCE of the ordering specification. Each construction action performs an appropriate ordering action or leaves its mapped variables unchanged. Protocol-specific refinement obligations remain necessary: five reusable components do not eliminate the proofs connecting five concrete models to them. DAG-Rider and ES Bullshark share reusable components but differ in wave lengths and commit/leader rules. Aleph is explicitly a variant; neither the paper nor its one-line repository README gives a precise delta against every published Aleph rule (Q4,Q9,C6). ## Assumptions and abstractions The system explanation assumes signed identities and fewer than one-third Byzantine processes. Reliable broadcast is weakened to integrity because validity and eventual agreement support liveness. Its model retains the first broadcast for each creator/round; the authors argue a faulty process’s chosen delivered message could equivalently have been sent first. This is an abstraction argument to retain in correspondence work, not a separately measured implementation equivalence (Q1,Q5). Unreliable communication copies a vertex from another local DAG; Byzantine participants can insert arbitrary modeled vertices. Procedures retain input/output behavior while omitting internal loop states. GPC becomes an arbitrary fixed function shared by all processes: randomness, unpredictability and fairness are absent. Agreement of the function’s answers suffices for the stated safety argument; it supplies no probability-one termination theorem or implementation of a cryptographic coin (Q5,Q7,Q8). The retained component models use finite symbolic bounds on waves/rounds or event IDs, with no fixed numerical test instance. Proof claims quantify over their parameters; a single TLC run at one bound would not establish that claim. The record does not independently establish an infinite-execution refinement beyond these bounded model families. The VV component incorporates its reference-consistency premise directly into both the prestate and poststate of Next. Its source proof of that premise therefore depends on the action restriction; a concrete protocol still must justify the mapping (C1–C5). ## Consequential findings in the retained artifact The printed self-referential VertexSet listing is explanatory shorthand. ReliableStructuredDAGconstructionSpecification.tla instead constructs vertices recursively by decreasing round with UntilRoundVertex. That resolves the apparent circular-definition concern for this component. However, its received/added-vertex guards access v.edges, while the actual constructed records contain strongedges and weakedges. This is a static field mismatch in the saved model; no checker error or reachable protocol failure was observed (C1). In the unreliable structured component, Approves(v,u) requires Observes(v,u) and forbids observing every vertex with u’s source and round. Taking that quantified vertex to be u yields both Observes(v,u) and its negation. Thus the literal definition admits no approval. With n-f positive under3f<n, ratification requires a nonempty set of approving sources and cannot occur under this reading. Since ratified vertices initialize to Nil, the displayed agreement property can hold without any ratification progress. This is a reader derivation from the retained definitions, not a claim that the real Cordial Miners protocol fails (C2). The unstructured component’s DonotSeeFork(v,u) has the same self-including universal condition. Taking x=u contradicts its Path(v,u) conjunct. Its Sees predicate consequently cannot witness a seen ancestor under the intended reflexive Path interpretation. This is another source-definition concern to resolve before trusting correspondence to actual Hashgraph behavior; the paper excludes liveness and no safety counterexample is established (C3). VVOrderingProofs.tla contains several named lemma statements without proof text. Most concretely, intInv14 asserts, for integers a,m, that a>=m and m+a>2f imply m>f. The permitted assignment f=1,a=2,m=1 makes both premises true and its conclusion false. The file cites this lemma in its Inv1 preservation proof. The nearby intadd statement has the plausible intended conclusion a>f with strict a>b. This suggests a proof-support defect or mistaken statement in the retained artifact; it does not show a checker accepted a false theorem. The actual preservation goal is a majority-count fact that can be mathematically true even though this cited general lemma is false (C7,C8). The same proof preamble asserts, without accompanying proof text, that every witness has more than2f predecessor sources in the preceding frame. Combined literally with its positive finite frame range and predecessor-frame condition, that leaves no nonempty witness set: a witness of minimum frame would require an earlier witness. This preamble should not silently become an established domain theorem. A simpler nonvacuity concern appears in the VV specification itself: all witness-DAG cells initially are empty, while adding a witness requires more than2f predecessor sources already present. With f nonnegative and no genesis exception, no first witness can be added under the intended typed interpretation. Whole proof closure and tool handling of unproved declarations have not been replayed. These artifact findings limit independent confirmation of the paper’s mechanized-proof claim; they do not refute the high-level decomposition or establish a reachable fork (C5,C7). ## Evaluation and significance Table1 reports, in order reliable structured/unreliable structured/unreliable unstructured/GPC/VV: specification lines403/160/230/272/136; invariants6/6/7/10/18; proof lines460/594/554/822/2120; maximum proof depths10/9/8/9/13; maximum degrees7/8/7/7/11; leaf obligations633/895/665/1302/3316; and checking seconds49/68/74/125/651. Environment:2.10GHzCPU,8GBRAM,Windows11,TLAPS1.4.5. These are author-reported component checks, not reader replications or total timings for every full-protocol refinement. No repeated-run variability or controlled comparison appears (Q10). The authors report approximately14person-months across five people. Their “almost half” proof-effort claim corresponds to reducing an illustrative ten separate construction/ordering components to five reusable ones. There is no controlled person-time baseline or ablation demonstrating a50% labor saving; refinement work and component complexity also differ. A reusable component count is concrete, while a measured causal labor reduction remains unestablished (Q0,Q4,Q10,Q12). This is directly relevant to reusable TLA+ specifications and distributed-protocol proofs. It has no Verus/Rust artifact or LLM-agent experiment. A reader proposal for evaluating proof agents is to score specification correspondence, nonvacuous progress examples, closure of helper lemmas and refinement obligations separately from reported leaf-obligation throughput. The retained field/predicate/lemma issues make those distinctions concrete without treating static concerns as observed solver results.
  • number: approximately 14 person-months across 5 people
  • number: Table 1 spec lines 403/160/230/272/136; proof lines 460/594/554/822/2120; obligations 633/895/665/1302/3316; TLAPS time 49/68/74/125/651 s
  • number: TLAPS 1.4.5 on 2.10 GHz, 8 GB
  • number: Reuse reduces proof effort by almost half
  • limits: Safetyonly;abstractbroadcastandcoin;finiteparameterizedhorizons;implementationrefinementfuturework;retainedsourcefield/predicate/helperlemmafindingslimitindependentconfirmation;nocheckerreplay
  • how much was read: most of it read
  • source; notes: Related addition: Reusable Formal Verification of DAG-based Consensus
  • record id: reusable-formal-verification-of-2025
• rIC3 (2025)
  • title: The rIC3 Hardware Model Checker
  • what: Introduces rIC3, a Rust bit-level IC3/PDR checker with a portfolio of IC3, BMC, and k-induction. It combines COI-reduced SAT queries, optimized VSIDS data structures, GipSAT, dynamic generalization (DynAMic), CTG/EXCTG, and optional internal-signal/localization abstractions. AIGER is handled directly; Btor2 word-level models are bit-blasted. Certificates are checked with Certifaiger and the tool integrates with SymbiYosys. The paper details architecture (ABC preprocessing to TranSys CNF, 11 IC3 + 4 BMC + 1 k-induction threads in portfolio), modular implementation (1,686 LOC IC3 core; 10,571 LOC total), ablations showing DynAMic and GipSAT matter, and systematic comparisons against IC3ref, ABC, nuXmv, AVR, Pono, and Avy.
  • number: Single-thread suite: 840 unique cases, 32 GB RAM, 3600 s; rIC3-ic3 solves 606 (225 timeout, 9 memory-out), PAR-2 2147.70, uniquely 61, fastest on 398
  • number: Single-thread competitors: nuXmv 533 solved/PAR-2 2777.30; ABC-pdr 516/2900.99; Avy 488/3142.87; IC3ref 486/3169.29
  • number: Portfolio HWMCC’24 (319 cases, 16 cores, 128 GB): rIC3 solves 245 (73 timeout, 1 memory-out), PAR-2 1809.74, unique 16, fastest 171; ABC-superprove solves 226
  • number: Ablation: disabling DynAMic (590 solved) or replacing GipSAT with Minisat (564) lowers solved count from 606; internal signals 564, localization abstraction 605
  • limits: Bit-level operation loses word-level arithmetic structure; bit-blasting arrays can explode and arrays are currently unsupported. Portfolio results use 16 cores/128 GB, while single-thread results use 32 GB and 3600 s. Some competitors uniquely solve cases rIC3 misses; internal signals/localization abstraction can reduce aggregate performance despite unique solves.
  • how much was read: most of it read
  • source
  • record id: ric3-2025
• rlive (2025)
  • title: Infinite-State Liveness Checking with rlive.
  • what: rlive is a model checker for liveness of infinite-state transition systems. It searches for counterexamples, learns abstraction predicates and synthesizes ranking functions. The ranking functions rule out loops that cannot run forever.
  • number: 835 liveness verification problems
  • number: timeout 1200 s, 8 GB per instance
  • number: solves 22 more instances than alpha-L2S
  • number: average speedup 6.47x on instances solved by both
  • limits: It handles Boolean and linear arithmetic constraints. It is model checking. It does not prove that software implements the model. It does not terminate on systems whose only counterexamples are not lasso-shaped (a prefix followed by a repeating loop).
  • how much was read: most of it read
  • source; notes: Infinite-State Liveness Checking with rlive
  • record id: rlive-2025
• SLTL standpoint model checking (2025)
  • title: Model Checking Linear Temporal Logic with Standpoint Modalities
  • what: Extends standpoint linear temporal logic (SLTL) with four history-information semantics in addition to step semantics: pure observation, public-history, decremental, and incremental. It supplies one history-DFA/model-checking construction that handles all five semantics, translates pure-observation SLTL to perfect-recall LTLK, and derives complexity bounds separating semantics and standpoint alternation depth. The formal semantics use separate finite transition systems Ta whose labels expose subsets Pa of propositions and define future-history satisfaction. Decremental nesting observes Pa intersections, while incremental nesting unions coalition observations; Example 3.5 gives explicit formulas and systems separating all five semantics. The algorithm computes bottom-up history DFAs using powerset constructions and products with subordinate DFAs, then applies standard LTL model checking. The paper proves PSPACE-completeness for full step/public SLTL and depth-1 pure-observation/decremental/incremental fragments, single-exponential time for step/public/decremental (and disjoint-observation pure observation), N-fold exponential time and (N-1)-EXPSPACE upper bound for incremental, and (d-1)-EXPSPACE membership for pure observation at alternation depth d.
  • number: five semantics
  • number: PSPACE-complete for full step/public
  • number: PSPACE-complete for depth-1 pobs/decr/incr
  • number: single-exponential time for step/public/decr
  • limits: Transition systems are finite, total, and have unique initial states; agent systems label only Pa subsets and agents may guess unobserved propositions. Complexity results rely on finite-state automata and alternation depth; pure-observation translation assumes perfect-recall LTLK and the improved time bound requires pairwise-disjoint Pa. No implementation or empirical benchmark is reported; the conclusion explicitly leaves experimental evaluation, stronger lower bounds, and analogous decremental space improvements as future work.
  • how much was read: most of it read
  • record id: sltl-standpoint-model-checking-2025
• Sound and Complete Witnesses for Template-Based Verification of LTL Properties on Polynomial Programs. (2025)
  • what: Defines existential and universal Büchi ranking functions as witnesses that a finitely branching numerical transition system has one, or only, runs visiting an acceptance set infinitely often. Gives soundness/completeness theorems and an LTL-to-product reduction, with deterministic-Büchi restrictions for direct universal verification. Synthesizes location-wise polynomial witnesses through quantified constraints, a cited Positivstellensatz reduction and SMT solving. Evaluates proof and refutation of four LTL properties on 287 linear and31 nonlinear programs; detailed results show competitive linear coverage and advantages on selected nonlinear tasks. Nonnegative witness values define a recurrent region; every chosen (existential) or enabled (universal) successor preserves this region, decreasing by at least one outside acceptance and allowing a reset at acceptance. Product automaton locations make Büchi membership constant at each synthesized location. Existential synthesis chooses one initial valuation and one suitable enabled successor; universal synthesis covers every initial valuation and successor. Reports invariant support, solver portfolio, excluded benchmark classes, true/false/unknown distinctions, and averages over different solved subsets. The paper’s broad general-LTL claims exceed the directly displayed positive universal-certificate reduction when the formula has no deterministic Büchi automaton.
  • limits: Transition systems have finitely many locations, finitely many real-valued variables and finitely many deterministic-update transitions; finite nondeterministic branching is allowed, unbounded nondeterministic assignment is not. Every state has a successor; a terminal location has an identity self-loop so all runs are infinite. Initial sets may be infinite. Synthesis further requires polynomial updates, guards and atomic constraints. There is no probabilistic transition semantics. LTL verification means all runs satisfy phi; refutation means some run satisfies not phi. Atom valuations need not be independent: x>=0 implies x+1>=0. The product with an NBW accepting not phi gives existential Büchi refutation. A direct universal-Büchi product for proving phi requires a deterministic Büchi automaton for phi; arbitrary LTL languages need not have one. Formal product definition and Lemma1 proof are deferred to [13]. The p.607 remark observes universal truth iff no accepting counterexample exists, then suggests using existential witnesses for general verification. Reader limit: absence of an EBRF is a negative semantic statement, not a positive polynomial witness that a synthesis routine has exhibited. Failure to find a degree-D witness cannot certify nonexistence of all witnesses. The displayed corollary for positive universal certificates remains restricted to deterministic Büchi formulas; deterministic programs with one run also permit an existential positive route. Büchi ranking is scalar real-valued in Definition1. On an edge from a state with f>=0: if current state is accepting, successor f must stay >=0; otherwise successor f must lie between0 and f−1. The decrement is at least1, not arbitrary strict real descent. Values at accepting states may jump upward, allowing repeated finite excursions. Negative values exempt states outside the selected invariant region. Existential EBRF requires at least one nonnegative initial state and at least one Büchi-ranked successor for every state. On negative states the implication is vacuous and total-successor assumption suffices. Choosing ranked successors from the initial nonnegative region creates an accepting run. Universal UBRF requires nonnegativity at every initial state and ranking on every transition, establishing acceptance on every run. Definition2 prints codomain R^n, but reuses scalar comparisons and the synthesis assigns scalar polynomials; reader treats that as a likely type typo, not a defined vector order. Theorems1/2 claim sound and complete witness families for existential/universal Büchi analysis of the stated finite-branching systems. Proofs are deferred to arXiv:2403.05386. Reader explanation of soundness: a nonnegative sequence cannot sustain decrements of at least1 forever outside B, hence each infinite continuation returns to B; the existential/universal successor quantifiers determine which continuations. Universal completeness depends on finite branching to bound nonaccepting delays from a fixed reachable state; the extension proof was not audited. The worked EBRF in Section3.1 assigns x0+3 at (linit,q0), x0+2 at (l1,q0), x0+1 at (l2,q0), zero at accepting (l1,q1), and zero otherwise. Reader defect: Figure2 includes nonaccepting terminal (lt,q0) with an identity self-loop, whose zero rank cannot satisfy0<=f(next)<=f(current)−1. The zero otherwise branch also fails at nonaccepting (l3,q0), whose successor has rank x0²+1. This invalidates the displayed example as written, not the general witness theorem; no one-cell full repair is claimed. Fixed maximum polynomial degree D gives one coefficient template per location over all monomials of degree<=D. Location invariants restrict entailments. The tool says it jointly generates suitable polynomial invariants using [12], and also reports ASPIC for linear benchmarks. The article does not fully specify how these two invariant sources interact in every experiment or the exact template/certificate degrees used. Existential constraints require some outgoing transition be enabled and ranked wherever the location invariant and f>=0 hold. Disjunction is rewritten equivalently as (phi and not psi1 and … and not psi(k−1)) implies psik, then antecedent DNF/consequent CNF distribute obligations. This avoids changing an existential successor choice into a requirement to rank every successor. Universal synthesis instead generates an implication for each enabled transition. Putinar-based elimination is imported from [1] as a sound/semi-complete conversion of polynomial implications to existential quadratic constraints. The printed paper does not supply its full compactness/positivity, certificate-degree or strict-inequality treatment. Theorems3/4 and text claim that sufficiently high D finds any polynomial witness, and sub-exponential complexity at fixed D. These are author theorems with omitted derivations; this reading does not independently validate unrestricted equivalence or quantitative complexity of every algebraic step. Existential initialization adds unknown initial values t and requires theta_init(t) and f_init(t)>=0. Universal initialization instead requires theta_init implies f_init>=0 for all initial values. Reader representation detail: a degree-two term ct² has total degree3 in unknown coefficient c and initial t, so Step4 is not literally quadratic without auxiliary-variable lifting or other encoding. Such lifting is possible, e.g. v=t² then cv; its equations are not described in this short algorithm. This is an encoding omission, not a demonstrated unsoundness. If a QP solution is found, the corresponding coefficients/initial values give a witness and Yes. Failure returns Unknown, acknowledging a higher-degree or nonpolynomial witness may exist. No bounded-degree failure establishes the opposite LTL answer. Mathematical soundness/completeness of witness families differs from semi-completeness of polynomial synthesis and from the practical solver’s ability to finish within a timeout. Prototype Java implementation calls Z3, Barcelogic and MathSAT5 in parallel on the generated constraints. Linear benchmarks use ASPIC for invariants. Direct-quantified Z3 is an ablation that omits the specialized Positivstellensatz step, not the same workload as a QP solver. No independent exact certificate validation, proof-assistant formalization, solver proof-log checking or floating-point-versus-exact coefficient audit is reported here. Experiments use Debian11, Intel E5-2670 at2.60GHz,6GB RAM,1800s timeout. Tool versions, concurrent solver resource allocation, repeats/variance, maximum memory, exact invariant/witness degree and complete translation details are not given in the article. Implementations/models linked at https://github.com/ekgma/LTL-VerP and DOI10.5281/zenodo.12518217 were not inspected or run. Benchmark selection: 297 of335 TermComp22 C-integer programs after excluding unbounded nondeterminism and variable-free programs;287 linear and10 nonlinear. Add21 of28 SV-COMP22 nonlinear loop benchmarks, excluding7 with unsupported operators such as integer mod. Thus318 programs,31 nonlinear, each paired with four specifications. Source categories mention integers while formal semantics uses reals; the article does not spell out a semantics-preserving integer-to-real translation or full arithmetic treatment. Refuting a real relaxation need not give an integer execution. Specifications use alphabetically first variable x, so their application is uniform but not an author-provided behavioral intent for each benchmark. RA is eventual terminal and globally x>=0, with every variable initially[0,64]. OV is eventual terminal or x outside[-64,63], with initial[-64,63]. RC is infinitely often x>=0; PR is always x<−5 implies eventually x>0, with initial[-64,63]. The formal model uses mathematical reals; the arithmetic domain and translation used for each benchmark are not specified in the article. OV is presented as a bound-crossing property; machine wraparound semantics are not established. A bounded nonterminating run need not converge, despite that word in the prose. Table2 compares Ours, Ultimate, nuXmv, MuVal and direct Z3. Yes/No count successful proofs/refutations; Tot adds them, U counts uniquely solved tasks. Reader arithmetic check: linear RA nuXmv prints76 Yes,91 No,137 Tot;76+91=167, so Tot is inconsistent. Stored table retains137 as printed and flags167 as arithmetic sum. Other printed count rows sum correctly. No raw outputs were examined to resolve which cell is wrong. Ours linear totals RA255,OV246,RC274,PR265 versus Ultimate263,267,280,282 and MuVal194,252,277,277. Thus Ours does not dominate linear coverage. Nonlinear Ours27,26,26,27 versus nuXmv1,7,26,25 and MuVal19,25,24,21; Ultimate unsupported, directZ3 zero. Unique counts sum10 linear and11 nonlinear property-program tasks; without task lists these must not be asserted to be21 distinct source programs. Average times are over successful subsets with differing coverage, not a common solved intersection. Table average rows include Yes,No,Tot times even though caption describes programs proved correct. Linear Ours5.4s Yes/81.5s No/47.2s combined, Ultimate5.4/4.1/4.7. Nonlinear Ours10.7/99.1/32.3. Do not infer a uniformly faster method from equal5.4s affirmative averages or compare conditional means as controlled speed ratios. The paper contains two program/automaton illustrations and an explicit location-wise EBRF example, but no named per-benchmark case study in results beyond aggregate categories. Supporting witness/product/algebraic proofs and full worked synthesis example are deferred to [13]/[1]. These were not read in this record. Heap/nonnumerical abstraction is future work; motivation through smart contracts/CPS is not a demonstrated deployed-system verification. No Verus, verified Rust, TLA+, distributed protocol implementation or LLM-agent experiment is supplied. Relevance to such evaluation comes from exact run quantifiers, proof versus refutation certificates, nondeterminism restrictions and theory/solver/benchmark boundaries, as reader inference.
  • how much was read: most of it read
  • source
  • record id: sound-and-complete-witnesses-2025
• Sprout (2025)
  • title: Sprout: A Verifier for Symbolic Multiparty Protocols.
  • what: Presents Sprout, a sound and complete implementability checker for symbolic multiparty protocols with dependent refinements, loop memory and generalized sender-driven choice. It reduces symbolic coherence conditions to µCLP and solves them with MuVal. Defines symbolic protocols with finite control plus dependent registers and refinement predicates. Sprout checks GCLTS eligibility, determinism, send/receive coherence, approximate simultaneous reachability and causal consistency before generating least/greatest fixpoint constraints. The two-bidder protocol illustrates dependent ISBN and increasing-bid refinements. Benchmarks include implementable/non-implementable protocols and custom properties; OCaml implementation compares with the prior naive checker.
  • number: ~3,500 lines OCaml
  • number: MuVal µCLP backend
  • number: two-bidder and calculator examples
  • number: benchmark times from seconds to minutes
  • limits: Soundness/completeness apply to the symbolic protocol semantics and µCLP reduction. Implementability does not prove application-level functional correctness. Expressivity depends on supported first-order theories and GCLTS eligibility; multiplication and some receiver-choice patterns are outside competing/local-type syntax. Runtime is benchmark-dependent.
  • how much was read: most of it read
  • source
  • record id: sprout-2025
• Statistical Model Checking Beyond Means: Quantiles, CVaR, and the DKW Inequality (2025)
  • what: Extends statistical model checking from means to higher moments, quantiles, conditional value-at-risk and entropic risk using the Dvoretzky-Kiefer-Wolfowitz-Massart confidence band for the entire empirical CDF. Defines effective two-sided and one-sided bounds, constructs stochastic-dominance upper/lower random variables from the DKW band, and proves soundness/convergence properties for moments, quantiles, CVaR and entropic risk. It identifies quantile discontinuity as preventing effective upper bounds for discrete rewards, proves CVaR bounds converge even for unbounded rewards, and gives a Sequential-DKW procedure that splits confidence across growing sample stages. The modes 3.1.287 implementation adds Modest/Jani syntax, CDF export, and QVBS demonstrations.
  • number: coupon DTMC has 17 billion states, leader_sync 4,244, embedded CTMC 8,548
  • number: modes runs k=100 simulations on all examples and k=1000 on coupon and embedded
  • number: Table 1 reports 0.3-quantile and CVaR0.3 intervals; embedded cannot bound expectation/CVaR because its unbounded real variable defeats the syntactic lower-bound procedure
  • number: runtime overhead of collecting samples and computing DKW intervals was negligible in the reported experiments
  • limits: Samples must be independent paths; rewards are nonnegative and finite where required. Quantile intervals converge effectively only when the CDF is continuous at the target quantile; discrete DTMC rewards can force a permanently loose upper bound. Unbounded expectation/CVaR handling may yield only lower bounds or depends on finite-tail arguments. Sequential sampling must allocate confidence across stages; naively stopping on repeated DKW intervals is unsound.
  • how much was read: most of it read
  • record id: statistical-model-checking-beyond-2025
• StatWhy: Formal Verification Tool for Statistical Hypothesis Testing Programs. (2025)
  • what: A Why3/Cameleer extension checks annotated OCaml/WhyML procedures that call hypothesis tests. Models statistical belief and explicit test histories using belief Hoare logic(BHL),with contracts for population assumptions,prior possibilities and interpretations/p-value composition. Proves program-contract entailment conditional on external population assumptions,trusted test routines and verification infrastructure;does not establish the scientific hypothesis as certain knowledge. Presents a rejected under-specified one-sample t-test,an explicit two-tailed primitive contract,a rejected minimum-of-two-p-values selection procedure,and a disjunctive drug-comparison example. Explains term/formula datatypes,possible-world/history representation,translation and proof-tree/VC workflow,and a custom Why3 unfolding strategy for fold-heavy specifications. Evaluates disjunction/conjunction counts2–10 and five multiple-comparison families with2–7groups.
  • limits: Analysts supply population distribution,sampling and prior-possibility assumptions. Unknown population normality cannot be mathematically established by the tool or proven by a normality test on a finite sample. Results are conditional on these premises and meaningful interpretation of the formulas. Hypothesis-test implementations are assumed correct. StatWhy checks their usage/contracts,not numerical correctness of the underlying t-test/statistical software. Verifying those routines is explicitly future work. Depends on BHL semantics/soundness,WhyML specification libraries,extended Cameleer translation,Why3 VC generation/transformations and SMT solver correctness. The chapter states a conditional soundness argument and cites BHL results;it does not give a machine-checked end-to-end translator/tool correctness proof. Complete relevant test histories are essential to detect selective reporting. Tests omitted from the program,unlogged external analyses,data-dependent population/model choices not captured by the contracts,or incorrect supplied scientific assumptions fall outside the shown guarantee. Statistical belief with a p-value bound is not a posterior probability that a hypothesis is true,certainty,or a general proof of empirical causation. Knowledge and statistical-belief modalities are explicitly distinct. Supports WhyML and the Cameleer OCaml subset;objects,GADTs and polymorphic variants excluded. Adds floating-point handling to translation but the chapter gives no numerical rounding/error analysis. Power analysis,interval estimation,Python and verified statistical primitives are future work. Small illustrative programs and bounded group/hypothesis counts;no annotation-time/user study,bug corpus,precision/recall,ablation against default strategy,solver comparison or repeated-trial variance. A timeout/failed VC does not by itself prove a contract error.
  • how much was read: most of it read
  • source
  • record id: statwhy-formal-verification-tool-2025
• Taming Floating-Point Rounding Errors with Proofs (2025)
  • what: Overview of formal verification for NASA avionics floating-point software, distinguishing an incorrect real-number requirement from rounding errors in a finite-precision implementation. Reports CPR verification with Frama-C/PVS/Gappa, PRECiSA certified error estimation using abstract interpretation and Kodiak, and ReFlow generation of annotated C with warnings for potentially unstable branches. Summarizes earlier results; supplies no new detailed proof or benchmark. The entire publication is an extended abstract. Records its actual toolchain stages, trace-wise symbolic versus numerical certificates, warning semantics, expert manual versus automated verification scope, concrete avionics cases, cited-source pointers and explicit future-work status of LLM-generated-code verification. Does not upgrade an overview into an independent check of cited systems.
  • limits: p1: Original CPR operational requirements reportedly failed intended precision even over exact reals. Tightened real-number requirements and a proved double-precision implementation are separate results. The overview supplies neither numeric preconditions/tolerances nor a counterexample position; source[6] VSTTE2017 and source[19] FM2018 hold the detailed analyses. No guarantee for the unmodified original requirements follows. p1: Improved CPR expressions reduce numerical complexity; double-precision correctness is attributed to Frama-C/PVS/Gappa. The early workflow requires expertise and is not fully automatic. Arithmetic format alone does not establish correctness; relevant input ranges and semantics are not reproduced here. p1: PRECiSA abstracts collecting semantics, builds symbolic error expressions along traces and invokes Kodiak for sound numerical enclosures. Externally checkable certificates cover both symbolic and numerical error estimates, relying on PVS floating-point and branch-and-bound formalizations. Certificate format, proof size, checker version, trusted components, coverage of exceptional values and termination are not specified in this overview. p2: ReFlow extracts floating-point C from a PVS real-number specification, emits warnings where control flow may differ due to rounding and generates ACSL annotations linking the two. A warning is a disclosed possible divergence; this statement does not establish unconditional branch agreement or exact real-number equality for every input. No detailed unstable-branch example, emitted C/ACSL or warning-return contract appears. p2: Frama-C generates PVS verification conditions; ad hoc PVS strategies discharge them automatically in the described toolchain. The user-expertise claim concerns these supported generated programs. The overview reports no corpus, supported syntax/loop bounds, failure rate or theorem proving timings that would justify universal automatic verification of arbitrary C. p2: Applications are winding-number point-in-polygon for geofencing and a fragment of DAIDALUS. This is not verification of all DAIDALUS, all ADS-B communication, complete aircraft software, a distributed fault model or system liveness. p2: LLM-generated code and quantized neural networks are future challenges, not an implemented/evaluated proof-agent or verified neural inference result. No Verus, verified Rust or TLA+ system is presented. Three-page invited-talk overview has no original formal statements/proof scripts, measurements, quantitative error table, performance comparison, source audit or reproduced artifact check. Tool guarantees are author reports of cited results.
  • how much was read: most of it read
  • source
  • record id: taming-floating-point-rounding-2025
• Tapis Horn-ICE array invariant learning (2025)
  • title: Data-Driven Verification of Procedural Programs with Integer Arrays
  • what: Introduces Tapis, a data-driven Horn-ICE decision-tree learner for procedural C-like programs with parametric-size integer/boolean arrays. It learns universally quantified loop invariants and procedure pre/postconditions by diagramizing array states into scalar samples, learning a quantifier-free decision tree, and lifting the classifier back to quantified array formulas; Z3 is the teacher that supplies counterexamples and inductiveness implications. The paper specifies finite-size array semantics (out-of-bounds reads return 0/false and writes have no effect), CHC encoding and Horn implications, then states the diagramization/lifting correctness results (proofs are deferred to the cited full version): Theorem 1 lifts a classifier of a consistent diagram sample; Theorem 2 guarantees consistency once each array has enough quantified indices. Attribute generation combines interval/octagon templates with patterns extracted from program assignments/guards. Bubble sort illustrates learned invariants; permutation preservation is explicitly outside that example. The implementation uses Clang frontend, C++ Tapis and Z3, tunes the teacher toward small arrays, and compares 215 programs: 121 SV-COMP array programs (84 safe, 37 unsafe) plus TAPIS-Bench (49 iterative, 37 recursive, 8 mutually recursive). Under 300-second runs on an 8-core 3.2GHz/16GB machine, Tapis solves 159/215 (95 safe iterative and 45 recursive safe plus 19 unsafe), versus Spacer 132 and Prophic3 118; it handles recursive procedures that several competitors cannot. Tapis uses at most two quantified variables per array/predicate in these sets and solves array-argmax for arbitrary N in 0.47 s where UAutomizer exceeds 36 minutes at N=5.
  • number: 215 programs total
  • number: 159 solved by Tapis; Spacer 132; Prophic3 118
  • number: 121 SV-COMP programs: 84 safe and 37 unsafe
  • number: TAPIS-Bench: 49 iterative, 37 recursive, 8 mutually recursive
  • limits: Programs are C-like, with finite parametric arrays, integer/boolean variables, loops and recursive procedures; specifications are first-order array formulas with universal index quantifiers and linear scalar constraints. The method requires fixed-size array values in counterexamples, so CHC-COMP unbounded-array benchmarks are excluded. Learner success depends on generated attributes, increasing quantifier count, sample consistency and Z3’s array-logic heuristics; quantifier alternation remains future work. Results are benchmark-specific and use manual translations to each competitor’s input language.
  • how much was read: most of it read
  • source
  • record id: tapis-horn-ice-array-invariant-learning-2025
• Token elimination (2025)
  • title: Token Elimination in Model Checking of Petri Nets
  • what: Presents static and marking-dependent dynamic abstractions that reset irrelevant Petri-net place tokens to zero while preserving a target reachability property, reducing branching and duplicate markings. Static least-fixed-point sets S↑φ/S↓φ propagate visible positive/negative effects from the query; dynamic C↑M/C↓M/CFM first over-approximates future possible effects and fireable transitions, then computes refined visible sets D↑φ,M/D↓φ,M. Lemma 3 proves shortest witness traces use only dynamic visible transitions, yielding Theorem 2 preservation; only markings change, so the same net can serve many CTL subproblems. Tapaal integration applies abstraction at every reachability node.
  • number: 45,632 queries per category; dynamic answers 32,392 CTL vs Tapaal 32,272 (+120), static +47; on challenging queries dynamic explores 10.1M vs Tapaal 16.7M configurations (−39.3%); dynamic answers 405 challenging queries under 1 GB vs Tapaal 144; 30 min/15 GB limits on AMD EPYC 7642
  • limits: Correctness is for EFφ reachability and shortest witnesses; CTL benefits only through reachability subproperties. Unbounded-net exploration may still not terminate; inhibitor-token removal can theoretically enable transitions (handled by exclusions/stubborn reductions). MCC 2023 has no inhibitor nets, and dynamic recomputation can have high overhead.
  • how much was read: most of it read
  • record id: token-elimination-2025
• Towards Automating Permutation Proofs in Rocq: A Reflexive Approach with Iterative Deepening Search (2025)
  • what: Rocq perm_solver Ltac tactic reifies list concatenations into binary trees of natural-number labels, searches for a multiset rewrite using permutation hypotheses, and applies a proved reflection theorem to obtain the standard-library Permutation result. Uses bounded iterative deepening, with an explicit fixed-depth/repeated-substitution variant. Demonstrates proof-script reduction on an existing k-d-tree development. Separates a concrete list-term mapping from the environment of permutation rewrites, retains grouping by trees so reflected terms are convertible to originals, and proves successful label search sound under all environment permutation premises. Tracks multiplicities and tests submultiset inclusion before replacement. Makes default no-reuse/depth bounds explicit and acknowledges incompleteness; does not confuse failure of heuristic search with refutation of a permutation.
  • limits: Lists may have arbitrary element type without a decidable element-equality assumption. Search compares generated natural-number labels for syntactic list pieces; this does not decide arbitrary semantic equality of opaque elements or lists. Goal and hypotheses are standard-library Permutation statements over list concatenations/cons. Cons is normalized into singleton append. Mapping associates distinct atomic list subterms with labels. A multiset of labels retains repeated occurrences; interpreting the paper’s word sets as ordinary sets would discard multiplicity and invalidate permutation reasoning. Reflection theorem requires a correct semantic permutation proof for every tree pair in the substitution environment and check_unify=true for the flattened goal. It proves soundness of success, not completeness or automatic truth of arbitrary context hypotheses. Ltac constructs terms/environments and discharges their obligations; the proof assistant checks the resulting theorem application. CUD depth0 returnsfalse before testing equality; positive depth first cancels common occurrences to detect equality, otherwise searches applicable left-side substitutions in either direction. It is a bounded backtracking rewrite search, not general complete logical unification or a decision procedure for all consequences of permutation assumptions. Default check_unify uses depth values at quartiles of the substitution-environment length and rpt=false, dropping a used hypothesis from that search branch. The fixed-depth variant takes user depth and rpt=true. Author’s observation that typical proofs rarely need reuse is empirical experience, not a theorem that a hypothesis may safely be discarded without losing solutions. Submultiset guards are required before replacement, and substitutions preserve multiplicity through occurrence removal/addition. Hypothesis reuse changes search power while preserving soundness. Exhausting depth or disallowing reuse cannot establish that a goal is false. Efficiency claims are preliminary. The author explicitly did not profile the algorithm; smaller proof terms versus a multiplicity/lia solver have no measured checking-time comparison here. Experiments replacing unary naturals/sorting were qualitative and do not establish asymptotic or general runtime superiority. Support for List.In/length goals, Ltac2 port, broader adoption and unrelated-fact pruning are future work. One rewritten development and line-count reduction do not establish general proof productivity or robustness. No distributed-protocol, Verus/Rust,TLA+ or LLM-agent experiment is presented.
  • how much was read: most of it read
  • source
  • record id: towards-automating-permutation-proofs-2025
• Tunable Automation in Automated Program Verification (2025)
  • what: Adds a broadcast mechanism to Verus so users choose which universally quantified facts the SMT solver may use, per module, function or proof block. It measures how extra facts about Seq/Map/Set/Multiset change proof hints needed and verification time on four Verus projects.
  • number: 49 Dafny-prelude lemmas added as ambient facts (Seq 25, Map 2, Set 10, MultiSet 12)
  • number: asserts after minimization: IronKV 268 to 245, Splinter 1158 to 1130, Anvil 343 to 336, CapybaraKV 449 to 415 (2% to 9% fewer)
  • number: more than half the original asserts were not needed
  • number: 98.2% of IronKV functions verify within 2x of original time; worst slowdowns 3x to 19x
  • limits: Assert count is called a very rough proxy for automation; the minimizer is a linear scan, not optimal, and ignores lemma calls. all_triggers did not scale to the other projects (many verification failures).
  • how much was read: most of it read
  • source; notes: Tunable Automation (2025)
  • record id: tunable-automation-in-automated-2025
• van der Leer Wullaert Ahrens Scott Karoubi UniMath 2025 (2025)
  • title: Scott’s Representation Theorem and the Univalent Karoubi Envelope
  • what: Authors report two Rocq-UniMath proofs of Scott’s Representation Theorem: every beta lambda-theory is recovered as the endomorphism theory of a reflexive object, by Scott’s syntactic retract category or Hyland’s presheaf category. Univalence converts theory isomorphisms to identities. Setcategory and univalent Karoubi envelopes are compared by Rezk completion, yielding a fully faithful embedding of Scott’s model into Hyland’s. An extensible Ltac2 tactic reduces substitution terms and emits explicit rewrites, with two reported timing examples. Records exact section-retraction versus equivalence scope, beta/eta boundary, synthetic initial syntax assumption, four displayed-category layers and tuple costs, explicit Scott/Hyland constructions, idempotent splitting/truncation, monoid counterexample, precise envelope completion versus full-presheaf embedding, source notation errors, generated proof timing versus tactic execution, component size caveats and open categorical lifting.
  • limits: Core foundation is Martin-Lof type theory with univalence; hom types are sets (unique identity proofs), objects need not form a set. A setcategory requires a set of objects; a univalent category requires identities of objects to correspond to categorical isomorphisms. These are distinct conditions. Proposition 6/13 use univalence of Set and displayed layers; semantic isomorphism is constructed first, then transported to identity. This is mathematical equality through an assumed foundation, not definitional equality by evaluation (§1.3, Remark 3). Algebraic theory T consists of sets T_n, projections and simultaneous substitution satisfying variable/unit/associativity laws. Lambda-theory adds abstraction lambda:L_(n+1)→L_n and application rho:L_n→L_(n+1), compatible with substitution, with beta rho∘lambda=id on L_(n+1). Main formal results cover beta theories, not beta-free or beta-eta variants, despite definitions and informal generalizations being discussed (§2.1, §2.3). Pure syntax Lambda is presented informally as a higher inductive syntax with variables/application/abstraction/substitution and equations. Formalization instead assumes a sequence of sets with these operations, equations and an induction principle, because UniMath core disallows inductive types. Initial Lambda→L morphism uses that interface. This does not assert a separately constructed concrete inductive syntax artifact; main SRT is parameterized over arbitrary theories and does not depend on constructing initial Lambda (Remark 10, Example 12). E maps a reflexive object X with X^X retract of X to E(X)n=C(X^n,X), substitution by product composition, abstraction/application via exponential adjunction and retraction. Beta needs app∘abs=id(X^X); eta additionally needs abs∘app=id_X. Definitions only need finite powers/binary products with nullary product and the relevant exponential, although introductory RO uses a Cartesian closed ambient category. Singleton in Set is trivial model; nontrivial models require other categories (§1.2, Definitions 16–17). Two functions S,H:LamTh→RO satisfy E∘S=id=E∘H. There is no claimed two-sided inverse RO→LamTh→RO. Scott and Hyland give distinct models with same endomorphism theory. Scott hom sets are inhabited; Hyland presheaves include empty objects with absent morphisms from nonempty objects. Remark 19’s phrase no morphisms into the empty object cannot literally include its identity; interpreted as the distinguishing lack of hom-set inhabitation. No equivalence between all theories and all reflexive objects is proved (§1.2, §2). Displayed categories build LamTh over AlgTh over Set^N, with four layers hiding structural details but making modular univalence proofs and avoiding duplicate object-type definitions. Two n-tuple encodings, nested pairs versus finite-index functions, require switching; paper reports this as implementation cost, not a measured algorithmic overhead (Remark 21, §1.4). Scott R has closed idempotent lambda terms A with A∘A=A and morphisms f with B∘f=f=f∘A; identity at A is A. Encoded pairing/projections supply products, lambda terms supply exponentials, terminal I=lambda x1 x2.x2. U=lambda x.x has each object A as a retract, hence U^U as a retract, and is reflexive. Explicit bijections E(U)n↔L_n preserve projections/substitution/lambda/rho and yield E(S(L))=L by univalence. Closed constants must be weakened under binders to typecheck (§2.2). Hyland uses algebraic T-presheaves: sets P_n with substitution action satisfying unit/associativity. Pshf_T is univalent. Shift A(Q)n=Q(n+1), with weakened action and fresh variable, is Q^T; lambda/rho exhibit theory presheaf L as reflexive. Lawvere category has natural-number objects and hom(m,n)=T_m^n. Its presheaves equal the algebraic interface; Yoneda yields Hom(T^n,Q)≅Q_n. These bijections preserve operations to prove E(H(L))=L. Informal observation about dropping beta does not enlarge the stated completed main formal scope (§2.3). Karoubi envelope D splits idempotents, fully faithfully contains C and every D object merely is a retract of an image object. Merely means propositional truncation, not chosen witnesses. Add setcategory or univalence condition for the corresponding foundation. Set construction R^S(C) uses pairs (X,f) with f idempotent, morphisms g satisfying f2∘g∘f1=g, identity f; it is a setcategory envelope if C is a setcategory. It defines a completion monad on setcategories, multiplication ((X,a),b)↦(X,b) (§3.1). R^S(C) univalent implies C univalent, converse false: Example 42 uses commutative matrix monoid {I,diag(1,0),diag(-1,0)}. Only I is a unit so its one-object category is univalent; at retract diag(1,0), both diagonal rank-one matrices are automorphisms while identity type has one member, violating univalence. This concrete counterexample is source mathematics; reader checked displayed matrices and c^2=b, not a replayed Rocq test (Proposition 41, Example 42). Univalent R^U(C) is full subcategory of Set-valued presheaves consisting of mere retracts of representables. Equalizer of an idempotent f and identity splits f; composition of retracts keeps object within subcategory; Yoneda gives full faithfulness. Full subcategory of univalent presheaves is univalent. R^S(C)→R^U(C), sending (X,a) to equalizer of Yoneda(a) and Yoneda(id), is fully faithful and essentially surjective: R^U(C) is Rezk completion of R^S(C) for arbitrary C. This theorem concerns envelope subcategory, not all presheaves (§3.2). Comparison identifies Scott R with set-envelope of monoid of eta-fixed closed terms, not all closed terms without restriction. Lambda/rho identify this monoid with substitution monoid L_1. Proposition 49 assumes target D has all colimits; applying D=Set^op relates presheaves on Lawvere category and L_1 one-object category. Diagram (8) passes through set-envelope, its Rezk completion and inclusion into full presheaves. Composite R→Pshf_L is fully faithful and preserves U as L, powers and relevant exponential/morphisms, hence endomorphism theory. Full Pshf_L need not itself be Rezk completion of R; introductory phrasing is coarser than Theorems 47/50 (§3.3). propagate_subst is deterministic syntactic rewriting in Ltac2: traverse left goal term, match registered traversal/rewrite patterns, execute applicable equalities and print explicit refine/maponpaths composition steps. It replaces slower repeated Ltac rewrite search. Ten trivial rewrites occur in shown substitution term (one abstraction, four applications, five variable substitutions); other proofs need 40+. Extensible lists cover constructors then composition/pair/projection/curry/n-tuples. Modular traverse also underlies generate_refine for targeted subterm rewriting; generalized tactic handles arbitrary identity sets and hyperdoctrine formulas (§4). Reported illustrative timings: U_term substitution, repeat reduce_lambda≈100ms, propagate_subst≈35ms, generated explicit script≈5ms. First nine lines of subst_compose≈40ms, propagate_subst≈330ms, reduce_lambda≈1s. These are two source-reported examples without hardware, repetition counts, uncertainty or benchmark corpus. Generated proof replay is distinct from tactic search/execution, and examples do not establish whole-project speedup. Longer explicit proofs trade size for checking performance and avoid extensive retained automation per UniMath maintainability preference (§4). Project reports >11,000 lines, roughly equal definitions/proofs. Approximate component counts: categories 3,000; Scott 3,000; envelopes 2,000; algebraic-theory constructions 1,000; comparison 1,000. These rounded listed components total 10,000, not an exhaustive exact project total; no independently counted repository size or development person-hours. Integrated into UniMath, HTML commit 5941f44e3c13d2ac385f5a8b9b486c0088dd3f46, archive 93afb3f22a54064c0baa8493bd326f385fc96ebe. Compilation instructions linked but no reader build/axiom audit or timing reproduction (§1.4). Printed notation has apparent typing/copy errors, checked visually: Definition 8 writes rho_n∘lambda_n=id(L_n) though maps compose on L_(n+1); Corollary 32 shows correctly indexed shifted object. Theorem 36 final proof line writes E(S(L)) rather than E(H(L)); theorem/§2 state H correctly. §3 preliminary idempotent-splitting paragraph reverses X/Y retract relation for f:X→X. Theorem 45 equalizer proof labels Y→E witness s while diagram and following page use r. These are exposition discrepancies; no corresponding artifact error established. Open: lifting the type-level section/retraction to categories or bicategories, with right-hand RO structure unsettled. Domain-equation/Scott D_infinity/PCF formalizations are complementary related work, not supplied proofs here. No distributed protocol, TLA+, Verus/Rust or LLM agent evaluation. Indirect contribution is foundational assumption auditing, abstraction cost, multiple-proof comparison and explicit generated proof replay evidence (§5–6).
  • how much was read: most of it read
  • source
  • record id: van-der-leer-wullaert-ahrens-scott-karoubi-unimath-2025-2025
• Veil (2025)
  • title: Veil: A Framework for Automated and Interactive Verification of Transition Systems.
  • what: It embeds distributed transition systems in Lean. It sends first-order proof obligations to SMT solvers and leaves the rest as interactive Lean goals.
  • number: 16 evaluated cases incl. Rabia, SCP, Suzuki-Kasami, Vertical Paxos
  • number: 1704 non-empty, non-comment lines of Lean; 85 actions and 185 invariants; about 100 lines per file
  • number: 16 benchmarks, 1,704 Lean lines, 85 actions, 185 invariants
  • number: Veil verifies 16/16; 14/16 under 15 s and 12/16 under 10 s
  • limits: It evaluates checking supplied invariants, not finding them. It is not an LLM agent. All its guarantees are safety. The notes record no agent success rate.
  • how much was read: most of it read
  • source; notes: Veil: proofs in Lean with automatic first-order checks; notes: Veil: a promising proof interface, with no agent rate established here
  • record id: veil-2025
• VEP: A Two-stage Verification Toolchain for Full eBPF Programmability (2025)
  • what: VEP separates eBPF verification into C-level symbolic execution and SMT proof generation in user space, compilation that translates code, assertions and proofs, and independent bytecode symbolic execution/proof checking intended for kernel space. Separation logic describes owned memory and helper-acquired resources. Annotations expose loop invariants and contracts unavailable to fully automatic verifiers. The paper reports acceptance/rejection, time, memory and annotation/proof sizes on 41 small programs, and claims Coq proofs of the separation-logic transformation properties. It does not present a mechanized soundness/refinement theorem for the entire executable toolchain. Records proof-generation/checking boundary, trusted helper specifications and bytecode semantics, assertion restrictions and conversion rules, compilation passes and source-property loss, safety versus intended functionality and termination proof limits, concrete string/list/socket examples, all Table 2–5 results and deployment/version uncertainty. Separates sample success from universal no-error/full-programmability claims; checks discrepancies in memory/speed/acceptance prose and proof-line terminology; preserves printed illustrative inconsistencies without claiming implementation defects.
  • limits: §§2/5: Claimed small trusted computing base excludes the C verifier, compiler and SMT solver because bytecode is checked again. Guarantee still depends on correct executable bytecode checker, faithful eBPF instruction/memory/arithmetic semantics, actual helper contracts, and correspondence with kernel execution/JIT. The paper supplies no whole executable-checker soundness or code-to-kernel refinement theorem. §5 specifically reports Coq proofs for separation-logic transformation properties, not all these components. §§2.1/3/5: VEP-C computes strongest postconditions, eliminates spatial entailments, and uses its own SMT solver producing cvc5-style proof terms. VEP-eBPF independently symbolically executes bytecode and checks spatial/pure proof steps without solving. Checked proof terms remove the need to trust SMT answers only to the extent proof rules and their checker/semantics are correct. Kernel-space deployment is the intended architecture; evaluation does not clearly distinguish an in-kernel deployment benchmark from standalone checker measurements. §§2.2–2.3/7: Introduction and capability section claim functional correctness, but §2.3 explicitly makes user intent the user’s responsibility and §7 lists functional correctness as future work. The reported Key_connection annotations are expressly memory-safety-only. Accepting bytecode safety does not establish intended lookup/copy semantics or preservation of arbitrary source assertions. §2.2: Termination within finitely many steps is claimed. The shown loop reasoning uses invariants and exit conditions; no explicit general ranking-function, decreasing variant or fuel/step-bound rule is explained. Invariant preservation alone establishes partial correctness, not termination. This is a limit of the presented justification, not a reproduced checker counterexample. §§2.1/6.2/Appendix B: Full programmability and no false positives/negatives are author claims. Finite examples and annotations do not establish completeness for all safe programs; general entailment is acknowledged undecidable. Spatial-expression scope restrictions reject some natural quantified array assertions, requiring custom predicates. Appendix B DNF normalization can multiply branches, so approximate linear symbolic-execution cost in statement/assertion length excludes assertion-size growth and SMT solving. §3: Memory ownership uses disjoint spatial conjunction; duplicated ownership is inconsistent. Built-in helper contracts are derived from documentation, not proved against kernel helper implementations. Resource acquire/release soundness depends on their completeness and accuracy, including permitted null returns, flags and sizes. Contract variants are selected for supported contexts. §§2.3/4: Source C undefined behavior can compile into memory-safe bytecode. Early source rejection protects source semantics beyond kernel bytecode safety. Maliciously altered bytecode with a valid safety proof may pass without matching original program intent. Neither final safety checking nor an unverified compiler automatically proves C-to-bytecode functional refinement. §4: Compiler uses nanopasses, member-to-offset conversion, calling convention transformation, iterated register coalescing, and explicit stack frame preconditions. Few optimizations supported. Dead source variables become existential logical variables. Figure 14 deliberately turns a false source assertion x==1 after x=0 into satisfiable exists _x,_x==1; source assertion truth is lost even though bytecode safety can survive. §4 Figures 13/15, Appendix A: Printed illustrations contain apparent inconsistencies. Figure 13 sets R1=0 then asserts R1==(R10-4)+1 while stack value is0. Figure 15 declares fields x,next but accesses l.head. Appendix A transforms forall n,v!=nn into forall n,n!=nn, which fails for n=0/1 and is not generally equivalent. These are source illustration issues; artifact behavior was not tested. Appendix A prose also describes x as a nonsquare although displayed condition constrains v with x=2v. §3 Figures 4/6/9/12: An arbitrary owned output list proves initialized memory/ownership, not that memset filled every byte or strncpy copied/padded correctly. Figure 9 uses stronger repeat(v,n) content predicate; Figure 6’s displayed successful strncpy postcondition is weaker than complete C-library functionality. Keep actual predicate content when evaluating generated proofs. Appendix B: Internal assertions separate program-variable addresses, pure facts and owned memory; logic variables in spatial facts require permitted existential binding. Printed array-address conversion shows V(e1+e2) without explicit element-size scaling; semantics/type conventions would need inspection before inferring a compiler defect. §6: Evidence is 41 selected small C programs, not large production services or adversarial bytecode fuzzing. Linux Kernel5.15 and PREVAIL August2024 used. Hardware, trial repetitions, confidence intervals, human annotation time/user study and whole-tool LOC are not specified. No independent reproduction performed. §6 Tables 2–5: Passing rate means acceptance for safe cases and rejection for unsafe cases. All ten unsafe cases stop at VEP-C; compiler/eBPF columns are dashes. Thus data demonstrate C-front-end rejection, not independent final-checker rejection of ten crafted attacks. Safe VEP outcomes are 30 category samples plus one Key_connection, all accepted. §6.2: Linux 6/10 acceptance is for the PREVAIL sample category, not all safe programs; Linux category is9/10 and Stringlib3/10, with Key0/1. PREVAIL10/10,8/10,1/10 and Key0/1. Source attributes PREVAIL variability to SMT dependency/nondeterminism although introduction describes abstract interpretation; no experiment establishes that causal claim. Claimed version regressions30%/20% lack paired version tables, and no cross-version VEP study is shown. §6.1: Claimed predictable2–3MB VEP-eBPF memory is contradicted by Linux sample maximum8034KB (lathist); VEP-C maximum32569KB. Linux average.94ms applies to its accepted Linux sample subset, not all benchmarks, and Stringlib maximum2.69ms. Claimed3–5x faster than PREVAIL is not uniform: Linux category12.48/8.42≈1.48x, while39.46/8.42≈4.69x relative to VEP-C. Different acceptance sets complicate average comparisons. §6.3: Table3 labels proof counts as proof lines, while prose calls64840 proof obligations. Do not infer64840 independent obligations. Annotation lines are a size proxy, not measured effort or expertise. Key proof5819lines in table versus about5800 in text; preserve rounding. §7: LLM generation of annotations, broader functional correctness and advanced optimization support are proposed future work. No LLM agent experiment, Verus/verified Rust/TLA+ proof, distributed-protocol theorem or code execution reported in this reading.
  • how much was read: most of it read
  • source
  • record id: vep-a-two-stage-2025
• Veri-QEC (2025)
  • title: Efficient Formal Verification of Quantum Error Correcting Programs
  • what: Defines assertion and program logics for quantum error-correcting programs, proves a sound proof system, reduces Pauli-error verification conditions to classical SMT assertions, and implements the automated Veri-QEC verifier. The framework supplies a heuristic for non-Pauli errors, parallel enumeration of error patterns, user-provided locality/discreteness constraints, Coq formalization, and verified scenarios for rotated surface, Steane and other stabilizer codes. The evaluation measures general properties, constrained verification, realistic fault-tolerant scenarios and a 14-code benchmark.
  • number: Sequential verification exceeds 24 hours at surface-code distance d=9; parallel verification extends solvable distances to d=11
  • number: Locality plus discreteness constraints verify d=19 (361 qubits) in about 100 minutes
  • number: Experiments run on 256-core AMD EPYC/512 GB with 250 cores and 24-hour maximum runtime
  • number: Benchmark includes 14 stabilizer codes
  • limits: Verification scales exponentially with code size and uses a 24-hour timeout; parallel experiments use 250 of 256 cores. User constraints can improve scale but require logical encodings and may change the verified scope. Relative completeness is established for finite programs without infinite loops; completeness for while-loops remains open.
  • how much was read: most of it read
  • record id: veri-qec-2025
• Verification of the CVM Algorithm with a Functional Probabilistic Invariant (2025)
  • what: The AFP document supplies a six-page informal proof, AppendixA.1–A.3 on printed/physical37–42. This reading inherits the20page main-paper account and source review from formal1417. The downloaded document is dated February6,2026, with a different title from the2025paper; correspondence to the exact version cited by that paper is unconfirmed. Only the prose appendix and opening title/contents were deliberately read. The TOC extraction accidentally also emitted the first formal-theory page3; it was not used as scientific evidence and no further formal-theory section was reviewed or executed. A.1 proves a distribution-level product invariant by alternating induction between the post-occurrence distributionΩ′ and post-subsampling distributionΩ. Insertion removes the current element then samples its reinsertion with current probabilityp; the argument separates whether that element belongs to the queried subsetS. Subsampling separates retained and absent elements, applies the assumed subsampler product bound, then the two scalar-function conditions. This avoids assuming independence of the buffer indicators. Lemma2 instantiates the class using nonnegative concaveh and a cutoff onp. A.2 sets A to the set of stream elements and q=n/(4|A|), reducing to|A|≥n. Lemma3 bounds the upper tail whilep≥q byexp(-nε²/12), usingt=qlog(1+ε), an affine exponential chord, Markov and the invariant. Lemma4 bounds the chance ofp<q by l exp(-n/12), union-bounding the first crossing fromf^j to f^(j+1). Its displayedf^j≤2ff^j usesf≥1/2; the retained main context is needed. Lemma5 uses negativet=qlog(1-ε), a nonnegative affine chord and the invariant to bound the lower tail byexp(-nε²/8). Theorem1 combines those three events: for0<ε,δ<1 and n≥12ε^-2 log(3l/δ), the displayed relative-error event has probability≤δ. This remains an abstract ideal-sampling theorem, not an executable implementation check. A.3 takes an almost-sure finite boundM onp^-1, suggestingM=f^-l. Applying the invariant to the two affine functionsx andM+1-x bounds both sides of the expected per-element scaled indicator, forcing its expectation to1. Linearity then gives E[|χ|/p]=|A|. The proof adds no empirical evaluation, implementation verification or distributed-system result. It makes the expected-value argument concrete but has strict/non-strict cutoff presentation gaps listed below. Exact source-page spansS1–S6 and individually viewed rendered pages preserve the printed reasoning.
  • limits: S1–S6: AppendixA.1–A.3 read completely, including every displayed induction calculation, Lemmas1–5, Theorem1 and unbiasedness derivation. Main20page reading inherited from formal1417. Current AFP document date February6,2026; exact identity with the cited2025 supplementary version not established. No formal tool or author implementation executed. S1: the appendix assumes subsample(chi) returns a subset and satisfies its referenced Eq1. That equation lies outside this new prose extraction and was not newly inspected in the formal-theory body. The original main paper context is inherited; this supplement is not treated as a self-contained proof of every subsampler premise. S1: Lemma1 prints phi:(0,1]×{0,1}→R_nonnegative but quantifies0<alpha<1,0<x≤1 while evaluatingphi(x/alpha,1). Forx>alpha that argument exceeds its domain. The displayed proof applications usex=p,alpha=p orx=pf,alpha=f, which keep the ratio in range, apart from the alpha=1 insertion boundary. This is a printed domain/boundary omission, not a claim that the uninspected formal theorem has that defect. S1–S2: the insertion step invokes condition1 withalpha=p, butcondition1 printsalpha<1 whilep=1 initially and before any subsampling. Atp=1 the needed inequality reduces to equality. A separate trivial endpoint case would close this presentation omission. S3–S6: Lemma2 states onlyq≤1 whileusingq^-1 as an interval endpoint; the applications requireq>0. More substantially it printsI(p>q), whereas upper/lower-tail calculations useI(p≥q). The lower-tail Markov calculation even changes the event top>q after startingp≥q. Equality can have positive probability becausep takes discrete powersoff. Do not silently certify these literal printed substitutions. S6: the unbiasedness display likewise usesI(p≥M^-1), where Lemma2 supplies a strict cutoff. Reader repair for this particular step: chooseq=1/(M+1), keepingh(x)=M+1-x nonnegative on[0,M+1]; thenp≥M^-1 impliesp>q and the same two bounds hold. This local repair is not a rereview or replay of the mechanized proof. S4–S6: Lemma4 needsf≥1/2 forf^j≤2ff^j and a positive finite streamlength for the displayedlog(3l/delta) capacity. The appendix relies on algorithm context instead of restating every parameter premise. Preserve the finite-stream and subsampling assumptions from the inherited main record. S1–S6: new proof-reading evidence leaves the main record printed negative-association Lemma6 concern intact. No formalization replay, proof-assistant output, random-number implementation, numeric arithmetic or Rust/distributed service has been verified by this reading.
  • how much was read: most of it read
  • source
  • record id: verification-of-the-cvm-2025
• Verified floating-point interval iteration (2025)
  • title: A Formally Verified IEEE 754 Floating-Point Implementation of Interval Iteration for MDPs.
  • what: Formally verifies interval iteration for MDP reachability from abstract Isabelle/HOL semantics through IEEE 754 double-precision directed-rounding arithmetic to generated LLVM, then embeds the code in mcsta. The proof establishes conservative lower/upper bounds, while experiments show competitive performance. Formalizes min/max MEC reductions, finite-horizon preservation, level-graph descent and convergence in reduced MDPs. Extends Isabelle’s Refinement Framework with lower/upper bounding float relations, non-NaN/non-negative restrictions, directed FMA, mixed comparisons and min/max refinements. A Gauss-Seidel interval-iteration nres program is refined to mcsta sparse-matrix arrays and LLVM; a Hoare triple links concrete outputs to abstract reachability bounds. Integration converts mcsta 128-bit rational probabilities to rounded double bounds using unverifed glue.
  • number: 49 QVBS instances
  • number: 10^6–10^8 states
  • number: epsilon 10^-6; iteration cap 10^7
  • number: Intel i9-11900K, 128 GB RAM
  • limits: Convergence theorem assumes finite reduced MDPs whose MECs are trivial or bottom and target/avoid sinks; deterministic MDPs with all probabilities one are excluded from the bound theorem. Float relation restricts values to non-negative non-NaN numbers and does not prove float lower/upper convergence to one point. LLVM theorem assumes well-formed input MDP, 64-bit size limits, valid separation-logic heaps, and correctly rounded conversions; parser/preprocessing and glue remain unverified.
  • how much was read: most of it read
  • source
  • record id: verified-floating-point-interval-iteration-2025
• Verified MEC decomposition (2025)
  • title: Efficient Formally Verified Maximal End Component Decomposition for MDPs.
  • what: Mechanizes correctness of maximal end-component decomposition for finite MDPs in Isabelle/HOL, refines the algorithm through efficient mutable data structures to LLVM bytecode, and integrates it into the mcsta probabilistic model checker. Experiments show performance comparable to the prior unverifiable implementation and lower memory use. Defines MDPs, end components and MECs over finite states and support sets, then formalizes the iterative SCC/culling algorithm. Isabelle locales state nonempty branches, finite state sets and closed kernels; refinement relations and separation-logic assertions connect abstract lists/sets and bitsets to LLVM memory. The implementation reuses verified Gabow SCC code but adds deletion-capable graph structures. Integration avoids data copies. The evaluation compares verified, integrated and reference implementations, including QVBS, long-run-average and hand-crafted MEC benchmarks.
  • number: 61 benchmark instances
  • number: 500,000–100 million target states
  • number: 3 runs per benchmark
  • number: 8.2% average extra memory for integrated implementation
  • limits: Finite nonempty state sets and well-formed closed MDP kernels are assumed; algorithm reasons only about nonzero support, not probability values. The implementation is one verified component, not a fully verified model checker. Benchmarks are limited to models fitting a 32GB laptop; interval iteration and floating-point rounding remain future work, and a theoretically faster MEC algorithm is not implemented.
  • how much was read: most of it read
  • source
  • record id: verified-mec-decomposition-2025
• Verifying an Efficient Algorithm for Computing Bernoulli Numbers (2025)
  • what: Isabelle/HOL verification and LLVM refinement of Harvey’s multimodular Bernoulli-number algorithm, including prime preparation, parallel modular numerator calculations, fast CRT reconstruction and denominator/sign recovery. Uses bounded machine arithmetic, Montgomery/table/reciprocal optimizations and specified GMP bindings. Exported code computes B_100000000 on a 128-thread cluster node in 45458 seconds; comparison with hand-optimized C++ is competitive for larger inputs under exploratory benchmark conditions. Tracks numerator residues instead of potentially undefined rational residues, all three modular cases, Kummer range reduction, nondeterministic refinement emptiness versus concrete LLVM, relaxed-accumulator bounds, 64-bit chunk table/reciprocal correction, certified prime-budget checks and sign-aware CRT. Preserves exact wrapper guarantees and external GMP/compiler/I/O boundaries, all benchmark table numbers, source inconsistencies and optimization-versus-mathematical proof effort.
  • limits: §2, pp.2–3: Bernoulli convention B1=−1/2; B0=1 and odd indices above 1 vanish. Even indices congruent 2 mod 4 are positive, multiples of 4 negative. Rational modular reduction requires denominator coprime to modulus. The denominator is the squarefree product of primes with p−1 dividing even k. The pre-existing AFP supplies Bernoulli foundations; Voronoi/Kummer congruences and concrete prime bounds were added for this development. §3, p.4: compute numerator N_k mod p for all odd primes, including denominator primes where B_k mod p is undefined. For p−1 dividing k, use −D_k/p mod p. Otherwise compute B_k mod p and multiply denominator factors modulo p. Fast sum requires 2^k≠1 mod p; slower fallback handles equality. Restricting to only fast primes lacks the required a priori coverage bound. Theorems 5–7, pp.3–4: Kummer gives range reduction using k prime=k mod (p−1), with k prime nonzero under the denominator exclusion, and factor k/k prime. Fast-sum theorem requires prime p≥5, 2≤k≤p−3 and primitive root g. It reindexes into m outer terms and n inner terms using the order of 2. These arithmetic assumptions differ from the later wrapper handling p=3 and larger original k. §3.1.1, p.5: nondeterminism-error monad refinement means implementation results belong to specification results and failure is controlled, but an abstract implementation with no results is still allowed. Refinement to LLVM later rules out an empty result set. The remainder-sum loop tracks power x^j, doubled residue 2^j s mod p and modular accumulator; explicit assertions expose bounds to later refinements. §3.1.2–3, pp.6–7: Montgomery state uses W=32, 64-bit accumulator and explicit nonoverflow arithmetic/casts. A relaxed accumulator is below (n+1)p and only needs final reduction. Refinement assumptions include a valid Montgomery context, n<2^W and correctly represented input. Export uses 32-bit modulus/inverse/value/residue parameters and 64-bit length/result; an interface width alone does not eliminate the stronger length proof condition. §3.2, pp.7–8: w=w prime=8 gives 64 binary digits per chunk and eight byte-indexed tables of 256 double-width words, 16 KiB total. Entries use relaxed Montgomery form so the hot loop mostly performs shifts, masks, indexed updates and additions. A precomputed floor(2^128/p) replaces division; a possible quotient error of one is corrected, requiring p<2^31. Remainder terms not divisible by 64 use the simpler loop. §3.3, p.9: final modular wrapper requires even nonzero k, odd prime 3≤p<2^31, denominator factor list, correct primitive root below p and correct order of 2. It creates the Montgomery inverse by Hensel lifting, applies range reduction or denominator-prime shortcut, multiplies denominator factors and converts out of Montgomery representation. The final result is exactly N_k mod p. §4.1–4.4, pp.10–12: an initial analytic bit-size bound and explicit prime-product inequality bound required sieve size. Reject if Y≥2^31; success is proved through k=105946388. Sieve produces odd primes and a smallest-prime-factor cache, denominator factors sharpen the bit budget, and fixed-point log bounds prune primes without floating point or huge integers. Tasks contain prime, primitive root, order and a placeholder residue. §4.4–4.5, p.12: primitive roots are found by testing candidates against prime factors of p−1; the factor cache also computes order. Parallel map preserves every task’s first three fields and fills the correct residue. t>1 is the map precondition, while the caller uses max(2,t). Parameters t,d affect parallel execution, not the mathematical result. This is shared-memory LLVM parallelism, not an asynchronous distributed protocol. §4.6, pp.12–13: special cases return 1,−1/2,0 for k=0,1,odd>1. General processing returns a success flag, numerator and denominator. Add N_k≡1 mod 2; all moduli are distinct primes and their product exceeds |N_k|. CRT returns residue num in [0,m); known sign gives N_k=num for positive indices and num−m for multiples of 4. This is not unsigned residue reconstruction without a sign theorem. §4.6.1–2, pp.13–14: fast CRT uses product/remainder trees, independent recursive branches and array refinement instead of explicit pointer trees. CRT and denominator product need arbitrary precision; GMP operations are imported through specified Hoare triples with an existence model. The model prevents contradictory specifications but does not prove GMP’s implementation correct. Replacing GMP with a verified library is discussed as independent work. §5, p.14: final wrapper Hoare triple assumes separate valid output memory locations, nonnegative signed 64-bit t,d and unsigned 32-bit k. It ensures valid GMP numerator/denominator outputs, k≤105946388 implies success, and every successful result equals the canonical numerator/denominator. A larger k is not guaranteed to fail; a successful larger case is still correct. Trust includes Isabelle, LLVM generator/compiler, separation-logic/model assumptions and specified GMP operations. §5/6, pp.14–15: generated C/C++ header and LLVM are used by a handwritten command-line driver. Timing callbacks instrument exported LLVM. Decimal conversion/file writing use an unverified GMP routine. The correctness triple is not a verified filesystem-output, command-line parser or OS/hardware theorem. §6, pp.15–16: benchmarks use Clang 18.1.8 and a LEO5 node with two 32-core 2.60 GHz Xeon Platinum 8358 CPUs and hyperthreading, nominal maximum CPU factor 128. Comparison also uses Ryzen 9 9900X single/12-core and Ryzen 7950X3D 16-core. Reported relative performance improves with k; cluster code is slightly faster over roughly 3e5–5e6, but authors explicitly deny a statistically rigorous comparison. No confidence intervals, run counts or repeatability protocol are given. §§7–8, pp.16–17: the cited O(k² log^(2+o(1)) k) complexity and practical-record history concern Harvey’s algorithm, not a newly mechanized cost theorem in this paper. A later subquadratic prime-power algorithm lacks an implementation according to the authors at publication. The development totals 32578 LOC; about 6 kLOC/20% is mathematical core. No artifact build or independent benchmark replay was performed.
  • how much was read: most of it read
  • source
  • record id: verifying-an-efficient-algorithm-2025
• Verifying Datalog Reasoning with Lean (2025)
  • what: Lean 4 certificate checker for positive, function-free Datalog conclusions. Formalizes least-model and proof-tree semantics and their equivalence; verifies computable ground-rule matching and tree/DAG validation. Offers unordered hash-map graphs with verified DFS acyclicity/local checks and ordered arrays with backward-index references. Adds preliminary safe-rule model checking; evaluates certificates converted from Nemo traces. Separates checking individual derivations from checking closure/model completeness. Gives partial-substitution matching equivalence under inhabited constants, ordered-body indexing, a reusable DFS correctness invariant based on reachability from cycles rather than cycle membership, and compact topologically ordered proof graphs. Benchmarks show sharing can greatly reduce tree certificates, while explicit input facts are absent from the prototype JSON and must be treated as leaf assumptions.
  • limits: Datalog fragment has finite programs/databases, constants/variables/relations with fixed finite arities and no function terms. Signature constant domain may be infinite. Herbrand interpretations use unique names. Negation, aggregates, existential heads, datatypes and complex values are future work, not supported logic covered by this checker. Grounding maps every variable to a constant; computable matching uses partial substitutions. grounding_substitution_equiv explicitly requires Inhabited constants so unmatched variables can receive a default. Atom/relation comparisons and hash-based executable representations require suitable equality/hash instances. Tree validity uses ordered children exactly matching the grounded rule-body list, or a database leaf; empty-body rules can also justify leaves. It proves a supplied derivation of a fact, not completeness of a reasoner or all facts being listed. Program indexing by head/body relation sequence must contain the correct source rules. Unordered graph is complete as a data structure: every predecessor is a vertex key. Acyclicity plus locally valid nodes yields a proof tree for every vertex. This completeness means no dangling graph references, not completeness of logical consequences. All vertices checked, not merely one selected root. HashMap/HashSet DFS distinguishes current walk for cycles from fully verified nodes for sharing. Theorem9 is scoped to calls from the driver and valid verified-node invariant; no unrestricted correctness claim for arbitrary bogus cached sets/walks. Ordered arrays require each predecessor index strictly less than current index and validate local rule steps. §5 model check requires safe rules (head variables also appear in body). It checks all matching body substitutions against a finite candidate interpretation, with partial ground rule activeness invariant. This is unoptimized preliminary functionality, not the procedure whose scalability Table 1 establishes. Prototype JSON does not explicitly encode original database facts; every no-predecessor node is treated as an assumed fact. Thus validation is relative to those supplied leaf assumptions. It cannot catch an invented leaf unless original database membership is separately supplied/checked. Authors explicitly call for explicit facts for production. Input fact/rule ingestion from original sources such as CSV is outside certification scope. Python Nemo-trace conversion and JSON parsing are described but no verified parser/translation theorem is established here. Lean kernel theorem checking and compiled standalone execution are distinct trust paths; paper does not verify Lean compiler/runtime. Certificate soundness for selected facts is not complete materialization correctness. A sound certificate plus checked modelhood and inclusion of original database would establish least-model equality, but those conditions must all be enforced; benchmark selection 1000 GALEN conclusions is not verification of all 1.8 million facts. Ordered-check LogSpace statement is a theoretical encoding observation, not measured peak RAM or a proved bound on the actual loaded-array/JSON/Lean implementation. Table 1 sizes are compact JSON bytes, not resident memory. No formal runtime complexity proof of the complete prototype is supplied. Nemo reasoning baseline excludes tracing and cannot directly express total certificate-generation/translation/checking overhead. Checker times are whole prototype wallclock means 5 runs on one laptop; no dispersion, raw generation cost or extensive invalid-input dataset is reported. Reader ran no artifacts.
  • how much was read: most of it read
  • source
  • record id: verifying-datalog-reasoning-with-2025
• Verifying maximum link loads in a changing world (2025)
  • what: Velo computes a separate worst-case offered traffic load for each network link over specified failures and independent BGP egress changes. Strictly isotone routing reduces each destination’s worst case from arbitrary egress subsets to one egress; exception tunnels require combinations of their endpoints. A top-k heap limits changed destinations. Weighted normalized traffic clustering reduces matrix size with an absolute error bound. Rust prototype evaluation compares analysis time and approximation accuracy; a real ISP topology/configuration with synthetic demand illustrates configuration and capacity planning. Records full optimal-subpath/ECMP and exception-path proofs, topology-by-topology failure enumeration, independent-destination and iBGP visibility assumptions, route-change budget semantics, complete clustering bound proof and its unaddressed count-preservation issue, qualified Algorithm2 listing concerns, all Table1/2 numeric cells, real-data reconstruction limitations, exact QARC comparison scope, synthetic case-study demand, and contradictions between summary claims and printed maxima.
  • limits: §§2/3/9: Inputs are topology/router configuration, current external routes, ingress-to-prefix traffic matrix, admissible egress changes and failure scenarios. Predicted loads conditional on that demand matrix and allowed events, not probabilities of congestion or guarantee about future offered traffic. Different matrices require separate runs; optional total additional traffic y covers arbitrary additive uncertainty, not arbitrary correlation/protocol dynamics. §§3/9: All routers must learn preferred iBGP routes and preference-affecting attributes must not change on iBGP sessions. Egress abstraction inspects external ingress filters and LocalPref; other attributes can take arbitrary values/ties. Route visibility problems, aggregation and conditional advertisements coupling destinations are excluded. Requires correct mapping from configurations to all feasible egress subsets; no full BGP convergence/transient-safety proof. §3: Traffic splits equally across optimal next hops at each router, a fluid ECMP model. Not per-flow hashing, finite-flow imbalance, congestion feedback, queueing, TCP adaptation, packet scheduling or latency/bandwidth guarantees. Strict isotonicity means path ordering remains strict when same prefix/suffix weights added; positive acyclic shortest-path behavior is needed for DAG/topological propagation. No loops/negative-cycle generalization. §4 Theorem1: For each fixed topology, destination, link and nonemptyegresssetB, someb∈B alone produces at least as much linkload. Proof chooses egress preferred by downstreamv, uses optimal subpaths/next-hop set inclusion and equal-split reachability to show crossing fraction cannot decrease. Different links can need different egresses; outputs are individual maxima, not a single scenario simultaneously maximizing all links. §4.1.1 Algorithm1: Per-border-root forwarding DAG, initialize node load from Md, topologically add l[u]/outdegree to successors and take each edge maximum. Source complexity O(N²logN+NEP) per topology uses NB≤N; failure enumeration multiplies this by number of supplied failure states. Polynomiality is for fixed failure bound/limited exception endpoints, not arbitrary simultaneous failures. §4.1.2 Theorem2/Appendix A: Optimal paths plus configured exceptional source-to-egress paths; need subsetsT′ofexception-endpointsetT plus at most oneother egressto retainworstcase. Requires correct feasibilityfilter for simultaneously preferredBGPegresses. Complexity O(N²logN+2^|T|NEP), exponential in distinctexceptionendpoints; a small number in experiments does not imply universal polynomial scaling. Appendix A Algorithm2 printed listing: Builds Gdag[b] and merged Gfw, then calls TopoSort(Gdag), out(Gdag,u) as if Gdag were one graph. Likely intended Gfw but not specified. Global max y update is nested only inside ordinary forwarding-edge loop after adding exception contributions to y′; a tunnel-only edge with no active ordinary-forwarding edge may never update y. These are qualified listing concerns requiring implementation comparison, not reproduced artifact failures. §4.2: k counts destinations with changed egress set, not changed routers, BGP messages, individual advertisements or packet paths. Top-k largest per-prefix increases plus current load handles independence within one fixed failure topology. Maxima from different failure topologies cannot be summed per destination; Velo explicitly enumerates failure scenarios to preserve this coupling. §5: Cluster only prefixes with same current egresses and same forwarding for each feasibleegressset; stable/per-router restrictions and permitted egresses must also remain compatible. CentroidAi=ΣMd, error ε=.5Σd |Md| ||Md/|Md|−Ai/|Ai|||1. Zero-traffic columns/empty clusters require normalization convention not stated. Cluster count user-controlled; local heuristic need not find global minimum for computed bound to hold. Appendix B: Lemma1 equation proves nonnegative scalar homogeneity, despite calling max-load linear. Global additivity over arbitrary matrices is false in general because maximizing routing state can change; Lemma2 adds independent destination columns. Theorem3 decomposes centroid into proportionally weighted columns, conserves each destination total, bounds each load difference by moved mass and sums ε. Argument is handwritten, not a mechanized proof of Rust implementation. Appendix B/§§4.2/5 candidate scope gap: Proof decomposes maximum load as independent sum across all destinations and does not show preservation of finite k changed-prefix budget after many prefixes become one cluster. Example two identical unit-demandprefixes, same current egress avoidinge, same alternative through e, k1: originalmax1 versus treating their centroid as onechange gives2 whileε0. A correct implementation could retain per-prefix gain weights/counts insideclusters; paper does not describe this step or prove bounded-k refinement. This is an analytical countercase to naive composition, not observed tool output. §§2.2/5/9: Approximation δ is absolute difference of maximum loads, bounded by ε; percentages in evaluation normalized by total network traffic, not link capacity or each link’s worst-case load. Small global percentage can be large for a particular lowcapacitylink. Threshold safety needs conservative upper bound or margin ε; approximate point estimate alone may understate maximum. Additionaltraffic y simply adds y to each result, may overestimate if no ingress/destination sends100%throughlink; reported exact in>99.9%testedlinks. §9: Load is offered traffic sum along intended paths and may exceed capacity. Model does not propagate drops downstream, so congested-network outputs are not actual carried traffic. Useful for identifying capacity/route demands, not full queueing/congestion behavior. ACL handling described as easy extension, not implemented/evaluated claim; packet dropping can require a new monotonicity argument if egress-dependent path filters change. §9: Destination set fixed by input matrix/routing prefixes. New more-specific route can be analyzed only if disjoint traffic volumes supplied separately; no systematic exploration of arbitrary new subprefixes. Source-destination independence is an explicit model condition, not a universal BGP property. §6: Prototype≈7KRustLOC does not mean verifiedRust/Verus. Handwritten Theorems1–3 support abstraction algorithms under stated model; no parser/routing-engine/clusterer/code soundness proof, SMT proof certificate or independent mechanized check. All artifact/configuration experiments unrun here. §6.1:75largestTopologyZoonetworks40–754nodes/80–1790links; random30borderrouters, randomIGPweights10–100,300clusters,k10,l1/2,noexceptions. Largest1790linknetwork≤1minute l1 but≤3hours l2; othernetworks≤2minutes. Abstract/summary withinminutes omits this outlier. All failurecombinations enumerated; fourorders growth withsize/failurebound; naiveoneyearestimate is extrapolation, not a yearlongrun. §6.1: Cogentone-factorvariation:k10→100 costs1.3x,unlimitedk2.9xfasterbylessheapstate;C300→600/1000costs1.3/1.6x,C1001.2xfaster;NB30→1001.7x;30/50exceptionpathscost1.4/3.2x. One-at-time study does not measure all interacting worst cases. Disablingclustering≈1000xslowdown estimated for1Mdestinations, not actual exhaustive run. §6.1/Appendix D.1: QARCauthorsimplementationrerunwithrouterpairtraffic,10%additiveuncertainty,k0,onedestinationperegress,noclusters. Noexternalroutechanges testedincomparison becauseQARClacksfeature. Veloexactinthisspecifictest; QARCexact generally whereasVelo+clustering hasεbound. Subsecondat l≤2;10–100xfaster l3/4,15%QARC1hourtimeouts,Velowithin20minuptotwicesize. Authors expectQARCwinforlargel. Differentoutputs maximumloads versusviolationdetection complicatescomparison. §6/Appendix D.2: Main machine96CPUthreads/384GB; Figure8axis says64threads. Keep this hardwarecount discrepancy, do not silently assignallplots96threads. ExactCPUmodel,randomseedsandtimingrepetition/variance notspecified. Accuracy boxplotsmin/max/quartiles/mean not confidenceintervals. §6.2/Appendix C: Four5minuteSwitchNetflowslices,/24IPv4 or/48IPv6aggregation,95%trafficto.23%destinationsunusuallyskewedcomparedtoreference15%. Customerprefixmappingincomplete/nonunique affects≈30%traffic; sampledexternallinksnotcustomerlinks. Anonymizedinterfacesrandomlyassignedtorouters100ways. These are reconstructed matrices, not fullyidentifiedproductioningresstraffic traces. Appendix C.1: Gravitymodelrepulsion/attraction/frictionfitfrommatrixmarginals,residualratioandindependentLogNormalassumption. Printedtextalternatesµ0distributionnotationandµ1prose, thenµ0residualnotation. LogNormalwithfinitepositivefactorsdoesnotliterallyyieldzeros; heavy-tail matrix canbeeffectivelysparse. No uncertaintyintervalsforfittedσ. §6.2/Table1: Six140–200nodetopologies,20randommatricesperparameter/topology,30equivalenceclasses,300clusters. Printedmaxδ1.06%inrowrepulsion2.03 contradicts always<1%; printedmaxε12.18%friction2.51 contradicts below12%. Top-X printedmaximumratios3.7–63.7 ratherthanuniversal5–50; realrows3.7–4.3versusprose≈3.4. Preserveallcells anddistinguishmaxvaluesfrommeanredlines. §6.2/Table2: Maintextapproxerrorbound3.5→1.8% likelymean, whileTable2max7.34→3.71%; do notmixsummarymeanswithmaxlabels. C100hasmaxδ2.66%,so within1%claimonlyintendeddefault300andstillTable1has1.06%. δistotaltrafficnormalizedabsoluteerror,notrelativeerrorofeachlink. Appendix D.4: Figure9caption says typicallyover100xsmaller butCDFmedianδ/ε10.4%(≈9.6xsmaller),90th16.6%(≈6x),maxaxis36.2%. Body says≈10x, consistentwithmedian;100xcaptionunsupportedbydistribution. Errorboundpessimismnotuniformfactor guarantee. §7: ISP126routers/376links/10providerorIXProuters/~100institutions; actualrelevantconfiguration/topology butgeneratedgravity100Kprefixtrafficmatrix. ProposedthreeMPLSpaths/redundantIXPlink and64monitoringpairsare offlinewhat-ifrecommendations, notdeployedproductionchangesorobservedcongestionprevention. Initialalllinks<50%utilization; worstcasesnotassignedeventprobabilities. No distributedstate-machineimplementationverification, livenessproof, TLA+ model or LLM proof-generationevaluation. Primary contribution is mathematically justified performance-state reduction/errorbounding, withRustprototypeempirics; proof/code/modelboundaries and budgetpreservation makeuseful agentverificationtasks. §2.2 p.1272 versusEquation2 p.1275: Added d3=(.4,.3) clustered with d1=(3,4) produces actual example link-load difference.1Gbps; prose says bound.1. Formula gives centroid(3.4,4.3), reconstructed d1=(34/11,43/11), d3=(17/55,43/110), moved mass1/11each, summedε2/11≈.1818Gbps. Preserve prose/example/formula distinction; no artifact result.
  • how much was read: most of it read
  • source
  • record id: verifying-maximum-link-loads-2025
• Wang et al Chevalley presentation rewrites 2025 (2025)
  • title: Algebra Is Half the Battle: Verifying Presentations of Graded Unipotent Chevalley Groups
  • what: Authors report Lean 4 verification that full Steinberg relations for the A3, B3-small and B3-large graded unipotent Chevalley presentations follow from codimension-1, lifted and chosen definition relations. Proofs exhaust missing relation families using explicit group rewrites, interchange lemmas, degree casework and reflection. Automation controls simplification, generates boilerplate theorems and handles reassociation. The application to higher-dimensional expanders and a field-size-independent derivation bound are not formalized. Examines exact relation-vanishing theorem, bounded-degree dependent generator type, hand-enumerated roots and constants, relation-accessor/equation interfaces, chosen missing-root definitions, 15/21/26 absent commutator families, eight lift patterns, reflection reduction, representative degree cases, controlled simp/macros/grw behavior, missing Dehn-function bound and several visibly inconsistent informal notations.
  • limits: Formalized cases are fixed A3, B3-small and B3-large presentations, not all ranks or all Chevalley groups. B3-small has seven roots from base beta/psi/omega; B3-large has nine from alpha/beta/psi. Generators are triples (root, natural degree i, coefficient) with proof i≤height(root). Base roots have height 1. Generic interfaces use Ring R, while concrete weak definitions use Field F and divide by 2; odd characteristic is explicitly required in the matrix discussion. Printed top-level excerpt omits surrounding typeclass/characteristic context, so this record does not infer arbitrary-ring validity of the final theorem (§3–4). Full relations include linearity for each root/degree, mixed-degree commutation for each root, and commutator relations for distinct roots with constants and degree sums. Commutator convention is ghg^-1h^-1. Unipotent positive-root restriction avoids diagonal/opposite-root relations. Monomial generators represent polynomial generators under linearity and mixed-degree rules. Extension parameter m used to motivate matrix families is absent from the formalization; no formal infinite HDX family construction follows (§3). Weak presentation has codimension-1 relations, images of ungraded present-root relations under lifting, and explicit missing-root definition words. Codimension-1 commutator relations require the pair to lie together in an appropriate two-base-root span: alpha+beta and beta+psi are individually present but their mutual commutator is excluded. The prose phrase every pair of distinct present roots is therefore too broad without the common-span condition shown by its own example. A fixed definition expression e is chosen; general invariance under arbitrary admissible e remains future work (§3.3). PresentedGroup is FreeGroup T modulo Subgroup.normalClosure rels. The exact displayed B3-large theorem states every full relation projects to identity in weakB3LargeGraded. Paper states this yields isomorphic weak/full presentations. This is an equality/consequence result for encoded presentations; the printed theorem is not itself a formal spectral/topological expansion theorem or a displayed matrix-representation isomorphism. Reader did not audit all definitions or execute source (§4). PositiveRootSystem excerpt only packages a height map; concrete roots and additive relationships are manually enumerated rather than obtained from general root-system geometry. This avoids partial addition/Option obligations and makes degree constraints easy for ht/omega, but authors acknowledge scaling limits. PartialChevalleySystem stores present roots and zero-/single-/double-span root pairs, with handwritten roots/constants later checked. Classification is tailored to A/B systems; more complex systems need more fields. Typechecker feedback alone should not be generalized to certification that every intended geometric root/constant was encoded correctly (§4). GradedPartialChevalleyGroup adds liftedRels and define to the partial system; define is identity on present roots and must commute with lifting. In full case liftedRels empty/define identity. Weak B3-large uses an explicit five-factor word with -1/2,1,-t for alpha+beta+psi, and commutator words for alpha+beta+2psi and alpha+2beta+2psi. split3/4/5 partition total degree into legal component degrees, preserving i=j+k. Definitions, not an automatically discovered arbitrary presentation, determine proof targets (§4). Three presentation-interface obstacles are handled explicitly: unpack one union of relation subsets into accessors; move from free-group relators to equations inside the quotient; turn r=1 relators into rewrite-friendly r1=r2 equalities by an equivalence lemma. Double-span relation has degree i+j and i+2j terms with coefficients C1tu and C2tu*u. These interfaces let rw/simp and standard group facts act on the right objects (§4). Authors derive each missing relation family individually: missing commutator counts 15 A3, 21 B3-small, 26 B3-large. These counts are root-pair relation families parameterized by coefficients/degrees, not just 62 individual scalar equations. A3 and small B3 each have one missing root, large B3 has three. Interchange lemmas shuffle degree/coefficient choices; eight are obtained by the 2^3 base-degree 0/1 lifts. Others require explicit rewriting. Several relations need separate concrete degree pairs (§5). Representative B3-small linearity proof expands the missing-root definition, commutes the target across smaller-root factors, combines linear terms and contracts to the desired generator. Printed Lean lin_of_beta_psi_omega follows these specified steps via grw, not autonomous search. For alpha commuting with the highest B3-large root, paper lists 00/01/02 and nine further degree cases (12 before reflection). Involution i↦height(root)-i preserves relations and derives the other half; this is a symmetry reduction, not a universal decision procedure (§3.1, §5). Automation has three parts. chev_simps controls linearity/identity/inverse normal forms without unrestricted simplification; height_simps plus omega discharges height arithmetic. Theorem macros generate names/statements/proofs for repeated linearity/identity/inverse, commuting and reflected consequences, removing 3–10-line boilerplate. greassoc_of% adapts category-theory reassociation by left multiplication. grw first tries a supplied rule directly, then its reassociated form, then project-specific simplification. General group multiplication is not assumed commutative; mul_comm in the exposition is an illustration of a supplied equality, not permission to commute arbitrary group elements (§6). Authors report faster development/compilation and readability/maintenance from automation, but no timings, controlled baseline, effort totals or automation success rate. Few thousand proof lines and 80 source-calculation pages are approximate descriptive counts. Macros generate checked proof scripts, not a reported LLM workflow; bounded exhaustive rewriting search is proposed future work. grw is expressly project-specific (§1, §6–7). Critical omitted result: quantitative HDX application needs a Dehn-function bound for deriving full relations from weak ones independent of field size q. Formalization establishes derivability, not this bound. Authors describe source papers as observing derivations lack field dependence, but do not formalize accumulated rewrite length or the HDX corollary. Proposed proof-length tracking tactics would address this gap. Spectral expansion and topological expansion differ in higher dimensions (§2, §7). Reader source caveats, visually confirmed: Definition 5 says q=p^m while quotienting by an irreducible polynomial of degree m+1; standard quotient cardinality would instead be p^(m+1). §3.3 calls G prime the ungraded group but prints lift G→G prime while text says ungraded→graded. Worked example p. 7 has a missing negative sign in the prose commutator expansion and swapped degree-split bounds relative to its stated beta/psi+omega heights; subsequent displayed derivation uses negative 1. These are informal exposition inconsistencies, not demonstrated failures of linked Lean code. Quotes retain original text rather than silently repairing it. Additional reader scope caution: p. 6 footnote broadly says all quadratic forms are equivalent in odd characteristic; this is not generally true over finite fields. Its purpose is explaining the displayed split orthogonal form, not the presented relation-vanishing theorem. Paper excerpts have omitted proof/context and inconsistent shortened class/type names, so they should not be treated as a standalone compilable file. No artifact replay, source axiom audit or independent matrix/geometry verification was performed. Future work includes general An, B4/C3, diagonal/non-unipotent presentations, general root-addition API and bounded proof search. Those are plans, not delivered cases. No Rust/Verus/TLA+ result, distributed-system safety/liveness experiment, LLM model or proof-agent benchmark appears. Relevance is checked rewriting infrastructure and the distinction between proving equations and certifying quantitative application requirements.
  • how much was read: most of it read
  • source
  • record id: wang-et-al-chevalley-presentation-rewrites-2025-2025
• A Formal Model to Prove Instantiation Termination for E-matching-Based Axiomatisations (2024)
  • what: # E-matching instantiation termination: whole chapter reading (authored by agents unless marked 🧑) Rui Ge, Ronald Garcia and Alexander J. Summers’s chapter is IJCAR 2024, LNAI 14739, pp.419–438, DOI 10.1007/978-3-031-63498-7_25. The saved candidate’s 2023/FM metadata is incorrect; the PDF and publisher identify 2024/IJCAR. All 20 pages were read: six sections and every subsection, Definitions 1–11, Examples 1–5, Theorem 1, acknowledgments, 27 references and the CC BY 4.0 notice. There are no numbered figures, tables, algorithm listings or appendices in this chapter. The extended technical report arXiv:2404.18007 is reference 13, not part of this completed chapter reading. Its complete axiom list, invariants and supporting proofs were not read here. [Evidence: Q0, frontmatter/abstract/publisher identity, PDF pp.1–1; Q1, §1 introduction/contributions/scope/technical-report pointer, PDF pp.1–3; Q18, complete references1–27, PDF pp.18–20; Q19, CCBY4 open-access notice, PDF pp.20–20; exact source and character/LF/page anchors in quotes.json.] The authors address matching loops in trigger-guided quantifier instantiation. They explicitly distinguish instantiation completeness, meaning the necessary proof instances can be made, from instantiation termination, meaning no endless sequence of instances; “In this paper, we focus on instantiation termination.” The contribution is an operational model, a termination argument for an adapted set axiomatisation, and a method for building such arguments. There is no reported runtime benchmark, solver performance comparison, mechanized proof certificate or implementation refinement proof. Avoiding all instantiations would terminate trivially but fail the intended usefulness requirement, as the authors’ footnote explains. Termination is not a proof of completeness, set-library correctness or a distributed protocol’s correctness. [Evidence: Q1, §1 introduction/contributions/scope/technical-report pointer, PDF pp.1–3; Q17, §6 conclusion/future work/acknowledgments, PDF pp.18–18; exact source and character/LF/page anchors in quotes.json.] Examples 1 and 2 show why equality, history and case splitting matter. The trigger [diff(s1,s2),member(x,s2)] requires both terms, with consistent variable assignments modulo known equality. Knowing a=c lets diff(b,c) and member(t,a) support the match (b,a,t); recording it prevents the equivalent later match (b,c,t). Changing the trigger to [member(x,s1),member(x,s2)] initially gives four combinations from two member applications. Instantiating produces a clause but does not alone populate the E-graph with all its literals. Splitting that clause can assume ¬member(t,diff(b,a)), making the term member(t,diff(b,a)) known and enabling five new combinations and an indefinitely repeatable pattern. These are worked logical cases, not measured solver runs. [Evidence: Q2, §2.1 E-matching/Examples1–3 including §2 introduction, PDF pp.3–5; exact source and character/LF/page anchors in quotes.json.] Example 3’s subset-elimination axiom adds a second difficulty: instantiating the outer variables can introduce an inner quantifier. Its inner [member(x,s1)][member(x,s2)] denotes alternative triggers, so either shape suffices; it is not the conjunction used inside one comma-separated trigger. A termination bound must anticipate newly introduced quantifiers and their possible instances, as well as terms. The model abstracts solver choices rather than claiming to reproduce one configured solver. [Evidence: Q2, §2.1 E-matching/Examples1–3 including §2 introduction, PDF pp.3–5; Q3, §2.2 model objectives, PDF pp.5–6; Q9, §3.6 nested tags/equality-aware deduplication, PDF pp.11–11; exact source and character/LF/page anchors in quotes.json.] Definition 1 assumes preprocessing to extended conjunctive normal form and Skolemisation of existentials. An extended literal is an ordinary literal or a tagged universal quantifier; extended clauses are disjunctions and formulas are conjunctions of them. Every trigger set is nonempty, covers every bound variable, and each term contains a bound variable and an uninterpreted function application; interpreted function symbols are excluded from triggers. The initial input is therefore not arbitrary unprocessed SMT syntax. Definition 2 states are current tagged quantifiers W, current clauses A and E-state E, or the terminal saturated/inconsistent markers. [Evidence: Q4, §3 introduction/§3.1 syntax/Definition1, PDF pp.6–7; Q5, §3.2 states/Definition2, PDF pp.7–7; exact source and character/LF/page anchors in quotes.json.] Definitions 3–4 replace a concrete congruence-closure implementation with an E-interface. Its judgments track known terms and equalities/disequalities, including known subterms and equality substitution; extending it adds literals with the required closure. Positive/negative predicates are represented using equality to Boolean true/false. A basis chooses one representative per known equivalence class. A finite number of classes does not imply only finitely many syntactic terms, and a finite basis at each step does not alone prevent unbounded growth across steps. This last limitation is explicit in the related-work discussion. [Evidence: Q6, §3.3 E-interface/Definitions3–4, PDF pp.7–8; Q16, §5 complete related work, PDF pp.17–18; exact source and character/LF/page anchors in quotes.json.] Definitions 5–7 pair the E-interface with an instantiation history containing a quantifier tag and a tuple of ground terms. A candidate is enabled only when an appropriate trigger matches known terms and no prior instance with that tag has a pointwise equal tuple under current equalities. History thus blocks semantic duplicates, not merely identical printed expressions. Example 4 applies this to (b,a,t)/(b,c,t). The model’s counting argument depends on preserving this history discipline. [Evidence: Q7, §3.4 E-history/E-matching/Definitions5–7/Example4, PDF pp.8–9; exact source and character/LF/page anchors in quotes.json.] Definition 8 has four transition rules. Split chooses a nonempty collection of disjuncts from currently unsatisfied clauses and must make progress; it adds ordinary literals to the E-interface and quantifiers to W. Instantiation selects an enabled match, puts unit literals/quantifiers directly into their components, keeps non-unit clauses in A and records the instance in history. Bot ends an inconsistent state. Sat ends a consistent state with assumed satisfaction of every current clause and no enabled instances. Instantiation and splitting may interleave without a fixed order or fairness requirement for this case. Reader scope limit: the saturated marker records this trigger-relative exhaustion; the chapter does not establish first-order satisfiability or completeness from it. [Evidence: Q8, §3.5 all four transitions/Definition8, PDF pp.9–11; exact source and character/LF/page anchors in quotes.json.] Section 3.6 parameterizes an inner quantifier’s tag by all outer bound variables. Instantiating an outer quantifier substitutes those tag parameters as well as its body. Both insertion of new quantifiers and history-enabled matching compare tags modulo equality of their parameters. This prevents equivalent outer instances from creating fresh identities that evade deduplication. These details are part of the abstraction; the full definitions are delegated to the technical report. [Evidence: Q9, §3.6 nested tags/equality-aware deduplication, PDF pp.11–11; exact source and character/LF/page anchors in quotes.json.] The present transition system excludes interpreted-theory reasoning: “our rules do not yet account for (interpreted) theory reasoning.” Section 3.7 proposes adding abstract deduction transitions and possibly fairness constraints later. Reader scope limit: the four displayed rules also have no explicit CDCL backtracking/restart, clause deletion, MBQI or concrete solver implementation state. Applying the chapter’s termination argument to all behavior of an actual Z3/cvc5 run requires explaining those additional operations and their correspondence to the abstraction. The advertised abstraction should not be silently treated as a verified implementation of either solver. [Evidence: Q8, §3.5 all four transitions/Definition8, PDF pp.9–11; Q10, §3.7 interpreted-theory exclusion/proposed extensions, PDF pp.11–12; Q17, §6 conclusion/future work/acknowledgments, PDF pp.18–18; exact source and character/LF/page anchors in quotes.json.] The case study adapts Dafny/Viper set axioms rather than proving the unchanged production libraries. It uses 12 uninterpreted functions, removes cardinality because that depends on external linear arithmetic, and splits bidirectional definitions into separate introduction/elimination implications with independent triggers. Example 5’s union elimination offers one single-term trigger and two alternative multi-term triggers. The authors aim for broader useful matching while preserving termination; completeness remains a separate goal. The complete axiomatisation/comparison is only in technical-report Appendices C.1/C.2, so this chapter reading does not audit every axiom. [Evidence: Q11, §4 introduction/§4.1 adapted set axioms/Example5, PDF pp.12–13; Q10, §3.7 interpreted-theory exclusion/proposed extensions, PDF pp.11–12; exact source and character/LF/page anchors in quotes.json.] Section 4.2 classifies axioms by whether they generate new quantifiers or new term-equivalence classes. Most are non-generative. Union elimination yields Boolean literals whose non-Boolean subterms were already known through the trigger; under this model Boolean literals do not add new classes. Four generative non-nested introduction axioms can create Skss(s1,s2), Skeq(s1,s2), Skdj(s1,s2) or Skie(s), respectively for subset, extensional equality, disjointness and emptiness. Their new terms have element sort T, not Set(T). Subset/disjointness/emptiness elimination instead can introduce nested quantifiers without new ground classes. Counting only currently enabled matches can therefore increase and is insufficient. [Evidence: Q12, §4.2 axiom classification/generative cases/footnote9, PDF pp.13–14; exact source and character/LF/page anchors in quotes.json.] Definitions 9–10 forecast the remaining work. O1(B) is the set-sorted basis. O2(B) contains the element-sorted basis plus every possible application of the three binary and one unary Skolem functions over O1(B). Potential match sets then cover original quantifiers and parameterized inner quantifiers, including those not yet introduced, while excluding history-equivalent instances. This reserves a finite budget for future Skolem elements and quantifier identities before they appear. Definition 11 uses the lexicographic pair (total size of these potential match sets, number of unsatisfied current clauses), with terminal states assigned (-1,-1). The intended argument makes the first component decrease at instantiation; splitting does not increase it and decreases the second. Its justification requires the invariants, not merely finiteness of each intermediate basis. [Evidence: Q12, §4.2 axiom classification/generative cases/footnote9, PDF pp.13–14; Q13, §4.2 future-term and nested-match budget/Definitions9–10, PDF pp.14–15; Q14, §4.2 lexicographic measure/Definition11, PDF pp.15–16; Q15, §4.3 invariants/Theorem1/proof-scope pointer, PDF pp.16–17; exact source and character/LF/page anchors in quotes.json.] Section 4.3 separates general invariants from case-specific ones. History entries must refer to existing quantifiers, have the right arity, and contain known terms and a known matched trigger. The set-specific clause-origin example connects a union-elimination clause back to its recorded generating instance, showing why later splitting does not introduce an unbudgeted term. Theorem 1 starts with the tagged set axioms, no current clauses, E-interface extended by ground literals L and empty history; every transition sequence has finite length. The chapter states the theorem and proof method but sends the detailed supporting invariants and induction to technical-report Appendix B. The theorem says “arbitrary set of ground literals”; this reading interprets the result for finite SMT input, consistent with the finite-basis/counting argument, and does not extend it to an infinite set of distinct ground terms. A footnote calls extension to initial ground clauses straightforward; it is not the displayed theorem here. No independent complete proof validation is claimed. [Evidence: Q15, §4.3 invariants/Theorem1/proof-scope pointer, PDF pp.16–17; Q12, §4.2 axiom classification/generative cases/footnote9, PDF pp.13–14; exact source and character/LF/page anchors in quotes.json.] The evaluation is this mathematical case study, not an empirical campaign. Section 5 compares the model with Dross et al.‘s instantiation trees and fairness/eager-theory assumptions; the claim that larger tree constructions would be complex is the authors’ belief, not a measured comparison. Axiom Profiler is distinguished as run debugging with empirical evidence, which cannot establish absence of matching loops on every input. The conclusion leaves interpreted-theory interactions, fairness-dependent examples and instantiation completeness to future work. References identify related sources without establishing that this reader has read them. [Evidence: Q16, §5 complete related work, PDF pp.17–18; Q17, §6 conclusion/future work/acknowledgments, PDF pp.18–18; Q18, complete references1–27, PDF pp.18–20; exact source and character/LF/page anchors in quotes.json.] For Verus/verified Rust and LLM proof agents, the concrete contribution is a way to specify and reason about trigger behavior: distinguish AND multi-triggers from OR alternatives, match modulo equality, retain history across equality merges, identify nested quantifiers and budget future Skolem terms. Reader proposals include evaluating whether generated proof code preserves those contracts and whether a termination claim merely disables useful instantiation. A distributed-system set encoding could reuse the method only after checking its own axioms, input restrictions and solver abstraction; no Verus, Rust, TLA+, distributed protocol or LLM experiment is reported in this chapter. No author code or scientific-result artifact was executed/imported/loaded, and no compiler, checker, solver, prover or model checker was run. [Evidence: Q2, §2.1 E-matching/Examples1–3 including §2 introduction, PDF pp.3–5; Q7, §3.4 E-history/E-matching/Definitions5–7/Example4, PDF pp.8–9; Q9, §3.6 nested tags/equality-aware deduplication, PDF pp.11–11; Q12, §4.2 axiom classification/generative cases/footnote9, PDF pp.13–14; Q13, §4.2 future-term and nested-match budget/Definitions9–10, PDF pp.14–15; Q15, §4.3 invariants/Theorem1/proof-scope pointer, PDF pp.16–17; Q17, §6 conclusion/future work/acknowledgments, PDF pp.18–18; exact source and character/LF/page anchors in quotes.json.]
  • limits: finitepreprocessedgroundinput/triggerrestrictions/historydedupmodulocongruence/nestedtagparameters/adaptedsetaxioms/nointerpretedtheory/cardinality;chapterproofmethodandtheoremnotfullTRproofaudit/actualsolverrefinement/completeness
  • how much was read: most of it read
  • source
  • record id: a-formal-model-to-2024
• A Generalised Union of Rely–Guarantee and Separation Logic Using Permission Algebras (2024)
  • what: GenRGSep is an Isabelle/HOL library generalizing rely-guarantee separation logic to resource models without guaranteed units or cancellativity. It supplies permission/multi-unit/single-unit algebra classes,compositional resource constructions,a generic relational-action concurrent language,explicit stabilization operators,and a reported mechanized operational soundness theorem. Identifies why Vafeiadis-style operational safety nearly extends to noncancellative resources but needs stronger preservation of local state on silent framed steps when external choice retains its surrounding command. Conjunction still needs all local resources cancellative. Distinguishes a weaker atomic framing condition from requiring the atomic relation to admit the corresponding unframed transition. Paper’s result concerns the generic logic/library,not a production implementation.
  • limits: Permission algebra requires partial commutativity/associativity,compatibility laws and positivity;it need not have units or cancellation. Multi-unit and single-unit classes add those respective structures. Total HOL addition is only constrained by algebra laws on compatible resources;behavior on incompatible sums cannot silently be used as valid resource composition. Proof system works over local/shared state pairs and relational atomic actions. Environment rely relation constrains shared changes;guarantee constrains observable updates. Local state splits under parallel composition while shared state remains common. Instantiating a real language requires sound resource and atomic-action models beyond this generic framework. Theorem2 says a derivable triple and its precondition imply safe n for every finite n. safe enforces postcondition only when command is skip,checks rely/program/framed steps,and records observable guarantee updates. It does not prove termination,fairness,progress,deadlock freedom or network-fault tolerance. Conjunction rule retains a global side condition:every possible local state must be cancellative. Removing cancellation from the base algebra does not make all standard conjunction reasoning available over arbitrary noncancellative instances. Silent τ transitions must preserve the same unframed local resource in the strengthened frame-safety clause. This is essential to the external-choice proof;allowing merely some decomposed residual resource is insufficient. Observable updates generate guarantee obligations without forcing guarantee reflexivity for silent actions. Predicates are shallow HOL functions;rely/guarantee,stabilization and atomic proof obligations are supplied mathematical relations/predicates. Paper reports an Isabelle mechanization and supplies GitHub/SWH artifact,but does not demonstrate an automated verifier,code extraction or verified compiler connection. The supplied PDF has substantial apparent notation/rule inconsistencies detailed in reader caveats. The record distinguishes the authors’ mechanized-soundness claim from the displayed formulas;no artifact execution checks which formulation is implemented. Displayed rules alone should not be treated as a coherent independently validated formalization.
  • how much was read: most of it read
  • source
  • record id: a-generalised-union-of-2024
• A Verified Earley Parser (2024)
  • what: Isabelle/HOL formalization of an inductive Earley recognizer, refinement through a bin-wise fixed-point algorithm to executable functional lists, and a pointer-guided parser producing one parse tree. Recognizer correctness and successful parse-tree existence equivalence require terminal-only input and an epsilon-free grammar. Returned-tree soundness and a termination argument are proved for generated pointer structures. Explains why one-pass list-bin processing misses completion opportunities for epsilon rules and retains an explicit epsilon-free premise. Separates item equality, refinement, pointer invariants, single-tree soundness and tree-existence equivalence from enumeration of all parses. Uses first reduction-pointer monotonicity to terminate even for cyclic grammars; gives informal O(n^4) time and O(n^3) pointer-space estimates, rather than attributing optimal Earley bounds to this implementation.
  • limits: Grammar is a finite rule list plus start symbol over a common symbol type. Nonterminals are all rule LHS symbols plus the start symbol; terminals are the remaining symbols. is_word G omega excludes nonterminals from the input. Abstract item completeness and correctness explicitly assume is_word. The inductive Earley specification supports epsilon rules, but executable Earley_eq_Earley_L, correctness_recognizer and correctness_build_tree_Earley_L require epsilon_free G: every RHS is nonempty. Lifting this restriction is future work. No verified epsilon-elimination preprocessing is delivered here. Each bin contains distinct items with end index equal to bin index. List insertion appends new items and merges reduction pointers into existing entries. Termination of bin processing relies on well-formed bounded items and finite candidate counts, not arbitrary malformed bin arguments. build_tree_prime termination requires wf_tree_input: sound_ptrs, mono_red_ptr, valid bin/input indices and valid entry index. Pointer soundness includes earlier origin bins for reductions, bounds and operation semantics. Only the FIRST reduction triple is required to have a strictly earlier reduction entry within the current bin. wf_item_yield_build_tree_prime additionally assumes wf_bins. Returned-tree corollary assumes epsilon_free and successful build_tree over Earley_L-generated bins, and proves rule-tree well-formedness, start root and full input yield. Existential successful tree iff derivation additionally assumes is_word. The algorithm extracts one parse tree, not a forest enumerating every ambiguous or cyclic derivation. Nevertheless the final theorem DOES establish existence of a returned tree iff a valid derivation exists under its premises. The phrase no completeness for trees concerns all possible trees, not failure to recognize some valid word. Partial functions in HOL use domain-theoretic definitions; termination is proved on stated valid inputs. Option None representing undefinedness is not a runtime detector that can return after discovering an infinite computation. Arbitrary externally supplied pointer cycles are outside the proved termination domain. Complexity is explicitly informal with fixed grammar: rule count and maximum RHS size are constants. More than 6,000 formalization lines are reported, but no formal complexity theorem or proof-effort breakdown is supplied. Scala extraction and execution do not constitute a verified compiler/runtime chain. Evaluation measures the exported recognizer, not a full byte-level lexer or full parse-tree production pipeline. Five toy grammars, unary inputs a^n and ten-run means do not establish representative production workload performance. Hardware, Scala/JVM versions, exact source dataset, variance and raw timings are not supplied in §7. Imperative cached refinement, grammar indexing, next-symbol grouping and epsilon support remain future work. No Verus, Rust, TLA+, distributed-system implementation or LLM agent is evaluated.
  • how much was read: most of it read
  • source
  • record id: a-verified-earley-parser-2024
• Affeldt Stone Coq Lebesgue differentiation 2024 (2024)
  • title: A Comprehensive Overview of the Lebesgue Differentiation Theorem in Coq
  • what: Affeldt and Stone report Coq/MathComp-Analysis formalization of the real-line Lebesgue Differentiation theorem, implying the first Fundamental Theorem of Calculus for integrable real functions almost everywhere and the density theorem for measurable real sets. Supporting work connects subspace/uniform-convergence topology, extended-real filter limits, regularity/Egorov/Lusin/Tietze, continuous L1 approximation and a finite Vitali covering argument for the Hardy-Littlewood inequality. A new Urysohn proof uses coarser uniform separators and reusable gauge-pseudometric infrastructure. Main theorem scripts and statements total approximately 1,497 lines, excluding uncounted supporting theories. Reads exact local-integrability/Lebesgue-point/FTC/density premises; explicit bounded-support localization and two error estimates; full-carrier subspace design preserving arithmetic; weak-topology uniform function alias; right-filter tactic issue; finite-measure versus prose boundedness; separator equivalence and gauge construction; finite ball selection with factor 3; unused infinite covering results; all table counts and future second-FTC scope.
  • limits: Main theorem is real-valued f on realType with Lebesgue measure on the real line, assuming locally_integrable [set: R] f. Definition requires measurability, open domain and finite integral of absolute value on every compact subset. It concludes a.e. Lebesgue points, not differentiability of every integrable f itself. Lebesgue point means average |f(y)-f(x)| over centered open balls tends to zero as positive radius tends to zero. iavg is average absolute value; davg centers f first. Extended-real fine maps infinities to 0, so meaningful normalization relies on the finite positive ball measures used under radius premises (§2–3). First FTC result assumes global integrability of f. FTC1_lebesgue_pt differentiates its variable-upper-bound integral at a Lebesgue point x with lower interval bound a<BRight x; bound type handles open/closed finite lower endpoints and negative infinity. Corollary FTC1Ny integrates over ]-infinity,x] and asserts derivative=f(x) a.e. Direction 1 is the derivative direction, not an extra smoothness hypothesis. Proof uses a nicely-shrinking-set generalization. No continuity of f is needed, and the result is not differentiability everywhere (§10.1). Density theorem assumes only measurability of A, not finite total measure. It concludes local ball-volume ratio converges a.e. to indicator_A(x), hence 1 inside A and 0 outside up to a null set. This local consequence uses the indicator as locally integrable, not global integrability of an infinite-measure set (§10.2). Proof localizes f to f_k=f*indicator_(ball 0 [2(k+1)]), obtains a.e. Lebesgue points in each ball, and uses countable localization for the full line. Positive-threshold limsup exceptional sets are controlled through continuous approximation: Markov bounds approximation error and Hardy-Littlewood bounds maximal error. Continuous L1 density depends on Lusin/Tietze, while maximal inequality uses regularity/finite Vitali. The overview explicitly identifies bounded-to-general steps often omitted in informal notes (§4, Figure 1). Subspace A is a type alias for the entire carrier T, not the subtype of points satisfying A. Neighborhoods restrict ordinary neighborhoods within A for points of A; outside A the topology is discrete. Thus continuity depends only on values within A while x+eps remains well-typed for arbitrary numeric carrier values. Hierarchy-Builder factories assemble proper-neighborhood/topological laws. This avoids needing A closed under addition; it does not assert x+eps remains in A (§5.1). Uniform_fun A V aliases all U→V functions, then pulls back uniform convergence on restricted functions via sigL_arrow and weak_topology, copying the uniform structure using Uniform.copy. Values outside A are ignored by the induced convergence condition. Extended-real limsup extends sequence-only infrastructure to arbitrary filters as inf_V_in_F sup(f[V]), specializing to deleted real neighborhoods and right-radius limits. Development exposed/fixed near-tactic right-filter handling quirks; no performance numbers are reported (§5.2–5.3). Egorov, outer/inner epsilon-regularity, Lusin and continuous L1 approximation formally use finite-measure hypotheses mu A<+infinity or mu D<+infinity, with measurability and positive epsilon; they do not formally require geometric boundedness. Prose repeatedly says bounded, which is stronger for real Lebesgue sets. Egorov additionally assumes measurability of each function and limit and a.e. pointwise convergence. It obtains uniform convergence outside a measurable epsilon-small set. Inner-regularity supremum version removes finite-measure restriction by sigma-finiteness (§6, §8). Uniform_separator A B means some uniform structure coarser than original topology has an entourage avoiding A×B. uniform_separatorP equates this with a continuous function into [0,1] taking 0 on A and 1 on B. No normal-space assumption appears in that equivalence; normality plus closed/disjoint sets supplies a separator, yielding Urysohn. A point outside a closed set in a uniform space supplies another separator, yielding complete regularity. Range/image inclusions support empty sets without needing equal nonempty singleton images (§7.1). New Urysohn proof replaces explicit rational-index induction with a countable entourage basis/gauge pseudometric, extended distance to A and truncated distance function min(d(A,x),epsilon)/epsilon. Coarser uniform topology ensures continuity in original topology. For normal spaces basis relations are U2×U2 union complement(closure U1)×itself, indexed by nested opens A subset U1, closure U1 subset U2. Most work proves a coarser uniformity and a separating entourage. Additional countable-product metrizability and uniform-space complete regularity are reusable consequences, not all needed by the differentiation proof (§7.2, Figure 2). Tietze theorem formally assumes normal X, closed A, f continuous within A, positive M and |f|≤M on A; extends to global continuous g equal to f on A with same bound everywhere. Uniform limits preserve continuity. Lusin gives compact K subset A, small measure A minus K, f continuous within K, via Egorov/inner regularity. Combined Lusin/Tietze yield globally continuous g_n integrable on A with L1 error over A tending to 0; proof then restricts approximants to localization ball. No stronger all-space globally integrable approximant conclusion is inferred (§8). Finite Vitali lemma takes a list of indices for nonempty sets satisfying is_ball. It returns duplicate-free sublist D of disjoint selected balls; each original ball intersects a selected ball of at least its radius and is contained in its triple-radius dilation. Set-based predicate avoids committing to center/radius-pair representation; cpoint/radius recover witnesses. Infinite Vitali lemma and covering theorem were also formalized but are expressly unnecessary for this differentiation proof (§9.1). Hardy-Littlewood operator is supremum over positive-radius averages of |f|. Formal weak-type bound: measure{x:HL(f)(x)>c}≤(3/c)*norm1(f) for locally integrable f and c>0. Global norm may be infinite, making bound uninformative in that case; useful quantitative estimates apply to localized/integrable functions. Factor 3 comes with one-dimensional ball cover. Lower-semicontinuity theory establishes measurability of maximal operator (§9.2). Table 1 counts approximate lines including theorem statements for selected main/intermediate lemmas: 87,61,118,108,108,118,75,180,165,143,265,69, summing to 1,497. Subspace and uniform-convergence support are explicitly N.A., not zero effort. Counts depend on boundary between lemmas and supporting theories, so total is not complete project size, human effort, automation throughput or runtime. No controlled benchmark, proof-generation rate or LLM intervention is described (Table 1). Reader exposition caveat: Lusin prose p. 12 prints measure(K minus A)<epsilon while K subset A, which is vacuous; exact formal lemma correctly prints measure(A minus K)<epsilon. This record follows the formal statement. Similarly formal finite-measure premises are preserved over prose shorthand bounded. These are distinctions in supplied paper, not evidence of source-code proof failure (§6–8). MathComp-Analysis extends MathComp with classical axioms. Paper supplies exact declarations, proof outlines, repository/archive and source-file pointers, not complete printed proof scripts or an independent axiom/build audit. Reference snapshots list MathComp-Analysis 1.2.0 and MathComp 2.2.0 (2024), and Coq manual 8.19.2; these references alone do not pin a tested build configuration. Artifact archive 603335be2da03f1a37b210f027047f94aa0ed2c6 identifies supplied source; reader did not execute it. Authors explicitly acknowledge mathlib differentiation statements are more general in domain/measure/codomain/Vitali-family formulations and sometimes stronger differentiability conclusions. Comparative claims describe cited 2024 snapshots and were not rechecked against current libraries. Their belief that Banach-space generalization should be engineering work is a proposal, not completed generality. Second FTC for absolutely continuous functions is future work using Radon-Nikodym plus bounded/total variation (§11–12). No distributed protocol, Verus/Rust/TLA+ result, software safety/liveness evaluation or LLM proof agent appears. Relevant evidence is human proof-engineering decomposition, exact semantic hypotheses, reusable topology interfaces, proof-gap repair and library integration. Authors claim first Coq Lebesgue first-FTC formalization; reader has not independently established priority.
  • how much was read: most of it read
  • source
  • record id: affeldt-stone-coq-lebesgue-differentiation-2024-2024
• Alpha-Beta Pruning Verified (2024)
  • what: Reports Isabelle verification of fail-hard, fail-soft and Bird–Hughes alpha-beta tree-search variants, for bounded linear orders and bounded distributive lattices. Compares window-relative correctness relations, proves fail-soft at least as informative as fail-hard while searching the same part of the tree, and generalizes single-function negamax using involutive order-reversing negation. An extended abstract of formalization results, not a complete algorithm/proof presentation. Preserves exact orientation and strength of three window relations, full-window equality, linear-order versus lattice hypotheses, de Morgan negation requirements, distinction between value correctness and search-space efficiency, and the private Quickcheck evidence behind a claimed suboptimal program. All displayed claims and scope limits read; no artifact verification claimed.
  • limits: §1: Two-player game trees with mathematical valuation val(t). Calling convention f(a,b,t) uses search window(a,b). No code, game-tree datatype, leaf/empty-tree definition, termination measure or full induction proof is supplied. The paper expressly restricts to functional correctness and omits quantitative results. No guarantee about an actual deployed game engine, infinite games or arbitrary cyclic game graph follows. §2: Values form a bounded linear order with bottom/top; numbers and infinities are one instance. Define window equivalence E(x,y): (y≤a⇒x≤a) and (a<y<b⇒x=y) and (y≥b⇒x≥b). Symmetry is stated only when a<b. Reported val(t) E hard(a,b,t) implies hard(bottom,top,t)=val(t). Values outside the window need only indicate the correct side; narrow-window outputs need not equal the exact tree value. §2: Define a second relation R(y,x): (y≤a⇒x≤y) and (a<y<b⇒x=y) and (y≥b⇒x≥y). This is a relation parameterized by(a,b), not ordinary ≤ or numerical-distance comparison. Paper reports R(soft,val), R(hard,val) and R(hard,soft), with hard/soft equal search spaces. It would be incorrect to infer soft superiority merely because it satisfies a stronger property than the classic hard theorem; hard satisfies that property too. The direct hard-to-soft relation expresses the actual refinement. §2.1: Single-player-perspective evaluation/search requires unary negation satisfying −min(x,y)=max(−x,−y) and −(−x)=x. These are abstract algebraic assumptions, not reliance on numeric subtraction or negative integers. They allow swapping the player perspective while preserving the order structure. §3: Generalization requires a bounded distributive lattice: meet/join replace min/max. The weak relation B(x,y) is a∨(x∧b)=a∨(y∧b). It recovers exact valuation for full bottom/top window. Equivalence with the classic E relation is stated for linear orders and a<b; it cannot be transferred blindly to partially ordered values. §3: Strong lattice relation S(y,x) means x∧b≤y≤x∨a. On a linear order with a<b it coincides with R(y,x). Distributivity gives S(y,x)⇒B(x,y), but B alone does not imply S. Paper reports S(f(a,b,t),val(t)) for hard,soft and Bird–Hughes bh, after modifying variants for lattices. It does not reproduce their algorithms or provide direct proof scripts. §3.1: For lattice negamax, −(x∧y)=(−x)∨(−y) and involution are assumed, forming a de Morgan algebra. Arbitrary bounded lattices or arbitrary unary sign functions are not enough. No theorem for nondistributive lattices is stated. §4: Caching/reusing earlier calls is cited as work by Li et al., outside the variants covered here. No verification of transposition tables, concurrent cache updates, distributed search or graph-cycle handling is reported. §4: A Hughes-derived program was suspected to prune less; Hughes reportedly used Haskell Quickcheck privately to compare its search space with the canonical implementation and confirmed the suspicion. No counterexample tree, generators, sample count, exact code or formal search-space strictness theorem is printed for this observation. It is empirical counterexample evidence as reported by Nipkow, distinct from the Isabelle functional-correctness statements. Source is a four-page invited-talk extended abstract. AFP June2024 entry is a proof-development pointer; this reading did not inspect or rebuild it, check axioms/dependencies or establish Isabelle version. No benchmark, runtime/space complexity, proof-line count, build duration, LLM agent, Verus/Rust/TLA+ or distributed-system evaluation appears.
  • how much was read: most of it read
  • source
  • record id: alpha-beta-pruning-verified-2024
• Basold, Bruin and Lawson directed Van Kampen 2024 (2024)
  • title: The Directed Van Kampen Theorem in Lean
  • what: Reports a Lean4/mathlib formalization of directed spaces and their fundamental categories, culminating in a Van Kampen theorem: covering a directed space by two open subspaces makes the induced fundamental-category square a pushout in Cat. This gives a compositional description of directed path-equivalence classes. Introduces 5.6k lines across30files and detailed correspondence between the handwritten universal-property argument and Lean obligations. Concurrency is motivated by irreversible executions and a two-program obstacle picture; no concrete distributed implementation or verified protocol is evaluated. Reads directedness/covering definitions, asymmetric homotopies and symmetric zigzag quotient, category/functor laws, complete eight-step proof and matching Lean construction. Records exact two-open-cover and overlap-compatibility assumptions, index offset, partition-refinement/representative independence, Classical.choose and quotient descent, artifact version/limits, and small printed type/order slips without inferring formal artifact failures.
  • limits: Directed space means a topological space with selected continuous paths closed under constants, concatenation and monotone subparametrization. Directed maps are continuous maps preserving those selected paths. This is more general than giving every space a global partial order; no finite-state, finite-dimensional or path-connectedness assumption appears in Theorem21. One must supply an appropriate directed-space model before applying the theorem (§2,§5.1). Figure1 contrasts two sequential schedules, concurrent schedules differing only in progress speed, and concurrent schedules around a shared-memory-access obstacle. The obstacle excludes simultaneous access and separates access orders. These are geometric motivation examples, not verified source programs, a memory-model soundness theorem, or measured race-detection results. Literal exactly-two-paths language should be read at the schedule/deformation level, since parametrized paths allow many timings (§1,Figure1). Implementation extends TopologicalSpace with IsDipath and three closure fields. Dipath extends endpoint-indexed Path with a proof of directedness. General path reversal is unavailable because it may violate direction. Products and directed structures induced along continuous maps are provided. For strict subparametrizations with changing endpoints, the authors reuse Path.map by treating the parameter map as a monotone path in the unit interval, overcoming a mathlib interface that only handled endpoint-preserving reparametrization (§2.1). Directed homotopy is a directed map I×X→Y with fixed map values at deformation times0/1; directed path homotopy also fixes both path endpoints. Direction applies to both product coordinates and a homotopy cannot generally be reversed. PreDihomotopic is existence of one such homotopy; Dihomotopic is its smallest generated equivalence relation, implemented by EqvGen. Symmetric equivalence of paths does not assert physical reversibility of executions (§3). Example12 uses linear interpolation H(t,s)=(1−t)γ1(s)+tγ2(s) for monotone interval paths ordered pointwise. Directedness uses coordinatewise monotonicity. Lemmas14–16 extend zigzags through directed maps, prove endpoint-preserving reparametrization invariance, and establish concatenation congruence, identities and associativity modulo equivalence. These are the exact conditions needed to descend path concatenation to a category (§3). Fundamental-category objects are all points; morphisms x→y are directed paths modulo Dihomotopic; identity is constant path and composition concatenation. It is a category rather than a groupoid because reverse paths may not exist. The dπ functor maps points by directed maps and path classes by composition; it is not an algorithm that enumerates every execution or yields a numeric count of schedules (§4). Path pieces γ_i,n are equal-parameter subpaths. Being n-covered means every piece lies in one cover member. Lean covered_partwise γ n represents n+1 mathematical pieces, with zero as one covered path; the recursive split therefore uses n+2. This index convention matters in refinement/induction and is explicitly explained rather than a theorem off-by-one bug. Homotopy covering is a rectangular n×m grid (§2.1,Definition20). Theorem21 assumes X1 and X2 open in X, unionX, and X0 their intersection, all with induced directedness. Inclusion maps induce the Cat square. Conclusion is the universal property of a pushout: for any target category and two functors from the local fundamental categories agreeing exactly on the intersection, there is a unique global functor restricting to both. No connected-intersection/basepoint hypothesis is required in this full-category formulation. General arbitrary covers are not formalized (§5.1,§6). Proof Steps1–2 force the global object map by local membership and the path map by a composite of local images of finitely many covered subpaths. Compactness/Lebesgue Number Lemma yields finite subdivisions for a path/homotopy under the open cover. This is an existence theorem for arbitrary topological paths, not a stated effective subdivision procedure or complexity bound (§5.1). Step3 uses overlap agreement to eliminate the cover-branch choice. Step4 refines n- and m-piece partitions to a common mn-piece partition, using functor composition and reparametrization to eliminate subdivision choice. Step5 proves constants and concatenation. These independence obligations prevent a local-piece construction from depending on arbitrary choices, rather than merely checking one chosen partition (§5.1 PDF12–13). Step6 reduces representative independence to a single directed homotopy and then to one row of covered rectangles by induction. Step7 strengthens the induction to homotopies with moving endpoints: the images of lower path followed by right boundary and left boundary followed by upper path agree. For a single rectangle, min/max endpoint homotopies make a fixed-endpoint path homotopy; induction glues columns. Constant boundary paths recover the original path-equivalence result. Step8 descends to the quotient, obtains a functor, verifies restrictions and uniqueness (§5.1 PDF13–14). Formal construction follows the proof but reorders it: covered-path maps and refinement independence are defined/proved before choosing a subdivision. FunctorOnHomAux explicitly uses Classical.choose_spec on has_subpaths. Then representative independence permits Quotient.liftOn; separate map-id/map-comp and unique-extension lemmas build Functor and IsPushout. Calling the proof constructive refers to its explicit mathematical functor construction; the printed use of classical choice does not establish an extracted executable algorithm (§5.2). Theorem/proof snippets have small printed slips. PDF13 Step5 begins F′(delta⊙gamma) although gamma:x→y and delta:y→z, so the composable order is gamma⊙delta; the preceding equation and Lean functorOnHomAux_trans PDF16 use the correct order. PDF14 final homotopy chain writes id_x as the left identity after the y-constant path; the typed identity should be at the target image. PDF14 prose calls F1/F2 maps out ofC and names the wrong inclusions for h_comm, whereas displayed Lean types are local categories→C with agreement along intersection inclusions. These are paper-text/type-description slips, not evidence of failed checking in the linked artifact. Implementation version is Lean4.6.0-rc1, built on mathlib; reported size5.6k lines in30files. Publication says not yet integrated into mathlib. These are2024source statements; this reading does not assert current2026integration status or a current first-formalization claim. The related2023arXiv version uses Lean3, so its version should not be conflated with the conference artifact (§1.1–1.2,front matter). Archived code is version1.1 at https://github.com/Dominique-Lawson/Directed-Topology-Lean-4/tree/v1.1 with Software Heritage directory479a73373a2bf508149f7d1b889b42304fe78a9e. File pointers include directed_space.lean, constructions.lean, dipath.lean, path_cover.lean, directed_homotopy.lean, directed_path_homotopy.lean, fundamental_category.lean and directed_van_kampen.lean. Paper excerpts deliberately replace proof bodies with comments; those omissions are not evidence of sorry in the repository. No build, axiom audit or independent kernel acceptance was performed in this reading. Authors do not formalize the undirected groupoid Van Kampen corollary, though they explain that making every path directed should yield it. Arbitrary open-cover generalization is proposed but not investigated in depth. Formal links to higher-dimensional automata and their languages are future work. Thus a concurrent program→d-space semantics bridge and any system safety/liveness theorem remain outside the reported formalization (§6). Evaluation is a mathematical formalization case with definitions, lemmas, theorem statement and archived artifact, not empirical protocol verification. No benchmark suite, checker runtime/memory, person-effort, defect count, LLM success rate, Verus/TLA+/Rust implementation or distributed-system model is evaluated. Applying the composition theorem to such tasks would require additional sound model encodings and property connections.
  • how much was read: most of it read
  • source
  • record id: basold-bruin-and-lawson-directed-van-kampen-2024-2024
• CauMon (2024)
  • title: CauMon: An Informative Online Monitor for Signal Temporal Logic.
  • what: Implements an online Signal Temporal Logic monitor that reports violation and satisfaction causation distances, revealing which current trace values cause a specification outcome. Two dynamic-programming strategies make this more efficient than direct causation monitoring.
  • number: 4 Simulink models; 10 traces/specification, 5 repetitions
  • number: CauMon at least 17.5% faster than PCauM
  • number: PCauM about 1900 s for nested AT formulas; NN PCauM timed out at 5000 s
  • number: AT1 CauMon about 0.18–0.23 s; AT2 about 1.81–1.99 s
  • limits: Signals are bounded in a hyper-rectangle and sampled to lists for implementation; STL intervals are closed and non-singular. Efficiency depends on dynamic-programming worklists and sampled windows. The monitor reports distances/causation for partial traces, not a proof that the CPS is safe. Evaluation uses four MATLAB Simulink benchmarks and ten random-input traces per specification, so generalization beyond these models is untested.
  • how much was read: most of it read
  • source
  • record id: caumon-2024
• CMSO/tw Model Checking (2024)
  • title: Parameterizing the quantification of CMSO: model checking on minor-closed graph classes
  • what: Introduces CMSO/tw, a fragment of counting monadic second-order logic whose set quantifiers range over sets of bounded annotated treewidth, and proves an algorithmic meta-theorem for CMSO/tw+dp on H-minor-free graphs. The paper defines annotated treewidth and the bounded quantifiers, develops annotated types and flat railed annuli, and proves local-global irrelevance to construct the meta-algorithm. The main theorem decides a CMSO/tw+dp formula on an H-minor-free graph in f(|φ|,|H|)|G|² time. The conclusion argues treewidth is the best possible minor-monotone parameter for this style of result and identifies extensions beyond minor-closedness as open directions.
  • number: quadratic |G|² dependence in the main theorem
  • number: algorithm factor f(|φ|, |H|)
  • number: bounded-treewidth quantifier parameter k included in formula length
  • limits: The theorem is parameterized by formula length and excluded-minor size and applies to non-trivial minor-closed classes (or H-minor-free graphs); it is a theoretical construction with no empirical runtime evaluation. The optimality discussion rules out analogous AMTs for parameters not functionally larger than treewidth, while topological-minor and alternative-parameter extensions remain open.
  • how much was read: most of it read
  • record id: cmso-tw-model-checking-2024
• Confidence-based neural 2-safety (2024)
  • title: Verifying Global Two-Safety Properties in Neural Networks with Confidence
  • what: Defines confidence-based global 2-safety properties unifying robustness and fairness, and verifies them by self-composing a DNN and replacing softmax with a sound piecewise-linear over-approximation checked by Marabou. The property compares every sufficiently close input pair when at least one output has confidence above a threshold, allowing class changes near low-confidence decision boundaries while requiring high-confidence predictions to agree. The paper proves soundness and bounds softmax approximation error, gives a complete Marabou-based counterexample procedure for the approximated network, and uses binary search to synthesize minimum robust/fair confidence. Experiments cover German Credit, Adult, Law School and COMPAS models with global robustness and sensitive-attribute fairness queries.
  • number: 4 public-dataset DNNs
  • number: binary-search German Credit threshold 0.75 in 45 s
  • number: COMPAS softmax error approximately 0.171
  • number: COMPAS ethnicity 0.999 fairness query 171 min 15 s
  • limits: Networks are feed-forward ReLU models with a small output layer; the linear softmax abstraction has no error for two outputs but about 0.171 error for three outputs, producing an undecidable confidence interval for COMPAS. Marabou completeness removes solver false positives, but abstraction can produce spurious counterexamples. High confidence as a precondition can make poorly calibrated networks vacuously safe; current method handles roughly two to five outputs and does not establish training-data generalization.
  • how much was read: most of it read
  • record id: confidence-based-neural-2-safety-2024
• Coq W-MSR Consensus (2024)
  • title: Formally verified asymptotic consensus in robust networks.
  • what: Mechanizes the necessary and sufficient conditions for asymptotic consensus of the Weighted-Mean Subsequence Reduced algorithm under bounded malicious faults in robust networks. The Coq development formalizes safety, sufficiency and necessity proofs, supplies a concrete counterexample for a missing/imprecise necessity argument, and proves a stronger sufficiency condition. Formalization exposed quantifier and definition inconsistencies in the original proof.
  • number: About 11,000 lines of Coq proofs
  • number: Six person-months for formalization
  • number: No runtime benchmark; theorem formalization is the evaluation
  • limits: The development assumes real-field arithmetic and verifies the algorithm mathematically rather than its finite-precision implementation. The network is treated under fixed threat assumptions; time-varying networks and implementation effects are future work.
  • how much was read: most of it read
  • source
  • record id: coq-w-msr-consensus-2024
• Correctly Compiling Proofs About Programs Without Proving Compilers Correct (2024)
  • what: PotPie compiles an embedded source program, its Hoare proof and its specification into a related target language, preserving a selected partial specification even when the program compiler changes other behavior. Gives a correct-by-construction CC workflow and a Tree workflow with an untrusted certificate generator or a less-assured boolean checker. Coq formalization proves conditional soundness; toy examples include deliberate miscompilation. Makes specification meaning preservation explicit via state correspondence and bidirectional assertion semantics, separately from target proof validity. Uses a manually translated implication database for consequence rules and structural compiler equations to transport other Hoare rules. Details source/target well-formedness, stack-purity obligations, certificate-versus-boolean trust, localized UIP axioms and partial-correctness/termination boundaries.
  • limits: Languages are simple related imperative calculi Imp and Stack, with natural-number arithmetic, functions and different variable models. They are embedded semantics, not C/Rust/assembly or machine-word execution. Practical lower-level logics, pointers, optimizing control-flow passes and scalability are future work. Partial correctness of a selected postcondition does not establish full behavioral equivalence, termination or any property omitted from that specification. Helper multiplication/exponentiation need separate termination proofs, and target termination is reproved rather than automatically transported. No total correctness of the approximation algorithms is established by their Hoare triples. Definition3 requires pre/postcondition meaning equivalence on source stores and target stacks related by the chosen bijective variable mapping. Compiling both assertions toFalse could yield a valid target Hoare triple without preserving intended meaning. CC requires specification soundness; Tree certificate validity alone does not supply it. Users manually translate a valid source implication database and prove corresponding target implications. These finite assertions can be preserved even if the whole compiler is incorrect. Automatic generation of these obligations via weakest preconditions is proposed but not implemented. CC needs structural equations for assignment/substitution, skip, sequence, if and while, plus source well-formedness and stack-preserving compiled expressions/functions. Thus arbitrary semantics-preserving control-flow transformations do not automatically qualify. Completeness language is conditional on the stated proof obligations and supported structure. Stack expressions in assignments and branch/loop tests must preserve the stack. Function-call effects/arity/stack shape require proofs. Source functions are mutation-free outside locals and immutable parameters, while target calls can access the whole stack. Definition1 constrains mapped variables/parameters but leaves extra stack suffix unconstrained. CC trust includes Coq kernel, mechanized semantics/Hoare definitions and two localized UIP axioms for assertion and function-environment types. It does not assume universal UIP. Opaque CC proof terms may retain dependency on source semantics. Tree certificate path constructs stk_valid_tree, whose Coq checking plus valid_tree_can_construct_hl_stk gives a target Hoare proof without UIP. OCaml certificate generation is untrusted for accepted checked certificates. Boolean fallback adds an unverified OCaml checker to the trust base and is not formal correctness evidence. Certificate generation can fail on mutually recursive functions or malformed trees. A boolean fallback for modular stack-purity checks does not repair this certificate limitation. Target specification preservation still needs its own user proof even if a certificate typechecks. Square-root example’s printed formal postcondition is a pair of cross-multiplied natural-number inequalities under preconditionTrue. Interpreting it as rational approximation additionally requires nonzero relevant denominators (b,y,epsilon denominator); these are not in the displayed precondition. The mathematical reading must not silently replace the stated encoded relation.
  • how much was read: most of it read
  • source
  • record id: correctly-compiling-proofs-about-2024
• CSP retrospective (2024)
  • title: The Challenges and Triumphs of CSP Based Formal Verification
  • what: Roscoe looks back on CSP, a notation for describing processes that run in parallel and talk to each other, and its model checker FDR. He covers a two-player-game encoding, a primary/secondary consensus handover protocol for blockchains with malicious nodes, a way to check deadlock freedom from the sum of component state spaces, and the Coco tool used by ASML.
  • number: Coco Platform is in use at ASML for photolithography machine software (as stated by the author, no figures)
  • number: the author’s naive CSP blockchain model could not hold a realistic number of blocks, agents or keys (state explosion)
  • number: token-invariant deadlock check on a 3-component example: state space of 6 component states, one nontrivial invariant (t4) proves deadlock freedom
  • limits: Reflective paper written for CSP experts: no benchmarks or timings are given for the handover protocol or the local checking idea, and both are models checked in FDR, not code. The author lists proving the Bully algorithm and a distributed database protocol for all N as still-open challenges.
  • how much was read: most of it read
  • source; notes: The Challenges and Triumphs of CSP Based Formal Verification (2024)
  • record id: csp-retrospective-2024
• Defining and Preserving More C Behaviors: Verified Compilation Using a Concrete Memory Model (2024)
  • what: Proposes a concrete pointer-as-integer C memory interface with explicit allocation/access failstops and an implementation-specific allocation oracle hidden behind axioms. Demonstrates it in Coq with a toy RTL-to-tagged-Mach compiler/runtime, proving two-way behavior refinement under a matching memory-model instantiation. Public/private protection isolates compiler control data while allowing defined out-of-object effects among public data. Connects finite allocation/failstop behavior to compilation rather than treating OOM as undefined. Context labels let the oracle predict target stack offsets and heap placements without exposing private layout in interface axioms. A perturb operation models private-layout changes between public allocations. Gives executable tagged stack/allocator design, relational state/memory matching and explicit optimization losses from concrete addresses. Scope remains toy data-pointer compilation, with full C,function pointers and phase composition future work.
  • limits: Public/private(PvP) protection allows arbitrary accesses among public regions, but prevents ordinary source data-pointer accesses to compiler-private state such as saved return addresses,locals,parameters and heap headers. It is not object-granularity spatial/temporal safety or protection against data-only attacks. The axiomatic byte-addressed interface has finite word-representable nonoverlapping regions,positive nonnull bases,alignment and minimum-size constraints,heap-base uniqueness,stack/heap observation functions,load/store stability and free/perturb laws. New allocations need not be initialized to zero; contents are defined but unpredictable. Any integer may be used as an address. Loads/stores within allocated regions succeed. Outside them they may succeed,warp to public storage or failstop depending on instantiation; source axioms do not expose private addresses. LdStEq applies to any successful store; LdStNeq only restricts stores whose destination lies in an allocated region, permitting OOB warping side effects. Allocation may report OOM at any time under the generic axioms. Nonvacuity/behavior equivalence is established for the particular program-indexed instantiation matching compiler/runtime allocation, not every arbitrary oracle and not a source-only universal resource guarantee. Proof-of-concept memory is64-bit-word-addressed with no alignments, unlike the proposed byte-indexed interface. Source RTL has unlimited local pseudoregisters,straight-line function bodies,+/−,loads/stores,calls and fixed local arrays. Function calls may recurse; no intrafunction branches or full C parser/type system/struct/byte-layout implementation. Mach has fixed registers,abstract code pointers/separate code,tagged word memory,privileged/unprivileged accesses and direct named calls. Code-pointer corruption is excluded by this representation. General function-pointer protection is explicitly future work; abstract blanket control-flow-attack language does not prove secure arbitrary-C compilation. Theorem1 assumes source behavior under I(S) is not Stuck; a source typing judgment can rule that out. It compares termination with same result,divergence and failstop. Its stated ≈ equates failstops for any reason,so it does not by itself equate exact OOM versus OOB labels or failure timing/step counts. Compiler correctness uses forward small-step simulation and target determinism to obtain reverse refinement,with matching three-way source-call-stack/oracle-stack/MachSP and tagged separation-logic memory assertions. Proof statement is relative to Gallina semantics and model parameters; no real hardware,tagging implementation,Coq extraction or native compiler theorem is supplied. The simple compiler does no register allocation and stores every pseudoregister/parameter at a fixed stack offset. Runtime malloc/free are Gallina builtins using modeled memory instructions,not compiled actual C runtime. Their correctness proof does not establish performance or an external allocator implementation. Concrete addresses invalidate some nonalias-based optimizations and dead-allocation elimination when observable OOM is preserved. Proposed inlining/tailcall compatibility and modular oracle construction are not verified general multipass/full-C results; §7 describes preliminary/future work. No benchmark evaluation,execution overhead,tag hardware measurements or empirical importance of lost optimizations is reported. No artifact build,proof recheck or native program run by reader. C snippets motivate semantics; they are not validated examples of a completed C frontend.
  • how much was read: most of it read
  • source
  • record id: defining-and-preserving-more-2024
• Distributed Model Checking on Graphs of Bounded Treedepth (2024)
  • what: Proves distributed decision of every fixed monadic second-order graph formula in a constant number of CONGEST rounds on bounded-treedepth networks. Constructs an elimination tree as a network subgraph, converts it to an ancestor-bag tree decomposition, and distributes finite-state dynamic programming for regular predicates. Extends the result to connected-pattern freeness on bounded-expansion classes through low-treedepth vertex partitions.
  • limits: CONGEST: finite simple connected graph, unique O(log n)-bit vertex IDs, synchronous rounds and O(log n)-bit messages per edge per round; unrestricted local computation. Fixed graph formula and bounded treedepth are essential parameters. Constants from finite homomorphism classes depend on width and formula and are not practical-performance guarantees. Decision uses all-nodes-accept semantics: legal iff every node accepts; the final root may be the only rejecting node. This differs from requiring all nodes learn a global Boolean answer. This is structural graph-predicate model checking, not temporal protocol-state-space exploration. It supplies no TLA+, Rust, Verus or LLM proof-agent artifact. Full details for optimization/counting/labeled graphs are omitted from the supplied conference version and pointed to arXiv:2405.03321; whole-paper status covers these 20 pages only. Low-treedepth decomposition theorem and MSO regularity are imported results. Their original external proofs have not been read in this assignment.
  • how much was read: most of it read
  • source
  • record id: distributed-model-checking-on-2024
• distributional probabilistic model checking (2024)
  • what: Extends probabilistic model checking from expected rewards to full reward distributions for DTMCs and MDPs, supporting variance, quantiles, value-at-risk and CVaR for rewards accumulated until co-safe LTL goals. The paper defines categorical and quantile distribution representations, distributional queries and optimization semantics, and reduces co-safe LTL goals to reachability with a DFA product. Algorithm 1 computes a DTMC distribution by forward propagation while separating non-target BSCCs that yield infinite reward, with a provable per-atom error bound and truncation mass ε. Risk-neutral distributional value iteration (DVI) chooses actions by expected value; risk-sensitive DVI uses the CVaR dual slack variable, a discretized product MDP and a convergence result whose error is O(stride). A PRISM prototype evaluates betting, Deep Sea Treasure, obstacle, UAV and energy models, with risk-sensitive products up to 2.3e6 states and runtime up to 15,051 s; distributions converge toward ground truth as atom counts increase. DTMC forward computation is often faster than DVI on large PRISM benchmarks, but DVI can be faster when Vmax is high.
  • number: Algorithm 1 truncation accuracy ε
  • number: risk-sensitive DVI up to 2.3e6 states and 15,051 s
  • number: categorical m=201 and slack |B|=51 or 101 in main experiments
  • number: Obstacle risk-neutral CVaR relative error 1.95%; risk-sensitive up to 2.00%
  • limits: Rewards are nonnegative integers (rationals require scaling), co-safe LTL satisfaction is finite-prefix, and DTMC/MDP models are finite. Risk-neutral DVI assumes an optimal policy with finite expected reward that reaches targets with probability 1; with multiple optimal policies, convergence may fail, and its stopping threshold has no precision guarantee. Distributional representations and discretized CVaR slack atoms introduce approximation; larger Vmax makes coarser strides and errors. Experiments use a Java explicit-state PRISM extension on selected synthetic/benchmark models, so results do not establish scalability for arbitrary or infinite systems or implementation correctness.
  • how much was read: most of it read
  • record id: distributional-probabilistic-model-checking-2024
• Duper: A Proof-Producing Superposition Theorem Prover for Dependent Type Theory (2024)
  • what: Implements Duper, a Lean proof-producing saturation prover adapting higher-order superposition to dependent types, potentially empty types and universe polymorphism. Generates classical Lean proof expressions; uses LeanAuto preprocessing for type classes/monomorphization. Benchmarks compare raw search and re-proving minimized ATP problems, showing near-Metis reconstruction performance on these suites, not a full Lean hammer or evaluated Mathlib-dependent-type capability. A DISCOUNT-style active/passive given-clause loop combines simplification and generation with higher-order KBO and unification. Proof reconstruction retains quantified variables unless unification supplies witnesses, eagerly records substitutions and passes transfer expressions for new variables. Empty types require Skolem functions with a dummy argument, separate Nonempty clauses and restrictions on vacuous-clause simplification; discovered inhabitation reactivates clauses for simplification. Dependent unification extends forall transitions/imitation; universe instantiations propagate backwards through the proof DAG. LeanAuto abstracts dependent parameters into essentially higher-order problems, heuristically instantiates type classes and identifies some definitional equalities. These are implemented algorithms and explanatory soundness arguments; no whole-calculus dependent-type completeness theorem is established here.
  • limits: Input lemmas must be supplied manually; no relevance filter. Full hammer integration and Mathlib evaluation are future work at publication. The assertion that no Lean hammer exists is historical to this2024 paper. Proof search and reconstruction use classical logic, including double-negation elimination, even for constructively provable goals. Producing a Lean term supports checking within Lean’s axiomatic foundation; reader did not execute artifact or independently certify implementation. Author completeness statement in §4.1 concerns the higher-order fragment of the unification procedure, not completeness of Duper over all dependent type theory. Native unification/preprocessing extensions and illustrative examples do not constitute exhaustive dependent-type benchmark validation. If inhabitationReasoning is disabled, search temporarily assumes nonpropositional types inhabited and errors at reconstruction if unsound inference results. Enabled mode reasons about Nonempty throughout saturation; vacuous clauses must not eliminate nonvacuous facts. LeanAuto monomorphization is heuristic and only sketched here. Its same-head representative mechanism cannot recognize all definitional equalities; preprocessing does not eliminate every universe-polymorphism issue. Benchmarks are TPTP FOF/THF translations of Seventeen and GRUNGE. They do not measure verified Rust/Verus/TLA+,distributed execution or LLM specification accuracy. GRUNGE formats differ in encoding difficulty. All runs externally terminated after30s wall time on a3.8GHz Mac,16GB RAM. Zipperposition portfolio forced to one core because Python multicore code was not Mac-compatible; Vampire portfolio ran unaltered. No statistical uncertainty reported.
  • how much was read: most of it read
  • source
  • record id: duper-a-proof-producing-2024
• EmptyHexagonLean (2024)
  • title: Formal Verification of the Empty Hexagon Number
  • what: Formalizes in Lean the geometric-to-SAT reduction behind h(6)=30: every set of 30 planar points in general position contains an empty convex hexagon. The development defines convexity/emptiness in mathlib, proves a triangle characterization, reduces geometry to triple-orientation Boolean assignments, proves canonical-position symmetry breaking, and verifies the optimized Heule–Scheucher CNF encoding. A distributed CaDiCaL/cake_lpr computation supplies the n=30 unsatisfiability certificate. Sections 3–4 connect Lean convex-hull predicates to triangle emptiness and determinant-based orientations; σPtInTriangle_iff under four-point general position closes an implicit gap in prior work, and OrientationProperty proves that holes depend only on triple orientations. Section 5 constructs a six-step canonical-position transformation (rotation, translation, projective map, sorting, reflection and return from infinity) and proves existence of a σ-equivalent canonical set. Section 6 defines orientation, triangle, cap/cup and hole variables plus 16 clause families; variable-defining and orientation clauses are proved, while forbidden configurations imply six-holes. The n=30 CNF is partitioned into 312,418 subproblems, solved by CaDiCaL 1.9.5 with LRAT proofs checked on the fly by cake_lpr in 25,876.5 CPU hours (~3 CPU years). The Lean encoder emits CNF below 1 s on a laptop; a comparison g(6) corollary takes 28 s to solve versus Marić’s 787 s and uses O(n⁴) rather than O(n⁶) clauses. The formalization required ~300 hours/3 months and ~4.7k Lean lines, and corrected an orientation-map error and a lex-order/code mismatch in prior work.
  • number: h(6)=30
  • number: O(n⁴) clauses
  • number: 312,418 subproblems
  • number: 25,876.5 CPU hours (~3 CPU years)
  • limits: The theorem assumes finite planar point sets in general position (no three collinear). Triple-orientation abstraction is justified for convexity/emptiness properties invariant under coordinate transformations; SAT satisfiability does not imply realizability, so only unsatisfiability is used. The Lean development asserts final CNF unsatisfiability as an axiom after external cake_lpr checks; proof files are estimated at tens/hundreds of terabytes, so the Lean-to-SAT connection remains a trust boundary. The computation is expensive and not itself a proof search performed by Lean.
  • how much was read: most of it read
  • source
  • record id: emptyhexagonlean-2024
• EPVerifier: Accelerating Update Storms Verification with Edge-Predicate (2024)
  • what: A Java data-plane verifier accelerates batched forwarding-rule updates by storing a Boolean packet predicate separately on each directed edge, avoiding global equivalence-class splitting/relabeling on unchanged edges. It dynamically groups switches by update counts and maintains local BDDs in parallel without shared-manager locks. Incremental formula transfer into a common BDD manager builds a graph for affected-packet loop/blackhole checks and optional reachability/waypoint checks. Evaluation measures model-update/checking performance on seven datasets and50 commercial-backbone storms; no end-to-end correctness theorem or mechanized proof is supplied. Records highest-priority rule semantics/hit sets, per-switch ownership and greedy scheduling, independent-versus-common BDD representation and incremental delta transfer, complete insertion/deletion/traversal pseudocode and several printed-algorithm inconsistencies, affected-traffic coverage boundary, full experimental tables and baseline provenance, small-network overheads and nonuniform speedup/BDD-operation claims. Separates batch final-state verification from update-trajectory correctness and parallel centralized computation from distributed on-device verification.
  • limits: §2: Snapshot topology and rule tables define deterministic stateless forwarding: highest-priority matching rule selects one next hop. Priority tie behavior is not specified. A rule is match/from/to/priority; hit is match minus higher-priority matches. Correctness depends on complete accurate controller inputs and faithful FIB semantics. Packet drops/valid terminal nodes need explicit interpretation; multicast, stateful transformations and hardware behavior are not modeled here. §§2/3/5.3: Update storm is a batch of insert/delete operations; verifier updates its model and then checks affected packets on the resulting graph. It does not prove all intermediate device-installation states, asynchronous rollout orders or packet histories are safe. Snapshot freshness and eventual installation correspondence are inputs, not established by speed measurements. Whole-network invariant maintenance additionally needs an initially valid state or separate initial check, since unchanged packet classes are not newly checked. §4.1 Figure3: EC labels are global forwarding-behavior classes, so local rule changes can split class labels on unchanged switches. EPs denote local packet sets per directed edge and change only edges outgoing from affected switch; this is representation locality, not a theorem that a local update has only local end-to-end consequences. Global path checks remain necessary. §§4.2/5.1 Algorithm1: Partition occurs after storm arrival. Greedily place the currently most-updated unassigned switch into least-loaded region. Whole switch remains indivisible; one hot switch can dominate and equal update counts need not mean equal BDD cost. No optimal-balance/complexity or runtime-bound proof. §5.1 recommends region count smaller than cores, but §6.2 uses8regions on8cores. §5.1: Separate BDD manager per switch avoids cross-thread manager sharing during local model updates. BDD operations across switches require common variables/manager, motivating shared B0/M′. Parallel local maintenance is not on-device distributed verification; §7 leaves that design for future work. Global transfer/traversal can remain bottlenecks. §5.2 Algorithms2/3: Compute actual hit by subtracting higher-priority hit regions; insertion adds new hit to selected next hop and removes overlap from lower-priority alternatives. Trie-based overlap optimization is described but omitted from listing. Preserving manager variables and original per-switch update order matters when grouping; no executable-refinement argument supplied. §5.2 Algorithm3 printed deletion lines14–21 appear incorrect; this is a source-pseudocode finding, not an executed implementation failure. Example: high-priority rule A→B matches nonemptyP, lower-priority A→B also matchesP and currently has emptyhit. Deleting high-priority rule removesP from edgeB atline14; branchline18 skips re-adding it because both destinationsB match, leavingB empty though lower rule should forwardP. Line20 subtracts oldr′.hit rather than newly reassigned match region; line21 can add remainingr.hit outside r′.match to r′.hit. Correct code/proof must resolve these cases. §5.3 Algorithm4: Transfer old-minus-new and new-minus-old formulae from local manager into sharedB0, accumulate union of changed packet sets. Boolean variable mapping and BDD-to-formula encoding must preserve semantics. Enumerating formulas can be much larger than BDD representation; paper explicitly admits worst-case all formulas affected. Empirical >97%one/two formulas does not bound worst-case cost. §5.3 Algorithm5 printed traversal subtracts edge predicate fromp atline8 before passing edge∧p atline10; under sequential assignments that intersection is empty. It also adds child tohistory before entering child, so a nonempty recursivecall would immediately satisfy loopguard; outerloop uses s but call uses undefinedn. Line12 pruning intersects already-subtractedp, alsoempty. These are visually confirmed listing inconsistencies, not evidence the unexamined Java has same defects. Mutable sharedM′ pruning needs a workingcopy or restoration for subsequent checks. §5.3 Algorithm6 repeats subtract-before-intersect atlines13–14. It tests globalmatch instead of recursivep for termination and records entirematch at reached waypoint/destination, even if only a subset arrived. No cycle/history guard is shown. As printed it cannot substantiate all-matched-packets reachability. Reach-set aggregation does not explicitly encode ordered waypoint traversal; desired waypoint semantics must be specified before formal proof. Link failure overwritesM′[l] and requires restoration/copy for independent queries. §5.3: Network invariants include loops and blackholes via DFS from each node; optional tuple(match,source,waypoints,dst) checks all requested packets and can disable a link. Valid packet termination versus blackhole policy is not formalized in pseudocode. Performance study uses loop checking; it does not establish soundness/completeness or false-alarm rates for all custom policies. §6.1: Roughly4000 JavaLOC using JDD/OpenJDK asynchronous threads; APKeep* is authors’ reimplementation from paper pseudocode, while Flash is public Java source. EPVerifier* uses EP-model plus subspace partition. Baseline results compare these implementations/configurations; not a verified comparison against original APKeep. No paired correctness oracle or tests of pseudocode counterexamples reported. §§6.1/6.2: Two ONOS-generated Airtel sets and five synthetic shortest-path networks using RouteViews prefixes/Rocketfuel topologies. Randomly choose10K or1M inserts, check loops, record memory, then delete corresponding rules in same order. Table2 describes overall process; do not silently interpret as single-insert-storm latency when timing includes both processes. Memory sampled after insertion. No repeated-run count/confidence intervals/error analysis reported. §6.2 Table2: EP is fastest among four on five large datasets; smallAirtel EP*.03s beats EP.09s, and FlashAirtel2 .08s beats EP.09s. EP memory~400MB versus~64MBsmallnetworks due per-switch BDDmanager caches. Large-network memory is sometimes above both baselines (Berkeley2829.26MB vsFlash1312.56; RF1755 3364.27vs2419.23), not universally lower. §6.2: Claimed at least10xfaster on lastthree does not hold against Flash onRF1755: printed8.4x. Claimed at leastone-magnitude-fewer BDDops on all datasets is contradicted by Airtel1 EP500000vsFlash300000 and Berkeley4Mvs10M (2.5x), among others. Abstract around10s for1M is approximate; printed EP large-dataset values11.91–25.98s have arithmetic mean15.744s. Preserve table rather than universalheadline. §6.3 Figure5 isolates models without partitions and varies stormsize from1upward. Larger/stormier networks favor EP despite transfer/traversal overhead on small tasks. §6.4 Figure6 compares two subspaces with per-switch managers; this also changes number/size of BDDmanagers. Its x-axis prose variance/total normalized0–1 lacks explicit formula, so do not infer general mathematical normalization. No optimal-distribution theorem. §6.4 Figures7/8: Per dataset choose switch with most updates, transfer sequential updates and count changed formulae; >97%affect1–2, mean≤2. Batching reduces per-update transfer BDDops via overlapping changes in tested traces. These observations do not prove overhead never explodes with arbitrary rules/header structure/topology. §6.5 Figure9: Commercial data-center backbone has hundreds of switches/thousands of links and50storms; network identity/exactdimensions/stormsizes are unspecified. CDF compares observed completion time, not correctness/detection accuracy. No natural error case catalog, false negatives/positives, deployment repetition or statistical interval reported. §7: NAT/packet transformation full design and implementation left to future work. Distributed on-device design also future work; proposed local storage plus central checking. Claims of extensibility are not completed support. No Verus/Rust/TLA+/LLM evaluation or formal checker implementation proof.
  • how much was read: most of it read
  • source
  • record id: epverifier-accelerating-update-storms-2024
• ESBMC-Python: A Bounded Model Checker for Python Programs (2024)
  • what: Introduces a Python front end for ESBMC: parse Python with ast/ast2json, infer annotations, translate to ESBMC symbol-table/IRep and GOTO representations, then symbolically execute bounded paths and query an SMT solver. Explains nondeterministic function arguments, function-scoped verification, inheritance lookup in a structured-programming encoding, and a factorial counterexample at input 5. Evaluates a new 85-program suite covering 15 categories and reports a division-by-zero in Ethereum integer_squareroot following unsigned increment overflow.
  • number: 85 programs; 15 categories
  • number: 31.56 ms reported overall mean
  • number: category mean CPU time 24.5–49.1 ms
  • number: category mean memory 14.5–26.4 MB; isolated maximum 27 MB
  • limits: Verification is bounded by the chosen unwind depth and relative to the implemented Python subset and numeric modeling. Type inference for complex flows and AI-library operational models are future work. The paper’s benchmark success is empirical evidence, not a proof of general semantic soundness. No direct tool comparison was possible because the authors could not obtain MSV artifacts. The Ethereum fix is reported by the authors; its repository was not inspected here.
  • how much was read: most of it read
  • source
  • record id: esbmc-python-a-bounded-2024
• ForEx hyperliveness verification (2024)
  • title: Automated Software Verification of Hyperliveness.
  • what: Introduces Forall-Exist Hoare Logic (FEHL) and ForEx, a constraint-based verifier for finite-program ∀k∃l relational properties (Forall-Exist Hoare Tuples). The method symbolically postpones existential nondeterministic choices as parameters, computes parametric strongest postconditions, and discharges resulting first-order constraints with SMT. FEHL provides self-composition, sequencing, conditionals, loops and consequence rules; the paper proves soundness and completeness relative to sound/complete unary Hoare and under-approximate systems. ForEx implements eager restriction satisfiability checks, a minimal C-like language with arrays/bitvectors, Z3 support for linear integer arithmetic, arrays and finite bitvectors, and guess-and-check invariant generation. Experiments compare ForEx against HyPA, PCSat and HyPro on k-safety, GNI, refinement and related benchmarks. ForEx is faster on solved instances but its counting-based loop alignment misses context-dependent alignments and it cannot prove termination of existential loops, leaving some GNI instances unsolved.
  • number: ForEx solves 6 of 8 ∀∃ instances in the PCSat comparison
  • number: HyPA comparison includes 20 k-safety/relational benchmark rows across Tables 5a/5b
  • number: ForEx times range from 0.10 ms to 2.88 ms on listed PCSat GNI cases
  • number: HyPro comparison checks 4 GNI instances over bitwidths 1–6 with 3-minute timeout
  • limits: FEHT validity quantifies finite terminating executions; the algorithm is for verification, not refutation of invalid FEHTs (which requires existential-universal reasoning). Completeness is relative to complete unary over/under-approximate proof systems and, for loops, depends on adequate invariant guesses. The tool explores a restricted counting-based loop alignment, so state-dependent alignments are outside its scope. Experiments use small benchmark programs, an M1 Pro with 32 GB, and user-provided invariant hints for marked cases.
  • how much was read: most of it read
  • source
  • record id: forex-hyperliveness-verification-2024
• Formal Sumcheck (2024)
  • title: Formal Verification of the Sumcheck Protocol
  • what: Gives the first machine-checkable, input-size-dependent-round security analysis of sumcheck. A generic public-coin interactive-proof locale is instantiated with an abstract generalized sumcheck protocol, then specialized to multivariate polynomials by proving algebraic axioms, yielding formal soundness and completeness. The modular formalization separates protocol reasoning from concrete polynomial representations. Abstract assumptions include a commutative monoid, finite support, evaluation/instantiation commutation, degree bounds and a root-counting property. Isabelle locales model recursive prover/verifier state and soundness/completeness; concrete multivariate polynomials are represented with Isabelle finite-support polynomial types. The framework is intended to support ring/module variants and protocols that use sumcheck as a subroutine.
  • number: No runtime or benchmark numbers reported
  • number: Formal results include Theorem II.7 public-coin sumcheck with null completeness
  • number: One input-size-dependent number of rounds is handled by recursive formalization
  • limits: Security is proved under axiomatized algebraic properties and the modeled public-coin interaction; concrete cryptographic assumptions and implementation behavior outside the formal model are not covered. Completeness is null completeness in the stated interactive-proof language. Formalization is Isabelle/HOL and no executable performance evaluation is reported. Fiat–Shamir or downstream protocol security requires additional modeling.
  • how much was read: most of it read
  • record id: formal-sumcheck-2024
• Four-valued STL incremental verification (2024)
  • title: Using Four-Valued Signal Temporal Logic for Incremental Verification of Hybrid Systems
  • what: Defines a four-valued STL semantics and an incremental verification algorithm that runs alongside set-based reachability. One unknown value denotes set-based ambiguity and a second denotes missing future reachability information, enabling early termination when a verdict is conclusive. The paper constructs Boolean until over minimal unitary decompositions, lifts operators to three- and four-valued signals via under/overapproximations, and proves refinement theorems connecting reachable-set verdicts to every covered execution. Algorithm 1 updates atomic predicates per newly computed interval and propagates signals; irrelevant prefixes are discarded. A branch refinement strategy splits reachability by discrete transitions or initial-state regions when one set mixes divergent behaviors. Evaluation covers bouncing-ball formulas (including inaccurate-set unknowns), a CommonRoad lane-change trajectory, and a nine-dimensional genetic oscillator.
  • number: 20 observations accumulated before propagation
  • number: bouncing-ball horizon 2.5 s, steps 0.01 s and refined 0.002 s
  • number: lane trajectory verified through 4 s
  • number: genetic oscillator 9 dimensions
  • limits: Reachability must produce incrementally computed set overapproximations; executions are assumed finite-variability to exclude Zeno behavior, and only future STL connectives are admitted. The method is sound but incomplete (hybrid reachability is undecidable); a verdict of four-valued unknown due to set imprecision requires reachability refinement. One global reachable set can introduce spurious executions and return unknown when behaviors do not synchronize; branch splitting increases cost. CORA discretization and overapproximation accuracy govern results.
  • how much was read: most of it read
  • record id: four-valued-stl-incremental-verification-2024
• Gauthier and Brown Ramsey 2024 (2024)
  • title: A Formal Proof of R(4,5)=25
  • what: Reports a HOL4 proof that the Ramsey number R(4,5) equals 25: every 25-vertex simple undirected graph contains a four-clique or five independent vertices, while an explicitly checked 24-vertex witness contains neither. A parity argument reduces the upper bound to degrees 8,10,12; certified covers and reconstructed MiniSat refutations eliminate every gluing case. Records the exact parity reduction, gray-edge cover semantics and coverage certification, propositional/first-order/higher-order connections, witness checking, heuristic and parameter-search methodology, actual gluing counts and resource bottlenecks, plus the modified theory loader and external dependency validation omitted from the abstract trust claim.
  • limits: Graphs are finite, simple and undirected, with vertex sets represented by subsets of nonnegative integers. Blue means an edge; red means a missing edge. R(n,m,k) denotes k-vertex graphs avoiding an n-clique and m-independent set; R(n,m) is the least k for which that family is empty. These are mathematical definitions rather than a distributed-system execution model (§2). Smaller Ramsey upper bounds are formalized, not all their exact values: R(2,s)≤s, R(3,3)≤6, R(3,4)≤9, R(3,5)≤14, R(4,4)≤18. A putative R(4,5,25) vertex has neighbor family R(3,5,d), antineighbor family R(4,4,24−d), and 7≤d≤13 (§3). Finite-set inductions establish the even degree sum. Since 25 is odd, some vertex has even degree, leaving only 8,10,12. The original 1995 argument only excluded all-degree-11 and retained odd alternatives 7,9,13. The same parity reasoning proves R(3,4)≤9 by ruling out nine degree-three vertices (§3). Printed Lemma 4 proof interchanges the m/n bounds attached to degree and antidegree: neighbors R(r,s+1,d) require d<n+1, antineighbors R(r+1,s,d′) require d′<m+1. Its stated recurrence and final sum contradiction remain valid after the interchange is repaired. This is a presentation issue, not evidence that the unseen HOL4 proof is unsound (§3, p.4). A generalization with n gray edges represents all 2^n red/blue completions. Covers may overlap; exact covers include precisely valid graphs. Exactness is not fundamentally necessary, but permits omission of clique constraints involving the splitting vertex. Regrouping shares proofs across similar graphs rather than assuming a representative proves all completions (§4). Greedy construction starts from an uncovered graph and grays individual edges only when all completions remain valid and enough new cases are included, stopping at a gray-edge cap or no allowed choice. It repeats until coverage; 1000 candidate seeds for R(4,4,k), all for R(3,5,k), selecting greatest uncovered coverage. Nauty normalization is unverified discovery; saved permutation witnesses certify isomorphisms (§§1,4.1). Coverage is independently proved by finite induction for R(3,5,k), k=5–13, with analogous R(4,4,k) proofs. Base case enumerates valid five-vertex graphs up to isomorphism; induction branches gray and newly incident edges. A custom DPLL-like prover uses first-order edge literals, distinct quantified vertices and clique constraints. Forbidding every target generalization and all its relabelings proves there is no uncovered extension (§4.2). Gray edges impose no literal; colored patterns are forbidden by universally quantified constraints. Permutation instantiation uses nauty witnesses to match leaves. Thus completeness is a proved property of generated covers, not an assumption that an external graph list is exhaustive. The conclusion calls the algorithm verified, but the described interface supports certification of outputs and coverage rather than a blanket proof of each heuristic/nauty implementation step (§§1,4,9). Notation errors retained as presentation qualifications: §4.2 sometimes writes R* where the graph property R is intended; §5 introductory sentence labels H as R*(3,5,24−d) although the actual antineighbor family is R*(4,4,24−d), used elsewhere and in the construction. These do not alone establish formal unsoundness. Gluing variables describe edges among 24 vertices: each four-subset has a disjunction of negative edges, each five-subset a disjunction of positive edges; colored partial edges are units and gray/transverse edges unconstrained. Exact covers justify omitting split-vertex constraints. Internal constraints simplify by unit propagation. Unit propagation before the HOL4 interface was necessary due to interface limitations absent in direct MiniSat calls (§5). MiniSat refutations are reconstructed in HOL4. Solver satisfiability answers alone are not the stated evidence. The full trust account also includes the modified theory loader and external dependency checks in §7; no artifact audit or independent rerun was performed for this reading. Simplicity(P)=sum over clauses of 2^(−clause length), based on the explicitly simplistic assumption of separate clause coverage. The graph formula counts five cross-clique configurations: b1b′3/8+b2b′2/16+r2r′3/64+r3r′2/64+r4r′1/16. Larger score predicts easier refutation; this is a heuristic, not a probability or runtime theorem (§5.1, Figure 5). The heuristic is effective only for the same variable count in reported experiments. Gray-containing clauses are ignored for comparing differently generalized problems, favoring delayed gray splits and proof sharing. Average counterpart clique counts permit independent cover construction. Figure 6 tests 200 random ordinary d=10 graph pairs; no confidence intervals, correlation statistic, out-of-distribution validation or universal guarantee is supplied (§5.1). Fastest edge selection maximizes simplicity; mixed-c generalization selection maximizes simplicity^c times uncovered coverage. Parameter estimates sample 200 pair problems and multiply mean runtime by total pair count. Increasing gray caps reduces pair count but raises per-case cost/memory; selected settings prioritize memory feasibility rather than minimum estimated time (§5.2). Table 2 selected caps: d=8 uses 4/0 gray edges, d=10 uses 4/4, d=12 uses 0/8; all fastest/mixed-0.5. Estimated CPU days .018/572/374. Alternatives 5/5 for d=10 estimate 396 days and 1/8 for d=12 estimate 353, but were not selected because of memory. These are sampled total-time estimates rather than measured end-to-end CPU totals. Table 3 ordinary versus generalized gluing: d=8 has 1792=358 versus 272=54; d=10 has 313130816=40945408 versus 4311752=505336; d=12 has 121449166=17389992 versus 12*26845=322140. Generalized total 827530 cases and estimated 946.018 CPU days, compared over 16000 ordinary days. Count/time reductions for d=10 are 81.0/14.6 and d=12 53.9/20.6 (§5.2). Propositional variables are instantiated with first-order E xi xj, proving permutation variants together; distinctness and domain-block constraints isolate neighbor/antineighbor sets. Gluing results aggregate into 27/43/12 theorems and then three degree exclusions. Bijections from canonical intervals to arbitrary finite integer vertex sets connect to the higher-order counting proof (§6.1). Lower bound uses one explicit 24-vertex graph from a 2016 list, not completeness of the list. A symmetric edge-list relation E0 is checked by finite quantified expansion, stopping branches on repeated vertices or a forbidden clique edge. Stated witness verification takes under 15 minutes on one CPU; cardinality 24 connects it to R(4,5)>24 (§6.2). Final gluing took under nine wall-clock days on four machines, two assigned d=10 and two d=12; three machines had 512 GB RAM and one 1024 GB. Each is described as 64 hyperthreaded cores/128 available CPUs; 40 cores per machine were used because memory limited concurrency. Same HOL4 copy maintained compatible theory timestamps (§7). MiniSat proof files could reach 2 GB; 40 concurrent jobs exhausted a 32 GB temporary partition. Authors changed dimacsTools.sml and MiniSat TMPDIR. HOL4 reconstruction required about 20 GB per problem and about three times solver-call time. One theorem per theory and buildheap instead of Holmake controlled per-core memory (§7). Critical trust qualification: loading more than 200000 theories slowed excessively. Authors used an alternative loader omitting link_parents to load the aggregated 43 d=10 and 12 d=12 results without theory origins. External theorygraph checks validate complete dependencies, coherent timestamps and absence of cycles. The final named theory r45_equals_24 has 828857 ancestor theories; the printed theorem remains R(4,5)=25. No claim that this workaround is unsound is established by this reading (§7). The abstract says uncertainty is limited to the small HOL4 kernel, and §8 says the entire proof ran through it. Preserve those as author claims qualified by the modified loading/external dependency procedure. Source code and dependency checker were not audited here. No pinned repository commit, precise HOL4 revision or full resource audit is supplied in this conference paper. Approximately one petabyte of MiniSat proof files is reported versus 200 TB for the Pythagorean triples comparison. This is generated proof volume, not an established peak live storage requirement. The paper compares proof reconstruction approaches but does not experimentally benchmark all external formalizations (§8). The result is a mathematical proof, with no distributed protocol refinement, verified Rust/Verus/TLA+ implementation, LLM proof agent or test of generated specifications. Relevance is methodological: certify search outputs, prove encoding connections and case coverage, account for proof-reconstruction resources and audit theorem-loading dependencies. These transfers are reader inferences, not results tested by this paper.
  • how much was read: most of it read
  • source
  • record id: gauthier-and-brown-ramsey-2024-2024
• Ghost signals and completeness thresholds (2024)
  • title: Semi-Automated Modular Formal Verification of Critical Software: Liveness and Completeness Thresholds
  • what: Develops (1) ghost-signal separation logic for modular termination proofs of busy-waiting concurrent programs under fair scheduling and (2) completeness thresholds reducing unbounded memory-safety proofs for array-traversing programs to bounded checks. Ghost signals are verification-only resources with obligations to set signals, well-founded levels preventing cyclic wait dependencies, and shared-state invariants connecting signal state to arbitrary data structures. The logic is modular over threads/functions and extends to race freedom, deadlock freedom, arbitrary conditions, signal erasure, higher-order features and fine-grained concurrency; appendices prove soundness. A bounded FIFO producer-consumer example and CLH lock were verified with tool support. Completeness-threshold chapters define thresholds over input sizes, derive verification-condition based approximations, prove modular/transitive/elimination rules, and characterize simple unconditional array accesses.
  • number: Tool support verifies C versions of bounded FIFO and CLH lock
  • number: No aggregate benchmark counts or runtime table in supplied text
  • number: Threshold results are theorem-based rather than empirical
  • number: bounded FIFO producer-consumer: 160 annotation lines for 37 lines of C (435%), verifies in 0.08 s
  • limits: Liveness requires fair scheduling and proof obligations that every signal is eventually discharged; levels must be well-founded and correctly encode dependencies. Ghost signals are not runtime state, so invariants linking them to concrete conditions are mandatory. Completeness thresholds target heap programs traversing arrays without allocation/freeing and can yield sound bounded guarantees only when verification conditions are precise; broader data structures remain future work. The dissertation reports no broad benchmark runtime study.
  • how much was read: most of it read
  • source; notes: Semi-Automated Modular Formal Verification of Critical Software (2024)
  • record id: ghost-signals-and-completeness-thresholds-2024
• Hitchhiking GPU LTL model checking (2024)
  • title: Hitching a Ride to a Lasso: Massively Parallel On-The-Fly LTL Model Checking
  • what: Introduces Hitchhiking, a massively parallel on-the-fly LTL emptiness algorithm for GPUs. It tracks interrupted accepting-state searches with a restart set, proving that the algorithm finds an accepting lasso iff one exists and terminates otherwise. Hitchhiking adapts the Map accepting-predecessor algorithm to exploration-time GPU execution. It maintains open, active, and interrupted sets plus a monotone maximal-predecessor function; detailed lemmas establish finite rounds, propagation invariants, cycle detection, and no-cycle termination, and a thread-safety argument explains atomic maxima and barriers. GPUexplore 3.0 integrates the algorithm with a compressed tree hash table, work claiming, generated CUDA successor functions, and Spot NBA construction. The evaluation compares Hitchhiking with Map, Spin NDFS, and 1/32-core LTSmin over 96 BEEM instances spanning 150,000–1.2 billion states.
  • number: Titan RTX 4,608 cores, 24 GB
  • number: 512 threads/block and about 3,000 blocks
  • number: 96 instances
  • number: 150,000–1.2 billion states
  • limits: The model is a finite Kripke structure with total transitions and an NBA product; correctness assumes a strict total order on accepting states, atomic thread-safe updates, and global barriers between parallel loops. GPU memory and state-hash capacity limit scale; work claiming is not BFS, making runtime exploration-order dependent. Benchmarks omit communication-channel models, partial-order reduction, and precise Spin hashing; one telephony family exposed incorrect LTSmin results attributed to overflow.
  • how much was read: most of it read
  • record id: hitchhiking-gpu-ltl-model-checking-2024
• hybrid-zonotope LTL reachability (2024)
  • title: Formal Verification of Linear Temporal Logic Specifications Using Hybrid Zonotope-Based Reachability Analysis
  • what: Constructs temporal logic trees for LTL specifications using backward reachability with hybrid zonotopes. Hybrid zonotopes represent non-convex and disjoint sets more compactly than polytopes while avoiding the exponential cost of general level-set Hamilton–Jacobi methods. Defines HZ-based predecessor computations and temporal-logic-tree construction for linear dynamics with constraints, demonstrates lane/parking reachability, and compares 4D and simplified 2D computation times. The tree can provide safety certificates and potentially support online adaptation and control synthesis.
  • number: Sample TLT construction times were 8.56 s for 4D and 3.94 s for 2D (§VI)
  • number: BRS evolution was shown at 30-step increments through t=150 (§VI)
  • number: Hybrid zonotopes represent two constrained-zonotope lane branches (§VI)
  • limits: The presented parking example uses simplified linear dynamics and set representations; results are preliminary and do not establish broad nonlinear-system scalability. HZ complexity and approximation quality depend on generators and constraints. Full formal control synthesis and richer dynamic environments are future work.
  • how much was read: most of it read
  • record id: hybrid-zonotope-ltl-reachability-2024
• Interpolation-Based Software Verification (2024)
  • title: Interpolation and SAT-Based Model Checking Revisited: Adoption to Software Verification
  • what: Adapts McMillan interpolation-based model checking from hardware to software safety verification in CPAchecker. Large-block encoding extracts program transitions; on 6,024 SV-COMP tasks the approach is competitive and solves seven programs missed by all other approaches.
  • number: 6,024 SV-COMP tasks
  • number: 7 unique solved programs
  • number: 15 min/15 GB limits
  • number: SV-COMP 2022
  • limits: Focuses on reachability safety; results depend on benchmark/resource limits and CPAchecker encoding.
  • how much was read: most of it read
  • record id: interpolation-based-software-verification-2024
• invariant-augmented interpolation model checking (2024)
  • title: Augmenting Interpolation-Based Model Checking with Auxiliary Invariants (Extended Version)
  • what: Augments McMillan interpolation-based model checking with externally generated invariants. Two variants strengthen fixed-point checks or interpolants so unreachable states are pruned, reducing program unrollings and interpolation queries while preserving safety verification. Defines invariant injection into IMC, compares fixed-point and interpolant strengthening, implements IMC variants in CPAchecker, and evaluates against IMC, invariant generators, and other verifiers on SV-COMP-derived tasks. The study reports task-level wins and analyzes overhead from invariant generation.
  • number: On 870 tasks with non-trivial invariants, plain IMC solved 534, fixed-point augmentation 536, interpolant augmentation 544 (§6.4)
  • number: Interpolant augmentation found proofs for 23 tasks where plain IMC timed out, while losing 13 plain-IMC proofs (§6.4)
  • number: Reduced unrollings on 35 tasks and interpolation calls on 56 tasks (§6.4)
  • number: Resource setup: 15-minute/15-GB task limits and 2.5-minute invariant generation (§6.3)
  • limits: Benefits require non-trivial inductive auxiliary invariants; trivial invariants add no information and generator time can erase gains. Evaluation uses bounded resource limits, selected domains and CPAchecker/MathSAT5 configurations. Augmented methods can lose tasks solved by plain IMC because of invariant-generation overhead.
  • how much was read: most of it read
  • record id: invariant-augmented-interpolation-model-checking-2024
• Isabelle AFP distributed build (2024)
  • title: Distributed Parallel Build for the Isabelle Archive of Formal Proofs
  • what: Introduces Isabelle/Scala technology for distributed AFP builds without shared memory or shared file systems. A master analyzes session dependencies, synchronizes workers with SSH/rsync, stores coordination state and compressed ML heaps in PostgreSQL, and workers execute sessions independently. A runtime predictor scales historical timings across hosts/threads; a heuristic solves the multi-mode resource-constrained scheduling problem quickly and reschedules as measurements change. The implementation sets concrete infrastructure assumptions (same platform, local SSDs, SSH/bash, PostgreSQL, repository clones) and explains why Slurm was rejected for cross-platform, low-privilege academic clusters. Build phases include dependency extraction, worker initialization, optional benchmark sessions, queue execution and HTML/LaTeX finalization. The scheduler uses Amdahl-law interpolation, conservative overestimation, host/thread modes and a parallel serial-generation scheme; experiments compare classic, heuristic and CPLEX schedules on preliminary, heterogeneous and Isabelle2024 release data. Three datasets contain 19,263, 30,510 and 30,203 session data points. On release hardware the heuristic finishes AFP in 35:40 (40:50 with slow sessions, 1:59:13 full), while distribution classic mode takes 8:10; full AFP CPU/elapsed speedup exceeds 100.
  • number: single-node AFP had degraded to 4–8 h; 45 min target
  • number: release: distribution 8:10 classic, AFP 35:40 heuristic, slow AFP 40:50, full AFP 1:59:13
  • number: heterogeneous cluster: distribution 9:16 heuristic versus 16:23 classic; AFP 43:11 versus 1:00:25
  • number: heuristic schedule generated in a few seconds
  • limits: Workers run a uniform platform and have fast local file systems; source distribution is synchronized rather than shared. SSH access, GNU bash and a reachable PostgreSQL server are required. Runtime prediction is deterministic and trained from historical runs, despite uncertainty; schedules are periodically recomputed. Session dependencies form a tree because Poly/ML heaps cannot join. Results use small 8–14-machine clusters and AFP/Isabelle workloads, so scaling to other provers or much larger clusters is not established. The heuristic assumes plentiful slower hardware; solution quality drops when only the four fastest hosts are used. Timing bootstrapping stabilizes after 7–8 runs, so the classic scheduler is recommended for one-shot builds.
  • how much was read: most of it read
  • record id: isabelle-afp-distributed-build-2024
• Lean Formalization of Completeness Proof for Coalition Logic with Common Knowledge (2024)
  • what: Reports a Lean 4 formalization of soundness, completeness and the finite model property for coalition logic with individual/common knowledge. Uses reusable syntax and proof-system typeclasses across CL, CLK and CLC, canonical coalition models and finite filtration. Main contribution is mechanized logical metatheory and proof engineering, not an implemented distributed-system case study. Records exact semantic/frame assumptions, positive-length common-knowledge paths, canonical effectivity cases, closure changes needed for deep embedding, finite-state construction, staged Set/Finset/List proofs and the concrete N-maximality derivation. Identifies a printed semantic discrepancy for empty-group common knowledge between the usual reflexive-transitive interpretation of starred notation and the shown Lean path constructors. Separates reported sorry-free artifact from abridged paper snippets; no independent replay.
  • limits: §§3–5, pp.3–7: finite nonempty agent set for stated logic, nonempty state space, atomic propositions encoded by naturals. Syntax is an inductive deep embedding with bottom, variables, conjunction, implication, coalition effectivity, individual knowledge and common knowledge. Syntax itself accepts arbitrary agent types; Fintype and Nonempty hypotheses are introduced where needed. Semantics uses classical reasoning and noncomputable finite-set conversions within Lean/Mathlib. §4, p.4: effectivity E(s,G) is a family of outcome sets a coalition can force, abstracting away explicit actions and strategies. True playability requires six conditions: empty outcome never forceable, universal outcome forceable, grand-coalition maximality relative to empty-coalition complements, outcome monotonicity, superadditivity for disjoint coalitions and a least empty-coalition outcome set. These are model assumptions, not distributed runtime liveness or memory-safety claims. §4/5, pp.4–7: each individual knowledge relation is reflexive, symmetric and transitive (S5-style equivalence). Coalition effectivity means the satisfying-state set belongs to E(s,G). Individual knowledge quantifies over indistinguishable states. Printed mathematical common knowledge uses a starred union relation, whereas Lean snippets use paths with at least one edge. For a nonempty coalition reflexivity bridges these conventions; empty coalition requires a different convention and exposes a discrepancy. §6/Table 1, pp.5/7: reported soundness Theorem 4 is theoremhood implies validity in the defined class of models, proved by induction on derivations. Axioms for coalition operators correspond to playability conditions; knowledge axioms use equivalence relations. Common-knowledge axiom C and induction rule RC use path-constructor arguments. This is not correctness of any specific program or natural-language requirement. §7, pp.8–9: Pformula gives constructors, Pformula_ax adds propositional derivability, CLformula adds effectivity and laws, Kformula individual knowledge, Cformula common knowledge with finite agent type. Typeclasses state minimum operations/laws; they are not generic inductive syntax. Generic semantics is omitted, so some proofs by induction remain tied to particular formula datatypes. §8.1, p.9: canonical coalition states are maximal consistent sets. For proper coalitions, X is effective iff some formula has its truth set inside X and its effectivity formula in the state. The grand-coalition case uses complements and absence of empty-coalition effectivity. Generic construction assumes nonempty agents and propositional bottom is not derivable. Initial canonical model has only five playability conditions and no epistemic relations. §8.2, pp.9–11: finite closure contains every subformula of every closure member, single negations, Ki CG ψ for members of common-knowledge groups and CG[G]ψ for effectivity formulas. Finiteness of agent groups enables finite expansion. Filtered states are canonical-state intersections with closure, represented by a filtered powerset and attached membership proof. There are at most 2^|cl(φ)| possible filtered states; this is a reader counting bound, not a paper runtime measurement. §8.2/8.3, pp.10–14: filtered effectivity treats grand coalition existentially and proper coalitions universally over canonical representatives. Finite models make empty-coalition principality follow from playability. Proofs use pairwise incompatibility of distinct filtered states and provability of the universal state disjunction. Set-to-Finset-to-List conversions require preserving disjointness, membership and absence of duplicates. §8.4/8.5, pp.14–15: Truth Lemma 5 equates filtered-state membership and satisfaction for formulas inside the finite closure. Common-knowledge proof inducts on positive-length paths from the front. Completeness Theorem 6 is validity implies theoremhood, using a maximal consistent extension of {¬φ} and a finite filtered countermodel. This establishes formula completeness/finite countermodels under the chosen semantics, not strong completeness for arbitrary infinite theories or a measured decision algorithm. §§1/3/9, pp.2–3/15–17: authors report all artifact proofs sorry-free, Lean 4.4.0-rc1 and Mathlib 98fe17fd, after completing an original Lean 3 proof and porting it. Paper snippets omit proof steps and even show an explicitly explained sorry. Code size about 6,000 lines: 300 CL, 700 CLK, 1,100 CLC and almost 4,000 shared. No exact build timings, proof-search benchmark, independent axiom audit or implementation replay provided in this reading. §9, pp.16–17: main engineering burden is finiteness/datatype conversion and long routine inductions. Native quantified representations and more generic semantics/inductive structures are proposed improvements, not implemented evaluations. IoT and metro systems motivate the introduction but are not verified cases. No Rust, Verus, TLA+, LLM agent or deployed distributed protocol experiment.
  • how much was read: most of it read
  • source
  • record id: lean-formalization-of-completeness-2024
• Modular Verification of Intrusive List and Tree Data Structures in Separation Logic (2024)
  • what: A modular separation-logic method for intrusive data structures, where clients embed link nodes inside data objects. The representation separates node topology from attached data. Coq/Iris proofs in HeapLang reuse node-level specifications to verify cyclic/doubly linked lists, deques, and unbalanced binary-search-tree maps, including internal pointers and insertion. Shows that singly linked intrusive sequences compose into cycles, two oppositely directed cycles compose into a dcycle, and data fields framed alongside dcycles give a deque. For search trees, separates shape, key ordering and attached values; uses functional one-hole contexts and separating implication to retain the traversed tree while returning a pointer to an interior link. Locate is proved once and its contract makes insertion a modular, non-inductive client proof.
  • limits: Object programs are in unmodified Iris HeapLang, a simplified language with dynamic allocation, arrays and location arithmetic. The paper deliberately omits C fixed-width integers, byte representation and alignment. It does not verify actual Linux/Boost C/C++ code, C container_of provenance rules, a compiler, or machine execution. Hoare triples guarantee no crash under their ownership preconditions, and the stated result if execution finishes. This is partial correctness, not a proved termination/cost bound. The illustrated operations are sequential; the use of the concurrent Iris framework does not establish concurrent linearizability or thread-safe list mutation. Node APIs require ownership of supplied link cells and return detached ownership after removal. Clients allocate/deallocate enclosing objects. Data-layout predicates require separate ownership of topology and payload fields; arbitrary aliasing between those fields is not admitted. Concrete BST API uses natural-number keys and ordinary comparisons. Generic functional discussion uses a Boolean comparison p, but the printed assumptions/as-stated lemmas have apparent gaps detailed below. No balanced-tree invariant, rotations, deletion API or logarithmic complexity theorem is provided. Partial-tree reconstruction requires a valid one-hole context and a subtree whose insertion preserves the whole-tree BST invariant. A magic wand does not allow plugging an arbitrary key arrangement into the hole. Functional correctness lemmas and context generalization are part of the proof effort. Formal checking depends on Coq, Iris reasoning about HeapLang, and the declared definitions/specifications. Diaframe assists proof search and small pointer-arithmetic support is added in Setup.v. The paper supplies a Zenodo mechanization, but this reader has not replayed it or compared printed inconsistencies to source. The deque proof-size claim is less than30Coq proof lines for the deque API after underlying dcycle specifications, Iris lemmas and Diaframe support exist. It is not the size or cost of the full library or tree development. Scaling to more graph-like shared structures remains open.
  • how much was read: most of it read
  • source
  • record id: modular-verification-of-intrusive-2024
• mypyvy repository (2024)
  • title: mypyvy: A Research Platform for Verification of Transition Systems in First-Order Logic.
  • what: mypyvy is a symbolic transition-system language inspired by Ivy. Its README documents inductive invariant checking and inference and gives a lock-server example.
  • number: 43 top-level examples, 83 more under misc and fbii
  • number: examples/misc/pd at the inspected checkout has 39 .pyv files covering cache, consensus, lock service, ring election, sharded KV, TLB and Paxos variants
  • limits: The README gives setup and examples, not benchmark results.
  • how much was read: most of it read
  • source
  • record id: mypyvy-repository-2024
• Nakasho Shidama PDLAX semicircle theorem 2024 (2024)
  • title: Classical Isoperimetric Theorem
  • what: Nakasho and Shidama formalize an isoperimetric bound for continuously differentiable plane curves on[0,π],with endpoints on the x-axis and constant speed. At unit speed the signed integral of y times x′ is at mostπ/2,with equality exactly for either of two translated,oriented unit semicircle parameterizations. The final theorem scales the squared speed toL/π and the bound toL/2. Continuity/integral positivity,restriction-aware derivatives and an auxiliary factorization y=u sin support the result. Records actual smoothness,domain,constant-speed and orientation contracts,the exact equality alternatives and scale parameter. Distinguishes the signed integral from unsigned geometric area without simplicity/positivity assumptions,and free x-axis endpoints from two prescribed endpoints. Exposes how endpoint continuity,vanishing derivative and nonnegative-integral arguments support equality rather than merely an upper bound.
  • limits: MML PDLAX version8.1.14 5.86.1479 identifies the article. The Introduction attributes the method to Peter D.Lax and presents this as Wiedijk problem43. It references HOL Light work but contains no theorem-by-theorem comparison,proof-size/timing benchmark or independent checker transcript (pp.187–188,194). Result1 extends a continuous partial function’s constant value on(a,b) to[a,b],a<b,using sequences approaching both endpoints. Results2–4 establish nonnegative integrals,integral monotonicity and constant lower bounds with explicit closed interval domain and continuity assumptions. Results5/6 turn a positive continuous value at an interior point into a positive lower bound e(d−c) on the total nonnegative integral (pp.188–190). Result7 represents the full integral as a limit of integrals over[a+1/(n+1),b−1/(n+1)]. For arbitrarya<b,the early endpoints may be reversed or outside[a,b];eventually they are ordered inside. The sketch proves an eventual error bound using boundedness of|f|. The record preserves the printed total sequence formulation without independently auditing the partial-function integral’s conventions for its early terms (p.190). Result8 gives sine/cosine derivative laws on an open set;9 givesf+f=2f. Results10/11 transfer point differentiability and derivative values under restriction to an open neighborhood. Result12 equates derivative restrictions when an openZ lies inX andf is differentiable onX. Result13 combines zero derivative on(a,b),exact domain[a,b] and continuity to obtain a constant on the closed interval (pp.190–191). Result14 assumes differentiable partialx,y,an openZ containing[0,π] and lying in both domains,continuous derivative restrictions onZ,unit squared speed x′²+y′²=1 throughoutZ,and y(0)=y(π)=0. It constructs continuousu with exactdomain[0,π],differentiable interior,continuous interior derivative,and y=u sin;there is no premise thaty≥0,x is monotone or the curve simple (pp.191–192). The same14 gives y′=u′sin+u cos inside,constructs convergentF_n=integral from1/(n+1) toπ−1/(n+1) of1−(u′)²sin²,and bounds integral yx′ by one half of integral(y²+x′²). Unit speed rewrites the latter integrand as y²+1−y′²,and14 identifies that integral withlimF. The construction handles endpoint zeros ofsin through a continuousu rather than globally dividing bysin without endpoint justification (pp.191–192). Result15 proves the unit-speed bound integral_0^π yx′≤π/2 under14’s open-neighborhood hypotheses. Equality iff either all t∈[0,π] satisfy y=sin t,x=−cos t+cos0+x0,or all satisfy y=−sin t,x=cos t−cos0+x0. The two alternatives cover the upper/rightward and lower/leftward semicircles giving the same positive signed integral. The statement fixes the parameterization and permits horizontal translation,not arbitrary reparameterization (p.192). Result16 removes the explicitly suppliedZ:partialx,y are differentiable,their domains contain[0,π],their derivatives restricted to their full domains are continuous,and squared speed is1 on the domain intersection. It gives the same bound/equality and cites12. This is not an extension to every rectifiable,nondifferentiable or arbitrary-speed curve;no arc-length reparameterization theorem is supplied here (pp.192–193). Result17 assumesL>0 and squared speed x′²+y′²=L/π,not speedL/π and not arc lengthL. It gives signed area≤L/2,equality with sine/cosine divided bysqrt(π/L). Its sketch rescalesx,y byk=sqrt(π/L),applies the unit-speed statement,and rescales the integral byk² (pp.193–194). Reading conversion,not a printed new theorem:under17’s speed condition,the curve length on[0,π] isell=πsqrt(L/π)=sqrt(πL),soL=ell²/π,the radius isr=sqrt(L/π)=ell/π,and the bound isell²/(2π). TreatingL itself as arc length would give the wrong dimensions and numerical bound. The equality endpoints are separated by2r;their x-coordinates were not prescribed by the hypotheses. The article calls integral_0^π yx′ an area,but the displayed premises do not require a simple arc,x-monotonicity,nonnegativey or fixed endpoint x-coordinates. Therefore the literal theorem concerns an oriented integral. Identifying it with ordinary unsigned area of a region,or deriving the closed-Jordan-curve bound perimeter²/(4π),needs additional geometric arguments not displayed in this article (pp.188,191–193). Reading equality mechanism,not a displayed complete proof of15:the pointwise square(y−x′)²≥0 gives the first integral inequality,and the nonnegative deficit integral(u′)²sin² implies the second bound from14’sF sequence. Equality forcesu′=0 inside via continuity/positive-integral lemmas;13extends constancy to endpoints. Together with y=x′ and unit speed,this yieldsu=±1 and the two printed semicircles. Results14/15 print conclusions without their full derivations,so this record does not claim their formal proof scripts were checked. Reading examples,not printed:x(t)=1−cos t,y(t)=sin t has speed1,endpoints(0,0),(2,0),and integralπ/2. The lower curve x(t)=cos t−1,y(t)=−sin t also yieldsπ/2. The horizontal curve x(t)=t,y(t)=0 has speed1 but integral0;the theorem does not force all admissible curves to be semicircles. All eight pages,17results/all clauses/sketches,Introduction,funding footnote,16references/date read;both sheets and enlarged p.193 inspected. Quotations are raw-extraction excerpts,not visual formula transcriptions;integrals,restriction/derivative subscripts,squares and radicals can be distorted. No formal artifact execution,empirical measurements,proof automation success rates or systems/Verus/Rust/TLA+/LLM-agent experiment.
  • how much was read: most of it read
  • source
  • record id: nakasho-shidama-pdlax-semicircle-theorem-2024-2024
• neuralmc (2024)
  • title: Neural Model Checking
  • what: NeuralMC trains neural ranking functions (measures that shrink toward the goal) from simulation samples. It targets LTL liveness of SystemVerilog hardware. It then validates the functions symbolically with SMT over all transitions.
  • number: Table 1: 194 tasks; own tool 180, ABC 57, nuXmv 117, commercial X 156
  • number: five hours per task
  • number: VGA solves 0 of 10
  • limits: It covers finite hardware models. Training failures and timeouts are separate from proved violations.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: Neural Model Checking
  • record id: neuralmc-2024
• PUPER optimal unfolding LTL checking (2024)
  • title: On-the-fly Unfolding with Optimal Exploration for Linear Temporal Logic Model Checking of Concurrent Software and Systems
  • what: Introduces on-the-fly unfolding with optimal exploration for LTL checking of concurrent programs. PUPER builds an exploration tree with delayed conflict transitions, explores each partial-order run once, and simultaneously unfolds a PDNet synchronization with a Büchi automaton. Defines PDNet conflict transitions, delayed sets, and an exploration algorithm that avoids enumerating concurrent combinations while checking counterexamples. Evaluates PUPER against traditional unfolding, SPIN, and DiVine on high-concurrency and mutual-exclusion benchmarks.
  • number: PUPER spends 6.34× less time than baseline unfolding on average (§5.3)
  • number: Against DiVine and SPIN, PUPER averages 0.05 s versus 1.55 s and 33.90 s (§5.4)
  • number: Baseline times out by 20 threads on Concur while PUPER solves within 300 s at 30 threads (§5.3)
  • number: PUPER outperforms SPIN by 368.02× on the listed benchmarks (§5.4)
  • limits: The method targets PDNet-modeled concurrent programs and LTL-◇/specified LTL fragments, with performance depending on conflict structure and event combinations. Benchmarks use 16 GB memory and 300 s limits; traditional methods can be competitive when combinations are small. The tool is experimental.
  • how much was read: most of it read
  • record id: puper-optimal-unfolding-ltl-checking-2024
• rlive (finite-state) (2024)
  • title: Avoiding the Shoals - A New Approach to Liveness Checking
  • what: This is a liveness checker for finite-state hardware circuits (AIGER). It checks that the circuit eventually stabilizes, or it finds a repeating execution that violates this. It is the predecessor of rlive-inf.
  • number: 223 benchmarks
  • number: limits 8 GB and 1 h
  • number: Table 2: nuXmv -rlive solved 159 (66 proved, 93 violated) vs k-Liveness+BMC 146 (61, 85)
  • number: Table 3 virtual best proves 82 and refutes 101; without rlive 82/85
  • limits: It covers circuit models only. It reports no circuit sizes and no human-effort totals. The notes did not identify the modified nuXmv source archive.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: original finite-state rlive
  • record id: rlive-finite-state-2024
• RTLola UAV Monitoring (2024)
  • title: Monitoring Unmanned Aircraft: Specification, Integration, and Lessons-Learned.
  • what: Reports integration of RTLola-generated runtime monitors for electric unmanned aircraft across log analysis, hardware/software-in-the-loop testing and flight tests, with an abstraction decoupling stable specifications from environment-specific integration. Defines translation layers between system outputs and monitor inputs, validates event-source mappings, and presents flight-phase detection, detect-and-avoid, geofence, sensor/system checks and other representative specifications. The monitor was integrated into development environments and tested in a flight with feedback to ground control.
  • number: Three organizations contribute authors: CISPA, Volocopter and DLR
  • number: A large case study covers representative specifications across multiple integration environments
  • number: A final test flight reports monitor feedback to the remote pilot
  • number: No quantitative accuracy/runtime benchmark table is reported
  • limits: Some specifications are unpublished because they require complete system knowledge. The monitoring approach checks observed streams and integration assumptions; external components must conform to their specifications. The paper reports a large case study and test flight rather than controlled detection-accuracy or runtime benchmarks.
  • how much was read: most of it read
  • source
  • record id: rtlola-uav-monitoring-2024
• SCYTHE distributed protocol synthesis (2024)
  • title: Efficient Synthesis of Symbolic Distributed Protocols by Sketching
  • what: Introduces SCYTHE, a syntax-guided and counterexample-guided synthesizer for completing TLA+ sketches of parameterized distributed protocols. It enumerates typed expressions with cache/equivalence reduction and short-circuiting, uses TLC to check finite instances, and generalizes counterexamples into pruning constraints for safety, deadlock, liveness, and stuttering. The tool synthesizes protocols including consensus, 2PC, locks, sharded stores, and Raft reconfiguration. The paper formalizes protocol instances, fairness, sketches with pre/post holes and regular-tree grammars, and distinguishes finite-instance synthesis (Problem 1) from all-parameter-instance synthesis (Problem 2). Candidate generation uses cache-based size enumeration and semantic normal forms for Boolean/set/equality expressions; pruning constraints are disjunctions of hole interpretations. Safety constraints are optimal, while deadlock/liveness/stuttering encodings are sub-optimal but non-over-pruning; fairness and explicit implementability/environment constraints prevent vacuous solutions. TLC exhaustive checks each finite instance. In 22 benchmark rows, equivalence reduction cuts generated expressions by orders of magnitude; final TLAPS proofs establish safety for arbitrary instances in all but the two-process-only Peterson cases. Extra-checks expose finite-size overfitting: two Raft variants initially correct up to 3 nodes failed at 4+ and required larger-instance checks.
  • number: 22 benchmark configurations
  • number: up to >3 orders of magnitude expression reduction
  • number: raft-reconfig ID 121: 694,552 to 271 expressions
  • number: 4-node extra-check caught 3-node overfitting
  • limits: Synthesis guarantees only the finite instance checked by TLC unless an independent proof (TLAPS) establishes parameterized correctness; the search problem is generally undecidable. Grammar restrictions, typed symbols, opaque domains, finite-state verifier instances, fairness constraints, and manually specified implementability/environment separation shape results. Liveness pruning is sub-optimal; weak-fairness handling may under-prune. TLC calls dominate many runs, and the final all-instance verification remains a difficult/undecidable step. Benchmarks are adapted from existing specifications and may not represent arbitrary distributed protocols.
  • how much was read: most of it read
  • record id: scythe-distributed-protocol-synthesis-2024
• SEEV ReLU neural barrier verification (2024)
  • title: SEEV: Synthesis with Efficient Exact Verification for ReLU Neural Barrier Functions
  • what: Introduces SEEV, a synthesis-and-verification loop for ReLU neural control barrier functions (NCBFs) on continuous nonlinear control-affine systems. It regularizes activation patterns along the barrier boundary and exactly checks correctness, hyperplane, and hinge conditions required by a nonsmooth Nagumo-style safety theorem. The model is xdot=f(x)+g(x)u with safe set C={h>=0} and inner set D={bθ>=0}. Proposition 1 requires feasible controls on every boundary activation set and D⊆C. Training combines correctness, derivative/feasibility, and a boundary activation regularizer; outer CEGIS adds verifier counterexamples. The verifier finds an initial boundary activation set by a line segment and LP, enumerates all boundary hyperplanes with neural breadth-first search, enumerates boundary hinges by LP, then applies cheap sufficient checks before nonlinear exact checks (dReal where needed). Theorem 2 gives a valid NCBF when all checks pass. Experiments on Darboux, obstacle avoidance, hi-ord8 and spacecraft rendezvous show major speedups; SR 6D L4/M8 falls from 298.7s baseline to 60.1s, while dReal/Z3 are unavailable or time out in many cases. Regularization cuts SR boundary hyperplanes from 6218 to 627 at equal coverage in one configuration.
  • number: SR boundary hyperplanes 6218 to 627 with r=50
  • number: Darboux verification 2.5s/3.3s versus 315s/631s baseline
  • number: hi-ord8 up to 22.4s while baselines time out
  • number: SR 6D L4/M8 60.1s versus 298.7s baseline
  • limits: ReLU piecewise linearity, continuous f and g, connected unsafe and initial sets for the boundary enumeration argument, and exact dReal checks are assumed. High-dimensional synthesis remains difficult; exact verification for non-ReLU NCBFs is open. Hinge combinations may be costly, and training loss alone cannot prove safety.
  • how much was read: most of it read
  • record id: seev-relu-neural-barrier-verification-2024
• Sequential ECC formal verification (2024)
  • title: Pragmatic Formal Verification of Sequential Error Detection and Correction Codes (ECCs) used in Safety-Critical Design
  • what: Presents a practical proof strategy for combinatorial and sequential Quad Bit Error Detection/Triple Bit Error Correction ECCs. It removes irrelevant memory, models codeword errors, proves syndrome linearity and position dependence as helper assertions, checks a cycle-inaccurate encoder model against RTL, then uses k-induction/SST lemmas to obtain unbounded proofs. The complete case study reports the actual SVA properties, bug discovery, error-space reduction, six-cycle encoder/three-cycle detection/two-cycle correction pipeline, equivalence glue model, induction equations, SST traces and missing environment constraints. It distinguishes a bounded result after 120 hours from the final unbounded result after adding decoder-IDLE and non-overlap assumptions. The method finds an incorrect one-hot error-flag bug before tape-out, but the conclusion says width, correction capability, and latency still limit scalability.
  • number: 128-bit data with up to four-bit errors gives approximately 1.1×10^8 combinations
  • number: reduced multi-bit detection analysis uses one fixed data word and takes 10 hours
  • number: linearity approach alone gave up after 120 hours with a bounded result on the sequential core
  • number: all properties prove within 24 hours with complexity reduction; dedicated settings report 18 hours
  • limits: The target is a 128-bit data plus 25-bit ECC Reed-Solomon-style QEDTEC design. Memory is removed as irrelevant and legal protocol behavior is assumed, including decoder starting IDLE and non-overlapping encode/decode. Helper assertions and cycle-inaccurate model are trusted only after equivalence proofs. Results depend on Cadence JasperGold engines/SST tuning; larger widths, correction counts or pipeline latency may fail to reach unbounded proof in reasonable time. This is RTL/SVA evidence, not a Rust/Verus proof.
  • how much was read: most of it read
  • record id: sequential-ecc-formal-verification-2024
• SMC plus process mining for product-line validation (2024)
  • title: White-box validation of quantitative product lines by statistical model checking and process mining
  • what: Combines statistical model checking (SMC) simulations with process mining (PM) to validate quantitative product-line models. Simulation logs are mined into a procedural model, converted back into QFLan-style graphs, and differenced against the intended model to expose unexpected or missing behavior. Automates log preprocessing, process discovery, conversion to model-language graphs, and diff visualization. Evaluations cover a coffee-vending product line, scalability on an elevator model, and a cyber-security attack-defense model in RisQFLan, showing issue localization, suggested fixes, and cross-domain use.
  • number: Two well-known product-line models plus a security model were evaluated (§Abstract)
  • number: Vending-machine queries compare maximum prices 10 and 15 (§4)
  • number: Elevator scalability experiments report runtime curves (§5)
  • number: RobBank original and refined models compare probability queries at step 100 (§6)
  • limits: SMC provides statistical estimates, not exhaustive guarantees; PM reconstructs only behavior observed in sampled logs and can miss rare events. Results depend on model specification, simulation parameters, mining algorithm, and graphical diff interpretation. The authors note future work for rare events and additional probabilistic frameworks.
  • how much was read: most of it read
  • record id: smc-plus-process-mining-for-product-line-validation-2024
• Stochastic Omega-Regular Verification and Control with Supermartingales (2024)
  • what: Introduces nonnegative Streett supermartingale certificates for probability-one omega-regular properties of general discrete-time stochastic processes. Uniform expected decrease on A minus B, bounded increase on B and no increase elsewhere certify each Streett pair. For Markov models, combines deterministic Streett automata, inductive invariants and parametric policies into polynomial-real constraints. Gives template-relative synthesis reductions to quantified NRA, existential NRA, QCP or LP, and eleven small example timings. Completeness for every satisfying stochastic process is explicitly open. Uses Robbins–Siegmund to certify disjunction of finite A-visits or infinite B-visits without proving either disjunct individually almost surely. Derives product-state post-expectations and six classes of universally quantified constraints, preserving invariant and policy synthesis jointly. Explains parametric versus known guards, Farkas infeasibility disjunct, external shielding and finite-memory encoding. Complete table/control parameters support checking exact model/property consistency; reader calculations identify printed automaton boundary and controller discrepancies, not inspected tool defects.
  • limits: General theorem uses a filtered probability space, measurable/adapted processes, nonnegative real V and fixed positive epsilon,M. It certifies probability1, permitting measure-zero exceptional runs, not every possible trajectory or a quantitative failure probability/time bound. Conditional expectations must be well-defined with the stated nonnegative drift inequality. Any connection to implementation numeric/physical behavior remains outside the mathematical theorem. A Streett pair(A,B) means finitely many visits to A OR infinitely many visits to B. Drift is E[V_next|history]<=V−epsilon1_(AminusB)+M1_B. Uniform epsilon matters; arbitrary strictly positive but summable decreases would not exclude infinite A-visits. B may recharge the certificate, so V need not be an ordinary supermartingale globally. Reader derivation of Theorem2 from Theorem1:take U_t=epsilon1_(AminusB),W_t=M1_B. On finite B-visits,sumW finite; Robbins–Siegmund implies sumU finite almost surely, hence finite AminusB and finiteA. Finite conjunction of probability1 pair-events preserves probability1. The paper gives theorem statements/intuitive examples rather than a machine-checked derivation. Theorem3 restricts Markov drift conditions to a measurable supporting invariant I containing the initial state and preserved with probability1. This can exclude unreachable regions where no global certificate exists. V must remain nonnegative onI; disregarding invariant initiation/consecution would break the proof. Common epsilon,M across finitely many pairs can be obtained by min/max if separate finite constants exist. Synthesis model is time-homogeneous real-state update f(x,w;kappa),i.i.d.disturbances and known fixed policy templates. Memoryless deterministic policies are direct; finite-memory/random inputs can be encoded by extra state/disturbances with fixed memory size/template. This does not synthesize arbitrary history-dependent policies or verify adversarial nondeterministic schedulers without a separate semantics. Deterministic Streett automaton reads current state label, advances q using currentx and advances modelx synchronously. Certificate/invariant live on product(x,q); automatonq alone generally lacks Markov time-homogeneity. LTL-to-automaton correctness and measurable observation predicates are trusted. Rabin duality requires negating the property/probability appropriately, not interpreting a Rabin probability0 result as satisfaction of the same unnegated formula. Symbolic closed-form post-expectation is essential. Theory allows piecewise polynomial templates of fixed degree and polynomial post-expectations, reducing to existential parameters/universal real states with quantifier elimination. Non-polynomial dynamics, arbitrary distributions, unknown degree, non-real arithmetic and unbounded unknown memory lie outside this algorithmic decidability claim. Template completeness is relative to existence of certificate,invariant,policy satisfying the encoded constraints in supplied forms. The paper explicitly leaves completeness of Streett certificates over all satisfying stochastic processes open. SolverUNSAT can show no encoded-template solution, not generally disprove the temporal property; no claim that increasing degree/regions must eventually succeed. Eq16 requires closure for every disturbance w inW, which is sufficient but stronger than Theorem3 probability1 closure when W contains null-probability choices. Example uniform[0,1] hasP(w>0)=1but excludes point0onlyalmostsurely; robust all-wclosure of invariantx>0 would fail. Relative completeness should be understood for the stronger written constraints, not all measurable probability1invariants. Piecewise linear in state does not mean linear in unknown coefficients: controller/certificate products make existentialNRA. Farkas implication rewriting includes either nonnegative multipliers proving consequence or multipliers proving antecedent infeasible. With known guards/invariant, discard infeasible premises then use feasible Farkas form. QCP may be nonconvex; polynomial products can be encoded with fresh quadratic equations. Fixedautonomous dynamics plus fixedguards reduce toLP. Strict-guard reduction cites[20,Lemma1] without reproducing its preconditions. Simply replacing strict premises by weak ones is not equivalent for an infeasible strict antecedent whose closure becomes feasible: (y<0 AND −y<=0)=>1<=0 is vacuouslytrue, while closed version fails aty0. A correct reduction must preserve strict infeasibility or meet the cited lemma conditions. This is a missing justification/precondition issue, not an inspected solver bug. Visible Figure3 claims DSA for(x>=−1) U G(−1<=x<=1),but transitions classify x>=1asq0 and only−1<=x<1asq1. Constantx1satisfies the printed closed-interval formula yet stays inq0forever and is rejected by Streett({q0,q2},empty). Thus displayed automaton enforces the stronger eventualx<1boundary; examplecontroller kappa.5 avoids that boundary issue, but general translation claim is not exact as printed. Example3 continuous uniformnoise[-.1,.1],x0=100,kappa.5 has V=x+1inq0,0otherwise andI:q0x>=−.2,q1x∈[−.2,.9],q2false. Eq32driftε.5 atx>=1andEq33atx<1are valid onI. Eq26maps[-.2,1)to[-.2,.6),Eq29maps[-.2,.9]to[-.2,.55],so closure holds. This is a concrete worked proof, not an executed synthesis replication. Example4 Eq44 prints PostV determined solely by x for all q∈{q0,q1,q2}, although q2 is absorbing in Figure3. For q2 the actual post branch uses alpha2,beta2 regardless of x; setting the q2 invariant false makes that defect irrelevant for Example3. Eq43 has an unexplained printed fv prefix. These are presentation defects; no artifact behavior is inferred. Prototype uses one affine certificate case per automaton state, convex polyhedral invariant templates, Spot LTL translation, SymPy symbolic manipulation and Z3 QF_NRA. Eleven Table1 rows:5VIC,4VI,1VC,1V; all reported under30seconds. Table includes externally supplied-invariant VC/V cases, despite the generic paragraph saying none are required. No comparison benchmark table, failed instances, scaling study, CPU/RAM/OS/solver versions or public artifact link is identified in this paper. Benchmarks use discrete random variables for weighted enumeration of post-expectation, except countably infinite evenOrNegative whose post-expectation is manual. The continuous uniform-noise example is worked analytically; benchmark distributions are not all continuous. Authors report a single deterministic execution and negligible variance, without repeated timing data, error bars or independent replication. Temperature1 model is x_next=.99x+2.8+alpha*x+beta+noise, with fair independent noise±.1 and x0=280K. Hot means x>298, Cold x<292. Alpha−1/32,beta4787/512 yield contraction767/800, center≈294.536 and limiting extreme interval[292.111742,296.960227], consistent with eventual comfort. Observations classify292/298 as neither Hot nor Cold, while prose uses open interval(292,298); preserve the boundary distinction. Reader counterexample to printed Temperature3 controller:alpha−1/64,beta9/2 give x_next=(1559/1600)x+7.3±.1. Starting from280, interval[280,289] is invariant: smallest/largest images are280.025/288.994375. Cold is therefore always true and Hot never true; GFCold=>GFHot fails on every run. This contradicts the printed model/observations/controller/property combination. It may be a model or parameter printing mismatch, not an independently inspected tool defect. Reader Temperature4 check:below shield305, alpha−43/3200,beta4 give x_next=(125/128)x+6.8±.1. Interval[280,295] is invariant, with extreme images280.1375/294.9859375. Hot never occurs and shield never activates.32consecutive low disturbances map any state in this interval to<=290.142598<292. Independent fair Bernoulli blocks produce infinitely many such positive-probability blocks almost surely; hence GFCold holds almost surely and GFHot is false. The printed reactivity claim conflicts with these shared dynamics/thresholds/initial state; artifact uninspected. Temperature3 total28.58s includes23.65s SMT. Temperature4 Table1 total4.64s and prose QCP solve.03s measure different work. Comparison changes controller class, shield, supplied invariant and parameter bounds; the entire speedup cannot be attributed solely to solver choice. Original alpha,beta bounds[−10,10], shielded[−5,5], with305alpha+beta<5.24. FinMemoryControl has one memory bit b; parameters alpha56,l1/8,m14,p1/2,q51 give guards x<=112 in b1 and x<=102 in b0. The simultaneous x update is alpha+w in b1, w−1 in b0. The paper does not state this benchmark’s disturbance distribution, initial state or initial memory bit, so its full behavior cannot be independently reconstructed from this PDF. The other random-walk and Temperature2 rows also omit full model details. Relevance is probabilistic liveness certificates, automaton-product invariants, template synthesis and checking exact generated controller/specification agreement. No LLM writes proofs/specs, no Verus/verified Rust or TLA+ pipeline, and no specific distributed protocol/implementation is verified. Quantitative verification and neural certificate learning are future directions; priority claims are author statements.
  • how much was read: most of it read
  • source
  • record id: stochastic-omega-regular-verification-2024
• Taming Differentiable Logics with Coq Formalisation (2024)
  • what: Coq/MathComp formalization of six differentiable logics through one intrinsically typed syntax and separate real/extended-real interpretations. Mechanizes algebraic properties, soundness and equal-input conjunction derivative properties, repairs incorrect informal soundness claims and completes previously omitted STL shadow-lifting analysis. Adds reusable partial-derivative, Cauchy mean-value and L’Hôpital results. Shows that truth extraction from a loss value needs a specified threshold and syntax fragment: finite STL equality evaluates to zero for a true equality and its negation, so sign-based soundness must omit negation. Handles constants by either extended reals or finite signed representatives. Encodes dimensions and availability of negation in dependent types. Proves inversion lemmas for n-ary connectives and formalizes missing limit cases rather than inferring soundness or useful optimization from a well-typed real expression.
  • limits: The core LDL syntax deliberately omits quantifiers, lambda and let from the earlier language. It embeds real constants, finite vectors/indices, arbitrary vector functions and applications, comparisons, n-ary conjunction/disjunction and optionally negation. Intrinsic typing prevents ill-typed terms, not false properties or ill-chosen loss semantics. Gödel, Łukasiewicz, Yager and product interpretations use [0,1]; DL2 uses nonpositive values and STL signed values. Interpretations over ordinary reals coexist with extended-real alternatives. Domain invariants are proof obligations. STL parameter nu is positive; Yager associativity statement requires p>0. Closed-interval soundness means only that an interpretation at a designated extreme truth/falsity value implies the corresponding Boolean truth. It is not a claim that every intermediate fuzzy value is classically true or false, or that arbitrary training loss minima meet the specification. DL2 and STL soundness is for the negation-free syntax. DL2 has no compositional structural negation. STL negates by arithmetic minus, which makes a zero-valued true equality and its negation share zero; the real-valued soundness theorem therefore uses >=0 for true, <0 for false and excludes negation. For finite-real constants the paper selects DL2 True=0/False=−1 and STL True=1/False=−1. Alternative extended-real semantics use domain endpoints. These choices repair a generic-syntax mismatch; they are not interchangeable numerical training implementations without further interpretation/geometry checks. Shadow-lifting is a local partial-derivative property at equal input coordinates, not a statement of strictly improving every unequal conjunction, differentiability everywhere, convergence of gradient descent, global optimum attainment, data generalization or universal network correctness. Disjunction shadow-lifting, weak smoothness, scale invariance and unequal-input generalization remain future work. The displayed Coq shadow_lifting definition quantifies p>0, whereas informal Definition6 allows any nonzero interpreted value. The printed stl_and_lt0 derivative lemma also assumes p>0 despite prose labeling its target branch amin<0. Record preserves that presentation mismatch; negative-domain coverage of the full formal implementation was not independently inspected. The paper formalizes differentiable logics, not neural networks themselves. Vehicle/CAISAR compiler certification is motivation/future integration, not an end-to-end certified specification-to-training/compiler result delivered here. No distributed-system proof, Rust/Verus, TLA+ or LLM proof-generation evaluation is presented. Proof reports rely on Coq, MathComp/MathComp-Analysis and their real/extended-real definitions. Partial is defined using a filter limit; substantive derivative lemmas additionally establish convergence. Artifact repository and Software Heritage archive are linked, but scripts and their axiom inventory were not run or audited by this reader.
  • how much was read: most of it read
  • source
  • record id: taming-differentiable-logics-with-2024
• The Rewster: Type Preserving Rewrite Rules for the Coq Proof Assistant (2024)
  • what: Extends Coq definitional reduction with user rewrite rules and presents a bidirectional type-preservation criterion for PCUIC with universe cumulativity and SProp proof irrelevance. Pattern types and metavariable types are inferred generally; right sides are checked against those types, optionally using equality constraints safely forced by a well-typed match. Coq implementation is reported, while confluence checking and justified conservative rules remain future work. Explains why checking a propositional equality at some common type is unsound under cumulativity and why ordinary unification can infer unjustified symbol injectivity. Gives higher-order metavariable substitution, restricted symbol-headed patterns, triangle/confluence restrictions, a matching antisubstitution proof and a constraint-extraction relation robust under later environment extensions. Separates type preservation from consistency, confluence and termination; implementation status is explicitly dated to publication.
  • limits: Underlying setting is annotated PCUIC with metavariables plus universe/sort-quality variables. Typing depends on a well-formed environment, local/metavariable contexts, structural guard conditions for fixpoint consistency and usual positivity for inductives. Virtual sort annotations matter to principal pattern types but do not carry observable matching content. Pattern matching is restricted: head of main elimination branch must be a declared symbol, not an arbitrary metavariable; variables may occur in argument holes. Patterns are left-linear, contain no β/ι-redexes, and cannot inspect syntactically irrelevant/SProp terms. Holes at irrelevant positions are allowed. These restrictions support the confluence/postponement argument. Subject reduction is conditional on appropriate confluence/triangle and pattern restrictions as well as the type-preservation criterion. Implementation of arbitrary rewrite declarations alone does not establish these global conditions. §8 says porting the Agda confluence checker is an immediate future goal. Definition4 requires a pattern-inference derivation at Tp with exactly its pattern metavariables Θ, and ordinary typing of the right side at Tp. Definition5 permits typing the right side under equalities E extracted soundly from pattern typing; it does not permit arbitrary assumptions selected to make the right side typecheck. Constraint extraction relies on rigidity/injectivity stable under environment extension. Symbols may receive future rules, so eliminations headed by symbols do not justify injective decomposition. Bare metavariable equality can be retained; equalities under higher elimination contexts are discarded, and if several equalities are extracted for one pattern variable, all but one are discarded. The full relation returning no equalities is sound but less useful. Type preservation is not consistency: symbols and rewrite principles may already be inconsistent propositionally. Consistency transfer is attributed to prior extensional-type-theory interpretation when proposed rules are admissible as propositional equalities. Justified-rules support proving this connection is future work, not required/checked automatically for every declaration. Termination is not assumed for subject reduction. The paper states a checker can be correct when it answers while potentially diverging. Its repeated decidable-criterion wording must therefore not be read as a proved total decision procedure for unrestricted user-supplied nonterminating rewrite systems. Article formally presents metatheory in the PCUIC framework and reports implementation. It does not provide a demonstrated machine-checked end-to-end proof that the modified Coq kernel implements this metatheory. No proof-checking session, kernel audit or artifact run was performed by the reader. At publication, rewrite PR18038 was integrated in development, expected for Coq8.20; type-preservation PR19290 was implemented but not yet integrated. These are historical paper statements, not checked current Coq/Rocq release status. Implementation extends presented syntax to primitive projections, universe/sort polymorphism and unfold_fix symbols. Exceptions example has acknowledged potential universe-inconsistency warnings on the if/match rules. No claim that all examples/rules are automatically safe, terminating or conservative. No runtime benchmark, corpus acceptance/rejection rate, proof-size comparison or user-study evaluation. Evidence consists of formal rules/proof arguments, counterexamples and implementation examples. Abstract formally-expressed wording is not interchangeable with fully mechanized verification.
  • how much was read: most of it read
  • source
  • record id: the-rewster-type-preserving-2024
• Timed MSR/PTS (2024)
  • title: Timed Multiset Rewriting and the Verification of Time-Sensitive Distributed Systems
  • what: Defines a multiset-rewriting language with explicit time for systems such as drone surveillance, where goals must hold perpetually under environment interference. Realizability asks whether some infinite trace satisfies timed goals; survivability requires all admissible traces to do so. For progressive timed systems (PTS), both are PSPACE-complete; bounded realizability is NP-complete and survivability lies in Δ2P. PTS limits actions in bounded time, enabling finite abstractions and complexity proofs. The Maude executable semantics checks bounded traces, with timed drone actions, energy and wind interference. The paper distinguishes finite bounded search from infinite recurring obligations and proves upper/lower bounds via configuration equivalence.
  • number: PTS realizability and survivability PSPACE-complete
  • number: With fixed time bound: realizability NP-complete, survivability in Δ2P
  • number: Maude simulation table reports states/time to find traces; no aggregate accuracy metric
  • limits: Complexity results require finite alphabets, bounded fact sizes and progressive timed systems. Infinite-time goals are not directly decidable without PTS assumptions; Maude experiments are preliminary and bounded. Survivability quantifies all environment traces, making it harder than realizability.
  • how much was read: most of it read
  • record id: timed-msr-pts-2024
• TLA+ model-checking education (2024)
  • title: WIP: An Engaging Undergraduate Intro to Model Checking in Software Engineering Using TLA+
  • what: Describes an undergraduate/graduate teaching approach that introduces TLA+ and TLC through puzzles, a microwave controller, concurrency, bounded counters, and buffers. Students progressively confront safety, liveness, deadlock, and thread-safety failures. Analyzes model-checking courses, supplies reproducible examples and open-source modules, and uses successive counterexamples to motivate stronger requirements. The microwave case distinguishes safety (door/radiation) from liveness (eventual shutoff), while bounded buffers and counters introduce concurrency.
  • number: 84% of students reported a positive experience (§Abstract)
  • number: FMEDB analysis covered 34 model-checking courses out of 88 total (§I)
  • number: Preliminary survey covered 32 recent courses (§II)
  • number: No controlled learning-outcome comparison reported
  • limits: Findings are preliminary, based on one institution/course and anonymous student input; the paper explicitly calls the work in progress and plans longitudinal/multi-institution evaluation. Educational engagement does not measure professional verification competence.
  • how much was read: most of it read
  • record id: tla-model-checking-education-2024
• Trace Inlining / Saransh (2024)
  • title: Accelerated Bounded Model Checking Using Interpolation Based Summaries
  • what: Introduces Trace Inlining, a lazy BMC algorithm that alternates under- and over-approximation, extracts Craig-interpolant procedure summaries from verified traces, and reuses/refines summaries across call contexts; implemented as Saransh. The inlining tree tracks overapproximated, inlined, blocked and summarized call sites. A verification oracle encodes passified procedures as SMT VCs; a verified partial trace yields an interpolant summary that replaces a subtree. LIFO unblocking explores all relevant traces; when a reused summary is insufficient, a stronger context summary is conjoined. Recursive procedures are bounded and summarized with special handling; soundness follows because summaries are overapproximations. Artifact includes benchmark and binaries.
  • number: 846 benchmarks: Corral 342 solved, Legion 492, Saransh 512; Saransh 54 h total and PAR2 1390.5 h; 263 instances solved by all, Saransh 16 h vs Corral 98 h and Legion 51 h; virtual best all three solves 630 vs 527 for Corral+Legion and is 4x faster on common set
  • limits: Programs are hierarchical/passified with a unique entry and bounded recursion; safety is checked by VC unsatisfiability, not full inductive verification. Summaries may be insufficient in new contexts and require refinement; Saransh can lose when procedures are rarely reused. Experiments use Z3 v4.5, fixed seeds, hard benchmarks (Corral >200 s), 2 h timeout, recursion bound 3, single core and 32 GB; results are device-driver-specific.
  • how much was read: most of it read
  • record id: trace-inlining-saransh-2024
• Trillium (2024)
  • title: Trillium: Higher-Order Concurrent and Distributed Separation Logic for Intensional Refinement
  • what: Trillium proves that full program executions refine a simpler model. Fairis preserves progress under fair scheduling. It uses fuel to bound stuttering (steps that change nothing). The extended Aneris shows that implementations follow TLA+ models.
  • number: full Coq refinement proof for the SDP example about 1,100 script lines (footnote 9)
  • number: cases: two-phase commit, single-decree Paxos refinement
  • number: Paxos client proof about 1100 lines of proof scripts (footnote 9, p.9:27)
  • limits: The authors translate the TLA+ models into Coq state-transition systems by hand. The distributed instantiation targets safety. Distributed liveness is future work.
  • how much was read: most of it read
  • source; notes: papers and boundaries
  • record id: trillium-2024
• Using Dynamically Layered Definite Releases for Verifying the RefFS File System (2024)
  • what: The RefFS project page links a separate 124-page draft, Progress of Concurrent Objects with Dynamic Dependencies, authored by Mo Zou. Its PDF metadata dates it May24,2024; the project says “A separate paper” illustrates MoLi’s metatheory (P1). This is a complete fresh reading of that PODD paper, not an appendix of the OSDI paper and not a new reading of the RefFS implementation. The original RefFS main-paper account remains inherited from formal509. Whether this precise draft proves every rule of the released MoLi framework is not established by the link alone. PODD makes a thread’s progress depend on definite actions, obligations that their owning threads must fulfill once enabled. Actions have state-dependent layers, and dependencies must preserve strict relative order even when numeric layers change. Layers have a total order, not necessarily a well-founded one. Finite dependency sets and decreasing local/stack metrics supply the termination argument. The LIVE-FRM rule extends action/layer context while preserving old ordering, so an acquisition proof can be reused without expanding every nested wait chain. Tokens account for unblocked loop progress and finitely many levels of delaying interference. Theorem4.2 states linearizability and deadlock-freedom; starvation-freedom additionally requires rely and guarantee actions at level0 (S12,S14,S15). AppendixA supplies the fuller resource/ownership logic, fences, rules and ideal shared-memory semantics. AppendixB first gives judgment simulations with finite-height while stacks: arbitrary-length lexicographic lists would not be well-founded (S31). B.3 expands new while/live-frame cases. B.4 maps these to a common simulation, directly for starvation-freedom and through a lock plus nondeterministically decreasing finite-wait wrapper for deadlock-freedom (S45,S48). B.5 combines thread simulations using finite active-thread dependency sets, scheduler rounds and a lexicographic metric. LemmasB.22–B.30 connect coinductive fair traces to refinement (S54,S57,S58,S66,S69). B.6 defines progress over complete fair traces, permitting abort alternatives, and uses three most-general clients to relate finite refinement to linearizability and fair refinement to linearizability plus starvation/deadlock freedom. The deadlock equivalence wraps the atomic specification; it must not be replaced by the stronger starvation refinement (S72,S74). AppendixC provides all printed proof outlines for nested TAS/ticket locks, ticket-lock coupling lists, optimistic/lazy TAS lists, and two-list transfers. Ticket queues support starvation-freedom; unfair TAS permits only the weaker deadlock-freedom claim. Lists use local lock obligations, node order and finite traversal metrics. Optimistic/lazy cases retain removed nodes in ghost garbage, not a proved memory-reclamation scheme. Lazy contain is explicitly omitted. Transfers use one mutex to serialize moves, list levels0/1/2 and lexicographic (listlevel,distance-to-tail) layers; their add/remove proofs are referred to earlier lists. The two-list move is a useful dynamic-dependency example, rather than a distributed network/crash model (S87,S90,S94,S102,S109,S116,S122,S124). Evaluation consists of paper proofs and worked examples; no numerical benchmark, proof-time table or replayed mechanization is supplied here. Section6 explicitly makes mechanization and automation future work (S20). Section5.1 admits that common rely conditions and frame stability can prevent reuse across objects (S17). Assumptions include fair scheduling, an arbitrary fixed finite number of threads, ideal atomic memory actions, safe total abstract methods and the presented non-nested method-call language. No bounded response-time, weak-memory, crash/recovery or implementation-to-binary theorem follows from this reading. Reader deductions from the literal listings must be kept separate from intended theorems. Figure40’s inner ticket loop never increments o; Figure55’s elems retains marked values and discards unmarked ones; Figure62’s sequential MOVE removes a head before reading the new head. Details and elementary counterexamples are in reader_diagnostics.json, with exact page anchors. These are printed-source defects, not findings about unseen code or a global refutation of PODD. The page also has draft-level omissions: a duplicated strict-comparison branch in the proof on p57, an apparent dependency-set type slip in DefinitionB.12, and an unresolved Fig.?? reference plus omitted scheduler semantics on p58. Underlines/fonts were visually checked before identifying these issues. Relevance to the requested database is manual liveness proof structure and evaluation of specification/proof agents: track actual fairness and progress strength, stable dependency ordering, finite metrics, abstract-method contracts, omitted cases and intended versus literal specifications. These are reader uses of a concurrency result. This paper does not evaluate Verus, Rust, TLA+, LLM agents or distributed consensus. RefFS/Coq performance and proof counts remain attributed to the inherited OSDI paper, rather than this draft. Records exact WHILE/OBJECT obligations, ticket and abstract-lock metric differences, dynamic-layer/TDep construction, VFS bug cycle and source typo, refcount ownership protocol, non-atomic operation abstraction, conditional theorem and unmechanized metatheory, survey denominators, all LOC cells, workloads, normalized performance limits and graph estimates. Separates checked RefFS proofs from trusted C/runtime/lock/allocator and protocol-only VFS reasoning.
  • limits: Fresh source: all124pages, every LF line and all31 rendered contact sheets read; larger renders48,51,54,57–59,66,68–69,96,111,118 inspected. Original21page RefFS main reading inherited from formal509. Separate PODD draft is not a same-title appendix or proof-assistant replay. S12,S15,S72,S74: fair scheduling and arbitrary fixed finite thread count; linearizability plus deadlock-freedom generally, starvation-freedom only under level0 rely/guarantee restriction. Abort alternatives in progress definitions do not establish memory safety by themselves. S10,S22,S23,S27: ideal shared-memory language, primitive atomic operations and specified safe/total abstract methods; presented language excludes nested method calls. No weak-memory, compiled implementation, network/crash/recovery or bounded response-time theorem. S12,S14,S31,S54,S66: total ordering of layers is distinct from well-founded local/stack metrics. Dynamic numeric ranks may change while actual strict dependency relations remain stable. Finite-height stack bound and finite active-thread sets are substantive premises. S17,S20: paper admits object-specific rely/frame obligations and leaves mechanization/automation for future work. Reading the linked draft does not identify its rules with every released MoLi implementation rule. S96,S111,S118: printed metric, lazy abstraction and MOVE inconsistencies require qualification before reuse as formal specifications; counterexamples are elementary reader deductions, without implementation inspection. S102,S109,S116: ghost garbage retention does not prove reclamation; contain and repeated add/remove proof cases are omitted/referred elsewhere. All supplied content was read; omitted derivations were not independently supplied. P1: directory depth ranks can tie. A uniquely determined numeric rank does not give a strict total order on directory identities. Strict ordering of actual lock dependencies needs its own invariant; this local wording issue alone does not refute the locking result.
  • how much was read: most of it read
  • source
  • record id: using-dynamically-layered-definite-2024
• Validating the eBPF Verifier via State Embedding (2024)
  • what: SEV tests the Linux eBPF verifier with deterministic closed programs. It profiles accepted programs, folds their observed register states into R9, then inserts a conditional illegal operation that must be reachable under the observed execution. Accepting that transformed program exposes an unsound approximation. A one-month upstream campaign found15root-cause-distinct verifier logic bugs, including12soundness/3completeness bugs and two reported privilege-escalation cases;10were fixed at submission. This is empirical validation of a verifier, not a whole-verifier correctness proof. Records the self-checking containment oracle and paper-only argument, deterministic-input and trace-preservation assumptions, concrete folding/operator/tracer design, false-negative paths and lack of detection-equivalence proof, all bug class/location counts and overhead values, manual triage, precise sample failures/diagnostic errors and privilege conditions. Separates verified-component claims from incomplete specification/implementation correspondence and records no bugs found in tnum.c rather than treating that as proof.
  • limits: §§1,3.1: Necessary soundness invariant is that every concrete execution state belongs to the corresponding abstract state. The testing oracle embeds an observed value with a branch to an invalid operation; a correct analyzer must consider that branch feasible. A rejected transformed program due to the sink passes this particular test, not every state/path or full verifier soundness. §§3.1–3.2: Inputs are accepted, closed, deterministic eBPF programs without external input/interactions so a single profile is repeatable. Correct interpretation/tracing, folding evaluation and transformed control-flow/register behavior are assumed. The method does not directly validate arbitrary nondeterministic production BPF workloads, concurrent shared map changes or every environment-dependent helper. §3.1 Proposition3.1/Corollary3.1: Paper argues embedding adds no invalid operation except the sink, using branch-state partition Ai=Aj union Ak and safety under subset Ak. This is a prose argument, not a mechanized proof of the generator/transformer/verifier semantics. It presupposes correct construction and original accepted program behavior; it cannot establish that all verifier rejections are bugs without diagnosing their cause. §3.1 folded variant/§4.5: Paper calls folded detection capability equivalent to direct embedding based on likely propagation over continuous campaigns. No injectivity or detection-equivalence theorem/probability bound is proved. §4.5 explicitly allows arithmetic to hide some non-contained states. Folding collisions/precision loss and missing generated programs can produce false negatives; longer testing is not a completeness guarantee. §3.2: R9 is reserved for folded state. One random ALU function is generated per basic block, then reused each time that block occurs in a loop trace; folded expected value is evaluated in execution order. Folding excludes division and unary operations and uses nonzero registers to reduce collapse to zero. These restrictions concern folding instructions, not necessarily every original generated instruction. §3.2/§4.2: Structured generator tracks lightweight register/stack types, encodings and control flow to make accepted tests likely. Tracer records instruction indices/register states at basic blocks using an internal buffer, virtual device and mmap. It does not snapshot all accessible memory; load/store issues are detected only if they propagate to observed registers or yield another diagnosed failure. §§3.2,4.1: Interpreter bpf/core.c is patched for tracing, so runtime ground truth is relative to this interpreter/instrumentation. No claim of testing every JIT compiler, processor or architecture follows. A verifier behavior not exercised by generated accepted programs may remain unchecked. §4.1: Campaign boots compiled upstream kernels in QEMU/KVM guests, restarts dead VMs, and retains original program/profile/transformed program. Root-cause analysis/deduplication is manual; automatic discovery does not mean automatic explanation, exploit construction, patching or independent validation. §4.2: Counts are15unique roots within one month and10fixes as of submission. These historical results do not imply all bugs are fixed today or each has a CVE. Two reported exploitable cases require CAP_BPF or CAP_PERFMON; they are not both demonstrated unprivileged-without-capabilities attacks. All15roots are reported in verifier.c, not arbitrary kernel-memory bugs. §4.2: Soundness bugs wrongly accept unsafe programs; completeness bugs wrongly reject safe ones. Rejection for a reason other than the sink prompts a completeness-bug diagnosis under valid transformation assumptions. A wrong diagnostic for an already-invalid program, as in Figure5d, is a logic-error case but by itself does not demonstrate acceptance of unsafe code or rejection of safe code. §4.4: Overhead comparison runs24hours and repeats measurements for each program, but does not report number of repetitions/programs, distributions, absolute throughput, confidence intervals, per-VM vCPU allocation or accepted-program rate. Total1.6%throughput impact is small partly because only infrequently accepted programs are profiled/transformed. No direct controlled bug-yield comparison with Syzkaller/BVF/Buzzer is shown. §4.5: No false positives observed is an empirical author report, not a proof of the whole oracle implementation. Accepted-program search diversity is the main acknowledged source of false negatives. Raw coverage refers to execution paths in generated programs and induced coverage to verifier code; optimizing induced coverage is left outside scope and no measured coverage percentage is supplied. §4.5: Directly inserting many sinks can halt checking early or fork repeatedly; verifier state pruning cannot remove these paths because precise registers have different ranges. One final folded sink avoids that multiplication. It also tests newly inserted arithmetic, which can expose a bug absent from the untransformed program. §5: Authors report range-analysis bugs in the same Linuxv5.19 version Agni claimed to verify and cite incomplete conditions/divergence issues. This challenges scope/specification correspondence, not validity of every formal proof. No bugs found in previously verified tnum.c (~200LOC) is a testing observation, not a newly proved soundness result. Agni range analysis is~2100LOC against~20000LOC overall verifier. §5: Compared with offline abstract-log comparison, the target verifier itself interprets embedded predicates, avoiding a second full abstract-state parser/reference verifier. This is a metamorphic testing oracle with a semantic containment requirement; without predefined per-component specs does not mean without any specification or modeling assumptions. §§5–6: Kernel-local case applicable to evaluating proof/checker trust and generated specifications. No distributed protocol, Verus/verified Rust, TLA+ or LLM-agent evaluation. A real adaptation to proof assistants/distributed verifiers requires a corresponding executable semantics, valid transformation and oracle; none is implemented here. No SEV repository/artifact appendix pointer in saved PDF; external references and bugs not replayed.
  • how much was read: most of it read
  • source
  • record id: validating-the-ebpf-verifier-2024
• Verified Cody-Waite exponential (2024)
  • title: End-To-End Formal Verification of a Fast and Accurate Floating-Point Approximation
  • what: Develops a fully verified, fast binary64 enclosure implementation of exp for CoqInterval, including bit-level argument reduction, polynomial approximation, tables, exceptional values and reconstruction, and reports a 20× speedup over the prior implementation. The new algorithm reduces x via k=round(x·1/ln2), computes t=(x−k·log2_64h)−k·log2_64l, evaluates a degree-5 polynomial, adds ±d bounds, scales by 2^k and applies next_down/next_up. The paper stresses that seemingly algebraic rewrites break accuracy because floating-point lacks associativity/distributivity. Arithmetic expressions are typed ASTs with IEEE-754 (flt) and real-plus-rounding (rnd) interpretations; exact operations reduce proof burden. A recursive well-behaved predicate WB ensures finite IEEE results equal rnd values (Theorem 1), and simplify_wb automates most exceptional-behavior goals while Gappa handles exact-rounding side conditions. The extracted text reaches §2.2; later strategy details and benchmark tables are unavailable.
  • number: Abstract reports 20× speedup in CoqInterval relative to previous exponential implementation. Prior Rump-integral proof took minutes with bit-at-a-time arithmetic and a few seconds after hardware floating-point support; exact new end-to-end timing is not in the extracted sections. Algorithm uses binary64 (53-bit precision), degree-5 polynomial terms p1…p5, and 64-entry constant table indexed by ki land 63.
  • limits: Correctness targets finite binary64 inputs and Coq’s executable function; theorem relies on WB side conditions (nonzero divisors, no overflow, exact representability for OpExact). Floating-point operations must retain implementation-specific parenthesization; algebraic simplification can invalidate results. The prior interval algorithm supports arbitrary precision, whereas fixed 53-bit hardware precision motivates the replacement. Available extraction omits Sections 3–7, so proof effort, benchmark counts and complete speedup table cannot be independently reported.
  • how much was read: most of it read
  • source
  • record id: verified-cody-waite-exponential-2024
• Verified Safe Reinforcement Learning for Neural Network Dynamic Models (2024)
  • what: VSRL trains neural controllers for finite-horizon safety under a known deterministic ReLU neural transition model. A horizon curriculum and remembered difficult initial regions shape a differentiable reachability-bound loss alongside a safe-RL objective. Verification can be split into shorter chunks for training. A final loop verifies every time step and stores different controllers for different initial-state regions until the initial set is covered. Five simulation tasks compare certified horizons, sampled safety, rewards and two ablations. Separates the curriculum heuristic from final all-step verification, model-relative certification from approximate physical dynamics, initial-state controller selection from unrestricted switching, and bounded-time safety from finite sampled episodes. Preserves every table cell and environment obstacle/initial-set parameters, exact runtime population, reward tradeoffs, missing termination/model-error contracts and printed notation/boundary ambiguities.
  • limits: §2/Eqs1–2: Deterministic CMDP with continuous actions and discrete time; known ReLU transition F, fixed policy parameters, predefined safe/unsafe sets and safe initial box S0. Optimize discounted reward subject to empirical expected discounted costs and mathematically checked state safety for every t=1,…,K and every initial state. Experiments restrict cost limits di=0; arbitrary di is a stated extension, not separately evaluated. §2/§4.1: Guarantees concern the neural transition model. Experimental vehicle/quadrotor dynamics are approximated by small ReLU networks. The PDF provides no certified approximation-error envelope, disturbance/noise model, numerical-rounding contract or implementation refinement. Thus verified NN-model trajectories do not by themselves prove actual nonlinear physics or deployed controller code safe. §3/Algorithm1: Pretrain using safe RL; split initial box according to radius gradients of region cost; advance k=1…K with a maximum nmax training attempts per phase; optionally branch-and-bound within a budget. Near-unsafe initial subregions and their time indices enter a memory buffer. Updating the policy can invalidate earlier checks. Paper explicitly says Algorithm1 does not necessarily guarantee K-step safety; memory is a training heuristic, not a proof of preservation. §3/Eq3: Training combines standard safe-RL loss with weighted bound loss over current unverified regions and remembered regions at their saved horizons. A verifier box intersecting the unsafe set means unverified, not necessarily a real reachable violation: overapproximation can be spurious. Printed Suc=FBound(G0)∩Sunsafe is an output-state set, whereas Eq3 forwards Suc again as an initial set. Prose appears to intend original grid regions whose images intersect unsafe; this domain/notation mismatch needs resolution for a literal algorithm. §3/p5: For avoiding the closed interval [a,b], printed region cost max(xub−a,0)max(b−xlb,0) is zero at boundary contact xub=a or xlb=b, despite the claim CR>0 iff intersection. Strict/non-strict safe boundaries or separation margins must be specified; final verifier must use the actual safety predicate. A zero surrogate loss alone is not a certificate. §3/p5: λ=min(λmax, arLSafeRL/LBound). Prose refers to magnitudes, but the formula lacks absolute values; a negative RL loss can produce a negative coefficient, and LBound=0 handling is unspecified. Loss clipping thresholds and hyperparameter values are absent. These are printed-specification ambiguities; code not inspected. §3/pp5–6: Buffer time categories can merge Si for i1≤i≤i2 into (union Si,i1,i2), reducing graph count. PDF does not completely specify how every intermediate-time obligation is represented in the grouped loss. Comprehensive final verification, rather than the grouped training objective, must establish all-step safety. §3/p6: Incremental verification composes sound box enclosures over chunks 0<k1<…<kn=target, backpropagating only through the last chunk. This reduces graph depth but can lose state dependencies and weaken bounds. Earlier bounds tending to be tight is an empirical claim, not a general mathematical property; chunk gradients need not equal full-horizon gradients. §1/§3/§5: Paper motivates reuse by small policy-gradient changes. Cached reachability bounds must remain sound for the current updated policy. Small parameter changes alone do not establish this: recomputation, invalidation or certified parameter-perturbation bounds are needed. PDF does not spell out that contract. This identifies a missing explanation, not a finding about unaudited implementation behavior. §3/Algorithm2: Verify every time step under the final fixed policy; save only certified initial regions and their parameters, cluster remaining unverified initial regions by violation type, fine-tune and reverify. Soundness requires sound α,β-CROWN bounds, correct dynamics/property encoding, complete S0 coverage and a correct mapping to saved fixed policies. No separate proof-kernel certificate or end-to-end implementation check is reported. §3/Algorithm2: Controller is selected once using initial s0 through h:S0→Θ and then retained for the trajectory. Arbitrarily choosing controllers based on later current states is not justified by initial-region certificates. Multiple policies increase expressivity and resource use relative to a universal single controller. §3/Algorithm2: The while loop stops only once no uncovered initial region remains. Finite violation types imply finitely many possible clusters, not that training finds a safe controller or terminates. No progress/termination theorem, feasibility assumption ensuring success, or general bound on policy count is given. Prose on p6 mistakenly stores (Sunsafe,πθ); Algorithm2 line5 correctly stores certified Ssafe. §4.1/Table1: Verified-K is percentage of regions, which need not equal state-space volume or initial-state probability under adaptive unequal grids. Verified-Max means all initial states certified under the evaluation setup; verification failure does not prove unsafety or impossibility. Full 100% region coverage is the relevant universal coverage result, conditional on the region partition and verifier. §4.1/Table1: Emp-k uses 10^7 sampled initial datapoints, but calls its metric percentage of regions; sampling distribution, aggregation and grid counts are not explicit. Percentages are truncated, not rounded. Finite sampled 100.0 does not establish universal safety beyond the verified horizon. Reward mean±SD is over ten episodes, not reported confidence intervals; checklist item7 calls the intervals confidence intervals. Independent training seeds/repetitions and significance tests are not specified. §1/§4.1: Introduction/contribution list says five baselines, actual experiment names six: PPO-Lag, PPO-PID, CAP, MBPPO, CBF-RL, RESPO. Five settings are lane following, moving-obstacle vehicle avoidance, fixed/moving 2D quadrotor and fixed 3D quadrotor. §4.2/Table1: Certified horizons 80/50/50/50/15 versus best baseline 8/13/14/8/4 yield ratios 10/3.85/3.57/6.25/3.75. Order-of-magnitude improvement over the best baseline occurs in lane following. Lane reward 214 versus best 383 is about 44.13% lower. Moving-2D 364 versus374 and 3D122 versus145 are about2.67% and15.86% lower. These are descriptive comparisons, without a statistical-significance conclusion. §4.2/Table3: Uses 1/2/4/2 controllers for lane/vehicle/fixed2D/moving2D; 3D policy count is not reported. Single-controller verified fractions 99.0/97.6/96.9/74.7 increase to100 with multiple controllers. No isolated memory/curriculum ablation or exact equal-resource comparison of single versus multi-policy training is supplied. AppendixA.1/Table2: Times are for twenty training epochs on one grid region, not complete training, all-region verification, or total project compute. 3D five-step incremental time31.0s is slightly above non-incremental30.9s; at eight steps49.9 versus403.6s gives about8.09×. No full training times or measured peak GPU memory are provided. CPU Ryzen9 5900X12core and GPU RTX3090 specified. AppendixA.2/lane: x is called lateral displacement with equilibrium x=θ=0 and positive target speed, but printed xdot=v*cos(θ+β) is longitudinal-style and nonzero at that equilibrium for straight driving. Coordinate/dynamics notation needs clarification; this is not an artifact-level finding. Numeric target speed, lf/lr split and lane/vehicle discretization step are not stated. AppendixA.2/moving obstacles: Motions are predefined constant-speed paths over500steps. Time or obstacle positions are absent from the listed vehicle/2D state vectors, so a clock/time-indexed unsafe set or augmented dynamics must be handled; details are not spelled out. No guarantee against adversarial or uncertain obstacle motion is evaluated. AppendixA.2/2D: State axes y,z conflict with equations/initial region/obstacle axes x,y; height is called y. Printed xdot,ydot,thetadot have acceleration-like right-hand sides rather than double derivatives despite six-dimensional position/velocity state. Likely notation errors require clarification before reproducing the model. dt=.02 implies certified50steps=1second versus empirical500steps=10seconds. AppendixA.2/3D:12D state, four clipped thrust actions, two16-unit ReLU dynamics layers. Certified15steps atdt=.02 is .3seconds, compared with10second sampled episodes. Motor clipping limits, dynamics training samples/error, controller architecture/optimizer/lr and full curriculum/budget settings are not specified in the PDF. Code URL is supplied but was not inspected or run. §5/checklist3: Authors acknowledge weaker guarantees than forward invariance; checklist says no theoretical results. There is no unbounded-time safety/stability, distributed protocol correctness, liveness, refinement, Rust/Verus/TLA+ proof or LLM-generated formal artifact evaluated.
  • how much was read: most of it read
  • record id: verified-safe-reinforcement-learning-2024
• Verifying Peephole Rewriting in SSA Compiler IRs (2024)
  • what: LeanMLIR(X) gives intrinsically typed SSA with nested regions and user-defined operation semantics. A mechanized generic rewriter lifts local semantic equalities to whole-program equality along SSA def-use chains, with verified DCE/CSE and tactics exposing domain-level obligations. Cases cover a fragment of LLVM arithmetic, bounded structured control flow and an FHE polynomial-quotient IR. Explains typed context/variable machinery, zipper splitting/insertion and matching substitutions, structural treatment of region matches, pure-expression invariant for monadic contexts, and how operation/region signatures assemble semantics. LLVM case explicitly collapses poison and immediate undefined behavior, leaving a manual condition for division/remainder rewrites. scf generic loop laws are not all supported peephole patterns; Poly representative-dependent operations require additional choices.
  • limits: Theorems concern the user-provided embedded syntax and denotation in Lean. Kernel acceptance establishes properties of that model under its assumptions, not automatically faithful semantics of actual evolving MLIR/LLVM or a complete native compiler pipeline. Parser/elaboration errors can affect intended statement fidelity even when resulting terms are well typed. Core value semantics are pure, total Lean functions with structured regions. General unstructured CFGs, irreducible control flow, divergence, arbitrary memory effects and inter-IR linking are not fully modeled. Bounded loops are deliberately selected to avoid nontermination semantics; noncomputable algebraic denotations are allowed but not executable interpreters. Matching follows SSA expression trees and structural region equality; it does not recursively match inside regions as metavariable patterns. Rewriting can recursively visit region bodies, but free region arguments in rewrite patterns are unsupported. These are distinct capabilities. Side-effect extension only rewrites operations markedpure, denoting them in Id while other operations use an IR-specific monad. User semantics/effect classification must be appropriate. Current mechanization conservatively treats all regions as potentially effectful. LLVM instance models selected scalar arithmetic/bitwise/shift/select/icmp instructions and all comparison flags, but excludes nsw/nuw flags and most LLVM. It collapses immediateUB and poison into Option.none despite their different contextual behavior. The manual corresponding-division/remainder check is outside the mechanized collapsed-value proof. Treating UB and poison identically is safe only under an additional condition preventing a new immediateUB on the right when absent on the left. Authors report manually checking both directions for translated division/remainder rules via matching operations/arguments; this is not a proved general full-LLVM refinement theorem. Exhaustive instruction tests enumerate inputs only through bitwidth8 and use LLVM opt constant folding as ground truth. They provide empirical consistency with those cases, not proof over all widths or an independent formal LLVM semantics. Arbitrary-width rewrite proofs concern the Lean model, with some rules inherently restricted to specific widths. Alive corpus selection retains only93 of435 tests matching supported instructions and no preconditions. Automatic success54/93 and six additional selected manual proofs must not be presented as full-suite coverage or full automation. No proof times, runtime optimization speedups, hardware, repeat-count uncertainty or comparative prover-cost benchmark is provided. Poly models a pinned evolving IR’s algebra, not encryption security, ciphertext noise bounds, a complete FHE implementation or correctness of lowering quotient operations to arrays/machine code. Operations using representatives depend on a chosen section of quotient projection and need more than abstract ring laws.
  • how much was read: most of it read
  • source
  • record id: verifying-peephole-rewriting-in-2024
• Verifying Randomized Consensus Protocols with Common Coins (2024)
  • what: # Whole-paper record: Verifying Randomized Consensus Protocols with Common Coins (authored by agents unless marked 🧑) Song Gao, Bohua Zhan, Zhilin Wu and Lijun Zhang. DSN 2024, IEEE, pp.403–415; DOI 10.1109/DSN58291.2024.00047. Read arXiv 2409.17627v1, submitted 26 September 2024, all 13 PDF pages, §§I–VIII, all 27 references, six figures and four tables. Inspected every page image. Publication pagination comes from Crossref; this PDF has no printed page numerals (Q52). Exact extracted passages with PDF pages and source lines are in quotes.json and combined.quote-source.txt. No author code, compiler, checker, prover, solver or serialized experiment/model data was executed or loaded. ## Contribution and claimed guarantees (authored by agents unless marked 🧑) The paper extends parameterized threshold-automaton verification from independent local coins to a shared common coin. It adds a separate coin automaton and communication variables, giving an infinite-state Markov decision process with process-location counters, per-round shared variables and resilience parameters (§III,Q9–17). Byzantine processes are represented through their effect on threshold guards rather than explicit Byzantine automata (§III-A,Q8). This is a verification method for protocol models, not an implementation refinement or verified executable. Safety and termination follow different reductions. For safety, two one-round invariants imply agreement and binary validity (Proposition 1,Q20–21). Theorem 1 states that any finite schedule can be reordered by rounds while preserving its final configuration and per-round stutter equivalence (Q22). Theorem 2 relates one-round LTL without next-time properties to a single-round system, assuming nonblocking behavior and termination of every fair single-round execution for all initial configurations (Q24). These assumptions matter; it is not an unrestricted equivalence between arbitrary multi-round properties and one bounded run. For termination the paper distinguishes three categories (§V-B,Q26–28). Category A has no decide event and targets eventual convergence to a common final value. Category B has binary messages and explicit decisions. Category C uses a Binary Crusader Agreement stage that may output ⊥, meaning undecided. C1 requires a uniform positive probability of converging during a round. C2 preserves unanimity; C2′ instead gives a positive probability of deciding when the round starts unanimously. Proposition 3 supplies a two-round geometric argument: the probability of not deciding after 2r rounds is at most (1−p·p′)^r (Q29). Binding fixes a bit at the first relevant execution prefix and excludes its opposite in every continuation. It is a property of sets of executions, beyond ordinary single-execution agreement (Definition 4,Q30). The model refinement introduces N0, N1, N⊥ locations so that five sufficient safety conditions, CB0–CB4, imply binding (Proposition 4,Q31–32). Proposition 5 combines binding and C2′ for termination (Q33). Lemma 2 states that, in the single-round setting, a uniform positive probability under every admissible adversary is equivalent to each adversary having some satisfying path (Q35). That quantifier order is stronger than merely finding one favorable schedule. The proof record is mixed. Lemma 1 has a one-line justification. Proposition 2 calls its proof trivial after a geometric-tail argument. Propositions 3–5 provide paper proofs; Corollary 1 cites them. Proposition 1, Theorems 1–2 and Lemma 2 explicitly omit proofs for length (Q21,Q24–25,Q35). proof-inventory.json records all ten named results and their assumptions. No proof-assistant artifact was inspected, and this reading does not independently establish their soundness. ## Assumptions and limits (authored by agents unless marked 🧑) The network is asynchronous and reliable: a sent message is “eventually received” without “loss, duplication or modification,” and receivers identify senders (§I(a),Q3). Byzantine faults are bounded by the selected resilience condition. The common coin is a trusted, fault-free abstraction, and only strong coins are considered: both bits are common outputs with probability 1/2. Cryptographic implementation correctness is future work (Q2–3,Q41). The model separates shared-message guards from coin guards. Correct processes cannot update coin variables; coin rules cannot modify shared variables. Automata are canonical: rules on cycles have zero updates (§III-B,Q10–13). The method is parameterized by the environment’s admissible n,t,f values, rather than verifying only the example cluster sizes. The termination specification is explicitly “under Round-rigid Adversaries” (§IV,Q19). Such an adversary is fair and schedules all actions of round k before those of round k+1 (§III-E,Q17). Removing this restriction is future work (§VIII,Q41). Finite safety-trace reordering does not establish probabilistic termination for arbitrary asynchronous adaptive schedulers. No benchmark archive, model file or proof-artifact URL is identified in the read paper. The paper says it builds two one-round automaton versions per protocol, but those inputs and their transformations were not available in the inspected sources (Q36–37). This does not assert that no artifact exists elsewhere. No ByMC run was reproduced. ## Cases and reported evaluation (authored by agents unless marked 🧑) The benchmark comprises Rabin83, CC85(a), CC85(b), FMR05, KS16, MMR14, Miller18 and ABY22 (§VI,Q36; Table II,Q45). Their protocol descriptions give different Byzantine bounds: for example Rabin83 uses t<n/10, CC85(b) t<n/6, and CC85(a), KS16 and ABY22 use n>3t. These protocol descriptions should not be substituted for the undisclosed exact checked input environments. Table II reports model locations/rules, execution-schema counts and verification time for agreement, validity and almost-sure termination. The authors “ran each experiments 10 times” and report averages, without raw trials or dispersion (§VI,Q37). The first six rows use an Intel Core i7-12650H laptop; the final two use a 216-core AMD EPYC7702 server in parallel mode. Times measure verification work, not consensus latency or throughput. Small examples complete quickly: Rabin83 has 7 locations/17 rules and reported times 0.25s for agreement, 0.20s for validity and 0.43s for its convergence target. CC85(a) uses 342 schemas/4.93s for agreement and an average 171.5 schemas/2.70s for termination. Fractional schema counts are averages. All eight rows and all table values are retained in numeric-evidence.json. MMR14 has 17 locations/29 rules. Its agreement and validity checks take 298.90s and 8.74s. The termination column says CE, with no time. Separately, §VI reports a CB2 violation “within 10 seconds at best,” with an example witness n=193,t=64 (Q38). A failed sufficient condition alone does not prove nontermination. The authors additionally analyze the returned execution, compare it with a known adaptive attack and describe repeating its final actions to recreate the opposite estimate distribution. The motivating four-node example has three correct processes and one Byzantine process. Two correct processes obtain the coin result s, while the adversary delays messages to the third until it can force estimate 1−s; the round can repeat (§II,Q7). This is a prior attack, not a new vulnerability discovered by the paper. Miller’s 2018 issue credits Ethan MacBrough and explains that the actual coin instantiation lacks the independence assumed by the earlier ABA proof (Q48–49). The issue proposes an extra CONF phase before revealing coin shares (Q50). Its later implementation comments were read as allegations, without auditing the linked code (Q51). The two repaired category C variants reportedly pass their obligations. Miller18 takes 11h46m47s and ABY22 takes 10h13m14s for all termination conditions, each exceeding 10^8 schemas; agreement takes 605s and 583s, respectively (Table II,Q45). The paper also describes 24-hour timeouts for the earlier technique on category C models, without a controlled cross-hardware speedup comparison (Q37). Table IV changes milestone counts from 10 to 6 in five same-size ABY22-based automata. Calculated maximum schemas fall from 98,182,294 to 28,918 for CB0 and 7,479,057 to 3,592 for Inv2 (Q39,Q47). These are calculated search bounds, not measured runtime reductions or proof that the variants preserve protocol semantics. Table I supplies MMR14 transition guards and updates; Table III lists selected value 0 formulas and an ellipsis, rather than complete checker inputs. Figures 1–6 provide pseudocode, voting and MMR14 automata, and the binding refinement. ## Source discrepancies that qualify interpretation (authored by agents unless marked 🧑) Three points remain unresolved from the printed sources. They are recorded as static comparisons, not reproduced checker failures or counterexamples to a full theorem. - Example 2 gives the MMR14 environment n>5t (Q9), while §II describes n>3t and §VI reports n=193,t=64. That witness satisfies 193 > 192 but not 193 > 320. The exact checked resilience condition cannot be recovered from the paper alone. - Proposition 5 reasons that no correct process has executed a coin-based rule, “in other words” the coin “is not yet tossed,” and therefore its result is independent of the binding bit (Q33). Figure 4 and Table I instead show rb with guard true, from initial coin location I2 to N0/N1, followed by unconditional rc/rd publishing its outcome (Q13,Q43–44). Under the initial-state and action definitions, a finite round 0 prefix can execute rb then rc before any correct-process transition. The adversary observes configuration histories (Q15,Q17). Thus the stated timing inference needs a further visibility or scheduling condition that is not enforced by these displayed rules. This prefix does not refute the full theorem or a benchmark protocol; it identifies an unsupported step in the supplied model-to-proof account. - Table III labels C1 with a universal implication excluding mixed final values along every path after a 0-valued final event (Q46). Body C1 is a positive-probability convergence condition, reduced through a per-adversary existential-path condition (Q27,Q35). The displayed statements differ. Separate model versions might explain a stronger checked obligation, but their concrete transformation is not supplied here, so the table cannot establish that correspondence. The coin prefix, resilience arithmetic and quantifier comparison are in static-witnesses.json. All relevant formulas and table entries were checked against rendered PDF pages, rather than relying only on text extraction. ## Relevance to the requested topic (authored by agents unless marked 🧑) This work directly addresses parameterized verification of randomized Byzantine consensus, especially the relation between common randomness, adaptive scheduling, binding and almost-sure termination. It supplies concrete verification-cost evidence and an example of using failed proof obligations to investigate a known attack. It also shows why a safety-preserving reordering theorem, a probabilistic termination argument and a checker result must retain their separate assumptions. For evaluating LLM-written specifications or proofs, the reader-derived lesson is to check scheduler quantifiers, coin secrecy and independence, the exact resilience environment, source-to-formula correspondence, proof availability and what a counterexample actually disproves. The paper contains no LLM, Verus or verified Rust experiment. Its TLA proof-system reference concerns related HotStuff work, not this paper’s verification method (Q40,Q42). HoneyBadger/Dumbo composition and cryptographic primitive verification remain future work (Q41).
  • limits: Parameterized canonical threshold automata under resilience environments; reliable eventual authenticated-sender delivery, no loss/duplication/modification; assumed strong fault-free common coin. Almost-sure termination only for fair round-rigid adversaries. CategoryA convergence differs from categoriesB/C decisions. Nonblocking and all fair single-round termination are prerequisites for reduction. Several central proofs omitted; printed resilience, coin-visibility argument and C1 formula correspondence unresolved.
  • how much was read: most of it read
  • source
  • record id: verifying-randomized-consensus-protocols-2024
• Verus SOSP 2024 (2024)
  • title: Verus: A Practical Foundation for Systems Verification
  • what: A Rust verifier for systems code. In its EPR-enabled method (EPR is a restricted logic that the solver can decide), the developer writes the inductive invariant (a fact that holds initially and is preserved by every step) and the tool checks it automatically. The evaluation (Section 6, Figure 9) is at the component level.
  • number: 6.1K lines of implementation and 31K lines of proof
  • number: IronKV 1,533 exec / 4,509 proof / 1,613 trusted lines; verifies in 18 s on eight cores vs Dafny 201 s
  • number: node replication verifies in 9 s vs 228 s
  • limits: It applies to the paper’s EPR-enabled method, not to finding arbitrary invariants.
  • how much was read: most of it read
  • source; notes: S30; notes: Verus: A Practical Foundation for Systems Verification
  • record id: verus-sosp-2024-2024
• VNN: Verification-Friendly Neural Networks with Hard Robustness Guarantees (2024)
  • what: Post-training optimization sparsifies a neural network one layer at a time. L1 weight/bias minimization is constrained by activation proximity, sampled ReLU branches and unchanged validation labels. ERAN/DeepPoly and SafeDeep certify more input neighborhoods for the changed networks; a limited Marabou comparison distinguishes some real robustness improvements from merely resolving approximate-verifier uncertainty. MNIST and personalized EEG/ECG classifiers supply empirical evidence. Records the exact validation-only constraints, layerwise L0-to-L1 relaxation, activation-regime and argmax ambiguities, additive versus multiplicative epsilon, complete paired verification/time tables, all pairwise Marabou outcomes and denominators, dataset splits and CNNs, medical accuracy tradeoffs, preprocessing costs and limits of universal robustness/verification claims. Separates sampled preservation, local logit margins, independently verified input regions and clinical performance.
  • limits: §2.1–2.2/Eqs1–7: Network is a chain of affine maps and activations. One target layer has variable weights/biases; earlier forward values are fixed and later weights unchanged. Constraints are instantiated only on Dval. Eq5 bounds absolute target activation difference by epsilon; Eq6 requires original argmax = changed argmax = true label y. Neither finite-point condition certifies all neighboring inputs or the deployment distribution. §2.2: Adding a constant output margin M is suggested as a hard robustness enhancement, but no chosen M, ablation or enforcement protocol is supplied. A positive logit margin at a validation point alone gives no specified input radius without a bound relating input perturbation to logit change. Input-region robustness is established separately by the verifiers, with their own soundness assumptions. §2.2/Eq6: Requiring the fixed original prediction to equal y makes the stated optimization infeasible for any misclassified validation example. The text does not state whether such samples are removed, relabelled with original predictions, or handled otherwise. Strict winner inequalities also require numerical margin/tie conventions in an LP solver; these are unspecified. This is a formulation/reporting question, not a code finding. §2.3/Eq8: L1 sums absolute weights/biases instead of counting nonzeros. It is a convex surrogate, not an equivalent globally minimum-cardinality solution. The unqualified tightest-convex-relaxation statement would require a specified bounded domain/scaling; those conditions are not supplied. §2.4/Eqs9–11: Fixing each sampled ReLU activation regime yields affine constraints. Eq9 selects the target branch from original activations, but the printed later-layer branch conditions use updated f_m,j(tilde x^(m−1)), which depends on optimization variables. A single LP requires those branches to be fixed or an additional linearization/encoding; the paper does not spell out this selection. No implementation defect is inferred without source inspection. Active constraints use ≥0, so boundary zero is permitted. §2.5–2.6: One LP per layer is a greedy sequential method, not a joint global optimum. Epsilon0 preserves constrained target values at sampled points, not the off-sample function. Positive per-layer changes can accumulate. If all Eq6 constraints really remain enforced at each step, validation labels remain fixed conditionally on feasibility/solver tolerances; test labels and input-region robustness are not thereby proved. §2.4/§3.2: Derivation handles ReLU piecewise-linear layers; clinical CNNs include max pooling. Pooling branch choice and convolutional parameter sharing are not explained in the displayed formulation. Official README currently documents dense ReLU classifiers only, so it does not resolve the CNN details. §1/§5: The paper calls VNNs guaranteed to be more accommodating to verification, but supplies no theorem that increasing sparsity monotonically improves every verifier or actual robustness. Certification performance depends on weights, activation bounds, abstraction/refinement and query. Empirical higher certified fractions for a changed network mix possible actual robustness changes with abstract-bound precision; uncertified samples need not be adversarial. §3.1–3.3: MNIST uses the first400 official test images split into200 optimization and200 evaluation points. Medical splits are within personalized patient datasets, not held-out patients. Random seeds/split ordering/normalization/clinical signal preprocessing and patient-level independence are not fully specified. Reported L∞ radii are synthetic coordinate perturbations; their physiological plausibility and patient outcome effects are not established. §3.5.1/Table1: Main results use epsilon0. Certified robustness is percentage of test points proved robust for the changed network, not end-to-end preservation of the original classifier. A76× ratio at ERAN5×100,delta.03 is38/.5, corresponding to76versus1 out of200. Zero baselines yield undefined multiplicative improvements; ratios emphasize small denominators and do not measure statistical significance. §1/§3.5.1/Table1: Prose says verification time always less/up to3× improvement; printed rounded ERAN times include ties, and SafeDeep2×100 atdelta.02 is7.6/1.9=4×. Preserve table versus prose disagreement. Per-query verification time excludes the one-off optimization cost, reported40–618seconds for six models; no amortization threshold or repeated timing uncertainty is given. §3.5.1/Table2: Marabou uses only2×50,200images×9rival classes=1800pairwise states, not1800 independent images. Timeout600seconds is described per sample, leaving exact query granularity unclear; Table2delta is not explicitly stated. Larger FNNs exceed timeout in>75%of cases. Whole-image certification needs all nine rivals; their joint grouping is absent. §3.5.1/Table2: DNNrobust41/notrobust805/timeout954; VNNrobust1237/notrobust275/timeout288.269actual nonrobust pairwise cases become proved robust;927timeouts become proved robust but original status was unknown. Zero observed robust→nonrobust transitions is finite evidence, not universal robustness preservation.954/288=3.3125 timeout ratio; timeouts cannot be counted as counterexamples. §3.5.1/Figure4: Epsilon ablation explicitly uses multiplicative activation intervals, e.g..1 permits[.9x,1.1x], whereas Eq5 is absolute additive. Those are distinct optimization variants. Small2×50 has claimed up-to13% verified gain; large-model epsilon.3 drops accuracy to roughly80 from>90at0/.1. Figure4b caption says8×200 but prose says9×200. No exact table for plotted curves or uncertainty is supplied. §3.5.1/Figures5–6: Six6×500 plotted curves are two PGD bases trained atdelta.1/.3 plus their fourepsilon0/.1VNN variants, not six independent base training runs. Layer-count ablation8×200/epsilon.2 generally improves certified proportions over1–8layers for five displayed radii; this is not a theorem that every layer update improves all points. §3.5.1: Polynomial complexity is conditional on a correctly fixed LP and its encoding size. One LP per layer counts solves; total runtime is not generally linear in layer count alone because each program includes downstream constraints and dimensions vary. Gurobi numerical tolerances, feasibility failures, chosen margins and complete solver settings are not specified. §3.5.2/Figure7: CHB-MIT nominal accuracy85.7±3.8original versus82.5±4.2VNN loses3.2percentagepoints. The paper explicitly labels μ±σ² and shaded variance; do not silently reinterpret ±as standard deviation. MBP84.1±4.1 falls to68.4±4.3 when matched to VNN sparsity. No statistical test or held-out-patient result supports clinical equivalence. §3.5.2–3.5.3: Medical MBP says lowest10%weights/biases are setzero yet40–50%of allparameters becomezero; exact percentile-versus-magnitude threshold interpretation is unclear. VNN approximately40%more sparse is asserted without a full per-patient sparsity table. Maximum verified ratios9/24CHBand34/30MIT depend on verifier/radius, not uniform guarantees. §4: Related work distinguishes exact SMT/MIP from abstract over-approximation, pruning/quantization/parametric-ReLU/robust training. Comparisons with MBP/SOP support this evaluated post-training constraint approach, not a proof that all alternative pruning violates robustness. Claims about other papers are attributed literature discussion, not independently verified here. Official README: Requires csv1-D signals/labels, h5dense classifier with ReLU hidden layers, epsilon0–.99, Gurobi Python interface/Python3.9+/TensorFlow2.10+. Documentation only was read. No execution, independent reproduction, implementation audit or numerical-soundness proof. No distributed protocol, Verus, Rust, TLA+ or LLM-generated proof is evaluated.
  • how much was read: most of it read
  • record id: vnn-verification-friendly-neural-2024
• Watase E_TRANS1 transcendence prerequisites 2024 (2024)
  • title: Formal Proof of Transcendence of the Number e. Part I
  • what: Watase formalizes prerequisites for a Hurwitz proof that e is transcendental,not the completed contradiction in this Part I. The article builds denominator clearing and polynomial retyping/embedding infrastructure,exact higher-derivative formulas,a finite sum of integer-polynomial derivatives viewed as a real function,and a mean-value identity relating F(x),e^xF(0),and the original polynomial at an interior point. Divisibility and irreducibility facts prepare the later integer-versus-small-real argument. Records actual integer-polynomial versus introductory rational-polynomial scope,characteristic-zero conditions,finite derivative indexing,denominator product and typed evaluation/embedding laws. Separates the proved mean-value identity from the postponed algebraic contradiction and flags an introductory auxiliary-function discrepancy.
  • limits: MML E_TRANS1 version8.1.14 5.83.1471 identifies the article. The Summary says the main proof is presented separately;Introduction explicitly postpones the assumption that e is a root of an integer polynomial to E_TRANS2:41. No theorem in these38results concludes that e is transcendental. The title/introductory “we prove” wording describes the series,not a completed result in PartI (pp.111–112). Introduction describes F(f)=sum of derivatives for f over Q and mentions f=x^(p−1)product_(j=1..n)(j−x)^p/(p−1)!. Actual Definitions10/11 and main34take f in the integer polynomial ring Z[X]. Do not silently apply their exact typed contract to an arbitrary rational-coefficient polynomial without an additional clearing/scaling argument. The special Hurwitz polynomial is motivation,not a named complete construction in this article (pp.112,117–118). Definition1 is the reciprocal exponential1/exp on R. Theorems1–7 give natural scalar associativity,sum monotonicity,ideal closure under finite sums,divisibility of a sum by a common divisor,and scalar compatibility. Definition2 gives eta(k,j)=k!/(k−0j)!;5identifies eta=j! binomial(k,j) only forj≤k. It is not the convention of zero falling factorial forj>k because subtraction is truncated (pp.112–113). Definitions3/4 retype identical set-theoretic polynomials as polynomial-ring elements and back. Theorem8 makes the coefficient range finite by separating finite support and0. Definitions5/6 collect reduced rational denominators and enumerate that finite nonempty set;9shows their product nonzero and10shows each coefficient denominator divides it. This is a common multiple,not a claimed least common denominator or optimized algorithm (pp.113–114). Theorem11 makes the annihilating polynomial ideal of an element integral over a subfield maximal. Theorem12 preserves irreducibility under multiplication by a nonzero natural in Q[X],where that scalar is a unit. Theorem13 says a nonzero rational polynomial vanishing at an irrational real has degree≥2. Theorem14 says an irreducible rational polynomial of degree≥2 has nonzero constant term. These are preparatory algebraic conditions,not an e-specific contradiction (p.114). Theorems15 and17 use characteristic0 to prevent a nonzero natural multiple of a nonzero element from vanishing and to show derivative length drops by1 when polynomial length>1. Theorem16 only identifies length from an upper bound and nonzero last coefficient and has no characteristic restriction. Theorem24 generalizes to len(D^j f)=len f−j forlen f>j and characteristic0. Characteristic matters:in characteristic p,the derivative of X^p is0,so exact degree decrease would fail. This example is a reading inference,not a printed case (pp.115–116). Theorem18 commutes repeated derivation with natural scalar multiplication. Theorems19–21 assume an integer polynomial f with Df=1:for1≤j≤k,D^j(f^k)=eta(k,j)f^(k−j);thekth derivative isk!,and higher ones are0. Theorem22 gives the general coefficient formula (D^k f)i=eta(i+k,k)f(i+k). The restricted j≤k form and the explicit higher-order zero result must not be merged into an unrestricted factorial formula (pp.115–116). Theorem23 commutes additive maps with finite sums by induction. Definitions7/8 embed integer polynomials and finite polynomial sequences into real polynomial rings while preserving domains;Definition9 evaluates a polynomial sequence pointwise. Theorems25/26 commute sequence decomposition and summation with polynomial evaluation;27preserves addition/multiplication under embedding (pp.116–117). Definition10 forms G(f) with exactly len f entries:entryi is D^(i−1)f,so the sequence includes f itself and ends at the top nonzero derivative for nonzero f. Theorems28–30 reconcile integer-point evaluation,embedded sums and real evaluation. Definition11 takes the real evaluation function of the embedded sum G(f),not merely a symbolic polynomial with an unspecified codomain (p.117). Theorem31 identifies derivative of a real polynomial evaluation function with evaluation of its formal derivative. Definition12 sets Phi(f)=exp(−x)F(f)(x);32/33give continuity on[0,x0] and differentiability on(0,x0). The Introduction instead prints application of the mean-value theorem to −e^xF(x);that helper expression differs from the later reciprocal-exponential definition. It is treated as an introductory discrepancy,not evidence about a failed or unsound checker (pp.112,118). Theorem34assumes integer polynomial f withlen f>0 andx0>0. It asserts existence of some0<s<1 with F(f)(x0)−exp(x0)F(f)(0)=−x0 exp(x0(1−s)) f(sx0),where the last evaluation uses the embedded real polynomial. It does not give one s valid for every x0,uniqueness of s,an explicit computable s,or a uniform remainder bound (p.118). Reading derivation of34,not a displayed proof:because G includes all derivatives through degreef,the derivative sum telescopes to F′=F−f. Thus(Phi)′=−e^(−x)f(x). Mean value on[0,x0] gives e^(−x0)F(x0)−F(0)=−x0 e^(−sx0)f(sx0);multiply bye^x0 to get34. Actual embedding/derivation identities rely on imported libraries;this record did not inspect their formal proofs. Theorems35/36 preserve scalar-polynomial multiplication and extended evaluation under ring/domain extensions. Theorems37/38 commute nonempty finite polynomial products with evaluation,including the integer-to-real embedding. Nonemptiness is explicit in their statements;the record does not silently generalize to an empty product convention (pp.118–119). Introduction lists HOL Light,Coq,Isabelle,Metamath and Lean as other formalization contexts;references point to those developments but no cross-prover theorem-by-theorem check,timing,proof-size comparison,automation success rate or benchmark is performed here. No executable transcendence decision procedure,numerical experiment or independent checker transcript appears (all pages). All ten pages,Introduction,sevensections,12definitions,38results/all clauses/sketches,19references/acceptance date read;no figures/tables/footnotes/appendices. Quotation text follows raw extraction,not a visual formula transcription:fractions,derivative/exponent placement,≥/≤,restrictions and application/composition are distorted. Renderings checked,especially the introductory helper discrepancy on112. No MML/source/checker execution,PartII read or distributed/Verus/Rust/TLA+/LLM-agent experiment.
  • how much was read: most of it read
  • source
  • record id: watase-e-trans1-transcendence-prerequisites-2024-2024
• WSR and DR register specifications (2024)
  • title: Hyperproperty-Preserving Register Specifications
  • what: Constructs two non-atomic shared-memory register specifications preserving finite-trace hyperproperties under strong adversaries. WSR is complete under forward simulation for write strong-linearizable registers, including single-writer ABD. Introduces decisive linearizability, which preserves relative order of already included operations while allowing insertion, and constructs complete register specification DR. A forward simulation from multi-writer ABD to DR establishes decisive linearizability and lets client proofs use DR. Conference paper gives algorithms, formal finite-execution definitions, examples and proof sketches; full proofs are deferred. Captures exact scheduler quantifiers and finite-trace scope, class completeness versus generic history tracking, three randomized client distinctions and fourth overwritten-value example, WSR set-collection stopping rule, DR guarded rollback/version/lock behavior, lazy-linearization hardness construction and ABD majority-publication simulation. Separates safety/refinement from progress and pseudocode from its stated LTS formulation. Replaces an incomplete introductory record.
  • limits: Model uses labeled transition systems with possibly infinite states/labels, finite transition executions including intermediate states, calls/returns with thread and action identifiers, per-thread sequential well-formed histories, and response-before-invocation real-time order. Registers hold natural numbers and initially contain 0. Prefix-closed sequential specifications and interface composition synchronize calls/returns while interleaving client/implementation internal actions. A hyperproperty is a set of sets of client traces. Satisfaction universally quantifies deterministic schedulers. A scheduler maps a complete past execution to a set of transitions; either at most one transition is allowed or all choices are client-internal. Thus it resolves scheduling and implementation nondeterminism while allowing unresolved choices only among client-internal transitions. It sees previous coin outcomes, not future ones. Authors avoid the prior step-determinism restriction by using executions rather than label traces. Strong observational refinement I≤sI# preserves every client hyperproperty of I# in I. Lemma3.4 says every concrete deterministic scheduler has an abstract deterministic scheduler with the same projected client trace set. Theorem3.5 equates this with call/return forward simulation: initial states related, each concrete step matched by a finite abstract sequence with the same interface projection, allowing stuttering. This is a finite-trace theorem. No fairness, infinite-trace, termination, or quantitative time guarantee follows automatically. A class is downward closed under forward simulation. A hard implementation is simulated by every class member; complete additionally means it belongs to that class, yielding membership iff forward simulation to it. Proposition4.3 constructs a generic complete linearizable object by tracking history and enabling only linearizable responses. Lemma4.7 generalizes to any preorder R relating linearizations of prefix executions, with state storing history and a suitable linearization. These existence constructions are not the compact useful reference programs sought here. Ordinary linearizability completes selected pending calls, drops others, and preserves thread behavior/real time. Strong linearization maps every execution to a legal history and preserves prefixes. Write strong-linearization preserves prefixes only after projecting to writes, permitting read repositioning. Decisive linearization preserves the whole prior linearization as a subsequence: new operations may be inserted before old ones but cannot reverse any already included pair. Decisiveness is defined for any object; the compact completeness results here concern registers. For registers the hierarchy is strict: strongly linearizable, write strongly linearizable, decisively linearizable, linearizable. ATR belongs to first; DLR separates first/second; TNSR and multi-writer ABD separate second/third; generic history-tracking linearizable register separates third/fourth. Write strong implies decisive through WSR⊑FDR and completeness, not by simply assuming every given write-strong mapping already preserves all read pairs. Single-writer linearizable registers being write strong is attributed to [15], not newly independently proved here. Motivating programs use fair coin values1/2 and target Pr[a=b]=1/2 under every strong adversary. P1 has sequential write1/write2/coin versus concurrent read. P2 has write1/coin/barrier versus write2/barrier/read. P3 moves coin after both writes complete at barrier. Figure3: ATR satisfies all; DLR fails P1 only; TNSR fails P2 only; ABD with at least three processes fails P1/P2; all satisfy P3. These are concrete semantic counterexamples, not a statistical experiment. DLR atomically loads X twice then adversarially chooses one value. TNSR atomically reads, and writes load X twice, optionally skip their store only when observed values differ. ABD uses lexicographic(counter,writerID) timestamps, majority query maxima, read writeback to majority, write timestamp increment, monotone background updates/acks. Fewer than three processes do not support the stated adversarial schedules; ABD2 requires all processes in each quorum. The finite-trace study does not establish the usual asynchronous ABD liveness/failure theorem anew. P1 ABD schedule buffers a homogeneous old-value1 quorum plus a newer-value2 reply; after coin, deliver an appropriate majority. P2 buffers old write2 query replies, lets write1 finish, and obtains a fresh reply. After coin, choose old replies so equal counters favor writer1 ID, or fresh reply so writer2 chooses a larger counter. For P3, after both writes finish every quorum intersects the maximum-timestamp publication quorum, so subsequent read value is already fixed. Probability manipulation follows scheduling information and operation overlap, not Byzantine messages. WSR Algorithm1 writes X atomically. A read initializes V={X}, repeatedly atomically sets (Vprev,V)=(V,V∪{X}), stops when V no longer grows, then chooses any member. It stops at the first observed value already in the set, which need not equal the immediately previous observation. Arbitrarily many distinct intervening writes can extend collection and memory; no bounded-read or wait-free property under endlessly new values is established. Adversary may delay final selection until after a client coin. Theorem5.4 makes WSR complete for write strong registers, hence single-writer ABD⊑FWSR. Remark5.3 gives k-load registers Ik with Ik+1 not strongly observationally refining Ik, while every Ik refines WSR. Calling WSR the limit is explanatory language, not a stated analytic convergence theorem or finite bound on loads. DR Algorithm2 adds natural version Ver and lock L. A new read waits for L0 then atomically saves start version and value. Later collection adds X only when Ver≥start. A writer saves start version under L0, then normally stores v/increments Ver, or, if a concurrent store made Ver>start, locks, saves current X, temporarily stores v and decrements Ver, then separately restores X/version and unlocks. Existing reads may see the temporary value; new read initialization/writers are blocked while L1. Version rather than value comparison detects concurrent writes even with equal values. The rollback and restoration are separate atomic steps. Treating them as one atomic block removes overwritten values visible to existing readers and loses the Figure4 behavior needed for ABD. Conversely, new reads cannot initialize from the temporary version. The read collection itself does not universally await L0; its version guard determines which temporary values an already active read may collect. Authors explicitly state the simplified DR pseudocode may choose overwrite before its guard can be satisfied and get stuck, whereas their LTS formulation avoids this. Thus a literal implementation of Algorithm2 is not automatically the full LTS with the same progress behavior. Conference finite-trace linearizability claims tolerate this stuck execution; the full LTS definition/progress equivalence is not supplied here. Figure4 P4 adds a third concurrent read c=2 before barrier to P2. TNSR cannot return2 there in a branch where write2 later skips its only store and b reads1. DR permits the temporary store; ABD permits the third reader to obtain2 through its query/timestamp schedule. This demonstrates why TNSR is too restrictive as the general decisive/ABD reference even though it is itself decisive. AppendixA Lemma4.7: simulation gives a prefix-preserving execution mapping π with identical history; compose a suitable linearization L with π for downward closure. Generic complete object stores a linearization and permits each interface action only if there is an R-related next one. Full proof details are in separate extended version. AppendixA WSR membership linearizes writes at stores and completed-choice reads retroactively at their first load of chosen value. Hardness cannot eagerly store whenever an arbitrary write-strong linearization first includes a write: that may remove older values still needed by overlapping readers. Construct lazy L* changing only on responses, including pending operations only if they are non-last writes, and additionally decisive. Simulate each newly added write by a store, and let pending readers collect new values they lack. Key lemma places returned value either at rightmost write when read invoked or at a later-added write. Lemmas establishing L* and full simulation relation are deferred. AppendixA DR membership assigns each included write its stored version and each chosen read its version at first load of chosen value, orders by version then associated transition order. Version/rollback guards are said to establish real time; immutable assignments preserve pair order. Hardness uses the lazy construction but temporarily rolls back when a newly included write must precede an already included one, maintaining X as rightmost linearized write. Conference sketch does not supply the full invariants or every insertion case; no independent mechanized proof performed. AppendixA ABD simulation tracks first majority publication of a value/timestamp pair, whether caused by a write update or read writeback. New maximum timestamp becomes a fresh DR version/store collected by active readers. Older timestamp uses temporary rollback, collection by eligible concurrent readers, restoration of latest value. Timestamp publication and version correspondence are proof state, not an executable conversion of network messages into a shared-memory algorithm. Example5.2(iii) ends with linearizes h1 although the branch is extension h2; the surrounding argument requires h2. This is a printed naming typo, not a counterexample to completeness. Other compressed diagram/proof wording is interpreted in its stated context, without inferring a main theorem failure from absent extended details. Related work: tail strong linearizability depends on chosen effect-free preamble and is not comparable to decisive; its repetition/random-choice transformation is ineffective on WSR/DR. Infinite-trace refinement requires a progressive form of forward simulation, left for future. Compact complete specs for decisive objects beyond registers and their progress/impossibility guarantees are future work. Time-Stamped Stack is cited as nondecisive because completed overlapping pushes can remain unordered until pop; original paper not independently read. Entire supplied conference PDF read, including both algorithms and AppendixA sketches. Full arXiv2408.11015 proof version, cited ABD and simulation sources not read. No machine-checked artifact, Verus/Rust/TLA+ model, LLM involvement, benchmark, runtime or proof-size measurements in this paper. Machine-assisted verification is proposed as a possible use of reference simulations, not delivered as a checked development.
  • how much was read: most of it read
  • source
  • record id: wsr-and-dr-register-specifications-2024
• Wuldo unrealizability proof synthesis (2024)
  • title: Automating Unrealizability Logic: Hoare-Style Proof Synthesis for Infinite Sets of Programs
  • what: The paper introduces Wuldo, the first proof-synthesis algorithm for Unrealizability Logic (UL), a Hoare-style logic over potentially infinite program sets described by regular tree grammars. Wuldo computes syntax-directed proof skeletons, generates parametric verification conditions, and checks or synthesizes nonterminal summaries and loop invariants using SMT/SyGuS solvers. Summaries are reusable inductive facts about grammar nonterminals, enabling compositional proofs of unrealizability and infinite-state/input properties. The implementation supports whole-cloth proof generation for some cases and emits interpretable proof certificates, unlike black-box satisfiability encodings.
  • limits: Wuldo’s main relative-completeness result is for loop-free program sets; loops require summaries/invariants and can be difficult. Effectiveness depends on solver support for quantified linear arithmetic, infinite arrays, and SyGuS grammars; Wuldo may prove unrealizability but does not generally establish realizability. Experiments use regular-tree grammars, finite benchmark suites, 5-minute timeouts, and a 4-core i7-7700HQ/16GB Windows machine. The authors note unsupported nondeterminism and hard quantified summaries as open limitations.
  • how much was read: most of it read
  • source
  • record id: wuldo-unrealizability-proof-synthesis-2024
• A Proof-Producing Compiler for Blockchain Applications (2023)
  • what: Augments Cairo0 compiler with per-compilation Lean3 specifications and correctness proofs connecting actual compiled Cairo machine code to user-written high-level functional specifications. Tool harvests compiler metadata and logs; it generates naive function/block specifications and proof scripts, while users prove these imply their desired specifications. Lean checks generated and handwritten proofs. Case verifies secp256k1 arithmetic and public-key recovery for signatures, conditional on model/range assumptions and an admitted elliptic-curve associativity lemma. Does not verify compiler universally or prove total correctness/cryptographic unforgeability. Cairo memory/register values are finite-field elements, memory is immutable,failed assertions have no successor and ill-formed instructions are nondeterministic. ensures quantifies over finite halting traces and promises some reached state satisfying a step-indexed postcondition; recursion/loops use induction on execution length,not a termination proof. Generated specifications use users’ specs of dependencies,allowing modular recursive proofs. Verification symbolically steps assembly via proved small-step instruction lemmas. Compiler flow-tracker identities about allocation-pointer changes are themselves proved in Lean. Range-check pointer intervals are threaded through calls; length mu<=kappa,with public execution length below field characteristic,prevents wraparound. User-facing specs mediate integers,secp field and three-limb Cairo-field representations. Only regular CFGs are supported; tool can fail on arbitrary spaghetti jumps. Generated source-level proofs support interactive debugging and incremental specification reuse without trusting compiler transformations.
  • number: {‘math_Cairo_lines_approx’: 450, ‘math_Lean_spec_proof_lines_approx’: 1150, ‘secp_Cairo_lines_approx’: 800, ‘secp_spec_Lean_lines_approx’: 3200, ‘elliptic_group_lines_approx’: 150, ‘dependency_functions’: 24, ‘assembly_field_elements_approx’: 900, ‘generated_Lean_proof_lines_approx’: 7500, ‘admitted_sorry’: 1}
  • limits: Cairo0 version0.10; Cairo1 substantially differs and is not the target language verified here. No separate formal source-language semantics/universal compiler correctness theorem. Partial correctness conditional on successful halting execution. STARK certification supplies evidence of such execution under cryptographic assumptions; this work does not establish termination or full cryptographic protocol security. Expected machine code/dependencies must occupy specified memory,arguments/registers must be placed correctly,range-checked region assumptions must hold and execution length must be below Cairo-field characteristic. Elliptic-curve group associativity is admitted using one Lean sorry. Paper notes a recent external formalization could eliminate it but does not claim integration already happened. Small trusted Lean kernel checks proof terms but mathematical/model assumptions remain. Repository link/archive is supplied; no independent artifact execution,trust-chain audit or kernel recheck performed for this reading.
  • how much was read: most of it read
  • source
  • record id: a-proof-producing-compiler-2023
• Akshay et al. affine MDP invariants (2023)
  • title: MDPs as Distribution Transformers: Affine Invariant Synthesis for Safety Objectives.
  • what: Treats MDPs as transformers of probability distributions and synthesizes affine inductive distributional invariants together with strategies proving distribution-based safety. AlgMemLess targets memoryless strategies with relative completeness; AlgDist handles distribution-dependent general strategies with sound but incomplete Handelman-based constraints. The paper proves that distribution strategies depending only on the current distribution suffice, and that an inductive distributional invariant contained in the safe set is a sound and complete certificate. AlgMemLess templates action probabilities and a conjunction of affine inequalities, uses Farkas’ lemma to eliminate universal quantifiers, and has soundness, relative completeness, and PSPACE bounds. AlgDist uses quotients of affine expressions for action probabilities; positivity constraints remove denominators, and Handelman’s theorem produces a sound bounded-product translation, losing completeness. The framework handles initialized and uninitialized cases, restricted initial constraints, and can extend to polynomial invariants via Putinar’s Positivstellensatz. A prototype in Python/SymPy/PySMT with Z3 and MathSAT solved Running, Chain, Split, PageRank, and Insulin-131 I examples.
  • number: AlgMemLess PSPACE, sound and relatively complete
  • number: AlgDist PSPACE for fixed K, sound but incomplete
  • number: Running 3s, 92 vars, 123 constraints
  • number: Chain 10s, 69 vars, 82 constraints
  • limits: Safety sets are finite conjunctions of affine inequalities over finite-state MDP distributions; initialized safety is Positivity-hard even for Markov chains. AlgMemLess is complete only relative to affine invariants and memoryless strategies; AlgDist’s Handelman translation is incomplete, parameterized by product bound K, and assumes compact antecedent sets for the theorem motivation. Existential nonlinear real arithmetic is decidable but solver performance varies by orders of magnitude and can take hours. Experiments are unoptimized and small; no claim of scalability or complete decision procedure for general distribution safety is made.
  • how much was read: most of it read
  • source
  • record id: akshay-et-al-affine-mdp-invariants-2023
• An Elementary Formal Proof of the Group Law on Weierstrass Elliptic Curves in Any Characteristic (2023)
  • what: Lean 3/mathlib formalization of an abelian group on nonsingular points plus infinity of a full Weierstrass curve over any field, including characteristics two and three. Avoids a huge direct associativity expansion by mapping each point to an invertible ideal class, proving this map respects addition and is injective, then transferring group laws from the class group. Records singular-curve scope, explicit vertical/tangent/secant branches, nonsingular closure, coordinate-ring domain independent of discriminant, inverse/addition ideal identities, norm-degree obstruction and Smith-normal-form dimension argument. Preserves the unformalized geometric-model bridge and discriminant converse, representation/typeclass performance lessons, 1500-line algebraic proof comparison, experimental failed expansions and boundaries of cryptographic applicability.
  • limits: §§2.1–2.3/3, pp.3–9: coefficients a1,a2,a3,a4,a6 define Y²+a1XY+a3Y=X³+a2X²+a4X+a6. General definitions start over a commutative ring, but group operations require a field for division. The point type is infinity or affine coordinates together with curve-membership and nonsingularity proof. The group theorem covers nonsingular points even when the curve discriminant is zero; an elliptic curve with invertible discriminant is a special case where all affine points qualify. Proposition 1/Remark 2/§4.4, pp.3–4/17: representing every abstract smooth projective genus-one curve equipped with an F-rational base point by a Weierstrass model is mathematical background via Riemann–Roch, not a formalized result of this development. Over rings the global-model claim requires restrictions such as trivial Picard group, and scheme-theoretic points differ from the affine-plus-infinity field representation. The paper does not prove the group theorem over arbitrary commutative rings. §2.2, p.5: affine nonsingularity means the equation holds and at least one partial derivative is nonzero. Nonzero discriminant implies every affine curve point is nonsingular by translating the point to the origin and using a coefficient calculation. The converse over the algebraic closure remains unformalized. Completing square/cube simplifies only when relevant characteristic is not two/three; the main full-model proof avoids those restrictions. §2.3, pp.6–8: infinity is identity; negation is (x,−y−a1x−a3). Equal x and opposite y gives infinity. Equal x but not opposite gives tangent slope −W_X/W_Y; unequal x gives secant slope (y1−y2)/(x1−x2). Cubic factorization gives x3=l²+a1l−a2−x1−x2, followed by reflected line value for y3. The slope function is total with zero in the vertical case; meaningful affine-sum lemmas require the guard excluding that case. Lemmas 5–6, pp.6–8: negation preserves nonsingularity directly. For nonvertical addition, differentiate the cubic factorization; if the third intersection x differs from the first two, a nonzero derivative proves nonsingularity, and otherwise the point equals an original point or its inverse. This establishes closure before relying on associativity. Addition on all affine points including singular ones would not yield a group. §3.1/Lemma 8, pp.9–10: coordinate ring F[W]=F[X,Y]/(W) is an integral domain by irreducibility of the monic quadratic in Y and degree comparison in X. This does not require discriminant nonzero. The ideal class group uses invertible fractional ideals modulo nonzero principal fractional ideals; it does not assume every nonzero ideal is invertible or prove the coordinate ring Dedekind. Lemma 10/§3.2, p.11: point ideal I(x,y)=(X−x,Y−y) is invertible for a nonsingular affine point because I(x,sigma_x(y)) I(x,y)=(X−x). Partial-derivative nonvanishing shows an auxiliary ideal is the unit ideal. Inverse fractional ideal is I(x,sigma_x(y))/(X−x). Infinity maps to the trivial class; additive type synonym adapts the multiplicative class group to the point-addition interface. Lemma 12/Remark 13, p.12: the nonvertical addition identity is I1 I2 (X−x3)=I3 (Y−lambda(X)). Principal factors vanish in the class group, so it proves preservation of addition. Tangent and secant are handled together under the nonvertical guard. The printed statement uses nonsingular points, but the underlying ideal identity does not require that; a more geometric three-intersection factorization would require stronger hypotheses. §3.3/Lemmas 14/16, pp.13–14: the coordinate ring has rank-two F[X] basis {1,Y}. Norm of p+qY is p²−pq(a1X+a3)−q²(X³+a2X²+a4X+a6), with degree max(2 deg p,2 deg q+3). The degree of the zero polynomial is treated as minus infinity in the degree formula. Even and odd leading degrees cannot cancel, and the mixed term has lower degree; no element has norm of degree one. Lemma 16–17, p.14: for nonzero f in this coordinate domain, Smith normal form equates degree of norm with F-dimension of the quotient by f. A point ideal quotient is F via evaluation, so if the point ideal were principal its generator would have norm degree one, contradiction. Trivial class therefore forces infinity; the already-established inverse/zero criterion reduces full injectivity to this kernel argument without assuming associativity of point addition. §3.3/Proposition 7, pp.9/14: injectivity and preservation of the explicit operation transfer associativity and commutativity from the existing class group. No surjectivity of to_class or identification of every ideal class with a rational point is needed. The final add_comm_group instance packages zero, inverse, addition and all laws. §4.1–4.2, pp.15–16: algebraic class-group argument spans about 1500 Lean 3 lines, reusing substantial algebra libraries. The cited Coq geometric comparison has 3500 divisor-theory plus 6500 curve-identification lines and different model/field scope. Direct general-position calculations reportedly involve tens of thousands of monomials and deterministic ring timeouts, while SageMath took about half a second. No hardware, systematic timings or controlled proof-strategy benchmark is given. §4.3, pp.16–17: nested univariate polynomials F[X][Y] make coefficient extraction and adjoin_root power basis convenient, but do not directly reuse multivariate Nullstellensatz lemmas. Explicit identities replace that machinery; partial derivatives are manually defined because coefficient differentiation is not a ring homomorphism accepted by polynomial.map. ring/linear_combination and a small eval_simp tactic discharge basic identities. §4.3, p.17: derived reducible comm_ring instance caused slow repeated unification despite an irreducible coordinate_ring type. Locally marking the instance irreducible fixes this Lean 3 issue; simplifying statement types fixes other timeouts. The publication predicts Lean 4 will address the issue, but this reading does not check current Lean/mathlib status. §4.4, p.17: base-change functoriality, division polynomials, reduction maps, cryptographic algorithms/protocols, Hasse bounds and abstract geometric equivalence are proposed or ongoing work. The record does not claim verified ECC machine code, constant-time implementation, cryptographic security, protocol correctness or independent build. Repository snapshot is supplied; actual source was not read here.
  • how much was read: most of it read
  • source
  • record id: an-elementary-formal-proof-2023
• AutoHyper: Explicit-State Model Checking for HyperLTL (2023)
  • what: Presents AutoHyper, a complete explicit-state model checker for arbitrary HyperLTL quantifier prefixes, using automata quantifier elimination and practical language-inclusion backends. HyperLTL trace quantifiers are eliminated inductively into T-equivalent Büchi automata; existential elimination composes with the transition system, while universal elimination is negation plus complementation. Proposition 1 replaces the outermost complementation by inclusion L(A_T^n)⊆L(A_φ), enabling spot, RABIT, BAIT and FORKLIFT. AutoHyper is implemented in F# with symbolic alphabets and text interfaces. Experiments compare explicit-state inclusion checking with HyperQube BMC on Boolean programs, NuSMV models, SNARK linearizability, mutation tests and grid path-planning hyperproperties; it is complete and often as fast or faster. Random formulas with up to four alternations show practical growth milder than worst-case theory. A complete AutoHyper baseline quantifies strategy-based verification’s incompleteness and runtime trade-offs.
  • number: On the HyperQube benchmark table, AutoHyper handles Bakery, SNARK, thread, NRP and mutation instances; HyperQube returns wrong results for Bakery3 φS3 and NRP:Tincorrect.
  • number: For grids, AutoHyper solves 60×60 shortest path in 88.83 s and robust path in 3.70 s, while HyperQube times out; 40×40 robust path takes 1.58 s versus HyperQube 265 s.
  • number: Strategy verification succeeds on 60.4% of random instances whose properties hold in 61.1% of cases.
  • number: All experiments use an Intel Core i3 Mac Mini with 16 GB RAM and spot 2.11.1 plus four inclusion backends.
  • limits: The model is finite-state, formulas are closed HyperLTL formulas over infinite traces, and explicit-state methods can exhaust the generated state space. Language inclusion remains PSPACE-complete in theory; backend performance depends on automata representation and checker. BMC may be faster on shallow cases but is incomplete for many alternated properties (for example GNI), while AutoHyper’s completeness does not remove worst-case state explosion. Evaluation uses a Mac Mini i3/16GB, selected benchmark instances, fixed HyperQube bounds and semantics, and an unoptimized strategy-based engine; results may not generalize to larger systems or optimized competitors.
  • how much was read: most of it read
  • record id: autohyper-explicit-state-model-2023
• Automated Theorem Proving for Metamath (2023)
  • what: Builds Metamath-to-ATP translations through MM0/HOL, three higher-order encodings and one first-order class encoding. Evaluates proof search on 40,556 translated set.mm problems, then adds chronological nearest-neighbor premise selection and Prover9/IVY-to-Metamath reconstruction in mm-hammer. Combined ATP success with human proof dependencies is 27,436/40,556 (67.65%). Reports around 30% hammer success with four 60-second premise slices and replay of roughly 15k Prover9 proofs with human premises. These are distinct evaluation settings; no LLM or distributed-protocol evaluation. Separates theorem bundling/unbundling, syntactic versus semantic encodings, known-proof premise access, chronological training, variable time-budget solver unions, first-order reconstruction restriction, full hammer claims and proof-size explosion. Preserves all table data, successful concrete examples and unsolved general lemmas, artifact pointers, hardware/version details and metric ambiguities.
  • limits: §§2–3: Metamath stores explicit proofs over token sequences. Metavariable substitution can bundle multiple alpha-equivalence classes in one theorem. MM0 splits these, parses constructor trees and makes set-variable dependencies explicit. Open formulas become higher-order functions. Unbundling increases task count without adding independently authored mathematics. §§3–4: translation chain is set.mm→MM0→HOL Lisp→TPTP TH0. Formula, class and set-variable types become truth values o, predicates iota→o and individuals iota. No constructor returns a set variable, so such terms are variables. v1 leaves constructors uninterpreted; v2 interprets 10 logical constructors; v3 interprets 11 more, including ternary conjunction, substitution and class abstraction. Deeper interpretation can ease search while making replay harder. §§4/6: benchmark axioms are earlier facts extracted from each theorem’s actual MM0 proof. This gives access to human proof dependencies. It is different from automatic premise selection over the whole library. Sequent antecedents are also distinguished from external facts used in proofs. Some alias problems are trivial because a supplied fact equals the goal. §5: first-order encoding represents formulas/classes as classes of context-tuples. It uses var constants for bound variables, cv for coercion, eval for composition/application, all for binding and predicate p for truth in empty context. Logic remains largely uninterpreted. Certain identities needed to expose intended semantic consequences are deliberately omitted, limiting provability of some generated tasks. §6: set.mm snapshot June 24, 2022, commit d75c0dbe. Original 40,338 theorems become 40,556 MM0 theorems, including 218 additional alpha-degenerate variants. Each of v1/v2/v3 has 40,556 tasks, plus a first-order version. Encodings overlap; they are not independent samples. No later-library or separate held-out library evaluation is provided. §7.1: server has 36 hyperthreading Intel Xeon Gold 6140 cores at 2.30GHz and 256GB RAM. Systems are E2.6, Vampire5980 and ZipperpositionCASC20, with portfolios and selected extra strategies. Most limits are 60s, with initial 10s runs, full runs up to 280s, and 600/1200s runs on previously unsolved tasks. The 67.65% union combines heterogeneous methods and budgets. §7.1: E at 10s solves 11,456 v1 versus 20,352 v2 problems; v1 adds only 46 unique solutions. Best full run is Zipperposition v3 at 280s with 25,420 (62.68%). Its v2 runs solve 24,959 at 280s and 23,518 at 140s. E at 60s slightly prefers v2 (21,001) over v3 (20,799). Deeper encoding does not uniformly improve every prover. §7.2: first-order successes with human premises are Vampire 15,938, E 15,136 and Prover9 14,693. Tasks are Horn with small dependency sets. Authors attribute similar results and weak complementarity to that structure. The paper compares these to Vampire’s higher-order 60s result but gives no separate full configuration table for first-order runs. §7.3: the whole-earlier-library setting allows all facts before the target theorem. Vampire at 60s solves 8,509 v3 tasks in LTB/SInE mode and 4,013 in hol mode. Distance-weighted nearest-neighbor selection trains incrementally on preceding human proofs. Seven parameters/slice sizes are 10,20,40,80,120,160,240. Future facts and proofs are excluded. Feature encoding, distance weights and tuning holdout are not detailed here. §7.3.1: seven higher-order 60s slices together solve 14,787 tasks; three complementary slices 120/240/20 solve 14,113, with nominal sequential budgets seven/three minutes. Best listed single slice, 120, solves 12,043. Parallel execution changes resource use; these unions are not one 60-second CPU run. §7.3.2: seven first-order standard slices plus 480/960 solve 12,373 unique tasks. Four slices 480/960/80/240 solve 12,089, about 30%. Sizes 480/960 alone solve 10,726/10,593. These are Vampire search results. No separate table gives final Metamath replay counts/timing for each slice. §11 calls the full tool 30% successful with four parallel 60s selections; retain that author claim without inventing a separately measured replay denominator. §8: Vampire proofs lack sufficient detail for reconstruction, so Vampire minimizes premises and Prover9 supplies IVY proofs. Reconstructed inputs and goals are Horn clauses. Instantiation/resolution preserve Horn; observed propositional steps remove duplicate assumptions. new_symbol, flip and paramod do not occur in reconstructed proofs. This is not replay of arbitrary classical or higher-order ATP proofs. §8: interpret Horn clauses as functions in minimal logic/simply typed lambda calculus. A headed clause maps conjunction of assumptions to its head; a negative clause maps to fresh F. Negated goal introduces the only constructor thm:B′→F. Resolution becomes function composition, instantiation substitutes terms, and duplicate removal repeats arguments. Normalize the proof of F to thm(p), remove thm, and emit Metamath applications. This argument relies on the restricted grammar and source facts; no full mechanized translator-correctness theorem is supplied. §8.1: normalization pushes instantiations to leaf applications. Restricting output to one theorem proof can duplicate intermediate work. mercolem6 expands from 674 IVY steps to 5,660,830 Metamath lines. Named auxiliary lemmas would avoid replication but are future work. Other listed reconstructed lengths are 849,77,50,45. Proof size can dominate search cost. §§9–11: benchmark https://github.com/ai4reason/mm-atp-benchmark and tool https://github.com/digama0/mm-hammer are published. Tool includes installer, premise selection, provers and reconstruction. Authors report replay of all roughly 15k Prover9 proofs with human premises. No artifact was executed for this record. No Verus/Rust/TLA+, distributed-protocol specification, LLM training or LLM-agent experiment.
  • how much was read: most of it read
  • source
  • record id: automated-theorem-proving-for-2023
• Automated Verification for Real-Time Systems (2023)
  • title: Automated Verification for Real-Time Systems via Implicit Clocks and an Extended Antimirov Algorithm
  • what: Defines the core timed language C_t, the Timed Effects (TimEffs) specification logic, a Hoare-style forward verifier, and an extended Antimirov term-rewriting system (TRS) that checks timed-language inclusion. The implementation verifies source-level temporal behavior with implicit, input-dependent clocks and concurrency constructs. TimEffs combines regular-expression traces with dependent arithmetic bounds, event absence, guards, waiting, deadlines, interrupts, parallel composition and shared mutable state. Forward rules compute effect states compositionally and call the TRS at calls and postconditions; the TRS uses nullable/first/partial-derivative functions, Z3 side-condition checks, memoized reoccurrence, and explicit parallel derivatives. The paper works through addNSugar/makeCoffee and Fischer mutual exclusion, and gives a soundness theorem for the forward rules, termination and soundness theorems for the TRS, and a prototype of about 5k OCaml lines.
  • number: 54 synthetic timed programs used for functionality validation; 16 tabulated examples
  • number: synthetic programs range 26–337 LOC; forward time 0.006 ms to 49,873.835 ms
  • number: Fischer proves for 2–5 processes in 0.09, 0.21, 0.46 and 25.0 s; disproves d≤e in 0.110, 0.093, 0.120 and 0.128 s
  • number: comparison uses PAT/Uppaal concrete-constant timings
  • limits: The core semantics uses discrete non-negative integral time (the authors say real-valued time is straightforward); programs are first-order and loops are represented by tail recursion. Arithmetic side conditions are discharged by Z3 and the TRS is incomplete: valid inclusions can be rejected because unification is insufficient. Experiments are manually annotated synthetic C_t programs plus a Fischer model, not deployed systems; parallel/shared-state reasoning is model-level and the authors identify separation-logic integration as future work.
  • how much was read: most of it read
  • record id: automated-verification-for-real-time-systems-2023
• AutoQ: An Automata-Based Quantum Circuit Verifier. (2023)
  • what: Presents C++ automated Hoare-style quantum-circuit checking with tree-automata sets of pure states, symbolic amplitude expressions and predicate-valued postconditions. Extends prior exact gate transformations with relational symbolic specifications and an antichain entailment procedure invoking Z3. Reports Hadamard identity, real-amplitude checks, full Grover probability checks for fixed/all encoded oracles and a weaker single-iteration amplification check, plus two injected bugs. No new machine-checked verifier correctness proof or empirical proof-writing agent is supplied. Defines symbolic-tree entailment and a compact high-level language with basis patterns, existential index and tensor products. Exact algebraic-number representation supports a finite gate set; the main new entailment step checks constraint-implied leaf predicates during bottom-up TA inclusion. Benchmark details expose how oracle quantification and weaker properties change scale and bottlenecks. Reader checks separate printed algebra/size defects from artifact correctness and distinguish the defined uniform symbolic-tree entailment from ordinary valuation-dependent set inclusion.
  • limits: Hoare input{P,phi}C{Q} has a finite OpenQASM gate sequence C, term-leaf precondition TA P, formula phi over shared symbolic values and term/predicate-leaf postcondition Q. It operates on pure-state amplitudes and unitary supported gate sequences; no measurement branching, noisy/mixed-state evolution, dynamic loops or physical-device correspondence is established. Exactness is relative to represented states and supported transformations. Each n-qubit vector is a depth-n binary decision tree, ordered by qubits, with amplitudes at2^nleaves. Tree automata share substructure and can represent all computational basis states with O(n)states/transitions. This compactness is for structured families, not a general polynomial representation of arbitrary quantum-state sets; executing gates and entailment can still grow exponentially. Introductory two-symbol construction assigns one marked amplitude vh and the same vl to every other basis. The text describes this as all states with one more probable basis, but it only covers that equal-unmarked-amplitude subclass, not arbitrary unequal lower amplitudes. A more general TA/specification may encode other structures; the displayed construction itself is restricted. High-level grammar supports fixed basis patterns with default other-basis term, existential bitstring index, finite spec unions and tensor products. Free indices, repeated bases and mixed lengths are ill-formed. Reusing an existential index across tensor factors encodes oracle/work-register relationships. This is user-authored specification automation, not automatic discovery that the postcondition captures the intended quantum algorithm. Concrete gate coefficients use(1/sqrt2)^k*(a+bomega+comega²+domega³),integer a,b,c,d and omega=exp(ipi/4). Supported gates:X,H,Y,Z,S,T,Rx(pi/2),Ry(pi/2),CNOT,CZ,Toffoli. This countable ring supports a universal approximation basis, not exact arbitrary-angle rotations. Solovay–Kitaev approximation for other rotations does not by itself certify the original ideal circuit/property or propagate an error budget. Precondition leaves share a normalization exponent k, omitted using normalization of the full state; relative exponent kc is tracked through gates and applied to final leaves. This depends on normalized-state/common-scale interpretation. The paper does not supply a full symbolic normalization-validation procedure or arithmetic-overflow audit. Integer symbolic terms and exact gate constants do not prove the whole C++/SMT pipeline correct. Visually confirmed formula defect on p.145: expansion first contains +ci, but squared imaginary component is printed(bsqrt2/2−c+d*sqrt2/2)² instead of+c. Reader example(a,b,c,d)=(0,1,1,0): |omega+i|²=2+sqrt2, whereas printed formula yields2−sqrt2. The real-amplitude condition c=0,b=−d remains valid; artifact arithmetic was not inspected and no implementation bug is inferred. Tree entailment requires each term leaf either match syntactically or satisfy phi=>postpredicate after substitution. Automaton entailment is forall source symbolic trees exists a post tree whose every leaf implication is valid under all phi-valuations. This quantifier order requires one post-tree choice uniformly across those valuations, stronger than allowing post-tree choice per concrete valuation. It is the defined check, not completeness for arbitrary extensional unions of concrete states. Reader quantifier example: identity on v|0>+(1−v)|1>,integer v∈{0,1}; postcondition is a union of predicate trees describing exactly|0> and exactly|1>. Every concrete output belongs to that union, yet neither fixed post tree matches both valuations under leafwise implication. Defined entailment can fail without a concrete physical violation under that different set interpretation. Do not treat bug found as an independently validated counterexample for every broader intended semantics. Algorithm1 initializes pairs(sourceleafstate,setofmatchingpostleafstates), combines pairs bottom-up along the same qubit label, rejects if a source root has no post root, and returns true when the worklist empties. Antichain Min/subsumption/simulation prune states; details are delegated to refs4/10. Visual line4 is Worklist!=empty; raw extraction loses the slash. Qr/Qq notation in some lines is inconsistent with Sr/Sq, not evidence of an implementation fault. C++ pipeline preprocesses .aut/.hsl/.smt/.qasm, applies imported gate transformations with symbolic leaf updates and outputs reachable TA R, then checks entailment. Uses VATA for term-only TA inclusion and Z3 for predicate implications; experiments use QF_NIRA. Allowing any Z3-supported theory is not a claim that every theory is decidable or that unknown/timeouts imply a bug. Such result handling and proof certificates are not described. Hadamard-square case uses arbitrary symbolic quadruples for both input amplitudes and phi=true, preserving each amplitude. One altered H gate is detected. Bernstein–Vazirani cases check only zero imaginary parts, not the full correct secret output, although the worked three-qubit example yields|010>. An injected BV bug violates that property. A different erroneous circuit could retain real amplitudes and evade this weaker specification. GroverSingle fixes an oracle satisfying bitstring and starts all work/ancilla bits zero; postcondition requires correct-work-basis probability>.9, other basis probabilities<.1, real amplitudes and zero ancillas. GroverAll stores an arbitrary basis-index oracle in an additional register and relates it to the work-register answer using the same index. It covers all encoded unique-solution bitstrings at a fixed n, not all Boolean functions/multiple-solution oracles or coherent superpositions of distinct oracle indices. GroverIter assumes all unmarked amplitudes are the same positive real vl, marked amplitude vh>0 and(2^n−1)*vl>vh. The postcondition increases marked magnitude and decreases every unmarked magnitude, preserves real amplitudes and zero ancillas. This avoids Grover overshoot and proves one iteration on that structured region, not overall search success for arbitrary input vectors, alliterationcounts or probability>.9. Table1 has18selected rows:16OKand2Bug. BV reaches1000qubits/2500gates in198m28s; that property is only real amplitudes. Full GroverAll reaches n9(27totalqubits),1492gates,25m16s; GroverSingle reaches n20(40qubits),141527gates,19m57s. GroverIter reaches n100(200qubits),895gates,10m53s for its weaker property. A fixed-size verification does not establish a parameterized theorem for alln. Printed GroverIter(2) row lists3qubits/13gates while Section5.4 describes a4-qubit two-work/two-ancilla circuit. Preserve the table and note the discrepancy; do not silently repair either without artifact comparison. n>=100scaling language is supported here by an n100row, not an unbounded sequence of measured results. Maximum peak memory is reported52MiB for GroverAll9. Entailment is usually negligible but costs138of198seconds for All8(~70percent) and1296of1516seconds for All9(~85percent). These are different-instance bottlenecks, not a controlled asymptotic proof. The paper supplies no CPU/RAM/OS, repeated trials, seeds, variance, timeout criterion or competitor benchmark table; previous evaluation is delegated to ref14. Artifact https://doi.org/10.5281/zenodo.7966542 and repository https://github.com/alan23273850/AutoQ are linked. A predecessor caught a Qcec bug according to footnote2/ref3, not a newly reproduced result here. No new formal correctness theorem/proof, independent artifact execution or full trust audit is provided in this reading. Relevance is automated relational specification checking, exact symbolic arithmetic and evaluation of property strength/negative cases. No LLM writes specs/proofs, no Verus/verified Rust or TLA+ pipeline, and no distributed-system protocol is verified. Claims about tool priority/manual-proof alternatives are author statements rather than an independent exhaustive comparison. Reader qualification after independent review: Grover probability/amplification predicates are printed using only coefficient a (square-a placeholder), not the full real amplitude a+sqrt(2)*b allowed by psi_Im (c=0,b=−d). Interpreting a as the entire real amplitude needs an a-only invariant for these cases or an unstated shorthand. This is a specification-presentation limitation; no circuit or artifact error is inferred.
  • how much was read: most of it read
  • source
  • record id: autoq-an-automata-based-2023
• Best et al regular-prime FLT case I 2023 (2023)
  • title: Fermat’s Last Theorem for Regular Primes
  • what: Authors report Lean/mathlib formalization of case I of Fermat’s Last Theorem for regular primes: a prime p coprime to the cyclotomic class number admits no integer solution a^p+b^p=c^p when p does not divide abc. Contributions include cyclotomic-extension definitions, prime-power rings of integers and discriminants, unit/coercion lemmas, a splitting-field typeclass repair and early upstream integration. Case II and full Kummer theorem are future work in this 2023 source. The engineering experience identifies concrete maintenance and automation needs; no proof-agent experiment is run. Reads exact case-I predicate and regular-number definition; positive-order/splitting-field encoding; finite number-field and prime-power ring/discriminant scope; definitional versus propositional Q-algebra diamond repair; quotient/action interface and nested unit/ring/field coercions; conjugation-fixed realness; source-only sorry-free claim; >110 accepted PRs/~2000 cyclotomic-library lines; proposed repair/style/import automation; missing Bernoulli equivalence and p-adic ingredients for case II.
  • limits: The title names the project target broadly, but completed result is case I only. Theorem2 states regular odd prime p with gcd(xyz,p)=1. Displayed Lean caseI assumes p prime, is_regular_prime p and not p dividing abc, returning a^p+b^p≠c^p. It has no explicit oddness hypothesis; do not replace this by a proof for every prime without the regularity/nondivisibility conditions. Nondivisibility also excludes zero abc. Case II permits p dividing xyz and is still ongoing (§1,§3). Regular number n is positive and coprime to the cardinality of the class group of the ring of integers of cyclotomic_field n Q. For prime p this means p does not divide that class number. Existing mathlib finite-class-group results are prerequisites. Paper reports p=2 regular, but generally cannot yet readily compute cyclotomic class numbers to certify concrete regular primes. Its examples 37/59/67 irregular below 100 and roughly 60% expected regular primes are mathematical context, not formalized classification or experimental success rate (§1,§3). Cyclotomic extensions are a property of A-algebras B relative to a set S of positive integers: specified primitive roots exist and B is generated over A by roots with those orders. Positive orders rule out n=0. cyclotomic_field is concretely a splitting field of the cyclotomic polynomial; field/algebra/inhabited structures derive from it, but cyclotomic-extension instance needs proof. Property encoding supports subextensions and transporting lemmas rather than forcing every construction to use one definitional field representation (§2). If S finite and K a number field, reported theorem says every S-cyclotomic extension of K is a number field. Ring-of-integers equality O_Q(ζn)=Z[ζn] is formalized only for prime-power n=p^k, sufficient for n=p in case I; no general all-n equality was completed here. Norm/trace APIs, discriminants and basis relations were developed as prerequisites (§2). Discriminant formula is (−1)^(φ(p^k)/2) · p^[p^(k−1)((p−1)k−1)] in the stated odd-prime/k>0 case and p=2,k>1. Lean discr_prime_pow works with general fields K,L, algebra structure, cyclotomic-extension assumption, p prime, primitive root and irreducible cyclotomic polynomial. Omitting those extra assumptions is unsound for general fields. Natural-number division/subtraction conventions handle boundary exponent cases; the printed formula is for the root power basis, not an unconditioned discriminant claim in every characteristic (§2). Q-algebra typeclass diamond arose from generic base-field algebra versus characteristic-zero induced rational algebra on a cyclotomic splitting field. They were propositionally equal but not definitionally equal, so elaboration chose incompatible representations. Repair changed splitting_field construction to lift each field separately, controlling qsmul/rat_cast before assembling the structure. Quotient well-definedness motivated weak distrib_smul action class. This is a concrete infrastructure repair, not a mathematical counterexample to the theorem (§3). Units R×, ring R and fraction field K are distinct types. Inversion works on units/field but not arbitrary ring elements; automatic rewriting has no single obvious normal direction. Small transport lemmas, including coe_coe_inv, handle nested casts. Lemma 3 decomposes a unit into an integer power of ζ times a real unit. Integer powers require a group, and realness is encoded as fixed by complex-conjugation Galois action on K, avoiding a noncanonical coercion into real numbers. This is the discussed proof-engineering obstruction and solution, not a measured general automation improvement (§3). Paper does not print every supporting lemma or complete case-I proof body: it links the blueprint and claims a full sorry-free repository proof. All supplied paper pages/code/formulas were read, but no source checkout/build, axiom audit or independent kernel acceptance was performed. Artifact archive c19341f16f36abca8203dcb2b5a8dbbbc1864b06 and repository https://github.com/leanprover-community/flt-regular identify author-provided evidence. Exact tool/library version is not pinned in the paper, and no current 2026 completion/upstream-status assertion follows. Blueprint is an informal progress/target document, not a formal specification automatically certified to match intended mathematics. The paper mentions independent elementary p=3 formalization by Ruben Van de Velde, which is not this reading’s artifact replay or a benchmark case for the project’s generic proof (§1,§3). Early upstream strategy stages ready_for_mathlib results and immediately opens PRs, sometimes proving extra generality. Authors report more than 110 accepted PRs across areas and around 2000 lines in number_theory/cyclotomic as byproduct; that is neither total project size nor measured proof-generation throughput. Their judgement that this is best for medium projects and criticism of other projects’ update difficulty are author opinions from 2023, without a controlled maintenance comparison (§4). Proposed automation includes summarizing upstream changes, generating/applying repairs, style improvement, simplifying/generalizing proofs, avoiding antipatterns and moving code/imports between libraries. These are desired tools, not implemented/evaluated LLM proof agents or a quantified repair benchmark. This is particularly relevant to evaluating agent-generated proofs as maintainable upstream contributions rather than only one-time acceptance (§4). Future case II needs Kummer’s unit lemma: regular p and unit u congruent to an integer mod p imply u is a p-th power of a unit. Proposed alternative regularity via Bernoulli numerators is easier to compute but equivalence with class-number regularity still needs proof. p-adic completions/extensions, logarithms of units and analytic links to Bernoulli numbers are missing ingredients; referenced p-adic L-function formalization may help depending on chosen route. These are plans, not completed results (§5). Reader mathematical caveat: introduction says one can restrict general FLT to odd prime exponents, but a full reduction also needs the exponent 4 case for powers of 2. The short paper does not discuss that separate standard reduction step. This does not affect its explicitly scoped case-I theorem (§1). No distributed program, protocol safety/liveness property, Rust/Verus verification, TLA+ model, LLM pass rate, formal proof runtime/memory, effort measurement or statistical benchmark appears. Contribution to this topic is a concrete Lean formalization/integration case and the resulting requirements for reliable proof construction and repair. All proof-completion claims above remain author reports rather than fresh certification.
  • how much was read: most of it read
  • source
  • record id: best-et-al-regular-prime-flt-case-i-2023-2023
• BMC for Asynchronous Hyperproperties (2023)
  • title: Bounded Model Checking for Asynchronous Hyperproperties
  • what: Generalizes asynchronous HyperLTL (A-HLTL) with nested trajectory quantifiers and gives a QBF-based bounded model checker for a fragment, with complexity results for acyclic Kripke structures and case-study experiments. The extended logic quantifies traces and trajectories independently, where trajectories choose which traces advance or stutter and must be fair. The bounded encoding unrolls Kripke structures to depth k and trajectory schedules to m, with pessimistic and optimistic halting semantics; Theorem 1 establishes equivalence at the structure diameter and a finite trajectory bound. For acyclic frames, one trajectory quantifier gives NL/coNP-polynomial-hierarchy bounds depending on trace alternation, while nested trajectory quantifiers raise complexity one level; arbitrary trace alternation with one trajectory remains PSPACE. The HyperQB implementation translates the encoding to QuABs QBF and finds security counterexamples and classifications in concurrent, speculative, compiler, and cache examples.
  • number: Theorem 1 uses K as structure depth and M=K×|Paths|×|Trajs|
  • number: ACDB 3.35 s; ACDBndet 14.01 s; ConcLeak 30.24 s; ConcLeakndet 911.72 s
  • number: SpecExcuV cases 9.33–13.58 s; DBE 0.98 s; LP 3.90 s; EFLP 22.58 s
  • number: compiler comparison reports 0.9/3.90/22.58 s for this method versus 0.8/365.9/1315.2 s MCHyper
  • limits: The completeness theorem targets terminating programs represented by acyclic Kripke frames and formulas with at most one trajectory-quantifier alternation; the BMC encoding omits the next operator because it cannot handle formulas not invariant under stuttering. General A-HLTL model checking is undecidable, and experiments use bounded finite models on a MacBook rather than scalability evidence for large software.
  • how much was read: most of it read
  • record id: bmc-for-asynchronous-hyperproperties-2023
• Closure Properties of General Grammars – Formally Verified (2023)
  • what: Lean3 formalization of unrestricted (type-0) grammars and closure under union, reversal, concatenation, and Kleene star. Supplies explicit grammar constructions and both language inclusions rather than relying on Turing-machine equivalence. The main technical obstacles are cross-boundary rewrite matches for concatenation and an invariant for arbitrary interleavings in star derivations; the latter uses a new delimiter-and-scanner construction. Preserves the symbol/rule/grammar encoding, finite rules with unrestricted symbol types, reusable lifting/sinking obligations, invalid naive concatenation example and proxy repair, all star rules and six invariant cases including unsuccessful derivations, mechanization effort and proof reuse limits, finite support in source definitions, pinned Lean/mathlib versions and incomplete adjacent README results.
  • limits: §2: Symbols are disjoint terminal/nonterminal constructors. A rule has input_L, one distinguished nonterminal input_N, input_R and an arbitrary output list. This structurally guarantees a nonterminal on every left-hand side; terminal-only strings are irreducible. A grammar stores its nonterminal type, initial symbol, and a finite rule list. Ambient terminal/nonterminal types need not be finite; each concrete grammar has finite symbol support. §2.2: A language is a set of terminal lists. Generated words are terminal-only images reachable from the initial nonterminal by reflexive-transitive rewriting. is_T0 means existence of a grammar with exactly that language. Grammar/Turing-machine equivalence is background knowledge, not formalized here; the conclusion lists it as future work. §1: Development uses Lean3/mathlib, small metaprogramming tools, nondependent data types with proof-bounded list indexing, and no attempt at constructivity. Source configuration pins Lean3.41.0 and mathlib7ed4f2cec258c1a1f86cd9a45adf7dc335f42ee1. This is not a verified algorithmic extraction or complexity analysis of recognition. §3: Union adds a fresh initial symbol and marked disjoint copies of both nonterminal sets, with two branch rules. Correctness requires construction plus both inclusions. The hard direction identifies the first branch and sinks subsequent derivations. The lifted_grammar interface requires injective lift, a partial inverse sink injective on defined inputs, matching forward rules, and preimages of applicable larger rules; the correspondence is not automatic for arbitrary embeddings. §4: Reversal swaps/reverses rule contexts and reverses outputs, preserving the central nonterminal and initial symbol. List reverse distributes over concatenation in reversed order and is involutive. No new terminal-alphabet restrictions are introduced. §5: Simply adjoining S→S1S2 is unsound for unrestricted grammars because terminal context can cross the factor boundary. The repair uses disjoint source tags and separate proxy nonterminals for terminals on each side. Simulated rules match proxies, never actual terminals. Proxy conversion may happen early, disabling matches, so the hard proof relates every arbitrary intermediate string to two source-derivable strings rather than assuming a prescribed execution order. Finite-support clarification from inspected source: paper prose says add conversion/scanning rules for every terminal t∈T, although T is unrestricted. Actual rules_for_terminals₁/₂ and rules_that_scan_terminals map only over all_used_terminals g, a list of terminal occurrences in rule outputs. Starting from a nonterminal, any generated terminal must have originated in such an output. This keeps constructed rule lists finite; the record does not assume a hidden global fintype T. §6.1: Star introduces three fresh nonterminals Z,#,R disjoint from the old alphabet, retains original rules, and adds Z→ZS#, Z→R#, R#→R, R#→ε, and Rt→tR. Delimiters isolate copies. R can pass only terminals, so removing a delimiter and finishing requires terminal content. Production choices that leave a final R or stranded delimiter are allowed but cannot yield a terminal-only word; correctness does not require every derivation to succeed. §6.1 Lemma2: The invariant includes six shapes: Z-prefixed compartments; R#-prefixed compartments; completed words plus a terminal prefix β, scanner R, residual γ and more compartments; a terminal word in L*; a string ending in stranded R; a string ending in stranded # with no Z/R. Induction on every rule preserves one case; only the fourth permits a generated terminal word. The empty-word case follows Z→R#→ε, even if L is empty. §6.2: Ellipsis-based compartment expressions become nested list.map/list.join. The 3,000-plus-line star_induction proof splits six state cases and then rule cases; localization of inherited rules inside a single compartment needs reusable auxiliary lemmas. This is paper-reported effort, not an independently counted minimum or a benchmark against another representation. §§3,5,6.2: Union and concatenation reuse general-grammar proofs for context-free closure because added rules have single-symbol left-hand sides when sources are context-free. Reversal is separately provided in the repository. The star construction uses two-symbol left-hand sides and therefore does not establish context-free star closure by the same proof; a simpler context-free construction is left separate. §1/§8: Type-0 intersection closure was not formalized, despite being mathematically true. Nonclosure under complement is cited as background. Context-sensitive/regular integrations and grammar–Turing-machine equivalence are future work. The authors’ belief that grammar proofs are more convenient is not supported by a controlled Turing-machine formalization comparison. Artifact scope: publish README says this commit matches paper v2, gives ./mk and a conditional Result: SUCCESS message, and separately marks context-free intersection/complement results as missing the pumping-lemma proof. This incompleteness concerns adjacent context-free results; it does not by itself invalidate the four reported type-0 closure theorems. No build was run and no complete dependency/axiom audit was made. Text searches of the two fetched closure files found no sorry/axiom tokens, which is not a kernel verification. Paper presentation: Lemma2 writes α∈(T∪N)* even while its cases explicitly include fresh Z/#/R, so interpret the induction over the expanded symbol alphabet, as formal source ns T g.nt does. The worked example’s final string is ab·aaabbb·ab. Source excerpts, mathematical paper proof, and successful artifact compilation remain distinct evidence levels. No distributed protocol, Verus, verified Rust, TLA+, or LLM proof/specification agent is evaluated. Useful adjacent evidence is the need for a stronger inductive invariant, counterexamples to informal composition, explicit failed execution cases, and verifying both directions of a claimed construction.
  • how much was read: most of it read
  • source
  • record id: closure-properties-of-general-2023
• CMM (2023)
  • title: Compound Memory Models
  • what: Gives two memory models for devices of different kinds (for example CPU and GPU): an operational one (LOST-POP) and an axiomatic one. Proves a mapping from scoped C/C++ to x86TSO and PTX for executions without data races. Checks the work with Lean, Alloy and gem5 tests.
  • number: 34 x86 tests, 73 PTX variants
  • number: 139 litmus tests in §6.2 vs 159 compound tests in §5.1, not reconciled
  • number: 512-2048 runs per simulator test
  • limits: The proof is a mathematical argument and is not fully machine-checked. No progress properties. The operational model leaves out mixed-size concurrent accesses and read-modify-write operations.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: Compound Memory Models
  • record id: cmm-2023
• CompMDP string-diagram checking (2023)
  • title: Compositional Probabilistic Model Checking with String Diagrams of MDPs
  • what: Defines CompMDP, a compositional probabilistic model-checking algorithm for open Markov decision processes composed as string diagrams, computing optimal expected cumulative rewards while retaining reachability probabilities and scheduler alternatives. The paper formalizes open MDPs with entrances/exits, rewards, transition probabilities and almost-sure termination, then derives decomposition equalities for reachability and expected rewards under sequential composition and loops. A categorical construction builds solution functors from rightward Markov chains to MDPs and bidirectional diagrams; semantic arrows retain pairs of reachability probability and expected reward for each memoryless scheduler, with a meager subsumption optimization. CompMDP implements this in Python, supports freezing subdiagrams and delegates frozen components to PRISM, and records an optimal scheduler result. Experiments on Patrol, Wholesale and Packets test reuse, freezing and scale, including models with 10^8 positions.
  • number: Patrol/Wholesale up to 10^8 positions
  • number: Packets 2.5×10^5 positions and 5×10^5 transitions
  • number: 6–130 s high-identification runs
  • number: Packets intermediate freezing 1–3 s vs PRISM 56–65 s
  • limits: The core framework assumes finite nonempty action sets, finite positions, unique exit access, and almost-sure termination of the top-level composed MDP; memoryless schedulers suffice under this termination assumption. Expected rewards are unconditional probability-weighted sums, differing from PRISM’s infinity convention for unreachable exits. The meager semantics and implementation optimization are described as correct but deferred for full categorical formalization. Sequential/task composition is better supported than parallel system composition; performance degrades with many locally optimal schedulers, low component reuse, loops, or poorly chosen freezing. Experiments run on one Apple dual-core laptop and synthetic benchmarks inspired by real tasks.
  • how much was read: most of it read
  • record id: compmdp-string-diagram-checking-2023
• Compositional Policy Learning in Stochastic Control Systems with Formal Guarantees (2023)
  • what: CLAPS learns policies and reach-avoid supermartingale certificates for edges of a DAG describing a SPECTRL task. A forward pass records the best certified product of edge probabilities and prunes prefixes below the global threshold. It extracts one certified path and uses a controller with memory of the current edge. Additive and multiplicative certificate formulations motivate a stronger model-relative probability bound using a Lipschitz/step-size delay before unsafe reachability. A stochastic nine-room example obtains a33.0% certified complete-path lower bound where direct policy/certificate learning times out. Records the exact certificate inequalities, stronger-bound conditions, full appendix proof arguments and printed gaps, verifier margin/numerical-expectation contract, stateful probability composition, restricted best-path completeness, every experiment/table value and the distinction between a33% lower bound and plotted successful trajectories. Identifies formula/translation/regularity discrepancies without assuming the uninspected implementation uses them.
  • limits: §3: Known dynamics xnext=f(x,π(x),ω), continuous state/action/noise spaces, fresh independent disturbances from a fixed known distribution at each step, Borel measurability, compact state space and continuous dynamics/policy. Model must map into X. Guarantees are for that stochastic model, every x0 in X0 and unbounded time to finite successful reachability; no bound on completion time or robustness to a changed disturbance law/model error. §3/p4/AppendixE/p23: Paper states continuous functions on compact domains are Lipschitz, which is false: sqrt(x) on[0,1] is a counterexample. The verifier actually requires valid finite Lipschitz constants for f,π,V; these must be additional assumptions or established for chosen neural networks/dynamics. Intro explicitly assumes Lipschitz dynamics. Compact X alone does not make unbounded U/W or their product compact. §4/Definition2: Additive RASM V continuous/nonnegative everywhere, V≤1 oninitials, V≥λ>1 onunsafe, and E[V(next)]≤V−ε for all nontarget states withV≤λ,ε>0. Stopping at target or certificate threshold distinguishes reachability from safety alone. A checked strict expected drift is essential; finite sampled decrease loss alone is not proof. §4/Definition3: Multiplicative RASM also requires V≥δ>0 outside target and E[V(next)]≤γV for nontargetV≤λ,0<γ<1. Theorem1 converts additiveε toγ=1−ε/λ,δ=min(ε,λ), and multiplicativeγ,δ toε=(1−γ)δ. Proof uses nonnegativity to boundV≥ε where active and V>λ elsewhere. Formulaγ is admissible only withε<λ; degenerate vacuous active sets/ε≥λ require choosing a smallerε. With a nonempty nontarget initial set,V≤1 enforcesε≤1<λ. §4/Theorem2: Assuming V isL1-Lipschitz with validLV and all transitions satisfy||x−f(x,π(x),ω)||1≤∆, N=floor((λ−1)/(LV∆)), lower bound reach-avoid≥1−γ^N/λ. ∆ andLV must bound all relevant states/noise, not just observations. N is a conservative lower bound on first threshold-crossing time; ceil would be the tight elementary distance bound, so floor is not literally the exact smallest time. IfN0, improvement vanishes; strictly tighter wording needsN>0. §4/AppendixD: Intended argument stops V at0 on target orλ on threshold exit, obtains nonnegative supermartingale and eventual stopping via positive additive drift, then scales byγ^−time and applies maximal inequality. Printed p21 partition includes overlapping target/threshold indicators and a dropped indicator; equality after summing claimed disjoint sets is not literal as written. A proper disjoint partition and stopped process recover the standard first part. AppendixD/pp21–22: PrintedYt freezes atYt−1 on the threshold-crossing step, excluding the crossing valueλ/γ^t. Thus its asserted equality between events supXt<λ and supγ^tYt<λ does not follow: an exit can be hidden by freezing the pre-exit value. Printed second caseV=λ also misses overshootsV>λ. A repaired process that includes the crossing value then freezes has a standard supermartingale argument and supports the intended bound; printed proof requires correction, not treated as kernel-checked proof. §4/Table1: Withγ.99,∆.1,LV5, theoremN=2(λ−1) for integerλ. Caption instead uses2λ. Forλ10/100 theorem values≈.916548624/.998633000, while table prints.91820/.99866, agreeing with the different exponent. λ1000 prints.99999 versus theorem≈.9999999999981. Both old1−1/λ values.9/.99/.999 preserved. Caption/theorem arithmetic discrepancy does not affect existence of a possible improved bound under corrected parameters. §4/Remark1: Pure-safety specialization sets targetempty andε0 orγ1, outside the strict RASM parameter conditions used for finite eventual stopping. Withγ1 factorγ^N=1, displayed theorem yields no strict improvement over the old safety bound. Positive strict drift/positivity with empty target on compact globally closed dynamics cannot simply be assumed forever on a non-exiting path. Claimed generic stronger safety guarantee needs separate conditions/argument. §5/Algorithm1: Translate formula toDAG,topologicalorder;Prob[source]1; for each node learn only incoming edges from predecessors withProb≥globalp, maximizing certified edge probability by finite-precision binary search; update max ofproducts. This optimizes a single selected path lower bound, not the union probability of alternative paths or arbitrary adaptive strategies. Failed/pruned certificate bounds do not show no safe policy exists. §5/AppendixF: Product composition requires each edge certificate uniformly lower-bound success from every state in its source region, and the previous edge termination state lie there. At random switching times, Markov dynamics/independent fresh noise permit conditional lower bounds; no assumption of independent edge-success events is needed. Proof must use conditional probabilities, not multiply arbitrary marginal success probabilities. §5/pp8–9: Runtime global controller remembers the current edge and switches at its target; it need not be a stationary continuous function of physical x alone even though preliminaries writeπ:X→U continuous. Augment with finite mode for semantics. On a safety violation it retains current policy indefinitely. Reach-avoid only constrains until a successful target prefix; no post-goal invariance/stability guarantee. §5/Algorithm1: Binary search uses heuristic learner/verifier success with unspecified precision parameter. Existence of an optimal certificate monotonic in threshold does not imply a finite-time stochastic learner succeeds monotonically. Maximal probability is only a search heuristic/achieved certified bound; no completeness or global optimality. Termination/timeouts of inner learning needed operationally; conclusion expressly disclaims guaranteed policy return/tight bounds. AppendixA/Eq1: Grammar achieveb, φensuringb, sequentialφ1;φ2, disjunction. Infinite trajectory satisfaction means some finite prefix satisfies formula; ensuring predicate holds over the chosen finite prefix. Thus successful traces have finite witnesses even though no fixed uniform horizon is required. A failure can be witnessed by a finite unsafe prefix or by never reaching a target. SPECTRL semantics do not impose safety after the selected satisfying prefix. AppendixA/Theorem4: Claims all fixed-finite-horizon Finitary properties translate into SPECTRL by disjoining sequences of word predicates. Printed sequence p(w1);…;p(wH) is not grammar-valid without a formula wrapper, and eventual sequential achievement does not force positions to be consecutive or at the initial prefix. More fundamentally these untimed constructs are invariant under repeating identical consecutive states, while a next-step predicate can change under such repetition. Hence the claimed general fixed-prefix expressiveness reduction is not established as written; do not report it as proved. AppendixB/Theorem5: Claimed linear-vertex DAG-equivalence construction has missing/incorrect details: merging sequential child nodes uses second child source labelX0 and overwrites first target predicate; disjunction adds a source but does not describe merging final nodes or edge labels; strict time indicesi0<i1… exclude zero-step achievement allowed by AppendixA. For example ifp holds only initially, achievep has an immediate witness but a single edge with strictly positive traversal time need not. Construction requires repair before literal equivalence follows; main paper cites prior construction separately. AppendixE/learner: Start withPPO, joint policy/certificate optimization, finite counterexample grids for initial/unsafe/decrease, softplus certificate output guarantees nonnegativity; initial max violation, unsafe max threshold gap, averaged empirical decrease residual plusτK, Lipschitz product-of-induced-L1-layer-norm regularization. Softplus networks can satisfy finite regularity bounds with valid layer norms, but zero empirical loss is insufficient for continuum expected drift. AppendixE/pp23–24: Verifier uses finite state meshτ and expected drift marginτK, K=LV*(Lf*(Lπ+1)+1), suppliedLf and computedLπ/LV. Interval arithmetic checks upperV≤1 on all cells intersecting initialset and lowerV≥λ on cells intersecting unsafe. Active cells must include all nontarget statesV≤λ. Soundness depends on valid bounds, correct cell coverage and certified expectations; grid dimension incurs scalability limits beyond shown2Dcase. AppendixE: Training decrease averages sampled noises, notationω1…ωN∼N inconsistently differs from disturbance lawd; θ/ν policy/certificate indices also swap. Verifier prints exactEω∼d but does not explain a sound integration/quadrature/interval expectation calculation in this PDF, referring to[68]. Training noise samples cannot stand in for a verified expectation without an error bound. λ starts1/(1−p′), decreases if needed for stronger bound, but unsafe loss still prints1/(1−p); relationp/globalp′/currentλ needs clarification. AppendixE/Theorem8: δ=min(min over grid(V−τK−E[Vnext]),λ),γ1−δ/λ. Strict positive margin is guaranteed only on active checked grid points, yet printedminimum runs over allXtilde, including target/inactive states where decrease is not required. Need restrictminimum to checkedpoints; nonpositive inactive margin can destroyδ>0. δλ also allowsγ0 contrary to definitionγ∈(0,1); choose a strictly smaller positive margin in such cases. Proof of extension uses Lipschitz bound to transfer active grid slack to all active states. §6: Only one2D Stochastic Nine Rooms environment; no benchmark suite, scaling study, repeated-seed uncertainty, empirical success fractions, reward values, total training runtime or hardware/network/hyperparameter table. Four-hour timeout per reach-avoid task, no total task count/runtime inPDF. A single successful visualization does not validate the certified lower bound statistically. §6/Figure1/Table2: StateX[0,3]²,initial[.4,.6]²,target[2.4,2.6]²; nine subgoal boxes centered on room centers. Wall regions drawn, exactcoordinates/noise distribution parameters not listed. Printed dynamics clipping parentheses malformed; intendedactionclipping[-1,1] plus additive triangularnoise. f:X→X requires boundary/obstacle treatment not fully specified. Table1∆.1 is not established for the printed2D L1 displacement, which can be.2 with two unit clipped action components even before noise; action-domain restrictions could change this. Need valid dynamics/noise/step-size contract. §6/Table2: Selectedpath(0,0)→(0,1)→(2,1)→(2,2) has printed edge bounds.723*.615*.745=.331260525; table conservatively reports.330. Printed percentages may themselves be rounded. Direct jointlearning timesout, not proof that no direct controller/certificate exists; a composed controller is itself an overall controller with additionalmode. §6/Figure2: Gray edges failed verification under budget; blue certifiededges; chosenorange3edgepath avoidsbottomright route that could not be verified. Automated graph search outperforms this one natural decomposition in the example; no general evidence that it dominates all manual decompositions. Edge-local obstacle labels must cover all global unsafe regions reachable before subgoal, or extra domain restriction is needed to infer globalwallavoidance. §7: Applies toSPECTRL task language, not allLTL. Probabilistic reach-avoid has both eventual progress and avoidance but no distributed scheduler/fault/network model. Paper proves mathematical certificate/composition statements with noted printed issues; no machine-checked proof, proofkernel audit, Rust/Verus/TLA+ implementationverification or LLMagentexperiment. Artifact URL supplied; no code inspected/executed here.
  • how much was read: most of it read
  • record id: compositional-policy-learning-in-2023
• Conschecker (2023)
  • title: Optimal Stateless Model Checking for Causal Consistency
  • what: Develops a stateless model-checking framework for causal consistency variants CC, CCv and CM. The DPOR algorithm explores executions represented by program-order (po) and reads-from (rf) relations, maintaining model-specific consistency edges; it is sound, complete and optimal because each consistent po-rf trace is explored once. Conschecker implements the algorithm at LLVM IR level and reports assertion violations. The paper formally defines CC overwrite cycles, CCv conflict/arbitration cycles and CM happened-before cycles, then gives a uniform trace semantics and DPOR schedule construction. Conschecker extends Nidhugg and validates outcomes against Herd simulations. Evaluation spans 9,815 litmus tests, SV-COMP stress tests, five database applications, classical anomaly benchmarks and parameterized programs; model strength differs (e.g., Delivery Order unsafe under CC/CCv but safe under CM).
  • number: 3 models: CC, CCv, CM
  • number: 9,815 litmus tests; under 3 min
  • number: Lamport 2,904,225 traces/490 s under CC
  • number: Fibonacci 6,224,342 traces/695–1,796 s
  • limits: Programs are finite-thread deterministic C programs with bounded loops, finite shared variables and atomic reads/writes; local statements are folded into transitions. The method explores terminating executions and detects user assertions, not liveness, memory safety or implementation correctness beyond the modeled semantics. Trace consistency checking can be expensive: SV-COMP examples generate millions of traces and parameterized scaling reaches 13 processes/variables in reported cases.
  • how much was read: most of it read
  • record id: conschecker-2023
• continuous-time decision-tree policy safety (2023)
  • title: Safety Verification of Decision-Tree Policies in Continuous Time
  • what: Introduces the first direct continuous-time reachability algorithm for systems controlled by decision trees. It propagates set enclosures through policy branches and nonlinear ODEs, using Taylor models for dynamics and axis-aligned predicate splitting for the tree, thereby detecting between-sample safety violations. A DTCS samples a tree every control period while applying the selected action continuously. Algorithm 1 queues state sets, postT partitions them among actions, and postf computes interval and endpoint enclosures; Theorem 1 proves termination/soundness and relative completeness under exact post procedures. The implementation uses TaylorModels.jl/JuliaReach and handles fixpoints for unbounded-time results. Even state-independent dynamics f(x,u)=u yield PSPACE-complete bounded-time reach-avoid and undecidable unbounded-time reachability via reductions from LBAs and two-counter machines. Experiments distill trees from neural policies: a depth-10 six-dimensional quadrotor is verified in 6.5 minutes; cart-pole is proved safe forever by a fixpoint; acrobot policies reach goal in about 100–112s; mountain-car reaches its goal within 132 steps in 16s. A generic hybrid-automata tool stalls at bisections, showing the value of exploiting tree structure.
  • number: PSPACE-complete bounded-time and undecidable unbounded-time even for state-independent dynamics
  • number: quadrotor depth 10/177 nodes, 84s table average and 6.5min full verification
  • number: cart-pole 40s finite analysis and infinite-time fixpoint
  • number: mountain-car at most 132 steps, 16s
  • limits: Solutions to ODE initial-value problems are assumed unique; predicates are axis-aligned xi≤c; Taylor-model overapproximations and bisections can accumulate wrapping error. Fixpoint checking is for time-invariant systems and may be hard with general Taylor sets. The proof-of-concept focuses on relatively small trees and simple tasks; nonlinear reachability remains undecidable in general and exactness depends on post procedures.
  • how much was read: most of it read
  • record id: continuous-time-decision-tree-policy-safety-2023
• COOL-MC (2023)
  • title: Generic Model Checking for Modal Fixpoint Logics in COOL-MC
  • what: Presents COOL-MC, a generic model checker parameterized by branching type and modal operators, instantiated for standard, alternating-time, graded, probabilistic and monotone fixpoint logics. The tool translates generic local model checking into parity/evaluation games, supports lazy solving and direct modality evaluation, and reuses backend parity-game solvers. Experiments cover ladder, language-inclusion, Towers-of-Hanoi, modulo, clique and Jurdzinski games, with a brief MCMAS comparison for ATL.
  • number: At least five executions per measurement with a 60-second timeout
  • number: COOL-MC is reported faster than MCMAS on some variants but slower on ATL castle benchmarks
  • limits: The tool’s genericity trades against specialized symbolic optimizations; symbolic coalgebraic model checking remains future work. Experiments average at least five runs with a 60-second timeout, and no direct comparison is made for logics lacking compatible external tools.
  • how much was read: most of it read
  • record id: cool-mc-2023
• CoqCryptoLine: A Verified Model Checker with Certified Results. (2023)
  • what: Coq/MathComp verifies CryptoLine typed semantics, SSA transformation and two verification reductions: algebraic specifications to polynomial root entailment, and range/soundness conditions to quantifier-free bit-vector queries. Extracted OCaml plus validated Singular polynomial witnesses and CoqQFBV certified answers check low-level cryptographic arithmetic models. Separates verified reduction and certificate validation from trusted parsing and manually chosen assert/assume bridges. Describes sound but incomplete algebraic abstraction, complete bit-vector reduction before optional incomplete slicing, polynomial witness normalization/lift optimization and bit-blasting cache. Reports a partially certified largest case rather than silently treating all 54 benchmark specifications as fully certified.
  • limits: §2.1: specification validity is for CryptoLine program executions from states satisfying manually supplied algebraic and range preconditions to postconditions. Model supports signed/unsigned arbitrary-width bit-vectors, explicit carry/borrow, shifts, joins/splits, casts, assert and assume. This does not by itself prove the original assembly/C-to-model translation, memory model, side-channel resistance or cryptographic security. §2.2: parser translates text to formal DSL AST and remains trusted. SSA module establishes preservation of specification validity. Formal semantics/reductions are reported verified in Coq/MathComp; detailed proofs deferred to reference 36/ePrint 2022/1116, not reproduced as theorem derivations in this tool paper. §2.2: polynomial executions correspond only when generated overflow/underflow soundness conditions hold; additional certified bit-vector queries establish these. Algebraic reduction is sound but incomplete because bit-accurate semantics abstracted to integer polynomial equations. Failure of CAS/root entailment need not refute source postcondition. §2.2: bit-vector reduction claimed sound and complete for modeled range specifications, and queries equivalent to algebraic soundness conditions. Optional verified slicing in §2.3 deliberately loses completeness. Formal reduction completeness does not imply practical solver success or guaranteed analysis completion. §2.2/§2.3: untrusted Singular returns coefficients for q=Σci*pi and verified validator checks polynomial identity using norm_subst; sophisticated CAS decisions need not be trusted. CoqQFBV handles bit-vector queries using certificate validation, including Grat SAT-certificate validator verified with Isabelle. §2.2 p.231 explicit trusted computing base: CryptoLine parser, external SAT text interface, Isabelle and Coq. These are authors’ listed components; this paper does not establish a separately verified OCaml compiler/runtime/extraction or source-assembly translation pipeline. §2.3 Mixed Theories: user may assert predicate on one side and assume an equivalent predicate on the other, but equivalence between these is currently unchecked. Certified proof of asserted predicate does not validate an arbitrary assumed translation. End-to-end meaning therefore depends on correct manual equivalences/assumptions as well as formal reductions. §3: preconditions, postconditions and initialization manually supplied; hints also manual. Tool automatically proves annotated assertions rather than requiring user Coq proofs. The claim “fully automatic” concerns verification given the annotated CryptoLine specification, not automatic extraction of intended requirements or sound assumptions. §2.3: extracted OCaml algorithms sequential; independent SMT/root tasks run in parallel. Walkthrough timing uses 24 threads; no statement that every plotted benchmark uses exactly 24 threads. CoqQFBV bit-blasting cache reuses identical program work across atomic range queries. §2.3: signed/mixed-width support, assert/assume and multi-moduli exceed bvCryptoLine subset. Multi-moduli formal proof uses MathComp xchoose to obtain existential integer coefficients; paper does not present this as a practical runtime polynomial-witness search algorithm. CAS lift computes actual ideal-membership witnesses. §4: 54 benchmarks, 52 from four security libraries plus two Kyber NTT versions; 43 use features unavailable in bvCryptoLine. Largest boringSSL x25519_scalar_mult_generic has 4274 statements and ~1.5 h runtime, but footnote explicitly says two out of three modular postcondition equations are certified. Do not count full certification of that specification. §4/Fig.3b: bar labels INT 2.09%, SMT 93.38%, CAS 4.63%; prose SMT 93.28%. Preserve discrepancy; displayed bars sum 100.10%, so do not silently normalize or claim exact partition. Internal verified code is a small fraction of reported runtime. §4: Ubuntu 22.04.1, Intel Xeon Gold 6134M 3.20GHz,1 TB RAM; no repetitions/variance, complete per-case table, exact tool commits or all-thread settings given. Scatterplots support trends, not exact per-benchmark values. Paper’s “acceptable” 1.5 h judgment is author opinion. §4: lift/gbarith comparison is selected 12 root-entailment problems that trigger gbarith, not a whole-tool end-to-end comparison on all 54 examples. Three gbarith cases fail within one hour; lift faster on other nine. Optional slicing generally reduces time; plot does not justify identical speedup for every benchmark. §§1/5: author priority claims about first certified secp256k1 and Kyber NTT verification not independently established here. No current repository/tool execution, proof build or reproduction performed. Network protocol, TLA+ and LLM proof-agent results absent.
  • how much was read: most of it read
  • source
  • record id: coqcryptoline-a-verified-model-2023
• CoqCryptoLine certified algebraic abstraction (2023)
  • title: Certified Verification for Algebraic Abstraction
  • what: Verifies algebraic abstraction for bit-accurate nonlinear arithmetic in Coq and certifies external SAT/algebra results, evaluating CoqCryptoLine on elliptic-curve routines and Kyber number-theoretic transforms. §3 gives TOYLANG bit-vector semantics and a Montgomery-reduction running example. §4 translates SSA instructions to polynomial equations, but explicitly shows why overflow and discarded shift/multiply bits make naive lifting unsound. Instruction-specific QF_BV obligations prove every execution satisfies the polynomial abstraction. Theorem 1 reduces assertion validity to these soundness conditions plus ideal membership, allowing multiple polynomial moduli. The running example replaces a truncated multiply with full multiplication whose high half is discarded, restoring a sound abstraction. §5 proves the abstraction and reductions in Coq, obtains algebraic ideal-membership witnesses from Singular lift and checks their polynomial identity in Coq. Bit-blasting of soundness conditions is verified, Kissat supplies SAT/UNSAT certificates and verified GRATCHK checks them. SSA conversion, slicing, optimized overflow checking and generator-rewriting heuristics are also verified. §6 uses multiple moduli to express the Kyber NTT ring isomorphism naturally and reports a carry-order bug in PQCrypto-SIDH arm64 multiplication.
  • number: 39 benchmark rows; 4 group-operation rows flagged with 1 of 3 postcondition equations failing certification
  • number: Kyber C NTT 6273 instructions, 1113.92s certified vs 46.54s uncertified
  • number: Kyber AVX2 NTT 8975 instructions, 433.31s certified vs 29.63s uncertified
  • number: BoringSSL x86 scalar-mult 3287 instructions, 4454.87s vs 240s, with certification footnote
  • limits: Straight-line SSA register-transfer arithmetic with assumptions and final assertions; TOYLANG presentation uses unsigned width-1/w variables, while the implementation extends to signed operations and further CryptoLine instructions. The main reduction supplies sufficient conditions for polynomial assertions, not a complete decision procedure for arbitrary program correctness. Range analysis for the complete Montgomery algorithm is outside the presented work. Specifications and extraction from real C/assembly into the input language are not certified end-to-end by this paper. Trusted base includes Coq, extraction/runtime infrastructure and the verified checker’s execution environment; external Singular answers are checked rather than trusted. Table 1 footnote marks four group-operation cases where one of three modular postcondition equations fails certification due to stack overflow, qualifying the introductory “39 real-world programs” claim. No cryptographic security, constant-time behavior, concurrent execution or whole-library correctness is proved.
  • how much was read: most of it read
  • record id: coqcryptoline-certified-algebraic-abstraction-2023
• Creusot higher-order iterators (2023)
  • title: Specifying and Verifying Higher-order Rust Iterators.
  • what: Defines a first-order framework for specifying Rust iterators, including nondeterministic, potentially infinite and effectful adapters. Iterators are described by a production relation over sequences; prophetic mutable-value semantics and closure contracts handle mutable borrows and Fn/FnMut callbacks. Creusot translates the contracts to Why3 verification conditions. Sections 3–6 define completed and production predicates, refinement of mutable references, closure pre/postconditions, and Map/MapExt adapters; MapExt carries ghost history for stateful effects. Range, IterMut, Skip, Take, Fuse, Map and MapExt plus clients (counter, decuple_range, hillel, knights_tour) are verified. The production relation intentionally permits underspecification such as hash-table order, requiring client properties to hold for all permitted sequences.
  • number: iterator proofs 0.40–1.06 s
  • number: Map and MapExt 7 manual steps each
  • number: client proofs 0.40–1.15 s
  • number: hillel 0.86 s; knights_tour 1.15 s
  • limits: The framework relies on safe Rust ownership/non-aliasing and first-order Why3 reasoning. Standard Map restricts closure preconditions to history-free ones; MapExt adds ghost state. Several proofs need manual quantifier instantiation or sequence lemmas. Filter, DoubleEndedIterator, ExactSizeIterator, lending iterators and automatic closure-contract inference are future work; this is not a distributed-protocol evaluation.
  • how much was read: most of it read
  • source
  • record id: creusot-higher-order-iterators-2023
• Datapath Propagation IC3 (2023)
  • title: Leveraging Datapath Propagation in IC3 for Hardware Model Checking
  • what: Introduces datapath propagation for datapath-abstraction-based IC3: concrete constant values are propagated to relevant uninterpreted functions and abstraction lemmas are generated to prune spurious counterexamples. The AVRdp prototype integrates propagation into the abstraction/refinement loop and is evaluated on 1,089 deduplicated HWMCC 2019–2020 tasks. It verifies 793 cases versus AVR’s 706, with 1.52x aggregate speedup; on common cases it is 20.40x faster than IC3IA and up to 11.46x faster than Pono mbic3.
  • number: 1,089 deduplicated benchmarks
  • number: AVRdp verifies 793 cases in 37,918.8 s
  • number: AVR verifies 706 cases in 57,483.4 s
  • number: 20.40x faster than IC3IA on 235 jointly verified cases
  • limits: The approach targets bit-level hardware safety verification using datapath abstraction and relies on benchmark formats/tool configurations. Experiments use a 3,600-second timeout and a large 128-core server; gains may depend on the selected benchmarks and competing engine settings.
  • how much was read: most of it read
  • record id: datapath-propagation-ic3-2023
• Dependently Sorted Theorem Proving for Mathematical Foundations (2023)
  • what: DiaToM is a proof-of-concept LCF-style SML prover for classical first-order logic with term-dependent sorts, formula-schema variables and a configurable equality/specification policy. Authors encode ETCS and SEAR and demonstrate proof-producing bounded comprehension translation, quotients and group homomorphisms, natural numbers/integers/lists/co-lists, a simulation-preservation characterization of modal formulas, and a set receiving injections from every finite powerset iterate of any given set. The body explains explicit context tracking for possibly empty dependent sorts, the danger of evaluating arbitrary relations as functions, specification unique up to a chosen equivalence, and proof-producing conversion from external bounded formulas to categorical internal logic. Quotient elimination requires a nonempty witness; co-list heads use option values because carriers may be empty. Concrete modal quantification and powerset-collection statements show what the chosen foundation adds, while a 2,443-line kernel and elementary SML infrastructure give qualitative implementation evidence.
  • limits: Classical first-order ambient logic; sorts s(t0,…,tn) depend on terms of earlier sorts, with each term storing its unique sort. Formula variables encode axiom schemas by instantiation, not ordinary higher-order quantified predicates. Only foundation-approved sorts support equality: no primitive object equality in ETCS or set equality in SEAR. Heterogeneous equality between differently sorted members is not expressible. Theorem Γ,A⊢φ retains all needed variables in Γ, including dependency information, so possibly empty sorts are not silently inhabited. Universal specialization adds free variables of its witness; generalization checks assumptions, sort dependencies and schema-sort lists. Substitution/matching must preserve well-formed dependent sorts; equality transport is deliberately restricted rather than a full dependent type theory. New function symbols require nonemptiness of output sorts plus unique existence modulo an equivalence with reflexivity/symmetry/transitivity proofs. Which equivalences are permitted is a foundational choice. Allowing the universal true relation imports choice. A proof-of-concept LCF architecture is reported; neither kernel implementation correctness nor consistency of newly added axioms is independently established in this paper. Semantic explanation erases sort dependencies into ordinary sorted FOL, adding domain/codomain projection functions and guarded function-symbol axioms. Quantifiers and theorem contexts gain guards. Conservative elimination of formula variables and proof-theory mechanization are reported as separate work not described here; validity of rules is sketched with universal generalization. No completeness theorem, detailed full soundness proof or metatheory artifact evaluation is supplied in this article. ETCS uses object/arrow sorts, choice and bounded internal comprehension; SEAR uses set/member/relation sorts, unrestricted formula-schema comprehension and collection, without choice as a base axiom. A new function subsort ensures Eval only accepts relations already represented as total single-valued functions. The authors call this extension conservative and cite Shulman’s personal agreement; no independent metatheory checked here. SEAR plus choice and restriction to bounded comprehension is compared in strength to ETCS. The unmodified foundations are not ordered by this sentence alone because their choice assumptions differ. The common constructions are shown in SEAR after §4; the text says ETCS analogues work except the all-model modal result and large-set construction, but does not print duplicate developments. Internalization accepts bounded formulas with appropriate element arguments and registered external/internal symbol correspondences. User-defined predicates require manually supplied correspondence theorems. It constructs a predicate arrow and a correctness theorem by derived rules, not an unchecked syntax translation or unrestricted comprehension axiom for ETCS. Quotient construction uses full equivalence relations; partial equivalences first restrict their domain. Defining a total left inverse requires a default point of the source. Empty quotient statements are handled through explicit hypotheses, not HOL’s built-in type nonemptiness. Card of an infinite subset is defined as zero, so Card(s)=0 alone does not characterize the empty subset. Modal theorem is PUS(φ) iff φ is equivalent over all set-carrier Kripke models to a positive existential formula. Quantification over sets supplies what ordinary HOL type variables cannot quantify over directly. The comparison concerns that direct unbounded all-carriers statement, not a claim that HOL cannot encode modal syntax, fixed-carrier results, selected universes or extensions with type quantification. Related work explicitly discusses extended HOL systems. Large-set statement is ∀A ∃P ∀n∈N ∃i:Pow^n(A)→P. Inj(i). It gives a common receiving set, not necessarily the least such set, a literal union of all iterates, or a completed Beth-cardinal development. Selection up to bijection and collection are essential. Minimality/replacement/Beth-cardinal work is future work. Abstract’s V_(ω+ω) comparison is a foundational expressiveness claim under its standard HOL interpretation, not a demonstrated impossibility for every HOL encoding. Printed formulas have local notation defects: §2.3.2’s variable-sort guard uses t_n under index i where t_i is intended; its concluding ∀ step is called elimination instead of introduction. Table1’s first three connective rows omit explicit equality-to-⊤ on their left sides. §8 uses unbound A instead of V in model parameters and f0 instead of φ0 in the final existential. §9’s successor construction writes i(xs) for xs∈Pow(X) although declared i:Pow(B)→Pow(X); intended argument is in Pow(B). These are source display issues, not established artifact errors. Further printed typing slips: §3’s respectful-isomorphism equations have f∘g=Id(B),g∘f=Id(B′) although f:B→B′ and g:B′→B, so identity objects are interchanged. §6 says qhom(N)∈ghom(g,qgrp(g)), where qgrp takes N not g. §5’s product-quotient paragraph labels (a,b)∈Q1×Q2 while they are elements of A×B in its membership equation. Correct intended typings are used for explanation; implementation not inspected. No runtime benchmarks, proof-time comparisons, memory results, automation success rates, user study, distributed protocol verification, Verus/Rust/TLA+ model or LLM agent evaluation. Implementation line counts are reported measurements of source size, not performance evidence. Claims of efficient checking and convenient rewriting are qualitative.
  • how much was read: most of it read
  • source
  • record id: dependently-sorted-theorem-proving-2023
• dFHL safety architectures (2023)
  • title: Formal Verification of Safety Architectures for Automated Driving
  • what: Extends differential Floyd–Hoare logic (dFHL) with assume-guarantee Hoare quintuples and interruption/fallback constructs to prove safety envelopes and graceful degradation in automated-driving controllers. The layered simplex combines a goal-aware RSS controller with a collision-avoiding RSS fallback around a black-box advanced controller. The paper gives trace semantics for nondeterministic hybrid programs with continuous physical dynamics and environment variables, defines α↓A interruption, fallback α on β, and a two-way simplex that switches back to α. Hoare quintuples split a global assumption from a guarantee; strong and weak as-long-as/fallback rules are proved sound, and an interruption-extension discharges the weak case when an assumption fails. In the pull-over model, GA-RSS can stop at the shoulder under constant-speed POV assumptions, while CA-RSS preserves collision avoidance if POV speeds change. Margined switching conditions, counters, or timers prevent infinite controller oscillation. Simulations with a sampling-based planner answer safety, strong goal, and best-effort goal questions, including POV2 braking that interrupts and later returns control to GA-RSS.
  • number: dFHL↓ Hoare quintuples with assumptions and guarantees
  • number: three POVs in the pull-over case
  • number: ε<ε′ conservative margins
  • number: two notable POV2-braking simulations
  • limits: Proofs are conditional on explicit physical/environment assumptions (RSS distance, bounded accelerations, legal speeds, and no rear-end collision responsibility). Strong goal achievement assumes all POVs keep constant speed; when that assumption fails, the weak guarantee preserves safety but may lose the stopping goal. The advanced controller is modeled as a black box constrained only by the switching contract. Termination of a simplex requires a finite switch counter or timer construction. The case study is one pull-over geometry and a prototype planner, so it does not establish broad automated-driving coverage.
  • how much was read: most of it read
  • record id: dfhl-safety-architectures-2023
• Distributed Certification for Classes of Dense Graphs (2023)
  • what: Gives compact one-round local certificates for every fixed vertex-set monadic-second-order property on graphs of fixed bounded clique-width. Reported certificate size is O(log² n) bits per vertex, extending results for sparse tree-like graphs to dense structured graphs. Also states O(log n) certificates for induced-P4-free graphs. Construction distributes a graph-expression decomposition, counts of colors and finite logical states, using tree witnesses to enforce consistent copies. Records exact adversarial-prover quantifiers and fixed-label/width/formula assumptions, NLC graph grammar, why incident-edge checks also need missing-edge counts, disconnected-subgraph consistency obstruction, NLC+ service-tree repair, depth/width tradeoff and large hidden logical constants. Separates main theorem statement, supplied overview and omitted full proofs; identifies printed width and binary-addressing discrepancies without claiming source theorem failure.
  • limits: §2.1, pp.6–7: connected simple n-vertex undirected graph, distinct IDs in [1,n^c] for fixed c>=1, fixed finite vertex-label alphabet {0,…,lambda−1}. Constant-size input labels may mark chosen vertices, colors or solutions. Encoding arbitrary overlay edges as constant vertex labels requires extra structure, such as bounded degree or a distance-two coloring with constant colors; theorem is not for arbitrary growing labels. §§1.1/2.1, pp.2/6–7: untrusted computationally unbounded prover knows entire graph and assigns local bit strings. Every node sends its certificate once to each neighbor, then decides from its own ID/label and all closed-neighborhood certificates. Completeness requires some all-accepting assignment on each legal graph; soundness requires at least one rejection for every assignment on each illegal graph. Node IDs/input labels are fixed trusted inputs, certificates are not. Theorem 1, p.4: for each fixed width bound k and fixed MSO1 formula Pi, all Pi-true graphs of clique-width<=k admit O(log² n) certificates. MSO1 quantifies vertices and sets of vertices and uses adjacency; MSO2 additionally permits edge sets. The theorem does not apply uniformly to arbitrary formulas/k supplied as growing input. The size bound is per vertex on honest accepting certificates, not total communication, prover runtime or verifier execution time. §1.3/Corollary 2, pp.4–5: when a graph family is both definable in MSO1 and bounded in clique-width, decomposition certification plus formula checking yields membership certification. Failure to find an appropriate decomposition rejects. Accepting a larger-width expression does not by itself decide exact clique-width<=k; family formula is still checked. Optimization extensions are asserted for MSO1-definable admissible vertex solutions, without a full separate optimization proof here. §§1.2/3.2, pp.3/9–10: clique-width grammar creates colored vertices, takes disjoint union, adds all edges between distinct chosen colors and recolors. NLC grammar joins specified color pairs across two operand graphs and permits simultaneous recoloring. nlcw(G)<=cw(G)<=2nlcw(G). Expressions represent entire graph edge structure, not just a witness subgraph. §3.3, pp.10–11: each vertex stores root-to-creation path, child choices, operation/recoloring data, exit vertex ID, finite logical class h(x) and a count of each color per expression node. Existing edges must be justified at the relevant lowest common ancestor. Color counts also verify that all edges required by complete color joins exist, preventing false acceptance from certifying a strict supergraph. §3.4, pp.11–12: main message copies must agree across vertices sharing expression ancestors. For connected G[x], certify a spanning tree within G[x] rooted at exit(x), propagating agreement. For disconnected G[x], arbitrary ancestor routing would make unbounded copies; NLC+ restructures unions to arbitrary arity and ensures a disconnected node has a connected parent. §3.4, p.12: disconnected child x uses a Steiner service tree in connected G[parent(x)], covering every G[x] vertex and possibly vertices in sibling G[y]. Each participating vertex gets tree certificate and a copy of the x message. At most two service trees per path level control congestion. This is a supplied high-level argument; full soundness, construction details and simultaneous routing are deferred. §3.5, pp.12–13: finite homomorphism class summarizes the information about the colored subgraph needed by fixed Pi, not merely Pi’s current Boolean truth value. Joining/recoloring determines parent class from child classes and operation; class consistency plus accepting root evaluates formula. Cited linear-time algorithm assumes a decomposition is given, so it does not establish efficient decomposition discovery. §3.6, pp.13–14: main/auxiliary/service fields cost O(log n) per expression level when k/Pi/label alphabet fixed. Depth d gives O(d log n); balancing gives logarithmic depth with exponential width growth, and NLC+ conversion is said not to increase depth. Proceedings states an NLC balancing width k2^(k+1) here and a clique-width decomposition bound k*2^(k−1) earlier, without explaining their relationship. Different upper bounds are not inherently incompatible. §3.6 Remark, p.14: decomposition-only hidden constant is single exponential in original width. Logical-state count can have a tower of exponentials whose height depends on formula quantifiers. Small asymptotic growth in n does not establish practical small certificates or efficient implementation for unrestricted parameters. Theorem 3/§§2.2/3, pp.5/7–8: O(log n) cograph certification is stated, and cotrees introduced, but no complete specialized verifier/proof appears in this proceedings overview. The generic O(log² n) construction alone does not prove the improved bound. Separate arXiv:2307.14292 is explicitly identified as comprehensive version and remains unread here. §4, pp.14–15: generic O(log² n) optimality is open; argument that both logarithmic factors appear natural is not a lower bound. Extending all MSO2 properties is also open, despite easy positive examples such as Hamiltonicity. No experiments, code size, network deployment, fault recovery algorithm, Byzantine consensus, Verus/Rust/TLA+ model or LLM proof evaluation is reported.
  • how much was read: most of it read
  • source
  • record id: distributed-certification-for-classes-2023
• λE higher-order prover (2023)
  • title: Extending a High-Performance Prover to Higher-Order Logic
  • what: Extends the first-order E prover with native full higher-order logic support (λE), adding lambda-term representation, beta/eta normalization, higher-order unification and indexing, pragmatic lambda-superposition, Boolean/extensionality handling and preprocessing. Describes locally nameless De Bruijn term cells with perfect sharing and cached properties, optimized beta/eta normalization, finite incomplete CSU enumeration with fixpoint/pattern oracles and backtracking, higher-order matching and discrimination-tree indexing. λE preserves Ehoh clausification where possible, disables prefix optimization, adds argument congruence and extensionality rules, primitive predicate instantiation, choice/equality/induction handling and abstracting rules. The implementation intentionally sacrifices completeness for speed and gracefulness. Evaluation uses all 2,899 TPTP higher-order theorems and 5,000 Sledgehammer problems, plus 1,138 first-order CASC problems to measure overhead.
  • number: 2,899 TPTP theorems
  • number: 5,000 Sledgehammer problems
  • number: 1,138 first-order problems
  • number: 120s wall/960s CPU TPTP limits
  • limits: Target is monomorphic classical higher-order logic with Hilbert choice. Unification and calculus are incomplete: only finite subsets of potentially infinite CSUs are enumerated, Boolean rules are mostly omitted, and proof search is heuristic. λE trails Zipperposition-coop on TPTP; tuning and formula-level inferences remain future work. Results use fixed time limits and developer schedules, so benchmark counts depend on configurations.
  • how much was read: most of it read
  • source
  • record id: e-higher-order-prover-2023
• Evangelou-Oost contextuality (2023)
  • title: Contextuality in distributed systems
  • what: Defines a lattice of distributed-program specifications as subpresheaves of relative execution traces paired with maximal covers of a finite topological variable space. The lattice order captures refinement and parallelism; associated information algebras define local and global consistency, with global consistency related to sequential consistency. The paper constructs relative traces from nondegenerate simplicial cells of products of variable prosets, proves the trace presheaf is flasque and a tuple system, and derives an ordered adjoint information algebra of relations. It characterizes local consistency by flasqueness and global consistency by an inference/join test. A dining-philosophers specification is locally consistent but globally inconsistent: three singleton traces induce a causal loop in chopstick acquisitions. Isabelle/HOL formalizes several constructions and proofs, while an explicit local-computation reformulation reduces join cost by projecting pairwise overlaps.
  • number: finite variable space
  • number: nine information-algebra axioms (I1–I9)
  • number: three-philosopher illustrative context
  • number: two consistency criteria: local and global
  • limits: The presentation assumes a finite variable set and nonempty per-variable prosets; finiteness simplifies the topology and lattice arguments. Relative traces preserve ordering but intentionally discard absolute timing, so the model does not represent synchronized clocks. Global-consistency computation is generally exponential in variables; the dining-philosophers demonstration omits detailed arithmetic of the final inconsistency. The work is mathematical and does not report measurements on deployed distributed systems.
  • how much was read: most of it read
  • record id: evangelou-oost-contextuality-2023
• Event-DPOR event-driven stateless model checking (2023)
  • title: Tailoring Stateless Model Checking for Event-Driven Multi-Threaded Programs
  • what: Introduces Event-DPOR, a dynamic partial-order-reduction algorithm for stateless model checking event-driven multithreaded programs whose handlers process mailbox messages in arbitrary order. The paper defines a finite-thread/shared-variable model with handler mailboxes, happens-before traces and trace equivalence. Event-DPOR extends Optimal-DPOR using happens-before prefixes, weak initials, wakeup trees, parked wakeup sequences and race reversal that can reorder serialized messages. Weak-initial redundancy checking is proved NP-hard; the implementation uses a sequence of inexpensive incomplete tests and a final decision procedure. Correctness proves at least one maximal execution per equivalence class; optimality proves exactly one for non-branching programs. The Nidhugg implementation stores vector clocks and handles first-conflict reversals. Benchmarks compare Event-DPOR with Optimal-DPOR, GenMC DPOR and LAPOR on posters, buyers, ping-pong, consensus, prolific, sparse-mat and plb programs.
  • number: Theorem 2 correctness: every maximal execution equivalence class is represented
  • number: Theorem 3 optimality for non-branching programs
  • number: posters(5): 113400 traces; Event-DPOR 84.64 s versus Optimal-DPOR 50.87 s
  • number: prolific(9): Event-DPOR 510 traces and 26.28 s versus Optimal-DPOR 362880 traces and 1363.31 s
  • limits: Programs terminate, have deterministic bounded code, finite threads/variables and unbounded mailboxes; handlers choose messages in arbitrary order and execution uses sequential consistency. Optimality is restricted to non-branching messages whose access sequence is interleaving-independent; correctness does not imply optimality for branching programs. Weak-initial checks are NP-hard in general, although the heuristic checks sufficed in tested benchmarks. The approach does not cover FIFO handlers or non-terminating systems; authors list FIFO and other execution models as future work.
  • how much was read: most of it read
  • record id: event-dpor-event-driven-stateless-model-checking-2023
• exact ReLU NCBF verification (2023)
  • title: Exact Verification of ReLU Neural Control Barrier Functions
  • what: Derives necessary and sufficient safety conditions for feedforward ReLU neural control barrier functions and an exact verifier for continuous-time nonlinear systems. Because ReLU NCBFs are nondifferentiable at activation boundaries, the paper uses a generalized Nagumo theorem and Clarke tangent cones. Lemma 2 gives sign-consistency constraints for each activation set; Proposition 1 combines boundary/intersection conditions with safe-set containment. The verifier discretizes state space, uses LiRPA and IBP to enumerate boundary activation sets, prunes impossible sets, and solves nonlinear programs for interiors and intersections. The resulting theorem is sound and complete for the stated model. Experiments cover Darboux, obstacle avoidance, spacecraft rendezvous, and an eight-dimensional system, comparing runtime with dReal and Z3.
  • number: ReLU networks up to 1024 neurons in a hidden layer (Darboux table)
  • number: example proposed runtime 0.43–108.44 s for 13–548 activation sets
  • number: SMT baselines often >3 h
  • number: Theorem 2 combines Lemmas 3 and 4 for global verification
  • limits: The dynamics are continuous-time and the admissible control set is polyhedral; exactness is for the feedforward ReLU model and the stated smooth dynamics. Enumeration and nonlinear programs can scale poorly with dimensions, activation sets, and depth. Experiments are numerical case studies on one workstation, not deployed control systems. Future work calls for higher-dimensional/deeper networks and other activations.
  • how much was read: most of it read
  • record id: exact-relu-ncbf-verification-2023
• Fast, Verified Computation for Candle (2023)
  • what: Adds a verified fast computation primitive to the Candle HOL prover kernel. Translates a restricted HOL term to a computation-specific representation,interprets it with native arbitrary-precision arithmetic,and returns a HOL equality theorem. HOL4 proofs show every successful result has a derivation from HOL inference rules;Version4 is integrated into Candle’s existing end-to-end soundness proof. Develops four implemented stages from verified numeral addition to a first-order recursive code-equation interpreter,then compiles its IR to de Bruijn local variables,indexed code vectors and environment-based execution. Establishes soundness through inverse translations to HOL,checked characteristic equations and user-supplied theorem objects,rather than replaying millions of primitive kernel rewrites at runtime. Benchmarks both arithmetic and structural workloads against in-logic evaluators.
  • limits: Soundness theorem assumes the current Candle theory supplies the characteristic equations for arithmetic and compute primitives. Kernel checks user-supplied theorem objects on each call;names alone are insufficient because the user could define constants differently. Context-relative derivability is the guarantee,not unrestricted truth of arbitrary code equations. Code equations must be Candle theorems for fully applied user constants,with cval arguments/results and RHS free variables among formal parameters;every RHS user-defined constant needs an equation. Translation sanity checks reject unsupported input. No arbitrary higher-order HOL/datatype evaluation is supported. Compute values are Lisp-like trees Pairc/Numc. The advertised untyped computation is inside this single HOL datatype,not a change to the HOL type system. Numeric operations treat pairs as0;pair projections of numbers returnNum0;onlyNum0is false. These defined semantics may differ from an external program’s intended error behavior. Recursive evaluation has fuel,initialized to maximum smallnum. App and Let decrease fuel;exhaustion givesNone in logic and an ML exception in generated code. A successful result yields an equality;the system does not prove every user-supplied recursive computation terminates or fits memory/time. CakeML code is synthesized from HOL4 functions and integrated into prior Candle soundness machinery. This paper adds compute correctness and reports integration with the existing end-to-end proof;it does not restate that proof’s detailed target-machine premises or independently re-prove all dependencies. It also does not establish fidelity to a human’s intended statement. Computation soundness is proved existentially:a HOL derivation exists. Candle performs no runtime proof recording;the returned theorem object is protected by the verified kernel,not accompanied here by a recorded primitive-inference derivation for an independent unmodified HOL checker. Version4is the benchmarked/integrated implementation. Version5staged setup/caching is explicitly not implemented. Versions1–4recheck characteristic equations and compile code equations on every call,so fixed overhead remains even for1+2. Benchmark scope is four selected computable first-order workloads on one machine and selected in-logic evaluators. Isabelle’s faster code-generation/NBE alternatives are discussed with larger unverified execution dependencies but not benchmarked. No overall theorem-prover,proof-search,Lean/Coq or LLM-agent speed ranking follows.
  • how much was read: most of it read
  • source
  • record id: fast-verified-computation-for-2023
• Finkbeiner Passing delay-dominance (2023)
  • title: Synthesizing Dominant Strategies for Liveness (Full Version)
  • what: Introduces delay-dominance, a strategy relation that compares unmatched progress failures against alternatives, to make best-effort synthesis compositional for many safety and liveness specifications. It defines a delay-dominance game, proves compositionality under an automaton bad-prefix criterion, and gives a universal co-Buchi automaton for synthesis. The paper formalizes the game where Spoiler chooses alternative-automaton branches first and Duplicator responds on the candidate strategy, proving self-dominance and that delay-dominant implies remorsefree dominant. It identifies existence of bad prefixes as the condition allowing blame of one component after composition, proves composition and winningness for realizable specifications, and constructs the recognizer by combining ACAs for phi and not-phi, Miyano-Hayashi conversion, and universal projection over alternative outputs. The resulting automaton has O(2^{|phi|^2}) states and bounded synthesis remains 2EXPTIME. Examples show immediate-send versus wait-for-peer strategies and mixed existential/universal ACA choices.
  • number: ACA size O(|phi|)
  • number: delay-dominance UCA size O(2^{|phi|^2})
  • number: synthesis in 2EXPTIME
  • number: parallel composition winning when phi realizable and bad-prefix criterion holds
  • limits: LTL specifications are represented by an ACA; delay-dominance depends on the chosen ACA structure, so a realizable formula may have no delay-dominant strategy. Composition requires the ACA to ensure bad prefixes; the authors state this is common for standard translations but leave parts marked TODO and give no implementation benchmark. Distributed architectures use Moore process strategies and standard bounded synthesis; complexity is worst-case 2EXPTIME.
  • how much was read: most of it read
  • record id: finkbeiner-passing-delay-dominance-2023
• First-Order Model Checking on Monadically Stable Graph Classes (2023)
  • what: Establishes fixed-parameter first-order model checking on every monadically stable graph class and proves monadic stability is the tractability boundary for hereditary edge-stable classes. The tractability proof first establishes almost-linear neighborhood complexity: for every ε, the number of distinct closed-neighborhood traces on a parameter set A is O(|A|^{1+ε}). A reduction using branching index, sampling and nowhere-dense machinery yields this bound. Welzl’s low-crossing-number order then gives distance-r neighborhood covers of constant diameter and subpolynomial overlap via a greedy compact-interval partition; the cover can be computed in O(n^{4+ε}). Substituting it into the Flipper-game model-checking framework improves the overall bound to O_{C,ε,φ}(n^{5+ε}). For hardness, Ramsey refinement and k-flips characterize non-stability by induced subdivided cliques or webs. Careful existential “deobfuscation” yields effective interpretations of all graphs, giving AW[*]-hard FO model checking, W[1]-hard existential FO model checking, and W[1]-hard induced-subgraph isomorphism under Turing reductions.
  • number: Theorem 1 gives O_{C,ε,φ}(n^{5+ε}) model checking; neighborhood-cover construction is O_{C,r,ε}(n^{4+ε}).
  • number: Theorem 3 gives O_{C,ε}(|A|^{1+ε}) neighborhood complexity for every ε>0.
  • number: Theorem 2 gives AW[*]-hard FO, W[1]-hard existential FO, and W[1]-hard induced-subgraph isomorphism for hereditary edge-stable non-monadically-stable classes.
  • limits: The positive result assumes a fixed monadically stable graph class C and ε>0, with class-dependent constants; the hardness result assumes heredity and edge-stability. The construction handles neighborhood formulas on vertex pairs, not the stronger tuple-type bounds left as Conjecture 3. The general monadically NIP tractability conjecture remains open because suitable Flipper/decomposition machinery is unknown; the authors also state the theorem does not settle tuple neighborhoods. Hardness transfers through polynomial effective interpretations and parameterized reductions, not through an implementation benchmark. The algorithm’s n^{5+ε} bound is asymptotic and can hide large class/formula constants.
  • how much was read: most of it read
  • record id: first-order-model-checking-2023
• Formal Methods for Network Performance Analysis (2023)
  • what: FPerf manually models queues, packet processing and bounded interactions in SMT, then synthesizes compact workload predicates for which every permitted trace satisfies a user-specified performance-problem query. A stochastic syntax-guided search uses good/bad example traces to guide candidates, while independent SMT feasibility and counterexample checks establish each accepted workload’s bounded model-level guarantee. Case studies expose scheduler starvation/fairness, host/NIC policy-composition effects, and ECMP contention/queue buildup in a small leaf-spine network. Runtime and model-size results measure tractability; there is no unbounded correctness or implementation-refinement theorem. Preserves non-vacuity checks, distinction between sampled search guidance and universal bounded checking, FIFO/metadata and immediate-composition semantics, MCMC cost/mutations/optimizations, exact six-case statistics, concrete scheduling/ECMP witnesses, timing/packet-size/model limits and several printed formula/prose discrepancies.
  • limits: §2.1/§3/§9: Algorithms are manually encoded into logical formulas; users supply topology, processing rules, metrics and query assumptions. Models start with empty queues and initial module state, run for bounded T dequeue-based time steps, finite queue capacity S and at most K incoming packets per step. Exhaustiveness concerns valid traces inside those bounds and that model, not real implementations, arbitrary initial states, unrestricted packet arrivals or unbounded time. §3: Time step is interval between dequeues of slowest output queue; packet order within each step is explicit. Queue variables enqs[t][1:K], elems[t][1:S], deq_cnt[t] constrained as FIFO. Modules may process/drop/clone/modify tuples when expressible in SMT; reliable symbolic model semantics do not establish hardware timing fidelity. Packet sizes, bit-rate and byte-fairness are absent from prototype despite metadata framework permitting extension. §3/§7.3: Sequential composition exposes dequeued packets downstream at next step; immediate composition exposes them within same step. Comp case uses equal-length paths so authors argue relative arrival order preserved while reducing needed horizon15→10. This is a case-specific timing abstraction, not universal equivalence for arbitrary unequal paths or end-to-end wall-clock latency. §4–5: Query combines base workload with temporal comparison on metrics for queues; query may use universal or existential bounded time. Synthesized workload is conjunction of interval constraints on external input queues only, using cumulative enqueues and arrival inter-packet gap, later extended with destination/ECMP. It denotes sufficient traffic conditions for a performance query, not all bad traffic, a probability of occurrence or a globally minimal explanation. §6.1: Candidate accepted only if model∧base_wl∧wl is satisfiable and model∧base_wl∧wl∧¬qry is unsatisfiable. The first check prevents empty/inconsistent workload from vacuously proving query. Base workload checked for feasibility before search. Result depends on correct encoding and SMT solver; no independently checked proof certificate or verified C++ implementation is reported. §6.2–6.4: MCMC-like search starts true, adds/removes/modifies constraints, sometimes accepts higher cost with exponential probability to escape minima. Examples guide search only; verifier checks every accepted answer. No completeness, termination-time or globally optimal-workload theorem. A workload that matches bad examples may be visited but cannot be returned as verified answer. §6.3/AppendixB: costE=number matched bad examples minus number matched good examples. costS sums number of queues in each constraint plus number of distinct nonoverlapping intervals with different active constraints; lower score favors concise less-fragmented descriptions. Weighted total CEcostE+CScostS withCE/CS=10 in experiments. Example counts are heuristic guidance, not measured production frequency or generalization probability. §6.4–6.5/AppendixC: Good examples cluster around Max-SMT base trace and keep its idle inputs idle; temporary zero-traffic base constraints narrow search then may be removed during verification-based shrinking. Diversity uses P random changed entries, decremented after failed retries; good traces minimize distance to base. Search skips known bad/infeasible candidates, detects equivalent workloads, may select among low-cost mutation set, adds replace mutation/backtracks on infeasibility, looks ahead/restarts on low progress. These guide tractability without establishing coverage of all explanations. §6.4 printed discrepancies: Bad-example distinctness formula contains negation of disjunction of inequalities, which enforces equality to prior traces rather than stated difference. First base-trace objective says minimize active queues but defines indicator1when queue has zero total traffic, which would minimize idle queues instead. Record intended prose and flag formulas; do not silently treat displayed equations as a verified algorithm or infer corresponding repository bugs without inspecting code. §2/§7.1: FQ-CoDel case is deliberately buggy scheduler inspired by FQ-CoDel and bug already warned about by RFC8290, not discovery of new Linux bug. Assumes rare hash collisions/oneflowperqueue, omits full CoDel behavior and models scheduling rather than measured Linux implementation. Emptynewqueue immediate deactivation lets it regain priority each arrival; RFC remedy moves empty new queue to old before deactivation. §7.1: Priority/RR examples expose bounded queue-selection behavior, not byte fairness. RR unsatisfiability is for T10/current bounds and stated sustained-arrival assumptions. Relaxed arrivals have cumulative lower bounds4at5 and8at10; prose calls rates equal, but constraints do not impose identical exact input rates. Sparse/bursty counterexample demonstrates temporal share imbalance, not necessarily long-run unfairness. §7.2: Comp reproduces qualitative problem from Loom[44] using symbolic4core host/NIC classification/RR/priority/demux model. Spark/memcached names identify modeled traffic classes; this paper does not run those applications or validate generated traces against a NIC. Per-core fairness and final memcached priority need not compose into global tenant fairness. §8/AppendixD: Leaf-spine uses input-queued switches with per-input virtual output queues, iSLIP matching, ECMP routing, no oversubscription. Each P-port switch is P forwarding modules plus crossbar; metadata dst/ecmp encoded. All packets entering a given queue at a given step share dst/ecmp, with extra smoothing to avoid arbitrary flow switching. This restricts packet-level workload space and should be explicit in any claim of exhaustiveness. §8 printed LS-T base workload contains dst(In1)=6 and distinct destinations but no minimum input-rate constraint, although prose says it ensures at least1packet/step. The reported interpretation therefore needs the prose’s intended rate assumption, not displayed formula alone. LS-L returned workload prints ecmp(In5)=6 even though topology has2spines and stated ecmp domain[0,S]; surrounding prose says host5sends tohost6, suggesting dst label typo. Preserve discrepancy instead of reporting literal formula as a feasible certificate. §8 LS-L query uses sum of queue sizes along a path≥10 at t10 as proxy for delay beyond baseline3steps; not direct tracking/proof that a particular packet takes13steps in a real switch. Contention and path-queue buildup interpretation is model-level. Host1ownarrival upperbound≤line-rate prevents trivial self-flooding; cross traffic causes contention. AppendixA: FIFO encoding explained by temporary validity after dequeues, sliding enqueue window, boundary/full-queue cases and no-hole constraints. Displayed no-hole clause uses val_elem[t][t] under quantifier i, rather than expected adjacent position; several names/time indices also vary (tmp_valid/tmp_val, elem/elems). Paper gives encoding design sketch with omitted standard/boundary constraints, no formal soundness proof. Do not infer source implementation is wrong from typography alone. §7.3/§8/§9: Runtimes from10runs on4socket XeonGold6128/3.4GHz/6cores each. Sixmaincases at7–14steps; average workload verification .02–.94s, average query verification up to1.66s; Compworstquery9.90s. Larger scaling uses25examples instead of50 and extra reduction/movingaverage optimizations. Largest4spine4leaf16host model takes224min, so headline minutes and subsecond checks do not extend to all evaluated sizes. §9–10: Repeatable patterns suggest potential persistent issues but unbounded-time reasoning, reachable initial states, packet sizes, congestion-control feedback closure and injecting concrete generated packets into real networks are future work. RL agents mentioned in relatedwork are adversarial-trace agents, not LLM proof/specification agents. No Verus/verified Rust/TLA+ application, automated code extraction or verified network implementation is reported. Artifact repository cited; not executed here.
  • how much was read: most of it read
  • source
  • record id: formal-methods-for-network-2023
• Formal RSS Intersection Safety (2023)
  • title: Formal Verification of Intersection Safety for Automated Driving
  • what: Extends differential Floyd–Hoare logic with hybrid control-flow graphs (hCFGs) and Hoare annotations for compositional multi-vehicle intersection models. A backward synthesis algorithm computes an RSS condition for a specified proper response and proves collision safety under that condition. hCFG networks synchronize separately modeled vehicles, translate to hybrid programs, and use acyclic backward annotation synthesis with closed-form ODE solutions. The implementation checks assertion validity with Z3 and solves ODEs with Mathematica. A user-provided disjunction assists synthesis in the case study; fully automatic assertion synthesis is left open.
  • number: approximately 1K Haskell lines
  • number: 23,328 simulations
  • number: 2,916 initial instances × 8 POV behaviors
  • number: 2,296 RSS-compliant and experimentally safe
  • limits: The formal guarantee assumes every vehicle and other traffic participant complies with RSS rules, and the case study fixes a max-braking response and parameterized point-vehicle dynamics. The hCFG used by the algorithm is acyclic and compatibility conditions require nonconflicting flows/assignments. An RSS-noncomplying instance can still be safe under another proper response; only one intersection scenario and one response are evaluated.
  • how much was read: most of it read
  • record id: formal-rss-intersection-safety-2023
• Formal Verification Of A Shopping Basket Application Model Using PRISM (2023)
  • what: Builds a 14-state discrete-time Markov chain for an online shopping-basket workflow and checks reachability/probability properties in PRISM. Translates an audit-trail process scenario into explicit DTMC transitions for browsing, login, selection, add/remove, checkout, authentication and logout. It states ten PCTL-style properties, reports PRISM satisfaction counts and numerical probabilities, and includes the complete model code. The case demonstrates basic probabilistic model checking rather than a new verification algorithm.
  • number: P1, P2, P3 and P4 are reported true at the initial/filter states
  • number: P5 (buy after deleting) is false
  • number: P6 start-checkout probability 0.4347821160949293; P7 erroneous-authentication probability 0.3999999999966359
  • number: P8 eventual logout 1.0; P10 deletion probability 0.666666030883789
  • limits: The workflow is a finite, memoryless DTMC with hand-set transition probabilities; it abstracts away concurrency, data values, failures and implementation details. Several properties use filter syntax and are interpreted as course-case requirements. Results are simulation/model-checking outputs for this toy model and do not establish correctness of a real shopping service.
  • how much was read: most of it read
  • record id: formal-verification-of-a-2023
• Formalizing Results on Directed Sets in Isabelle/HOL (Proof Pearl) (2023)
  • what: Reports Isabelle/HOL proofs of Iwamura’s directed-set decomposition, equivalence of directed completeness and nonempty well-related completeness, and equivalence of Scott continuity and preservation of nonempty well-related suprema. Uses cardinal-indexed well-orders on the original carrier instead of a universal ordinal type. Generalizes from partial orders to quasi-orders and removes all codomain order/completeness assumptions in the continuity theorem. The uncountable construction closes each strict prefix under chosen finite upper bounds by countable iteration, bounding its size by the larger of the prefix size and countable infinity. Countably infinite carriers require a different finite-stage sequence; an inverse order isomorphism reconciles its natural-number index with the carrier index. Cardinal induction chooses possibly nonunique suprema of smaller directed sets, turns their monotone image into a well-related set, and transfers its supremum back to the original directed set. A strengthened simultaneous induction proves continuity for every possible supremum without assuming transitivity in the codomain.
  • limits: Directed means every finite subset, including the empty subset, has an upper bound in the carrier. Thus directed sets are nonempty. The familiar nonempty plus pairwise-upper-bound definition needs transitivity for equivalence. Iwamura’s theorem assumes reflexivity and an infinite directed carrier but does not assume transitivity; completeness and continuity equivalences assume a quasi-order, meaning reflexivity and transitivity, without antisymmetry. A well-related set is one whose every nonempty subset has a least element. This implies reflexivity but is defined without assuming transitivity or antisymmetry. A pre-well-order additionally assumes a quasi-order. In the main theorem’s quasi-ordered ambient carrier, well-related subsets inherit transitivity. Nonempty qualifiers exclude a requirement for a least element/bottom arising from an empty supremum. Choice is used to select a least-cardinality well-order of the carrier and a bound f(X) for each finite X using SOME. Later it selects a supremum for each smaller directed set. This last selection cannot use unique choice because removing antisymmetry makes suprema potentially nonunique. More constructive proof organization does not mean a choice-free or computational construction. Isabelle/HOL cannot collect arbitrarily large ordinals of every type into one ordinal type. The workaround represents an ordinal by a well-order relation and uses cardinal-library comparisons across types. The index order on A is the particular least well-order representing |A|; it is different from the original relation whose directedness is being studied. Locales permit both relations, unlike fixing one order per type through a type class. For the least well-order, every strict prefix A_prec(a) has strictly smaller cardinality. Leastness is essential: an arbitrary well-order may have a strict prefix as large as the whole carrier. An infinite least-cardinality well-order has no greatest element, since deleting one point preserves infinite cardinality. Therefore the union of all strict prefixes equals A. That equality fails for nonempty finite carriers, which are handled separately. Uncountable case: F(X)=X union {f(Y):Y is a finite subset of X}; F^omega(X) is the union of its finite iterates. Any finite set in this union is contained in one common stage, so its chosen upper bound is in the next stage. This argument needs no transitivity. F and its closure are monotone; closure stays within A and includes X. Cardinality control splits finite and infinite prefixes. A finite starting set has finite stages and at most countable closure, which is still smaller than uncountable A. For infinite X, finite subsets have the same cardinality as X, each iterate preserves that cardinality, and a countable union has size at most |X|. The proof uses existing cardinal-library lemmas; it does not assume that the original uncountable cardinal is regular. Countably infinite case: choose order isomorphism seq from natural numbers to the least well-order on A. Seq(0)={f(empty)} and Seq(n+1)=Seq(n) union {seq(n),f(Seq(n) union {seq(n)})}. Every stage is finite and directed because the added bound also bounds itself by reflexivity. This avoids countable closure becoming as large as the entire countable carrier. Compose Seq with inverse(seq) to obtain the same A-to-subsets type as the uncountable construction. Final Iwamura family is piecewise in the cardinality case; every I(a) is directed, smaller than A, nested in the chosen index order, and its union covers A. Proof locales collect definitions under directedness and are interpreted in the final theorem’s reflexive context. The printed mono_uncountable lemma uses domain D where surrounding construction uses A; the record does not infer an error in the AFP theorem from that local presentation. Reverse completeness direction: every nonempty finite subset of a well-related set has a greatest element, proved by removing a least element and inducting on finite size. This proves directedness even without transitivity. Forward direction uses cardinal induction on directed D. A finite D has a greatest element by directedness; an infinite D is decomposed by Iwamura and each smaller I(d) receives an inductively obtained supremum s(d). Monotonicity of I and of taking suprema makes s monotone from the chosen well-order on D to the original relation. A monotone image of a well-related set is well-related even without injectivity. Completeness supplies a supremum x of s(D). Covering D by I(d) and ambient transitivity shows x bounds D; any bound of D bounds each I(d), hence s(D), so x is least among bounds of D. C-continuity includes f(A) subset B and preservation of every existing supremum for each nonempty C-subset. It does not require preserving empty suprema. Under a reflexive domain and class C containing every related pair {i,j}, this property implies monotonicity. Well-related sets meet that condition, without requiring codomain reflexivity or transitivity. The continuity equivalence assumes only a quasi-ordered, nonempty-well-related-complete domain. The codomain is an arbitrary carrier and binary relation, with no reflexivity, transitivity, antisymmetry or completeness assumptions. The proof establishes completeness and preservation simultaneously by cardinal induction. It does not compose codomain inequalities through an unstated transitivity assumption. For continuity, a supplied supremum x of D may differ from the one constructed through the well-related set C. Domain transitivity proves the supplied x also is a supremum of C, so preservation applies to f(x) itself. A bound b of f(D) bounds each f(I(d)); the induction hypothesis gives f(s(d)) related to b. Thus b bounds f(C), and the least-bound property of f(x) completes the proof without codomain transitivity. Authors report 726 Isabelle lines in AFP entry Directed_Sets, plus refactoring of Complete_Non_Orders with new Continuity.thy and Directedness.thy totaling 427 lines. These counts describe different development scopes; they are not runtime or proof-success measurements. The article reports machine formalization but no build log, tactic-time statistics, independent replication, empirical benchmark or proof-agent evaluation. AFP and cited prior developments were not opened or rebuilt in this reading. The paper motivates directed sets through nets in topology, fixed-point semantics for loops and ideals in reachability/coverability of well-structured transition systems such as Petri nets. These are motivating applications, not a verified protocol, Rust implementation, Verus/TLA+ specification or applied model checker delivered here. It contains no LLM-assisted proof experiment.
  • how much was read: most of it read
  • source
  • record id: formalizing-results-on-directed-2023
• FuzzBtor2 (2023)
  • title: FuzzBtor2: A Random Generator of Word-Level Model Checking Problems in Btor2 Format
  • what: Provides a self-contained C++11 fuzzer that recursively generates random QF_ABV transition systems and safety properties as Btor2 files, with controls for state/input counts, arrays, constraints, bad properties, tree depth, and candidate widths. Tests expose bugs in AVR and Pono.
  • number: 200 calls; 100 BV and 98 ABV cases, 2 ABV generation failures
  • number: 22–58 lines, 39.2-line average; all passed catbtor
  • number: AVR: 16 safe, 24 unsafe, 22 uniquely solved, 157 errors, 1 timeout
  • number: Pono: 44 safe, 27 unsafe, 53 uniquely solved, 127 errors, 0 timeouts
  • limits: The target is Btor2’s quantifier-free bit-vector-with-arrays theory; users choose a set/range of widths rather than an exact sort. Random generation is probabilistic and may fail for some parameters. Output/fair/justice keywords and liveness/fairness are unsupported. The evaluation uses small 22–58-line files and one-hour checker timeouts, establishing bug-finding value rather than broad performance.
  • how much was read: most of it read
  • record id: fuzzbtor2-2023
• Geometric-logic LTL streams (2023)
  • title: Liveness Properties in Geometric Logic for Domain-Theoretic Streams
  • what: Defines LTL over the algebraic cpo of partially defined streams JStrAK and studies formula denotations through Scott topology, sobriety, frames and geometric logic. Negation-free LTL formulas translate inductively to geometric theories whose models are exactly the denotations; the paper applies the translation to prove a liveness specification for the non-productive stream filter function. The stream domain is DCPO[N,JAK] with a pointwise flat order, so finite-support streams are compact approximants and total streams are their directed suprema. The authors prove negation-free denotations are upward-closed and induce sober subspaces, while negation can destroy sobriety (e.g., J¬□aK excludes aω). They stratify negation-free LTL into G, Gδ and full fragments, define geometric-formula operators for next/until/weak-until, and prove model equivalence (Theorem 3). A frame/deduction treatment establishes spatiality for countable theories and gives complete deduction for Gδ formulas. For filter, ordinary fixpoint induction fails because the bottom function does not satisfy total-output liveness; finite-occurrence formulas ψn,k and output approximants φk yield Lemma 13 and prove that infinitely many predicate-satisfying input elements imply a total filtered stream.
  • number: Theorem 3: model equivalence for every negation-free LTL formula
  • number: Corollary 3: every negation-free denotation is a sober subspace
  • number: Corollary 5: countable geometric theories yield spatial frames
  • number: filter proof uses finite n,k approximants and Lemma 13, not experiments
  • limits: The semantic development assumes a set A (finite for the filter theorem), flat Bool and a Scott-continuous predicate p that is defined on every a∈A. Results concern denotational stream semantics, not an implemented language or distributed protocol. Negation-free formulas are the main tractable fragment; arbitrary negation and Fσ cases may lack a geometric-theory model presentation. Decidability and refinement-type automation are left open, and the filter proof handles a single recursively defined function/specification.
  • how much was read: most of it read
  • source
  • record id: geometric-logic-ltl-streams-2023
• Grassroots distributed systems (2023)
  • title: Brief Announcement: Grassroots Distributed Systems: Concept, Examples, Implementation and Applications
  • what: Formalizes grassroots distributed systems with multiagent transition systems; presents blocklace-based Cordial Dissemination protocol, safety/liveness/grassroots propositions, pseudocode, mobile UDP adaptation, and applications. Defines strict behavior inclusion for grassroots; states an asynchronous interactive non-interfering sufficient condition; specifies Create/Follow, Cordially-Send, Receive transitions; states self-closed safety and friendship-path liveness; gives address-hopping probability estimates.
  • number: friend hopping together probability around 10^-7 under stated timing assumptions
  • number: clique simultaneous hopping loss around 10^-3.6*n
  • number: Proposition 4 liveness and Proposition 5 grassroots
  • limits: Potentially infinite agent universe but each considered subset finite; unique self-chosen key pair per agent; asynchronous model assumes every sent message eventually received and agents create/send often for liveness. Cryptographic hash cycles computationally infeasible. No implementation measurements; mobile UDP discussion is an engineering argument and full protocol details are in cited full paper. Theorem 3 and Propositions 4–5 are stated here; full formal definitions and proof details are deferred to the full paper.
  • how much was read: most of it read
  • record id: grassroots-distributed-systems-2023
• Henzinger Mazzocchi Sarac quantitative safety liveness (2023)
  • title: Quantitative Safety and Liveness
  • what: Generalizes safety, liveness, the safety-progress hierarchy, and safety-liveness decomposition from Boolean properties to quantitative trace properties over complete lattices. It defines quantitative safety/liveness by finite-prefix rejection of threshold hypotheses, proves closure/decomposition theorems, and derives finite-state approximate monitors for properties that are approximately safe and co-safe. The paper introduces quantitative properties Φ:Σ^ω→D over complete lattices, quantitative safety via finite witnesses for wrong lower-bound hypotheses, and the safety closure Φ*(f)=inf_{s≺f} sup_g Φ(sg). It proves safety iff upper semicontinuity iff equality with safety closure, safety iff inf-property, co-safety iff sup-property, and characterizes lim-inf/lim-sup levels. New liveness and co-liveness definitions are shown to generalize Boolean liveness; every property decomposes as min(Φ*,Ψ) with Ψ live, and as the minimum of two live properties. Approximate α-safety/β-co-safety are characterized by closure gaps; for real-valued limit properties these imply suffix influence eventually falls below any δ>α+β, yielding a finite-state (δ,δ)-monitor. Examples include minimal/maximal/average response times and discounted safety.
  • number: complete-lattice value domain
  • number: safety/liveness decomposition for every property
  • number: approximation threshold δ>α+β
  • number: monitor with at most 2|Sδ| equivalence classes
  • limits: The core definitions assume a nontrivial complete lattice; finite-state monitoring Theorem 59 additionally assumes a limit property with finite real values, finite observation alphabet, and finite α/β error bounds. Quantitative liveness is intentionally stricter than prior multi-live or verdict-live notions, and the paper proves strict separations. The results are semantic and monitor-construction theorems rather than implementation benchmarks; applications to distributed systems require choosing an appropriate trace domain and quantitative metric. Limit-property converse results are left as conjectural/partial in places (e.g., the full converse of the countable-supremum characterization for lim-inf properties).
  • how much was read: most of it read
  • record id: henzinger-mazzocchi-sarac-quantitative-safety-liveness-2023
• HyperLTL Loop BMC (2023)
  • title: Efficient Loop Conditions for Bounded Model Checking Hyperproperties
  • what: Develops complete automata- and simulation-based loop conditions for bounded model checking HyperLTL with up to one quantifier alternation. Prototype Z3py experiments assess short-loop exploitation and completeness; bounded simulation is NP-complete.
  • number: HyperLTL alternation
  • number: automata-based completeness
  • number: simulation-based SAT queries
  • limits: Prior approaches lacked looping; automata bounds can be doubly exponential and experiments are limited to studied case families.
  • how much was read: most of it read
  • record id: hyperltl-loop-bmc-2023
• HyperTSL(T) automata checking (2023)
  • title: Automata-Based Software Model Checking of Hyperproperties
  • what: Defines HyperTSL(T), extending Temporal Stream Logic with theories, trace quantifiers, cross-trace predicates/functions and updates. It gives automata-based infinite-state software model checking for TSL(T), alternation-free HyperTSL(T), and a sound but necessarily incomplete counterexample algorithm for the ∀∃ fragment. Büchi product programs, bounded inconsistency and infeasible-cycle removal provide over-approximating existential witnesses.
  • number: Formal definitions and soundness theorem for the projected-product counterexample search; no quantitative runtime benchmark or implemented tool reported.
  • limits: Program behavior is represented by symbolic Büchi program automata and theory interpretations; feasibility depends on removing k-inconsistent transitions and infeasible accepting cycles. The ∀∃ procedure is sound for finding counterexamples but incomplete, and implementation/other quantifier fragments remain future work. Demonstrations are small automata, not a broad implementation benchmark.
  • how much was read: most of it read
  • source
  • record id: hypertsl-t-automata-checking-2023
• HyperTWTL model checking (2023)
  • title: Model Checking Time Window Temporal Logic for Hyperproperties
  • what: Introduces synchronous and asynchronous HyperTWTL for timed multi-trace requirements and a reduction of selected checking problems to ordinary TWTL over self-composed finite timed models. Evaluates a small surveillance example and grid path synthesis. The complexity and alternation claims need their stated qualifications preserved. Reported verdicts concern the printed TWTL encodings; their transfer to the original quantified formulas has unresolved proof/translation gaps. Defines trace and trajectory quantifiers, timed hold/within/concatenation operators, self-composition, silent-event trace alignment, fresh-atom flattening and illustrative security/concurrency requirements. Propositions state conditional translation correctness and bounded-variability decidability; the general versus bounded model-checking claims and a separate satisfiability complexity claim must be distinguished.
  • number: PyTWTL Python 2.7 on Windows 10, 64 GB RAM, Intel i9-10900 3.70 GHz. TESS bounds T1..T9 = 2,5,6,7,12,13,19,20,30
  • number: Table 6: theta1 SAT 16.30 s/15.21 MB; theta2 UNSAT 19.05/15.33; theta3 UNSAT 22.24/17.25; theta4 UNSAT 24.52/16.27; theta5 SAT 25.19/16.04; theta6 UNSAT 23.83/16.39; theta7 SAT 22.24/17.48
  • number: Table 7 phi8 time across increasing grids: 23.08,47.94,72.40,103.05,161.17 s; memory 15.53,19.11,28.84,39.50,52.11 MB
  • number: Table 7 phi9 time: 17.43,21.63,28.61,36.72,56.49 s; memory 15.21,18.96,23.73,25.35,31.96 MB. Text instead says 27.35 MB at 40x40; retain table value with discrepancy noted
  • limits: Finite timed Kripke structures with integer nonnegative transition durations and labels; dead ends are given duration-one self-loops Synchronous semantics aligns timestamps. Asynchronous semantics quantifies trajectories controlling trace advancement/stuttering, with fairness requiring each trace variable to advance infinitely often Section 5 restricts checking to alternation-free and selected one-alternation formulas and disallows temporal nesting involving different traces; Section 5.2 additionally requires stutter insensitivity for its synchronization transformation The translation proposition assumes an equivalent TWTL formula; fresh atoms must actually encode the multi-trace relations. A generic unconditional translation theorem is not established by the short proof Unbounded alternation claims, bounded model checking and satisfiability complexity are separate statements. Bounded variability and bounded time are not interchangeable definitions, although §5.4 moves between them The evaluation uses a small symbolic robotics case and bounded grids, without real multi-robot deployment, distributed protocol verification, baseline comparison or independently reproduced run Table4 phi2 has exists pi1 forall pi2. A single violating trace pair refutes one existential candidate, not the whole formula: refutation requires forall pi1 exists pi2 not(body). Section6 gives neither that witness family nor a quantifier-preserving justification. This does not independently establish that the reported verdict is false [Q19; rendered Table4,p8]. Section5.3’s printed equality flattening maps initial-state equality to I1/I2 or I2/I1 pairings, which express inequality when the two initial states are exclusive. Equality would require I1/I1 or I2/I2. The mismatch is in the displayed translation, without an implementation conclusion [Q12; rendered p7]. Table4 phi1 fixes trace1 to R2→R4 and trace2 to R3→R5. Table5 theta1 permits either route in each copy and therefore both copies taking the same route, even after repairing its reversed interval/negative exponent. The common-condition fresh atoms do not explicitly restore that distinction. Missing displayed asynchronous difference bounds in theta5/theta7 also need a model-preservation explanation; omission alone is not a complete counterexample because synchronization changes the trace model [Tables4–5,p8; §5.2–5.3].
  • how much was read: most of it read
  • record id: hypertwtl-model-checking-2023
• Isabelle HOL attack-tree model checking (2023)
  • title: Higher Order Model Checking in Isabelle for Human Centric Infrastructure Security
  • what: Derives executable, provably correct attack-tree model checking from Isabelle/HOL theories of Kripke structures and CTL, using list-based finite infrastructure states and executable transition functions. The paper proves correctness and completeness of attack-tree semantics against CTL EF, defines list-based efficient states and st_e transitions, proves soundness/completeness with respect to the abstract transition relation, and repeatedly collects reachable states with bounded st_et. In the IoT healthcare case, an automatically found EF attack violates a global data-label privacy policy by injecting learned data as Eve’s own label, demonstrating detection of an attack outside modeled privacy mechanisms.
  • number: correctness theorem AT_EF and inverse Completeness theorem formalized in Isabelle
  • number: reachable-state collection st_et executed with a bound n
  • number: case study finds an EF path where Eve puts data into the cloud
  • number: finite-infrastructure transition correspondence proved both directions
  • limits: HOL model checking is generally undecidable and the executable procedure presumes finite state sets so bounded fixed-point iteration terminates. The implementation focuses on attack trees rather than generic CTL fixpoint code; the case study abstracts covert channels and implicit flows. Conclusions are a formalization and illustrative case study, not performance benchmarks.
  • how much was read: most of it read
  • record id: isabelle-hol-attack-tree-model-checking-2023
• Learning-based timed automata verification/synthesis (2023)
  • title: Timed Automata Verification and Synthesis via Finite Automata Learning.
  • what: Decomposes a timed-automaton system into a large finite-state machine A and smaller timed component T, learns DFAs approximating T, then applies finite-state model checking or game solving. Model checking is sound via an overapproximation; synthesis alternates over- and under-approximations and is sound but incomplete under a Controller-silent restriction. For model checking, L* or TTT learning uses membership and inclusion oracles answered by TChecker; once L(T)⊆L(H), finite-state checking of A×H yields assume-guarantee safety. For synthesis, learners maintain H_under⊆L(T)⊆H_over, with Abssynthe solving finite games and NuSMV checking strategy containment. Controller-silent means controller transitions are silent and controller locations urgent, enabling transfer of winning strategies from G×H to G×T. The Scala prototype integrates TChecker, NuSMV, LearnLib/AutomataLib, Yosys/berkeley-abc and Abssynthe.
  • number: Leader Election A: 3 clocks, 13 conjectures, 232 membership queries, 15-state DFA, 157 s
  • number: FTSP-abstract-3: 3 clocks, 17 conjectures, 340 queries, 23-state DFA, 47 s
  • number: Scheduling genbuf A: 50 conjectures, 2,178 queries, 114-state overapproximation, 26 s
  • number: Planning genbuf C: 9 conjectures, 1,156 queries, 5/5-state DFAs, 266 s
  • limits: Model-checking scalability depends on learning convergence and DFA size; Leader Election D and several larger models time out or exceed 8 GB/30 minutes. Synthesis is not complete and applies only to Controller-silent, label-deterministic timed games; it may reject a controllable instance. Timed-automaton complements do not complement untimed languages directly, so containment needs adapted zone exploration. Experiments target finite safety benchmarks; liveness and controllers choosing nonzero delays are unsupported.
  • how much was read: most of it read
  • source
  • record id: learning-based-timed-automata-verification-synthesis-2023
• LISA – A Modern Proof System (2023)
  • what: Initial proof assistant and kernel for single-sorted schematic first-order logic with equality and axiomatic set theory. Kernel uses ortholattice-based formula comparison, explicit DAG proof steps and theory-specific sealed theorem values. Scala DSL constructs checked proofs/tactics; demonstrations include a propositional solver, unique/underspecified definitions and Cantor’s theorem. Explains which propositional equivalences and limited quantifier rules the efficient kernel handles, why automatic quantifier instantiation is excluded from F(OL)^2 comparison while explicit instantiation proof steps remain kernel-checkable, how standalone proof imports differ from justified theory theorems, and why schematic axiom schemas make existence-only definition unsound as a conservative extension. Underspecified definitions use a unique concrete witness while exposing only a weaker property.
  • limits: Logical foundation is classical first-order sequent calculus with schematic function/predicate/connector instantiation, equality and chosen axioms. Schematic symbols are not bound higher-order quantifiers; authors argue they do not increase expressive power because instantiation can be simulated. No proof of consistency of ZFC/Tarski-Grothendieck axioms is supplied. Kernel implementation is about 1607 Scala lines of code, with about 300 for the ortholattice algorithm. Polynomial/quadratic complexity claims concern checking explicit proof data and formula comparisons, not general proof search. No machine-checked verification of the whole Scala kernel/compiler/runtime or empirical complexity benchmark is reported. Ortholattice equivalence is a restricted propositional theory excluding Boolean distributivity. F(OL)^2 extends it with equality symmetry/reflexivity, universal monotonicity and congruence for schematic connectors. It is not a complete validity or equivalence decision procedure for first-order logic. Standalone proof checking establishes derivability from explicitly listed imports; it does not prove imported axioms/theorems themselves. Theory validates imports against its own stored axioms/theorems/definitions, and a theorem remains relative to that theory’s assumptions. Calling the result unconditionally true in the paper does not establish consistency of arbitrary user axioms. Theorem type depends on a specific Theory instance; host language path-dependent types prevent ordinary mixing of facts from distinct theories. Scala type checking is a usability/encapsulation mechanism, while kernel proof checking remains the proof-validity boundary. Function definitions require fresh symbol and proof of unique existence. Existence alone could yield a global pick function and Choice when new symbols are usable in replacement schemas. Underspecification weakens the exposed fact after checking a unique construction; it does not discard the existence/uniqueness obligation. Tautology is a non-clausal DPLL-like propositional proof search with worst-case exponential atom branching, most-frequent-atom heuristic and ortholattice simplification. Its stated completeness is for propositional reasoning, not quantified mathematical proof or all first-order validity. Quantifier automation/external ATP integrations are future work. Interaction model at publication uses Scala IDE, rerunning projects and incremental compilation; live interactive proof state and serialized theories are not established features. Future usability/interoperability/verification benefits are design goals, not measured comparative outcomes. Set-theory library is early: basic sets, relations, functions and Cantor. Orders/ordinals/induction ongoing; category theory/Coq embedding via Grothendieck universes future. No distributed-system proof, Verus/Rust implementation verification, LLM experiment or TLA+ proof integration is presented.
  • how much was read: most of it read
  • source
  • record id: lisa-a-modern-proof-2023
• Malvone strategies and information in MAS model checking (2023)
  • title: The Impact of Strategies and Information in Model Checking for Multi-Agent Systems
  • what: Reviews model-checking complexity for Alternating-time Temporal Logic (ATL/ATL*) and Strategy Logic under memoryless, memoryful, bounded/natural strategies and perfect or imperfect information, then identifies open research directions. The paper fixes a concurrent-game-structure model with finite states/actions, protocols respecting indistinguishability, and temporal/strategic semantics. It defines memoryless and history-dependent uniform strategies and natural guarded-action strategies, including epistemic conditions and regular-expression recall. Tables give concrete complexity classifications: ATL is PTIME-complete with perfect information but undecidable with imperfect information and memoryful strategies; ATL* is PSPACE-complete memoryless and 2EXPTIME-complete perfect-information memoryful, while imperfect-information memoryful is undecidable; SL is PSPACE-complete imperfect-information memoryless and non-elementary perfect-information memoryful. NatATL/NatSL regain PSPACE or DeltaP2 bounds. The review argues memoryless strategies are weak, memoryful strategies are costly, and natural-strategy complexity and imperfect-information taxonomies remain open.
  • number: ATL perfect-information memoryless and memoryful: PTIME-complete
  • number: ATL imperfect-information memoryful: undecidable
  • number: ATL* perfect-information memoryful: 2EXPTIME-complete
  • number: NatATL with recall: PSPACE-complete
  • limits: Models are finite concurrent game structures with finite action sets and equivalence-based observation; uniformity is required for indistinguishable states/histories. Complexity results are literature results, not new implementations or experiments. The paper notes undecidability in several imperfect-information perfect-recall settings and that natural-strategy complexity measures are unsettled; no distributed-system case study or empirical evaluation is provided.
  • how much was read: most of it read
  • record id: malvone-strategies-and-information-in-mas-model-checking-2023
• Nash Gallagher shrinking-errors Lean 2023 (2023)
  • title: A Formalisation of Gallagher’s Ergodic Theorem
  • what: Nash reports Lean/mathlib formalization of Gallagher’s zero-or-full-measure dichotomy for rational approximation under the additional hypothesis δ_n→0. General infrastructure includes additive circles, uniformly locally doubling measures, filter-form density theorems, subset-thickening Cassels scaling invariance, ergodic circle maps and approximate-order sets. A prime-divisibility partition combines these tools. The separate nonshrinking-error case and Duffin–Schaeffer theorem remain future work in this 2023 source. Preserves missing δ→0-free branch; exact bounded-limsup/approximate-order definitions; density hypotheses and positive radii; Cassels arbitrary-subset generalization avoiding enumerations; set/function Boolean-algebra diamond; finite-measure almost-invariance lemma; expanding/affine circle maps and translation-order density argument; all four order identities; prime-partition proof; 27 upstream PRs/~3500 net lines versus 101-line final proof; future arithmetic dependencies.
  • limits: Title/abstract discuss Gallagher broadly, but completed formal theorem in Listings 1/16 requires δ:N→R tendsto 0 at_top. Conclusion is (a.e. x not well-approximable) OR (a.e. x well-approximable), with one global disjunction outside the almost-everywhere quantifiers. It is not the vacuous pointwise disjunction and not a theorem choosing which branch holds. δ may be signed; positive-radius thickenings and the limit hypothesis determine the meaningful sets. General no-limit theorem is stated informally but not completed (§1, §6.2). Original real-line set uses infinitely many reduced rationals with strictly increasing denominators and strict approximation |x-q|<δ_denom(q). Periodicity descends to S=R/Z. Exact order of rational coset matches reduced denominator. Formal add_well_approximable is a predicate-bounded limsup over n>0 of thickenings of exact-order-n points. Zero order is excluded from final limsup, although generic approx_order_of accepts natural n. Almost equal means both set differences measure zero, not literal set equality (§1–2, §6.1). Generic lattice limsup API, including blimsup over predicate p, avoids reindexing by subtypes and proves disjunction of index predicates maps to lattice sup. Actual definition also supports conditionally complete lattices; set formula is a proved specialization. Open thickening generalizes balls and reuses existing Gromov-Hausdorff infrastructure (§2.2–2.3). add_circle K p is quotient K/zmultiples p, with generic ordered additive/topological carrier; numeric norm/measure results used here concern real circle with positive period T. Unit-period norm is |x-round(x)| and Haar ball measure min(1,2epsilon) for nonnegative radius. The new additive model avoids irrelevant exp/log conversion from preexisting complex unit circle; additive/multiplicative class pattern allows both. Period 2pi for angles is contextual reuse, not a separate benchmark (§2.4, §3.1). Doubling condition is uniformly local: exists common nonnegative C such that for all sufficiently small positive epsilon and every center, closed-ball measure at 2epsilon≤C times measure at epsilon. It does not assume a global radius bound for all scales. Circle Haar measure gets C=2 via ball formula. Density theorem assumes metric/Borel/second-countable space, locally finite doubling measure; conclusion a.e. under µ.restrict S for arbitrary set S and arbitrary indexing filter, with positive radii tending to 0 and eventual x in K-times-radius displaced balls. Radius positivity is explicit in N[>]0 even where informal statement only says δ_j→0 (§3). Density theorem builds doubling API to instantiate Gouezel’s existing Vitali-family theorem, rather than re-proving general Vitali theory. For ordinary density take fixed center x. Positive measure then supplies a density-1 point; [0,1] has density-1 points (0,1) under real Lebesgue measure. These are mathematical examples illustrating the theorem, not executed numerical tests (§3.2). Cassels lemma: for any predicate p, sequence of arbitrary subsets s_n, real radii r_n→0 and constant M>0, bounded limsup of Th(Mr_n,s_n) equals that of Th(r_n,s_n) a.e. under same metric/Borel/second-countable/locally-finite/doubling hypotheses. One difference direction follows monotonicity depending on M<1 or >1; the other uses a density-point contradiction. Generalizing points to subsets avoids arbitrarily enumerating finitely many exact-order points per circle denominator. This is proved API generality, not permission to omit r→0 (§4). Cassels statement needs explicit :set α type ascriptions because set α and α→Prop have mathematically equal but definitionally different complete Boolean-algebra Inf/Sup fields. Source records issue 16932; this is a 2023 library issue, not verified current status or a mathematical inconsistency. General abstraction avoids subtype obligations but does not automatically eliminate elaboration diamonds (§4). pre_ergodic states measurable exactly invariant sets are null or conull; ergodic adds measure preservation. Separate pre-ergodic structure also supports quasi-ergodic maps, which are not developed in this paper. Crucial derived lemma needs finite total measure, measurable s and image f[s] almost contained in s, concluding null/conull. Exact preimage invariance in the definition is thus not incorrectly substituted for the weaker almost-image property used in proof (§5.1). On S, multiplication by natural n preserves Haar measure for n≥1 and is ergodic only for n≥2. Measure-preservation extends to compact Abelian divisible topological groups; ergodicity of this family is proved for circle using density. If a null-measurable s is invariant a.e. under translations u_i with finite orders tending to infinity along a nontrivial filter, s is null/conull. Density point d and balls with measure 1/order(u_i) force measure(s)=1. n-fold invariant sets translate by [1/n^i], yielding ergodicity. Figure 1 illustrates two half-sized preimage arcs, not invertibility of the doubling map (§5.2). Affine maps y→ny+x have same thresholds. For n≥2, translation by a chosen (n−1)-division point conjugates the affine map with pure multiplication; a general measure-preserving conjugacy equivalence transfers ergodicity. This does not make circle multiplication by n one-to-one. The exposition’s x/(n−1) denotes a chosen division point, not a globally defined unique division operation on R/Z (§5.2). Approximate order AO(A,n,δ) is thickening of exact-order-n points in a seminormed group; to_additive generates additive counterpart. All four identities assume a seminormed commutative group, real δ, a group element a and nonzero natural m,n. Four identities used: coprime m,n multiplication preserves order class up to radius factor m; multiplication takes order nm to n; translation by a of coprime order takes n to order(a)n; order(a)^2 dividing n makes translation preserve AO. A weaker radical(order(a))order(a) divisibility condition is mentioned but not needed. Figure 2 shows four small arcs for order 5 near 1/5,2/5,3/5,4/5 (§6.1). Main proof partitions positive n for each prime p into p not dividing n (A_p), p dividing exactly once (B_p), p² dividing n (C_p), so W=A_p union B_p union C_p. Approximate-order laws and Cassels imply A_p almost forward invariant under py and B_p under py+[1/p]; either non-null implies conull by finite-measure ergodicity. If all A_p/B_p null then W equals C_p a.e. for every prime, hence is almost invariant under translation [1/p]. Unbounded prime orders and the translation lemma give final dichotomy. Shrinking errors enter through Cassels, explaining why the unfinished branch cannot simply be dropped (§6.2). Reported 27 PRs and just over 3,500 net new lines include mostly generic library code contributed directly to mathlib master. Final ~30-line informal proof corresponds to 101 formal lines excluding comments, after supporting libraries exist. This is not total proof effort, proof-check time, autonomous automation output or a model benchmark. Author recommends upstream-first development as a belief supported by this case, without controlled workflow comparison (§1, §6.2, §7.4). Missing general branch first normalizes δ to max(δ,0). For this nonnegative sequence, failure to tend to zero yields literal WA=S by a separate arithmetic argument. Normalization matters: failure of a signed δ to tend to zero by negative values alone does not imply full approximation. Needed divisor-count/totient growth bounds partly existed in external Unit Fractions Project and would need migration. This is future work in source, not completion inferred from a suggested plan (§7.1). Duffin–Schaeffer convergence/divergence criterion for nonnegative approximation errors is motivating context, not proved here. Easy convergence direction uses Borel–Cantelli; hard converse and Pollington–Vaughan lemma are future targets. Later quantitative work can bypass Gallagher according to author correspondence; source does not formalize those quantitative results. No current library completion claim follows from this 2023 paper (§7.2–7.3). All supplied pages/listings/proof outlines read. Repository mathlib and archive a022d44847c12ca961b4bd0c8bca4f9df70cf7df plus embedded source links identify author evidence. Paper does not supply a pinned toolchain command/axiom audit; reader did not replay proofs. No distributed protocol, Rust/Verus/TLA+ result, LLM proof agent or quantitative model evaluation appears. Relevance is exact theorem-scope auditing, reusable measure interfaces, incremental upstreaming and formal/informal proof-cost distinction.
  • how much was read: most of it read
  • source
  • record id: nash-gallagher-shrinking-errors-lean-2023-2023
• Neural Activation Patterns as Specifications (2023)
  • title: Towards Reliable Neural Specifications
  • what: Proposes neural representation as specification: mine partial neural activation patterns (NAPs) shared by most examples of a class, then verify classification and robustness for the whole input region following that pattern. A relaxation factor δ controls precision/recall. NAPs can be encoded directly in Marabou, support non-ambiguity checks between labels, and augment input norm-balls to verify larger regions. The method’s mining algorithm counts neuron activation frequencies on class training data, selecting activated/deactivated neurons above δ and below 1−δ. The paper distinguishes NAP robustness (all inputs following a pattern are classified as the label) from NAP-augmented robustness (norm-ball intersected with the pattern region). Controlled 2-D visualization explains why activation regions are flexible and larger than boxes. VNNCOMP-21 MNIST and CIFAR10 experiments quantify precision/recall, timeouts, coverage and robustness bounds; δ=0.99 yields an MNIST digit-1 NAP covering 84% of test images and verifies ε=0.3 for six of seven previously non-robust inputs. CIFAR10 verifies some examples at ε=0.12 (10× the prior bound) when δ=0.9.
  • number: MNIST δ=0.99 digit-1 NAP recalls 959/1135=84% test images; δ=1.0 recalls 1124/1135=99% but admits 8 wrong-label images
  • number: Table 3: ε=0.2 without NAP fails/timeout, while δ=0.99 NAP robustness verifies all tested labels; ε=1 augmented NAP also verifies all tested labels
  • number: Table 4: with δ=0.99, all six mnistfc_256x4 and one mnistfc_256x6 non-robust inputs verified at ε=0.3; largest VNNCOMP ε was 0.05
  • number: CIFAR10 Table 5: at ε=0.12 and δ=0.9, 3/7 tested inputs verify; ε=0.12 is 10× the prior bound and an input volume ratio of 10^3072
  • limits: Targets feed-forward ReLU classifiers and uses Marabou; extension to other activations/architectures is conjectural. Mining is approximate, requires δ>0.5 and trades recall for precision; lower δ can cover fewer inputs. NAP guarantees concern the network’s classifier, not semantic correctness of labels or distribution shift. Noisy/mislabeled data can violate ideal same-label patterns. Marabou has timeouts and complete verification remains expensive; abstract verifiers can be inconclusive. Experiments use MNIST/CIFAR10 VNNCOMP models, not deployed systems.
  • how much was read: most of it read
  • record id: neural-activation-patterns-as-specifications-2023
• Okazaki RUSUB6 Gram Schmidt 2023 (2023)
  • title: On the Formalization of Gram-Schmidt Process for Orthonormalizing a Set of Vectors.
  • what: Okazaki formalizes exact Gram–Schmidt orthonormalization in a real inner-product space. For a nonempty injective sequence whose range is linearly independent, the output has equal length, is injective and orthonormal, spans exactly the input span, and preserves span equality at every prefix. The paper constructs finite projection-term sequences and recursive prefix states, then defines PROCESSGramSchmidt by this contract. It does not verify floating-point stability or give a compiled implementation. Records finite linear-combination helpers, inner-product summation, the exact projection/subtraction/normalization formula, division safety from prefix independence, dual recursion state and per-prefix span/orthonormality invariants.
  • limits: MML RUSUB_6 version 8.1.12 5.74.1441 identifies the Mizar formalization. H is a real unitary space, meaning a real inner-product space in this library, not an arbitrary normed space or complex unitary matrix. No completeness of H or finite dimension of its entire carrier is required; the input sequence is finite (pp.53–55). Theorem 9 assumes x is one-to-one, rng x is linearly independent and len x≥1. Set-level linear independence alone would not exclude repeated entries of a sequence; the injectivity guard matters. Zero vectors and dependent later vectors are excluded, rather than detected and skipped by a specified branch (p.55). Definition 1 makes r◦x the sequence of scalar-vector products r_i x_i with length len x. Proposition 1 assumes equal coefficient/vector lengths and input range in A to put its sum in Lin(A), by induction. Propositions 2/3 turn mutual generator containment in spans into equality of subspaces (pp.53–54). Definition 2 forms the real coefficient sequence ((u|x_i)) of inner products. Proposition 4 gives its pointwise vector product, Proposition 5 moves inner product through a finite sum, and Proposition 6 reduces such a sum to the sole potentially nonzero term. These support orthogonality of residuals, not numerical approximations to it (p.54). Proposition 7 constructs a total function on H×H* returning the finite sequence ((x|e_i)e_i); Definition 3 names it SeqProj(H). The function returns projection summands, not their sum. For a general e it is just this formula; interpreting the sum as an orthogonal projection requires the orthonormal prefix invariant (p.55). Proposition 8 proves every orthonormal family linearly independent by showing a zero-sum linear combination has empty support. Theorem 10 later applies it to the constructed output range; the main same-span theorem is already part of Theorem 9 and the defining contract (pp.55,57). Theorem 9 sets e_1=x_1/||x_1|| and e_(k+1)=r_(k+1)/||r_(k+1)||, with residual r_(k+1)=x_(k+1)-sum_(i≤k)(x_(k+1)|e_i)e_i. It requires equal input/output lengths, orthonormal output range, injectivity, same final span and the recurrence, plus orthonormality/injectivity/same span at every prefix k≤len x, including the empty prefix (p.55). The residual is orthogonal to each earlier e_j because the prefix is orthonormal and inner product distributes over the sum. It is nonzero because otherwise x_(k+1) lies in the earlier output span, equal by induction to the earlier input span, contradicting independence plus injectivity of x. Thus every normalization divides by a strictly positive norm. These are the mathematical obligations of the printed recurrence; the PDF abbreviates the final induction rather than displaying its full checker proof (pp.55–56). For span preservation, each new e is a scalar multiple of x_(k+1) minus a combination of earlier e, so it lies in the enlarged input span. Conversely x_(k+1)=||r||e_(k+1)+the projection sum lies in the enlarged output span. Nonzero normalization plus orthogonality also makes the new output distinct from earlier unit vectors. This reading explains the invariant step; it is not a separate executed proof trace (Theorem 9). Theorem 9 proof first constructs E(k), a finite sequence of partial output sequences in the union of H^i for i≤len x. Its transition appends the normalized residual. It then extracts a vector sequence e with E(n)=e restricted to n and proves the prefix predicate by induction. Maintaining E and e agreement connects a state of prefixes to the advertised output recurrence (p.56). Definition 4 names PROCESSGramSchmidt(x) under the same nonempty/injective/independent assumptions and repeats all seven substantive contract clauses, including prefix-span equality. The recurrence mathematically determines the output for a fixed ordered input, but this PDF does not present a separate uniqueness proof script or code extraction. Its output is an orthonormal basis of Lin(rng x), not necessarily all of H (pp.56–57). The arithmetic is exact real arithmetic. No rounding, conditioning, classical versus modified Gram–Schmidt stability bound, reorthogonalization, rank-deficiency handling, operation-count benchmark or executable numeric example appears. Error-correcting-code/cryptology applications and Isabelle/HOL work are introductory related-work context, not evaluated case studies here (pp.53,57). Exact quotations preserve raw extraction artifacts such as inequality glyphs, U+0016 for prefix restriction and broken denominator/index ordering; renderings were checked. Five pages, four definitions, ten propositions/theorems, all supplied sketches, acknowledgement, eight references and acceptance date read. Mizar source/checker and cited developments not independently inspected/run. No distributed protocol, Verus/Rust/TLA+ or LLM proof/specification-agent evaluation.
  • how much was read: most of it read
  • source
  • record id: okazaki-rusub6-gram-schmidt-2023-2023
• Petrification (2023)
  • title: Petrification: Software Model Checking for Programs with Dynamic Thread Management
  • what: Reduces verification of dynamically forked/joined concurrent programs to fixed-thread Petri programs. Petrification instantiates at most β thread copies, separates control flow from data, and adds safety and bound specifications; iterative β increases detect semantic thread width. The Conc semantics permits non-unique thread IDs and sequentially consistent arbitrary interleavings. Petrification renames local variables per template/instance, adds inUse/notInUse/insuff places, and labels Petri transitions with assignments and guards. Lemmas connect bounded-width executions and Petri firing sequences; Theorem 3.10 equates bound-specification satisfaction with thread width ≤β, yielding soundness and completeness for bounded-width correct programs and incorrect programs. Three iterative algorithms differ in whether they check safety or bound first.
  • number: SV-COMP category: 2,865 tasks; Automizer 1,516 successes, 35.3 h, 1,590 GB aggregate memory
  • number: Algorithm 1/2/3: 1,580/1,571/1,573 successes respectively
  • number: Algorithm 1 unsafe successes 356 vs 341 and 348 for Algorithms 2 and 3
  • number: 15-minute timeout, 16 GB memory, AMD Threadripper 3970X
  • limits: Soundness requires both safety and bound specifications. Relative termination assumes finite thread width and termination of the underlying Petri verifier; Algorithm 2 never terminates for infinite width, and Algorithm 3 depends on counterexample selection. Implementation supports a pthreads subset, sequential consistency, and parameter translation; it does not cover all POSIX features. Completeness is relative to the modeled language and Petri verification backend.
  • how much was read: most of it read
  • record id: petrification-2023
• Pomeret-Coquot et al. Bel-Games 2023 (2023)
  • title: Bel-Games: A Formal Theory of Games of Incomplete Information Based on Belief Functions in the Coq Proof Assistant
  • what: Formalizes normalized belief functions, conditioning, expected utilities and complete/incomplete-information games in Coq/SSReflect/MathComp. Reports utility preservation and Nash-equilibrium correspondence for three transforms from Bel games to hypergraphical complete-information games. Extends the TBM transform beyond Dempster conditioning by enlarging local-game participation. Records the finite algebra and exact conditioning contracts, three score semantics, type-specific deviations and profile flattening, transform restrictions and locality caveat, weak-conditioning TBM repair, theoretical versus verified complexity, illustrative payoff errors and limits of the reported proof evaluation.
  • limits: The development uses finite state/player/type domains, finite sets/functions and realFieldType scalars; field operations suffice, without a general infinite measure/integration construction. A normalized basic probability assignment has zero mass on the empty set, nonnegative masses summing to one. Bel sums masses of contained focal sets; Pl sums intersecting ones. A probability measure is the singleton-focal special case (§3.1). Dempster-Shafer evidence and upper/lower probability interpretations are distinguished; the formal development chooses the former. The Mr. Jones example assigns mass 1/2 to {P,Q} and 1/2 to {R}. The paper’s objection to a Bayesian posterior concerns the specific equiprobable-within-men prior and its intended evidence interpretation, not a mathematical proof that Bayesian models cannot represent any such decision situation (§§2–3.1). Conditioning packages a revisability predicate, a mass-transforming function requiring its proof, and Bel(C-complement | C)=0. This is weaker than Bel(C|C)=1 or Pl(C-complement|C)=0. For example, mass 1 on Ω and a proper nonempty C satisfies Bel(C-complement)=0 while Bel(C)=0 and Pl(C-complement)=1. The introductory certainty/impossibility wording must therefore be qualified by the actual axiom; the paper explicitly acknowledges weak conditioning can yield Bel(C|C)<1 (§3.2; reader example). Dempster requires Pl(C)≠0, intersects each focal set with C, discards empty intersections and renormalizes. Strong conditioning requires Bel(C)≠0 and retains only focal sets contained in C. Weak conditioning requires Pl(C)≠0 and retains whole focal sets intersecting C, renormalized without intersection. These encode distinct updates, not interchangeable implementations of one posterior (§3.2). Printed notation errors, checked on rendered pages: Definition 13 types revisable as a predicate on Ω although it is applied to events; the Coq pred {set W} has the intended event domain. Definition 19 uses an unbound B in the denominator/overlap test; its Coq rule consistently uses C. Definition 27’s final mathematical inequality omits the prime on the deviating action, becoming vacuous; the adjacent Coq change_strategy expression correctly changes to a’_i. These presentation defects do not establish formal-artifact unsoundness. XEU is a focal-mass weighted sum of φ(u)(B). CEU takes minimum utility within B; JEU mixes its minimum and maximum using local pessimism coefficients (mathematically in [0,1]); TBEU averages within B, equivalently using a pignistic probability after conditioning. Each agrees with ordinary expected utility on singleton masses. The displayed Coq fJEU accepts an arbitrary scalar coefficient function; its type alone does not enforce the stated coefficient interval (§3.3). Pure complete-information Nash equilibrium excludes a strictly improving unilateral deviation; ties are allowed. Mixed strategies use a product of each player’s probability distribution and expected utility, hence independent randomization, not an arbitrary correlated distribution. Mixed equilibrium is represented as pure equilibrium in the mixed extension; this is a representation theorem, not a general existence proof or a computed equilibrium solver (§4.1). Hypergraphical games sum local utilities for each player, who must use the same action in every local game. Bel games add a common mass assignment over joint private-type configurations and utilities depending on joint actions and types. A pure strategy maps own type to action. Properness requires every own-type event to satisfy the chosen revisability predicate, excluding otherwise undefined posteriors, even for types assigned zero plausibility under Dempster conditioning (§§4.2–5). Bel equilibrium checks each player and each of their types for a profitable change at that type. Flattening turns a type-contingent strategy into a vector over abstract players (i,θi). The reported transform theorems establish equality of utilities for each such pair and one-to-one pure-equilibrium correspondence, not equality of information available to the original decision makers or a distributed implementation (§§5–6). Direct transform computes Dempster conditioning on the fly, indexing local games by prior focal sets and including types possible within that set; weights divide by the corresponding type-event plausibility. Conditioned transform precomputes posteriors for any permitted conditioning, uses the union of posterior focal sets and posterior masses; local contribution can be zero for a posterior in which the set is not focal (§§6.1–6.2). Reader qualification of the printed any-XEU claims in Theorems 34/36: the displayed score types allow φ(u)(B) to inspect u outside B, but the transformed local game only knows actions for types appearing in B. Utility preservation needs locality: agreement of u,v on B implies φ(u)(B)=φ(v)(B). CEU/JEU/TBEU satisfy this, but no such premise appears in the displayed statements. Counterexample to unrestricted printed generality: one player, types 0/1, actions 0/1, prior singleton masses 1/2, Dempster conditioning, utility u(a,θ)=a and φ(v)(B)=v(1). Original type-0 utility equals strategy σ(1), while only the positive-mass local game for {0} contributes to abstract player (i,0), whose local payoff cannot observe σ(1). Two profiles agreeing at type 0 and differing at type 1 thus refute universal utility equality. The full repository may contain omitted assumptions; it was not inspected. This is a statement-scope concern, not a finding that Coq accepted a false theorem. TBM uses TBEU/pignistic probabilities and one local game per joint type configuration. For arbitrary conditioning it expands participation beyond matching own types: include (i,θi) if a posterior focal set contains the local state and a state matching θi. This is necessary because weak conditioning can retain states not matching the conditioned type. Dempster/strong posteriors stay within the own-type event and the original smaller participation condition suffices (§§6.3). Table 4 reports Direct and Conditioned time/space O(kSize(G)^k), TBM under Dempster conditioning space O(kSize(G)) and time O(Size(G)), with k the largest focal-set cardinality. These bounds are imported from prior work; §7 identifies complexity proofs as future work. They are not demonstrated machine-checked complexity guarantees, measured runtimes, or a uniform polynomial bound when k varies. The enlarged arbitrary-conditioning TBM graph is not assigned the same unconditional complexity bound. Concrete examples use two players choosing P/Q/R; avoiding the culprit gives 3 each for different innocent partners and 2 each when sharing one. Table 2 has equilibria (Q1,R2)/(R1,Q2) when P is guilty. Example 32’s type-dependent strategy yields CEU 3 for every player/type, hence is an equilibrium. Table 3 center (Q guilty) nevertheless prints (2,2) at (Q1,R2), conflicting with the stated culprit-zero rule, which gives (0,3). Example 32 also mislabels σ2(R-bar) as σ1(R-bar); its following prose disambiguates. These local illustration errors do not refute the general transformation proofs. Reported size is about 2.5 k lines of Coq/SSReflect, including roughly 1 k lines for belief functions. Proofs mostly rewrite finite sums, often using under beneath binders; authors report no special additional recurring automation need. They report formal verification clarified conditioning pre/postconditions and proof presentation. Paper gives no checker runtime, extracted implementation test, empirical solver benchmark, independent human-behavior study or LLM-agent success evaluation (§§3.1,7). Artifact is linked to GitHub/Software Heritage and reported MIT/OPAM availability, but no repository audit or proof execution was performed here. Separate 2022 paper was not read. No Verus/verified Rust/TLA+ or distributed-protocol safety/liveness result appears. Relevance to proof/specification-agent evaluation is inferred: compare intended semantics, formal premises and checked statement; conditional transformations do not prove the empirical adequacy of a decision model.
  • how much was read: most of it read
  • source
  • record id: pomeret-coquot-et-al-bel-games-2023-2023
• Proof Pearl: Faithful Computation and Extraction of µ-Recursive Algorithms in Coq (2023)
  • what: Constructs a Coq interpreter for possibly nonterminating µ-recursive algorithms whose extraction resembles direct functional evaluation rather than fuel-based repeated approximation. Domain existence proofs guard Coq computations, then erase. A tailored unbounded-search termination predicate and forward proof invariant handle minimization; ordinary structural recursion handles syntax, vectors and primitive-recursion helpers. Discusses erasure choices that eliminate generic Obj.t placeholders or replace them with unit. Records exact search pre/postconditions for partially decidable predicates, functionality/disjointness role, existential proof versus computational witness distinction, impossible-branch dependent inversion, forward invariant for tail recursion, all six arity-indexed constructors and semantics, nested-recursion guard conditions, vector-projection design and two higher-order extraction encodings. Separates structural extraction faithfulness from formal operational-cost/divergence equivalence and trust in unbuilt artifacts.
  • limits: §§1/4, pp.1–4/10–13: µ-algorithm is syntax for zero, successor, projection, composition, primitive recursion and unbounded minimization. A partial function maps an input to at most one natural output; undefined may mean nontermination. Work targets natural direct interpreter structure, not new computability expressiveness or universal termination. Ackermann and universality are background, not new executable benchmarks. §§1/4.3, pp.4/12–13: compute(P)=(exists x,Px)->{x|Px}; Coq computation requires a noninformative existence proof and returns value plus specification proof. It does not turn arbitrary existential propositions into extractable witnesses without a program specific to P. Footnote explicitly says compute is not a definition of traditional computability. Within Coq no value is required when guard lacks proof. §3.1, pp.6–7: test n takes a proof Dtest(n) and returns proof of P(n) or Q(n); on domain P and Q cannot both hold. Q need not equal global negation P and test need not be defined everywhere. Prels(s,x) requires x>=s, domain at all points s<=i<=x and P(x), but does not assume x is the first hit or prior Q. Postls returns m>=s, domain/P at m and domain/Q at each s<=i<m, establishing first hit under disjointness. §3.2, p.7: Dls has stop(domain/P at n) or next(domain at n,Dls(n+1)). Loop is structurally recursive on Dls proof, which erases. Dls projection at n supplies test-domain proof; when test chooses Q, stop constructor is impossible by P/Q disjointness and false elimination yields the needed structural subterm. This carefully chosen inversion matters to guard acceptance. §§3.3–3.4, p.8: existential Prels builds Dls entirely in Prop using interval induction. Search never reads the witness as runtime data. Forward btwn(Dtest and Q,s,n) proof accumulator records already rejected prefix, so recursive call is syntactically tail-position before extraction rather than reconstructing result proof after it. Correctness is proof-carrying, not runtime certificate checking. §3.5, pp.9–10: F(n,y) must be functional and comes with a program computing y under exists-y guard. Minimized output m satisfies F(m,0) and every smaller n has a defined positive F(n,*). Instantiating Dtest=domainF,P=zeroF,Q=positiveF meets disjointness via functionality. A zero after an undefined earlier point is not a valid minimum under these semantics. §3.5, p.9: generic test creates a dependent Boolean then immediately branches; extraction would retain that unnecessary intermediate structure. Specialized six-line loop directly pattern-matches computed natural output, with zero return/positive recurse. Shared termination/search reasoning is retained, but code deliberately specializes instead of maximizing generic abstraction. §4.1, p.10: syntax A_a indexed by arity. zero:A0,succ:A1,projection idx(a)->A_a,composition A_b with vector b of A_a yields A_a,primitive recursion A_a with A_(a+2) yields A_(a+1),minimization A_(a+1) yields A_a. Input tuple order is reversed so recursion-driving natural is first vector element. Coq types rule out malformed arities before extraction. §4.2, pp.10–12: semantics is a functional input/output relation over fixed-length vectors. Composition existentially supplies all inner outputs, primitive recursion relates successive intermediate outputs, minimization enforces prior positive definedness. ra_sem_fun proved by structural induction establishes at most one output. No assertion of existence for every algorithm/input. §4.3, p.13: interpreter follows same syntax recursion as semantics; composition passes recursively interpreted subalgorithms through vector traversal. Coq guard checker sees structural subterms because helper recurses on vector itself. Minimization uses Braga-style domain machinery only inside search; recursive interpreter call is on proper child syntax. Display leaves three proof obligations as underscores and points to source, which was not inspected here. §4.4, pp.14–15: finite indices and length-indexed inductive vectors are tailored for extraction. Projection recurses on vector, not index, so a projected child remains recognizable structural subterm. Empty vector+inhabited index contradiction is eliminated with idx_inv; dependent inversions enable one match instead of separate head/tail matches. Vector extensional equality is provable componentwise without assuming functional extensionality for arbitrary functions. §5, pp.15–16: extraction erases arities, maps indices to naturals/vectors to OCaml lists and inlines selected helpers. Resulting OCaml admits calls not typable in source, such as a too-short input list or bad projection index; impossible source cases become assert false. Coq-level arity guarantee therefore requires well-formed callers or a checked wrapper after extraction. §5, pp.15–16: higher-order argument with existential-proof arrow may retain Obj.t/__ placeholder because extraction cannot erase it in that argument type. Unit-guard packaging {_ : unit | exists x,Px} replaces placeholder by explicit unit argument; packaging proof under last data argument {n|exists y,F n y} removes placeholder entirely but uses asymmetric dependent typing. Changes target partial-function argument types, not every implementation. §§1/6, pp.4–5/16–17: artifact is author-reported self-contained under1000LOC, imports only Utf8/Extraction beyond custom basics and uses explicit terms/light automation. This is not independent line counting or a proof-search benchmark. Operational faithfulness is illustrated by extracted direct code and source typing; supplied paper gives no machine-checked step/cost correspondence or formal theorem characterizing target divergence on every outside-domain input. Extraction plugin/OCaml compiler/runtime are not verified by this case study.
  • how much was read: most of it read
  • source
  • record id: proof-pearl-faithful-computation-2023
• Propositional proof skeletons (2023)
  • what: Introduces semantic proof skeletons: selected learned clauses that summarize an unsatisfiability proof and allow later reconstruction of a complete DRUP/DRAT proof by incremental SAT solving. Online glue/reason-clause filters and offline LRAT-activity filters are implemented in CaDiCaL and DRAT-trim, with independent chunks enabling parallel reconstruction. The paper formalizes the reconstruction invariant: each skeleton clause is proved as a RUP under preceding clauses, then chunk proofs are stitched into a complete proof; variables in skeleton clauses are frozen to prevent unsound incremental inprocessing. It gives online Glue, Glue+Trail and Dynamic filters, offline activity-based Offline/Offline+Units/Offline-Opt filters, UNSAT-core restriction, and post-reconstruction shrinking. It also adapts DRAT-trim to concatenate chunk LRAT proofs and explains when deletions must be removed.
  • number: 65 unsatisfiable formulas
  • number: 500–5,000 s original solving range and 5,000 s timeout
  • number: 100–5,000× skeleton compression
  • number: 24-core reconstruction around 5× faster for the majority
  • limits: The method targets unsatisfiable CNF instances with clausal DRUP-style proofs; a skeleton alone is not a proof and needs a sound SAT solver/checker to fill each gap. Independent reconstruction must remove deletions that could invalidate later gaps; incremental reconstruction requires freezing variables occurring in skeleton clauses. Runtime and compression depend on heuristic clause selection and chunk balance; the study uses CaDiCaL/DRAT-trim and does not establish comparable gains for satisfiable cases or other proof systems.
  • how much was read: most of it read
  • source
  • record id: propositional-proof-skeletons-2023
• PyLTA (2023)
  • title: PyLTA: A Verification Tool for Parameterized Distributed Algorithms
  • what: Introduces PyLTA, which model-checks layered threshold automata for all process and fault-parameter valuations without bounding state-space diameter or exchanged messages. It supports synchronous/asynchronous communication-closed protocols and LTL, using counter/predicate abstraction, Büchi automata, SMT realizability checks and interpolant-based refinement. The paper gives an LTA input language with repeating or lasso layers, threshold guards and parameter relations. Counter abstraction counts processes traversing states and loses identities; Phase King identity guards are nondeterministically abstracted. Negated LTL is translated by Spot, MathSAT/PySMT checks abstract counterexample realizability, and automatic CEGAR adds predicates. The Phase King example assumes 4t<n, introduces actual-fault parameter f≤t, and needs one refinement predicate.
  • number: parameter constraint 4*t < n
  • number: actual fault parameter f ≤ t
  • number: one refinement predicate in running example
  • number: Supports parameterized process and fault counts
  • limits: Protocols must be parameterized, round-based and generally communication-closed with monotonically increasing message tags and threshold guards. Fairness assumptions are needed for infinite configurations. Identity-dependent behavior is over-approximated by counter abstraction, and results apply to the LTA model rather than executable code. General parameterized verification remains undecidable; no broad runtime benchmark is reported.
  • how much was read: most of it read
  • source
  • record id: pylta-2023
• Real-Time Double-Ended Queue Verified (Proof Pearl) (2023)
  • what: Isabelle/HOL verification of a persistent purely functional deque based on Chuang and Goldberg. Refines its representation into explicit rebalancing phases and proves list-based functional behavior and invariant preservation. Fixed work on each update yields worst-case constant-time operations under a unit-cost arithmetic/list-primitive model; paper gives a code-inspection complexity argument, not timing benchmarks. The main work is specifying intermediate rebalancing states: two simultaneous abstractions describe current observable contents and the eventual balanced ends; a remaining-step function and size_ok inequalities ensure both ends survive updates before rebalancing finishes. Split stack representations avoid final linear append. Small bounded deques are expressed with constructors rather than an implicit list-length restriction.
  • limits: Sequential immutable structure with persistence, not a concurrent deque. Interleaved enqueue/dequeue operations occur BETWEEN bounded rebalancing slices, not simultaneous threads. Prior versions remain available through functional values. Correctness equations require invar, except the stated empty abstraction equation. first/dequeue behavior has a nonempty-list precondition. Missing empty/invalid-state pattern cases are outside that specified behavior; no total checked error-return API is described. The abstract meaning is listL, with listR=rev(listL). Left/right enqueue prepends in the corresponding orientation; valid nonempty dequeue removes the first corresponding element. Isabelle HOL lists/naturals and total logic do not imply defined useful behavior for arbitrary malformed constructors. Rebalancing has phase-dependent invariants. A local Small1 state cannot independently determine its final list because transferred big-side elements are missing; the joint States abstraction supplies that information. Specifications over the partial local abstraction must stay in phase-appropriate contexts. Runtime code is the yellow-background material. list/list_current, remaining_steps and proof invariants may traverse large lists; these are ghost definitions for verification, not functions called by every deque update. Similarly size_new and some overloaded size meanings are logical descriptions; executable counters implement needed constant-time size tests. Worst-case O(1) uses constant-time arithmetic, list cons/head/tail and fixed-depth nonrecursive helper calls. It is not a measured physical real-time deadline or a claim about unbounded-integer bit complexity, garbage collection, code-generator/runtime correctness or allocator latency. §5.7 argues constant time from nonrecursion and primitive operations. The paper presents no separate instrumented cost semantics/theorem, exact instruction bound, executable benchmark, space-allocation measurement or proof-effort comparison. Public updates on a valid Rebal state perform four joint steps; an update starting rebalancing performs six. Phase transitions and invariant slack, not merely the 3:1 idle balance condition, establish safe completion before an end can run out. The publication says the formalization has 4,400 definition/proof lines and changes some names for presentation. Several printed code snippets have type/name/direction inconsistencies, so the displayed pseudocode should not be copied as an executable artifact without consulting the formal source. This record has not checked the repository.
  • how much was read: most of it read
  • source
  • record id: real-time-double-ended-2023
• Song Liu WFTC-net DCTL (2023)
  • title: Model Checking of Workflow Nets with Tables and Constraints
  • what: Redefines workflow nets with tables as WFTC-nets by adding guard-constraint sets, generates a constraint-aware state reachability graph (SRGC) that removes pseudo states, and defines database-oriented CTL (DCTL) to express table-data design requirements and data-flow properties. A C++ WFTCMC tool implements SRGC generation and DCTL model checking. The paper formalizes data refinement of abstract data items, table records, and three-valued guards; firing rules require both Petri enablement and guard constraints. Algorithm 1 explores reachable configurations while refining only data needed by reads/writes/selects/inserts/deletes/updates. DCTL extends CTL with quantification over table records and attribute comparisons; Algorithms 2–7 compute satisfaction sets bottom-up and fixed points with stated O((n+r)|φ|) complexity for verification. The motivating vehicle-management model shows how guard relationships eliminate impossible combinations and reveal a license-consistency defect invisible to soundness alone.
  • number: BM1 WFT 262 states/399 arcs vs WFTC 88/120
  • number: BM8 WFT 629/976 vs WFTC 67/81
  • number: BM1 table size 2,100: >1.2e5 states, 3.0e7 arcs, 3.1e5 s
  • number: 8 benchmarks, 5 behavioral metrics, 10 repetitions
  • limits: The SRGC is finite and explicit, so state explosion remains; the authors report over 1.2e5 states, 3.0e7 arcs and 3.1e5 seconds for a table size of 2,100 in BM1. Data values are abstract/refined from observed table values and fresh values, with undefined values represented as ⊥; correctness therefore depends on the refinement and guard model. Experiments use eight synthetic/public workflow benchmarks on one Intel Core i5-8500/8GB machine, repeated ten times; no comparison with industrial-scale model checkers or proof assistant formalization is supplied.
  • how much was read: most of it read
  • record id: song-liu-wftc-net-dctl-2023
• Taming Large Bounds in Synthesis from Bounded-Liveness Specifications (Full Version) (2023)
  • what: The paper synthesizes reactive systems from Safety LTL extended with bounded next/eventually/until operators. It translates formulas to countdown-timer games, representing large numeric bounds symbolically rather than expanding them into nested next operators. On-the-fly pruning, timer-index reduction, and abstraction-based game solving keep generated games finite and manageable. The construction defines timer ordering and closure invariants, expansion/tree/timeout/squeeze operations, and a safety-game reduction whose locations encode current obligations. The full evaluation compares the prototype to ebr-ltl-synth and Strix on LTLEBR, SYNTCOMP, discretized real-time, railroad, conveyor-belt, robot-camera, and office-robot benchmarks, including bounds up to 21,600.
  • number: Experiments ran on an Intel Core i7-1165G7 with 16 GB RAM and one core
  • number: On 23 SYNTCOMP benchmarks, all three tools were comparable; Strix rejected roughly half of the [9] formulas as too long
  • number: Real-time adaptations used up to 19 propositions, 16 bounded operators, and bounds 60–4,000, where the tool clearly outperformed Strix
  • number: Office-robot bounds reached 21,600; many larger instances timed out under 15 minutes, while Strix often timed out or rejected expanded formulas
  • limits: The logic is discrete-time and restricted to an extension of Safety LTL; dense-time MTL/MITL synthesis is outside scope. Solving uses an abstraction threshold and can time out or become infeasible without approximation; Strix cannot accept many formulas because it expands bounded operators, and ebr-ltl-synth cannot handle benchmark assumptions. The prototype is single-core and comparisons use adapted benchmarks where formalisms differ.
  • how much was read: most of it read
  • record id: taming-large-bounds-in-2023
• Tranchecker optimal DPOR for causal consistency (2023)
  • title: Optimal Stateless Model Checking of Transactional Programs under Causal Consistency
  • what: Presents a uniform optimal dynamic partial-order-reduction stateless model checker for transactional programs under five causal-consistency variants (CC, CCv, CM, RCom and RAt), exploring program-order/reads-from traces. Defines operational trace semantics that incrementally computes readable transactions and causal-order obligations for each model, then gives ExploreTraces/CreateSchedule procedures to backtrack over alternative reads while avoiding duplicate po-rf traces. Theorem 7.1 establishes soundness, completeness and optimality with polynomial work per explored trace. The Tranchecker implementation extends Nidhugg at LLVM IR/C level and checks assertions across generated litmus tests, database anomalies, distributed-application examples and large parameterized stress cases.
  • number: all 7,507 litmus tests completed in at most about 570 seconds per model
  • number: version-1 benchmark suite under 4 seconds; version-2 about 402 seconds; version-3 450–12,003 seconds depending on model/program
  • number: stress test generated 7.7 million traces
  • number: Table 1 outcomes: RCom/RAt 5,867 allowed and 1,640 forbidden; CC/CCv/CM 5,093 allowed and 2,414 forbidden
  • limits: Transactions execute atomically; causal delivery and transaction isolation are built into all models. The method targets assertion violations and terminating runs; state/trace explosion remains when many processes and transactions generate millions of traces. It does not cover snapshot isolation or serializability, whose po-rf consistency checking is NP-complete and left for future heuristics. Experimental times depend on Ubuntu/i7/16GB hardware and benchmark encodings.
  • how much was read: most of it read
  • record id: tranchecker-optimal-dpor-for-causal-consistency-2023
• Verifiable P4 (2023)
  • title: Foundational Verification of Stateful P4 Packet Processing
  • what: Builds Verifiable P4, a Coq program logic and semi-interactive verifier sound against formal P416 operational semantics, plus a proved-correct reference interpreter. Demonstrates source-level functional correctness of a sliding-window Bloom filter and a firewall no-recent-false-negatives policy, and adapts the proof to sliding-window count-min-sketch. Section 2 connects P4 control-block proofs to functional models, abstract time-window axioms, a per-packet process relation and its flow-level history closure. Hierarchical representation predicates and MOD clauses track only the rooted persistent-register subtree, enabling client/library proofs. Sections 3–4 define P4light, big-step stack/external-state semantics, nondeterministic partially initialized bits, a determinizing interpreter and a separate static instantiation phase with fully qualified paths and abstract methods. Theorem 1 proves SBF model axioms; Theorem 2 proves the P4 control implements the model; Theorem 3 proves program-logic soundness. Table 1 records P4-manual/compiler ambiguities and fixes. Sections 5–7 report proof sizes, saturating CMS adaptation and explicit boundaries for parsing, compilation, concurrency and probabilistic false positives.
  • number: T=60s; k=4 panes; r=3 rows; S=2^18 slots
  • number: dense-flow maximum gap about 100 microseconds
  • number: 48-bit nanosecond timestamps with wraparound
  • number: SBF: 416 P4 / 480 model / 1258 specs / 1859 P4 proofs / 1261 high-level proofs lines
  • limits: The SBF’s no-false-negative flow theorem assumes dense monotone packet time with no gap over T/C (about 100 microseconds), enabling incremental clearing; correct switch timestamps are assumed, while 48-bit nanosecond wraparound is allowed by the proof. Parameters are T=60 seconds, k=4 panes, r=3 rows, S=2^18 slots per row. Packet handling is atomic for a single Tofino-like pipeline; multiple pipelines, recirculation and surrounding packet scheduling remain future work. The logic excludes packet parsing/deparsing although the operational semantics includes them. The P4 front end/type checker and deployed compiler are not proved correct here; architecture resource acceptance and compiler correctness are assumptions for executable behavior. The reference interpreter selects zero for undefined bits, proving one allowed behavior rather than exhaustively exploring nondeterminism. No small false-positive probability is proved. P4 type-soundness proof and broader interpreter test-suite validation are ongoing.
  • how much was read: most of it read
  • source
  • record id: verifiable-p4-2023
• Verus OOPSLA 2023 (2023)
  • title: Verus: Verifying Rust Programs using Linear Ghost Types
  • what: It connects erased proof resources (ghost state, which exists only in the proof) to Rust ownership and imperative code.
  • number: 12 example programs in Table 1
  • number: XOR doubly-linked list: 385 total SLOC, 5.03 s
  • number: FIFO queue: 477 total SLOC, 4.58 s
  • number: Verus RwLock: 425 total SLOC, 4.44 s
  • limits: The formal result is for a small calculus. The termination claim covers specifications and proofs, not executable programs.
  • how much was read: most of it read
  • source; notes: S31
  • record id: verus-oopsla-2023-2023
• VLSM Faulty Distributed Systems (2023)
  • title: Validating Labelled State Transition and Message Production Systems: A Theory for Modelling Faulty Distributed Systems
  • what: Introduces Validating Labeled State transition and Message production systems (VLSMs): labeled transition systems with validity predicates on transitions and recursively defined valid states/messages. Composition, validators, local/global equivocation evidence, fixed-set and weight-limited state/message-equivocation models, and Byzantine components are defined in one framework. The paper distinguishes constrained executions (arbitrary environment inputs) from valid executions (inputs producible by the VLSM), defines free/constrained composition and induced validators, and proves state/message equivocation trace correspondence under full-node assumptions. It models weight-limited equivocation by annotating states with observed equivocator sets, then defines Byzantine components that can emit authenticated messages arbitrarily. Theorems 7.1/7.2 reduce fixed or weight-bounded Byzantine behavior to equivocation as observed by validators; examples include multiplication VLSMs, UMO/MO/ELMO observers, and explicit counterexamples showing composition constraints can break equivalence.
  • number: All results and examples are formalized and checked in Coq
  • number: Theorem 6.1 gives two-way trace correspondence for fixed equivocators under full-node assumption
  • number: Theorem 7.1 equates non-Byzantine traces under fixed Byzantine and equivocation behavior
  • number: Theorem 7.2 gives the analogous weight-limited reduction
  • limits: Validity can be undecidable in general (Turing-machine example). Equivalence theorems require channel authentication, sent and full-node assumptions for components; arbitrary composition constraints can make state and message equivocation differ. Byzantine components are restricted from forging sender identities. The work is foundational and Coq-checked, not a performance benchmark or deployed protocol.
  • how much was read: most of it read
  • record id: vlsm-faulty-distributed-systems-2023
• A-cast Strategic Ability Model Checking (2022)
  • title: Model Checking Strategic Abilities in Information-sharing Systems
  • what: Introduces A-cast concurrent game structures, a coalition-broadcast restriction of visibility-based CGS that permits private data sharing while retaining decidable ATL model checking. Proves 2-EXPTIME-completeness for A-formulas and models a nested-ATL terrorist-fraud attack on the Hancke–Kuhn distance-bounding protocol. A-cast requires an outsider’s visibility assignment to be identical for every agent in coalition A after the initial state, while initial states may have arbitrary indistinguishability. Lemma 1 shows common-knowledge-related histories generated by one A-strategy and sharing an initial state are distributed-knowledge-related; this bounds information sets by first/last states and yields a finitary two-player game construction. Theorem 1 proves 2-EXPTIME-completeness. The case study encodes n protocol sessions, one collusive session where a far prover leaks responses, and a Dolev–Yao attacker; nested strategic modalities express help only in the collusive session without future impersonation.
  • number: Theorem 1: 2-EXPTIME-complete
  • number: n executions modeled with A={P,At}; attacker receives a1,a2 only in collusive session
  • number: security case study is a pen-and-paper model-checking instance, not a runtime benchmark
  • limits: Decidability relies on the A-cast visibility restriction and ATL formulas whose coalitions are subsets of A; unrestricted vCGS ATL model checking is undecidable. The presented security model abstracts explicit timing/distances and uses the one-bitstring Hancke–Kuhn depiction, although the authors argue equivalence to the bit-by-bit protocol. Perfect recall and finite-state/action assumptions underlie the game construction.
  • how much was read: most of it read
  • record id: a-cast-strategic-ability-model-checking-2022
• A Verified Cyclicity Checker For Theories with Overloaded Constants (2022)
  • what: HOL4 proof of a termination/cyclicity characterization for finite monotone composable dependency relations with ad-hoc overloaded constants, plus a verified clocked breadth-first checker. Integrates a successful check into a Candle-derived HOL kernel with overloaded definitions and synthesizes a corresponding CakeML checker binary. Tests exported dependency graphs from portions of Isabelle/HOL. Repairs an earlier proof’s incorrect strict type-size argument by tracking both size and number of free type variables. Analyzes most-general solution paths modulo renaming, eliminates infinitely many strict instantiation extensions, and reduces nontermination to a self-instance cycle under composability. Gives exact clocked search outcomes/invariants, shows how positive acyclicity discharges kernel extension assumptions, and explicitly exposes unverified parsing and incomplete full-library coverage.
  • limits: Types are rank-1 polymorphic constructor trees; symbols are types or named typed constants. The finite base dependency relation can induce infinitely many type-instantiated edges. Monotonicity requires every type variable on a dependency’s right occur on its left; the kernel checks the corresponding definition-name condition. Main equivalence requires finite, well-formed, monotone and composable dependencies. Composability says a reachable endpoint and any next edge source are comparable by type instantiation or have no common instance. Without it, nonterminating instantiated chains need not contain a cycle of the restricted uninstantiated-start path form. A cycle means a restricted path ends at an instance of its starting symbol, modulo variable renaming, not necessarily identical concrete syntax. A typed dependency graph must account for substitutions/unification rather than ordinary finite graph cycle detection. The executable breadth-first checker is clocked and always returns at the supplied depth limit; Maybe_cyclic means inconclusive, not a cyclicity witness. Acyclic means the explored frontier actually became empty after checked steps, allowing a proof about all lengths; absence of a discovered cycle at finite depth alone is insufficient. Cyclic_step gives a self-instance path witness; Non_comp_step gives a failed composability witness. Neither a noncomposable input nor a cyclic dependency automatically proves a logical contradiction in the user’s equations. They prevent acceptance by this sufficient termination-based foundation. No unconditional decision procedure for all overloaded theories is claimed. General termination is undecidable; a finite clock does not guarantee a decisive answer on every input. The text’s sound-and-complete wording characterizes clocked outcomes and explored depths, not a universal terminating yes/no algorithm. HOL4 formalization uses Hilbert choice for infinite-sequence reasoning and verified unification/instance tests. CakeML proof-producing synthesis relates pure/monadic functions to executable code. Overall consistency of the overloaded HOL theories is relative to consistency of Zermelo–Fraenkel set theory and reused semantic/conservativity developments. The exported Isabelle dependency parser is explicitly unverified. Checker correctness therefore applies to the graph actually parsed, not automatically to the originating complete Isabelle theory. Removing type dependencies further weakens coverage; the paper explicitly calls using only constants-to-constants dependencies unsound for certifying a full theory. The whole Isabelle Main graph was not feasibly checked. The verified kernel is a HOL variant with overloading, not a drop-in verified Isabelle/HOL kernel. Accounting for axiomatic type classes and performance differences is future work. Reader did not run the compiler or scripts.
  • how much was read: most of it read
  • source
  • record id: a-verified-cyclicity-checker-2022
• Accelerating Verified-Compiler Development with a Verified Rewriting Engine (2022)
  • what: Coq framework that turns supported proved rewrite equalities into a specialized, proved-correct Gallina rewriting/partial-evaluation compiler. Combines decision-tree matching, normalization by evaluation, PHOAS binders, sharing-preserving let lifting and executable conditional rules. Replaces Fiat Cryptography’s CPS/custom simplifier pipeline with direct-style libraries and an extractable compiler, evaluated on large-binder microbenchmarks and finite-field-code generation. Separates an untrusted match-decision hint from verified evaluation/application, specializes a once-proved rewriter for native Coq lemmas, and proves denotation preservation while using the host type/termination checker to manage binders and normalization. Addresses output sharing through telescopes and handles variable-bound-dependent rewrites by a prior verified abstract interpreter recording constant bounds in clip decorators. Measures compiler time while preserving generated arithmetic code; identifies boundaries of extraction/evaluation trust and unsupported rule forms.
  • limits: Rewrite rules are proved equalities in supported Coq syntax; Make reifies them and generates code/soundness/well-formedness proofs. The OCaml plugin/compiler-builder need not be trusted if its generated terms/proofs are checked. The paper’s arbitrary sets wording is qualified by §6: equality only, decidable side conditions over constant-only variables, limited higher-order/polymorphic mixing and first-class polymorphism, no nonfully-applied function equality rewriting, hardcoded containers/eliminators and required decidable equality for types mentioned in rules. The object language is nearly simply typed with applications, abstractions, variables, constants and lets. PHOAS parameterizes syntax by a variable family and uses forall var for the closed representation. Denotation preservation is the stated theorem; this does not certify arbitrary Coq-language features or the entire target C toolchain. Decision trees guide decomposition and selection but are not proved correct as match compilers. Verified evaluation only returns a sound rule application; a wrong hint may miss an optimization without justifying an invalid equality. This separation supports soundness, not complete matching, confluence, saturation or a canonical normal form for arbitrary theorem sets. Gallina engine termination is enforced by typed recursive construction. Its combination of NbE and scheduled head rewriting should not be described as unrestricted iteration of arbitrary rules until a fixed point, which need not terminate. do_again/eager markers control strategy; no generic termination theorem for arbitrary rewrite relations is claimed. The no-added-trust claim concerns the compiler-building/proof architecture relative to Coq. §1.1 explicitly says VM/native-compilation execution mechanisms are unverified. Standalone extracted OCaml execution has a larger trusted base than in-Coq execution, as §2 acknowledges. No verified extraction, OCaml compiler or native-machine theorem is delivered here. Conditional rules must have executable decidable Boolean tests mentioning only variables marked compile-time constants; Make rejects tests with unmarked pattern variables. This is not a general open-term theorem-proving engine for arbitrary hypotheses. The clip pattern requires a separate verified bound analysis before rewriting. It records conservative constant intervals syntactically so later rules test constants, not the dynamic variable. Fusing abstract interpretation with rewriting/partial evaluation remains §6 future work; the prior analysis/decorator scheme does not establish that fusion is already implemented. Benchmarks measure partial evaluation/code-generation time, not speed of resulting arithmetic routines. Authors report essentially the same generated code on previously supported primes. Claims about production use/browser/mobile adoption are author reports and not independently audited here. The full version carries detailed performance/bottleneck/proof/implementation appendices. Hardware/software versions, complete timing data, repeats/dispersion and raw benchmark protocol are not supplied in this proceedings version. Approximate graph/prose values are preserved as such; reader did not run artifacts.
  • how much was read: most of it read
  • source
  • record id: accelerating-verified-compiler-development-2022
• Automated Verification of Network Function Binaries (2022)
  • what: Klint checks x86_64 network-function binaries against Python specifications by symbolic execution with trusted environment/data-structure contracts. Ghost maps express both specifications and contracts, separating known key/value/presence triples from unknown-item invariants and translating operations into quantifier-free bitvector constraints. Candidate invariants are inferred across maps and weakened to a packet-loop fixed point. Optional full-stack verification follows NIC register actions and separately proved data structures/allocator. Records operation formulas, persistence layers and recursive lookup shortcut, forall incompleteness/nontermination, invariant relaxation and cross-map candidates, dynamic-link/memory/event restrictions, NIC action preconditions, precise full-stack trust boundary, all verification/performance tables and BPF scope, concrete configuration/standard bugs, appendix property obligations and get algorithm.
  • limits: §§1–2: Core technique assumes correctly implemented, delineated data structures with map-based contracts. Binary must expose calls/symbols for environment operations and known parameter types/calling convention. No source/debug symbols needed for NF, but this is not arbitrary opaque whole-binary verification without contracts. §2.1: Single-threaded, initialization then packet processing; no shared-state multi-thread verification. Code executes only on init/packet arrival; timers must be checked within handler. Capability allocation only at initialization and may fail externally, e.g.OOM. Later operations may fail through misuse, not arbitrary external environment failure. §5: Mutable memory after init confined to stack and map-modeled heap; other memory read-only. calloc-like allocations return symbolic pointers. State/data-structure separation is enforced, and excessive unabstracted paths reach configurable instruction threshold. No general unbounded-loop termination proof. §§3.2–3.4: Decidability concerns generated quantifier-free bitvector formulas, not completeness or termination of all host-level map/invariant processing. forall false gives no constraints on future unknown items. Recursion shortcut handles reciprocal maps but other recursive invariants may recurse infinitely; introduction always-proof-or-counterexample claim is explicitly qualified by §3.4 and execution limits. Failed checking can be incompleteness/threshold/timeout rather than an actual implementation bug. §3.4: Unknown-item invariant applies only to unknown keys, not every known item; equality consistency handles aliases and KnownSize constrains distinct present known keys. Map layers share base unknown state and lazily transform known entries so later reads on old/new versions remain related. Ordered queues/stacks are expressible but authors believe poorly suited to inference. §4: Candidate constraints from initialized/known items are relaxed until inductive over each packet path; cross-map FK,FV,FP functions are discovered from known items and checked against unknown invariants. Shrinking candidate set is paper convergence argument; this does not establish inference of every useful invariant or remove §3.4 recursive-operation nontermination. §5: Specification map matching tries candidates heuristically and rejects only after all possibilities violate spec. §6.1 requires struct field order in spec to match implementation; values can be abstracted with ellipsis. Specifications/environment contracts remain human adequacy obligations. §5: Full stack verifies driver/most minimal OS against manually encoded NIC DSL/actions from public hardware documentation. Register writes must match feasible action and preconditions; hardware semantics and model faithfulness remain trusted. Does not prove physical NIC correctness or distributed network behavior. §5: Full-stack TCB explicitly includes Klint,angr,Z3,bootloader,hardware,VeriFast and C compiler for source-verified data structures/allocator. Ordinary core-contract mode assumes those implementations correct. Abstract assertion of no trusted software except Klint omits this detailed boundary. §§5,7: Environment compiled separately, linked without LTO to retain symbols; dynamically linked data-structure operations cost calls/lost inlining. NF+driver can compile together. Containers use Linux environment/contracts and trust container runtime/Linux implementation, enlarging TCB. §§6.3,7: Seven functionally checked binaries are six C functions plus one Rust policer; five existing BPF programs receive memory safety/crash freedom only because functional specifications unavailable. Native assembly dumped from kernel-compiled BPF is analyzed with BPF-map contracts. Rust example validates one compiled binary relative to contracts/spec, not Rust language/compiler correctness or a Verus proof. §7: Correct implementation of specification is not proof of protocol properties such as absence of infinite network-message loops. No distributed consensus/liveness/linearizability/durability theorem, no TLA+ or LLM-generated specification/proof evaluation. §6.1: Verification timing from one specified CPU; solver heuristics can change times by dozens of seconds, no repetitions/confidence intervals stated. Table1 excludes additional~15minutes/fullstack/function. Router0s cells are printed values, not measured zero computational work. §6.2/Table2/Figure5: All10Gbps Klint throughput cells are link-saturated censored measurements, not true maximum capacities. TinyNF replaces original Vigor DPDK subset in principal comparison. Implementations/allocator/driver/inline assembly differ and Klint bridge adds STP; performance is not controlled same-code cost of verification. Curves show median and5th/95th percentiles, not statistical confidence intervals. §6.3/Table3: No extra inputs comparison excludes shared prerequisites: NF specification plus data-structure/environment contracts still required. Historical Rust bug-tracker69unsoundissues and BPF loop restrictions are source-time claims, not current facts. External repository/proofs unrun.
  • how much was read: most of it read
  • source
  • record id: automated-verification-of-network-2022
• Automatic Test-Case Reduction in Proof Assistants: A Case Study in Coq (2022)
  • what: Coq-specific test-case reducer integrated into compatibility-testing workflows. Repeatedly transforms a failing development while testing that it still fails under the changed Coq version and passes under the baseline. Uses proof admission, definition-block deletion, module/name handling and dependency inlining to obtain smaller self-contained reproductions. Deployment study measures reduction outcomes; the reducer itself is not formally verified. Explains the behavioral oracle, admission/transparency pitfalls, section dependencies, inaccurate globalization metadata and non-linearizable global state. Separates initial-run success, standalone success on a smaller measured subset, elapsed workflow time and final compilation time. Provides exact denominator accounting and explicitly rejects using its evolving-tool observational results as a comparative benchmark.
  • limits: Reverse dependency compatibility testing (RDCT) uses external projects as tests of a modified proof assistant. Standard reducer oracle is baseline success and modified-version failure with a normalized matching error message. That preserves a chosen symptom, not a proof of identical root cause or semantic equivalence between original and reduced files. Error matching deliberately groups universe inconsistencies, forgotten-universe errors and unsatisfied-constraint errors, ignores filenames/positions/wrapping and often numbering. It preserves numeric information for universe-instance length errors. Such relaxations trade reduction freedom against possible slippage to another bug. Replacing proofs with Admitted, Admit Obligations or an existing axiom is intentional for debugging. A reduced file with admissions is not a newly verified theorem or a successful proof-generation outcome. A kernel-acceptance bug needs an explicit observable test symptom, not merely a generic compiler error oracle. Greedy syntax-unit and definition-block removal can stop at local minima; minimal means reduced under tested heuristics, not globally shortest or a proved minimal reproducer. Program obligations, modules, imports and section variables create dependencies that single-line deletion misses. Coq cannot fully isolate every global setting when files are inlined. Module wrapping, selective name resolution and trying alternate insertion positions are heuristic workarounds; no guarantee exists that every dependency tree can be flattened while reproducing behavior. Globalization .glob metadata is incomplete/inaccurate, including missing tactic and notation resolution. The implementation selectively resolves Require/Import/Export and lets Coq handle other names; it does not use a complete verified Coq parser or resolver. Production bot automatically PROPOSES minimization after internal tests pass and external tests fail relative to a successful base. §9.1 describes a comment from someone triggering the run. Abstract automatic-trigger phrasing should not be read as unattended execution of every CI failure. Six-hour GitHub Action timeout causes restart from the latest reduced file. A retry can repeat indefinitely if no progress is made before timeout. The study includes four manually cancelled loops; retrying is not itself evidence of eventual completion. Dataset is observational, selected by developers requesting minimization, excludes PRs opened by first author, and deduplicates to first trigger per PR/project. Tool changed in response to these same cases. This is feasibility evidence, not a fixed-version unbiased comparison against alternative reducers. Standalone means no dependency beyond Coq standard library, not no dependencies whatsoever. 89% uses only 47 recent SUCCESSFUL runs with inlining metadata; detailed size/time/ratio results mostly use 42 known standalone cases. These are distinct from all 191 requested first runs. Elapsed reduction duration includes queue/VM setup, not pure reducer CPU time. Final-case compile time comes from reducer header estimates, not a new independently controlled rerun. Hardware, language-version-specific controls and dispersion are not given here. Record reads the publication, not supplementary CSV/Jupyter code or current repository behavior. No efficacy measurement on Verus, Rust, TLA+ or LLM-generated specifications/proofs is reported; generalization to other assistants is an author expectation.
  • how much was read: most of it read
  • source
  • record id: automatic-test-case-reduction-2022
• Automating cutoff proofs (2022)
  • title: Automating and Mechanizing Cutoff-based Verification of Distributed Protocols
  • what: Formalizes cutoff-based verification for parametric distributed protocols in the Relational Modeling Language (RML). A finite cutoff instance is sufficient when every safety violation in any larger instance can be simulated by a trace of the cutoff; the paper encodes this simulation in first-order logic and uses SMT to check it. The paper gives initial, step, and safety simulation conditions and a first-violation refinement that removes the need to simulate behavior after a violation. A backward static analysis starts from instantiated negated safety clauses, follows action updates into guards to a fixed point, and emits the relevant action set, simulation relation, and lockstep. In the sharded key-value example, the analysis reduces eight actions to four and proves a two-node cutoff. The implementation checks the formulas with Z3 and handles seven protocols: four cutoffs are synthesized automatically; three require small manual changes. Two-phase commit exposes a limit: universally quantified guards force actions of all larger-instance nodes into the simulation, requiring an extra failure-simulating node and constraints.
  • number: 7 protocols
  • number: 4/7 automatic synthesis; 3/7 small manual changes
  • number: 20–40 ms per protocol
  • number: 2-node sharded-key-value cutoff
  • limits: RML domains are finite per instance but may have infinitely many valid interpretations; safety properties are assumed universally quantified. The result is for safety, not liveness. Cutoff correctness depends on a simulation relation for every valid larger interpretation and on a safe finite cutoff. Automatic synthesis can fail when universal guards or side effects conflict, as in two-phase commit, and the basic key-value store needs an added precondition.
  • how much was read: most of it read
  • source; notes: Cutoff automation with seven concrete protocols
  • record id: automating-cutoff-proofs-2022
• Bapanapally and Gamboa Banach–Tarski 2022 (2022)
  • title: A Complete, Mechanically-Verified Proof of the Banach-Tarski Theorem in ACL2(R)
  • what: Reports a complete ACL2(R) formalization of Banach–Tarski: a finite partition of the unit ball can be moved by rotations into two copies of the ball. Encodes reduced words as lists, proves a faithful free rotation group, chooses canonical orbit representatives, removes countable poles, then handles radial extension and the origin. Paper lists five subsets for the sphere minus poles decomposition,14 for the sphere, and 52 for the ball. Provides concrete Lisp definitions/theorem statements and archived source pointer, but no runtime/proof-size benchmark or fresh certification log. Follows every construction and printed code listing, including strengthened defchoose representative consistency, enumeration of poles/bad angles, origin absorption via arbitrary-axis rotations, matrix closure/inverse/distance lemmas and exact final theorem forms. Distinguishes a mathematical existence proof with noncomputable choice from an executable geometric algorithm; records abbreviated hints/unions and two prose slips without extrapolating them into failures of the linked formal artifact.
  • limits: The theorem is about abstract non-measurable subsets of the real unit ball, not physically cuttable pieces or a volume-doubling program. It relies on an Axiom-of-Choice mechanism and prior non-denumerability of real intervals. ACL2(R) extends ACL2 real reasoning via non-standard analysis. The paper cites existing formalized matrix algebra, modular arithmetic, trigonometry and uncountability; this reading does not audit their foundational implementation or consistency (§1,§7). Infinite sets are represented extensionally by membership predicates, not allocated data structures. Existential predicates use defun-sk with witness functions; defchoose with :strengthen t selects a common representative for all inputs in the same orbit equivalence class. Canonical consistency is essential to disjointness; an arbitrary unrelated witness per input would not suffice. These choices establish logical existence and need not compute a constructive enumeration of all chosen points (§2,§5.1). Words use four character encodings for a,a^-1,b,b^-1; weak words allow adjacent inverses, reduced words do not. word-inverse reverses the word and swaps each letter with its inverse. word-fix recursively cancels inverse neighbors and compose fixes concatenation. Closure, associativity and inverse are shown as defthmd statements; the empty list is identity. The reduction/isomorphism invariants make an abstract group argument tractable as list induction (§2,Listings1–5). Corollaries 1–3 partition all reduced words into identity plus four leading-letter classes and reconstruct the whole group as a^-1W(a) disjoint-union W(a^-1), and similarly for b. This is the algebraic source of two reconstructions. It does not by itself prove a partition of physical ball pieces; later arguments transfer it to a free group action (§2). §2 PDF 5 prose says the witness word-a for x=compose(a^-1,word-a) is a^-1x. In the stated no-leading-a^-1 case the witness should be ax. Reader example x=b: compose(a^-1,ab)=b, whereas compose(a^-1,a^-1b)=a^-1a^-1b. This is a printed explanatory slip, not evidence that the formal corollary is false or its certified proof fails; no linked source was run (§2 PDF 5). Rotation generators A± rotate about x and B± about z with cos 1/3 and sine ±2sqrt2/3. array2p stores real 3×3 matrices. rotation maps a reduced word to the product of corresponding matrices. Faithfulness is shown using image of(0,1,0), rescaling coordinate x/z by 1/sqrt2 and all coordinates by 3^|w| to obtain integers. Nonempty reduced words yield a nonzero mod 3 triple; base cases 4 and inductive letter-pair cases 16 underpin nonidentity and injectivity (§3). Definition 4 characterizes rotations by 3×3 real matrix, inverse=transpose,determinant1. New helpers compute determinant and inverse; Lemmas 5–12 establish multiplication closure/determinants/identity/inverse laws, rotation product/inverse closure and distance preservation. Lemma12 uses x^T x and R^T R=I, without a geometric determinant argument. These are exact real algebra statements, not floating-point error guarantees (§4). D consists of unit-sphere points fixed by a nonidentity group rotation. Its complement is invariant under group action, proved by conjugation: if r(p) is fixed byrw, then p is fixed by r^-1 rw r. Choosing one representative M per orbit outside D transfers the word partition to disjoint representative-rotation classes. Intersection of two distinct classes would imply a nonidentity rotation fixes a point outsideD, a contradiction (§5,§5.1). Listing 6 reports five disjoint sets covering S²−D and two reconstructions from transformed class pairs. The printed iff/or statements express coverage/equivalence; disjointness is argued in prose and depends on separate properties. Listing 6’s conjunction-free union formula alone does not constitute the whole partition proof. Paper explicitly describes witness and orbit-consistency reasoning rather than reducing the result to a finite test (§5.1). For each nonempty reduced-word rotation, symmetry would force rotation=its inverse, contradicting faithfulness and the free group’s absence of nontrivial self-inverse words. Thus skew-entry vector(m32−m23,m13−m31,m21−m12) has nonzero normK. Its normalized positive/negative vectors are exactly the two unit-sphere poles. Enumerating all finite words and both poles yields coverage of D, even though generation includes weak words/duplicates; countability only needs a covering sequence (§5.2). Uncountability yields an axis point outsideD. General rotation-3d supports angle addition and iteration. Bad angles that send some pole to another after a positive number of rotations are countable via pole pairs and integer indices. A good angle yields pairwise-disjoint translated copiesD,RD,R²D,…; with E their union, RE=E−D. This countable shift absorbs the poles and transfers the paradoxical decomposition from S²−D to S² (§5.3). §5.3 PDF 11 says alpha is uniquely determined by p1,p2,n, but its own alpha=(2πk+beta)/n expression also depends onk. For fixed n there may be several roots in[0,2π). The argument enumeratesk as well as n/pole pairs, so uniqueness over onlyp1,p2,n is unnecessary and overstated; countability survives finite/countable multiplicity. This reading does not infer a formal-artifact defect from that prose statement (§5.3). Listing 7 shows14predicate classes covering the sphere and two displayed six-term reconstructions; proof hints are elided. Count14is the displayed construction’s author-reported size, not a claimed minimum number of Banach–Tarski pieces. Union equivalences and rotations in the paper must be read with the stated disjointness/construction arguments, not as a standalone complete certification transcript (§5.3,Listing 7). For nonzero points of the ball, p maps to p/||p|| on the sphere; linear rotations preserve radial scaling. Thus sphere pieces lift along radii to B³−{0}. The origin needs a separate transformation since every origin-axis linear rotation fixes it. rotation-about-arbitrary-line combines translation and rotation about an off-origin axis close enough that the entire origin orbit stays inside the ball (§6). Off-origin rotation is shown to return an R³ point, have zero-angle identity, compose by angle addition, and keep the chosen origin orbit insideB³. Return-to-origin angles requirecos(nθ)=1, hence rational multiples2πk/n. Uncountability supplies a nonreturn angle. Z = {R_(l,nalpha)0:n∈N} givesRZ=Z−{0}, allowing the same shift/absorption strategy to restore the origin. Listing 8labels 52 sets and three ball equivalence theorems, but abbreviates several terms and all hints (§6). Evaluation is formal construction and authors’ reported machine acceptance in ACL2(R), with source link and Software Heritage archive. There are no empirical benchmark datasets, theorem-generation agents, success-rate comparisons, proof-checking times, memory figures, source line counts or person-effort measurements. Printed listings give concrete definitions and obligations but include ellipses, so this paper reading is not a fresh reproduction of all event admissions (§§1–7,Listings5–8). Source pointer https://github.com/acl2/acl2/tree/master/books/nonstd/nsa/Banach-Tarski and archive swh:1:dir:964ff589fe9739a46201bbeac71a6733aa4f274b establish where the authors locate the formalization. Reusable rotations.lisp and countable-sets.lisp are identified in§7. This reading does not certify current master contents, exact checker version/options, absence of unsound admissions or a full dependency closure; the paper supplies no reproduced audit log. No distributed protocol, concurrency/liveness model, Verus, verified Rust, TLA+or LLM agent is evaluated. Transfer to the human’s topic is methodological: specification representation, explicit witness/choice assumptions, intermediate algebraic invariants and replayable named theorem artifacts. Whether these encodings improve LLM proof generation or system verification is untested.
  • how much was read: most of it read
  • source
  • record id: bapanapally-and-gamboa-banach-tarski-2022-2022
• Bayesian HyperPCTL* SMC (2022)
  • title: Bayesian Statistical Model Checking for Multi-agent Systems using HyperPCTL*
  • what: Presents Bayesian statistical model checking for probabilistic HyperPCTL* over DTMCs. A multidimensional Bayes test handles joint probabilities; an approximate Bayes test bounds parameter error when recursively sampled nested subformulas are uncertain. BayesSMC propagates Type-I/II errors, uses top-down on-demand sampling, and is implemented in HyProVer alongside an SPRT comparator.
  • number: HyProVer Python toolbox, macOS Big Sur quad-core i7, 16 GB RAM, 50-run averages, 30-minute timeout. For collision avoidance, Bayesian method decided all tested n=4–10 cases in 0.019–0.382 s with 8–8,786 samples where SPRT often exceeded 1,800 s or remained undecided. For nested goal reaching, Bayesian completed in 0.216–6.316 s with 16–62.72 samples; SPRT never completed within 30 minutes.
  • limits: Finite DTMCs, finite-bounded until operators, independent path samples and Beta priors (uniform for comparisons). Approximate testing has an indifference region near expanded/reduced hypothesis boundaries and requires nonempty reduced sets; guarantees are probabilistic, not exact. Experiments use two-robot grid worlds and no public HyperPCTL* checker comparison.
  • how much was read: most of it read
  • source
  • record id: bayesian-hyperpctl-smc-2022
• BlueCov/JBMC coverage integration (2022)
  • title: BlueCov: Integrating Test Coverage and Model Checking with JBMC
  • what: Introduces BlueCov, a Java bytecode coverage tool that consumes JBMC’s own coverage goals, instruments exactly those bytecode locations, records runtime hit counts and feeds uncovered goals back to JBMC for incremental test generation. This avoids criterion mismatches and redundant tests when formal test generation augments an existing suite. JBMC translates Java bytecode through CProver GOTO, inserts assert(false) goals for location/branch/path/MC-DC criteria, and synthesizes inputs; a greedy subset-cover heuristic minimizes generated tests. BlueCov takes JBMC’s JSON goals, instruments bytecode with ASM 6 using bytecode indices, records hits in an in-memory map, persists them with MapDB and uses a JVM shutdown hook. A FloatTools.sign example maps nine goals to three existing tests, then uses a NaN input to reach otherwise apparently dead code and complete coverage. The implementation discusses Java interfaces, erased generics, modeled JCL functions, exceptional termination, Maven integration and the difference between source lines and bytecode goals.
  • number: JBMC location coverage generates 9 goals for FloatTools.sign
  • number: 3 existing tests before augmentation
  • number: NaN test reaches previously uncovered goal 9
  • number: ASM 6 instrumentation
  • limits: Coverage is defined by JBMC’s bytecode model, so model/library approximations can differ from deployed JVM behavior; unsupported or nondeterministically modeled JCL functions may reduce precision. Test generation is NP-hard subset cover approximated greedily and object construction is proprietary/outside the paper. BlueCov records coverage rather than percentages, and persistence depends on shutdown-hook execution. The work demonstrates tool integration and one small example, not proof that generated tests establish functional correctness or broad industrial scalability.
  • how much was read: most of it read
  • record id: bluecov-jbmc-coverage-integration-2022
• Candle: A Verified Implementation of HOL Light (2022)
  • what: A HOL Light-like interactive theorem prover whose soundness theorem reaches from higher-order-logic inference rules through source/kernel/REPL/compiler to modeled machine-code execution. Exported statements on a dedicated kernel-controlled channel must encode derivable HOL sequents and contexts. Implements runtime compilation of user declarations using CakeML Eval,with safety and datatype-protection proofs in HOL4. Combines a prior verified HOL kernel with whole-program simulation preserving soundness-critical values,syntactic restrictions that protect constructors/references/export channels,an interactively verified Eval-based REPL,and in-logic compilation. Distinguishes unverified user-customized display/input behavior from a verified invertible theorem-export format. Shows actual HOL Light-style sessions and documents incompatible language/library features and required wrappers.
  • limits: Top theorem is conditional on repl_ready_to_run:the generated code is installed in the prescribed machine state with correct entry point and FFI setup,plus other compiler/runtime premises hidden in that predicate. It is a theorem about machine_sem with basis_ffi,not a proof of physical processor/OS behavior or arbitrary binary loading. Guarantee concerns special kernel_ffi events. Ordinary stdout can contain any theorem-looking string;pretty printing is customizable and mostly unverified. Only the protected export,which includes a recoverable context and sequent,has the stated semantic guarantee. Logical result is THM ctxt th:derivability in the encoded HOL calculus relative to a context,connected through prior kernel/semantic soundness work. It does not establish that a human’s intended theorem was faithfully parsed/formalized or that arbitrary printed prose is true. Safe declarations cannot directly call protected constructors or kernel FFI,and cannot obtain writable kernel references;pattern matching and kernel-function calls are allowed. Runtime checks,environment/type-stamp freshness and valid-state invariants protect this boundary. Unrestricted native code/unsafe operations are not granted to arbitrary users. REPL theorem rules out Fail,meaning a stuck/type-error behavior in the formal semantics. It does not guarantee termination,successful compilation of every declaration,absence of exceptions,resource sufficiency or eventual theorem production. Compiler refinement permits early resource-limit exits. REPL functional input-output correctness is deliberately not proved. A parser,quote filter or pretty-printer could choose the wrong intended statement while the exported formal sequent remains sound. Verifying safety suffices for this soundness theorem,but not for full user-interface equivalence. Eval is integrated into CakeML compiler/proofs but not typeable in the source type system used to validate user code;users therefore cannot mention Eval. Its detailed verification is deferred to another publication. Current top-level proof uses interactive reasoning rather than ordinary whole-REPL type inference. 2022 HOL Light library port is incomplete. Some record-using files omitted;open/include unsupported,polymorphic comparison/hash rewritten or removed,value restriction affects code,and parser needs explicit arguments in let rec. No drop-in compatibility/completeness theorem or performance study is reported. Proofs developed in HOL4 depend on the correctness of the host prover and formal logic/machine/compiler/FFI models. The paper uses prior kernel,CakeML compiler/type-inference/bootstrap results;it does not independently re-prove their entire development here.
  • how much was read: most of it read
  • source
  • record id: candle-a-verified-implementation-2022
• Counterexample-Guided Prophecy (2022)
  • title: Counterexample-Guided Prophecy for Model Checking Modulo the Theory of Arrays
  • what: Introduces Prophecize, which adds history and frozen prophecy variables during CEGAR refinement to target array terms at future time steps. The array abstraction and refinement reduce many quantified, array-valued invariant proofs to quantifier-free, array-free reasoning, implemented in prophic3. The paper proves soundness and no false positives for the refinement, describes weak versus strong array abstraction, unsat-core filtering of axioms, large-value abstraction, and a pre-state-property heuristic. The approach needs only a small number of relevant index instantiations close to a potential violation; prophecy variables average 1.2 (median 1) on solved quantified cases.
  • number: freqhorn: 81 benchmarks, prophic3 66 Q / 5 QF / 0 US
  • number: quic3: 43 benchmarks, 41 Q / 0 QF / 0 US
  • number: vizel: 33 benchmarks, 22 Q / 3 QF / 1 US
  • number: CHC-COMP-2020: 501 benchmarks, 42 Q / 159 QF / 56 US
  • limits: Termination is not guaranteed when no finite Prophecize calls capture all relevant indices. Array axiom enumeration assumes an infinite index domain. Performance is sensitive to transition-system encoding; SeaHorn translations solved 6 quic3 benchmarks versus 41 with direct Kratos2 translation. The method’s existential power is weak because history variables only retain finite delays, and it is not expected to work well for parameterized protocols without improvement.
  • how much was read: most of it read
  • record id: counterexample-guided-prophecy-2022
• decentralized shielding (2022)
  • title: Shield Decentralization for Safe Multi-Agent Reinforcement Learning
  • what: Defines decentralized multi-agent shielding and decomposes a centralized DFA shield into per-agent shields that require no communication while preserving safety. The paper identifies two requirements for communication-free shields: Cartesian safe action sets so any combination of local choices is safe, and unambiguous local state transitions inferable from each agent’s label and action. Algorithm 1 starts from one safe joint action, greedily adds individual actions only when the induced Cartesian set is safe and next-state mapping remains unambiguous; Algorithms 2–3 compile these sets into transient and interface-compatible individual shields. Theorem 1 proves safety preservation for environments with all actions enabled. If the input shield is Cartesian and unambiguous, the result is maximally permissive; otherwise it is at least the trivial one-action solution. Gridworld experiments retain 22.07 of 23.30 average safe joint actions, and Q-learning obtains zero violations; a momentum particle task shows zero violations even under partial observability.
  • number: Theorem 1 safety preservation under E(s)=A
  • number: gridworld 23.30 centralized vs 22.07 decentralized safe joint actions
  • number: 2.5 million training steps, 240 agents, 10 seeds/configuration
  • number: particle shield 21.67 vs 20.81 average actions
  • limits: Safety depends on a correct environment abstraction, a centralized shield, and shared labels independently computable by every agent; theorem assumes E(s)=A. Decentralized synthesis is generally hard or undecidable, so the method decomposes an existing shield and makes order/arbitrary choices that affect permissiveness. State explosion is severe (71,130 gridworld and 170,348 particle shield states before reduction); asymmetric observations may lack a shared label set. Evaluation is simulated tabular Q-learning/DQN, not physical systems.
  • how much was read: most of it read
  • record id: decentralized-shielding-2022
• Endive (2022)
  • title: Plain and Simple Inductive Invariant Inference for Distributed Protocols in TLA+
  • what: Samples candidate lemmas from a predicate grammar the user gives. Checks them on small finite instances. Greedily picks the lemmas that remove counterexamples to the induction step. A separate TLAPS proof is still needed for the protocol at unbounded size.
  • number: Invariant for 25 of 29 protocol benchmarks
  • number: Table I has 30 rows incl. MLDR; 2 rows have no TLA+ translation
  • number: Paper’s Endive rerun in IC3Syn solves 24 shared cases
  • number: endive solved 29 benchmark protocols plus MLDR; MLDR row: 2,025 s, 7,751 CTIs, 1,272 s checking, 651 eliminated, 102 s CTI generation (Table II)
  • limits: The generated invariant is not guaranteed to be truly inductive, because counterexamples are sampled at random. Needs a grammar from the user.
  • how much was read: most of it read
  • source; notes: Endive: TLA+ candidates, followed by an unbounded proof; notes: papers inspected
  • record id: endive-2022
• Event monads in Isabelle (2022)
  • title: Compositional Verification of Interacting Systems Using Event Monads
  • what: Defines event monads, event systems and Hoare rules in Isabelle/HOL, then composes independently verified handlers into correctness results for distributed summation, a German cache-coherence model and real-time partition scheduling. An event monad returns a set of value/state/output-trace triples and a failure flag, supporting nondeterminism, state updates, signal, bind and while loops. Preconditions and postconditions can depend on traces; an append-only trace frame rule preserves prior output, unlike simply treating traces as arbitrary state. Event systems map events to handlers; unhandled events become environment output, while emitted handled events execute recursively in sequence. Separate inductive reachability and guaranteed-termination predicates support partial/total Hoare rules. Pair and indexed-array lifting rules preserve untouched subsystem properties. The MapReduce model proves that alldone implies the accumulated sum is correct. Cache-coherence proves an invariant ensuring exclusive access for arbitrary N clients. The scheduler case proves watchdog representation refinement, scheduler refinement, their product composition and a final tick-level specification. Both no-switch and next-tick/next-window/next-frame switching cases reuse the watchdog proof.
  • number: 8948 total implementation/example lines
  • number: 1131 foundations; 726 MapReduce; 1261 cache coherence
  • number: 2572 watchdog lines reused by both scheduler versions
  • number: 723 no-switch scheduler; 2265 switching scheduler/system
  • limits: Interactions send events without waiting for immediate replies; all output events may be placed at function end. Handlers and the recursive event-dispatch semantics execute sequentially, so this is not a general concurrent interleaving or network-failure model. Unhandled events are delegated to the environment. Termination must be proved for recursive event chains and loops; MapReduce permits a server to skip progress forever and proves correctness conditional on alldone, not eventual completion. RTOS verification is at design level: parts resemble C, but AutoCorres C translation is not used; the concrete doubly-linked watchdog is abstracted to a list/array of relative deadlines. Case studies demonstrate functional correctness/refinement, not measured end-to-end implementation performance, schedulability for arbitrary workloads, or spatial separation of an entire OS.
  • how much was read: most of it read
  • record id: event-monads-in-isabelle-2022
• Felli-Montali-Winkler CTL-star DDSA (2022)
  • title: CTL* model checking for data-aware dynamic systems with arithmetic
  • what: Introduces a finite-history-constraint abstraction and CTLf model-checking procedure for data-aware dynamic systems with arithmetic (DDSAs), synthesizing initial-variable conditions for branching-time properties. The procedure recursively reduces CTL subformulas to LTL checks over configuration maps, computes history constraints with quantifier elimination, and terminates when finitely many constraint formulas exist up to equivalence at the property quantifier depth. This criterion yields decidability for rational/real monotonicity constraints and integer periodicity constraints, while a two-counter-machine reduction proves feedback-free and bounded-lookback systems remain undecidable for branching time. The ada prototype accepts DDSA or bounded Data Petri Net models, calls CVC5/Z3, returns configuration maps and product graphs, and reports detailed SMT counts and runtimes on mined and normative business processes.
  • number: road-fines runtimes 7.0 s to 15m27s
  • number: hospital billing 20m59s and 1,234,928 SMT checks
  • number: sepsis normative 1m36s and mined 7m24s
  • number: road-fine deadlock property false for mined and normative versions
  • limits: Semantics are finite-trace CTLf, chosen for terminating business processes; infinite-trace CTL is outside the procedure. Decidability requires finite history-constraint sets up to equivalence, guaranteed for MC over Q/R and IPC but not generally decidable itself. Integer MC loses quantifier elimination, and feedback freedom/bounded lookback do not suffice. Runtime grows with product constructions and SMT checks; reported benchmarks are bounded DPNs and a Python prototype.
  • how much was read: most of it read
  • record id: felli-montali-winkler-ctl-star-ddsa-2022
• Felty biological neuronal archetypes ITP 2022 invited talk (2022)
  • title: Modelling and Verifying Properties of Biological Neural Networks
  • what: Felty summarizes joint work with Abdorrahim Bahrami and Elisabetta De Maria on small biological neuronal circuits. Boolean spiking/leaky integrate-and-fire models support automatic checks of fixed instances in Lustre/Kind2 and general parameterized proofs in Coq. The synopsis reports delay, filtering and a delay-or-filter classification result; it does not print theorem statements with complete hypotheses or derivations. The body identifies weighted graph/discrete-time/leak-factor semantics, series and activation/inhibition loops, concrete meanings of delay/filter behavior, fixed parameters in earlier model-checking examples, and Coq dependent-record/induction/list/rational-number methods. It distinguishes a claimed general proof from fixed-instance checks without claiming that all Kind2 verification is inherently bounded.
  • limits: Biological neuronal micro-networks are modeled, rather than trained artificial neural networks. A neuron is one graph node; synaptic connections are weighted directed edges. Boolean spikes and leaky integrate-and-fire membrane potential update at discrete time steps. Inputs and leak factor influence temporal window. Article gives prose semantics, not full recurrence, reset/threshold formulas or all admissible parameter constraints (§1,p.1:1). Archetypes are small circuits implementing functions, composable as building blocks. Cases include single neuron, linear neuron series, and two-neuron loop with activating or inhibiting connection. Composition is motivation; no theorem for arbitrary assembled networks is printed. Claims apply to this abstract model, not independently validated human physiology (§1,pp.1:1–1:2). Delayer: under unspecified conditions, single neuron/series reproduces input after some delay. Filter: under unspecified conditions, no spikes on consecutive steps. Author also reports every neuron exhibits either effect; synopsis omits formal quantifiers, conditions and whether alternatives overlap. Reader does not infer an unconditional exhaustive theorem for every biological cell or circuit. Properties identified in discussions with neurophysiologists, not established here by biological experiments (§1,p.1:2). Earlier De Maria work models networks/properties in Lustre and checks automatically with Kind2. Author says examples fix series length, time steps, input sequence, leak and other potential parameters. Coq work states properties generally over those parameters, using dependent records, structural induction, case analysis and list/rational libraries with limited automation. Any-values phrase remains conditioned on model/theorem assumptions omitted here. This comparison concerns cited studies, not a universal limitation of model checking (§1,p.1:2). Comparison on fixed property set is cited to Frontiers of Computer Science16(3),163404 (2022), but synopsis supplies no comparison table, proof count, timings, code/statement sizes, failure rate or automation benchmark. No proof script, replay log, experiment dataset or full formal proof printed. Reading this entire two-page document does not count as reading cited CSBio2018/2017, HSB2016 or other full studies. Medical treatment, inactive-region detection and extension to regulatory/metabolic/environmental networks are proposed goals, not evaluated outcomes (§1,References). Reader inference: relevant as a compact example of separating bounded instance evidence, parametric theorem statements and model adequacy. No distributed protocol, node fault/network semantics, Verus/verified Rust/TLA+, LLM specification/proof agent or implementation-refinement result is reported. Coq is explicitly used by the cited research; the synopsis alone is insufficient to audit the complete theorem hypotheses or biological validity.
  • how much was read: most of it read
  • source
  • record id: felty-biological-neuronal-archetypes-itp-2022-invited-talk-2022
• FLAQR availability and integrity types (2022)
  • title: Applying consensus and replication securely with FLAQR
  • what: FLAQR is a typed core calculus for composing confidentiality, integrity, and availability policies around remote evaluation, equality comparison, and replicated choice. The paper gives paper proofs of blame soundness, a conditional majority-quorum failure bound, and noninterference; it does not verify a concurrently executing Paxos or PBFT implementation. The substantive addition is a principal algebra with availability authority and partial conjunction/disjunction, plus a fails judgment that follows failures through nested protected types. Quorums arise by composing compare and select rather than being a special type-system parameter. Blame constraints connect an observed failed comparison to possible faulty principal sets. These are language metatheory results in a sequential global stack model, with two worked banking programs rather than an implementation benchmark.
  • number: Four named theorems: sound blame; majority liveness; confidentiality/integrity noninterference; availability noninterference (§VIII, PDF pp.10–11)
  • number: Appendix A prints 33 supporting lemmas, expanded expression/stack typing and operational rules, bracket semantics, an observation function, and the blame-update function (PDF pp.13–31)
  • number: Two worked banking examples and a bracket-typing table; no empirical runtime, throughput, implementation size, test-suite score, verifier result, or machine-checked artifact is reported in this source
  • number: The source reports a 2-of-3 example with a one-principal tolerated fault set. This is a symbolic bound in the calculus, not an observed availability percentage or asynchronous network latency measurement
  • limits: The attacker coalition is fixed before execution but may actively replace inputs, including functions. Availability attacks also require integrity authority because inconsistent values can make compare fail. The majority theorem requires a source term without fail, well typing, a guarded result type, an m/n majority quorum, and a failing execution in the blame semantics. Confidentiality/integrity noninterference is restricted to terminating successful value observations; availability noninterference equates failure behavior and permits programs that always fail. Global evaluation has no concurrent semantics. This v1 also prints an unfinished-looking instruction and an arity error in the blame function used by its proof.
  • how much was read: most of it read
  • record id: flaqr-availability-and-integrity-types-2022
• Formalising Fisher’s Inequality: Formal Linear Algebraic Proof Techniques in Combinatorics (2022)
  • what: Human Isabelle/HOL formalization of incidence matrices and reusable rank/dimension proof methods, applied to uniform Fisher, Odd Town, generalized constant-intersection Fisher and its dual nonuniform PBD bound. Builds ordered-list/multiset bridges, multiplicity-safe duality, zero-one matrix property transfer, and field-specific linear independence proofs. Gives qualitative library/automation experience and one small proof-length comparison. Records exact type/carrier/distinctness and inherited locale assumptions, repeated-block handling, both proof patterns and all theorem directions, field conversion limits, proof organization, representation/library-search difficulties and evidence limits. Distinguishes reported formalization from independently reproduced checking, and local proof-length example from a benchmark.
  • limits: Finite point set V and finite multiset of blocks B⊆V; design blocks nonempty. Ordered form has distinct point list Vs but permits repeated blocks in Bs. A block occurrence has its own list index. Current AFP proper_design additionally requires b≠0, so v>0; this prevents empty-ground-set/single-empty-block countercases from being imported into the formal generalized theorem. Targeted current sources are not established identical to the archived 2022 snapshot. Incidence matrix has v point rows and b block columns. Constructor polymorphic over ring-1; ordered locale N is integer-valued. Zero-one locale only assumes elements⊆{0,1}, with zero≠one. Replication/block sizes use counts of ones, not field-valued sums; such counts survive field changes even where modular sums differ. Rank multiplication and determinant helper require compatible carrier dimensions and conjugatable-ordered-field, not arbitrary semiring. det(MMᵀ)≠0 yields rows≤columns. Multiple-row/column determinant preservation needs appropriate elementary-operation index/source-target preconditions; printed prose is not an unconditional claim for every parameter/list, e.g. adding a row to itself scales it. Linear-bound general-set uses vectors over a field within carrier-vec nr and linear independence. Matrix lin-bound-argument2 separately assumes distinct columns and nr×nc carrier plus zero-linear-combination implies every coefficient zero; then nc≤nr. Choosing field/type remains user work; arbitrary representation choice and characteristic-map discovery are not automated. lift-01-mat maps zero→zero and every nonzero→one. It is injective on the zero-one element set and preserves combinatorial incidence predicates/counts. It is not globally injective, a general ring homomorphism, or a promise to preserve rank/determinant/arbitrary arithmetic across characteristics. Uniform proof instead uses real-of-int as an injective ring homomorphism. Uniform Fisher is for BIBDs with the locale’s nontriviality/incompleteness/balance assumptions; these imply the positive determinant factors r−λ and r+λ(v−1). It is not a bound for arbitrary pairwise-balanced systems if completeness or positivity hypotheses are dropped. Odd Town requires every block odd and distinct block occurrences to have even intersections, which already excludes repetitions. Generalized Theorem8 fixes distinct subsets with every off-diagonal intersection size k, 1≤k≤n, and concludes m≤n. Formal proper-design theorem also handles zero intersection and single-block cases separately. Proof works over reals, not a field of arbitrary characteristic. Dual nonuniform corollary assumes positive pairwise index λ and every block incomplete in its inherited pairwise-balanced design context; no uniform block-size requirement. Dual numbers original block occurrences as points so repeated equal blocks remain distinct dual points; transpose exchanges incidence, replication/block size, and constant intersections/pairwise balance. Printed dual-is-pbd additionally assumes all original point replications positive and b≥2. Dropping those can leave empty dual blocks or outside inherited balance context. Paper presents reusable lemmas and proof sketches with omitted subproofs, linked formalization and archived snapshot swh:1:snp:6189000751ad63f2df385fc3e5a5fbd2996bc358. Read all printed reasoning, not every underlying Isabelle proof/dependency; no independent build, axiom/sorry audit or complete artifact review. Separate full version not credited. “First” formalization and broad library availability comparisons are authors’ 2022 survey claims. No user study, controlled automation benchmark, aggregate LOC/build-time/performance result or LLM-agent evaluation. SErAPIS/Sledgehammer experience is qualitative; Frankl-Wilson, polynomial-space extensions and technique automation remain future work. Printed Theorem3 converse assumes only a zero-one matrix and positive r/λ satisfying the Gram identity, which does not prohibit zero columns. The theorem’s regular-design terminology also inherits no-empty-block convention from Definition1. The reader two-row matrix counterexample exposes this missing printed restriction; no claim that the underlying formal theorem is false, since its converse source hypotheses were not inspected.
  • how much was read: most of it read
  • source
  • record id: formalising-fisher-s-inequality-2022
• Formalizing the Divergence Theorem and the Cauchy Integral Formula in Lean (2022)
  • what: Formalizes a generalized divergence theorem for rectangular boxes in Lean/mathlib using a distortion-controlled gauge integral (GP). This avoids assuming integrability of each individual partial derivative. The GP theorem transfers to the Bochner integral when divergence is integrable, then yields Cauchy–Goursat and Cauchy integral formulas for Banach-valued complex functions, including countable exceptional differentiability sets. Describes reusable integration infrastructure and proof-design tradeoffs. Records actual derivative/continuity/integrability distinctions, exceptional sets, domain and Banach-space restrictions, partition/filter nontriviality, four integral parameter settings, box-additive abstraction and choice, totalized integrals, proof chain through annulus and disk to analyticity, displayed corollaries, code presentation caveats, and unfinished extensions.
  • limits: §§2.2,2.4,3.2,4.9: Finite-dimensional real domains and real Banach-valued functions. The GP partial-derivative theorem assumes Fréchet differentiability within the closed box outside a countable set and continuity within at exceptional points. Summing diagonal components gives divergence. No separate derivative integrability hypothesis is needed for GP, but full differentiability is stronger than existence of partial derivatives alone. §§3.3,4.10–4.11: The Bochner conclusion additionally requires Bochner-integrable divergence, continuity on the closed box, and differentiability in its interior outside a countable set. Exhausting the interior by smaller boxes removes differentiability requirements on the boundary; a≤b permits degenerate boxes, with both sides zero. The informal Theorem8 says continuity on an open-closed I, but displayed integral_divergence explicitly assumes continuity_on f (Icc a b); retain the formal closed-box condition. §§1–2: Domain shape is rectangular; no theorem for arbitrary elementary regions is formalized here. The comparison with Abdulaziz–Paulson Isabelle Green is the author’s: that result allows broader plane domains and only partial derivatives, while this result allows higher finite dimensions/Banach codomains and weaker derivative regularity. Neither formalization subsumes the other. No independent source-to-source comparison was performed. §3: Gauge δ is point-dependent; Henstock tags belong to their own closed subbox. Riemann uses a constant gauge; McShane allows tags outside their own box but inside the ambient closed box. GP further bounds partition distortion, with its gauge permitted to depend on that bound. Ordinary multidimensional Henstock–Kurzweil/Fubini-compatible generalizations cannot integrate every divergence, motivating the different integral. §3.1: The one-dimensional Henstock–Kurzweil definition and derivative FTC are explanatory background. The author explicitly did not formalize a separate one-dimensional interface; a wrapper over the R¹ box integral is future/easy work, not an existing wrapper demonstrated here. §4.1: Boxes are nonempty products (lower_i,upper_i] with strict coordinate bounds, making partitions disjoint and endpoints uniquely recoverable. Empty boxes use with_bot; intersections and bounding-box joins form a lattice. Face coordinates use fin.succ_above, with distinct front/back embeddings. Degenerate domains enter later through the generalized theorem, not the box structure. §§4.2–4.3: One prepartition structure plus is_partition predicate permits shared operations and filter lemmas. The author is unsure about this design because proofs must carry the predicate. Tags are total functions on all boxes to avoid membership proof arguments. Extending structures does not automatically inherit namespace lemmas, so one-line wrapper definitions/lemmas are repeated. §4.4: Cousin’s lemma guarantees subordinate tagged partitions, preventing vacuous integral limits. Nested center splits produce homothetic boxes with the original distortion; a common point and positive gauge give a contradiction. Refining each box and merging preserves union/distortion. These existence results ensure GP filters are nontrivial, rather than merely defining an unrestricted limit. §4.5: Three booleans encode constant-gauge, Henstock-tag and distortion requirements. Riemann=(true,true,false), Henstock=(false,true,false), McShane=(false,false,false), GP=(false,true,true). Filter bases additionally require a complementary prepartition of bounded distortion when applicable. This condition is trivial for full partitions; the author includes it to avoid an extra c>1 side lemma for partial partitions. The design proves common lemmas uniformly but is difficult to extend to other integrals. §4.6: Box additivity means partition sums equal the whole-box value, either globally or on subboxes. Additivity for binary coordinate splits suffices via common hyperplane refinements. Measures, integrals, and upper-minus-lower face integrals instantiate this interface. Complement partitions are obtained by classical choice, not an extraction of an executable partition algorithm. §4.7: The integral is a selected filter limit if integrable and zero otherwise. Therefore an equation involving its value alone is not an existence proof; has_integral/integrable premises matter. Integration supports continuous-linear-map-valued box-additive volumes, but the project uses only measure-scaled vectors; the author calls the unused generality possible overengineering. §4.8: Henstock–Sacks estimates control sums on partial partitions covering the same union, with error ε1+ε2, or compare a partial sum with a sum of subbox integrals within ε. The convergence gauge packages hypotheses. This yields restriction to subboxes and box additivity uniformly across the four integral settings. §4.9 proof: Differentiability gives a local linearization error controlled by ε times box volume at fixed distortion. At countably many exceptional points, continuity permits summably allocated local errors κ(x), whose sum is <ε/2. This is a countable-point exception, not arbitrary almost-everywhere differentiability or a null-set exception without further hypotheses. §4.10 proof: Bochner→McShane starts with measurable indicators, extends to simple functions, proves invariance under changes on measure-zero sets, and approximates an integrable function by simple functions. The displayed transfer theorem uses a locally finite measure and bRiemann=false; it does not imply every Bochner function is Riemann integrable or conversely characterize Bochner integrability. §5: Complex results use a complex Banach codomain with second-countable topology, required by this mathlib Bochner setup. Continuity on closed domains and complex differentiability off a countable interior set suffice. No continuous derivative assumption is introduced. Annulus results require 0<r≤R; center disk formula uses R>0; disk Cauchy theorem permits R≥0. §5 proof chain: A real vector field (−if,f) has zero divergence by Cauchy–Riemann, giving rectangular Cauchy–Goursat. Applying it to e^z f(c+e^z) on a logarithmic rectangle gives equality of annular circle integrals. Apply this to f(z)/(z−c) and shrink the inner radius for the center formula. Applying the center formula to (z−c)f(z) gives the disk theorem. A removable difference quotient gives the formula at arbitrary w, extended to exceptional w by continuity. Cauchy coefficient integrals then give power-series analyticity. §5,p17: Displayed later theorems include a removable-singularity criterion using a punctured-neighborhood little-o condition relative to (z−c)^−1; a maximum-modulus boundary bound on a bounded U with differentiability and closure continuity; Liouville for entire bounded range; and Schwarz for a disk self-map fixing0. The paper lists statements and links, not complete proof scripts for all corollaries. §1,p3/§4: Author reports all results in mathlib master at publication. Names and notation in listings are changed for exposition and some proof bodies are omitted, so the printed snippets are not a standalone compilable artifact. Links redirect through an author-maintained site and may be updated to newer master. No fixed commit, proof-size counts, compilation times, benchmark comparison, or independent rerun is reported in this reading. Presentation discrepancies: The §5 prose calls a ≤-bounded rectangle open; the integral_divergence statement provides the relevant continuity hypotheses. The displayed GP divergence face expression omits the component projection that is explicit in the later Bochner formula; the paper’s own notation/renaming caveat means source code would be needed for a compile-level audit. Preserve these limits without claiming a kernel defect. §6: Other integral definitions permitting countable coordinate-hyperplane exceptions, multivariable complex analysis, arbitrary-domain Cauchy–Goursat, and Ilyashenko’s finite-limit-cycle theorem are plans rather than completed results here. Additional topological lemmas and a refactor of the fixed boolean parameter interface are identified obstacles. No distributed protocol, Verus, verified Rust, TLA+, or LLM agent is evaluated. Evidence concerns mathematical mechanization and reusable proof-library design. Paper-reported formalization is distinct from independently checking the artifact.
  • how much was read: most of it read
  • source
  • record id: formalizing-the-divergence-theorem-2022
• From Bounded Checking to Verification of Equivalence via Symbolic Up-to Techniques (2022)
  • what: Develops Hobbit, a bounded-complete checker/prover for contextual equivalence in a simply typed higher-order language with local state. Fully abstract symbolic environmental bisimulation is combined with up-to separation, re-entry and state-invariant techniques, plus symbolic first-order transitions and Z3. The paper defines λimp operational semantics and symbolic LTSs, proves soundness/completeness of symbolic transitions, and formalizes three novel up-to techniques that finitise otherwise infinite bisimulation graphs. Manual annotations express relations between paired states. Evaluation on 105 equivalences and 68 inequivalences quantifies each technique, while examples include Meyer–Sieber location passing, swap functions and classical re-entry cases.
  • number: 105 equivalences and 68 inequivalences
  • number: default bound 6; maximum bound 348
  • number: 72/105 equivalences proved with all techniques; 3/105 with all off
  • number: 68/68 inequivalences found with techniques on
  • limits: Contextual equivalence is undecidable, so up-to techniques are incomplete and bounded exploration may return inconclusive. λimp omits reference types as values; location exchange is encoded by function pairs. User annotations can be wrong, and synchronised internal recursion/well-bracketing are unsupported.
  • how much was read: most of it read
  • record id: from-bounded-checking-to-2022
• Hage et al. SMC4PEP (2022)
  • title: SMC4PEP: Stochastic Model Checking of Product Engineering Processes
  • what: Introduces SMC4PEP, which converts pool-based or event-based BPMN product-engineering processes into PRISM Markov Decision Processes, removing redundant processes and replacing cross-abstraction message flows with events to reduce model size while preserving stochastic, timing and reward analyses. The architecture has differentiator, converter and generator stages. The converter eliminates exactly identical processes, removes pools/message flows and inserts events; the generator builds one PRISM module list per diagram and adds timeline rewards. Two automotive OEM cases compare pBPMN and eBPMN models: event-based models reduce states/transitions substantially, including orders-of-magnitude reduction in the four-level case, though one build time increases. PRISM checks A-SPICE properties for deadlock freedom, objective fulfillment and conformance, plus minimum duration and expected cost. The authors explicitly acknowledge state-space explosion and rely on model minimization as future mitigation.
  • number: case 1 level-2 reduction 33.8% states and 40.7% transitions
  • number: case 1 level-3 reduction 67.78% states and 73.11% transitions
  • number: case 2 pBPMN 9.3×10^16 states versus eBPMN 1.7×10^10
  • number: case 2 pBPMN 1.4×10^17 transitions versus eBPMN 1.9×10^11
  • limits: Evaluation assumes pBPMN cross-level communication by merging diagrams to obtain a comparison baseline, which is not how real processes work. Cases are two OEM processes on one Core i7/Windows 10 setup. Identical-process elimination requires equality of all tasks, events, gateways, roles and flows. Results concern generated MDP size and PRISM properties, not proof of converter correctness or preservation beyond the stated semantic construction; state-space explosion persists.
  • how much was read: most of it read
  • record id: hage-et-al-smc4pep-2022
• Hoare calculus for reconfigurable distributed systems (2022)
  • title: Reasoning about Reconfigurations of Distributed Systems
  • what: Develops a Hoare-style calculus for programs that create/delete components and connectors while finite-state component behaviors continue. A separation-logic-inspired configuration logic uses inductive predicates for unbounded networks; havoc invariants capture interactions in unaffected parts, with an assume/rely-guarantee-style proof system. Defines primitive reconfiguration commands new/delete/connect/disconnect, local programs and frame rule, and havoc semantics allowing loose/tight interactions. Extended regular expressions describe interaction sequences; cyclic proofs establish havoc triples and soundness. Examples prove safety of self-adjustable tree architectures. Automation analysis shows configuration-logic entailment is 2EXP-complete under bounded-degree restrictions, while frame inference remains open.
  • number: No runtime benchmark; contribution is calculus and worked proofs
  • number: CL entailment is 2EXP-complete under stated restrictions (§7)
  • number: Havoc proof soundness established by Theorem 2 (§5.3)
  • limits: The main examples use finite-state event behaviors, ideal networks without packet loss or delays, and exogenous coordination; low-level mutex/CAS coordination is abstracted away. CL entailment is undecidable in general and 2EXP-complete only under syntactic and bounded-degree restrictions. Havoc proof rules require distinctive proof trees and cyclic-progress conditions. Frame inference and broadcast interactions are future work; timed/hybrid behaviors are not modeled.
  • how much was read: most of it read
  • record id: hoare-calculus-for-reconfigurable-distributed-systems-2022
• Holistic Verification of Blockchain Consensus (2022)
  • what: Parameterized model checking verifies binary Byzantine consensus associated with Red Belly Blockchain under n>3t and0≤f≤t. First verifies binary-value broadcast, then substitutes a smaller specification-based automaton into the outer consensus and checks safety and progress properties with ByMC. Agreement and validity do not require the added good-round fairness; termination does. The verified algorithm is the coordinator/timeout-free pseudocode variant under that fairness, rather than a proof of the deployed implementation or its partial-synchrony mechanism. Makes the decomposition concrete: global sent-message counters replace local receive counts; Byzantine effects lower enabling thresholds by f; four temporal broadcast properties support a replacement gadget; round communication closure reduces selected all-round LTL obligations to one-round checking. Manual meta-arguments connect per-superround invariants to global agreement/validity and good-round existence to eventual decision. Gives a fair-round definition, a nonterminating4-process trace, detailed automaton rules, explicit liveness preconditions and measured schema counts.
  • limits: Fixed n sequential processes communicate through reliable fully connected asynchronous point-to-point links; delays are finite but unbounded, steps interleave, each receive is atomic and sender identities distinguish quorum members. Up to t<n/3 are Byzantine; f≤t is the actual fault count. The threshold abstraction assumes faulty senders cannot impersonate arbitrarily many distinct processes. Communication closure is essential: each process uses only messages for its current round, discards earlier tags and buffers later tags. Monotone send counters and threshold guards admit the prior ByMC reduction. Guarantees do not automatically extend to arbitrary protocols with cross-round data dependencies, timing constraints or changing membership. Reliable communication is encoded by progress assumptions on enabled rules and source-location emptiness. This excludes scheduler executions that indefinitely withhold enabled productive actions. Added consensus fairness is different: some round r has every correct process first deliver r mod2 in that round’s binary-value broadcast. Neither fairness follows from asynchronous reliability alone. Algorithm1 is the DBFT variant without coordinator/timeouts. The second DBFT variant uses partial synchrony, but this paper replaces that mechanism with a good-round assumption. It does not prove a synchronizer, coordinator rotation, timeout correctness or that the deployed environment enforces the assumption. Threshold models describe correct processes and abstract Byzantine influence with f-offset guards; global send counters abstract possible local receipt histories. Parameterized checking ranges over symbolic parameters satisfying n>3t≥3f, rather than testing a list of network sizes. Soundness still depends on faithful manual abstraction and ByMC’s reductions/SMT checks. Inner broadcast verification establishes justification,obligation,uniformity and termination. Replacement must preserve all behaviors relevant to the outer consumer because contestants is shared and the outer algorithm can proceed before the broadcast finishes. The paper argues this and supplies encoded preconditions; it is not a machine-checked source-to-source refinement of production code. ByMC handles a restricted LTL fragment and one-round systems. Cross-superround agreement,initial validity and existential good-round termination require manually chosen intermediate formulas and mathematical composition arguments. The model checker does not directly discharge each final quantified formula as written. The proof covers binary agreement,validity and eventual decision for the displayed algorithm. It does not prove blockchain transaction semantics,multi-value reduction,ledger consistency across all block heights,network/cryptographic code,resource bounds or end-to-end behavior of the deployed Red Belly software. Processes continue participating after deciding so others can finish; only the first decision matters. Text states safe exit after two later rounds but does not supply a verified executable stopping implementation. A process that halts immediately on first decision would change progress assumptions.
  • how much was read: most of it read
  • source
  • record id: holistic-verification-of-blockchain-2022
• HyperTree Proof Search for Neural Theorem Proving (2022)
  • what: Introduces HyperTree Proof Search (HTPS), an online proof-search/training method for encoder-decoder policy and critic models. It expands a proof hypergraph by sampling tactics, requires all child subgoals, estimates unresolved leaves, and trains from proof-search outcomes. Evariste improves held-out Metamath/Lean results and adapts to a synthetic Equations environment; reported improvements are benchmark pass rates, not proof semantic judgments beyond each checker. Selection recursively builds partial proof trees rather than one MCTS path; expansion classifies solved/invalid/unsolved nodes; back-propagation multiplies child values under an independence assumption. Policy samples minimal proofs and critic targets solved=1, invalid=0, internal best-action values. Distributed asynchronous provers stream samples into finite queues while trainers refresh models. Online training differs from expert iteration and transductive evaluation intentionally includes statements seen during training. Ablations show minimal-proof filtering, soft critics and stochastic search parameters matter. Supplement findings: Appendix C defines solved/invalid/expandable hypergraph nodes, PUCT and prior-regularized selection, virtual counts, cycle removal and topological multiplicative backup. The implementation discards a tactic if a simulation encounters a cycle and restarts from the root; the authors explicitly acknowledge this may remove valid proofs. Search failure or an invalid node therefore need not mean the mathematical statement is false. Algorithms 1–2 are procedural descriptions, not a completeness theorem. The recovered appendix specifies 12 encoder and 6 decoder layers; encoder dimension 1600, decoder dimension 1024 for Lean/Metamath and 512 for Equations; 600M versus 440M parameters. MASS pretraining uses mathematical arXiv LaTeX, around 6B tokens/40GB. Fine-tuning uses Adam, inverse-square-root scheduling, dropout 0.2 and layer dropout 0.1; online learning fixes 3e-5 after warm-up and alternates supervised and search-generated objectives. Default Metamath/Equations experiments use 16 trainers+32 provers/48 V100 GPUs, with larger experiments excepted. Figure 7 shows asynchronous prover/trainers/controller messaging. These are source-reported settings, not independently exercised. Decoding caps are 512/128/32 tokens for Metamath/Lean/Equations. Per-proof randomized settings are tactic samples {8,16,32,48}, temperature U[0.8,2], length penalty U[0,1.2], expansion budget log-U[1000,10000], depth penalty {0.8,0.9,0.95,1}, exploration log-U[0.01,100]. Evaluation fixes expansions to 5000 Lean/10000 Metamath. Lean subgoal splitting respects shared metavariables and contiguous goal groups. Every tactic proof term is kernel checked, replacing metavariables by lambda abstractions. Version commits are printed in D.5, with Lean tag v3.3.0. This closes the earlier missing-details reading gap. Appendix E.4 reports that early approximate numerical checking let the model obtain 100% apparent accuracy and prove arbitrary statements. Figure 9 gives a false proof of 2=3 via injectivity of exp and underflow of exp(-exp(exp(2))) and exp(-exp(exp(3))) to 0.0. Figure 10 gives a false proof of 0≠0 using cos(pi/2)≈6.123e-17 and repeated square roots to exceed a tolerance. The reported fix restricts automatic numerical checking to exact rational expressions; transcendental inequalities require rules. This documents earlier checker vulnerabilities, not a claim that the reported final Lean/Metamath runs accepted those falsehoods. No independent soundness audit of the Equations checker was done. Equations goals use expression trees and assumption-bearing rewrite/assertion rules. Random walks yield easy, transformation-only proofs; random graph generation adds assertion use and shared subproofs. Identities contains 160 hand-created out-of-domain expressions. Lean export is possible only for rules also present in Lean; 1702 distinct Mathlib statements were converted, with overlapping type categories. Figure 11 supplies two synthetic Lean examples. This is constrained generation/export, not verified translation of arbitrary Equations rules. Table 9 gives selected examples among 144 identities, ordered by first solution, with size and depth for the first and smallest proof found during online training. For sin(2pi+x)=sin(x), size is 353→69 and depth 62→16; for tanh(x)+tanh(y)=sinh(x+y)/(cosh(x)cosh(y)), size 162→144 and depth 95→91. The label Best means smallest found in the reported search, not globally optimal. The caption’s 144 solved identities and inherited main-text 91.3% are retained as separately reported counts rather than silently equated. Figure 12 shows a cleaned proof that 7 does not divide 2^n+1 using modular arithmetic and induction. Figure 13 explicitly says its imo_2001_p6 proof is valid for an erroneous miniF2F statement: natural-number subtraction interprets b+d-a+c as max(b+d-a,0)+c, making the problem easier; the proof fails for the corrected statement. Checker acceptance establishes the formal statement, not that the benchmark formalization captures the intended IMO problem. Rendered Table 6 prints Transformation [74,18,9,8,109], Assertion [90,11,9,0,110], Total [171,29,18,11,219] in Basic/Exponential/Trigonometry/Hyperbolic/All order. Several displayed sums disagree (e.g. Basic 74+90=164, not 171; Hyperbolic 8+0=8, not 11). Table 9 prints cos(x)^2=1+cos(2x)/2 and cosh(x)^2=1+cosh(2x)/2 without grouping the constant in the numerator; at x=0 these printed identities fail. These are presentation discrepancies, not evidence that false printed identities were accepted by the implementation. Source values are preserved without silently repairing them.
  • limits: HTPS treats child-goal solvability as independent when multiplying values; this is a search heuristic,not a theorem about goal probabilities. Policy/critic predictions guide search and do not establish correctness; final proof validity comes from Metamath/Lean/Equations environments. Online training statements can be seen during training. Lean miniF2F-valid58.6% is cumulative pass rate on statements used in online training; test41.0% pass@64 is the cleaner held-out comparison. Metamath valid82.6% is cumulative; test72.4% pass@32 is held out. Equations is a restricted synthetic expression environment. Its training data is generated on the fly, and random-generator statements are solved easily; Identities is the harder online split. The paper does not establish transfer to Verus,Rust,TLA+ or distributed systems. All evaluations are run once; the paper says repeated evaluations would be too costly and reports no error bars. Compute is large:Lean uses32 trainers/200 provers and A100 days in Table2;Metamath uses128 trainers/256 provers and V100s. Code for overall distributed training is tied to internal infrastructure and difficult to open-source. Compared with GPT-f,reported pass rates use different training budgets and protocols. The study is a 2022 benchmark snapshot; no current model comparison or human study. Appendix C defines solved/invalid/expandable hypergraph nodes, PUCT and prior-regularized selection, virtual counts, cycle removal and topological multiplicative backup. The implementation discards a tactic if a simulation encounters a cycle and restarts from the root; the authors explicitly acknowledge this may remove valid proofs. Search failure or an invalid node therefore need not mean the mathematical statement is false. Algorithms 1–2 are procedural descriptions, not a completeness theorem. Appendix E.4 reports that early approximate numerical checking let the model obtain 100% apparent accuracy and prove arbitrary statements. Figure 9 gives a false proof of 2=3 via injectivity of exp and underflow of exp(-exp(exp(2))) and exp(-exp(exp(3))) to 0.0. Figure 10 gives a false proof of 0≠0 using cos(pi/2)≈6.123e-17 and repeated square roots to exceed a tolerance. The reported fix restricts automatic numerical checking to exact rational expressions; transcendental inequalities require rules. This documents earlier checker vulnerabilities, not a claim that the reported final Lean/Metamath runs accepted those falsehoods. No independent soundness audit of the Equations checker was done. Figure 12 shows a cleaned proof that 7 does not divide 2^n+1 using modular arithmetic and induction. Figure 13 explicitly says its imo_2001_p6 proof is valid for an erroneous miniF2F statement: natural-number subtraction interprets b+d-a+c as max(b+d-a,0)+c, making the problem easier; the proof fails for the corrected statement. Checker acceptance establishes the formal statement, not that the benchmark formalization captures the intended IMO problem. Rendered Table 6 prints Transformation [74,18,9,8,109], Assertion [90,11,9,0,110], Total [171,29,18,11,219] in Basic/Exponential/Trigonometry/Hyperbolic/All order. Several displayed sums disagree (e.g. Basic 74+90=164, not 171; Hyperbolic 8+0=8, not 11). Table 9 prints cos(x)^2=1+cos(2x)/2 and cosh(x)^2=1+cosh(2x)/2 without grouping the constant in the numerator; at x=0 these printed identities fail. These are presentation discrepancies, not evidence that false printed identities were accepted by the implementation. Source values are preserved without silently repairing them.
  • how much was read: most of it read
  • record id: hypertree-proof-search-for-2022
• Invariant inference with quantifier alternations (2022)
  • title: Inferring Invariants with Quantifier Alternations: Taming the Search Space Explosion
  • what: Presents a PDR/IC3 invariant-inference algorithm that learns first-order invariants with quantifier alternations. It lifts quantifier-prefix choice to the inductive-generalization level for parallel breadth-first search, introduces k-term pseudo-DNF (k-pDNF) matrices, and combines EPR restrictions, incremental SMT, multi-block generalization and heuristic may-proof-obligations. The IG procedure partitions prefix space into categories/workers, orders prefixes by quantifier depth/alternations/universals/existentials, shares constraints only from immediate sub-prefixes, and interleaves separation with SMT checks of Init and relative inductiveness. k-pDNF represents a negated cube followed by up to k−1 cubes, expressing implication-shaped Paxos lemmas more compactly than CNF/DNF. The complete P-Fol-Ic3 algorithm has learning and heuristic tasks, optional EPR edge restrictions, and solver robustness via restarts, parallel Z3/CVC5, and incremental assertions. Evaluation covers 30 safe distributed-protocol problems, including Paxos variants, with ablations for pDNF, EPR, incremental SMT and multi-block generalization.
  • number: 30 benchmark problems
  • number: 5 trials per algorithm; 16 threads, 20 GiB RAM, 6-hour timeout
  • number: paxos-epr 920 s (5/5), flexible-paxos-epr 418 s (5/5), multi-paxos-epr 4272 s (4/5)
  • number: k=1 universal and k=3 non-universal pDNF settings
  • limits: Benchmarks are safe transition systems with known human invariants; inference success is not a refutation method for unsafe systems. EPR requires a user-provided acyclic set of allowed sort/function edges, and prenex separation may need a special push-down mode. Full FOL search can be intractable; the method failed vertical-paxos-epr and several hardest cases, and stochastic parallelism yields variable success. Experiments use fixed 6-hour timeouts and 16 threads/20 GiB; performance and learned lemmas depend on solver behavior, random seeds and prefix restrictions.
  • how much was read: most of it read
  • source; notes: P-FOL-IC3: full 30-model experiment recovered
  • record id: invariant-inference-with-quantifier-alternations-2022
• IPA compositional TLA+ checking (2022)
  • title: Compositional Model Checking of Consensus Protocols Specified in TLA+ via Interaction-Preserving Abstraction
  • what: Introduces Interaction-Preserving Abstraction (IPA) for compositional checking of TLA+ consensus specifications. Actions are partitioned into modules, dependency/interaction variables are identified, internal actions are abstracted, and each module is checked in a context formed from abstractions of the others. Strong refinement proves that passing all compositional checks implies refinement of the original specification to the abstract one. IPA defines recursive dependency and interaction-variable sets and four abstraction constraints: abstract dependencies cannot use other modules’ locals; interaction updates depend only on interaction/dependency variables; abstract locals avoid other-module locals; and every externally visible action has a mapped abstract action preserving effects. A strong action mapping is used because ordinary refinement does not record correspondence of omitted actions. Case studies identify polling, centralized control-flow and brute-force replacement of performance optimizations as practical patterns. Raft is split into PreVote, Vote and Replication; ParallelRaft merges Replication into LeaderRecovery when it offers little abstraction. The theorem composes per-module refinements into S⇒A.
  • number: Raft ratio 10.3–288.6
  • number: Raft (term=1,cmd=3): 19:12:50 vs 4:02
  • number: ParallelRaft ratio 1.9–3.1
  • number: 3 servers
  • limits: The framework checks finite-state safety invariants and explicitly excludes liveness. Correctness assumes the abstract specification already passed model checking, and module/interaction-variable classification and strong refinement mappings are manually supplied or checked; TLC checks only ordinary refinement. The PRaft specification is confidential. Experiments use three servers and bounded term/command parameters, so measured ratios do not establish unbounded protocol scalability.
  • how much was read: most of it read
  • record id: ipa-compositional-tla-checking-2022
• Jaakkola polyadic Boolean modal logic (2022)
  • title: Complexity of Polyadic Boolean Modal Logics: Model Checking and Satisfiability
  • what: Studies complexity of satisfiability and combined model checking for polyadic modal logic with relation permutations and Boolean operators (negation, intersection). It proves ExpTime-completeness for PML(¬), ExpTime-completeness for PML^c(p,s,¬,∩) when the accessibility vocabulary is bounded by a constant c, and PTime-completeness for combined model checking of PML(p,s,¬,∩). The paper defines k-ary relation terms, cyclic/swap permutations, Boolean operations, k-tables, and their Kripke semantics. For PML(¬), it gives a polynomial reduction replacing R and ¬R by fresh relations R1,R2 plus a coverage formula η, then reconstructs a model with a two-copy domain. For bounded-vocabulary full Boolean polyadic logic, Lemma 11 first converts modalities to table terms; formulas ξ1–ξ3 force table coverage and closure under permutations, after which a layered domain W×{2,…,m}×N reconstructs a model. The PTime model-checking proof normalizes negations to leading form, evaluates relation terms as polynomial-size sets, and uses a subformula-labeling algorithm with pointer enumeration for complemented relations.
  • number: PML(¬) satisfiability ExpTime-complete
  • number: bounded-vocabulary full PML satisfiability ExpTime-complete
  • number: unbounded full PML satisfiability NExpTime-complete
  • number: model checking PTime-complete
  • limits: The ExpTime result for PML(p,s,¬,∩) requires a constant bound on the number of relation symbols; without it the satisfiability problem is NExpTime-complete. The reductions rely on finite formula subformula sets and table expansion, so the polynomial translation depends on the constant vocabulary (a bound on arity alone is insufficient). PML+global-diamond ExpTime-completeness is imported through a guarded-forward-fragment translation. The model-checking result concerns explicit finite relational structures and formulas, not distributed protocols or infinite-state verification.
  • how much was read: most of it read
  • record id: jaakkola-polyadic-boolean-modal-logic-2022
• Katra: Realtime Verification for Multilayer Networks (2022)
  • what: Katra verifies fixed data-plane forwarding rules for packets with unbounded encapsulated header stacks. It partitions finite top headers by local next-hop/transformation equivalence, explores forwarding paths over stacks of symbolic header sets, and repairs lost cross-layer correlations by backward preimages and forward replay. A repeated-head stack criterion detects persistent loops. Handwritten proofs give concrete-trace coverage for a simplified traversal and a loop characterization under model restrictions. Synthetic experiments compare with bounded duplicated headers in the same implementation. Records exact finite-header/top-only semantics, priority/defaults and terminal behavior, partial-equivalence invariant and repair process, full soundness/corollary/loop proofs and excluded optimizations, missing strict-step and unexposed-prefix printed theorem conditions, property scope, unproved implementation multipath extension, baseline shared optimizations, disabled intermediate reachability checks, order-sensitive decapsulation cost and full numeric experimental scope.
  • limits: §§3/5: Finite topology/rules and finite single-header domain H, unbounded stack H*. One packet follows a static rule snapshot; no mutable per-flow state, concurrent control-plane executions, delivery timing, queueing, congestion, failures varying during traversal or distributed consistency protocol. Network rule insertion/deletion triggers checking, not a proof that live update transitions preserve policies. §3.2: Eachnode/headerhasunique lowest-numbered priorityrule, totalmatch via default; directedlinks/selfedges model forwarding/recursive lookup. Undefined transformation terminates packet, withdrop/deliver both undefined and differentiated by property/location context. Formal semantics deterministic; §6 implementation adds multipath without corresponding extension proof in paper. §3.4: Rules inspect/modify only topheader; pushduplicates top, poprequiresatleasttwoheaders. Heterogeneousprotocols represented by masterunionfields+typefield. Cannot directly read arbitraryinnerheaders or history/state. Loopproof additionally disallows a single transformation combiningpopandpush; splitting into nodes asserted to preserve expressiveness. Correct model extraction/BDDtransform/inverse implementation trusted. §4.2: Partialclassespartition H, same selectededge/transformationat every node but not globalbehavior. Avoidstransformclosure; symbolicstackframeproductoverapproximates correlations. Exactconcretebehaviorrequires retaining history and repairing restrictions; partialclassesalone do notprove endtoendequivalence. §§4.3–4.5: DFSnode=(location,partialclass,symbolicstack), top⊆class. Transform/splitbyoverlappingclasses,repairwhen restricted, checkPatterminal orreturnlooptrace. Repaircomputes preimages alongentirehistory thenforwardreplays to reconstructframeconstraints. Inverse is setpreimage, notbijection; requires effective/sound/precisetransformationoperations. Paper argues tracecoverage, no separate full no-spurious-counterexample proof or executable refinement. §4.6: Visitedreuse intended for suffix/subpath-closedproperties: destinationreachability,isolation,loopfreedom. Generalpathproperties claimed possible withvisitedreuse removed atgreatercost, not demonstratedperformance. Terminalpath property checker and selecting relevant sources/destination/headerdomain are user obligations. Algorithmreturns looptrace regardless ofP; semantically allows treating every persistentloop as violation. §5/AppendixTheorem5.1: Induction shows for eachnonterminatedconcrete step someDFSnodecontains locatedpacket, assuming traceexplored. Explicitly removes visitedoptimizations and maintextalsoelidesloopcheck. Baseinitialheader; inductiveselectedruleequal/transform/overlap/preimage-replaycontainment. CorollarychecksPattermination. Does not byitselfprove termination, memoizationcorrectness, precisionofeverycounterexample, APIcodecorrectness or concurrentnetwork behavior. §5.1/AppendixTheorem5.2: Intendedloopcondition repeats location/topheader while retaining untouched lowerprefix, possiblygrowingstack. Sufficiencypumps repeatedsegment; necessityusesfiniteheaders/topology andinfinitelymanyfuturestackminima/pigeonhole. Algorithm2walksancestorsatmatchinglocation, longestcommonsuffixγ, mininterveningheightμ; reportsloopifμ>|oldstack|−γ. Symbolicsetcomparison and criterion-to-concretetrace correspondence are not separatelyproved in full. §5.1/Appendix printed Theorem5.2 concerns: statement omits i<k; i=k and σprime=ε make (1)/(2) identical and (3) vacuous even for a delivering packet. Adding i<k alone is insufficient: (3) permits σdoubleprime=ε, exposing prefix σ, although proof infers forwarding does not depend on σ. Finite counterexample over headers {a,b,c}: (s,a)→(u,ab)→(v,a)→(w,ac)→(u,acb)→(v,ac)→drop. s pushes/writes b; u pops; v pushes/writes c only for top a and otherwise drops; w pushes/writes b. At i=1,k=4,σ=a,σprime=c,h=b all printed conditions hold yet trace terminates; no transformation combines pop/push. Intended pumping needs distinct steps and nonempty remainder above σ throughout the interval. Algorithm2 strict height test rejects example (μ=1,|oldstack|−γ=1). Printed theorem/proof-statement defect, not demonstrated implementation failure. §§3.1/4.5/Appendix notation concern: §3.1 defines f◦g left-to-right (f:X→Y,g:Y→Z,f◦g:X→Z), and push-then-rewrite examples follow that declaration. Generic repair/replay formulas instead use the opposite order. Interpret intended operations from explicit sequences; do not assume one consistent composition convention. Loop necessity proof p634 prose about shrinking forever has a displayed growing inequality |σj1|<|σj2|. Presentation concerns, no artifact run. §6: C#~8KLOC, APKeep-derived partialclassalgorithm, BDDheader sets plus safe boundingboxes/boundingvolumehierarchies; prefixalignedfieldsuseoptimizedtrie. Underlying library/overlap/inverse/graphcode not verified. InputprogrammableAPI rather than demonstratedautomatic productionrouterconfigurationparser. §7.1: DUPbaselineisKatrainstantiatedwithNreplicatedfullIPv4headers, copyingfields onpush/pop; chooseNlargeenoughforbenchmarks, excludeunboundedloops. Sharespartialclassreduction/collision/otheroptimizations. APKeepclosedsource, singlelayerperformanceclaimedcomparableto publishednumbersbutrawresultsomitted. Comparisonisolatesrepresentationchoiceinsideonecodebase, notheadtoheadoriginalAPKeepexecutable. §7.2: Syntheticrandomconnectedgraphswithℓlayers/nnodesperlayer, mappedoverlaynodes/shortestpathroutes, O(ℓn²)rules. No reportedproductionmultilayertrace, fieldbugfind, realoperatorintent recovery or exhaustiveadversarialtopologyset. Reachabilitychecksoutermostlayeralladvertisedsubnets, disabledwhiletunnelsincomplete; thusbenchmarkdoesnotcertifyeverytransientconfiguration. §7.2/Figures8–10: ℓ2/4/6/8,n20–100compareclasscomputationandpropertychecktimes separately. Nearly50×atℓ6/n100referspropertychecking, nottotalruleprocessing. Under1msclaimonperinsertionCDFshownonlyℓ2/4,n20/40, nothardrealtimedeadline/universalnetworks. Aggregateclassrecomputationatℓ8/n100roughly175sDUP/40sKatra; costsnotallsubmillisecond. §7.3/Figures11/12: Looppropertycheckedaftereveryupdate; arbitraryordercanhit~40mstailbecauseearlypopforcesmanyclassesrechecked. Delayingdecapsulationinsertionsmakesnearlyall<1ms; orderchangeswhichintermediateconfigschecked. Two-layer4minuteexperiment:DUPtimesoutbeyondn100/20Krules,Katraupn300/180Krules.5–32×speeduprangeforn20–100loopchecks, notallproperties/networks. Reportedmaxscaleisbenchmarkcapacity, notallpossibleheaderstackdepthsmeasured. §7: No machineCPU/RAM/OS/runtime/BDDversion, seeds, repeatcount, confidenceintervals or memorymetrics specified. Plotsgiveperformanceevidenceforgeneratedworkload; reproducibility/environment sensitivitynotquantified. No independentartifactexecution or measuredproofchecker acceptance.
  • how much was read: most of it read
  • source
  • record id: katra-realtime-verification-for-2022
• Mazouz et al NNDM barriers2022 (2022)
  • title: Safety Guarantees for Neural Network Dynamic Systems via Stochastic Barrier Functions
  • what: The official five-page Appendix A supplies case-study training, rectangular verification domains, partition widths, model/policy architectures and two illustrative 100-step simulations. The main 15-page paper account is inherited from formal849. These additions make the learned-model experiments more concrete; they do not resolve the main account’s printed controller-optimality proof concerns, establish exact numerical certificate checking, or transfer the model certificate to physical dynamics. Source spans S1–S5 preserve every appendix page, including Tables2–4, Figures2–4 and Equations11–12. A.1 trains Pendulum/Cartpole models for up to300epochs with early stopping and5,000–50,000points as depth increases. Pendulum has1–5hiddenlayers of64neurons, training angle±π and angularvelocity±1, safeangle±π/15, initialangle±π/36, actuator±1. Cartpole prose says1–3layers of128neurons; this is a training description, distinct from the1/2layer cases in the inherited main Table1. Its training box is position±2.4, velocity±.6, angle±π/15 and angularvelocity±.6; verification Table3 narrows position to±1 and both velocities to±.5. Correction acts in linear/angular acceleration with both inputs in±1. Figure2 shows learned Pendulum vector fields; Figures3/4 are single100step trajectories with/without correction, not empirical safety probabilities or repeated trials. A.2 describes PyBullet Husky training: random-action trajectories fit an open-loop model; a model-predictive controller produces expert actions; imitation initializes a policy followed by TRPO; a further imitation fit compresses the closed-loop composition. Table4 gives open-loop6×500ReLU×4 or7×500ReLU×5, policy4or5×64tanh×64tanh×2,200epochs,.1second step, horizon1 and100rollouts. Verified closed-loop models are4×256×4,4×256×256×4 and5×512×5, with ReLU hidden activations. The prose’s universal4input policy description does not cover the5D row, which the table labels explicitly. A.3 trains a6D Acrobot model on25,000points for300epochs with reported validationloss10^-3. It describes cos/sin coordinates, an expert controller, a tip-height task and coordinatewise sine restrictions. Table3’s verification box has both cosine coordinates in±.1 and both sine coordinates in±.6; those bounds cannot contain a physical joint’s unit-circle coordinates. Thus the supplement strengthens the need to distinguish an abstract NN state-box guarantee from physical Acrobot safety. Reader diagnostics below separate this elementary inference from the authors’ reported experiment. Neither the appendix nor these source checks inspect the code or stored results. Separates the sufficient barrier certificate from serious printed controller-proof defects: SOS does not imply convexity, distance to a minimum does not order an anisotropic convex barrier, and existential LP variables do not implement a universal robust constraint. Records counterexamples, recomputation safeguard, threshold-loop sign error, physical/model scope and missing experimental appendix.
  • limits: S1–S5: the complete official AppendixA was read. Only Neurips_NNDM_Barrier/Appendices/Appendix.pdf was opened from the publisher ZIP. All implementation/data/result members remain unopened. Main findings are inherited explicitly from formal849, including its theoretical qualifications; no fresh full main-paper reread is claimed. S1,Table2: preserve printed grid widths rather than silently repairing them. CartpoleQ3840 prints angle width0.000872665, whereasQ960/1920 print0.01745329. The5D Husky row is misspelled Huksy in extraction and uses xdot/thetadot headings despite the Table3/prose state order x,y,theta,v,omega. These are source presentation inconsistencies, not verified implementation errors. S2: Pendulum prose explicitly says the uncorrected trajectory stays safe while the corrected trajectory violates the theta constraint. This is the opposite of the usual intended-controller narrative. The plotted trajectory does not make an obvious crossing of the dotted bound at the viewed resolution. Preserve the prose and panel labels; do not convert this into evidence of reliable controller benefit or a demonstrated runtime failure. S3: Cartpole prose reports correction in all regions for the desired bound, and describes Figure4 as keeping the system safe. This is one100step illustration; it supplies no repeated-trial estimate, confidence interval or independent validation of the main certificate. S4: Husky initialset prose says circle of radius.1 and then writes coordinate bounds x,y∈[-.1,.1], a square. These sets differ. Record the ambiguity instead of treating one as the confirmed initial distribution. Four-dimensional lane y∈[-1,1]; five-dimensional lane y∈[-.5,.5]. S4–S5: reader inference for Acrobot: every genuine joint satisfies cos²theta+sin²theta=1, while Table3 allows at most.1²+.6²=.37. Consequently its entire verification box contains no genuine joint state in that encoding. Also a physical pair of joints has squared norm2 in its four cosine/sine coordinates, so the printed radius.1 ball about their origin contains no physical state. This is a state-model mismatch in the printed account; the implementation was not inspected. S5: the printed implication from sin(theta1)≤.6 and sin(theta2)≤.6 to tipheight sin(theta1)+sin(theta1+theta2)≤1.2 is not generally valid. Reader example theta1=theta2=arcsin(.6) gives .6+.96=1.56. This example addresses that prose implication; it is outside Table3 because its cosine coordinates are.8. Do not conflate the implication counterexample with a trajectory inside the verified box. S1–S5: AppendixA supplies grids, boxes and training settings, but still gives no numerical covarianceR or complete certification-horizonN setting.100steps identifies plotted simulations, and.1seconds is the Husky discretization time; neither establishes all experiments certification parameters. Main evaluation wording about an unavailable appendix must be replaced by this narrower remaining gap.
  • how much was read: most of it read
  • record id: mazouz-et-al-nndm-barriers2022-2022
• Model Checking Runtime Verification MAS (2022)
  • title: Towards the Combination of Model Checking and Runtime Verification on Multi-Agent Systems
  • what: Combines static model checking of decidable MAS submodels with runtime monitors for residual strategic/temporal properties, returning conclusive or inconclusive partial results even when full ATL* checking is undecidable. The procedure finds positive/negative submodels, checks subformulas statically, synthesizes LTL monitors for remaining temporal parts, and proves preservation links from monitor verdicts back to ATL* satisfaction/violation. A Java tool is tested on random imperfect-information interpreted concurrent game structures.
  • number: 10,000 random iCGSs per information percentage
  • number: More than 80% of runs return a conclusive result
  • number: Runtime verification is polynomial in analyzed history size; monitor synthesis is 2EXPTIME-hard
  • number: Experiments run on Intel i7-7700HQ, 4 cores/8 threads and 16 GB RAM
  • limits: The global MAS problem is undecidable; inconclusive results are possible. Runtime candidates can grow exponentially with imperfect-information states, and monitor synthesis is 2EXPTIME-hard, though monitoring a history is polynomial. No public benchmark suite of iCGSs exists, so experiments use random structures.
  • how much was read: most of it read
  • record id: model-checking-runtime-verification-mas-2022
• Modular Formal Verification of Rust Programs with Unsafe Blocks (2022)
  • what: # Modular Formal Verification of Rust Programs with Unsafe Blocks (authored by agents unless marked 🧑) Nima Rahimi Foroushaani and Bart Jacobs, December 2022 technical report, arXiv:2212.12976v1. This is a proposal and early VeriFast implementation for checking unsafe Rust using modular symbolic execution and RustBelt semantic types. The demonstrated prototype verifies one small allocation example. A soundness proof relating successful execution to RustBelt, general generics, and panic safety remain future work. Its worked Cell proof explains an intended resource discipline; the literal Rust listing also omits UnsafeCell, an important source-language qualification (Q1,Q2,Q10,Q11,Q12,R1). ## Reading and evidence scope Read the whole 23-page PDF: cover, abstract/contents, printed pages1–22, sections1–7, Appendix A, all13 bibliography entries, all13 listings, three figures and the six-row Table1. No numbered theorem, completed soundness proof, benchmark-results table or checklist appears. Figures1/2 show concrete/symbolic execution trees; Figure3 is a screenshot whose code and “0 errors found (28 statements verified)” message were read in its page18 render. Individual page renders inspected:9,11,16,17,18,22,23. Appendix listings12/13 are clipped at the right edge in the PDF itself; their visible text was read, without claiming recovery of missing characters. References were read as entries, not recursively followed. Acquired the paper-linked Zenodo7472607 v0.1.0 record and its7,879,059-byte Git bundle; checked published MD5 and pinned ref rust-tr-drop at58197015846357c14553fd514a3d357abaee378a. Inventoried1,861 Git-tree entries through static object inspection. Retained eight plaintext assets. Seven were read whole: repository README, soundness.md, frontend Readme, exporter toolchain/Cargo configuration,217-line rust_fe.ml and alloc.rs. Read translator lines400–505 and735–965, plus selected search hits; this is not a whole1,316-line translator or repository audit. Manifest hashes/Git blobs identify the exact files. The current official Rust UnsafeCell documentation was consulted for its introductory and aliasing paragraphs; it is2026 documentation, not a pinned2022 language definition. Other documentation sections, repository files, experiments and cited papers were not read. No author code was executed/imported, checker/solver invoked, or model/checkpoint/serialized experiment data loaded. ## What the proposed verification means The input is assumed already type- and borrow-checked. User separation-logic contracts, ghost commands and lemmas complement obligations extracted from Rust types. The aim is to check unsafe implementations against their safe interfaces, so safe callers can rely on ownership, validity and borrowing guarantees. The report’s “Our target claim” explicitly quantifies over all safe abstractions and the unsafe hierarchy behind them; §6.1 then proposes proving the checker sound or generating function-specific Iris proofs. These are intended guarantees, not completed meta-theorems of this prototype (Q1,Q9,Q12). The distinction between a valid address and a valid Rust value is concrete. Listing3 dereferences null; its other function overwrites an inner mutable reference with null without directly accessing unallocated memory. That operation corrupts the reference’s type invariant and can make later safe code fail. Thus tracking allocation alone cannot establish Rust safety (Q3). The paper’s UB examples and safety ambitions do not exhaust every Rust validity, aliasing or concurrency rule. ## Modular symbolic execution and the deque example An execution state consists of a variable store, owned heap chunks and persistent path facts. An allocation may abort through handle_alloc_error or yield aligned allocated memory. Fresh fields carry an uninitialized marker; reading that marker causes verification to get stuck. Figures1/2 contrast arbitrarily many concrete allocation addresses with two symbolic cases, null and nonnull. This is an explanatory abstraction argument, not a measured path-reduction result (Q4,Q5). The create_deque example allocates a sentinel Node, writes its prev/next pointers to itself and leaves value uninitialized. Heap predicates separately own allocation and fields. A write needs a matching owned chunk; a successful write updates its value. The postcondition transfers all allocation/field chunks and nonnullness to the caller. At calls, the checker consumes the precondition and produces the postcondition rather than repeatedly executing the callee body. Consuming ownership prevents duplicating permission when transferring resources. Empty residual heap in this example accounts for all chunks; this does not establish that every Rust program must be leak-free (Q4–Q6). The raw-pointer-only deque has little type-induced interface information. Safe abstractions need stronger semantic types: check the implementation from the resources its parameter types provide and reestablish the interface resources at return. Although §3.3 describes weakest-precondition/strongest-postcondition ideals, the method uses user contracts; it does not automatically infer maximally precise contracts or eliminate the need to justify lemmas (Q6,Q7). ## RustBelt resources and the worked Cell outline RustBelt interprets a type by its size, ownership predicate and sharing predicate. Shared-reference ownership refers to the pointee’s sharing predicate, so sharing a Cell can have a different logical meaning from sharing an ordinary immutable integer. The Cell example uses a thread-dependent non-atomic persistent borrow. Its lifetime token, with a positive fraction at most1, witnesses the borrow is live; the thread’s non-atomic token controls access in that thread. Opening a borrow supplies writable resources together with an obligation to restore them before reclaiming the tokens (Q8). Table1’s six rows show the intended sequence: initial reference/lifetime/thread resources; unfold shared-reference ownership; unfold Cell sharing; invoke the lifetime access rule; write the new integer; close the borrow and recover tokens. The token discipline prevents ending a lifetime while borrowed resources remain outstanding. The authors omit details, including representation of local variables as owned pointers, and present the table as an outline. It is neither a complete mechanized Cell proof nor a verified Rust-library result of the demonstrated prototype (Q8,Q9). There is a separate source-language problem. Listing2 stores a plain i32, obtains a mutable raw pointer from &self.value and writes through it. It declares !Sync and does not expose deep references. The authors conclude “The usage of unsafe code in Cell library is sound” (Q2), reasoning about race avoidance. Current official Rust documentation says “Mutating that data, for example through an alias or by transmuting a &T into a &mut T, is considered undefined behavior” and “All other types that allow internal mutability, such as Cell and RefCell, internally use UnsafeCell to wrap their data” (R1). A single-thread restriction alone does not grant permission to mutate shared plain-i32 storage under these documented rules. Accordingly, preserve the authors’ intended RustBelt-style Cell resource model but do not present the literal Listing2/6 as valid production Rust. This is static source/documentation comparison, not a compiler/Miri experiment or a proof about the historical prototype’s acceptance. The current documentation itself says precise aliasing rules remain in flux; the core immutability/UnsafeCell distinction is explicit (R1). Appendix A labels its examples “intended” encoding and translation. Listing12 writes self.value under &self with a comment invoking an unsafe superpower; this is illustrative code rather than ordinary compilable Rust. Listing13 introduces abstract lifetime/thread/borrow predicates and bodyless access/closing lemma declarations. Those declarations express obligations and trusted rules to implement/justify; their presence is not a proof of those rules or evidence that the prototype generated and checked this translation (Q14). ## Prototype, artifact and trust boundary The architecture invokes the official compiler frontend for type/borrow checking, extracts MIR and annotations through Cap’n Proto, then translates into VeriFast’s C AST and separation logic. MIR supplies explicit control flow while retaining type information. Reusing the frontend helps source correspondence; it does not prove the MIR-to-C translation preserves Rust semantics. Contracts for allocation/library operations, translation, type encoding, VeriFast and its solver remain relevant trust assumptions (Q10). At publication, the authors report support for a “very limited subset of Rust.” They demonstrate alloc.rs allocating one u8, checking allocation failure, writing42, testing the impossible branch *p!=42, and deallocating. The unreachable branch contains two deallocations. Its acceptance would show path-sensitive exclusion of that branch under the example’s assumptions, not acceptance of a reachable double-free or general exception safety. The paper screenshot reports28 statements verified, not a benchmark score, runtime or reader reproduction. No additional verified Cell/deque/library suite is reported here (Q11,C1). The pinned translator agrees with the admitted limits: Layout::new becomes sizeof; pointer is_null becomes comparison with zero; other generic functions hit an unsupported case. Type translation handles Layout specially, rejects nonempty tuple types in the inspected branch and rejects generic lifetime/constant arguments. The call translator follows the ordinary destination, and Resume is explicitly unsupported. These inspected regions support limited functionality, not a claim that every source path was audited. The frontend is tied to nightly2022-01-31 and explicitly takes only the first decoded Cap’n Proto message. No serialized message was loaded during this read (C2–C5). The pinned backend soundness document states “VeriFast does not check that the program obeys strict aliasing rules” for its C verification claim, and lists known issues. Its C-compiler caveats do not automatically establish a bug in this Rust example. They do explain why translating Rust into an accepted C AST cannot, without further justification, discharge Rust’s distinct shared-reference rules. No claim is made that every listed C/Java unsoundness affects this Rust path (C6). ## Panic safety and evaluation limits Listing9’s swap_nonoverlapping contract is explicitly hypothetical. Listing10 demonstrates unsafe temporary state in BinaryHeap::sift_up and a comparison that may panic. Listing11 exposes a MIR unwind successor, motivating analysis of exceptional paths. However, MaybeUninit::::zeroed().assume_init() already creates an invalid value when all-zero bytes are invalid for T; this example’s risks cannot all be attributed to later unwinding. §6.2 leaves the exact necessary post-panic checks and RustBelt extension as future work. The inspected Resume unsupported case reinforces the prototype boundary; it is not a new checker test (Q12,Q13,C3). There is no timing comparison, benchmark population, proof-size study, RustBelt derivation count or controlled usability experiment. Claims that source annotations reduce learning burden or improve documentation are proposed benefits. Zenodo’s example whole-test-suite execution time is not a measurement of this Rust example. Successful screenshot output is the only concrete prototype verification result shown; its binary/compiler configuration was not replayed (Q10,Q11). ## Contribution to the requested topics This report directly informs verified Rust and unsafe-code verification through the separation between syntactic borrow checking, semantic library invariants and owned resources. It uses VeriFast rather than Verus and contains no distributed protocol, TLA+ specification or LLM-agent experiment. For distributed Rust implementations, the local memory/aliasing obligations would complement, rather than imply, protocol safety and liveness. Transfer to agent evaluation is a reader proposal: record whether a result is a target, worked outline, hypothetical annotation, bodyless axiom, prototype example or mechanically justified theorem; retain frontend/translation/tool versions; check reference validity and exceptional paths; and audit the actual source-language model when another language serves as backend. The Cell omission gives a concrete reason that a persuasive resource argument and a checker screenshot alone are insufficient evidence of valid Rust semantics.
  • limits: Type/borrowcheckedinput;usercontracts/lemmas;trustedMIRtranslation,semanticencoding,backend/solver;limitedprototype;generalmeta-soundnessandpanicsfuture;literalCellomitsUnsafeCell;clippedappendix;noexecution
  • how much was read: most of it read
  • source
  • record id: modular-formal-verification-of-2022
• OCTAL LTL graph learning (2022)
  • title: OCTAL: Graph Representation Learning for LTL Model Checking
  • what: Introduces OCTAL, a graph-representation-learning approach that classifies whether a Büchi automaton satisfies an LTL formula. It represents the automaton as a bipartite graph, the formula as an expression tree, joins matching variables, and trains GNNs to avoid explicit negated-formula automaton and product construction. Section 3 specifies graph construction, NNF formula normalization, shared variable/negation node encoding, and a unified graph C. A 3-layer GIN performs message passing and mean pooling for binary classification. Section 4 builds Short (9,424), Diverse (6,107), and RERS19 (1,798) datasets, compares OCTAL GIN/GCN against MLP, LinkPredictor and LTL3BA, tests domain shift and one-vs-many ranking, and drops graph edges to assess robustness. Appendix experiments cover directed graphs and encodings.
  • number: datasets: Short 9,424; Diverse 6,107; RERS19 1,798
  • number: OCTAL GIN accuracy 96.62%, 86.74%, 94.09%, 94.20%
  • number: runtime speedups ~3x, 5x, 3x including preprocessing
  • number: inference speedups 239x, 4690x, 63x
  • limits: OCTAL is a probabilistic predictor without formal soundness or completeness; it can return false positives/negatives and cannot produce counterexample traces. Training uses balanced generated data and fixed Spot/LTL3BA translations, so distribution shift and formula/system semantics may affect results. Removing all edges collapses performance near random; graph preprocessing overhead is substantial. Authors position it as a first-line filter with traditional model checking for confirmation.
  • how much was read: most of it read
  • record id: octal-ltl-graph-learning-2022
• Okazaki RUSUB_7 Hilbert orthogonal decomposition 2022 (2022)
  • title: Formalization of Orthogonal Decomposition for Hilbert Spaces.
  • what: Okazaki formalizes real Hilbert-space orthogonal decomposition for closed linear subspaces. Metric,norm and topology representation bridges support a best-approximation theorem;the nearest vector is characterized by an orthogonal residual and is unique. The article proves a closed subspace and its orthogonal complement form a direct sum,and identifies the double orthogonal complement of a nonempty set with its closed linear span and its smallest closed containing subspace. Restores the closedness premise absent from the Summary’s unrestricted decomposition wording. Distinguishes inner-product-space orthogonality/uniqueness from Hilbert-space existence,and separates closure/closed-ball overbars lost in extraction. Flags the printed variable-binding problem in23 and preserves strict-structure guards for literal subspace equalities.
  • limits: MML RUSUB_7 version8.1.12 5.72.1435 identifies the article. All spaces are real:the imported term “real unitary space” means a real inner-product space,not necessarily complete;the stronger real Hilbert assumption is explicit for existence/decomposition. No complex-Hilbert generalization is stated (pp.295–299). Results1–6 identify inner-product-induced norm distance withMetricSpaceNorm distance,open and closed metric balls with norm inequalities,and sequence convergence/limits across the two representations. Result3uses a closed-ball overbar absent from raw text;it is not asserting that an open ball equals a ≤norm set (pp.295–296). Results7–9 characterize open sets by positive norm balls and show open/closed norm balls have their respective topological properties. Results10–12 characterize membership in closureX and topological closedness by convergent sequences. Result10’s overbar matters:it is not saying an arbitrary subset already contains all sequential limits. Results13–16 identifyTopSpaceNorm withTopUnitSpace and transfer subset open/closed predicates (pp.296–297). Result17assumes an inner-product spaceX,linear subspaceM,andm0∈M. It equates m0’s global distance-minimizing property overM with residualx−m0 being orthogonal to everym∈M. Result18proves two minimizers coincide. These two results require neither closedM nor completeX;they characterize/uniquely identify a minimizer if one exists and do not establish existence (p.297). Result19does establish existence ofm0∈M minimizing||x−m||,but assumes a real Hilbert space and that the carrier ofM is closed in the induced norm topology. It cites12’s sequential closedness bridge without displaying the full best-approximation construction. Combined17–19give the unique orthogonal residual decomposition under those guards (p.297). Definition1 introducesOrtCompSet(M) as allx with(y|x)=0 for everyy∈M,for an arbitrary subsetM,includingempty. It is nonempty because0belongs. Result20proves it is linearly closed. The following results use the previously imported subspace-valuedOrtComp(M),with nonempty subset guards where printed;this record did not independently inspect the imported definition linking its carrier to the set-valued construction (p.298). Results21/22show the orthogonal complement of a nonempty subset is sequentially/topologically closed in any real inner-product space. Completeness is unnecessary there. Result24 reverses inclusions:S⊆T givesOrtComp(T) a subspace ofOrtComp(S). Orthogonal complements depend on all generating vectors,not on a chosen finite basis (p.298). Result23prints “Then every non empty subset of X is a subset of OrtComp(OrtComp(M)).” The namedM is not locally introduced in that proposition. The standard intended inclusion ties the subset to its own double complement:M⊆M-perp-perp. Taken as every subset lying in the double complement of one unrelated fixedM,the printed wording is false:inR withM={0},the double complement is{0},which does not contain{1}. This is a publication-level binding concern,not a claim that a checker accepted a false formal theorem;the formal source was not audited (p.298). Result25requires real HilbertX,strictX,and topologically closed carrierM to assertX is the direct sum ofM andOrtComp(M). Its sketch establishes the full carrier sum and zero-only intersection. Result26also requiresM strict and gives literal subspace equalityM=OrtComp(OrtComp(M)). The imported “strict” structure guards are preserved;the article does not explain their source-level representation semantics (p.298). The Summary says “For any subspace S of a Hilbert space H” a decomposition exists,but25’s closedness restriction is essential. Reading counterexample,not printed:letM=c00,the finitely supported sequences,dense in reall2. ThenM-perp={0};a square-summable sequence with infinitely many nonzero entries cannot equalm+0 withm∈M. This also shows nearest points need not exist for a nonclosed subspace (pp.295/297–298 plus labelled inference). Result27says the closure of a linear subspace carrier remains linearly closed,using sequential closure and scalar continuity;itsK=closureL bar is lost in raw extraction. Result28,for strict real HilbertX and nonempty subsetM,shows double complement closed,its carrier equal toclosure(carrierLin(M)),andLin(M) a subspace of that double complement. It is closed span,not necessarilyM or its purely algebraic span (pp.298–299). Result29adds a strict closed subspaceK containingLin(M) and concludesM-perp-perp is a subspace ofK. Along with28,this gives the smallest closed containing linear subspace. NonemptyM and strictX/K guards remain part of the printed theorem. This article does not construct a numerical projection method or state an explicit bounded linear projection operator,norm formula or convergence rate (p.299). Reading finite-dimensional example,not printed:inR² withM=span(e1),x=(3,4) has unique nearestm0=(3,0),orthogonal residual(0,4) and distance4;for generalm=(t,0),||x−m||²=(3−t)²+16. This illustrates17–19and25 without asserting the article contains a numerical experiment. All five pages,one definition,29results/all clauses/supplied sketches,acknowledgement,six references/date read;both sheets and enlarged pp.298/299 inspected. Raw-extraction quotations are not visual formula transcriptions;closure/closed-ball bars,norms and inner-product notation can be distorted. This reading did not execute MML/checker artifacts. The paper reports no quantitative proof timing/size,automation benchmark or empirical evaluation,and no direct distributed/Verus/Rust/TLA+/LLM-agent experiment.
  • how much was read: most of it read
  • source
  • record id: okazaki-rusub-7-hilbert-orthogonal-decomposition-2022-2022
• Optimal-DPOR-Await (2022)
  • title: Awaiting for Godot: Stateless Model Checking that Avoids Executions where Nothing Happens
  • what: Introduces Partial Loop Purity Elimination (PLP), an assume-to-await transformation, and an await-aware Optimal-DPOR algorithm to eliminate executions whose loop iterations have no externally relevant effect. PLP statically detects pure loop iterations and inserts assumptions; suitable assumptions become awaits, while a weakened conflict relation lets Optimal-DPOR-AWAIT remain optimal. Theorems establish preservation of local-state reachability and assertion violations and one representative per equivalence class for terminating programs. Evaluation covers locks, queues, sorting networks, and SafeStack.
  • number: On sortnet(6), PLP+Await explores 1 complete execution in 0.08 s versus Nidhugg baseline 1+312 executions in 0.48 s
  • number: SafeStack-331 bug found in 8 minutes after 2+2,453,474 traces; fixed version exhaustively checked in 24 minutes after 5,772+8,521,721 traces
  • number: GenMC and baseline Nidhugg failed to find SafeStack-331 after more than 2,000 hours
  • limits: Correctness and optimality are stated for terminating programs; SMC requires loop bounds. PLP is static and can miss zero-net-effect loops or be limited by syntactic purity conditions. Experiments use C/C++ pthread programs on one Ryzen 5950X system, with one-hour benchmark and ten-hour SafeStack timeouts; fairness/livelock handling is limited.
  • how much was read: most of it read
  • record id: optimal-dpor-await-2022
• Partial-Observation Interaction RV (2022)
  • title: Dealing with observability in interaction-based Offline Runtime Verification of Distributed Systems
  • what: Defines offline runtime verification of partially observed distributed executions represented as multi-traces against interaction models. A search graph consumes matching local actions or removes lifelines whose traces are empty, allowing truncated/unobserved components without synchronizing monitor termination. Introduces removal on interactions and multi-traces, proves removal homomorphism and confluence properties, defines finite search graph with Pass/Fail sinks, proves correctness, and establishes NP-hardness by a polynomial 3SAT reduction. HIBOU 0.8.0 experiments compare translated SAT solving and mutate accepted traces from four distributed-system use cases.
  • number: custom 3SAT: 663 instances (376 SAT, 287 UNSAT), HIBOU median 0.002792 s
  • number: UF20: 1,000 instances, HIBOU median 0.229745 s
  • number: four use cases generate accepted prefixes and mutated traces; verdict timing reported
  • number: search graph reachable subgraph is finite
  • limits: Offline logs and interaction semantics are required; recognition is NP-hard, so heuristics prune search. Removal is justified only for empty lifeline traces, and experiments are ad-hoc rather than a scalable industrial benchmark.
  • how much was read: most of it read
  • record id: partial-observation-interaction-rv-2022
• pCTL-REBEL lifted relational model checking (2022)
  • title: Lifted Model Checking for Relational MDPs
  • what: Introduces pCTL-REBEL, a lifted probabilistic model checker for relational Markov decision processes that reasons over first-order abstract states instead of grounding all objects, and proves decidability for state-bounded infinite domains via finite abstract RMDPs and probabilistic bisimulation. The paper defines OI-subsumption relational states, grounding semantics, relational pCTL including next and bounded/unbounded until, and a relational Bellman operator whose V and Q rules store probabilities rather than rewards. Logical regression, Q-rule combination, V-rule maximization and three mutually recursive Check/CheckUntil/CheckNext algorithms implement lifted checking, including absorbing goals and state-bound filtering. Theorem 1 proves that an abstract RMDP for a state-bounded infinite model is probabilistically bisimilar for a formula, so checking the finite abstraction is equivalent to checking the infinite MDP. Worked blocks-world regressions and nested formulas expose rule construction. The unoptimized SWI-Prolog prototype checks infinite blocks/box worlds and compares against PRISM/STORM; pCTL-REBEL handles 15 blocks (6.6e13 ground states) under 1800 seconds while PRISM explicit handles 8 and STORM sparse 9, but indefinite-horizon checking grows exponentially and road-map constraints cause runtime explosions.
  • number: 15 blocks and 6.6e13 ground states within 1800 s
  • number: PRISM explicit at most 8 blocks (4.0e5 states); STORM sparse at most 9 (4.6e6)
  • number: Table 3 nested phi_nested(3,1): 1554 s
  • number: prototype SWI-Prolog 8.0.2 on 2.4 GHz Intel i5
  • limits: Relational states use unique-name and OI-subsumption assumptions, and abstract transition heads may use only variables present in their bodies. Finite-domain soundness applies to step-bounded pCTL; the naive epsilon convergence criterion is not sound for unbounded until, though intended as an approximation. Infinite-domain decidability requires a state-bounded MDP and finite formula-relevant constants; an optimal deterministic stationary policy is assumed for infinite abstractions. The implementation is unoptimized SWI-Prolog, compared with grounded PRISM/STORM conversions on selected IPPC blocks/box benchmarks, with 1800-second timeouts; no implementation-level proof of scalability beyond those cases is given.
  • how much was read: most of it read
  • record id: pctl-rebel-lifted-relational-model-checking-2022
• Polyhedral Petri Abstraction (2022)
  • title: A Polyhedral Abstraction for Petri Nets and its Application to SMT-Based Model Checking
  • what: Defines E-abstraction equivalence between Petri nets using Boolean combinations of linear integer constraints, adapts BMC and PDR to reduced nets, and implements the method in SMPT. The abstraction preserves reachable-marking observations through a constraint system E; an E-transform formula Ẽ reduces checking F on the original net to checking Ẽ∧F on a residual net. The paper proves composition/transitivity and congruence properties, derives reduction rules, and gives correctness arguments for reduced BMC and monotonic-property PDR.
  • number: about 20% of instances fully reducible; about half reduced by at least 30%
  • number: with reductions 6,986/13,265 results versus 3,555 without (roughly 2×), with 100% agreement with the MCC oracle
  • number: category counts: Low 1,662 vs 1,350; Good 1,176 vs 704; High 1,591 vs 511; Full 2,557 vs 990
  • number: reduction time usually about 1 s per instance and amortized over about 30 properties
  • limits: SMT encoding targets QF-LIA and the implementation currently pipes formulas to Z3; no other solver was experimentally tested. PDR is restricted to monotonic formulas (about 30% of properties), so its contribution is small. Full Petri-net reachability remains difficult; the implementation is a proof of concept and reduction correctness for new rules is not automated.
  • how much was read: most of it read
  • record id: polyhedral-petri-abstraction-2022
• PolyLogicA geometric spatial model checking (2022)
  • title: Geometric Model Checking of Continuous Space
  • what: Extends the Spatial Logic for Closure Spaces (SLCS) to continuous polyhedral space. Each polyhedral model is converted to a finite face-poset Kripke model preserving SLCS formulas, enabling a geometric model-checking algorithm and the PolyLogicA prototype. Defines polyhedral semantics and a reachability modality γ, proves logical equivalence between a polyhedron and its triangulation-derived relational model, gives a flooding algorithm linear in the number of encoded cells for fixed dimension, and defines simplicial bisimilarity characterizing logical equivalence. Proof-of-concept experiments analyze a 3D maze and a medical anatomy mesh.
  • number: Maze model has 147,245 cells; Q1/Q2/Q3 checks take 200/250/100 ms and all together 300 ms; total times 5.45–5.55 s (§5.4.1)
  • number: Digital anatomy mesh has about 1.5 million simplicial cells (§5.4.2)
  • number: Maze input parsing takes about 4 s and Kripke construction about 1 s (§5.4.1)
  • number: Geometric reachability model checking is linear in number of Kripke nodes for fixed dimension (§4.1)
  • limits: Models are finite polyhedra represented by triangulations; encoding size and edge count grow exponentially with simplex dimension d. The prototype is proof-of-concept, with parsing/model construction dominating measured time. Larger benchmark suites and optimized parsing/Kripke generation are left for future work.
  • how much was read: most of it read
  • record id: polylogica-geometric-spatial-model-checking-2022
• PRESTO (2022)
  • title: PRESTO: Predicting System-level Disruptions through Parametric Model Checking
  • what: Introduces PRESTO, a MAPE-K analysis workflow that forecasts trends in monitored system/environment parameters and evaluates predicted requirement violations by re-evaluating parametric model-checking expressions for a pDTMC. It targets proactive adaptation before reliability, time, or energy disruptions occur. The paper formalizes DTMC/pDTMC/PCTL semantics and derives Storm-generated rational expressions for probability and reward requirements. A fruit-picking robot model has parameters for positioning/picking success, retry decisions, operation time, and energy. PRESTO fits linear trends to monitoring windows, predicts parameters over a horizon, and plugs those values into fixed PMC expressions. The preliminary evaluation studies three requirements (success probability, completion time, energy), trend prediction errors, noise sensitivity, and the adaptation trigger slack τ; it reports no false positives/negatives in the basic experiments but substantial noise and trigger-slack tradeoffs.
  • number: 3 requirements
  • number: 1000 repetitions per noise level
  • number: R1 488 cases, R2 715, R3 501 for τ analysis
  • number: τ sweet spot around 30 min
  • limits: Models are finite DTMCs with rational-function transition probabilities/rewards and PCTL requirements; parameter trends are forecast from monitoring data and are assumed sufficiently captured by the chosen time-series method. The study is preliminary, uses one autonomous-farming case, does not evaluate end-to-end MAPE-K execution, and identifies noise, prediction error, adaptation latency, and model/trend diversity as limitations. Results are simulations/experiments rather than a proof that predictions are universally accurate.
  • how much was read: most of it read
  • record id: presto-2022
• PTA reachability and liveness (2022)
  • title: Reachability and Liveness in Parametric Timed Automata
  • what: Maps decidability boundaries for parametric timed automata, introducing bounded integer-points PTAs and reset-PTAs for decidable reachability while proving many liveness and deadlock problems undecidable. The paper separates EF/AF reachability emptiness, cycle existence, deadlock existence, and EG persistence across bounded/open/closed L/U-PTAs and integer-point subclasses. It uses counter-machine reductions for undecidability and derives PSPACE-completeness for bounded closed L/U-PTA EF and cycle problems, identifying thin boundaries where closedness or boundedness changes decidability.
  • number: existence of an infinite run in an L/U-PTA is PSPACE-complete
  • number: deadlock-existence is undecidable for closed bounded L/U-PTAs
  • number: cycle-existence is PSPACE-complete for closed bounded L/U-PTAs and undecidable for general bounded PTAs
  • number: EF-emptiness is decidable/PSPACE-complete for bounded IP-PTAs
  • limits: Results are complexity-theoretic and depend on parameter domains, strict/non-strict guards, boundedness, and open versus closed parameter valuations. The undecidability constructions show that unrestricted PTAs cannot generally support algorithmic synthesis or liveness checking; no empirical implementation benchmark is claimed.
  • how much was read: most of it read
  • record id: pta-reachability-and-liveness-2022
• QBMC for rectangular hybrid automata (2022)
  • title: Model Checking for Rectangular Hybrid Systems: A Quantified Encoding Approach
  • what: Introduces quantified bounded model checking (QBMC) for rectangular hybrid automata. A universal bit-vector index selects iterations while one transition relation is reused in a quantified SMT formula, reducing formula duplication and memory relative to quantifier-free BMC. The paper defines rectangular-hybrid-automaton semantics, derives the quantified encoding and implements it in HyST using Z3. Experiments compare QBMC with dReach and HyComp on an illustrative automaton, safe and unsafe Fischer mutual exclusion protocols and Lynch–Shavit, measuring time, memory and SAT/UNSAT outcomes.
  • number: illustrative k≤128: QBMC 5.36 s/41.2 MB; dReach 19,896 s/812.6 MB; HyComp 1.62 s/128.7 MB
  • number: Fischer unsafe 3-process k≤16: QBMC 22.7 s/49.7 MB versus dReach 959.3 s/235.3 MB
  • number: Fischer unsafe 4-process k≤32 solved by QBMC with 254.1 MB
  • number: Lynch–Shavit 4-process model has 6,561 locations
  • limits: The encoding targets rectangular differential inclusions and bounded safety checks; solver termination and performance depend on quantifier support in Z3. The prototype uses old Z3/HyST tooling, small virtualized hardware and BMC bounds, so results are preliminary rather than complete unbounded safety proofs. Quantified encoding can incur higher time as the number of paths grows, despite lower memory.
  • how much was read: most of it read
  • record id: qbmc-for-rectangular-hybrid-automata-2022
• Refinement of Parallel Algorithms down to LLVM (2022)
  • what: Adds parallel execution to the Isabelle Refinement Framework and generates verified LLVM. A state-nondeterminism-error monad reports reads, writes, allocation and frees; parallel composition assumes feasible allocation pairs and fails on races. Concurrent separation logic and a VCG prove low-level commands; Sepref refines pure list algorithms to in-place arrays, tracks pointer equalities and splits arrays for disjoint parallel updates. A parallel introsort/pdqsort-style algorithm is proved total-correct and benchmarked against C++. The memory model uses never-reused blocks, so use-after-free and allocation conflicts are detectable. The M-monad invariant requires consistency and an execution avoiding every finite forbidden block set. The disjoint concurrency rule composes Hoare triples; with_split and npar refine independent list subcomputations to same-array disjoint slices. Parallel psort partitions, falls back when depth/size is small or partition is unbalanced, and uses median-of-64 sampling. The final theorem states in-place return of the original pointer and sorted-permutation contents. Generated LLVM is instantiated for uint64 and strings. Figure 2 compares verified, std::sort(par-unseq), and Boost sample_sort over many distributions on laptop/server; Figure 3 shows speedup versus core count. Results are comparable on laptop integers, slower for server strings and highly parallel speedup. The semantics and generated LLVM text remain within an explicit trust boundary: Isabelle’s kernel, the shallow LLVM embedding and the code generator are trusted, and parallel execution uses an external C++ TBB primitive.
  • number: {‘printed_pages’: 18, ‘server_cores’: 22, ‘server_ram_GiB’: 128, ‘laptop_threads’: 12, ‘laptop_ram_GiB’: 32, ‘pivot_samples’: 64, ‘code_width_bits’: 64}
  • limits: Parallel strands must have disjoint or race-free access reports; potential races cause semantic failure. Memory blocks are never reused; each execution allocates finitely many blocks and the model assumes an unbounded supply of fresh blocks (actual OOM is separately defined termination). The framework targets a small LLVM fragment, multicore CPUs and a parallel combinator; locks, atomics, read-only fractional ownership and GPUs are future work. Sorting correctness assumes a weak ordering and array length represented by a fixed-width word; code generation fixes widths to 64 bits and uses an int64 size signature. Benchmark evidence is runtime comparison, not a proof of speed or broad hardware scalability; no distributed network model, Rust/Verus, TLA+ or LLM agent is evaluated. The trusted code base includes Isabelle’s inference kernel, the shallow embedding of a small LLVM fragment and the text code generator. The parallel primitive calls an external C++ implementation using tbb::parallel_invoke. Correctness is proved against the embedded semantics; the paper does not prove the LLVM compiler, TBB runtime or complete LLVM-to-binary toolchain correct.
  • how much was read: most of it read
  • record id: refinement-of-parallel-algorithms-2022
• RFCNLP (2022)
  • title: Automated Attack Synthesis by Extracting Finite State Machines from Protocol Specification Documents
  • what: Extracts partial protocol state machines from RFCs with BERT/CRF. Translates them to Promela. Uses KORG/SPIN to synthesize attacks on safety and progress properties, checked against a canonical model.
  • number: six protocols extracted
  • number: TCP: 17 of 20 transitions correct or partly correct
  • number: automated TCP models find attacks on 1 property, canonical model on all 4
  • number: Six protocols extracted; TCP: 17 of 20 transitions correct or partly correct
  • limits: The attacks work against models, not deployed code. Experts write the canonical models and four LTL properties each. A progress property can pass vacuously (hold trivially, because the condition that should trigger it never occurs).
  • how much was read: most of it read
  • source; notes: RFCNLP: learned extraction followed by model-level attack synthesis; notes: RFCNLP: learned extraction followed by model-level attack synthesis
  • record id: rfcnlp-2022
• Simple-history snapshot linearizability (2022)
  • title: Polynomial-Time Verification and Testing of Implementations of the Snapshot Data Structure
  • what: Proves that data-independent single-writer snapshot implementations are linearizable exactly when all simple histories are, derives small automata for non-linearizable simple histories, and evaluates PAT verification and a linear-time simple-history tester. Simple histories allow only two distinguished processes to change their update value once from the initial value 0 to 1; all other processes keep 0. Theorem 5 uses differentiated histories, Anderson’s shrinking lemma and value renaming to reduce arbitrary algorithm correctness to simple histories. Theorem 10 characterizes simple-history correctness by no inversion, non-decreasing scan results and appropriate update pairs. Theorem 11 recognizes violations with O(n) states/O(n^2) transitions. Theorem 17 gives O(m n^4) verification for finite simple-history state spaces; Theorem 18 tests a fixed (i,j)-simple history in O(|h|). §6 removes vacuous reads/writes of always-zero registers. Two verification implementations compare PAT refinement on simple histories and PAT reachability with violation automata. §7 carefully identifies encoding/tool threats and distinguishes bounded exploration from full verification; its headline bug counts disagree between sections.
  • number: Theorem 17 O(m n^4); Theorem 18 O(|h|) for fixed-pair simple histories
  • number: §7.6: normal 14/30 bug cases, simple 17/30, polynomial 26/30 (headline totals differ)
  • number: polynomial peak 4.4GB vs simple 25.1GB vs normal 22.8GB
  • number: Bowman 3/4 processes checked without operation bound for simple/polynomial; correct versions of other algorithms generally remain bounded or infeasible
  • limits: The reduction requires data independence, single-writer per-process register segments, and history semantics preserving real-time precedence; it does not cover multi-writer snapshots or strong linearizability, both future work. Polynomial verification measures m, the finite automaton/state graph for all simple histories, not source-program size; state explosion remains. Linear-time testing covers simple histories, not an arbitrary already-recorded snapshot history. Experiments check only the (0,1) distinguished pair; complete verification requires all pairs unless justified by symmetry. Unbounded data types require per-process operation bounds. Algorithms and automata/specifications are manually encoded in PAT; cross-checking mitigates but does not remove errors, and PAT bugs were not independently mitigated. The proceedings supply proof sketches and refer full proofs to supporting material. Quantitative inconsistency: abstract reports 27 versus 14 bugs; introduction says 27 versus 16; §7.6 says normal 14/30, simple 17/30, polynomial 26/30. Table 1 is consistent with 26 polynomial cases and 27 cases for the union of simple and polynomial, which is a reading-based reconciliation rather than the paper’s explicit explanation.
  • how much was read: most of it read
  • record id: simple-history-snapshot-linearizability-2022
• Sound SAT Model Checking Encodings (2022)
  • title: Formalizing the Soundness of the Encoding Methods of SAT-based Model Checking
  • what: Shallowly embeds generic SAT-based model-checking encodings in Coq and proves soundness for bounded, forward/backward, k-induction, and simplified IC3/PDR methods. A generic encoding scheme reduces quantified finite-path validity subformulas to SAT/SMT unsatisfiability checks. The formal development introduces explicit state-sequence/path operations, loop-free-path reduction, and Coq proofs for true/false cases of k-induction and PDR. The Coq specification doubles as a prototype SMC tool and is released with the proofs.
  • number: proof-script LOC: E(6) theorem 459 (348 state-sequence/path), E(7) 545 (423), E(10) 607 (423), PDR E(11) 147 (70), E(3) 14, E(12) 74
  • number: loop-shortening Lemma 1 proof 352 LOC (270 state-sequence/path)
  • number: no runtime or benchmark performance evaluation reported
  • limits: The work proves soundness, not completeness or termination of an industrial checker. It uses simplified encodings and classical logic in front-end conjunction transformations and the loop-shortening lemma. Future work identifies infinite-sequence loop formalization, liveness/k-liveness, other methods, and extraction of a practical tool as unresolved.
  • how much was read: most of it read
  • record id: sound-sat-model-checking-encodings-2022
• SPsCGF model testing (2022)
  • title: Improve Model Testing by Integrating Bounded Model Checking and Coverage Guided Fuzzing
  • what: Presents SPsCGF, a two-stage test-generation workflow for Simulink/Ptolemy control models: CBMC bounded symbolic execution supplies initial seeds, then coverage-guided fuzzing mutates signal inputs using signal-pattern operators. The implementation translates models through an intermediate representation to C/C++ drivers and measures coverage. The paper explains why indirect time-series effects defeat symbolic execution (an ONDLC shutdown model can yield 2^n combinations while only one signal pattern reaches the target), and why ordinary fuzzing creates irregular signals. SPsCGF combines CBMC branch/MC/DC seeds, an efficient dynamic-programming n-wise generator for constant ports, seed selection based on half-flipped conditions, and time/signal mutation operators. It supports nonlinear elements by executing generated raw code and directly embeds complex Simulink code in the IR. Experiments compare SPsCGF, raw coverage-guided fuzzing, SimCoTest, and Simulink Design Verifier across benchmark and industrial vehicle-control models.
  • number: 12 experiments
  • number: 8–38% higher coverage
  • number: 3–10× time efficiency
  • number: NLGuidance MC/DC: 20% SPsCGF, 0% SPsCGF-BMC, 0% SLDV
  • limits: Bounded model checking explores only a finite loop expansion and can fail on nonlinear arithmetic, floating point, long horizons, or complex loops; n-wise testing is restricted to constant ports because it is expensive. Fuzzing inputs are byte buffers decoded by generated drivers, so legal signal semantics depend on mutation operators. Coverage is a proxy for testing effectiveness, not a proof of safety; the paper is an arXiv evaluation with limited benchmark disclosure.
  • how much was read: most of it read
  • record id: spscgf-model-testing-2022
• STLmc: Robust STL Model Checking of Hybrid Systems Using SMT (2022)
  • what: Introduces a Python tool for bounded quantitative STL checking of hybrid automata by threshold-shifting formulas and invoking an existing Boolean STL SMT encoding. Supports exact algebraic trajectory encodings through Yices/Z3 and approximate Lipschitz ODE reasoning through dReal. Adds minimized Boolean-scenario enumeration with parallel ODE refinement and counterexample plots. Thirty reported benchmark tasks favor direct solving for linear/polynomial flows and25-core two-step solving for ODEs. Published strict-threshold and atomic-sign presentation issues require explicit qualification. Makes three bounds explicit: time horizon tau, truth-change/mode-change count N, and robustness epsilon. Its actual no-counterexample theorem supplies rho>=epsilon, hence strict satisfaction at every smaller positive threshold, rather than at epsilon itself. Describes abstraction/implicant minimization/refinement/blocking and its solver interfaces. Complete results preserve encoding sizes, counterexample bounds, scenario counts and algorithm failures. Reader checks identify reversed atomic shift signs in Definition3 and a misleading paraphrase of the nested thermostat property; neither establishes an artifact bug.
  • limits: Hybrid automata have discrete modes, real states, initial/invariant/jump/flow conditions and finite-horizon signals on[0,tau). STL uses state propositions, negation, conjunction and interval until; other connectives are derived. Quantitative semantics use signed atomic scores, negation, minimum and supremum/infimum over time intervals truncated by the finite horizon. Results are bounded finite-signal claims, not arbitrary infinite-run temporal verification. Definition2 requires rho(phi,sigma,t)>epsilon for every trajectory. Theorem1(2) only concludes rho>=epsilon after no Boolean counterexample. Therefore the authors explicitly guarantee strict robustness for each0<epsilon_prime<epsilon and warn epsilon itself may fail. Abstract/conclusion descriptions saying greater than the specified threshold overstate this boundary if read literally; record preserves the theorem and caveat. Visually confirmed source defect: Definition3 prints p_minus(s)=p(s)−epsilon as weakening and p_plus(s)=p(s)+epsilon as strengthening. For atomic truth p(s)>=0, adding epsilon weakens the requirement. These signs conflict with the intended reduction/Theorem1(2). Reader check p=x>=0, constantx=0,epsilon=1: printed p_plus=x+1 is true everywhere, so no Boolean counterexample exists, yet claimed rho=x>=1 fails. Swapping atomic signs is a natural presentation repair, not confirmed implementation behavior. Theorem1 proof details are deferred to technical report42; Theorem2 encoding correctness is imported from refs3/29. No proof assistant development, machine-checked end-to-end compiler/solver theorem or certified implementation is reported. The printed-sign issue must not be described as evidence of a kernel accepting a false proof or an observed tool unsoundness. N bounds mode changes and variable points where any relevant STL subformula changes truth. It is not merely a jump bound or a consequence of elapsed time. The paper uses y(t)=sin(pint/tau) to exhibit n−1 interior truth changes with no mode change. Restricting N can exclude continuous oscillation behavior even when a hybrid trace has no jumps. Time intervals are truncated at tau and may be open/closed, bounded/unbounded. Empty-time-window conventions and boundary equality affect Boolean/quantitative correspondence; the paper explicitly takes only inequality implications with a threshold gap. No unbounded-time or all-discrete-bound guarantee follows from a True result at a fixed N,tau. Linear/polynomial model categories refer to explicit trajectory solutions expressible as linear functions/polynomials, not arbitrary polynomial-vector-field ODEs. Yices/Z3 handle algebraic encodings; dReal approximately handles Lipschitz ODEs. The latter are generally undecidable in exact form. Experiments use dReal precision delta=.001, distinct from property robustness epsilon; the paper supplies no detailed error-budget theorem translating delta-sat to an exact original-model witness. Boolean encoding includes universal time quantification for invariants. Polynomial flows use an imported reduction to quantifier-free conditions; dReal supports ODE existential/universal conditions. A generic SMT-LIB wrapper and automatic solver selection improve interoperability but do not prove parser, encoding implementation or solver correctness. Two-step abstraction replaces flow/invariant constraints by Booleans, producing a weaker propositional problem. A scenario pi is a conjunction of literals implying that abstraction; its ODE/invariant refinement must be checked. UNSAT refinement permits blocking pi; SAT ends search and cancels jobs. After every scenario at each bound is excluded the algorithm returns True. Correctness needs complete coverage and sound refinement/blocking; the abstract Boolean scenario alone is not a real counterexample. Z3 unsat cores of pi and not-Psi are used for dual-propagation scenario reduction. A core supplies a sufficient implicant, while strict subset-minimality requires minimization beyond arbitrary core extraction. The text calls scenarios minimal but does not specify all core-minimization details. No concurrent scheduling correctness proof or distributed fault model is provided for parallel jobs. Running thermostat has two scalar temperatures and three heater modes: both off, only0on, only1on; initial temperatures18..22. Model listing gives k0=.015,k1=.045,h0=100,h1=200,c0=.98,c1=.97,d0=.01,d1=.03, declared temperature domains10..35 and mode invariants. At most one heater is on; guards switch at temperature thresholds16/17/25/26. Dynamics and property meanings are model assumptions, not verified physical-room correspondence. Property phi1 is F_[0,15](x0>=14 U_[0,infinity) x1<=19). Its prose paraphrase says x1<=19 occurs in the first15seconds, but the formula only bounds the start of an until obligation; its witness may occur later before tau. Reader logical example: x0 always>=14, x1 becomes<=19 only at20, tau25; outer F can start at0 and until succeeds at20. This shows a paraphrase defect, not a trajectory established reachable in the thermostat. Property phi2 is G_[2,4](x0−x1>=4 implies F_3,10). Example with epsilon2,tau25 finds a counterexample at bound2 in14.70277s. Phi1 at epsilon.5,tau25,N5 returns True in818.73110s, subject to threshold-gap caveat. Plots explain implication via max(negated antecedent,eventual consequent) and outer infimum; source figure is a returned witness visualization, not independent validation. Evaluation uses eight named system families in ten model/dynamics configurations, three properties each:9linear,9polynomial,12ODE tasks. Bounds N20/10/5 respectively, model-specific tau/epsilon,60-minute timeout. Yices handles linear/polynomial and dReal handles ODE. Hardware IntelXeon2.8GHz,256GB; two-step uses25cores. No single-core parallel ablation, repeated trials, confidence statistics or exact solver revision is supplied. Table2 reports the faster algorithm per row. All18linear/polynomial two-step runs timed out; all12ODE direct runs timed out. The shown complementary algorithm finishes all30tasks; this is not evidence that either algorithm succeeds universally or a controlled equal-resource speedup estimate. Successful shown times range2.7..818.7s; connectives are reported in thousands, not byte sizes. Reader counts:12no-counterexample rows and18counterexample rows. Linear4/5, polynomial4/5, ODE4/8 positive/negative respectively. Counterexample bounds are at most8linear,5polynomial and4ODE. ODE scenarios range79..3580. No-counterexample is bounded and threshold-qualified; ODE counterexamples inherit approximate-solver qualifications. Companion report contains exact benchmark propositions/model details and comparisons with HyComp/SpaceEx/Flow*/dReach; those are not included or independently read here. Tool code is around9500Python lines; website https://stlmc.github.io and report https://stlmc.github.io/assets/files/stlmc-techrep.pdf are referenced. Artifact/source and experiments were not executed. Future work adds reachability methods. This is temporal-logic model verification, not an LLM writing specifications/proofs or a verified implementation in Verus/Rust. No TLA+ or distributed protocol correctness result; networked rooms/tanks are physical compositions and parallel solver jobs are infrastructure. Relevant lessons concern exact bounds, specification meaning, numerical tolerance and independent witness checking.
  • how much was read: most of it read
  • source
  • record id: stlmc-robust-stl-model-2022
• Taming Armv8 (2022)
  • title: Taming an Authoritative Armv8 ISA Specification: L3 Validation and CakeML Compiler Verification
  • what: Connects a compact L3 Armv8 specification to a HOL4 model extracted from Arm’s authoritative Armv8.6 A-class ASL specification via Sail and Lem. Instruction simulation lemmas then support a CakeML compiler correctness theorem with respect to the ASL-derived machine semantics. Sections 3–4 explain the extraction pipeline, manual patches and proof engineering needed for a 488 kLOC HOL4 specification. The authors replace set-valued nondeterminism with Hilbert choice, replace address translation by an identity map and widen physical-address types. The state relation aligns common registers and memory under system-register and well-formedness constraints; l3_models_asl requires allocated decoding and successful exception-free L3 execution. Symbolic evaluation bypasses monolithic ASL decoding before interactive proofs for arithmetic, logical, branch, address and load/store instruction classes. The simulation takes 7.5 kLOC proof plus 0.5 kLOC automation. Section 5 reuses CakeML’s L3 encoder and runs Asm, L3 and ASL state machines together to establish instruction and whole-program results. The final theorem permits resource-limit failures. The work reproduces a known cbnz/cbz error and validates its correction; CakeML does not emit cbnz.
  • number: ASL 168 kLOC source → 488 kLOC HOL4
  • number: L3 2.4 kLOC source → 8.5 kLOC HOL4
  • number: ASL extraction ~2 h, build ~3 h; L3 extraction ~1 s, build <30 s
  • number: 7.5 kLOC instruction proofs + 0.5 kLOC automation, ~40 min build
  • limits: The theorem covers the supported general-purpose instruction subset under explicit system-register constraints, a well-formed state, encodeability and appropriate compiler/machine configurations. Address translation is stubbed, and the machine stepping model omits interrupts and devices. The proof does not cover all Arm features, exception behavior or hardware concurrency. Official ASL is the root of trust; ASL→Sail→Lem→HOL4 extraction is unverified and includes manual changes. The paper suggests testing generated HOL4 against Arm tests or hardware as future validation. Whole-program machine behaviors refine source behaviors extended with out-of-memory errors.
  • how much was read: most of it read
  • source
  • record id: taming-armv8-2022
• Tamus timed-automata robustness (2022)
  • title: Timed Automata Robustness Analysis via Model Checking
  • what: Defines minimal sufficient reductions (MSRs) that relax the fewest clock constraints to make an unreachable target reachable, and maximal insufficient reductions/minimal guarantees (MIR/MG) whose remaining constraints preserve safety. Tamus combines UPPAAL checks, MILP and Imitator parameter synthesis to tune timing constants and robustness. Presents dual shrink/enlarge algorithms, witness-path and global variants, MILP objective for minimum cumulative timing change, and robustness degree for uniform relaxation. Evaluates scheduler automata and ten literature benchmarks, comparing Tamus with Imitator’s all-valuation synthesis. Tamus computes MSR/MG sets; Imitator tunes valuations after sets are identified.
  • number: Tamus solved all 24 scheduler models; longest MSR time 16.75 s; longest MG 40.46 s
  • number: Imitator full parameter synthesis solved 4/10 literature models; witness mode 7/10; MSR-guided synthesis 9/10
  • number: Tamus computed MSR and MG for all 10 literature models; Imitator robustness times <15 s for produced results
  • number: Hardware Intel i5 quad-core 2.5 GHz, 8 GB RAM, 20-minute benchmark timeout
  • limits: Targets simple clock constraints and reachability/safety monotonicity; minimal means set inclusion or cardinality, not globally minimal cost unless MILP stage applied. UPPAAL verifier calls dominate runtime; Imitator can time out or return non-optimal witness with early termination. Timeouts set at 20 minutes and network timed-automata handling excludes MILP relaxation.
  • how much was read: most of it read
  • record id: tamus-timed-automata-robustness-2022
• TLA+ verification trifecta (2022)
  • title: Specification and Verification With the TLA+ Trifecta: TLC, Apalache, and TLAPS
  • what: Uses a TLA+ specification of asynchronous termination detection and Safra’s ring algorithm to demonstrate complementary verification with TLC explicit-state checking, Apalache bounded/SMT and inductive-invariant checking, and TLAPS theorem proving, including refinement from the algorithm to a high-level state machine. The high-level module specifies active nodes, pending messages, termination detection, safety, liveness under weak fairness, and quiescence. Safra’s algorithm adds white/black colors, message counters and a circulating token; termination requires an inactive node 0, no pending messages, white token/node, and zero accumulated counter. TLC finds 4,097 states for N=4,K=3 in the abstract model and 1.3 million (N=3,K=C=3,Q=9) or 219 million (N=4 with same bounds) in the algorithm model, exposing state explosion and a token-color bug. Apalache checks bounded prefixes, proves an inductive invariant for N=100 in 20 seconds, and checks quiescence for N=100 in 11 seconds. Refinement is checked for small N; TLAPS proves type, safety, liveness, and refinement for arbitrary instances, with an invariant proof taking about 230 lines and liveness/refinement about 245 lines. The conclusion recommends TLC first, Apalache for inductive invariants, TLC/random exploration for liveness, then TLAPS for higher confidence.
  • number: 4097 states for high-level TLC N=4,K=3
  • number: 262145 states for high-level N=6,K=3
  • number: 1.3 million states for Safra N=3,K=C=3,Q=9
  • number: 219 million states and about 50 min for Safra N=4
  • limits: The abstract model assumes a nonzero finite N, natural pending-message counters, asynchronous actions and weak fairness only for DetectTermination; stronger fairness is optional but unnecessary for the stated liveness. TLC requires finite bounds on pending messages/counters for exhaustive checking, so finite checks cannot establish arbitrary executions. Apalache handles bounded prefixes and inductive invariants but needs type annotations and human-discovered invariants; it cannot directly handle the fairness temporal property. TLAPS proof effort is manual and backend-dependent. The Safra case is a ring algorithm and does not evaluate throughput, deployment behavior, or other distributed topologies.
  • how much was read: most of it read
  • record id: tla-verification-trifecta-2022
• Undecidability of Dyadic First-Order Logic in Coq (2022)
  • what: Coq formalization gives compact reductions from uniform Diophantine pair constraints (UDPC) to decision problems for first-order formulas with a single binary relation and no function symbols. Validity and intuitionistic provability are undecidable even with only forall/implication; satisfiability and finite validity/satisfiability use falsity as well. Classical provability result assumes excluded middle. Finite reductions reconstruct arithmetic through well-founded finite order and partial number representations. Records synthetic undecidability convention, relation/UDC encoding, preservation versus reflection and complemented source problems, mock constants and pair tagging, concrete Friedman falsity trick, object-level proof chains, finite order/indistinguishability/recovery construction, precise minimal fragments, conjecture versus theorem, actual mechanization path, LOC accounting including large dependency, and literal printed anti-chain inconsistencies.
  • limits: §2.1, pp.3–4: constructive CIC, booleans, lists, option types, computable definable functions. Decider f:X→bool matches truth; enumerator N→option X lists exactly satisfying values. Synthetic undecidable P is defined as dec(P) implies enumerability of the complement of lambda-halting, not an unqualified internal proof of not dec(P). The nonenumerability interpretation supplies the usual computability meaning; no explicit machine-model programming needed for each reduction. Complement bars are visible in PDF but lost by plain extraction. §2.2, pp.4–5: de Bruijn syntax in Coq, named binders on paper. Tarski satisfaction maps connectives to constructive metatheory; intuitionistic/classical natural deduction imported. VAL is truth in all models/environments, SAT existence of model/environment, PRV/PRVc derivability with no premises. Finite model means listable domain AND decidable relation interpretations. Decidable satisfaction in one given finite model does not decide existence of some finite model. §3, pp.5–6: arithmetic pair relation (a,b)(c,d) iff c=a+b+1 and 2d=b²+b. Total functional on pairs and irreflexive. It supports successor/addition/square via triangular sums. Full Base/Step/Tieback axioms characterize it; only Base and forward weak Step characterize it as least relation, permitting overapproximations. UDPC asks simultaneous satisfaction of finite constraints by one natural-number assignment. Theorem20, p.6: reduce UDC equations 1+x+y²=z using five variables vi per source variable: v0=v, v1=v(v+1)/2, v2=v²+v+1, v3=v², v4=v1(v1+1)/2. Three pair constraints (y1,y1)(y2,y4), (y3,y0)(y2,y1), (y3,x0)(z0,x1). Existing UDC undecidability derives from Diophantine satisfiability; new local reductions inherit that large dependency. §4.1, pp.7–9: standard model domain N+N²; binary relation on number/number is equality, number/pair tests left component, pair/number right component, pair/pair is arithmetic relation. N k:=relation(k,k) tags numbers because pair relation irreflexive. P p l r tags pair p with components l,r; R a b c d existentially connects two pair objects. Zero is universally bound mock constant, preserving no-function signature. Axioms assert tagged zero, successors and weak Step; FVAL h has axioms imply existential witnesses for all source constraints. §4.1, pp.8–9: validity reflection instantiates standard model and extracts natural witnesses. Preservation builds finite-length successor chain f:N→D mapping needed numbers into arbitrary model satisfying axioms, then transports pair relation by induction. No full infinite arithmetic embedding, injectivity or unique representative required. Theorem29 UDPC≤VAL, Theorem30 complement(UDPC)≤SAT by negating reduction; do not erase complement. Printed maximum/strict bound needs care, noted below. §4.2, pp.9–11: hand-specialized double-negation/Friedman translation produces forall/implication formulas with no falsity and no new relation symbol. It is not a mechanized general translation theorem for all formulas. Strong falsity formula forall a b.relation(a,b) is false in standard model; weak falsity relation(c1,c2) can encode UDPC h. Number-number relation becomes x=y OR (x=0 AND y=1 AND UDPC h), so at mock c1=0,c2=1 weak falsity is source solvability. This semantic model interpretation can use arbitrary Prop; no claim it is decidable. Continuation-style pair/relation formulas remove conjunction/existentials. §4.2–4.3, pp.10–12: double-negated chain existence/transport used to prove minimal formula. For PRV, chain data explicitly lists variables (m,l,r) while object-level hypotheses separately record their relations; metatheoretic dependent pairs cannot simply be treated as object proofs. Soundness gives reflection, syntactic induction gives preservation. Actual mechanization starts here and derives semantic/Kripke corollaries; informal validity-chain Propositions26/27 not separately mechanized, though signature-only Theorem29 has separate implementation. Theorems36–44/58, pp.11–12/16: single-relation VAL, PRV and Kripke KVAL undecidable in forall/implication; SAT and Kripke KSAT need falsity. PRVc forall/implication result additionally uses LEM for classical deduction soundness in constructive Tarski metatheory. Apart from that proviso authors report no axioms assumed. All-positive forall/implication SAT is trivial by all-true singleton model; adding falsity permits undecidability. Kripke semantics imported, not formally introduced in paper. §5, pp.12–15: finite reduction instead maps UDPC→FSAT; negation gives complement(UDPC)→FVAL. Successor-construction axioms would force unbounded growth, so finite axioms deconstruct nonzero elements and arithmetic constraints instead. Definable indistinguishability a≡b matches incoming/outgoing relation profiles; it replaces equality in zero guards, not a new built-in equality symbol. Definable transitive irreflexive < on listable domain is well-founded and contains predecessor steps, excluding cyclic fake arithmetic. §5, pp.13–15: finite standard model domain N≤m + (N≤m)² for m=1+max assignment value. Number-number relation uses ≤ instead of equality to encode ordering in spare relation space; other blocks unchanged. Domain cardinality is (m+1)+(m+1)², so mock m bounds represented numbers, not literally total cardinality. Existentially bound zero/m and code require each represented source variable≤m. Reflection partial map f:D→option N recovers represented numbers modulo indistinguishability, preserving successors and arithmetic; printed Definition49 has multiple defects and cannot be read literally as valid specification. §5.1, p.15: finite relation decidability makes formula satisfaction decidable. Induction validates double-negation translation into forall/implication/falsity in each finite model, enabling FSAT/FVAL fragment reduction without metatheoretic LEM. Theorem58 finite FVAL result retains falsity; eliminating it is only Conjecture59. Quantifier-prefix minimization not attempted. §6.3, pp.17–18: Coq uses H10UPC/H10UC and h10upc_sem_direct, Pr/#/## notation, de Bruijn binding and lia; readable paper formulas differ from source. Unbounded quantifier nesting/hypotheses made a prior FOL toolbox inapplicable. About1000LOC PRV/corollaries versus prior4000;1200FSAT versus prior5000; signature-only reduction<300LOC. Diophantine dependency12000LOC and itself uses PCP; local savings are not end-to-end foundation-size reductions. No checker times, hardware, proof-generation success experiment, artifact execution or independent build.
  • how much was read: most of it read
  • source
  • record id: undecidability-of-dyadic-first-2022
• Verifying a Sequent Calculus Prover for First-Order Logic with Functions in Isabelle/HOL (2022)
  • what: Deterministic fair sequent-calculus proof search with function symbols, mechanized soundness and completeness in Isabelle/HOL. Instantiates a coinductive proof-tree framework and constructs countermodels over only branch-relevant terms using set-bounded semantics. Exports an unverified Haskell executable/driver that can print SeCaV certificates for Isabelle replay. Gives concrete whole-sequent rule application, accumulated term state, cyclic scheduling, persistence/saturation proof and bounded Herbrand countermodel. Connects finite generated trees to SeCaV derivability and both bounded/type-universe semantics, including open formulas. Explains why invalid formulas diverge, proof certificates can be verbose and executable export has a weaker trust boundary than the verified source procedure.
  • limits: Formal syntax is classical first-order logic with named predicates/functions of list arguments, DeBruijn variables and usual connectives/quantifiers. It has no primitive equality constructor in the displayed datatype. Full first-order wording should not imply built-in equality/congruence reasoning or dependent/higher-order quantification. Soundness means a finite well-formed tree yields a SeCaV derivation/semantically valid root. Completeness means search terminates with such a tree for every valid sequent. It is a semidecision procedure, not a terminating validity decision algorithm: invalid formulas do not terminate and executable counterexamples are not produced. Proof-tree framework requires well-formedness closure, enabled rules and persistence. Rules are made always applicable (identity when shape does not match), giving trivial enabledness/persistence at this level; cyclic scheduling then provides fairness. Countermodel construction additionally requires nonempty accumulated term universe and saturated escape path properties. Bounded semantics bounds quantifiers by an arbitrary explicit set u and requires environments/function interpretations remain in u. Bounded does not mean finite or bounded model checking. termsH contains all subterms from an infinite path if necessary, including free variables, with fallback Fun 0 [] when otherwise empty. Countermodel function meanings are syntactic constructors only when their result lies in termsH; otherwise select an arbitrary in-universe term via Hilbert choice. This closes the restricted domain under interpretations without enumerating the full unrestricted Herbrand universe. It is a mathematical completeness construction, not executable countermodel extraction. Isabelle/HOL formal proof and existing SeCaV/framework libraries are the assurance base. Export uses unverified code generation, code lemmas and custom printing. Supplementary hand-written Haskell traversal/certificate postprocessing is unverified, so full executable soundness/completeness does not follow automatically. Independently replaying an emitted certificate in Isabelle can validate that particular successful proof despite export bugs. Ten-second nonproof on invalid test formulas is only a bounded negative test, not a proof of invalidity or executable completeness. Test-suite size, corpus, precise timings/hardware/repeats are not reported. The procedure prioritizes verifiability/completeness over speed or short proofs. It applies rules to all top-level formulas and instantiates γ formulas with all accumulated relevant terms, even irrelevant ones. No state-of-the-art runtime competitiveness or human-readability user study is established. No distributed protocol, Verus/Rust program, TLA+ specification, LLM proof agent, theorem-corpus scaling benchmark or deployment is evaluated. It is infrastructure/metatheory evidence for formal proof search.
  • how much was read: most of it read
  • source
  • record id: verifying-a-sequent-calculus-2022
• Verifying Hardware Security Modules with Information-Preserving Refinement (2022)
  • what: Knox checks information-preserving refinement (IPR): an HSM circuit implements a trusted functional specification through a trusted wire-protocol driver, and arbitrary digital wire observations can be reproduced by an emulator that only queries that specification. A shared relation ties initialization, functional equivalence and physical equivalence together, including recovery after arbitrary I/O. Solver-checked symbolic execution and guided state exploration cover complete C/assembly/Verilog circuits for PIN backup, password hashing and TOTP tokens. Records exact real/ideal switching semantics, reset relation, extra crash-safety obligation, quantified fixed-point/subsumption conditions, all eight hint primitives, tool and manual-efficiency trust, FRAM model versus BlockRAM prototype, each emulator construction and commit point, subtle timing/persistence and compiler/hardware bugs, every LOC/proof-time/overhead value, deterministic-spec limitation and scaling proposals.
  • limits: §2: Adversary controls/observes digital input/output logic levels every clock cycle through a compromised host, including malformed protocol traffic and interruption/reset. No physical device attack, violating electrical specifications, analog voltage measurement, electromagnetic/temperature/power side channel. The digital timing result is relative to the modeled circuit, not an all-physical-side-channel guarantee. §§3–4: Trusted functional specification includes intended API disclosures and driver wire protocol. IPR is relative to these inputs, not proof that the API itself has desirable cryptographic/security semantics. Refinement relation, emulator, hints and proof scripts are supplied but checked; toolchain/model/solver and physical implementation correspondence remain assumptions. §3: Host may alternate functional/physical views any time. Physical→functional reinitializes driver (resetting circuit here); functional→physical reinitializes emulator auxiliary state. Emulator sees only spec-level query results, not arbitrary secret memory. A single continuing spec state must account for physical effects across recovery, ruling out treating each interval as a new empty specification. §4: Relation R need hold between operations and after reset, not at every implementation cycle. Initialization must relate initial states. Functional equivalence includes return result and final relation for each driver operation, including no-op/background running. Physical equivalence matches all per-cycle output sequences and relates reset final circuit to resulting spec state. §4.5: PE maps arbitrary wire traffic to some sequence of legal spec operations. Additional crash safety restricts interrupted protocol-following operation to its old or new abstract state. These are separate obligations: a functionally correct and crash-safe program may still leak through the commit point. §5.1: Yield permits arbitrary cycle delays. Closed overapproximating symbolic-state sets, with checked subsumption, establish fixed points. Merge may overapproximate the union and reduce proof performance burden without discarding concrete behaviors. This is not finite sampling of host schedules. §5.2: STEP checks same-cycle outputs and reset recovery for circuit/emulator/spec symbolic states. SUBSUMED closes an already-covered branch; checked full exploration and closure establish coverage for unbounded-length input. Proof script failure may time out, be slow or fail coverage; success assumes sound framework/solver/model. §6: GCC compiles application C to RISC-V ROM and Yosys translates Verilog via SMT-LIB/#lang yosys to Rosette. The binary/circuit is proof subject; this does not mechanically verify GCC/Yosys/FPGA place-and-route or general CPU ISA correctness. Initial nonvolatile and volatile/reset semantics must match hardware. §7.1.1: Persistent model uses durable atomic32-bit FRAM writes in one cycle. Experimental board substitutes FPGA BlockRAM for external FRAM. Functional proof assumes modeled persistence behavior; experiment does not validate actual power-failure retention of physical FRAM. §7.1.3: Host supplies timestamps; nondecreasing checks reject rewind but do not establish real elapsed time or trustworthy clock. Audit deliberately reveals last timestamp and helps detect future-code requests. Equal timestamps are allowed by the less-than test. TOTP cryptographic security relies on chosen functional algorithms, not a new proof of SHA1/HMAC security. §8.1: Computational security requires efficient emulator so it cannot justify a key leak by factoring/brute force. Knox does not formalize/check efficiency: manual audit supplies this obligation. Case emulators reportedly use at most one spec query per circuit cycle and roughly equivalent computation. Do not describe whole cryptographic result as fully mechanically checked. §8.2: Specs deterministic; true hardware randomness unsupported. Stateful CSPRNG plus explicit host seed/add-entropy operation is proposed compatible design, not a fourth demonstrated/verified case. §8.3: Permitted leakage can be made explicit as spec leak operation; functional equivalence need not be checked for that adversary-only operation. Enlarging allowed leakage changes guarantee and needs policy review. §8.4: Monolithic proof avoids intermediate ISA specs and proves only particular HSM program/circuit behavior. Scaling to sophisticated CPUs/crypto is unresolved; no public-key signatures in three simple cases. Delayed fixed worst-case response with separate correctness/WCET reasoning is a future proposal. §9: Noninterference/declassification/secure-compilation comparisons concern formulations described by authors. Their limitations do not establish impossibility for all generalized information-flow or simulation frameworks. No direct distributed-protocol, Rust/Verus/TLA+ or LLM-agent experiment. §7.2: Single-threaded verification timings on one older CPU; no distribution of proof time or independent reproduction. Implementation latency at12MHz/2Mbaud, no confidence intervals/run count given. Claimed interactive suitability is author interpretation. Originality/relative-simplicity comparisons not independently surveyed.
  • how much was read: most of it read
  • source
  • record id: verifying-hardware-security-modules-2022
• VPN polynomial-network verification (2022)
  • title: Sound and Complete Verification of Polynomial Networks
  • what: Presents VPN, a branch-and-bound verifier for polynomial networks using alpha-convexification to obtain global lower bounds and convergence guarantees. VPN exploits low-rank polynomial-network structure, interval bound propagation, Hessian lower bounds, a power method for spectral-radius estimates, and uniform or non-uniform diagonal shifts. It recursively splits the widest input interval; projected gradient descent gives an adversarial upper bound, while the convexified objective gives a sound lower bound. Branch-and-bound terminates with global verification under the stated assumptions. Experiments compare VPN with Gurobi, IBP, and DeepT-Fast on MNIST, CIFAR10, and STL10, including degree 2–7 networks and 96×96 images.
  • number: MNIST 2×16 VPN 1.43–1.78 s per listed epsilon
  • number: CIFAR10 VPN about 0.92–1.03 s for 2×16
  • number: STL10 VPN 1.39–5.06 s versus Gurobi out of memory
  • number: degree 2–7 MNIST bounds
  • limits: The method targets twice-differentiable polynomial networks and uses finite input boxes, bounded Hessian estimates, and a time-limited practical search. PGD alone is not a certificate; soundness comes from convex lower bounds and branch-and-bound, while timeout leaves instances unresolved. Black-box QP solvers scale poorly in input dimension and degree. Higher-degree/deeper architectures and other functions remain future work.
  • how much was read: most of it read
  • record id: vpn-polynomial-network-verification-2022
• ZonoDual (2022)
  • title: Zonotope Domains for Lagrangian Neural Network Verification
  • what: Introduces ZonoDual, combining zonotopic intermediate bounds with Lagrangian decomposition to produce tighter lower bounds for ReLU-network verification. The paper formulates verification with duplicated layer variables and dual equality multipliers, replacing independent hyperboxes by zonotopes that preserve neuron dependencies. A zonotopic ReLU program is equivalent to two-layer verification and NP-hard; coordinate partitioning gives tractable relaxations, with exact 2-D candidates computable in near-linear generator time. ZonoDual initializes DeepZ/IBP bounds, performs GPU-friendly 2-D dual ascent, optionally merges later partitions into MIP subproblems, and retains valid lower-bound guarantees. Stagewise use of tighter boxes further improves zonotopes.
  • number: 2-D zonotope evaluation O(dm) after O(dm log m) preprocessing
  • number: 2-D zonotope has 2m vertices
  • number: CIFAR network 6,244 ReLUs/4 layers
  • number: MNIST-Deep 5,196 neurons/6 layers
  • limits: The core setting is scalar feedforward affine/ReLU networks and axis-aligned input boxes; the method is an incomplete bound procedure, not complete verification. Weak duality and sound pushforward bounds are required. Higher-dimensional ReLU programs need MIP or another incomplete solver, and stagewise optimization has substantial memory/parallel cost. Reported experiments are MNIST/CIFAR-10 networks and compare bounds, not end-to-end branch-and-bound completion.
  • how much was read: most of it read
  • record id: zonodual-2022
• A Formal Proof of Modal Completeness for Provability Logic (2021)
  • what: HOL Light deep embedding of Gödel–Löb provability logic (GL) proves soundness and modal completeness for nonempty finite irreflexive transitive Kripke frames. Finite duplicate-free maximal consistent formula lists replace an inappropriate infinite canonical construction, yielding finite countermodels without compactness. Polymorphic bisimulation transfers completeness from formula-list worlds to any infinite carrier type. A semantic MESON tactic proves some modal lemmas but fails even on the Löb axiom. Records object/meta-level distinction, frame endpoint constraints, transitive converse-well-founded semantics, theoremhood-only derivability,120lemma engineering effort, finite subformula extension and strict-box-growth accessibility, truth/valuation clauses, carrier-size condition and bisimulation variance. Separates formal theorem from incomplete tactic; concrete terminal/loop/infinite-chain/small-carrier/valuation examples expose exact assumptions.
  • limits: §§1.2/2, pp.4–6: classical polymorphic HOL Light with infinity and choice. Modal syntax is a separate inductive form datatype with string atoms and classical/Box constructors. Recursive holds interprets this object language under valuation V. Object provability is distinct from HOL theoremhood. The paper manually restores some type annotations omitted by the printer. §2.1, pp.5–6: frame (W,R) has a set W of carrier values and binary accessibility relation R. Box p at w checks every u in W with R w u. Frame validity quantifies all valuations and all worlds in W; class validity quantifies every frame in that class. Raw holds_in allows empty W and vacuous validity; nonempty worlds and relation endpoint constraints belong to the relevant frame classes. §2.2, pp.6–7: TRANSNT requires nonempty W, every R endpoint in W, transitivity and well-founded converse R (no infinite forward R chain). ITF requires nonempty finite W and irreflexive transitive R with those endpoint constraints; ITF_NT proves inclusion. TRANSNT_EQ_LOB characterizes transitive/converse-well-founded frames by validity of the Löb schema under the endpoint constraint. Finite world sets differ from infinite carrier types: the latter must accommodate arbitrary finite countermodel sizes. §3, pp.7–10: classical Hilbert axioms plus K: Box(A=>B)=>(Box A=>Box B), and Löb: Box(Box A=>A)=>Box A. GLproves closes axioms under modus ponens and necessitation of theorems. Derivability with assumption contexts is not formalized; the authors leave its necessitation restrictions and deduction theorem aside. Soundness for TRANSNT/ITF yields GL does not prove False. This is theoremhood completeness, not arbitrary-premise strong completeness or arithmetic incompleteness. §3.1, pp.8–9: about 120 internal theorems and derived-rule lemmas, including reusable classical/K/K4 facts. Propositional axiom naming follows Arithmetic/derived.ml; lemmas are proved for this GL calculus. Internal _th forms and external derived rules aid list reasoning. The authors report that MESON/METIS sometimes fail to infer middle implications or schema instantiations, requiring manual search. No success distribution, annotation burden or timing benchmark is reported. §4.1, p.11: CONJLIST []=True, singleton [p]=p, larger lists use nested conjunction. CONSISTENT X means GL cannot prove Not(CONJLIST X). Either extending a consistent X with A or with Not A remains consistent. MAXIMAL_CONSISTENT p X adds no repetitions and a decision q or Not q for each subformula q of p. This is relative maximality over relevant formulas, not every formula in the language. The world definition separately restricts all members to subformulas or their negations. §§4.1–4.2, pp.12–13: extension takes a consistent list X of subsentences of p and returns a relative maximal M with X SUBLIST M and the same closure restriction. It iterates over missing subformulas, appending a formula if consistency survives, otherwise its negation. This is an existence proof, not an efficient executable consistency test. Nonprovable p gives a world containing Not p. Duplicate-free lists over the finite closure yield finitely many worlds, including order variants; no 2^n world bound is stated. §4.2, p.13: GL_STANDARD_REL p w x requires appropriate maximal worlds; every Box B in w persists in x together with B; additionally some Box E is in x while Not(Box E) is in w. The new-box witness gives strict progress needed for irreflexivity. Merely preserving boxed facts permits self-loops. ACCESSIBILITY_LEMMA derives boxed membership from universal successor membership for relevant Box subformulas under its nonprovability/world hypotheses. §§4.1/4.3, pp.12/14: for w in W, standard V a w iff Atom a is a member of w AND a subformula of p. Under nonprovable p, a standard model, and q a subformula of p, the truth lemma equates membership of q with its truth at w. Extending consistent [Not p] gives a countermodel. Completeness initially uses carrier form list; the Noetherian-frame version follows by class inclusion and soundness. No claim that an infinite canonical maximal-set construction works. §4.4, pp.15–16: bisimulation across two carrier types requires related points to belong to their world sets, agree on atoms, and satisfy forth/back successor conditions. BISIMILAR_HOLDS preserves all modal formulas. Class-validity transfer requires coverage of every source model point by a bisimilar target point. Embedding finite countermodels in carrier A proves generalized completeness only under INFINITE(:A), not for every fixed finite carrier. §4.3, pp.14–15: the finite-model property gives mathematical decidability; a complete efficient procedure is outside scope. GL_TAC applies completeness, unfolds semantics/ITF and calls MESON_TAC []; GL_RULE invokes prove after universal generalization. The tactic is incomplete because first-order automation does not handle essential finite/Noetherian reasoning. It fails on the Löb axiom despite that axiom being available in GL. Its successful Box-biconditional example has a printed MESON trace. No total termination or completeness guarantee for the tactic. §4, p.11: the authors suggest reusing finite subformula extension for other normal modal calculi with different accessibility relations. This does not prove that all normal modal logics have the finite-model property; logic-specific semantic obligations remain. §5, pp.16–17 compares S5, IS4 and HOL4 via cited work, not independently replayed artifacts. Supplement/§1/§1.2, pp.1–4: HOL Light GL source comprises modal.ml, gl.ml, misc.ml and completeness.ml, loaded by GL/make.ml. January 2021 archive identifier is provided; the authors report using original HOL tools. No independent load/build here. The paper intentionally omits proof bodies. No total LOC, elapsed checking/runtime, hardware, large benchmark or LLM-agent evaluation. Solovay arithmetic completeness is background, not this formalized result.
  • how much was read: most of it read
  • source
  • record id: a-formal-proof-of-2021
• A Mechanised Proof of the Time Invariance Thesis for the Weak Call-By-Value λ-Calculus (2021)
  • what: Reports Coq proofs that weak call-by-value lambda calculus L and multitape Turing machines simulate each other with polynomial time overhead, with stronger linear-in-machine-steps simulation in the reverse direction for fixed machine. Relates both simulation and boolean-string relation computability, proves halting many-one equivalence, and introduces a Hoare-logic layer combining functional correctness with termination/time bounds for Turing-machine programs. Records the exact closed-term and encoding restrictions, heap compression and output-size dependence needed for size explosion, costed heap-machine transition/refinement, concrete 11-tape/30-symbol simulation, total-function extraction versus manually defined divergence, Hoare tape invariants and constructive machine-definition choices. Reads included worked run and all formal rules, preserving several printed variable/type/zero-size problems rather than treating a prose theorem as an audited source build.
  • limits: §§1/3, pp.2–8: L has de Bruijn-indexed terms, weak reduction outside lambda bodies and beta reduction only on abstractions; variables are not values. Closed terms are the main simulation input. Term size counts unary indices. Reduction may choose either side of an application, but uniform confluence yields unique terminating value and beta-step count. Small-step and big-step characterization agree on closed terms. Theorem 1/§1, pp.3–4: L-to-TM simulation returns a shared heap encoding the result, not necessarily its fully expanded syntax. Expansion can be exponential in source size and beta-step count. Polynomial simulation bound depends on source size and steps; materializing the value additionally depends on output size. Pointer overhead can prevent constant-factor space equivalence; full time-and-space invariance is future work. Theorem 2/§3.1, pp.3/6: computability concerns k-ary relations over boolean lists and an output list. Complexity is actually a functional relation over input lengths, output length and time, written as a function on paper. This avoids requiring a globally total Coq time-bound function for undecidable domains. Polynomially bounded output gives equivalence of polynomial-time computability, in particular PTIME agreement. §3.2/Theorem 6, pp.7–8: compile variables to ref, application to concatenated operand code plus app, abstraction to lam/body/ret. Task and value stacks hold program/address closures; heap entries link arguments and prior environments. Lambda parsing matches nested lam/ret tokens; indexed heap lookup follows links. Optimized task push drops empty residual programs. Starting from a closed term prevents invalid free references. Theorem 6, p.8: beta evaluation in i steps is simulated by 3i+1 heap-machine steps, finishing with empty task stack and singleton closure value. Reachable machine-state encoding size is bounded by c(i+1)(i+||s||+1). Unfolding is a functional relation rather than an unrestricted recursive Coq function because malformed cyclic heaps may diverge. Reachability and acyclic construction matter. §4/Appendix A, pp.9–11/19–20: finite state and alphabet types, fixed finite tape count, total transition function, boolean halting flag and optional write/no-move actions. Tapes encode a contiguous finite symbol segment plus head position, with no built-in distinguished blank. User string-computability convention supplies a blank symbol distinct from true. These choices support constructive encodings and avoid an arbitrary noncomputable transition oracle. §4.2, pp.9–11: realization is partial correctness of terminating runs; a separate relation provides time-bounded termination. Labelled machines support Switch/While composition, alphabet retractions, selected-tape lifting and relabelling. Register encodings have START/STOP delimiters with head at START; unspecified auxiliary tapes are implicitly void in §5. The framework builds actual machine descriptions, while user proofs connect inferred relations to intended specifications. §5/Theorem 11, p.12: Lookup/Parse use five tapes; Step and simulator use eleven tapes over a 30-symbol alphabet. Simulator is While Step. Printed bound p(i,m)=c(3i+2)^2(3i+1+m)m is polynomial in beta steps and input-term size. Conversely simulator termination implies source termination. Some displayed component specs contain variable/type slips; no independent artifact replay validates their corrected versions here. §6/Theorems 17/21, pp.13–14: certifying extraction translates total first-order Coq functions and generates time-recurrence obligations, discharged by solverec when a sufficient bound is supplied. A manually constructed recursion/loop term handles partial or divergent computation. For a fixed TM, transition cost is constant in tape contents but depends on machine parameters; generated obligations include 52|Q|²+130n+216. Fixed-machine simulation is linear in TM steps with machine-dependent constants. §7, p.14: input-list conversion, k-ary application/substitution, simulation and output decoding connect TM-computability to L-computability. Printed Theorem 21 bound is cmn1*…nktau+c; zero-length arguments make this formula degenerate, so it should not be silently accepted without a size-plus-one convention or correction. No such restriction is stated in the supplied definition. §8, p.15: weak Hoare triples express conditional realization; total triples combine it with a termination budget under the same precondition. Per-tape assertions describe encoded value, voidness or exact tape equality, plus an optional cross-tape/label invariant. Combinator rules enable symbolic execution; a user first proves correctness, adds a cost, replays the script and discharges accumulated arithmetic. Automatic synthesis of a useful cost function is future work. Theorem 23/§9, p.16: L-to-TM relation compiler prepares a task stack, runs heap simulation, unfolds the resulting boolean-list value and decodes it. For N=sum input lengths, bound c(i+1)(i+N+1)((N+1)(i+1)+m) is cubic in i, quadratic in N, linear in output length m. Constants may depend on the fixed source program/arity. Explicit +1 factors avoid zero-input collapse in this direction. §10, pp.16–18: development including dependencies is reported as 30,000 lines and about 18 minutes compilation on an Intel i7-6600U 2.60GHz; new code 7,800 lines, about 40% specifications/60% proofs. These are author measurements, not an independent benchmark. Framework scaling is conjectured; proof automation sometimes fails or is slow and needs annotations for every recursive helper. MetaCoq and automatic cost generation are proposed extensions. §8/References, pp.15/18: full Hoare rule details are in a separate externally linked Appendix B, not the supplied 20-page PDF. This reading covers all supplied pages and explicitly leaves that supplement and source build unchecked. No distributed protocol, Verus/Rust, TLA+ model or LLM specification/proof-generation evaluation is reported.
  • how much was read: most of it read
  • source
  • record id: a-mechanised-proof-of-2021
• A Mechanized Proof of the Max-Flow Min-Cut Theorem for Countable Networks (2021)
  • what: Isabelle/HOL formalization of the existence of an orthogonal flow-cut pair in countable networks with finite individual capacities. Corrects a failed reduction invariant and quotient/trimming definitions in Aharoni et al. An alternative proof under finite total outgoing capacity at every non-source vertex uses finite-network MFMC and majorised convergence. Tracks the full network→web→maximal wave→trimming/quotient→bipartite linkage→network chain; distinguishes loose from unhindered webs, finite vertex weights from locally finite graphs, orthogonality from numeric optimization, arbitrary chains from countable convergence sequences, and bounded from unbounded proof effort. Includes the infinite-ray counterexample showing that even an orthogonal cut need not have minimum numeric value.
  • limits: Theorem 1/Definitions 2–5 and §5, pp.1/3/12–13: countability is stated for edges. Each edge capacity is finite and nonnegative, but total incoming/outgoing capacity may be infinite. The formal locale requires distinct source and sink, zero capacity off edges, and finite capacities. The informal Theorem 1 omits the distinctness condition, although its cut requires the source inside and sink outside. Formal graph vertices are edge endpoints, eliminating isolated vertices; the carrier type need not itself be countable. Definitions 4–5, pp.3–4: a network flow respects edge capacities and equates incoming/outgoing sums at internal vertices, potentially infinity on both sides. Orthogonality saturates each outgoing cut edge and sets every incoming cut edge to zero. This is a local edge property; it does not establish a minimum numerical cut or maximum numerical source outflow in all infinite networks. Definitions 6–11, pp.4–5: webs place finite weights on vertices rather than edges. A current bounds both degrees by each weight, reflects outgoing flow in incoming flow outside A, has no inflow to A or outflow from B, and may leak current internally. A web-flow additionally conserves internal current. Saturation and exhaustion differ; a terminal vertex is a saturated sink. Definitions 8–11, pp.4–5: an essential vertex has a path to B avoiding other vertices of the separating set. Roofing collects vertices separated from B; strict roofing removes essential vertices. A wave has separating terminal vertices and zero outgoing current outside their roofing. These path-based properties describe bottlenecks, not an algorithmically computed finite cut. §3.1/Lemma 13, pp.5–7: each network edge becomes a web vertex weighted by its capacity; incident original edges yield web edges. This records how an incoming contribution splits among outgoing edges, avoiding subtraction of two infinite aggregate flows. The recovered network edge flow is max(in-degree,out-degree). The local reduction assumes distinct endpoints, no sink outgoing edges, no direct source-sink edge and positive capacities; additional reductions remove the extra restrictions before the final result. §3.2/Definitions 14–15, p.7: pointwise ordered currents/waves form chain-complete partial orders. Zorn yields a maximal wave. A trimming decreases current, conserves current in strict roofing outside A, and preserves essential terminal vertices outside A. Decreasing one-step scaling at a leaking vertex reaches a fixpoint by Bourbaki–Witt; this is an existence construction, not a terminating executable flow algorithm. Definition 16/Lemma 19, pp.8–9: the quotient retains edges with source outside strict roofing and target outside all roofing. Its A side consists of essential terminal vertices minus B−A; terminal vertices in B receive zero weight. Adding a quotient linkage to a trimming gives an orthogonal web-flow. The maximal-wave quotient is loose: no nonzero waves and zero is not a hindrance. Definition 18/Figure 7, p.8: absence of nonzero waves alone is insufficient for linkability. A hindrance is a wave leaving a positive deficit at a nonessential A vertex. Looseness requires the zero wave not be a hindrance too. Unhindered means there is no hindrance, allowing nonzero waves. §3.4/Lemmas 20–21, p.9: bipartite reduction assumes no incoming edges to A, no outgoing edges from B, no loops, and disjoint sides. Internal vertices are duplicated into left/right copies with a diagonal edge and original-edge cross links. Loose input implies unhindered bipartite output, not necessarily loose output. Bipartite linkage can require a further trimming to restore flow conservation in the original web. §4.1/Theorem 25, pp.10–11: the simpler linkage proof assumes the sum of weights of the neighbours of each A vertex is finite. The corresponding network result bounds outgoing capacity individually at every vertex other than the source; no uniform global bound or finite-neighbour requirement is imposed. A finite-set Hall-type weight inequality plus countable matrices, diagonalization and majorised convergence yield a linkage. Proposition 24, p.10: prescribed countable nonnegative row/column marginals have equal finite total, and all subsets satisfy the neighbour-sum inequality. The constructed matrix vanishes off the allowed relation. The formalization adapts the special case of Kellerer directly using finite MFMC; it does not import an unverified infinite-network theorem. §4.2/Definition 26/Lemma 27, p.11: general linkability maintains that the residual web after subtracting allocated degree weights is unhindered. Saturate one enumerated A vertex while preserving that invariant, add the current to the previous current, and take the increasing edgewise supremum. Bipartite structure makes every current a web-flow. This removes the bounded-neighbour assumption. Theorem 28/Lemmas 29–31, pp.11–12: the saturation proof uses flow attainability under no loops/no incoming source edges and finite total incoming OR outgoing capacity at each non-sink vertex. Perturbation lemmas control finite total weight reductions and positive slack. These are helper hypotheses established in the proof, not added assumptions on every final network. §5, pp.12–14: graph/network/web records group data; locales enforce countability, finite weights/capacity, and side restrictions as needed. Extended nonnegative reals and counting-measure integrals define total sums, avoiding summability proof obligations while retaining necessary finite-bound obligations. Zero off edges allows degree sums over the entire type and avoids changes of graph parameter. §5, p.13: Bourbaki–Witt replaces explicit ordinal developments for trimming, linkage recovery and saturation. Arbitrary chains needed by Isabelle chain completeness are reconciled with sequential monotone convergence by selecting a countable subsequence, using countably many potentially nonzero edge coordinates. Supporting fixed-point and integral lemmas were added to the library. §6, pp.15–16: the original bipartite reduction fails to preserve looseness, and also fails to preserve unhinderedness for arbitrary unhindered input. The corrected route specifically uses loose→unhindered and proves linkability for the larger class of unhindered bipartite webs. The induction invariant and saturation lemma must both be strengthened. §6, pp.15–16: allowing quotient edges back into essential terminal vertices can invalidate the sum of wave and quotient current. Corrected quotient excludes them and adjusts sides/weights. Original trimming equality used all terminal vertices on one side; replacing that with essential terminal vertices handles zero-weight sinks. §§5/7–8, pp.14/16–17: evaluation consists of a formal development, proof reductions, counterexamples, line-count comparison and prior theorem reuse. No runtime, proof-check time, hardware, algorithm benchmark or independent artifact execution is reported here. Further restrictions that avoid infinite-ray anomalies remain unformalized. AFP version and separate report are available but were not checked in this reading.
  • how much was read: most of it read
  • source
  • record id: a-mechanized-proof-of-2021
• A Verified Decision Procedure for Univariate Real Arithmetic with the BKR Algorithm (2021)
  • what: Isabelle/HOL correctness proof of a BKR-style univariate real-arithmetic decision procedure with rational-coefficient polynomial atoms. Computes exact realizable sign assignments by recursive matrix combination and reduction using Tarski queries, then decides existential/universal closure of Boolean polynomial formulas. Supplies executable SML and supporting matrix/rank theorems, with ten illustrative microbenchmarks. Connects formula semantics to complete sign determination, reduces unrestricted sign regions to roots of coprime polynomials using squarefree factorization/Rolle/root bounds, and proves the matrix equation separately from invertibility. Kronecker combination preserves invertibility but temporarily includes impossible sign patterns; zero-count column removal and rank-preserving pivot-row selection restore an invertible reduced system. Proves cached matrix consistency and coverage invariants, and exposes coefficient growth as the practical bottleneck despite fewer queries.
  • limits: Formal input grammar has atoms p>0,p≥0,p=0 with rational-coefficient univariate p, combined by conjunction/disjunction. The proved top-level operations decide ∀x phi or ∃x phi over one real variable. Negation/disequality can be normalized using signed polynomials, but arbitrary multivariate quantifier alternation and full real QE are not delivered here. Restricted sign theorem requires p!=0 and each q coprime to p, ruling out zero signs for q at p roots. Preliminary squarefree/pairwise-coprime factorization and separate zero-root cases are needed to cover unrestricted input atoms, including signs0. A Renegar variant avoiding coprimality was formalized after acceptance but its full details are omitted. M*w=v needs distinct candidate sign vectors covering every realizable assignment and valid subset indices. The theorem alone does not imply square/invertible M; separate inductive invariants establish it. Roots and actual count-vector definitions are semantic/nonconstructive specifications, not procedures for explicitly isolating real algebraic roots. The algorithm maintains distinct sign vectors of correct length, all realizable signs included, a cached matrix equal to the matrix computed from subset/sign lists, and matrix invertibility. Only reduction guarantees exact signs; base/combination may overapproximate. Column deletion retains full column rank, then selected rows form a square full-rank matrix. The empty polynomial-list restricted case is handled separately: no roots of p gives no consistent assignment; otherwise the result is the singleton empty vector. The sampling construction using derivative of the product is presented for nontrivial factors; constant/degenerate preprocessing cases should not be inferred from that displayed formula alone. Optimized univariate BKR has potential for parallel polylogarithmic time, but this development is unoptimized/sequential and does not formalize that complexity theorem. Both parallelization and a compatible formal complexity framework remain future work. The cited Tarski-query arithmetic-operation estimate excludes coefficient bit growth. Export to SML compiled by MLton supplies experimental executables, not automatically a kernel-checked Isabelle proof result for each native run. Making BKR practical as an Isabelle tactic is future work. By contrast the measured univ_rcf comparator explicitly checks untrusted Mathematica certificates by reflection inside Isabelle. Bivariate/multivariate AppendixA is informal motivation, not a verified multivariate algorithm. The original multivariate BKR complexity analysis has a known error; the paper proposes future variants and does not claim to repair/formalize all multivariate complexity bounds. Performance evidence is ten microbenchmarks on one laptop, one-hour cutoff, three-decimal reported seconds. No repetitions/variance or broader representative suite is given. Naive matrix-equation implementation is unverified, and the external-solver tactic includes startup overhead. No LLM-agent, distributed-protocol, Rust/Verus or TLA+ result is measured.
  • how much was read: most of it read
  • source
  • record id: a-verified-decision-procedure-2021
• Active Learning of Abstract System Models from Traces using Model Checking (2021)
  • what: Combines trace-based symbolic automata learning with software model checking to actively refine a finite-state abstraction until it admits all implementation behaviors over chosen observable variables. Defines a symbolic NFA over valuations, extracts local completeness conditions from incoming/outgoing predicates, checks them with CBMC, converts valid counterexamples into new traces, and proves that satisfying all conditions implies trace inclusion. It separates spurious-counterexample checking via k-induction, quantifies completeness alpha and transition match d, and evaluates T2M+CBMC on reverse-engineered Simulink Stateflow C implementations against random passive sampling.
  • number: Of 51 benchmarks, 7 failed code generation, 13 had no sequential behavior and 3 were recursive; 28 were evaluated
  • number: most active-learning runs completed under one hour; 10-hour timeout used
  • number: final alpha=1 for completed valid abstractions and d=1 on most non-timeout benchmarks
  • number: random sampling failed to produce alpha=1 for 50% of remaining benchmarks; some active runs timed out (e.g., FrameSyncController)
  • limits: Completeness is over the selected observable variables and depends on a finite-state (regular-language) abstraction; recursive state machines require more expressive formalisms. The k bound should meet system diameter for a completeness guarantee, but is often estimated and poor values add spurious behavior. Experiments use auto-generated Simulink C and an a-priori finite alphabet; generalization to other software/code generators is unestablished. CBMC may time out or segmentation-fault on models.
  • how much was read: most of it read
  • record id: active-learning-of-abstract-2021
• Avis (2021)
  • title: Avis: In-Situ Model Checking for Unmanned Aerial Vehicles
  • what: Introduces Avis, an in-situ model checker for UAV control firmware. It builds portable flight workloads, injects clean sensor failures at operating-mode transitions using the SABRE stratified breadth-first schedule, and checks physical-state invariants in simulation.
  • number: reviewed 394 ArduPilot/PX4 bug reports, retained 215 after pruning
  • number: sensor bugs were 20% of firmware bugs and 40% of crash-causing reports; 47% reproducible under defaults; 34% had serious symptoms
  • number: tested ArduCopter-3.6.9 and PX4-1.9.0 with 3DR Iris, two-hour runs per workload
  • number: 10 previously unknown bugs (6 ArduPilot, 4 PX4), including crashes and fly-aways; 5 reinserted known bugs all detected
  • limits: The fault model is a sensor instance that stops communicating and does not recover during a run; simulation uses mostly unmodified firmware but only a selected environment and workloads, leaving special environments and stunt/race modes untested. Invariant checks detect simulated physical crashes/fly-aways, so coverage depends on workload modes, simulator fidelity, and the chosen invariants; the authors report no false positives for discovered conditions.
  • how much was read: most of it read
  • source
  • record id: avis-2021
• Bridging arrays and ADTs in recursive proofs (2021)
  • what: Presents a fully automatic method for synthesizing recursively defined relational invariants that prove equivalence of paired object implementations when one uses arrays and the other algebraic data types (ADTs). The method encodes initialization, paired transitions, applicability and output equality as CHCs; Algorithm 1 builds a recursive invariant schema, Algorithm 2/3 bridge producer/consumer operations for linear scans, and Algorithm 4/5 use noop observations for sets/maps. Candidate relations are validated by structural induction with AdtInd/Z3. The paper formalizes equivalence as an inductive invariant over a composition of two deterministic objects, with initialization, consecution for every paired operation, precondition applicability in both directions, and output equality. It defines producer/consumer/noop classifications via a partial ordering on ADT states and synthesizes a Skolem-like updated array state plus matching constraints. Recipe 1 handles stacks/queues with an index and can infer loop invariants; Recipe 2 handles sets, multisets and maps by updating only the observed array cell while preserving all other inputs. Validation is structural induction rather than recursion-free SMT checking, and user lemmas are optional (one multiset lemma was needed in evaluation).
  • number: 10 benchmark variants in Table 1
  • number: stack 2.81 s and queue 40.61–42.18 s
  • number: set 2.12/19.24 s; multiset 32.62/3.59 s; map 1.95/5.83 s
  • number: MacBook Pro 2 GHz Intel Core i5, 8 GB RAM
  • limits: Objects are modeled syntactically as predicates obtained from symbolic execution; loop effects must already be expressed as quantified formulas. Programs are deterministic and each enabled precondition has a successor/output. The approach targets finite sets of operations and list-shaped ADTs; it assumes suitable classifications/recipes and SMT quantifier-elimination/array reasoning. CHC solving is undecidable in general, proof search can dominate runtime, and the evaluation is textbook data structures rather than large real software. The method requires monotonic/structural-induction support in AdtInd and may need user lemmas for harder cases.
  • how much was read: most of it read
  • source
  • record id: bridging-arrays-and-adts-in-recursive-proofs-2021
• Brief Announcement: On Strong Observational Refinement and Forward Simulation (2021)
  • what: Shows by example that ordinary forward simulation need not preserve hyperliveness or strong observational refinement when finite and infinite traces are allowed. Defines progressive forward simulation with a well-founded decrease on concrete steps mapped to an empty abstract sequence; states that it implies strong observational refinement. Full theorem proof is external. The counterexample composes a forward-simulated LL/SC implementation with fetch-and-add. A particular LL/SC implementation permits SC failure merely because another thread executed LL, without any intervening write. Alternating threads can therefore prevent both operations from returning. The formal scheduler requirement is nonempty enabled actions after every consistent finite trace, plus object determinism; it does not impose per-thread fairness. Definition 1 forbids infinite internal stuttering through a well-founded concrete-state order. Necessity of the progress condition is future work.
  • limits: Finite and infinite traces; programs composed with labelled transition-system objects; deterministic admissible schedulers. Specific implemented LL/SC semantics permit the counterexample; it does not assert every hardware LL/SC behaves this way. Full proof of Theorem 2 deferred to external reference [3]; no machine-checked artifact or empirical measurements in supplied brief. The motivating text says LL at F2 although pseudocode labels LL at F1; record interprets the operation rather than reproducing that line typo.
  • how much was read: most of it read
  • source
  • record id: brief-announcement-on-strong-2021
• Cameleer: A Deductive Verification Tool for OCaml. (2021)
  • what: Translates GOSPEL-annotated OCaml programs to WhyML and invokes Why3 verification-condition generation and SMT solvers. Extends GOSPEL from interface contracts to implementation annotations including loop invariants and ghost code. Supports a bounded-mutability subset with basic modules/functors; reports a26-case verified gallery. Proof success concerns supplied specifications and translated semantics,conditional on front-end/solver correctness and assumptions. Shows higher-order and functor binary search with loop variants and exceptional postconditions;maps OCaml attributes,ghost code,type invariants and module namespaces into WhyML. Integrates OCaml as a Why3 input format using the Why3 API/session tools,and uses extraction to erase ghost code. Explicitly documents rejection of recursive mutable Queue cells under Why3’s alias discipline,and gives line counts,VC counts,replay times and manual-interaction flags across realistic library fragments and textbook algorithms.
  • limits: Programmer supplies contracts,invariants,termination variants,ghost functions and sometimes manual auxiliary induction/case splits. Discharged VCs prove those formal requirements,not that the requirements express all intended behavior. Axioms in module signatures constrain admissible implementations and must be justified at instantiation. Cameleer trusts its GOSPEL parser/type-checker and OCaml-to-WhyML translator,Why3 typing/effect analysis/VC generation and external solvers. The paper refers to inductive translation rules in the longer report but does not present a machine-checked compiler/refinement correctness theorem in this chapter. Higher-order comparison arguments used in specifications are assumed pure. WhyML’s bounded-mutability discipline requires aliases to be statically known. Effectful higher-order code and recursive mutable data types are limited;arbitrary OCaml pointers/aliasing are not handled by this translation. Supported subset roughly corresponds to caml-light plus basic modules/functors. Objects,GADTs and polymorphic variants are unsupported. Viper/CFML integration and richer heap reasoning are future work in this2021paper,not implemented capabilities established by the case studies. Source integer overflow and precise machine-integer correspondence are not explained in the supplied chapter. Do not infer that mathematical arithmetic VCs automatically prove every OCaml machine arithmetic corner case without checking library models and translation. Case-study proof replay is measured after contracts,lemmas and proof sessions have been developed. “Immediate” means no extra IDE interaction after annotation,not no human proof design. Manual sessions are retained for six cases. No failed-case population,annotation time or developer-effort study is reported. Quoted comparison of tool usability/language suitability reflects author opinion and2021tool scope. Related-work mentions Prusti and Tezos proofs in other tools;neither is an evaluated Cameleer Rust/blockchain case.
  • how much was read: most of it read
  • source
  • record id: cameleer-a-deductive-verification-2021
• Coghetto PAPPUS real projective plane 2021 (2021)
  • title: Pappus’s Hexagon Theorem in Real Projective Plane
  • what: Coghetto formalizes Pappus’s theorem for ProjectiveSpace TOP-REAL3 in Mizar and registers the resulting real projective plane as Pappian and Desarguesian. One route uses determinant/bracket identities and projective-incidence lemmas; the other embeds two lines in a reducible quadratic conic and applies an imported Pascal theorem. Some technical lemmas were proved with Prover9 and translated using ott2miz. The PDF exposes lengthy nondegeneracy obligations and a concrete coordinate sketch, but no automation performance data or checker traces. Records nonzero vector/scalar preconditions, complete incidence/nonincidence infrastructure, precise Pappus intersection pairing, the union-of-two-lines conic construction, imported theorem boundaries and the limited evidence for external ATP proof translation.
  • limits: Target is the concrete real projective plane ProjectiveSpace TOP-REAL3, represented by directions of nonzero real3vectors with collinearity. It is not every abstract projective plane. Proposition18 registers Pappian and Desarguesian properties; the summary credits imported Hessenberg theorem for the latter implication (pp.69,74). MML PAPPUS version8.1.11 5.66.1402 identifies the Mizar article. Summary explicitly says some lemmas in both proof routes use Prover9 and ott2miz. Section2 title identifies Propositions4–16 as technical lemmas proved by Prover9 and translated with help of ott2miz. No per-lemma search times, proof lengths, success rates, raw generated proofs, checker logs or trust-boundary audit is supplied (pp.69–73). Proposition1 expands a3×3 determinant. Proposition2 derives bracket-product equality [p1,p2,p4][p1,p3,p5]=[p1,p2,p5][p1,p3,p4] when projective P1,P4,P5 are collinear and represented by nonzero p1,p4,p5; auxiliary p2,p3 need not be nonzero. Proposition3 transfers eight scalar product equalities to a ninth using18explicitly nonzero real quantities. Those nonzero hypotheses justify cancellation, rather than assuming all determinants are invertible (p.70). Section2 works in a projective space described by collinearity. Proposition4 takes ten explicit point inequalities, a noncollinear reference triple(c1,c4,c7), four input-line incidences and six crossing incidences, then lists28noncollinear triples (some permutations/redundancies). Proposition5 obtains one additional noncollinearity under a shorter incidence/inequality list. These conditions support later determinant cancellation (pp.70–71). Proposition6 transports the initial and crossing incidences into eight convenient orderings. Proposition7 gives four noncollinear triples from two distinct lines and explicit distinctness; Proposition8 changes the reference frame while re-establishing18incidence/inequality/nonincidence clauses. These are formal hypothesis-management steps, not new Pappus conclusions (pp.71–73). Propositions9/10 give disjunctions of failures to rule out degenerate configurations. Proposition11 separates an intersection from c2; Propositions12/13 recover collinearity within each original line; Propositions14/15 derive further distinctness; Proposition16 proves a crossing point noncollinear with a specified pair. Exact hypotheses differ, so these statements do not authorize arbitrary point coincidences (p.73). Proposition17 uses a reference point o and two lines through it, with(o,p1,q1) noncollinear. It requires o distinct from p2,p3,q2,q3, the three p points pairwise distinct and the three q points pairwise distinct. Crossings are r3 on p1q2 and q1p2, r2 on p1q3 and p3q1, r1 on p2q3 and p3q2. Conclusion r1,r2,r3 collinear. No distinctness of the output r points is imposed (p.74). The theorem does not assume all ten named points pairwise distinct: for example p1=o is already excluded by noncollinearity, while the exact additional inequalities and incidences must be preserved as written. The two source lines are distinct because their reference triple is noncollinear; the projective setting includes intersections at infinity, rather than requiring affine nonparallelism (Propositions17/22). Proposition19 packages many noncollinearity and incidence side conditions for the Pascal route. Its printed prose breaks a long negated disjunction awkwardly at “c7,c6. And c4”; this is a presentation limitation. Do not interpret the later “And” as an independently proved positive collinearity; its intended context is the single negated list (p.74). Proposition20 states the all-zero quadratic conic is the entire carrier, so this library conic constructor allows a degenerate zero form. Proposition21 establishes that the nine Pappus points form the library Pascal configuration under the same conditions. This does not alone say any arbitrary nine points on the zero conic have collinear Pascal intersections; imported Pascal hypotheses matter (p.75). Proposition22 repeats Pappus via Pascal. Its sketch selects nonzero representatives u1,u2,u3 of the collinear p points and v1,v2,v3 of the q points. x=u2 cross u3 and y=v2 cross v3 give the two line normals; pairwise distinct p2,p3 and q2,q3 ensure these normals are nonzero. Quadratic coefficients are x1y1,x2y2,x3y3,x1y2+x2y1,x1y3+x3y1,x2y3+x3y2 (p.75). The quadratic evaluates to (u dot(u2 cross u3)) times(u dot(v2 cross v3)). Thus each of the six points on either source line lies on the union-of-lines conic. Proposition21 supplies Pascal configuration and the imported real-projective Pascal theorem yields the crossing collinearity. The PDF prints the factorization sketch but not the full final theorem instantiation/checker script. Its last mixed coefficient reuses the name x1, shadowing an earlier coordinate; distinguish these roles when reconstructing the formula (p.75). The two presented proof routes are not independent proof-assistant implementations: both belong to the same Mizar development, use technical ATP-supported lemmas and import library results. Coq Grassmann-Cayley and Tarski-geometry formalizations are cited as related work, not evaluated or independently read here (p.69,references). Exact quotations preserve raw-extraction defects, including “6=” for not-equal, sub/superscript ordering and awkward Proposition19 sentence segmentation. Renderings were checked. All22propositions/subclauses, four footnotes and13references read. No examples with numeric coordinates, experimental measurements, Verus/Rust/TLA+, distributed protocols or LLM proof agents appear; no artifact execution.
  • how much was read: most of it read
  • source
  • record id: coghetto-pappus-real-projective-plane-2021-2021
• Diffy: Inductive Reasoning of Array Programs Using Difference Invariants (2021)
  • what: Diffy verifies selected parameterized array programs by induction on positive array-size parameter N. It splits PN into QN-1 plus a peeled suffix, relates QN-1 to PN-1 through product-program difference invariants, transfers the smaller-program postcondition, and verifies the peel with iterative strengthening or recursively reduced loop nesting. At60seconds it proves151/157 safe cases and detects142/146 unsafe cases on an enhanced303-program suite. Distinguishes QN-1 (only loop bounds truncated, with data-dependency repairs) from PN-1 (all N replaced), explains required precondition splitting and cross-program coverage, records conditional peel simplification and failed loop propagation, and retains the strengthen-transfer obligation rather than treating arbitrary quantifier elimination as sufficient. Complete category results, timeout sensitivity, baseline wins and source formula/indexing gaps qualify headline superiority.
  • limits: §3: program grammar has scalar/array assignments, conditions, sequential composition and well-nested for loops, each with a unique counter initialized0 and incremented1, never assigned by the body. Upper bounds use N, constants and enclosing counters, not arbitrary mutable data. N is a positive integer size parameter. It does not cover arbitrary C pointers, concurrency, recursion or distributed failures. §3: properties are universal arithmetic-index guards implying quantifier-free array/integer arithmetic predicates, or quantifier-free formulas. Scalars and arrays undergo SSA renaming, including separate array versions per loop and distinct writes. The mathematical domain is integers/arrays; the paper does not establish C overflow, pointer aliasing, division edge cases or machine memory-safety semantics end to end. §§2,4.1: PN-1 replaces all occurrences of N by N-1; QN-1 truncates loop-bound N while preserving data-expression N, then repairs uses affected by moving peels. Correct construction must establish PN semantically equivalent to QN-1;peel(PN). It is not enough to append last iterations without propagating all data/control dependencies. §4.1: nested-loop exposition assumes inner-body writes are not used later in outer fragments, and outer writes used by the inner body are not overwritten again. Relaxations are delegated to extended[13]. Algorithm1 aborts a needed substitution from a peel that is still a loop; implementation sometimes uses closed-form summaries, unused-write reasoning or conservative overapproximation. Thus it does not automatically transform every grammar-accepted nested array program. §4.1/Lemma1: strictly smaller maximum nesting depth is proved for linear upper bounds in N/enclosing counters, whose difference on replacing N by N-1 is constant. Corollary that a nonnested program has loop-free peel inherits conditions; general nonlinear bounds need not yield constant many peeled iterations. Missed-iteration construction also needs sensible nonnegative ordered bounds; grammar alone does not state all monotonicity/boundary conditions. The theorem should not be generalized to arbitrary decreasing/negative bounds without additional validation. §4.2: phi(N) must imply phi-prime(N-1) and delta-phi-prime(N), with split remainder facts not modified by PN-1/QN-1 as needed. For conjunction over indices0..N-1, restrict only index range for phi-prime and retain N inside each conjunct; remainder is last-index conjunct if untouched. If no iterated conjunction, proposed default is phi-prime=phi(N),delta=True. Correct input coupling between the two program runs is essential. §4.3: product graph has synchronized loop iteration structure; corresponding branches synchronize only after establishing equivalent guards, otherwise all four branch pairs are considered. Dataflow tracks equalities and disjunctions of equalities between corresponding variables/array elements at loop heads/exits/branches. At-most-quadratic N expressions are an experimental observation, not a theorem for arbitrary programs. Interval inequalities and template guess/check are possible extensions, not evaluated implemented capabilities. §§2,4.4: transferred postcondition is exists VP: psi(N-1) and D(VQ,VP,N-1). Equality substitution can eliminate VP, or SMT quantifier elimination is used. Stronger peel preconditions need corresponding original-program strengthenings satisfying xi(N) and D implies xi-prime(N). The paper explicitly notes this can require logical abduction; arbitrary existential projection over VQ does not by itself establish that universal transfer implication for nondeterministic/nonfunctional D. §4.4/Theorem2: soundness is conditional on valid original strengthened bases1..M, valid xi-and-D transfer for allN, sound program/precondition transformation and valid strengthened peel Hoare triple. Paper states Theorem1/equivalence and Theorem2/soundness without full proofs here; only nesting lemma has an explicit proof. No mechanized proof of transformation/dataflow/LLVM implementation or independently checked proof certificate is reported. §4.4/Algorithm2: initial base N1 failure reports counterexample; later inability to strengthen, invalid strengthening base or timeout returns False meaning unable to prove. A failed induction step or spurious strengthening is not evidence of an original-program counterexample. Text allows checking small fixed N values; unsafe detection is incomplete for bugs appearing only beyond checked sizes. Parameter induction proves safety obligations, not a stated total-correctness/termination theorem. §§2,4.4: strengthening iteration need not converge, and tool uses timeout. If weakest precondition cannot be obtained and peel has a loop, recursion invokes Diffy on the peel; the nesting argument is conditional as above. Difference invariants are postcondition independent and reusable, but strengthening is property dependent. Printed source issues, visually confirmed: Algorithm1 line4 ranges loop indices throughN though line1 givesm loops; line16 usesLi in helper parameterizedL. Algorithm2 shifts D argumentsN-1/N and line22 references chi-prime(N) while line16 computed chi-prime(N-1); prose points to line6 for elimination actually at22. These are schematic/indexing gaps, not verified implementation bugs. Printed example issues: §4.3 calls forall i in0..N-1:a-prime[i]-a[i]=1 a first-loop-head invariant, omitting the processed-prefix restriction or entry relation that would make it valid before all writes. §4.4 p927 prints peel precondition x-prime=(N-1)^3; for Fig2 peel x:=x+N^2 and final b[N-1]=x+N-1, required pre-peel x is N^3-N^2=(N-1)N^2. Thus displayed primed formula cannot be accepted literally with the shown update; this does not establish unsoundness of the tool source, which was not audited. §5: C++ prototype,LLVM6.0.0,Z3 4.8.7; benchmarks on i7-6500U2.5GHz,16GB,Ubuntu18.04.5. ComparatorsVajra1.0,VIAP1.1,VeriAbs1.4.1-12. Main timeout60s. No repeated-run variability, independent proof replay, random sampling or broad production-corpus evaluation supplied. §5:303 benchmarks combine entire prior Vajra suite with added challenging cases;157safe/146unsafe. C1 has no N-dependent branches,modulo or nesting; C2 has N-dependent branches/modulo without nesting; C3 has nesting. Success on this designed suite is not superiority on all SV-COMP submissions or arbitrary C array programs. Unsafe cases are described as unsafe versions of safe examples, not an independent production bug sample. §5/Table1:Diffy151safe with3inconclusive/3timeouts,142unsafe with4inconclusive;Vajra110safe/115unsafe;VeriAbs110safe/125unsafe;VIAP20safe/120unsafe. Diffy proves all safe benchmarks proved by Vajra/VIAP within 60 seconds but not VeriAbs: VeriAbs proves2C2+3C3 safe cases Diffy misses. These paired wins support portfolio use; totals alone hide complementarity. §5:3Diffy safe timeouts arise in modulus induction SMT queries;3safe inconclusive cases lack predicates. At100seconds Diffy/Vajra/VeriAbs outcomes remain unchanged, VIAP additionally proves89safe C1/C2 cases (reader total109), unsafe counts unchanged. The earlier claim VIAP takes70seconds more on average is not compatible with a straightforward60second completed-run comparison; aggregation/set/budget is unspecified. Do not present it as a verified common-instance speedup. §§6–7: existential-property generalizations and relaxed nested restrictions are delegated to extended arXiv paper, not read here. Synthesis of difference invariants remains future work. No Rust/Verus/TLA+ result, protocol/network model or LLM use/evaluation is reported. Artifact DOI10.6084/m9.figshare.14509467 not run.
  • how much was read: most of it read
  • source
  • record id: diffy-inductive-reasoning-of-2021
• Dijkstra Monads Forever: Termination-Sensitive Specifications for Interaction Trees (2021)
  • what: This is a spec framework in Coq for programs written as interaction trees. It can express termination, divergence, and full infinite output traces.
  • number: no runtime, proof size or person-hours reported
  • number: Proved cases: square-root loop, Boolean query loop, stateful input/output loop printing multiples
  • number: No runtime, proof size, person-hours or benchmark success rate reported
  • limits: It gives reference semantics only, not production code. It generates the verification condition automatically, but humans supply the invariants and termination measures.
  • how much was read: most of it read
  • source; notes: Dijkstra Monads Forever: Termination-Sensitive Specifications for Inte; notes: Dijkstra Monads Forever: Termination-Sensitive Specifications for Inte; notes: Concrete problem records
  • record id: dijkstra-monads-forever-termination-2021
• Doczkal Wagner hypermaps Coq 2021 (2021)
  • title: A Variant of Wagner’s Theorem Based on Combinatorial Hypermaps
  • what: Doczkal reports a constructive Coq proof that a finite simple graph with neither K5 nor K3,3 minor and no isolated vertices admits a genus-zero combinatorial hypermap embedding. Reusing Gonthier’s four-color theorem then yields four-colorability for every such minor-excluding graph, including isolated vertices. Proof combines finite separator/minor arguments with hypermap operations, combinatorial Jordan theory and an explicit bridge to ordinary graph representations. Converse and a bridge to actual real-plane drawings remain outside the completed result. Preserves no-isolated-vertices technical premise, one direction only and nongeometric embedding semantics; details minor-map/3-connected contraction/neighbor-segment arguments, genus arithmetic and inherited Jordan/Walkup lemmas, computed K4 and negative K3,3 example, type-changing isomorphisms and generalized induction, lossy modification interfaces and gluing invariants, 7000-line effort and future closures.
  • limits: Graph carrier is finite; adjacency is irreflexive/symmetric. H minor of G means disjoint nonempty connected branch sets in G indexed by H, neighboring whenever H vertices are adjacent. G/xy deletes y and attaches its neighbors to x; it is an edge-contraction minor only when x−y. H-free excludes H as a minor, not merely as a subgraph. k-connected requires k<|G| and all separators size≥k. Proper separations require both exclusive sides nonempty; visual overlines in §2 distinguish exclusive sides, which flow extraction drops (§2). Exact Coq Wagner theorem assumes no_isolated G plus no K3,3/K5 minors and concludes inhabited(plane_embedding G). It proves the minor-exclusion→embedding direction, not the converse, and uses combinatorial genus-zero embedding rather than an actual drawing in R^2. Informal Theorem 8 omits technical no-isolates premise; Theorem 31/code restores it. Source reports constructive development without classical axioms because finite decidable domains support case distinctions/maximal finite choices. Reader did not inspect theorem axioms or extract/run an embedding algorithm (§1, §4, §9–10). Hypermap is finite darts D with permutations e,n,f and n∘f∘e=id. Their cycles encode edges, nodes and faces; retaining redundant third permutation helps symmetry reasoning. Plain means every edge cycle has two darts; loopless means paired darts lie in different node cycles; simple means at most one edge cycle links any two node cycles. Genus=((2C+|D|)-(E+N+F))/2, where C counts components and E,N,F permutation cycles. Inherited Euler inequality and evenness ensure natural subtraction does not truncate and division has no remainder; planar means genus 0 (§5). Embedding map goes from darts to graph vertices, g:D→G, surjective; node-orbit equality iff vertex equality and hypermap node adjacency iff graph adjacency. Requires plain hypermap; looplessness follows from irreflexive G, but parallel edges permitted. This intentional extra multiplicity reduces constructor/gluing obligations; can later simplify when needed. No distinguished outer face or arrangement/nesting between components; more closely models one sphere per component. Every represented node has an incident edge, so isolated vertices cannot be represented under surjectivity (Definition 20, Remark 21). Combinatorial core: for 3-connected G of ≥5 vertices there is an edge whose contraction remains 3-connected. Contradiction proof assumes all contractions fail, extends each edge to size 3 separator, maximizes a remaining connected component F and derives larger component via adjacent z,u unless a forbidden size 2 separator exists. Finite maximal search is constructive. For minor-free G with adjacent x,y, duplicate-free cycle C disjoint from x,y and neighbor subsequences X,Y each size≥2, all Y lie between two successive X vertices, including endpoints. Three common neighbors yield K5 branch sets; alternating X/Y quadruple yields K3,3 branch sets. Existing MathComp arcs needed substantial additional cycle-splitting API (§4). 3-connected induction: K4 is base. Contract suitable xy edge, embed smaller graph, delete merged vertex; remaining graph 2-connected, deleted neighbors lie on a face with duplicate-free boundary. Excluded-minor segment lemma puts y-neighbors in one x-neighbor interval. Insert x and then y across faces, restoring G. Non-3-connected induction splits at smallest separator of size 0,1,2. For size 2 {x,y}, marker edge xy added to both sides; Lemma 6 preserves minor exclusion only for smallest proper size 2 separator. Glue along marker edge, then remove it if absent originally. Topological stretching/outer-face choices disappear in representation (§3–4, §7–8). Inherited §5 results from Gonthier include genus arithmetic, Walkup operations and combinatorial Jordan theorem, not new proofs claimed by this paper. Walkup removes one dart while adapting one permutation, never increasing genus; certain reverse operations preserve genus exactly. Jordan criterion excludes a duplicate-free (n^-1 union f)-path from x to n(y) visiting y before n(x), for distinct darts, with y=n(x) allowed. It is a theorem of finite permutation maps, not a proved equivalence to topological Jordan curves (§5). Concrete K4 uses 12 darts for 6 edges, explicit permutations/map and MathComp DFS to compute genus and brute-force embedding conditions over domains 4/12. Author-reported kernel-checkable finite computation, not reader replay. Negative K3,3 example simplifies embedding, N=6,E=9,D=18,C=1; each face ≥4 darts by bipartite no-odd-cycle property so F≤4; parity excludes F=4, hence positive genus. Conclusion also reports nonembedding K5, though detailed §6 worked proof is K3,3. Obstruction nonembedding alone does not prove missing general converse (§6, §10). Theorem 25: faces in 2-connected plane graph have duplicate-free graph-vertex cycles. Underlying Lemma 26 assumes plain/loopless/planar map and contour-path connectivity after deleting any node orbit; it prevents distinct darts sharing both node and face orbit. Proof splices paths into forbidden Moebius contour, invoking inherited Jordan theorem. Graph2-connectivity supplies avoiding paths, lifted into contours. This two-stage pattern proves hypermap facts then exposes graph-level lemmas to main induction (§6). Lemma 27 restricts darts to subset P, with edge/node permutations given by skip-to-next-P operation, provided result is a hypermap; genus cannot increase. Prove by removing single excluded dart using WalkupF and cross-carrier isomorphism. Generalizing to all hypermaps, rather than plain ones, enables odd intermediate dart counts. New isomorphism permits bijection between different dart types preserving all three permutations; old four-color development’s same-carrier equivalence was too restrictive. Generalized theorem and richer isomorphisms are proof-engineering consequences of changing carriers (§7). Lemma 28 deletes vertex x from 2-connected G, simplifying hypermap and deleting all edge cycles incident on x. Remaining darts are complement of e-orbit closure of x node orbit; overline visible in PDF but lost in flow text. Other nodes retain darts, and adapted face permutation joins all former neighbors on a face. Uses Lemma 26 to control how many removed darts a face traversal skips. Lemma 29 inserts new z adjacent to chosen face subsequence between x,y, producing face [x,z,y]++q; reverse double-Walkup proves planarity. Both lemmas deliberately prove existence/needed face only, not preservation of every untouched embedding part; such stronger frame-like property is future potential, not current guarantee (§7). Gluing uses disjoint union then nonadjacent node identification. Swap successors in node permutation and corresponding inverse-face positions; keep darts and edge permutation. For different node cycles on same face, N decreases 1/F increases 1; for separate components N,F,C all decrease 1, preserving Euler genus. Arbitrary pairs in one component do not get unconditional planarity preservation. Shared-vertex gluing uses separate components; shared-edge gluing identifies endpoint pairs in sequence, choosing faces so second pair remains cofacial. Parallel edge allowance avoids deleting duplicate edge darts (Lemma30, §8). Structural four-color theorem has no no-isolates restriction: restrict to vertices with nonempty neighborhood, apply embedding theorem then existing planar-loopless-hypermap four-color theorem, transfer colors through node correspondence and color isolated vertices arbitrarily. Final graph statement mentions neither hypermaps nor regions, so it remains a meaningful theorem about ordinary finite graphs without proving the chosen model equivalent to Euclidean drawings (§9). Author reports about 7000 added Coq lines, increasing prior graph-theory library by >one third; about half address hypermap/embedding operations. Formalization in coq-community/graph-theory 0.9, builds on MathComp, previous graph library and Gonthier FCT. Archive 81966a945703d0e2a85fe34e920f4fe9a46b6e03. No runtime/solver benchmark, theorem completion rate, ablation or independent build performed; size and qualitative steep learning curve are author reports (§1, §10). Unfinished: converse embedding→minor exclusion (Kuratowski route needs removing-edge-subdivision closure), isolated-vertex model relaxation by dropping their surjectivity obligations, uniqueness up to hypermap isomorphism for 3-connected embeddings, and convex/real-plane embedding bridge. Convexity cannot be expressed by current permutation model. Suggested abstract embedding interface or constructing geometric drawing from unique hypermap is future work. Reference 3 is distributed-algorithm verification related work; current paper verifies no distributed protocol, TLA+, Rust/Verus or LLM proof agent (§10).
  • how much was read: most of it read
  • source
  • record id: doczkal-wagner-hypermaps-coq-2021-2021
• DSS (2021)
  • title: Detectable Sequential Specifications for Recoverable Shared Objects
  • what: Defines detectability by transforming an ordinary sequential object specification into a detectable sequential specification (DSS). Per-process abstract state remembers a prepared operation and its response. prep-op announces the operation, exec-op performs it, and resolve reports whether it took effect and its response; ordinary operations remain available without detection. Section 2 gives the state transformation and four operation axioms. prep-op and resolve are total and idempotent, while exec-op requires the matching prepared operation with no recorded response. An auxiliary parity bit can distinguish repeated identical operations. DSS is combined with a separate concurrency correctness condition and leaves nesting recovery to the application. Section 3 derives a queue from the Michael–Scott/durable queue: tagged per-thread pointers record operation preparation and completion, CAS and helping maintain the linked list, and Appendix A supplies a centralized recovery scan. A variation replaces centralized recovery with individual recovery. Theorem 1 states lock-freedom and strict linearizability, but the article omits the analysis and detailed model. Section 4 measures failure-free queue throughput on real Optane memory.
  • number: up to 20 threads on 20 cores
  • number: 30-second runs, ten runs per point, standard deviation <2% of mean
  • number: non-detectable DSS nearly 3× detectable DSS throughput at low parallelism
  • number: MS up to 1.5× non-detectable DSS at two threads
  • limits: A recovering process must retain its identifier across crashes to query its previous operation; this conflicts with the fresh-identifier model underlying durable linearizability. DSS specifies sequential behavior and requires a separate concurrent correctness condition. The queue uses asynchronous shared memory, persistent memory, volatile caches, explicit flushes and system-wide crashes. Correct nesting is an application responsibility. The correctness theorem is stated rather than proved in this article. Experiments cover failure-free runs, use debug compilation at O0 and sequentially consistent atomics, and do not measure crash recovery latency. The log queue comparator is the authors’ implementation and could be optimized further.
  • how much was read: most of it read
  • source
  • record id: dss-2021
• dtree variable-length state storage (2021)
  • title: Recursive Variable-Length State Compression for Multi-Core Software Model Checking
  • what: Introduces dtree, a concurrent chain-of-balanced-trees storage structure for variable-length model-checker states, supporting partial reconstruction and incremental delta updates; integrates it into the DMC multi-core checker. The paper contrasts dtree with TreeDBS and Compact Tree, explains why fixed alignment fails under dynamic allocation, and defines a StateID combining root index and length. Its API supports insert, delta, full/partial get and nested sub-states, enabling models to update heap regions without reconstructing complete states. Dtree experiments model Michael-Scott queues, sorted linked lists and concurrent hash maps, then compare 118 BEEM fixed-length models against LTSmin/TreeDBS, Compact Tree and SPIN Collapse. Results expose the trade-off: dtree wins on variable-length variance but loses compression on fixed-length vectors because its chain can be less balanced.
  • number: up to 2.9x faster and 29% less memory for variable-length models
  • number: 118 BEEM models
  • number: 64 threads; 96 physical cores
  • number: Compact Tree up to 2.3x more compression
  • limits: State slots are 32-bit and StateID allocates a fixed 40-bit index plus length budget; the chain-of-trees shape trades fixed-length compression for append/dynamic allocation. TreeDBS/Compact Tree comparisons require padding or auxiliary storage and exclude models with unsupported adjacent −1 values or excessive size. DMC’s search core is simple parallel BFS; experiments use 64 threads on one 96-core machine, so results are implementation- and workload-dependent. Future work includes better root tables and work stealing.
  • how much was read: most of it read
  • record id: dtree-variable-length-state-storage-2021
• ESBMC SMT-based C++ model checking (2021)
  • title: Model Checking C++ Programs
  • what: Presents an SMT-based bounded model checker for C++ in ESBMC with operational models for templates, inheritance, polymorphism, STL containers, and exception handling. It encodes bounded executions into decidable first-order SMT constraints and compares ESBMC with LLBMC and DIVINE. Details type checking and template instantiation, inheritance/polymorphism encodings, a C++ operational model replacing STL with contract-like assertions, and exception-to-control-flow encodings. The study evaluates 1,513 C++03 programs and includes a commercial telecommunications Sniffer application.
  • number: ESBMC correctly verified 84.27% of 1,513 benchmarks in about 4 hours (§8)
  • number: Standard Containers success rates: ESBMC 78.45%, LLBMC 70.36%, DIVINE 44.69% (§6.2)
  • number: Benchmark set contains 543 buggy and 970 bug-free programs (§6.1)
  • number: Sniffer contains 20 classes, 85 methods, and 2,800 lines of C++ (§6.3)
  • limits: Verification is bounded by loop-unwinding/call bounds and depends on the correctness of the simplified C++ operational model (COM) for STL semantics. Coverage targets C++03 and lacks several C++11 features; template/SFINAE support remains incomplete. CBMC comparison is limited because CBMC aborts or lacks STL support on this benchmark set.
  • how much was read: most of it read
  • record id: esbmc-smt-based-c-model-checking-2021
• Failure-aware actor Synod progress (2021)
  • title: Verification of Eventual Consensus in Synod Using a Failure-Aware Actor Model
  • what: Introduces a predicate-fair failure-aware actor model (FAM) and mechanically verifies sufficient asynchronous conditions for eventual progress of the basic Synod protocol without a unique leader. The report formalizes proposers, acceptors, quorum predicates, message transitions and actor availability/failure in an asynchronous actor semantics. It states fairness axioms for send/receive, nonfaulty-agent assumptions, and P1/P2 proposal-number conditions preventing higher-numbered interruption. Lemmas show eventual promises and votes from a nonfaulty quorum; Theorem 1 derives that some proposal is eventually learned as chosen. Athena and SPASS mechanically check the proof sketches in roughly 6000 lines. The appendices include the actor-language operational rules and code correspondence discussion.
  • number: about 6000 lines of Athena code
  • number: quorum conditions use >2/3 only where specified by application context
  • number: four Synod message types: 1a, 1b, 2a, 2b
  • limits: Safety is inherited from Synod; the result is eventual progress, with no time bound. The sufficient condition CND assumes a nonfaulty proposer eventually ready to send a P1/P2 proposal to a quorum of nonfaulty acceptors. FAM assumes stable storage, uncorrupted but asynchronous messages, and fairness axioms; failures can be temporary or permanent, but progress requires the relevant actors eventually available. The proof does not use generic predicate fairness directly, instead relying on a system-specific uninterrupted-proposal property. Applicability to UAM timing requires additional bounds not proved here.
  • how much was read: most of it read
  • record id: failure-aware-actor-synod-progress-2021
• Fidelity QCTL quantum Markov chains (2021)
  • title: An Algebraic Method to Fidelity-based Model Checking over Quantum Markov Chains
  • what: Defines QCTL, a fidelity-based quantum analogue of CTL over super-operator-weighted quantum Markov chains, and decides formulas by synthesizing path super-operators and reducing fidelity threshold queries to existential-real quantifier elimination. The algorithm removes the direct sum of all bottom strongly connected component subspaces covering fixed points, represents path super-operators as explicit matrices, and handles bounded/unbounded until formulas. The paper derives polynomial complexity for concrete initial quantum states and exponential complexity for parametric initial states, then implements the method in Mathematica/Reduce on a quantum IPv4 protocol.
  • number: fidelity-quantifier formulas are decidable in exponential time for parametric initial states
  • number: concrete initial state gives polynomial-time corollary
  • number: matrix synthesis complexity is analyzed as O(N⁶) in the presented setting
  • number: IPv4 running examples complete within a few seconds; synthesis uses nearly 30 MB and deciding at most 50 MB; concrete-state fidelity usually under 1 second
  • limits: Exact decidability relies on finite-dimensional QMC matrix representations and real-algebraic quantifier elimination; parametric initial states incur exponential worst-case cost. The IPv4 demonstration is a running example rather than a broad benchmark, and future work identifies conjunction, negation, multiphase-until, and parametric extensions.
  • how much was read: most of it read
  • record id: fidelity-qctl-quantum-markov-chains-2021
• Formal Verification of Termination Criteria for First-Order Recursive Functions (2021)
  • what: # Whole reading: Formal Verification of Termination Criteria for First-Order Recursive Functions (authored by agents unless marked 🧑) The paper connects several definitions of first-order function termination in PVS and proves a finite test for a given matrix-weighted graph. Ackermann supplies the worked example. Finding suitable measures and proving graph labels remain separate proof tasks; the proposed reflection-based integration was still under development. The paper reports no new runtime benchmark. The complete 17-page paper, all five figures, proof sketches, pseudocode and references were read. Detailed source-linked findings are in reader-diagnostics.json, including the apparent Figure4/Example38 matrix discrepancy. Source and prose reviews remain pending. Final exhaustive-task acceptance is separate.
  • limits: Embedded first-order univariate model, atomic built-ins, existential graph/measure choice and proved labels; D2/D6–D10. Apparent printed example discrepancy D12.
  • how much was read: most of it read
  • source
  • record id: formal-verification-of-termination-2021
• FORTify (2021)
  • title: Certifying Proofs in the First-Order Theory of Rewriting
  • what: Defines a line-oriented certificate language for the decidable first-order theory of rewriting over linear variable-separated TRSs, implements FORT-h to emit certificates, and presents FORTify, an Isabelle-formalized/code-generated certifier that checks the automata construction and final emptiness claim. Certificates encode formulas with de Bruijn indices and implicit RR1/RR2 tree-automata operations (GTTs, closure, projection, products, complement and emptiness) while avoiding EXPTIME automaton-equivalence checks. FORTify’s Isabelle proof connects formula semantics to automata predicates and proves check_certificate correctness; executable generation required Horn inference for inductive sets, container-backed red-black trees and epsilon-removal optimization. FORT-h extends FORT from left-linear right-ground to linear variable-separated TRSs and emits witnesses. Examples cover normalization, commutation and a COPS ground-confluence conflict.
  • number: COPS #1118 certificate certified in 2 min 57 s
  • number: GCR set: FORT-h solved 36–37 YES and 83–84 NO per formula under 60 s; FORTify certified only 6–16 results
  • number: GNFP set: 122/122 systems mostly solved; FORTify certified 20–50 per formula
  • number: GCOM: FORT-h solved 1,381 YES and 6,120 NO with 2 timeouts; FORT solved 1,354/6,100 with 49 timeouts
  • limits: Decidability and the formalized checker assume finite linear variable-separated TRSs over a nonempty signature and ground-term semantics; open/non-ground properties and many-sorted extensions are future work. Parser module A and the Glasgow Haskell Compiler are trusted because they are outside Isabelle verification. FORTify can be very slow: many certificates time out, with transitive closure and automata power-set operations dominating. FORT-h and FORTify require compatible certificate syntax and tool-generated claims.
  • how much was read: most of it read
  • record id: fortify-2021
• Ghost Signals: Verifying Termination of Busy Waiting (2021)
  • what: Develops a modular Hoare/separation-logic approach to termination of busy-waiting programs under fair scheduling. Ghost signals represent conditions other threads must establish; linear obligations require setting them. A well-founded partial order forbids waiting on a signal at or above any obligation held by the waiter. Data-structure invariants tie signals to real conditions, allowing resource-local proof of waiting over arbitrary shared structures. §2 derives the logic through thread-safe physical signals, non-thread-safe signals guarded by mutexes, arbitrary heap cells, then erasure into ghost state. An augmented operational semantics makes a thread get stuck if it exits with outstanding obligations; fork transfers obligations rather than discarding them. A program-order graph tracks the path carrying each obligation. A minimal infinitely-waited signal would have an infinite obligation path that can wait only on finitely-waited lower signals, yielding contradiction under fairness. Points-to/signal ownership prevents races. Mutex acquisition creates a release obligation and also obeys the level order. §3 splits signal-ID allocation from initialization so a fixed finite collection of signal IDs can be named early without creating premature obligations. Loop iterations may select from a finite signal set, and outer productive loops use ordinary decreasing counters. §5 explains call/wait permissions and thread phases; permission consumption only in descendant phases prevents a self-fueling busy loop. §6 describes a possible reduction of termination to instrumentation safety for higher-order step-indexed logics.
  • number: bounded FIFO: 37 C lines, 160 proof-annotation lines, reported 435% annotation overhead, 0.08 s verification
  • number: CLH: 49 C lines, 343 annotation lines, 700% overhead, 0.1 s verification
  • number: example: FIFO capacity 10, 100 values, 200 signal IDs; levels pop(i)=102−i and push(i)=101−i, mutex level 0
  • limits: Termination relies on fair thread scheduling and a well-founded signal/mutex-level order; proof authors supply invariants, levels and ghost actions and must discharge every obligation. The proceedings presentation restricts busy loops to with-mutex-await syntax and ultimately to a finite fixed set of signals per loop; the external report generalizes looping/recursion. Physical machine memory models are not analyzed; claims use the presented language semantics. Higher-order assertions are not supported by this logic itself; Iris integration is proposed, not demonstrated as a mechanized embedding here. Abstract specifications for CLH require a suitable level universe supporting bounded infinite level sets. No automated signal/invariant/level inference or LLM experiment is reported. The server I/O-liveness result is a linked combined-logic artifact, not a full server proof included in these pages.
  • how much was read: most of it read
  • record id: ghost-signals-verifying-termination-2021
• Gillian Part II (2021)
  • title: Gillian, Part II: Real-World Verification for JavaScript and C.
  • what: Introduces separation-logic verification in the multi-language Gillian symbolic-execution platform. A language instantiation supplies a trusted compiler to GIL and a compositional memory model; core predicates with consumer/producer actions describe memory resources, including negative information such as absent properties, freed C blocks, and out-of-bounds cells. The same language-independent AWS message-header predicates are connected to JavaScript and C implementations. Sections 2–3 define GIL state/action semantics, partial commutative monoids, well-formedness, path-covering symbolic memory actions, assertion satisfiability and function-specification calls. The JS model uses object properties, domains and metadata; the C model uses cells, bounds and freed blocks, with symbolic arrays represented by optimized trees. Sections 4–5 layer a pure byte-list encryption-context specification over JS ArrayBuffers/Uint8Arrays and C byte cursors/hash tables, then verify complete, incomplete and malformed header behavior. JS verification took 3 person-months and about 45 seconds; C took 2 person-months and about six minutes, using roughly 1.2 kLOC language-independent lemmas, 1.2 kLOC language-dependent abstractions and 1.1 kLOC annotations/invariants. Two JS bugs (prototype poisoning and mutable authenticated data) and three C bugs (malformed-header acceptance, NULL+0 undefined behavior, and 8-byte over-allocation) were fixed. The paper also records caveats: axiomatized ES6 built-ins and toUtf8 in JS, omitted TypeScript types/unsupported syntax, and axiomatized C hash-table/array-list libraries and allocator functions.
  • number: 3 person-months JS and 2 person-months C verification
  • number: ~45 s JS and ~6 min C
  • number: ~1.2 kLOC language-independent lemmas
  • number: ~1.2 kLOC language-dependent abstractions
  • limits: Soundness depends on a trusted TL-to-GIL compiler preserving memory semantics, correctly implemented PCM/well-formedness/action models, and separation-logic specifications. JS verification elides TypeScript types, rewrites unsupported ES6 patterns, axiomatizes ArrayBuffer/DataView/Uint8Array/Object.freeze/Array.map and assumes injective toUtf8. C verification axiomatizes AWS container libraries, assumes allocators are malloc/calloc/realloc, and substitutes aws_byte_cursor_advance for the Spectre-hardened variant. The reported correctness therefore covers the modeled module and these assumptions.
  • how much was read: most of it read
  • source
  • record id: gillian-part-ii-2021
• Global Petri-game winning conditions (2021)
  • title: Global Winning Conditions in Synthesis of Distributed Systems with Causal Memory
  • what: Classifies decidability of global winning conditions in Petri games for asynchronous distributed synthesis with causal memory. For bounded system players and one environment player, the paper reduces bad-marking synthesis to a finite Büchi game. Decision tuples encode players, last mcuts, NES status and backward histories; backward moves detect bad concurrent markings and nondeterminism, while NES handles infinite system-only behavior. Strategy translations prove equivalence and yield a 2-EXPTIME decision procedure with exponential strategy construction. PCP reductions establish undecidability for good-and-bad markings and for good markings with role-changing players.
  • number: 2-EXPTIME decidability for bounded system players, one environment player and bad markings
  • number: winning strategy constructible in exponential time
  • number: undecidable with at least two system and one environment player for good-and-bad markings
  • number: undecidable with at least three players and role changes for good markings
  • limits: The decidability theorem assumes a bounded number of system players, exactly one environment player, finite Petri games and global bad-marking safety. The Büchi construction uses finite causal-history encodings, backward moves, and a restriction/handling of NES cases. Liveness with good markings becomes undecidable in broad classes; open corner cases remain. Results are proofs and constructions, not empirical tool benchmarks.
  • how much was read: most of it read
  • record id: global-petri-game-winning-conditions-2021
• GPU Acceleration of Bounded Model Checking with ParaFROST (2021)
  • what: ParaFROST combines one CPU CDCL search thread with GPU variable/clause elimination before and during solving. Adds compact device clauses, capacity-checked parallel resolution/substitution, assumption-variable protection for incremental solving and a restart-independent multiple-decision schedule. CBMC experiments on168 AWS Core C99 bounded verification instances show155 solved with GPU or GPU+MDM, versus154 for a CPU-only ParaFROST variant and143 for CaDiCaL/MiniSat. Details the actual CPU/GPU work split, all clause metadata/byte costs, independent-variable scheduling, learned/original clause restrictions and memory accounting. Preserves boundedness versus induction, experimental denominators and CPU baseline improvements, parenthetical comparison ambiguity, missing significance method and the geometric-average/max speedup distinction.
  • limits: §§1–2: evaluates SAT-based bounded checking of safety properties through CBMC, not arbitrary SMT solving or an unbounded distributed-protocol verifier. UNSAT at a selected unwind depth does not itself establish all-execution correctness; k-induction is background, with no separate inductive completeness experiment supplied. §2: incremental formulas use selectors sigma_i to disable previous error disjunctions and activate the current one through assumptions, while retaining learned clauses. Assumptions are temporary assignments, not permanent contradictory units carried into subsequent bounds. §3 excludes all assumption variables from elimination so incremental queries remain meaningful. §3: CUDA C++ v11 implementation is based on CaDiCaL and patches a C++ CBMC interface for configuration. GPU handles simplification; CPU handles sequential search, scheduling of independent variables and unit propagation. Asynchronous batched transfers overlap host formatting with copying, not arbitrary parallel CPU/GPU CDCL search. §3: device clause header has state2bits,used2bits,two bookmarks1bit each,lbd26bits,size32bits and signature32bits. Each literal32bits includes sign1bit/identifier31bits. Total12+4t bytes versus MiniSat4+4t,CaDiCaL28+4t and prior GPU20+4t. Lower header cost is not total measured solver/GPU memory and does not establish absence of every out-of-memory condition. §3/Fig3: supports AND/OR, inverter, if-then-else and XOR substitution; RES only on original clauses, SUB promotes retained learned clause to original when needed, ERE cannot delete an original clause relying on learned parents. Equi-satisfiability is the preservation goal, not full model equivalence over eliminated variables. No proof reconstruction/checker or complete assignment-reconstruction procedure is evaluated. §3: variables scheduled together share no clause, preventing those local elimination threads from writing overlapping clause sets. Clauses are marked deleted before deferred removal. Occurrence cutoff mu rises across iterations. This dependency argument is not a mechanically proved CUDA race-freedom or entire-memory-safety theorem. §3/Algorithm1: scan each selected variable for rule and output clause count beta/literal count gamma; exclusive prefix sums assign nonoverlapping output offsets. Apply only if cidx+12beta+4gamma fits clause storage and ridx+beta fits reference capacity. If space is insufficient skip that rule rather than overrunning the preallocated arrays. Other allocation/integer bounds are not formally proved. Fig3 RES is a schematic pair rewrite. Applying pairwise replacement blindly in an arbitrary surrounding formula would not justify eliminating a variable with further occurrences; the paper relies on the established variable-elimination procedure/rule context cited in[15,20,32–34]. This record does not independently reprove the complete implementation from the small displayed diagram. §4: multiple decision making selects batches intended not to cause immediate propagation, but single decisions remain necessary. Original MDM details/validity are cited in[30]. New scheduling is driven by conflict counts, independent of restart policy, with mdmrounds3 and default initial ConfFactor2000 growing linearly. VSIDS and VMTF alternate. This is not GPU execution of all decisions or a guarantee that arbitrary simultaneous assignments cannot conflict. §5:168 instances come from seven AWS data-structure families at unwinding upper bounds8,16,64,128,1000. These are instances, not168 independent packages or arbitrary unbounded input sizes. Header Verified does not specify a SAT/UNSAT breakdown, exact safety assertions or whether an unwind bound is complete for each program; retain reported solved counts without claiming155 universal correctness proofs. §5: each instance isolated on one DAS-5 node, XeonE5-2630 at2.4GHz,64GB RAM,RTX2080Ti with68SMs/64cores perSM/11GB global memory;3600s timeout. PAR2 averages solved runtimes plus7200s for each unsolved instance. No repeat variance, exact source revisions, command lines, power/cost accounting or correctness cross-check statistics are reported in the paper. §5/Table1: tuned CPU-only ParaFROST already improves CaDiCaL143→154 solved; GPU adds one solved instance and reduces PAR2 824→765; MDM retains155 and lowers765→743. Therefore differences from CaDiCaL combine solver/data-structure/tuning changes with GPU effects. The CPU-only comparison is the relevant supplied GPU ablation. §5/Table1: comparison cells report faster-instance counts and signed parentheses. Prose describes parentheses as comparator-unsolved instances, but Glucose has(-4), which cannot literally be a count of such instances. All signs equal differences in total solved counts. Preserve raw signed values and this ambiguity; do not assert pairwise exclusive-solve sets or infer them solely from net totals. §5/Table1: triangles mark significantly better/worse, but no significance test, sample model, threshold or confidence interval is specified. Curves/bars show some individual slowdowns as well as gains. Geometric-average1.3x/1.6x and maxima18x/27x compare GPU/GPU+MDM to CPU-only, not to every solver; treatment of timeout cases in the geometric mean is not stated. §1 Fig1: approximately half the cases permit40% variable reduction; million-variable formulas have at least25% reduction; largest13million-variable priority-queue shift-down formula has65% reduction. These are selected AWS formulas, not universal BMC redundancy guarantees. Claim that largest nonverification SAT-competition formula encountered is0.2million variables is qualified by authors encountered subset, not all SAT formulas. §6: combination with multithreaded BMC is future work. First GPU-BMC priority is an author claim. No formal implementation proof, SAT proof certificate validation, verified Rust/Verus/TLA+ or LLM experiment is reported. Artifact and cited elimination/MDM proofs were not independently run/read; CBMC translation, solver transformations and CUDA/runtime remain trusted.
  • how much was read: most of it read
  • source
  • record id: gpu-acceleration-of-bounded-2021
• HybridSynchAADL: Modeling and Formal Analysis of Virtually Synchronous CPSs in AADL (2021)
  • what: An AADL subset and OSATE plugin model synchronous hybrid control systems with bounded clock deviations and sampling/actuation intervals. Generates Maude-with-SMT models, merges symbolic states and checks bounded invariants/existential reachability using Yices. Prior Hybrid PALS equivalence transfers suitable properties to distributed implementations under infrastructure bounds. Defines allowed communication and environment/controller composition, separates symbolic proof from randomized bug search, gives a drone model with explicit timing and manually chosen safety/reachability properties, and compares tools with achieved time bounds as well as runtime. Demonstrates that missing initial velocity constraints produce a collision despite a rendezvous witness.
  • limits: §§1–2/8: prior PALS/Hybrid PALS requires infrastructure bounds on clock skew, network delay and execution time and a suitable round period. PALS distributed construction stuttering-bisimilar to synchronous design; hybrid extension cited to reference8. This tool paper does not reprove equivalence, give a verified deployable implementation generator or establish hardware/network timing bounds. §2: physical variables evolve by mode-dependent ODEs; clocks have bounded deviation from real time. Sampling/actuation tied to local clock. Synchronous abstraction retains imprecise physical sampling/actuation times, rather than deleting all timing uncertainty with network interleavings. No arbitrary failures/unbounded delays/Byzantine nodes covered by this model. §3: environments cannot connect to each other or enclosing systems. Controller-to-controller communication uses only data ports and delayed connections so outputs sent one round available at next iteration start. Controller/environment interactions instantaneous at chosen sampling/actuation instants. This is a restricted architecture, not unrestricted AADL/network semantics. §3: continuous dynamics specified as ODE strings or closed-form real functions, while controllers use hierarchical systems/processes/threads and Behavior Annex. Real-valued interpretation despite Base_Types::Float syntax does not establish machine floating-point rounding correctness. §4: invariant universally quantifies all states reachable from every allowed initial state within bound. Reachability existentially asks whether some allowed initial state reaches goal within bound. A rendezvous witness therefore does not establish universal eventual convergence, fairness, unbounded liveness or safety. §4: randomized simulation selects concrete sampling/actuation/nondeterministic choices until counterexample; absence of observed bug is not a proof. Portfolio runs simulation and symbolic analysis in parallel and returns first outcome. Only completed symbolic bounded analysis can certify absence within the chosen bound. §4 footnote1/§8: symbolic analysis currently limited to polynomial continuous dynamics by Yices2 capabilities, including nonlinear polynomial cases. General ODE language expressiveness exceeds current symbolic backend; integrating dReal/Flow* remains future work. §4: Maude-with-SMT semantics and implementation details in technical report33. State merging uses disjunction/generalization to reduce iteration successors. No mechanized correctness proof of AADL translation, state merge or complete toolchain reported here. Trust includes modeling/translation, Maude and SMT solver. §5: collision property uses componentwise horizontal AND vertical distance<0.1, not Euclidean radius0.1; gather threshold pairwise distance<1 in prose. Initial condition constrains four positions only, not velocities; safety counterexample expected. Velocity-restricted proof reported only by reference to detailed report. §6: comparisons use simplified controllers because most other tools timeout on complex versions; not full controllers uniformly compared at large scale. N=2,3,4 and finite horizon up to 500 ms; no parameterized proof for arbitrary N. §6/Table 1: times are accompanied by achieved B in units 100 ms. True-invariant entries show largest successfully proved bound, false-invariant entries smallest bound yielding a counterexample. Different B values preclude naive runtime speedup comparison. HSAADL true Rend_double reaches B=4, not B=5. §6 footnote3: Flow* counterexamples can be spurious due Taylor-model overapproximation; smaller counterexample bounds do not automatically reveal real earlier bugs. dReach default precision used but numeric delta omitted. No uniform concrete-witness validation protocol described for all backends. §6: HyComp excluded for nonlinear double-integrator models because it does not support those dynamics. Others encode synchronous designs as three-mode hybrid automata; HYST flattening for Flow*/dReach. Thus performance comparison partly includes representation/backend choices, not a controlled isolation of state merging. §6: one-hour timeout, Intel Xeon 2.8GHz/256 GB; specialized Maude/Yices 2.6, SpaceEx PHAVer/STC, Flow* adaptive steps/Taylor order 1 or 2, HyComp BMC. No repetitions/variance, full tool versions, numeric dReach precision or exact model parameters here. Detailed complex benchmarks and state-merging ablation deferred to report. §§4–6: ~6200 Maude and 8600 Java/Xtend LOC are implementation size, not proof size. No artifact execution or independent reproduction. Results for selected modeled CPSs do not establish safety of physical drone deployments or verified Rust/Verus source.
  • how much was read: most of it read
  • source
  • record id: hybridsynchaadl-modeling-and-formal-2021
• IC3PO symmetry verifier (2021)
  • title: On Symmetry and Quantification: A New Approach to Verify Distributed Protocols
  • what: Introduces IC3PO, symmetric incremental induction extending finite-domain IC3/PDR. It infers the quantifier prefix of inductive invariants from protocol symmetries, then finds a finite cutoff whose proof generalizes to all instance sizes. Logical orbits map symmetry classes to quantified clauses; symmetry-aware clause boosting avoids searching fixed quantifier templates. A cutoff procedure checks that orbit representatives cover all relevant instances. IC3PO handles universal/existential alternations and produces compact quantified invariants automatically.
  • number: Evaluation set 29 protocols; IC3PO solved all 29, versus I4 13, UPDR 14, fol-ic3 23
  • number: 10 protocols solved by all: IC3PO total 232s/85 invariant assertions/12,160 SMT queries
  • number: IC3PO 1-hour timeout, 32GB memory, Intel Xeon X5670; Z3/Yices/CVC4 backends
  • number: ToyConsensus(3,3,3): IC3PO 192 SMT calls and 13 CTIs versus I4 7,814 calls and 443 CTIs
  • limits: Focuses on parameterized protocols whose sorts are sets of indistinguishable constants; ordered sorts and integer arithmetic are future work. Safety only, not liveness. Finite cutoff correctness depends on symmetry assumptions; evaluation uses bounded protocol models and SMT solver timeouts.
  • how much was read: most of it read
  • source; notes: papers inspected
  • record id: ic3po-symmetry-verifier-2021
• Invariant barrier certificates via DCP (2021)
  • title: Synthesizing Invariant Barrier Certificates via Difference-of-Convex Programming.
  • what: Defines an invariant barrier-certificate condition equivalent to inductive invariance for polynomial differential systems, reduces synthesis to BMI optimization using SOS/Putinar certificates, and solves BMIs with difference-of-convex iterations plus branch-and-bound. The paper derives finite Lie-derivative conditions, SOS encodings, BMI objective maximization, eigendecomposition-based psd-convex difference decomposition, and linearized LMI subproblems whose feasible sets under-approximate the original BMI constraints. It proves local convergence and a weak completeness theorem when a strictly valid template parameter exists and the partition/degrees are sufficiently fine. A branch-and-bound algorithm searches coefficient space, with pruning based on visited projections and negative objectives. The worked nonlinear ODE example obtains B(x)=−0.00363421x2; benchmarks compare BMI-DC, PENLAB, and SOSTOOLS with posterior Mathematica/Z3 validity checks.
  • number: 23 benchmark examples
  • number: 2.10 GHz Xeon, 376 GB RAM
  • number: 100 iterations in focus case
  • number: B(x)=−0.00363421x2 worked certificate
  • limits: Systems are autonomous polynomial ODEs with unique maximal trajectories; templates, multiplier degrees, and SOS degrees are fixed. DCP alone reaches only local optima, while branch-and-bound can be exponentially large and needs a strict-validity neighborhood for weak completeness. Numerical roundoff requires posterior validity checking; several high-dimensional examples were inconclusive, and the CAV version omits proof and benchmark details delegated to an extended version.
  • how much was read: most of it read
  • source
  • record id: invariant-barrier-certificates-via-dcp-2021
• IPRCTL imprecise rewards (2021)
  • title: Robust Model Checking with Imprecise Markov Reward Models
  • what: Extends PRCTL probabilistic model checking to imprecise Markov reward models, defining IPRCTL operators and polynomial algorithms for lower/upper expected cumulative rewards and reward-bounded probabilities. The paper models uncertainty as finitely generated credal sets over initial and transition probabilities, defines upper/lower expectations and nonlinear transition operators, and gives recursive algorithms for bounded hitting probabilities, cumulative rewards and reward-threshold probabilities. It proves that replacing precise probabilities with imprecise ones preserves polynomial dependence on state count and horizon (though iteration count can grow), then evaluates a three-state geriatric spend-down model using interval conversion/dismissal rates and a £15,000 sustainability threshold. All three departments remain robustly sustainable under the reported intervals.
  • number: finite credal sets
  • number: polynomial in |S|·t
  • number: three states
  • number: 20-year horizon plot
  • limits: Models are finite, discrete-time, time-homogeneous and memoryless; credal sets are finitely generated and reward horizons are finite. The work addresses Markov reward models, not imprecise MDPs or continuous-time chains; those are future work. Bounds are sensitivity envelopes over admissible probabilities, not a statistical confidence interval. Complexity claims are polynomial in |S|·t for fixed recursive iterations and do not provide implementation benchmarks beyond the case study.
  • how much was read: most of it read
  • record id: iprctl-imprecise-rewards-2021
• Justness (2021)
  • title: Justness: A Completeness Criterion for Capturing Liveness Properties
  • what: Defines justness as a completeness criterion for transition-system paths: once a non-blocking transition enabled by parallel components is not interfered with, some component must eventually act. It formalizes asymmetric concurrency for CCS, broadcast ABC/ABCd, and CCS with signals (CCSS). The paper gives an LTSC framework with blocking actions, concurrency relation, and B-just paths; defines dynamic and static synchron/component relations and proves they induce the same justness. It proves feasibility by constructing extensions of finite paths when countably many enabled non-blocking transitions (or equivalence classes) exist, relates justness to fairness, and proves agreement with coinductive definitions for CCS extensions and abstract paths. It also treats indicators/signals, infinitary choice, and gives inductive/coinductive characterizations.
  • number: Theorem 1 proves B-justness feasible under countably many enabled non-blocking transitions
  • number: Corollary 1 extends feasibility to countably many concurrency-equivalence classes
  • number: Theorem 2 shows dynamic and static justness coincide
  • number: Theorem 3 and Theorem 4 establish agreement with coinductive and abstract-path definitions
  • limits: Transition systems abstract distributed systems and assume atomic actions terminate. Blocking actions are explicitly identified; justness is weaker than fairness and cannot guarantee a task that is repeatedly postponed despite no interference. Feasibility theorem needs countably many enabled transitions/equivalence classes; the paper does not provide implementation or empirical evaluation, and future work is semantic equivalence with Petri/event-structure models.
  • how much was read: most of it read
  • record id: justness-2021
• Lean ProofWidgets (2021)
  • title: A Graphical User Interface Framework for Formal Verification
  • what: Designs and implements ProofWidgets, a Lean metaprogramming framework for declarative web UIs inside an interactive theorem prover. Components use functional reactive state and a virtual DOM; server-side Lean handlers retain tactic context while the editor renders HTML and forwards events. The framework exposes Html and Component with init/view/update; component state can contain the complete tactic state. A JSON client/server protocol annotates source positions with VDOMs, reconciles trees while preserving component state, dispatches event-handler identifiers and returns editor effects. Structured eformat tags pretty-printed subexpressions with expression addresses, enabling semantic highlighting, nested tooltips, go-to-definition and rewrite tooling. The Lean 3 implementation supports VSCode and remote sessions, has been adopted in mathlib with hundreds of contributors, and demonstrates interactive expressions, plots and community widgets. A 1000-node goal widget measured under 80 ms pointer-to-pixels on a 2012 Intel i7 laptop. Long-running tactics currently block rendering; concurrency and Lean 4 support are future work.
  • number: 1000+ VDOM nodes; under 80 ms round trip on 2012 Intel i7
  • number: hundreds of mathlib contributors using widgets
  • number: three component operations init/view/update
  • number: JSON protocol across editor/server boundary
  • limits: Architecture relies on an ITP server and editor client implementing the protocol; appearance and behavior are server-defined. Performance can degrade for large VDOMs or long-running calculations. Current implementation is Lean 3 and uses a sandboxed web browser/React client; related systems such as PIDE trade a larger editor API for tighter editor integration. No comparative user study or proof-correctness evaluation is reported.
  • how much was read: most of it read
  • record id: lean-proofwidgets-2021
• Lechner et al. Infinite Time Horizon Safety (2021)
  • title: Infinite Time Horizon Safety of Bayesian Neural Networks
  • what: Defines sure infinite-time-horizon safety for Bayesian neural-network policies in closed-loop discrete-time systems and computes a safe subset of the weight posterior. The method learns a neural-network positive-invariant certificate and uses a constraint-solving verifier; unsafe posterior samples are rejected, with an adaptation to safe-exploration reinforcement learning. The paper turns a product of intervals W_epsilon around posterior means into a verifiable weight set. For feed-forward ReLU BNNs, it encodes existence of an unsafe input/output and all weight choices as Phi constraints, proving safety iff Phi is unsatisfiable (Theorem 1), with MILP, Reluplex, or NRA-SMT options. For feedback systems it defines W_epsilon-safe positive invariants, proves they imply safety of every trajectory (Theorem 2), and gives a counterexample-guided learner/verifier: a classifier g_Inv is retrained on violating transitions and the verifier checks closedness, initial non-negativity, and unsafe-state negativity. Epsilon is enlarged iteratively from a previously successful certificate; rejection sampling and projected updates support safe exploration.
  • number: Unstable LDS: 1.5σ without bootstrap, 2σ with bootstrap; all-layer variant 0.5σ
  • number: Pendulum: 2σ with X0/Xu and bootstrap; all-layer bootstrap 1.5σ
  • number: Collision avoidance: bootstrap 2σ (partial Bayesian) and 1.5σ (all-layer)
  • number: runtimes range 6–1729 seconds in Table 1
  • limits: Discrete-time deterministic dynamics f and ReLU policies are assumed; stochastic environment dynamics are future work. Safety is sure safety for all trajectories whose sampled weights lie in W_epsilon, not a posterior-probability guarantee. The interval-product shape centered on means is restrictive and Gaussian/approximate posterior support outside the set is discarded. MILP requires bounded inputs/finite epsilon and scalability is limited by NN constraint solving; learned invariants are sound only after all verifier constraints are unsatisfiable. The continuum of states is represented through solver encodings and piecewise-linear dynamics in experiments.
  • how much was read: most of it read
  • record id: lechner-et-al-infinite-time-horizon-safety-2021
• LI HLS Formal Model Checking (2021)
  • title: Verifying High-Level Latency-Insensitive Designs with Formal Model Checking
  • what: Automated RTL wrapper generation and bounded model-checking checks for invalid input consumption and deadlock in MatchLib latency-insensitive HLS designs. The invalid-input model instantiates reference and test DUTs with equal valid inputs but different invalid data and compares valid outputs. The deadlock model aggregates HLS global-stall signals; for nonblocking ports it synthesizes a stall signal when no relevant ready signal is asserted for a configured number of cycles. Checks operate on HLS-generated RTL because the bugs depend on cycle-accurate timing, while wrapper generation is fully automated.
  • number: Table I runtimes 5.99–359.3 s for abstracted cases; buggy initial versions are falsified and final fixes proven
  • number: five MatchLib components have invalid-input properties proven (0.10k–9.75k gates; 10.98–36,627 s)
  • number: NoCRouterArray.v1 deadlock falsified in 12.71 s; v2 proven to bound 450 in 16,915 s
  • number: OpticalFlow.v2 deadlock falsified in 1,237 s; OpticalFlow.v1 proven to bound 10,000 in 42,090 s
  • limits: Uses MatchLib valid/ready interfaces, HLS-generated RTL and Synopsys VC Formal 2018.10 bounded model checking. Deadlock proofs are exhaustive only for the modeled check or stated user bound; several application results are bounded or time out. The custom nonblocking stall threshold N must be known from HLS optimizations.
  • how much was read: most of it read
  • record id: li-hls-formal-model-checking-2021
• LTL branching-process complexity (2021)
  • title: Linear-Time Model Checking Branching Processes
  • what: Studies whether every branch of a randomly generated multi-type branching-process tree satisfies an omega-regular specification almost surely, using an automata-theoretic reduction with unambiguous Büchi automata. The paper develops a complexity map for qualitative and zero-probability model checking against finite, deterministic parity, nondeterministic Büchi, co-Büchi, co-unambiguous Büchi, and LTL automata. Spectral-radius arguments for nonnegative matrices capture branching and support PSPACE procedures; translations explain the sharp gap between probability-one and probability-zero questions.
  • number: P(LTL)=1 is PSPACE-complete (Theorem 18)
  • number: P(LTL)=0 is 2EXPTIME-complete (Theorem 19)
  • number: P(NBA)=1 is PSPACE-complete and P(NBA)=0 is EXPTIME-complete
  • number: P(coNBA)=1 is PSPACE-complete and P(coNBA)=0 is EXPTIME-complete
  • limits: Results concern qualitative probabilities (P=1 or P=0) for finite-type branching processes and omega-regular automata/LTL specifications. The main headline is an upper bound and completeness result, not an implementation benchmark; the conclusion notes open complexity issues for unambiguous Büchi automata universality.
  • how much was read: most of it read
  • record id: ltl-branching-process-complexity-2021
• MCPPAL (2021)
  • title: Regular Model Checking Approach to Knowledge Reasoning over Parameterized Systems (technical report)
  • what: Defines PPAL, an extension of public-announcement logic for parameterized multi-agent systems, and gives a regular-model-checking procedure over automata-presented Kripke structures. It decides formulas without iterated announcements and uses Angluin L* learning of a disappearance relation for iterated announcements when that relation is regular.
  • number: Russian Card experiment: 36 s and 2365 MB
  • number: Large Number experiment: 53 s and 1218 MB
  • number: Muddy Children M≤3/M≤4: 3 s; M≤9: 24 s; M≤10 timeout over 5 min; M≤11 out of memory
  • number: Unbounded Muddy Children after symmetry reduction: 2.5 s and 111 MB
  • limits: Configurations and relations must have regular, effectively computable automata representations; model checking without iterated announcements is decidable but nonelementary, while the L* semi-algorithm terminates only when the disappearance relation is regular. The unbounded Muddy Children encoding is non-regular and diverges before the paper applies a counting/symmetry abstraction; experiments use fixed parameter bounds and a Java prototype.
  • how much was read: most of it read
  • source
  • record id: mcppal-2021
• MoCOFAP ATL+ (2021)
  • title: Tableaux like model checking on-the-fly for ATL+
  • what: Introduces MoCOFAP, a tableau-like proof calculus and on-the-fly local model-checking algorithm for ATL+ with perfect-recall strategies, constructing only states needed for a queried assertion. Assertions are state-formula/state pairs; reversible static, gamma and Next rules expand a candidate proof graph. Fair depth-first construction treats finite true leaves as success and maximal cycles containing only until assertions as failure; Tarjan SCC detection handles cycles. The paper proves soundness, completeness and termination bounds.
  • number: ATL+ model checking is PSPACE-complete in prior results
  • number: candidate proof bound 2^(2^|phi|^2 × m)
  • number: Tarjan strongly connected components for cycle detection
  • number: no implementation experiments; benchmarking left future work
  • limits: Concurrent game models are finite in the work and strategies have perfect recall. The candidate-proof bound is rough (double exponential in formula size), no implementation or benchmark exists, ATL+ PSPACE optimality is not established, and ATL* extension is future work.
  • how much was read: most of it read
  • record id: mocofap-atl-2021
• Nakasho Futa NDIFF10 inverse function 2021 (2021)
  • title: Inverse Function Theorem. Part I
  • what: Nakasho and Futa formalize a local C1 inverse theorem between nontrivial real Banach spaces. They first verify an isometric coordinate-exchange map, transport derivative/partial-derivative contracts, then apply an imported implicit-function theorem to f(x)-y=0. The final open neighborhoods give mutually inverse restrictions with derivative Dg(y)=Df(g(y))^-1. A careful source-neighborhood intersection converts target-ball solution uniqueness into a genuine two-sided local inverse; all-invertible derivatives further imply an open image. Records partial-function domain equality, exchange isometry and chain-rule transport, first-coordinate implicit solution uniqueness, residual partial derivatives, the open A=source-ball∩preimage(B) construction, exact inverse ranges and local-image scope.
  • limits: MML NDIFF10 version 8.1.11 5.65.1394 identifies the Mizar development. Main Theorems16–19 assume nontrivial real Banach E,F, open Z=dom f, differentiability on Z and continuity of the derivative map there. The local point a belongs to Z, b=f(a), and Df(a) is an invertible bounded linear operator. C1 is not replaced by mere differentiability at a (pp.9,15–18). Theorem1 makes f^-1(B) ambient-open when dom f=A is open and f is continuous on A, with B open. A continuous partial function on an arbitrary nonopen domain would give only relative openness. Theorems2–5 supply product-ball neighborhoods and open product strips used for the residual equation (p.10). Definition1 gives Exch(X,Y):(x,y)→(y,x) as a linear bijective isometry. Theorem6 supports norm preservation via the two coordinate norms. Theorems7/8 track swapped membership, the exact domain of composition dom(f composed I)=I^-1(dom f), and pointwise evaluation. Total swap and partial f have distinct domain contracts (pp.10–11). Theorem9 transports derivatives through a linear bijective isometry: Df(y)=D(f composed I)(I^-1 y) composed I^-1. Theorem10 makes derivative continuity equivalent under that change. Theorems11–13 identify the swapped coordinate slices and swap first/second partial differentiability and partial derivatives. Composition order and source/codomain types matter (pp.11–12). Theorem14 permits parameter space F merely normed, but solution space E and equation-value G must be nontrivial real Banach spaces. For C1 f:E×F→G on open exact domain Z, f(a,b)=c and invertible first partial at(a,b), it supplies positive radii whose product ball lies in Z, a unique x near a for every y near b, and a C1 solution g with exact target-ball domain and source-ball range (pp.12–13). The implicit solution satisfies f(g(y),y)=c and Dg(y)=-(D_1f(g(y),y))^-1 composed D_2f(g(y),y); the first partial remains invertible along that solution. Uniqueness is both pointwise among near solutions and extensional among any functions with the same target-ball domain/range constraint and equation. Those comparison functions need not separately assume differentiability (Theorem14). Theorem14 is derived from the imported implicit-function theorem formulated for solving the second coordinate. Exch(F,E) swaps the product, preserves openness and C1 via Theorems7–13, and transfers the derivative formula back. Imported implicit theorem PartII and its deeper analytic proof are not re-proved or independently audited in this record (pp.13–14,reference6). Theorem15 builds h(x,y)=f(x)-y on D×F, where D=open dom f is nonempty. It proves h is C1, D_1h(x,y)=Df(x), and D_2h(x,y)=-Id_F. The two partial derivative maps are continuous: the first comes from the original derivative, the second is constant. Imported partial-to-total differentiation rules justify C1 of the product map (pp.14–15). Theorem16 applies14 to h(x,y)=0 at(a,b). It gets positive source/target radii, source ball inside Z, and a C1 g on B=Ball(b,r2) into Ball(a,r1) with f(g(y))=y, g(b)=a, Dg(y)=Df(g(y))^-1 and invertibility along its image. The minus signs cancel in -(Df)^-1 composed(-Id). The statement also retains uniqueness for target values in B (pp.15–17). Theorem16 does not say f is injective on the entire source ball for outputs outside B. Theorem17 instead defines A=Ball(a,r1) intersect f^-1(B), an open neighborhood of a, with B the target ball. Existence gives f(A)=B and g(B) subset A; uniqueness for values in B gives injectivity on A and every x in A equals g(f(x)). Thus g(B)=A, not just a range inclusion (pp.17–18). Theorem17 records exact domains/ranges, f restricted to A and g both one-to-one, g=(f|A)^-1, f|A=g^-1, continuous/C1 inverse and the inverse-derivative formula. These are local neighborhoods, not global injectivity or surjectivity of the original f. The forward restriction is already C1 by the initial assumptions (p.17). Theorem18 says for any given positive source radius there exists a positive target radius with Ball(b,r2) inside the partial image f(Ball(a,r1)). The chosen arbitrary source ball need not lie entirely in dom f; partial-function image uses its intersection with the domain. This is qualitative local openness, with no numerical radius bound (p.18). Theorem19 assumes Df(x) invertible at every x in Z. It obtains the local image-ball property at every x and concludes f(Z) open. It does not add a global inverse or a global one-to-one conclusion; neighborhood witnesses are chosen locally (p.18). The proof uses imported implicit-function/invertible-operator/chain-rule results and exact real Banach analysis. No numeric worked case, computable inverse solver, iteration convergence rate, Lipschitz constant, proof-size/check-time measurement, benchmark or checker log is supplied. “Lipschitz continuity” is a keyword, not a quantified inverse Lipschitz bound established in these displayed conclusions (all pages). Exact quotations preserve raw-extraction artifacts including U+0016 restriction/partial-derivative symbols, derivative superscript ordering and nested function-application slash notation. Renderings were inspected. Eleven pages, one definition,19 theorems/all subclauses/sketches,footnote,acknowledgement,ten references/date read. No source/checker/artifact execution, distributed protocol, Verus/Rust/TLA+ or LLM proof/specification-agent evaluation.
  • how much was read: most of it read
  • source
  • record id: nakasho-futa-ndiff10-inverse-function-2021-2021
• Neural barrier certificate synthesis (2021)
  • title: Automated and Formal Synthesis of Neural Barrier Certificates for Dynamical Models.
  • what: Presents a counterexample-guided inductive synthesis loop in which a neural network is trained as a barrier certificate and an SMT verifier proves its safety conditions or returns counterexamples. The paper states the barrier conditions (initial set non-positive, unsafe set positive, negative Lie derivative on the zero level set), translates trained networks symbolically, and adds bespoke losses, polynomial/tanh/sigmoid/ReLU architectures, prioritized and multiple counterexample generation, and numerical-robustness measures. It handles polynomial and transcendental ODEs, a piecewise hybrid model, and 4/6/8-dimensional ODEs. The CEGIS loop is sound when SMT returns unsat, but not complete; it retains weights and augments samples after each counterexample. SOS candidates are often numerically ill-conditioned and fail SMT verification.
  • number: 8 benchmarks; at most 9 CEGIS iterations
  • number: 0.5k–2.3k initial samples
  • number: up to 0.1% of prior method’s data
  • number: 50 randomized runs
  • limits: Models are continuous ODEs or a specified hybrid partition with continuous vector fields; the certificate must be differentiable and satisfy strict inequalities. SMT dReal uses δ=10^-6 and Z3 handles polynomial cases; timeout and architecture choices affect success. CEGIS may not terminate or find a certificate, random initialization causes high variance (8% success on the polynomial model and 12% on 8-D over 50 runs), and SOS comparisons are unsound unless separately verified.
  • how much was read: most of it read
  • source
  • record id: neural-barrier-certificate-synthesis-2021
• NRA Model Interpolation (2021)
  • title: Interpolation and Model Checking for Nonlinear Arithmetic
  • what: Introduces model interpolation through an SMT-modulo-partial-model API, implements it in MCSAT/Yices2, and uses it for invariant inference in nonlinear-arithmetic model checking. Algorithm 1 enumerates models of B and asks A for model interpolants that refute each model; finite convergence yields a Craig interpolant. The MCSAT implementation generalizes models with cylindrical-algebraic-decomposition cells, supporting complete nonlinear real arithmetic interpolation and PDR-style invariant inference. A Cauchy–Schwarz inequality is encoded as a transition-system invariant.
  • number: pdkind solves 82/114 benchmarks (59 valid, 23 invalid) in 1,971 s total; ic3-nra solves 73 (58/15) in 986 s; kind solves 48 (24/24) in 855 s
  • number: pdkind proves 59 properties, including 36 not proved by kind; it finds 23 invalid properties
  • number: pdkind proves 11 properties ic3-nra cannot, while ic3-nra proves 10 pdkind cannot
  • number: Cauchy–Schwarz property proved valid by pdkind in 1 s
  • limits: Completeness is limited to theories supported by MCSAT. Termination depends on finite convergence of model interpolation. CAD-derived interpolants can be large clausal formulas; unlike interval methods, the procedure does not cover arbitrary functions/ODEs. Experimental comparison uses one-hour CPU timeouts and only the selected benchmark suite.
  • how much was read: most of it read
  • record id: nra-model-interpolation-2021
• Porous invariants (2021)
  • what: Defines porous invariants for branching integer affine loops: structured semilinear sets that may have infinitely many holes. The paper computes strongest real-linear and integer-linear invariants, gives reachability and separator results for several target/system classes, proves undecidability in high-dimensional nondeterministic systems, and implements a complete one-dimensional affine procedure.
  • number: Theorem 5: undecidable with two 91-dimensional matrices
  • number: 8,128 random instances; 1,160 unreachable and 6,968 reachable
  • number: all instances built invariants; mean 0.209 s, maximum 20.252 s
  • number: all unreachable proofs; 5,828/6,968 reachable direct proofs within ~30 s
  • limits: The systems are integer LDSs with finitely many linear matrices, or one-dimensional affine maps. N-semilinear sets are Presburger-definable, so multiplication is unavailable in the invariant language. Full-dimensional Z-linear target reachability is decidable, but non-full-dimensional targets can be Skolem-hard or undecidable; N-semilinear invariant synthesis is undecidable for nondeterministic systems with two 91-dimensional matrices. The one-dimensional procedure is polynomial only with unary encoding; binary reachability is NP-hard and generated intervals can be exponentially large. Applicability to nested loops and richer specifications remains open.
  • how much was read: most of it read
  • record id: porous-invariants-2021
• Progress in Certifying Hardware Model Checking Results (2021)
  • what: Certifaiger certifies positive k-induction results for finite Boolean circuits by constructing a history-extended k-witness circuit whose property is 1-inductive exactly when the original property is k-inductive. An independent checker validates combinational simulation and an inductive invariant with five SAT obligations and one universally-existential reset QBF. The certificate circuit has size O(k times original circuit size). Records the history/initialization-bit construction, reset-surjectivity requirement, every proof direction and checker obligation, actual trusted components, unsupported simple-path constraints, complete TIP table and selected HWMCC denominator. Flags source-level indexing/listing mistakes and experimental aggregation ambiguity instead of treating prose averages or theorem typography as a machine-checked result.
  • limits: §2: finite Boolean circuits have input set I, latch set L, reset functions rl(L), total next-state functions fl(I,L), and good-state predicate P(I,L). Reset equations may be cyclic and unsatisfiable, yielding no initial states and vacuous safety. Inputs supply nondeterminism; total transition functions ensure every state has successors. Only safety is treated, not liveness or fairness. §§2–3/Definitions6–7: combinational extension shares exactly the original input variables and contains the original latches as a subset. Combinational simulation requires old-latch transition equivalence for all valuations, extended property implying original property, and every original reset assignment having an extension satisfying new resets. Last condition is forall L exists newL: R(L) implies Rprime(Lprime). Merely checking reset satisfiability would not rule out an unsound underapproximation. §3/Theorem1: if an extending circuit combinationally simulates the original and is safe, the original is safe. Proof lifts each original initial assignment through reset extension and extends the run through total transition functions while preserving shared latches; property implication transfers safety. This is a paper proof, not a mechanized proof of Certifaiger itself. §3/Definition9: k-induction requires base Uk-1 and resets implying P at times0 through k-1, plus unrestricted Uk and those k properties implying P at time k. Safe does not mean the unstrengthened property is k-inductive for an arbitrary fixed k. A positive result using simple-path constraints is outside this certificate construction. §4/Definition10: witness stores k copies of original latches, k-1 past-input copies and k initialized bits; current inputs remain external. Oldest component shifts away; youngest follows original dynamics. Reset equations allow full or partial history initialization, and bits mark an initialized suffix. Property conjoins monotone initialized bits, consistent adjacent transitions, original safety at initialized components, reset at first initialized component when partial, and youngest initialized. §4/Theorems2–6: youngest component provides shared-latch simulation. Base equivalence splits one/partial/full initialization, then reverses by locating a last reset before a bad state. Consecution reverses by embedding k good states; forward direction separates partial histories using the original base case from full histories using original induction. Theorem3 is equivalence of k-inductiveness and 1-inductiveness for this construction, not completeness for every safe circuit at a chosen k. §4/Definition10 is stated for k>=1, but u1 is used in clauses3(c)/(f) and is not defined by3(b) when k=1. The concrete nontrivial construction/experiments use k>=2; a k=1 special case is not spelled out. Gate sharing yields O(k*|C|), linear separately in k and original circuit size, not O(k+|C|), constant-size proofs or guaranteed low solver time. Printed proof/listing issues, visually confirmed: Fig1 lines18/20 both initialize c1, leaving c2 without an explicit init despite Fig2 declaring only000 initial. Lemma3 uses R(Lm) and negated u^(m-1), inconsistent with the claimed largest reset index and suffix disjunction definition (one expects excluding later reset indices); preserve this as a proof-text indexing problem. Lemma7 keeps initialized bits starting at m after shift, whereas Definition10.4 shifts their boundary to m-1. Its printed final shift range also addresses the older rather than initialized suffix. Lemma8 mixes temporal indices/arguments, including P(Li,Li). These source errors do not establish an implementation exploit, but prevent describing every displayed proof line as formally validated. §5: input AIGER plus k yields extended AIGER with general reset functions, beyond standard0/1/uninitialized resets. Simulation checker produces two SAT formulas and reset QBF; invariant checker produces initiation, consistency and consecution SAT formulas. Consistency is trivial for phi=Pprime here. The table explanation that phi must hold at all good states reverses the actual formula phi implies P; rely on the formula. §5: Kissat checks CNF after aigtocnf conversion; QuAbS checks QAIGER reset obligation via QCIR conversion. Successful six checks establish safety regardless of witness generator correctness, conditional on faithful parsing/encoding/checker/solver behavior. No checked SAT/QBF proof traces, independently verified solver kernels or end-to-end mechanized tool correctness are reported. Independent from model checker does not mean a trust-free checker. §5: skipping the three simulation checks is proposed only if the construction/mapping implementation is trusted correct. It is not the default six-check assurance. Sanity tests with incorrect k and a bad initial state respectively fail consecution/initiation; no denominator, mutation campaign or systematic fault-detection rate is supplied. §6: experiments use modified McAiger exposing k, Intel Corei9-9900 3.60GHz,32GB,Manjaro kernel5.4.72-1. TIP selects positive results and excludes three cases needing simple paths; Table1 has14rows. Prose says k4–96, but table minimum is5 and maximum96. No runtime uncertainty/repetitions/independent reproduction is provided. §6/Table1/Fig7: text calls certification time a sum over components while also assuming six conditions computed in parallel. Table/Fig7 time ratios match approximately (generator + maximum of six solver times)/model-check time; sum gives different results. Reader calculations from rounded table: mean of per-instance parallel ratios17.90, aggregate parallel ratio8.45, mean summed ratios25.10 and aggregate summed ratio11.28. The reported average around8 is compatible with an aggregate parallel ratio but not the arithmetic mean of plotted per-instance ratios. Preserve ambiguity rather than asserting a defined arithmetic mean. §6: normalized expansion epsilon=#Cprime/(#Ck), not #Cprime/#C. TIP average approximately1.5 therefore corresponds to witness size approximately1.5k times original, not merely1.5times original. Table prints unusual init size124220 for v.prodcell17, unlike neighboring decimal values; retained raw without silent decimal repair. Other extra decimal digits in91.216/32.542 are also retained. §6: HWMCC2010 prefilter McAiger15min solves513 instances;216 UNSAT cases have meaningful k>=2, seven require simple paths. Paper says selected from216 without an explicit final evaluated count. Do not claim all216 or infer a precise209-case success denominator. Reported ratio30 excludes four pj20 outliers with certification>=15min, attributed to QAIGER→QCIR conversion rather than QBF solving. Proposed direct format output is future improvement, not measured repaired performance. §§6–7: scaling example uses500-bit counter, modulo32,b through431,k through400 and convergent normalized expansion. Preprocessing/retiming/temporal decomposition, complex multiengine tools, simple-path constraints, liveness and infinite-state extensions remain future work. No Verus/Rust/TLA+ implementation or LLM proof-agent experiment; artifacts not run here.
  • how much was read: most of it read
  • source
  • record id: progress-in-certifying-hardware-2021
• PromelaSketcher numerical model synthesis (2021)
  • title: Model Sketching by Abstraction Refinement for Lifted Model Checking (Extended Version)
  • what: Synthesizes complete Promela models from sketches with numerical holes by applying variability-specific abstraction refinement to a featured transition system representing all variants. SPIN checks LTL properties on abstract subfamilies; refinement separates correct, incorrect and undecided families. The algorithm is sound and complete and can return all correct variants or report none. Defines numerical-feature FTSs, abstraction predicates and a recursive ARP algorithm: check the whole family, split by feature expressions when inconclusive, prune violating subfamilies, and collect satisfying variants. PromelaSketcher performs source-to-source transformations and compares lifted refinement against brute-force enumeration on model sketches.
  • number: Algorithm is sound and complete for finite model families (§Abstract)
  • number: No detailed runtime table in extracted text; paper reports convergence after a handful of iterations for large search spaces
  • number: Feature family size grows exponentially with number of numerical features (§1)
  • limits: Feature domains are finite integer sets and sketches are Promela/LTL; abstraction precision depends on chosen variability predicates. SPIN still faces state explosion within variants, and abstract checks can be inconclusive, causing refinement blow-up. Synthesis guarantees concern modeled variants/properties, not implementation code or unbounded feature domains. Extracted file is short and reports limited benchmark details.
  • how much was read: most of it read
  • record id: promelasketcher-numerical-model-synthesis-2021
• Proof Pearl: Playing with the Tower of Hanoi Formally (2021)
  • what: Coq/SSReflect formalization of Hanoi variants, including uniqueness and optimality for three-peg regular perfect-state transfers, optimal arbitrary-state strategies for three pegs, and Frame–Stewart optimality between perfect states for four-peg regular and outer-to-outer star puzzles. Four-peg proofs reconstruct technical mathematical lower bounds rather than merely verify a recursive solution. Records finite-function state encoding, peg-relation-parametric legal moves, projection with adjacent-repeat deletion, equality-sensitive minimality induction, greedy counterexample and linear variant, triangular-number valuation for four regular pegs, 2^i3^j sequence and alternating multi-state penalty invariant for four-star pegs. Distinguishes puzzle variant and endpoint scopes, stated optimality from generated legal paths, proof effort and printed formula/side-condition errors.
  • limits: §2, pp.3–6: n differently sized disks are finite ordinals 0..n−1, smaller number means smaller disk; k pegs are finite ordinals. A configuration is a finite function from each disk to its peg, uniquely inducing sorted stacks. Thus every encoded state is stack-legal; on_top checks no smaller disk on that peg. Finite-function equality/extensionality comes from the finite representation, not an assumed axiom for arbitrary Coq functions. §2, pp.3–7: auxiliary-peg selector is symmetric but guaranteed different from both pegs only for at least three pegs. General move requires one chosen disk on top before and after, an allowed peg relation and all other disks unchanged. If the relation is reflexive, unchanged states may qualify; regular/linear/star relations are irreflexive. This is a discrete sequential graph, with no simultaneous moves. §2, pp.6–7: regular relation allows every distinct pair; linear relation allows consecutive ordinal pegs; star relation requires distinct pegs and at least one equal zero, so zero is center. Three-peg linear/star graphs are isomorphic after relabelling, not equal under the displayed labels (linear center 1 versus star center 0). Endpoint role matters for distances. §2–2.1, pp.5–8: transforms remove/add largest disks, split/merge size ranges, or restrict arbitrary disks/pegs. Projecting a legal path can produce identical adjacent states when a removed disk moves, so rm_rep deletes adjacent repetitions before applying the smaller-puzzle path theorem. It need not delete all repeated states or establish shortestness. §2.1, pp.7–8: distance is least length of a connecting path in a finite state graph; gpath combines path legality, endpoint and size equal to distance. Paper does not spell out its convention for disconnected arbitrary relations. Uses in the Hanoi results have connected move graphs; an unconditional metric theorem for every arbitrary peg relation should not be inferred. §3.1, pp.8–9: recursive perfect-state transfer has 2^n−1 configurations after the starting state, and is a legal path when source differs from destination. Equality-sensitive comparison proves every such transfer path is at least this length and equals it iff it is the generated path. Double induction on disks and path length handles the largest disk moving once, twice or returning. Uniqueness applies to these regular perfect endpoints, not all shortest paths in all variants. §3.1, p.10: in regular three-peg arbitrary-state transfer, a greedy largest-disk destination move may be suboptimal. Greedy is optimal if one endpoint is perfect; for two arbitrary endpoints compare one- and two-jump strategies for the largest disk whose location differs, leaving larger disks fixed. The paper describes these formalized results but does not print all algorithm/optimality proofs. §3.2, pp.10–11: for linear three pegs, greedy is optimal. Distinct adjacent perfect pegs have distance (3^n−1)/2; the two outer pegs have 3^n−1; identical endpoints have zero. With 3^n states, a shortest outer transfer visits every configuration exactly once. This is a state-graph result, not a measured search benchmark. §4.1, pp.11–12: Frame–Stewart parks top m<n disks using four pegs, transfers remaining n−m using three while avoiding the occupied peg, then retrieves m. Choose m minimizing 2T4(m)+T3(n−m). The generic k-peg recurrence yields an algorithm; its optimality for arbitrary k is stated open at publication. This paper proves four-peg regular and four-peg star scopes only. §4.2, pp.12–13: regular four-peg optimal perfect-transfer cost Phi(n) is the prefix sum of 2^(triangular_root i), and satisfies the Frame–Stewart recurrence with 2^(n−m)−1. The proof uses a valuation Psi of an arbitrary disk set E, defined through a max over L with capped triangular-root exponents. If v uses only two pegs avoiding p0, then Psi of disks on p0 in u bounds d(u,v) below. Distinct p0,p2,p3 and the codomain restriction are essential. §4.2, p.13: strong induction follows first/last visits of the largest disk and a selected disk T through a geodesic, splits at critical configurations and modifies/project paths to fit the induction hypothesis. Combined with the generated upper bound, this yields exact Phi(n) for distinct perfect endpoints. The 1000-line proof formalizes a six-page main argument, with most details referred to Bousch rather than reproduced. §5, pp.13–15: star theorem concerns two different outer pegs. Transfer parks small disks on the third outer peg, uses a three-peg outer-to-outer linear transfer for the rest, then retrieves. Cost is 2S1(n), where S1 sums increasing distinct numbers 2^i3^j starting at 1. Its recurrence contains (3^(n−m)−1)/2; doubled cost satisfies the star Frame–Stewart recurrence. §5, p.14: lower bound generalizes from two endpoints to l+1 configurations, with intermediate codomains alternating between pairs of outer pegs. Sl(n) and its differences alpha_l plus endpoint penalty beta support induction on n and splitting into alternating subpaths. Convexity in n and concavity in l combine lower bounds. At l=1 and perfect outer endpoints penalties vanish, matching the algorithm upper bound. §5–6, pp.15–16: star main argument spans about 3500 Coq script lines versus 15 informal pages, organized into three sublemmas and a without-loss-of-generality step. Proofs use little automation and natural numbers. Replacing subtraction inequalities with addition needs the source proof’s bounds; truncated natural subtraction is not ordinary integer subtraction. §6, pp.15–16: evaluation is formal theorem reconstruction, counterexamples and proof-size descriptions. No implementation runtime, hardware, proof-check time, total LOC, finite test campaign or independent artifact replay is reported. Claimed mechanical checking and historical flawed general proof are author reports; the cited original papers/source were not independently read here.
  • how much was read: most of it read
  • source
  • record id: proof-pearl-playing-with-2021
• QCTMC STL model checking (2021)
  • title: Model Checking Quantum Continuous-Time Markov Chains
  • what: Introduces quantum continuous-time Markov chains (QCTMCs), specifies their real-time behavior in signal temporal logic (STL), decides atomic propositions using real-root isolation for exponential polynomials, and evaluates general STL formulas bottom-up with interval operations. The paper derives the QCTMC evolution from Lindblad-style dynamics, develops a root-isolation algorithm under Schanuel’s conjecture, and gives a compositional STL procedure whose query complexity is linear in formula size once atomic interval queries are available. An open quantum walk with an absorbing boundary demonstrates the framework, including non-Hermitian dynamics.
  • number: STL formulas are proved decidable over QCTMCs under the stated conjecture
  • number: query complexity is linear in input formula size
  • number: root isolation recursively subdivides intervals and tests derivative bounds/sign changes
  • number: one open-quantum-walk running example is provided; no runtime benchmark table
  • limits: Completeness of the real-root isolation procedure is conditional on Schanuel’s conjecture and algebraic-number assumptions. The method is exact but may not be numerically efficient; the paper lists approximation and non-Markov extensions as future work. The evaluation is a single running example rather than a benchmark suite.
  • how much was read: most of it read
  • record id: qctmc-stl-model-checking-2021
• Rubicon (2021)
  • title: Model Checking Finite-Horizon Markov Chains with Probabilistic Inference
  • what: Introduces Rubicon, which transpiles Prism finite-horizon Markov-chain models to Dice and represents all horizon paths as a BDD for weighted model counting. Formalizes iterative step-bounded versus path-factorized inference, handles monolithic and modular Prism programs, and compares Rubicon with Storm explicit and ADD engines on factories, Herman and queue models plus parametric-chain sampling.
  • number: Storm fails beyond 15 factories in motivating example
  • number: Factories 15: Rubicon build 40 s, WMC 4 s versus Storm ADD >1800 s
  • number: Herman R17: Rubicon 45 s build/28 s WMC; Storm ADD >1800 s
  • number: Rubicon outperforms explicit model checking through horizon 10 on queues
  • limits: Rubicon relies on compact BDD structure and currently requires one initial state, ignores rewards, and lacks some process-algebra and integer operations. It is not competitive on all standard benchmarks such as NAND, EGL and LeaderSync.
  • how much was read: most of it read
  • record id: rubicon-2021
• RVF-SMC stateless model checking (2021)
  • title: Stateless Model Checking under a Reads-Value-From Equivalence
  • what: Introduces RVF-SMC, a stateless model-checking algorithm that partitions concurrent interleavings by read values and causal order at reads. RVF is proved sound for local safety and at least as coarse as Mazurkiewicz, data-centric, reads-from and value-centric equivalences; it can be exponentially coarser. The paper develops VerifySC for reads-value-from witnesses, shows VSC is parameterizable in thread and variable counts, adds backtrack-signal and closure/auxiliary-trace heuristics, and implements RVF-SMC in Nidhugg. Evaluation compares traces and runtimes with VC-DPOR, Nidhugg/rfsc, DC-DPOR and Nidhugg/source across 119 benchmarks.
  • number: 119 benchmarks
  • number: RVF partitioning can be exponentially coarser
  • number: 27 Boop4: 837 s at unroll 10 and 2,017 s at unroll 12
  • number: 45 monabsex1: one trace and 0.09 s at unroll 7
  • limits: RVF soundness targets local safety properties and assumes the event/value/causal-order conditions of the equivalence; the evaluation uses sequentially consistent concurrent C/C++ programs and one-hour benchmark timeouts. RVF gives little reduction on some workloads, where mature alternatives dominate, and relaxed-memory extensions remain future work.
  • how much was read: most of it read
  • record id: rvf-smc-stateless-model-checking-2021
• SceneChecker (2021)
  • title: SceneChecker: Boosting Scenario Verification Using Symmetry Abstractions.
  • what: Introduces SceneChecker, which abstracts vehicle-plan hybrid automata by symmetry, delegates reachability to Flow*/DryVR and refines modes when the abstraction is inconclusive or unsafe. Safe abstraction results imply concrete scenario safety; unknown remains possible. A scenario is a directed graph of waypoint segments, uncertain initial set, guards, time bounds and polytope obstacles. User maps must be differentiable, invertible and commute with trajectories. Abstract modes aggregate symmetric segments, map guards and unsafe sets, and use nondeterministic resets. A DFS verifier caches per-mode initial sets, and split refinement separates modes until safety is shown or the concrete automaton is reached. The paper proves soundness and losslessness relative to the subroutine and map assumptions, but does not produce counterexamples.
  • number: 14× average speedup over standalone DryVR/Flow*
  • number: One Flow* standalone run exceeds 120 minutes while SceneChecker completes in 12 minutes
  • number: Abstraction-refinement gives over 13× speedup in QNN scenarios; comparisons exceed 30× over CacheReach
  • number: SceneChecker mode counts range from 1 abstract mode initially to 11 after refinement in QNN-S3
  • limits: Soundness relies on user-supplied symmetry maps satisfying the trajectory equation and on sound reachability over-approximations; the implementation never checks the map equation. Unmodeled dynamics can break exact symmetry. Guard and reachability over-approximation can produce unknown. Unsafe cases lack counterexamples. Experiments use hyperrectangular initial/guard sets, polytopic obstacles and selected vehicle controllers/scenarios.
  • how much was read: most of it read
  • source
  • record id: scenechecker-2021
• Simulation-based cutoff proof announcement (2021)
  • title: Brief Announcement: Automating and Mechanising Cutoff Proofs for Parameterized Verification of Distributed Protocols
  • what: Proposes parameterized distributed safety verification via a designer-supplied small cutoff instance, node map sim, state-effect filterΩ and action-sequence translatorτ. Generates a relation requiring relevant large-instance state effects to be included at mapped cutoff nodes; uses first-order SMT checks for preservation and violation reflection. Illustrates a two-node cutoff for ring leader uniqueness. Reports preliminary Z3 verification of leader election/sharded key-value store in a few seconds and manual checks of three other protocols; tool unfinished. Printed soundness theorem omits explicit initial-relatedness and matching-step existence obligations. Preserves witness-dependent ring partition, guarded message effects, non-one-to-one node mapping, zero/multi-step lockstep, first-violation restriction and exact two SMT obligations. Distinguishes user-supplied proof structure from automation, mechanized versus manual cases, finite cutoff checking from unbounded proof, and partial-correctness preservation from existence of an executable matching trace.
  • limits: Protocol model is RML relational state, asynchronous messages, guarded atomic actions chosen nondeterministically. Target propertyΦ is state safety over every finite execution for every node-count instance. Fairness, liveness, delivery time, Byzantine faults and concrete implementation refinement are not established. The announcement does not formalize all RML syntax, ordering/topology axioms or state domains. Cutoff means any counterexample at a larger parameter has one at size≤k. Introduction requires checking all sizes≤k; worked transfer uses a selected size-k instance. Thus all smaller admissible sizes must also be checked or covered separately, and all relevant IDs/topology/data instances represented, not merely one concrete graph/state. No automated cutoff finder or complete procedure for arbitrary protocols claimed. Designer supplies protocol, cutoff C, map from every large-instance node to a cutoff node, filterΩ of effects relevant to a violation, and translatorτ mapping actions to zero/more cutoff actions. Automation generates/checks a candidate relation from those inputs; it does not infer all proof ingredients or eliminate human protocol insight. Ω is property-specific and must retain enough state to reflect violation. Generic relation is forallN Ω(σL(N))⊆σC(sim(N)): many large nodes collapse to one cutoff representative, so it is one-way inclusion of selected facts, not exact equality of distributed state. Ring example chooses distinguished hypothetical violating leadersLA/LB and partitions directed ring arcs, includingLB onCB side andLA onCA side; cutoff has two nodes with same IDs. Map may depend on counterexample witnesses, not one universally fixed arbitrary quotient. Ring protocol: each node has unique totally ordered ID; generate sends own ID to successor. Handle forwards IDs greater than own, elects self when own ID returns, ignores smaller ID. Safety is at most one elected node. Relation carries implication from each distinguished large leader flag to corresponding cutoff flag, and only carries pendingA/B messages while their originating distinguished node has not become leader. It is not full queue/order/multiplicity equality and requires the surrounding protocol encoding. Lockstepτ may stutter when node images coincide or a large action cannot usefully be reproduced, and may execute multiple small actions. Example handlingB atLA maps to handleB atCA followed by generatingB atCB; extra generation restores relation. Symmetric cases also required. Printed short list does not fully specify every intermediate-node/other-ID/stuttering case, parameter guard, or when a proposed action sequence is enabled. Equation1 checks unsatisfiability of R∧largeAction∧translatedSmallSequence∧¬Rprime, with safe prestateΦL/ΦC conjoined to focus on the first violation. Equation2 excludes ¬ΦL∧R∧ΦC, so related large violations force small violations. These are relation preservation and bad-state reflection. A cutoff correctness proof also needs related initial states and existence of a legal matching small sequence for every relevant large step. Neither is an explicit premise of printed Theorem1 or checked by these formulas alone. In particular, putting τ(a) in the antecedent of Equation1 only constrains already-existing matching moves. If that sequence is disabled, formula is vacuously unsatisfiable and says nothing about simulating the large step. Need an enabledness/totality obligation R∧ΦL∧ΦC∧a⇒existsσCprime τ(a), plus initial-state matching; a partial-correctness SMT check cannot substitute for it. This identifies an incompleteness of theorem as printed, not an audited flaw in an unavailable implementation/full proof. Reader simple countermodel: relationR says large bad flag implies cutoff bad flag. Both initially false; cutoff flag permanently false; a large action sets bad true, while designated cutoff action is disabled. Equation1 has false τ antecedent; Equation2 contradictory byR; small instance safe; large instance unsafe. Initial relation already holds, so even adding initialization alone does not fix missing matching-step existence. Such a node-count-dependent guarded action fits a broad relational model unless further protocol restrictions rule it out; announcement states no restriction establishing totality. A second missing obligation is initial relatedness: Rfalse makes both displayed formulas unsatisfiable for any protocol, regardless of its executions. Even when generated inclusionR disallows this exact candidate, the proof must establish the chosen initial-state relation rather than infer it from preservation. Ring pending/leader initialization plausibly makesR hold, but the announcement does not print/check that case. Adding Φ of both prestates is sound for a first-bad-state transfer only if initialization and step matching hold and all translated intermediate small states are legal. If a small execution violatesΦ earlier during a multistepτ, that already witnesses unsafety; if cutoff safe, every such intermediate stays safe. Does not require preserving after first violation. All free/quantified instance, topology and order variables must be encoded with sound restrictions for SMT UNSAT to entail the mathematical statement. Theorem1 asserts all instances safe from UNSAT of Equations1/2 and safety ofC; no proof provided beyond prose. Z3 UNSAT is reported, not an independent proof-assistant/kernel certificate. Soundness relies on correct FOL encoding, quantifiers, topology/ID assumptions, action semantics and solver. Unknown/timeout would not be proof; the paper reports only successful preliminary cases, without completeness or decidability theorem. Evaluation separates two solver cases (ring leader election, sharded key-value store) from three manually checked cases (Lock Service citing Verdi, Learning Switch citing Ivy, Distributed Lock Service citing IronFleet). These citations do not show re-verification of full Verdi/IronFleet codebases. Only ring cutoff2 is stated here; key-value/other cutoff sizes, exact properties, modeling effort, action counts and solver formulas not detailed. Timing is order of a few seconds for both solver cases, not exact measurements or a controlled comparison. No Z3 version/hardware/options, repetitions, timeout policy, raw logs, benchmark suite table, proof size or artifact revision printed. Tool explicitly work in progress; finishing implementation, complex protocols and automatic cutoff synthesis future. Full Version points to a GitHub repository, not independently fetched/read in this batch. Entire supplied4-page technical announcement read, including all13 references and rendered equations. Existing record already covered announcement but lacked explicit missing soundness premises; replaced without duplicate title and archived original. No full version/artifact/underlying protocol reading, tool execution, Verus/Rust/TLA+ code or LLM use here. Useful as a proof-design/checking method, with theorem obligations requiring completion before use as a trusted parameterized verifier.
  • how much was read: most of it read
  • source
  • record id: simulation-based-cutoff-proof-announcement-2021
• Spin-Overtaking (2021)
  • title: Simulation and Model Checking for Close to Real-time Overtaking Planning
  • what: Combines discretized LiDAR/laser sensor data from a Unity autonomous-vehicle simulator with sequential Promela/Spin model checking; counterexample paths to an LTL property become overtaking action plans. Uses guided simulation to execute Spin-generated plans, handles consecutive overtakes by replanning, introduces danger-zone abstractions and tests sensor/action discretization on rural two-way traffic. Reports both safety successes and sensor/compilation limitations.
  • number: Average simulated vehicle drives at least 40km and overtakes 214 vehicles before collision
  • number: Median distance before failure 40.6km; median overtaken vehicles 214.5
  • number: Model verification about 20ms; Promela-to-C compilation about 3s
  • number: No path failure occurred during reported experiments
  • limits: Finite-state discretization, simplified vehicle behavior and sensor noise constrain realism; Spin verification takes about 20ms but C verifier compilation about 3s, preventing strict real-time use. Failures are usually caused by inaccurate sensors and repeated overtaking is forced more aggressively than normal driving.
  • how much was read: most of it read
  • record id: spin-overtaking-2021
• Static Race Detection and Mutex Safety and Liveness for Go Programs (extended version) (2021)
  • what: The paper develops GoL, a process-calculus model for shared memory, locks, read-write locks, and later channels, with behavioural types that encode happens-before synchronization. Type soundness and progress connect processes to µ-calculus types; model checking these types detects data races, lock safety/liveness, and mixed channel/shared-memory errors. The migoinfer+ extractor and Godel2/mCRL2 backend form a static toolchain. Beyond the abstract, the authors define race and lock properties over GoL, prove subject reduction, process safety/data-race transfer, and conditional equivalence of type and process liveness for terminating, may-converging, and finite-branching programs. The channel extension models channel-as-lock and pointer-through-channel errors. Evaluation includes mutex/channel variants, producer-consumer, and five-philosopher programs with explicit false-positive caveats for approximated cyclic analyses.
  • number: 17 benchmark programs were checked on an 8-core Intel i7-7700K with 16 GB RAM
  • number: No-race and simple-race variants correctly separate safety/data-race outcomes in roughly 0.69–0.79 seconds
  • number: dine5 unsafe took 6,996 ms; dine5 deadlock 12,278 ms; dine5 fixed 8,998 ms
  • number: channel Dining Philosophers took approximately 185 minutes for the race version and 645 minutes for the fixed version
  • limits: The liveness correspondence requires restrictions such as termination, may-convergence, or finite branching; the implementation is sound for safety/data-race transfer but can report rare liveness (and possibly safety) false positives/negatives on approximated cyclic models. Extraction supports only a Go subset, has restrictions on embedded mutexes/structs and parameter passing, and does not scale to unbounded goroutine creation. mCRL2 state space grows rapidly with summands and action order.
  • how much was read: most of it read
  • record id: static-race-detection-and-2021
• Statistical Blockchain Attack Checking (2021)
  • title: Statistical Model Checking of Common Attack Scenarios on Blockchain
  • what: Models three blockchain attack scenarios in stochastic real-time BIP and estimates attack success with SBIP 2.0 statistical model checking: DNS cache poisoning, double spending through mempool flooding, and consensus-delay double spending. Historical Bitcoin data supplies mining and propagation-time distributions. The models combine timed/stochastic automata, connectors and priorities with MTL properties. DNS uses a birthday-collision probability and a DNSSEC-style bound; double-spending models use empirical mining and propagation datasets. The authors turn curves into mitigations: hash outputs over 20 bits, a 650-second same-user transaction restriction, and common fee/mempool settings.
  • number: δ=0.1 precision and α=0.1 risk
  • number: DNS collision probability zero for listed hashes with output length >20 bits
  • number: double-spend probability <0.5 after 570 s and ≈0.1 after 610 s
  • number: 650 s restriction proposed for both double-spend scenarios
  • limits: Quantitative estimates use δ=0.1 and α=0.1, finite historical data, and a 2.3GHz dual-core i5 with 90-minute/4GB limits. Results assume the specified BIND collision distribution, fast transactions, and reliable measurements; violating those assumptions invalidates conclusions. Models omit many network details and require manual construction; automatic smart-contract model generation is future work.
  • how much was read: most of it read
  • source
  • record id: statistical-blockchain-attack-checking-2021
• Storm: Refinement Types for Secure Web Applications (2021)
  • what: Storm centralizes row/column read/insert/update policies alongside Haskell web-application data models. Generated Persistent ORM field/query types track policies and query-result invariants; refinement-indexed RIO computations track authorized readers and possible observers. LiquidHaskell checks sequencing so later observers are authorized by all earlier reads, including predicates on sensitive columns. A simplified two-column reference ORM is verified against refined LIO, inheriting previously established noninterference; full framework and apps use existing SQL/network libraries. Records exact Field/Query/RIO abstractions and Horn bounds, implicit query leakage and cross-table witnesses, per-handler monotonicity/erasure revocation semantics, LIO reduction and downgrade mechanism, simplified-reference/full-SQL boundary, unsupported absent-row policy/SQL/effects, complete LOC/timing tables with internal discrepancies, real implicit bug and deployments, and appendix mutations/versioned reproduction recipe.
  • limits: §§1,3,5: Security is relative to developer-written central policy, generated/primitive API contracts, authenticated session identity and mediated RIO effects. Checked type annotations are untrusted evidence; policy correctness remains human obligation. Policy LOC is not total trusted computing base: checker/solver,Haskell/compiler/runtime,ORM/DB,network/auth primitives and generator matter. §§4–5: RIO authorizes users via an underapproximation and observers via overapproximation. bind requires observers2⊆authorizees1; result authorizes intersection and observes union. This prevents explicit and implicit flows represented by API, not all effects in arbitrary Haskell IO or browser code. §5.3: Uninterpreted cross-table predicates must occur positively, represent evidence from some snapshot during current handler, and remain true until handler ends. Access revoked during action need not invalidate already established evidence in that action. Each new handler starts without assertions and must requery; this is per-handler authorization semantics, not immediate global revocation at every read. §5.3: No proof of arbitrary concurrent DB transactions, isolation/linearizability or cross-service consistency in paper. Snapshot language does not itself establish transaction isolation for SQL deployment. Existing DB/ORM must implement claimed primitive behavior. No distributed crash/retry/durability protocol theorem. §6: LiquidHaskell verifies refined LIO API and simplified λStorm reference implementation. Reference has single primitive Val type and exactlytwo columns/table, list-backed labeled rows. Full Storm supports arbitrary SQL types/columns through existing SQL ORM. Paper supplies no equivalence proof from production SQL implementation to simplified model. §6: Security argument composes checked API implementation/no-dynamic-IFC-exceptions with previously mechanized LIO noninterference results. It is not a new end-to-end mechanized theorem of the complete browser/network/SQL stack. No numbered theorem or detailed proof appendix in saved paper, and external proof source not run here. §6: Labels follow lattice order; label output must not fall below current label, unlabel raises current label. downgrade uses ceiling and returnsFalse when computation exceeds it, allowing positive Boolean evidence without exposing forbidden test outcome. This specifically modeled operation is not arbitrary unchecked declassification. §7.1: Cannot express policy requiring absence of conflicting row in PaperPCConflict; must change representation. Simple queries/joins supported, richer grouping/sorting not covered. Positive witness restriction intentionally limits policy expressiveness. §8: Controllers restricted to RIO; DB/HTTP/email/random effects incorporated, arbitrary exceptions future work. Full timing/termination/power/resource side-channel resistance and availability are not established by the presented IFC argument. No runtime-overhead benchmark; erased static checks motivate no added runtime-enforcement cost claim. §7: Expressiveness ports are policy/model files, not all executable verified applications (appendix explicitly says not verifiable code). Three applications evaluate annotation burden, two full deployed apps evaluate policy size. Do not turn policy-port count into ten verified implementations. §§5.3,7.1/Table1: Prose saysnine policy case studies, Table1 contains ten rows includinggradebook; §5.3 separately says9/11benchmarks span tables. These source counts differ and are retained without invented reconciliation. Table2: Printed totals do not equal all visible row sums: server2851versus2791,models140versus136,client5844versus5642,annotations125(72)versus140(78). Policy166 and verification290s agree. Exact visible rows and printed totals kept separately; no silently corrected totals or inferred hidden lines. §7.3: Under4%server/under1%withclient are author auditability claims, not per-application bounds directly reproduced from displayed rows (Voltron37policyLOC/756server≈4.9%,37/(756+1012)≈2.1%). Combined apps/fullcode denominators differ. LOC reduction is proxy for audit burden, not proof of policy adequacy. §7.3: Discussion moves from Disco invisible-room bug to saying Voltron was retrofitted under2days including implicit-leak checks; source attribution switches application names. Record preserves wording and does not assume Disco retrofit time. No controlled user study or bug-rate comparison. §5 Figure9: bind first input printed RIO<auth1,auth2>, inconsistent with prose/resultobs1; intended first input RIO<auth1,obs1> follows surrounding composition explanation. Figure8 FldEq variable roles swap versusEquation2 but universally quantified equality is symmetric. Record uses prose-consistent types and notes typography rather than alleging implemented unsoundness. AppendixA: Artifact snapshot/version instructions and expected failure snippets are reported, not reproduced here. Under1% policy claim, nearautomatic inference and first/static comparisons are author findings/claims at historical time. No direct Verus/Rust/TLA+ or LLM evaluation.
  • how much was read: most of it read
  • source
  • record id: storm-refinement-types-for-2021
• Symblicit exploration and elimination for probabilistic model checking (2021)
  • what: Combines a symbolic predecessor-count representation with explicit exploration and immediate state elimination to compute reachability probabilities, expected rewards, and long-run averages while retaining only a partial explicit state space. The predecessor count determines when every predecessor has been explored, avoiding re-exploration of eliminated states. State elimination redistributes self-loop probabilities/rewards and links predecessors to successors; initial and absorbing states survive. Long-run averages use two recurrence-reward structures. The preliminary ePMC implementation generates/compiles C++ and uses CUDD plus MPFR for large recurrence rewards; its implementation separates state exploration, predecessor counting, and elimination into three phases.
  • number: molecular case: 1,000,000,001 states; 25 MB peak; 18,807 s
  • number: BRP: 426,378,219 states; 41 MB; 9,039 s
  • number: Crowds 352,535 states needs 10,698 MB
  • number: arXiv version: 2001.04289v1
  • limits: Read source is arXiv:2001.04289v1 (2020), linked by Unpaywall to the 2021 DOI; differences from the publisher version were not checked. Exposition and algorithms concern finite DTMCs, with CTMC case studies; broader MDP/Markov-automata applicability is asserted, not established by the displayed DTMC algorithm alone. Efficiency depends on compact predecessor-count diagrams and search/elimination order. Current arithmetic is floating point; exact rationals and interval bounds are proposed alternatives. Crowds performs poorly, and there is no systematic head-to-head tool benchmark in this version.
  • how much was read: most of it read
  • source
  • record id: symblicit-exploration-and-elimination-2021
• TA2SMT timed automata encoding (2021)
  • title: Improved Bounded Model Checking of Timed Automata
  • what: Presents TA2SMT, a direct BitVector/real-arithmetic SMT encoding of timed-automata networks for bounded model checking, preserving TACK’s MITL property encoding while removing the intermediate CLTLoc representation and adding semantic and implementation fixes. TA2SMT encodes active transitions as BitVector identifiers, adds one location-specific null transition per location, derives location aliases from transition sources, represents bounded integer variables in two’s complement, and encodes clock guards with elapsed-time terms before resets. The complete formula combines initialization, transition, synchronization and lasso constraints; an argument relates its soundness/completeness to the prior TACK CLTLoc encoding. It supports non-equality integer guards, broadcast synchronization and all left/right-closed interval combinations that the old implementation lacked. Experiments compare TA2SMT with TA2CLTLOC and MITL0,∞ BMC on Fischer mutual exclusion, Gearbox, Token Ring, Philips Audio and modified CSMA/CD models, showing scalability gains and new model coverage.
  • number: lasso length k+2
  • number: finite-domain integer variables
  • number: TA2SMT supports broadcast and all interval closures
  • number: CSMA/CD up to 27,947.4 s at k=45 in reported table
  • limits: Bounded model checking explores finite lasso-shaped non-Zeno traces up to bound k, so absence of a counterexample is bounded. Integer variables have finite domains; TA2SMT still requires variable-expression widths compatible with sign extension. MITL properties continue through CLTLoc conversion, and some comparisons omit tools because models/features were unavailable. Results use Z3 and timeout limits on one evaluation setup; performance varies by property, bound and process count. The soundness/completeness argument is relative to the previously proved CLTLoc encoding and does not establish unbounded verification.
  • how much was read: most of it read
  • record id: ta2smt-timed-automata-encoding-2021
• The CakeML Project’s Quest for Ever Stronger Correctness Theorems (2021)
  • what: Historical account of CakeML’s end-to-end verification strategy: proof-producing translation of logical functions to embedded ML programs, verified compilation to concrete bytes, and application-specific proofs, with extensions through a verified Silver CPU’s Verilog implementation. Describes improvements that strengthen transported correctness, especially impure code reasoning and space bounds needed for liveness. Explains why in-logic execution supplies a concrete compile(input)=machine_code theorem, enabling a final property statement without the compiler function; how applying synthesis and in-logic compilation to the compiler’s own logical definition yields a verified executable; why finite target memory limits the default behavior theorem; how a sound space-cost semantics removes early out-of-memory exits for specific programs; and how shared characteristic-formula infrastructure connects manual verification and monadic code synthesis. Separates completed compiler/hardware layers from 2021 prospective language/compiler projects.
  • limits: This 10-page invited overview summarizes previously published mechanizations; it contains no new complete formal proof, benchmark table, theorem inventory or fresh controlled experiment. Its references identify where to inspect the underlying statements. Counts or broad performance comparisons here are author reports, not independently reproduced results. The transfer argument relies on proved source properties, formal CakeML operational semantics, a correct compiler theorem and a proved concrete compilation result. In-logic compilation removes the compiler from the final statement; it does not eliminate trust in the logic, prover implementation or fidelity of source/machine/hardware models. Source lists, arrays and integers are unbounded; target memory is finite. The default behavior preservation explicitly permits early out-of-memory errors. Source liveness alone therefore does not ensure target liveness. The separate compiler-sound space-cost semantics supports tight bounds for concrete programs and the strengthened transfer. The first compiler’s front end includes parser soundness/completeness with respect to an SML syntax grammar, type-inference soundness (completeness added later), and no runtime errors for typed source programs. That typing theorem does not rule out target out-of-memory exits. The optimizing compiler uses eight intermediate languages and multiple passes per language. Functional big-step, clocked interpreter semantics permit a single simulation proof per phase to handle termination and nontermination; the paper says most, not all, simulation directions are forward. CakeML characteristic formulae are proved sound against CakeML operational semantics, including higher-order recursive functions, mutable state, exceptions and FFI I/O. A later extension handles diverging programs, and a simplified nontermination Hoare logic is proved sound and complete. Do not extend that completeness claim to every CF feature or program-verification automation. The Isabelle/HOL source generator is for the most part verified once for all; the HOL4 generator is for the most part proof-producing. Lem generates source-semantics definitions in both provers from a common specification. The overview does not present a verified cross-prover transport theorem or certify Lem itself. The Silver result composes a verified compiler target, machine-code filesystem and CPU correctness through the formal Verilog implementation. A later verified compiler maps a supported subset of generated Verilog to FPGA technology-mapped netlists. Physical fabrication, FPGA programming and the entire external synthesis toolchain are not established by this overview. Compiler projects using CakeML for a low-level imperative language, a Haskell-inspired language and a choreographic language are described as ongoing in 2021. Project-success explanations are explicitly the author’s beliefs, not empirical causal conclusions. No Rust, Verus, TLA+ or LLM-agent experiment is reported.
  • how much was read: most of it read
  • source
  • record id: the-cakeml-project-s-2021
• timed MSR complexity (2021)
  • title: On the Complexity of Verification of Time-Sensitive Distributed Systems: Technical Report
  • what: Formalizes time-sensitive distributed systems with progressing timed multiset rewriting and presents complexity results for compliance, safety and time-bounded/unbounded verification. The report models quantitative temporal properties through critical configurations, compliant traces and time sampling, relates verification problems across timed MSR/PTS classes, and proves PSPACE-completeness results for PTS verification. Drone behavior serves as an application notation linking timed rules to real-time constraints.
  • number: §6.1 proves PSPACE-completeness for PTS verification problems
  • number: Algorithms use polynomial space in m, k and log2(Dmax) (as stated in source)
  • number: No empirical runtime benchmark; contribution is complexity-theoretic
  • limits: Complexity results are for specified timed rewriting classes and encodings; practical verification depends on finite constants, sampling and point-of-no-return bounds. PSPACE decidability does not imply tractable large protocol verification, and liveness/time assumptions are model-dependent.
  • how much was read: most of it read
  • record id: timed-msr-complexity-2021
• Verified Double Sided Auctions for Financial Markets (2021)
  • what: Coq formalization of multi-unit double-sided batch auctions verifies fairness transformation, optimal uniform individually rational matching (UM), and maximum individually rational matching (MM). Uniqueness of per-order traded quantities at equal fair total volume supports comparing an exchange output with a verified reference without requiring identical pairings. Extracted OCaml comparison on100stocks flags3anomalies, with unresolved rule/preprocessing/data interpretation. Records matching versus price rationality distinction, exact fairness/priority model, partial-quantity state and termination, uniform versus unconstrained optimum, exchange surgery, per-order versus pairing uniqueness, conditional comparison prerequisites and overlooked equal-priority case. Preserves real-data preprocessing, market-order sentinels and uncertain anomaly interpretation; no direct exchange-code verification.
  • limits: §4, pp.4–5: bid/ask records contain identifier, timestamp, quantity quota and limit price; lists duplicate-free by distinct IDs. Natural prices represent smallest currency unit. Transactions reference original bid/ask records plus quantity/price. Matching requires compatible limit prices, source-order membership, and aggregate quantity of each order at most quota. It does not itself require transaction price between limits; IR is separate. Paper does not fully spell out positivity constraints or equal-timestamp assumptions used by source. §§2/4–5, pp.2–7: more competitive bid has higher limit price, or same price and earlier timestamp; asks reverse price order with same earlier-time priority. Fairness means any strictly lower-priority order trading requires every strictly higher-priority order fully filled. This is order allocation priority, not preferential counterparty pairing or economic strategy-proofness. Equal price AND equal timestamp is not resolved by displayed definitions; theorem22 proof assumes comparable distinct orders. Reader counterexample below identifies a missing side condition/tie-break, not an inspected artifact bug. §4.1, pp.5–6: aggregate traded quantity bounded by total bids/asks. For every price p, Q(M)<=Q(B prices>=p)+Q(A prices<=p), proven by partitioning trades by bid limit above/below p. This is a universal upper bound, not equality, equilibrium-price existence or a unique clearing price. Compatible-limit matching suffices even before IR price assignment. §4.2, p.6: IR requires ask limit<=transaction price<=bid limit. Any compatible matching can be repriced per trade to IR. Uniformity requires same price for all trades. Maximum unrestricted IR volume can exceed optimum under both IR and uniformity; UM and MM intentionally optimize different feasible sets. §5, pp.7–9: Fair sorts asks/transactions by ask priority then FOA, sorts resulting transactions and bids by bid priority then FOB. FOB preserves every ask allocation and total volume, so preserves existing ask fairness; symmetric FOA plus FOB gives both sides fair. IR/uniform preservation follows replacing counterpart by at least as competitive order and retaining prices. Fair does not promise original per-bid/per-ask volumes separately, since it reallocates to higher priorities. §5.1, pp.7–9: FOB helper f(M,B,t) tracks already used quantity t of unchanged head bid. At each step trade min(current transaction quantity,head quota−t); remove both on equality, transaction only if smaller, bid only after splitting transaction if larger. Keeping head order intact preserves source membership while separate t tracks capacity. Each branch decreases |M|+|B|, handled by Equations well-founded recursion. Auxiliary full-head and later-order lemmas prove price-time priority allocation. §6, pp.10–13: UM sorts most competitive bid/ask first, greedily matches remaining quotas while limits compatible, and stops when best remaining pair incompatible. All final prices replaced by last trade ask price; sorted order makes this compatible with all preceding matched pairs. Replacement affects prices only. Empty matching default last price immaterial to empty output; source default implementation not inspected. Theorems18–20/Lemma19, pp.11–13: proof generalizes to effective remaining quotas qb−tb,qa−ta with tb<qb,ta<qa and inducts on |B|+|A|. Any uniformIR comparison of sufficient volume can be surgically transformed to saturate top pair at minquotas: first Fair makes both heads trade enough, then unit swaps preserve per-order totals/uniform price. Remove saturated pair and recurse on reduced book. UniformIR ensures every participating bid can pair with every participating ask at shared price; this is essential for cross-swaps. §7, p.14: MM initially pairs most competitive bid with least competitive matchable ask, then applies Fair. Theorem21 states fair IR global maximum volume. Additional surgery proof and detailed procedure deferred to separate full version; supplied paper gives summary/theorem, not complete MM derivation. No asymptotic complexity proof or measured UM/MM comparison here. §8, pp.14–15: matching itself need not be unique: counterparty edges, splitting and prices may vary. Theorem22 equal-volume fair matchings have same per-order allocations, subject to total-priority condition noted above. Theorem23 applies to two fair optimalIRuniform outputs because optimum volumes equal. Theorem24 transfers fairness to any valid matching with identical per-order allocations; IR/uniformity must still be checked from prices, and aggregate equality yields optimal volume against reference. §8/Appendix A, pp.15/18: comparison soundness assumes a valid reference matching over the same correctly preprocessed input book, with the required priority uniqueness or resolved ties. Equal quantities for every original order imply capacity bounds because the reference quantities satisfy those bounds. Membership, order identity, transaction prices and uniformity still need validation. A mismatch can reflect failure of the specified properties or a data/model mismatch; it does not identify a particular exchange-code defect. §9/AppendixA, pp.16–18: real exchange/dates/traders/stocks masked. Select top100stocks by capitalization for one day, although procured data spans multiple days. Updates/deletes collapsed to final active orders; timestamps converted to natural microseconds; market asks limit0, market bids largestOCamlinteger. These wrappers/representation choices outside mathematical matching theorem require correct mapping. Paper does not claim verified parsing/serialization, unbounded natural-to-machine-integer correspondence or end-to-end exchange deployment. §9, p.16: three flagged stocks each contain unmatched market ask; corresponding update has auction microsecond time and uniform price. Authors suspect exchange-generated entry but do not establish cause or rule violation. Removing market asks during preprocessing removes all flags. Thus empirical result is conditional anomaly detection, not three confirmed exchange bugs; no denominators for number of orders/trades or false positive/negative ground truth. §§3/10/AppendixA, pp.4/16–18: about50newdefinitions,750lemmas/theorems,12000LOC author report; no extra axioms, extractedOCaml/Haskell. Actual demonstration uses OCaml certified.ml plus handwritten create.ml/compare.ml and processeds.bid/s.ask/s.trade. No timings/hardware/memory, independent artifact execution or extraction trust audit. Continuous double auctions future work with specifications described as vague; no distributed concurrency/protocol proof.
  • how much was read: most of it read
  • source
  • record id: verified-double-sided-auctions-2021
• Verified password generation (2021)
  • title: Towards Formal Verification of Password Generation Algorithms used in Password Managers
  • what: Surveys password-generation algorithms in Chrome, Bitwarden and KeePass and proposes an EasyCrypt reference implementation supporting length and per-character-set minimum/maximum policies. The authors formalize functional correctness and a game-based security property requiring indistinguishability from uniform sampling over policy-valid passwords. The reference generator samples required character classes, fills remaining positions subject to maxima, applies a random permutation and uses rejection-sampling RNGs to avoid modulo bias. EasyCrypt expresses correctness as probability-one policy satisfaction and security through RealRPG versus IdealRPG games; the paper also records implementation differences across 15 password managers.
  • number: 15 password managers surveyed
  • number: three algorithms studied in detail
  • number: reference password length range 1–200
  • number: correctness target probability 1
  • limits: Security assumes the underlying random-byte generator is secure and the policy-valid set is the ideal comparison domain. The paper presents formalizations and a reference algorithm rather than a proved extracted production implementation; future work includes Jasmin implementation, user-defined character sets and password-strength properties. Strict policies can still generate guessable strings such as P@ssw0rd.
  • how much was read: most of it read
  • record id: verified-password-generation-2021
• Verifying Quantized Neural Networks using SMT-Based Model Checking (2021)
  • what: Presents an ESBMC/SMT software-model-checking workflow for floating- and fixed-point neural-network C implementations, including finite-word-length arithmetic models, interval invariant inference, slicing/constant propagation/tree balancing, and lookup-table discretization for nonlinear activations. The paper gives a concrete translation pipeline from C ANN code to nondeterministic inputs, assume/assert safety properties, interval bounds, and fixed-point operations. Theorem 3.1 bounds lookup-table error for piecewise-Lipschitz activations by choosing N_i >= 1+L_i lambda_i/epsilon. Experiments isolate solver and optimization effects, vary quantization widths, and compare against Marabou and Neurify on Iris, Vocalic and 45 ACAS Xu networks.
  • number: ESBMC on Intel Xeon E5-2620 v4, 128GB RAM; Yices usually beats Boolector/Bitwuzla and Z3 often struggles
  • number: all 45 ACAS Xu property-1 networks verified by this method; Marabou times out on 13 while Neurify also completes all
  • number: authors report quantization granularity affects both verification time and outcome; lookup-table and small-data limits are acknowledged
  • limits: Verification is for sequential C implementations; concurrent/CUDA code is out of scope. Fixed-point formats must cover dynamic range or overflow changes behavior. Lookup tables approximate nonlinear functions and can invalidate guarantees when resolution mismatches quantization. SMT scalability remains limited for large networks; Iris/Vocalic are small and ACAS Xu uses a large integer width. Results depend on ESBMC, Yices, interval annotations and selected safety regions.
  • how much was read: most of it read
  • record id: verifying-quantized-neural-networks-2021
• Visual Script Symbolic Checking (2021)
  • title: Formal Verification for Node-Based Visual Scripts Using Symbolic Model Checking
  • what: Translates node-based visual scripts into NuSMV models and checks CTL/LTL specifications, with state-variable elimination optimizations. The converter combines manually supplied node semantics and specifications into SMV transition relations. An optimization removes a node’s internal state variable when its output uniquely encodes that state, reducing variables and reachable states. Counterexamples are returned by NuSMV for script bugs.
  • number: eight scripts contain 1,178 nodes total and 164 node kinds; 30 custom semantics were manually prepared
  • number: script #1 optimization reduces variables 356→180, reachable-state log size 223.0783→216.6621, and time 192.786→3.603 s (98.1% faster)
  • number: scripts #5 and #7 detected real bugs; optimized times 10.169 s and 17.103 s
  • number: script #8 has 430 nodes/475 optimized variables and did not finish within 3 h
  • limits: The method models control flow but explicitly omits illegal data-flow bug detection. Current experiments verify only a single node graph at a time and require manual semantics for 30 custom node kinds. State explosion prevents completion for the largest 430-node script within a three-hour timeout; compositional verification and automatic semantics generation are future work.
  • how much was read: most of it read
  • record id: visual-script-symbolic-checking-2021
• VTV verified TESC checker (2021)
  • title: A Formally Verified Checker for First-Order Proofs
  • what: Presents VTV, an Agda checker whose kernel and first-order semantic soundness theorem are formally verified for TESC proof objects. The checker reconstructs omitted sequents while traversing an inductive proof, checks side conditions and supports theory-extension rules (currently equality axioms, relation definitions and choice axioms). A size-tracking tree replaces lists to make random access practical in dependently typed code. The paper explains engineering choices that make a verified checker usable: De Bruijn syntax, mutually recursive traversals accepted by Agda termination checking, indexed-functor freshness invariant, and a simple append-only balancing tree. Soundness is stated as verify-success implying sequent unsatisfiability, while parse-verify deliberately leaves equivalence between parsed TPTP and the original problem to an unverified parser. The empirical study filters TPTP to CNF/FOF theorem or unsatisfiable instances solvable by Vampire/E and compilable to TESC, then compares VTV with optimized Rust OTV. VTV checks 12,291/12,296 proofs within 16 GB, has 40 ms median and >97.4% under one second, but at least >64 GB is needed to check all proofs.
  • number: 12,296 proofs tested; 12,291 completed under 16 GB
  • number: 5 proofs exhausted 16 GB; at least >64 GB to verify all with VTV
  • number: VTV median 40 ms, OTV 30 ms
  • number: VTV >97.4% under 1 s and >99.3% under 5 s
  • limits: Soundness assumes the root sequent satisfies the good-sequent indexed-functor invariant and targets first-order equality semantics with an infinite-arity encoding. Input formulas must be closed because the unverified Rust parser rejects open formulas. The formal theorem covers the proof-checking kernel, not that parsed TPTP text is equivalent to the original problem. VTV has substantially higher peak memory than OTV and five largest proofs exhaust 16 GB (three still fail on 64 GB).
  • how much was read: most of it read
  • record id: vtv-verified-tesc-checker-2021
• What’s Live (2021)
  • title: What’s Live? Understanding Distributed Consensus
  • what: Extracts published liveness statements for consensus algorithms and formalizes them in TLA+. It compares what each one assumes and guarantees: 3 link assumptions, 7 server assumptions and 6 progress assertions. It also runs finite TLC experiments.
  • number: of 31 algorithms in Table 1, only 18 (58%) mention liveness and 11 (35%) give a liveness proof
  • number: TLC on up to 4 proposers and 4 acceptors in a few hours
  • number: 31 algorithms/variants are catalogued; 18 state liveness assertions, and only 11/31 (35%) provide some liveness proof.
  • number: TLA+ TLC illustrations cover up to 4 proposers and 4 acceptors for single-value Paxos; multi-value/larger cases become too expensive.
  • limits: It is an analytical comparison plus finite TLC runs, not new verified code. Appendix A uses a tick bound. Hours and lines of code are not stated.
  • how much was read: most of it read
  • source; notes: What’s Live? Understanding Distributed Consensus
  • record id: what-s-live-2021
• Yamazaki Miyajima Shidama ASCOLI 2021 (2021)
  • title: Ascoli-Arzelà Theorem
  • what: Yamazaki, Miyajima and Shidama formalize Ascoli–Arzelà for continuous maps from a compact metric domain into a complete normed target. Compactness of the family’s closure in the supremum norm is equivalent to equicontinuity and compact closure of each pointwise value set. Definitions and finite-net/closure lemmas connect normed, metric and topological representations. The paper also handles a common compact target range. Closure bars disappear in the raw extraction, so interpreting this as compactness of the unclosed family would change the theorem. Records uniform versus pointwise family moduli, compact-domain uniformization, closure rather than raw-subset completeness/compactness, finite-net consequences, evaluation-set conditions, topology transport and the common-compact-range corollary.
  • limits: MML ASCOLI version 8.1.11 5.66.1402 identifies the Mizar formalization. Main setting has nonempty metric M, nonempty compact topological S equal to M_top, complete normed linear topological T, and a nonempty family F of continuous maps S→T with its supremum norm. G is the same underlying function set in the metric-domain representation (pp.87,90–93). Definition 1 explicitly introduces closure of a metric subset through the induced topology. Rendered closure bars on Y,Z,H,F and pointwise sets are lost in raw extraction. Theorems 7–12,16–19,23 must therefore be read from the renderings. This record uses cl(F) for closure and distinguishes it from F; exact quotations preserve extraction and their pointers warn about missing bars (entire paper). Definition 2 equiboundedness gives one finite K for all functions and all domain points: ||f(x)||≤K. Definition 3 equicontinuity at x0 gives one delta for each epsilon and x0, uniform over f but allowed to depend on x0. Definition 4 uses one delta for each epsilon uniformly over all functions and all pairs x1,x2. These quantifier orders are distinct (pp.88–89). Theorem 3 expresses continuity by open neighborhoods and norm differences; Theorem 4 converts continuity on compact metric M into uniform continuity. Theorem 5 makes pointwise family equicontinuity equivalent to its uniform Definition 4 on compact M. Its proof takes half-radius neighborhoods, a finite subcover and a positive minimum radius, then uses an epsilon/2 triangle argument (pp.88–89). Theorem 2 proves a finite union of compact subsets compact by induction on finite-sequence length. It is supporting topology infrastructure, not a general assertion that arbitrary unions of compact sets are compact (p.88). Theorem 6 equates norm completeness and metric completeness. Theorem 7 says a closed subset cl(H) of complete Z is complete, not that arbitrary H is complete. Theorem 8 says H is totally bounded iff cl(H) is; Theorems 9/10 combine this with completeness to relate total boundedness of H and compactness/sequential compactness of cl(H), across metric/norm/topological representations (pp.89–90). The continuous-function space C(S,T) is complete when S is compact and T complete, imported through the existing normed continuous-function library. Theorems 11/12 give sequential compactness/compactness of the closure of a family iff its metric subspace is totally bounded. No closedness assumption on the original family is needed because the conclusions concern its closure (pp.90–91). Theorem 13 starts with a totally bounded nonempty family in the sup norm. A finite cover by radius-one balls, representatives and K=maximum representative norm+1 give a uniform bound. Smaller sup-norm nets and uniform continuity of finitely many representatives give a shared continuity modulus. The PDF prints the bound construction and asserts the final modulus, rather than a complete expanded derivation (p.91). Theorem 14 says each evaluation set H_x={f(x):f∈H} is totally bounded and the family equicontinuous. Evaluation is norm nonexpansive: ||f(x)-g(x)||≤||f-g||_sup, explaining transfer of finite nets. This inequality is this reading’s explanation, not a reproduced checker trace (pp.91–92). Theorem 15 aligns the distance-by-norm, MetricSpaceNorm and TopSpaceNorm constructions when a normed structure and norm topology agree. This avoids treating equality of underlying elements as automatic equality of every topology/metric representation. Theorems 20/21 similarly transport compactness, and22 gives completeness of a compact normed linear topological space (pp.92–93). Theorem 16 characterizes total boundedness of H by uniform family equicontinuity and compactness of cl(H_x) for every point x. Target completeness turns totally bounded pointwise sets into compact closures. For the converse, the standard finite-net reasoning combines finitely many domain sample neighborhoods with finite approximations to their evaluation sets. The displayed proof merely states existence of finite epsilon-ball covers and omits that detailed construction; it was not audited from Mizar source (p.92). Theorems 17/18 express the same criterion as sequential compactness of cl(H) or compactness of cl(F), respectively. Theorem19 replaces uniform equicontinuity by equicontinuity at every point using Theorem5. These are relative compactness criteria for the family, not assertions that an arbitrary unclosed family F is itself compact (pp.92–93). Theorems 16–19 require pointwise relative compactness, stronger than equiboundedness in a general infinite-dimensional Banach target. A bounded family of constant maps taking orthonormal unit-vector values would be equicontinuous and equibounded but have no compact evaluation-set closure. This is an illustrative mathematical check of the necessary distinction, not an example supplied or benchmarked in the paper. Theorem23 assumes every member range lies in one compact subset U of T. Then the pointwise closures lie in that compact set, so equicontinuity suffices for compactness of cl(F); conversely compact cl(F) gives equiboundedness and equicontinuity. The compact-range premise is a substantive additional restriction, not merely boundedness of U (p.93). Presented evaluation is a library-based formal theorem development with definitions, short proof sketches and dependency references. No executable finite-net construction, computational complexity, checking times/proof sizes, empirical comparison, checker log or artifact run is supplied. Imported ASCOLI source and continuous-function Banach-space proof [11] not independently inspected. No distributed protocol, Verus/Rust/TLA+ or LLM proof/specification-agent evaluation (all pages).
  • how much was read: most of it read
  • source
  • record id: yamazaki-miyajima-shidama-ascoli-2021-2021
• ACL2 multiplier rewriter (2020)
  • title: Automated and Scalable Verification of Integer Multipliers.
  • what: Gives an ACL2-verified rewrite procedure for functional correctness of concrete signed/unsigned multiplier circuits. It proves symbolic SVL execution equals ACL2 integer multiplication with specified extensions and bit truncation. First proves hierarchical adder modules and replaces them with sum/carry specifications s(x)=x mod 2 and c(x)=floor(x/2). Separate multiplier rules flatten summation trees, combine carries through a temporary d(x)=x/2 representation, and simplify Booth/sign-extension partial products. Syntactic restrictions contain polynomial expansion and keep conflicting adder/multiplier rules in separate phases. The specification is rewritten via a proved multbycol function to the same per-output-bit form; syntactic equality concludes the theorem. Lexicographic measures justify termination of the core rule sets.
  • number: Eight 1024×1024 signed/unsigned cases: 322–397 s; DK takes 13,247–15,198 s and AM times out
  • number: Proof time grows 4.5–6× for 4× circuit-size growth; largest runs consume up to 30 GB
  • number: Simple Wallace-like designs spend about 40% in rewrite simplification; Booth designs spend over 70% in partial-product simplification
  • limits: Requires preserved circuit hierarchy, adder module names/I/O sizes, multiplier I/O widths and signedness. ACL2 proves the rewriting and resulting circuit theorem relative to SVL semantics and the supplied specification; completeness is unproved. Failed proofs lack friendly diagnostics or counterexamples. Array multipliers scale poorly. Comparison excludes Verilog translation time; DK includes certificate generation/checking, while AM produces no certificate. Benchmarks are arbitrarily selected, emphasizing Wallace-like circuits. The termination section omits detailed discussion of elementary algebraic rules.
  • how much was read: most of it read
  • source
  • record id: acl2-multiplier-rewriter-2020
• An Axiomatic Approach to Existence and Liveness for Differential Equations (2020)
  • what: # ODE liveness needs enough solution duration and a valid path through its domain (authored by agents unless marked 🧑) Tan and Platzer develop deductive proofs that an ordinary differential equation (ODE) solution lasts long enough to reach a target without leaving its allowed domain. This record reads the complete 61-page arXiv:2004.14561v2 report, dated 9 August 2020, including all appendices. The contribution is a library of small refinement steps in differential dynamic logic (dL), a logic for discrete and continuous programs, plus derived existence/liveness rules and a KeYmaera X implementation. The authors derive corrected forms of several earlier liveness arguments; the earlier publications themselves were not independently checked for this record. [Evidence: Q0, Title, complete abstract and §1 scope, PDF pp.1–1; Q1, §1 complete surveyed corrections, contributions and trust/implementation claims, PDF pp.1–3; complete exact passages in quotes.json.] Source (Q0, Title, complete abstract and §1 scope): > An Axiomatic Approach to Existence and Liveness for Differential > Equations > Yong Kiam Tan André Platzer ∗ > Abstract > This article presents an axiomatic approach for deductive verification of existence and liveness for ordinary differ- > ential equations (ODEs) with differential dynamic logic (dL). The approach yields proofs that the solution of a given > ODE exists long enough to reach a given target region without leaving a given evolution domain. Numerous subtleties > complicate the generalization of discrete liveness verification techniques, such as loop variants, to the continuous set- > ting. For example, ODE solutions may blow up in finite time or their progress towards the goal may converge to zero. > These subtleties are handled in dL by successively refining ODE liveness properties using ODE invariance properties > which have a complete axiomatization. This approach is widely applicable: several liveness arguments from the > literature are surveyed and derived as special instances of axiomatic refinement in dL. These derivations also correct > several soundness errors in the surveyed literature, which further highlights the subtlety of ODE liveness reasoning > and the utility of an axiomatic approach. An important special case of this approach deduces (global) existence prop- > erties of ODEs, which are a fundamental part of every ODE liveness argument. Thus, all generalizations of existence > properties and their proofs immediately lead to corresponding generalizations of ODE liveness arguments. Overall, > the resulting library of common refinement steps enables both the sound development and justification of new ODE > existence and of liveness proof rules from dL axioms. These insights are put into practice through an implementation > of ODE liveness proofs in the KeYmaera X theorem prover for hybrid systems. > Keywords: differential equations, liveness, global existence, differential dynamic logic > 1 Introduction > Hybrid systems are mathematical models describing discrete and continuous dynamics, and interactions thereof. This > flexibility makes them natural models of cyber-physical systems (CPSs) which feature interactions between discrete > computational control and continuous real world physics [Alu15, Pla18]. Formal verification of hybrid systems is > of significant practical interest because the CPSs they model frequently operate in safety-critical settings. Verifying > properties of the differential equations describing the continuous dynamics present in hybrid system models is a key > aspect of any such endeavor. > This article focuses on deductive verification of existence and liveness1 > properties for ordinary differential equa- > tions (ODEs), i.e., the question whether an ODE solution exists for long enough to reach a given region without > leaving its domain of evolution. Such questions can be phrased naturally in differential dynamic logic (dL) [Pla10, > Pla12b, Pla17a, Pla18], a logic for deductive verification of hybrid systems whose relatively complete axiomatization > [Pla12a, Pla17a] lifts ODE verification results to hybrid systems, and whose theorem prover, KeYmaera X [FMQ+ > 15], > enables an implementation. > For discrete systems, methods for proving liveness are well-known: loop variants show that discrete loops eventu- > ally reach a desired goal [Har79], while temporal logic is used to specify and study liveness properties in concurrent > and infinitary settings [MP92, OL82]. However, the deduction of (continuous) ODE liveness properties is hampered > ∗Computer Science Department, Carnegie Mellon University, Pittsburgh, USA {yongkiat|aplatzer}@cs.cmu.edu > 1The form of ODE liveness considered in this article is in the sense of Owicki and Lamport [OL82] for concurrent programs within their (linear) > temporal logic. Liveness for ODEs has sometimes been called eventuality [PR07, SJ15] and reachability [TT10]. To minimize ambiguity, this > article refers to the property as liveness, with a precise formal definition in Section 2. Other advanced notions of liveness for ODEs are discussed > in Section 8. > arXiv:2004.14561v2 > [cs.LO] > 9 > Aug The standing model uses autonomous polynomial vector fields over mathematical real states, with rational polynomial syntax and first-order real-arithmetic target/domain formulas. A fresh clock can represent time dependence. Polynomial fields have unique local solutions, but those solutions need not last forever. A diamond formula means that some finite solution segment reaches the target and satisfies the domain throughout, including its initial and final states; duration zero is allowed when the domain and target already hold. This is finite reachability along a unique continuous evolution. Applying it to distributed fairness, message delivery or infinitely recurring progress would require an additional model. The paper’s completeness background concerns ODE invariants; it does not establish completeness for all ODE liveness. [Evidence: Q2, §2.1–2.2 syntax, standing ODE model and modal semantics, PDF pp.3–5; Q3, §2.3 Lie derivatives, base proof rules and constant-context restrictions, PDF pp.5–6; complete exact passages in quotes.json.] Source (Q2, §2.1–2.2 syntax, standing ODE model and modal semantics): > 2 Background: Differential Dynamic Logic > This section reviews the syntax and semantics of dL, focusing on its continuous fragment which has a complete > axiomatization for ODE invariants [PT20]. Full presentations of dL, including its discrete fragment, are available > elsewhere [Pla12b, Pla17a, Pla18]. > 2.1 Syntax > The grammar of dL terms is as follows, where x ∈ V is a variable and c ∈ Q is a rational constant. These terms are > polynomials over the set of variables V: > p, q ::= x | c | p + q | p · q > Notably, dL also supports term language extensions [PT20] that would enable, e.g., the use of exponentials and > trigonometric functions. These extensions are compatible with the results presented in this article, but are omitted for > simplicity as they are not the main focus of this article. > The grammar of dL formulas is as follows, where ∼ ∈ {=, 6=, ≥, >, ≤, <} is a comparison operator and α is a > hybrid program: > φ, ψ ::= > First-order formulas of real arithmetic P,Q > z }| { > p ∼ q | φ ∧ ψ | φ ∨ ψ | ¬φ | ∀v φ | ∃v φ | [α]φ | hαiφ > The notation p < q (resp. 4) is used when the comparison operator can be either ≥ or > (resp. ≤ or <). Other > standard logical connectives, e.g., →, ↔, are definable as in classical logic. Formulas not containing the modalities > [·], h·i are formulas of first-order real arithmetic and are written as P, Q. The box ([α]φ) and diamond (hαiφ) modality > formulas express dynamic properties of the hybrid program α. This article focuses on continuous programs, where α > is given by a system of ODEs x0 > = f(x) & Q. Here, x0 > = f(x) is an n-dimensional system of differential equations, > x0 > 1 = f1(x), . . . , x0 > n = fn(x), over variables x = (x1, . . . , xn), where the LHS x0 > i is the time derivative of xi and the > RHS fi(x) is a polynomial over variables x. The ODEs x0 > = f(x) are autonomous as they do not depend explicitly on > time on the RHS [Kha92]. A useful transformation is to add a clock variable t to the system with x0 > = f(x, t), t0 > = 1 > 4 Y. K. Tan and A. Platzer > -1 0 1 u > -1 > 0 > 1 > v > -1 0 1 u > -1 > 0 > 1 > v > Figure 1: Visualization of αl (left) and αn (right). Solutions of αl globally spiral towards the origin. In contrast, > solutions of αn spiral inwards within the inner red disk (dashed boundary), but spiral outwards otherwise. For both > ODEs, solutions starting on the black unit circle eventually enter their respective shaded green goal regions. The ODE > αn also exhibits finite-time blow up of solutions outside the red disk. > t=0 > t=0.3 > t=0.4 > t=0.5 > t=0.55 > t=0.56 t=0.57 > 0 2 4 6 8 u > 0 > 2 > 4 > v > 0 0.2 0.4 0.6 t > 1 > 10 > 100 > 1000 > u2 > +v2 > Figure 2: Two views of the ODE αn evolving from initial state u = 1, v = 0 over time t. The left plot shows its > trajectory in the u, v plane (cf. Fig. 1) while the right plot shows the squared Euclidean norm u2 > + v2 > evolving over > time t (with logarithmic scaling for the vertical axis). The solution blows up in finite time with norm approaching ∞ > as t approaches 0.58 (rounded up, black dashed asymptote). Nevertheless, the solution reaches the green goal region > u2 > + v2 > ≥ 2 from Fig. 1 at t ≈ 0.31 (rounded up, green dot) before blowing up. > if time dependency on the RHS is needed. The domain constraint Q specifies the set of states in which the ODE is > allowed to evolve continuously. When there is no domain constraint, i.e., Q is the formula true, the ODE is also > written as x0 > = f(x). For n-dimensional vectors x, y, the dot product is x · y > def > = > Pn > i=1 xiyi and kxk2 def > = > Pn > i=1 x2 > i > denotes the squared Euclidean norm. Other norms are explicitly defined in this article when used. > The following two running example ODEs αl and αn are visualized in Fig. 1 with directional arrows corresponding > to their RHS evaluated at points on the plane: > αl ≡ u0 > = −v − u, v0 > = u − v (1) > αn ≡ u0 > = −v − u( > 1 > 4 > − u2 > − v2 > ), v0 > = u − v( > 1 > 4 > − u2 > − v2 > ) (2) > The ODE αl is linear because its RHS depends linearly on u and v while αn is nonlinear because of the cubic > terms in its RHS. The nonlinearity of αn results in more complex behavior for its solutions, e.g., the difference in > spiraling behavior inside or outside the red disk shown in Fig. 1. In fact, solutions of αn blow up in finite time iff they > start outside the disk characterized by u2 > + v2 > ≤ 1 > 4 , whereas finite-time blow up is impossible for linear ODEs like > αl [Chi06, Wal98]. An illustration of finite-time blow up for αn from an initial state outside the red disk is shown > in Fig. 2. This phenomenon is precisely defined and investigated in Section 4, which enables formal proofs of the > aforementioned (absence of) finite-time blow up. > When terms (or formulas) appear in contexts involving ODEs x0 > = f(x), it is sometimes necessary to restrict the > set of free variables they are allowed to mention. In this article, these restrictions are always stated explicitly and are > also indicated as arguments to terms (or formulas), e.g., p() means the term p does not mention any of x1, . . . , xn as > free variables, while P(x) means the formula P may mention all of them. This understanding of variable dependencies > An Axiomatic Approach to Existence and Liveness for Differential Equations 5 > is made precise using function and predicate symbols in dL’s uniform substitution calculus [Pla17a]. > 2.2 Semantics > States ω : V → R assign real values to each variable in V; the set of all states is written S. The semantics of polynomial > term p in state ω ∈ S is the real value ω[[p]] of the corresponding polynomial function evaluated at ω. The semantics of > dL formula φ is defined compositionally [Pla17a, Pla18] as the set of states [[φ]] ⊆ S in which that formula is true. The > semantics of first-order logical connectives are defined as usual, e.g., [[φ ∧ ψ]] = [[φ]] ∩ [[ψ]]. For ODEs, the semantics > of the modal operators is defined directly as follows. Let ω ∈ S and ϕ : [0, T) → S (for some 0 < T ≤ ∞), be the > unique solution maximally extended to the right [Chi06, Wal98] for the ODE x0 > = f(x) with initial value ϕ(0) = ω, > then: > ω ∈ [[[x0 > = f(x) & Q]φ]] iff for all 0 ≤ τ < T where ϕ(ζ) ∈ [[Q]] for all 0 ≤ ζ ≤ τ: ϕ(τ) ∈ [[φ]] > ω ∈ [[hx0 > = f(x) & Qiφ]] iff there exists 0 ≤ τ < T such that ϕ(ζ) ∈ [[Q]] for all 0 ≤ ζ ≤ τ and ϕ(τ) ∈ [[φ]] > Informally, the safety property [x0 > = f(x) & Q]φ is true in initial state ω if all states reached by following the > ODE from ω while remaining in the domain constraint Q satisfy postcondition φ. Dually, the liveness property > hx0 > = f(x) & Qiφ is true in initial state ω if some state which satisfies the postcondition φ is eventually reached in > finite time by following the ODE from ω while staying in domain constraint Q at all times. Figure 1 suggests that > formulas2 > hαli 1 > 4 ≤ k(u, v)k∞ ≤ 1 > 2 >
    > and hαniu2 > + v2 > ≥ 2 are true for initial states ω on the unit circle. These The central proof method refines a simple diamond property into the desired one, justifying each change with a box property that holds along relevant solutions. Ghost variables are fresh auxiliary ODE coordinates used only for proof. The new bounded differential ghost axiom permits nonlinear vector ghosts when their squared norm is bounded along augmented solutions; a derivative-growth version supplies another sufficient condition. These bounds prevent added coordinates from ending the solution prematurely. Appendix A proves the semantic duration comparison and derives the refinement axioms; Appendix B supplies syntactic rule derivations. Existing base-calculus results cited by the paper are distinguished from its new ghost and refinement arguments. [Evidence: Q4, §2.3 Lemma2 bounded differential ghosts and explanation, PDF pp.7–7; Q5, §3 complete refinement examples and Lemma3 axioms, PDF pp.7–9; Q29, AppendixA.1 complete bounded-ghost soundness proof, PDF pp.34–35; complete exact passages in quotes.json.] Source (Q4, §2.3 Lemma2 bounded differential ghosts and explanation): > An Axiomatic Approach to Existence and Liveness for Differential Equations 7 > versions of the axiom (where a(x) is a matrix and b(x) is a vector) have also been used elsewhere [PT20]. This article > uses a new vectorial generalization that allows differential ghosts with provably bounded ODEs to be added. > Lemma 2 (Bounded differential ghosts). The following bounded differential ghosts axiom BDG is sound, where > y = (y1, . . . , ym) is a m-dimensional vector of fresh variables (not appearing in x), g(x, y) is a corresponding m- > dimensional vector of terms, and kyk2 > is the squared Euclidean norm of y. Term p(x) and formulas P(x), Q(x) are > dependent only on free variables x (and not y). > BDG > [x0 > = f(x), y0 > = g(x, y) & Q(x)] kyk2 > ≤ p(x) > → [x0 > = f(x) & Q(x)]P(x) ↔ [x0 > = f(x), y0 > = g(x, y) & Q(x)]P(x) >
    > Proof in Appendix A.1. > Like DG, axiom BDG allows an arbitrary vector of ghost ODEs y0 > = g(x, y) to be added syntactically to the > ODEs. However, it places no syntactic restriction on the RHS of the ODE (such as linearity in axiom DG). For > soundness, BDG instead adds a new precondition with a bound kyk2 > ≤ p(x) in terms of x on the squared norm of y > along solutions of the augmented ODE. This syntactic precondition ensures that y cannot blow up before x, so that > solutions of x0 > = f(x), y0 > = g(x, y) have existence intervals as long as those of the solutions of x0 > = f(x). Section 4 > shows how to prove these preconditions so that axiom BDG enables ODE existence proofs through the refinement > approach of Section 3. Domain refinement has additional obligations. The direct rule requires a suitable domain invariant, rather than assuming the target’s negation wherever convenient. COR requires an initially false target and matching open/open or closed/closed topology for target and new domain. SAR uses a different until-condition involving the negation of target-and-domain together; its general argument relies on the tame local behavior of semialgebraic sets and polynomial ODEs. Appendix A separately covers closed targets or open domains. Parameters are held constant when testing the topology of sets over ODE variables. These conditions control what happens when a solution reaches a shared boundary. [Evidence: Q6, §3 unsound domain weakening, Lemma4 and topology conditions, PDF pp.9–10; Q30, AppendixA.2 complete topological refinement soundness proof, PDF pp.37–39; Q31, AppendixA.3 complete topological tests and constant-parameter interpretation, PDF pp.39–40; complete exact passages in quotes.json.] Source (Q6, §3 unsound domain weakening, Lemma4 and topology conditions): > DRh·i [x0 > = f(x) & R ∧ ¬P]Q → hx0 > = f(x) & RiP → hx0 > = f(x) & QiP >
    > This conjectured axiom is unsound (indicated by ) as the solution could sneak out of Q exactly when it crosses > from ¬P into P. In continuous settings, the language of topology makes precise what this means. The following > topological refinement axioms soundly restrict what happens at the crossover point: > Lemma 4 (Topological ODE refinement axioms). The following topological h·i ODE refinement axioms are sound. > In axiom COR, P, Q either both characterize topologically open or both characterize topologically closed sets over > variables x. > COR ¬P ∧ [x0 > = f(x) & R ∧ ¬P]Q → hx0 > = f(x) & RiP → hx0 > = f(x) & QiP >
    > SAR [x0 > = f(x) & R ∧ ¬(P ∧ Q)]Q → hx0 > = f(x) & RiP → hx0 > = f(x) & QiP >
    > Proof in Appendix A.2. > Axiom COR is the more informative topological refinement axiom. Like the (unsound) axiom candidate DRh·i, > it allows formula ¬P to be assumed in the domain constraint when proving the box refinement. For soundness > though, axiom COR has crucial topological side conditions on formulas P, Q so it can only be used when these > conditions are met. Several variations of COR are possible (with similar soundness proofs), but they require alternative > topological restrictions and additional topological notions. One useful variation involving the topological interior is > given in Lemma 26. When these topological restrictions are enforced syntactically, axiom COR is derived from dL’s > real induction axiom [PT20]. For the sake of generality, this article gives semantic topological side conditions with > associated semantic soundness proofs in Appendix A.2. > Axiom SAR applies more generally than COR but only assumes the less informative formula ¬(P ∧ Q) in the > domain constraint for the box modality. Its proof crucially relies on Q being a formula of real arithmetic so that > the set it characterizes has tame topological behavior [BCR98], see the proof in Appendix A.2 for more details. By > 3In dL’s uniform substitution calculus [Pla17a], this Lie derivative is written directly as the differential term (kyk2)0 which can be soundly and > syntactically rewritten using dL’s differential axioms [Pla17a]. > 10 Y. K. Tan and A. Platzer > topological considerations, axiom SAR is also sound if formula P (or resp. Q) characterizes a topologically closed > (resp. open) set over the ODE variables x. These additional cases are also proved in Appendix A.2 without relying on > the fact that Q is a formula of real arithmetic. Global existence is expressed by adding a clock and proving that every arbitrary finite clock threshold can be exceeded. The dependency-order rule builds the ODE in groups whose right-hand sides use only earlier groups and themselves. Each group needs either a squared-norm bound depending on earlier groups/time or a suitable linear bound on its squared-norm derivative. Derived cases include globally Lipschitz fields and affine dependency groups. Example 2, u′=u and v′=uv, has provably global solutions despite lacking a global Lipschitz constant for the whole vector field. The bounded-existence rule says a solution either reaches any requested time horizon or leaves a bounded region; invariance of that region then proves global existence. The combined rule allows affine groups alongside bounded nonlinear groups. [Evidence: Q7, §4–4.1 finite-time blow-up example, clock existence and Lemma5, PDF pp.10–10; Q9, §4.1 dependency-order groups and complete Corollary6, PDF pp.11–12; Q10, §4.2.1 global Lipschitz and affine dependency-order existence, PDF pp.12–13; Q11, §4.2.1 complete Example2 and dependency-order derivation, PDF pp.13–14; Q12, §4.2.2 complete bounded existence and combined Corollary10, PDF pp.14–15; complete exact passages in quotes.json.] Source (Q7, §4–4.1 finite-time blow-up example, clock existence and Lemma5): > 4 Finite-Time Blow Up and Global Existence > This section explains how global existence properties can be proved for a given ODE x0 > = f(x), subject to assumptions > Γ about the initial states for the ODE. The existence and uniqueness theorems for ODEs [Chi06, Wal98] guarantee that > polynomial ODEs like x0 > = f(x) always have a unique, right-maximal solution from any initial state, ϕ : [0, T) → S > for some 0 < T ≤ ∞. However, these theorems give no guarantees about the precise duration T. In particular, ODEs > can exhibit a technical phenomenon known as finite-time blow up of solutions [Chi06], where ϕ is only defined on a > bounded time interval [0, T) with T < ∞. Additionally, it is possible that such finite-time blow up phenomena only > happens for some initial conditions (and corresponding solutions) of the ODE. Moreover, these initial conditions (with > finite-time blow up) may not be relevant to the model of concern, especially when the dynamics of real world systems > are controlled to stay away from the blow up. For example, αn (2) exhibits finite blow up of solutions only outside the > red disk as shown in Fig. 1 and the blow up occurs well after its solutions have reached the target region, see Fig. 2. > As an additional example for this section, consider the following nonlinear ODE: > αb ≡ v0 > = −v2 > (7) > The solution to this ODE is v(t) = v0 > v0+t , where v0 6= 0 is the initial value of v at time t = 0 (if v0 = 0, then > v(t) = 0 for all t). If v0 < 0 initially, then this solution is only defined to the right for the finite time interval [0, −v0), > because the denominator v0 + t is 0 at t = −v0. On the other hand, for v0 ≥ 0, the existence interval to the right is > [0, ∞). Thus, αb exhibits finite-time blow up of solutions, but only for v0 < 0. > 4.1 Global Existence Proofs > The discussion above uses the mathematical solution v(t) of the ODE αb (7) as a function of time. For deductive > proofs, the (global) existence of solutions can be expressed in dL as a special form of an ODE liveness property. The > first step is to add a fresh variable t with t0 > = 1 that tracks the progress of time4 > , see Section 2.1. Then, using a fresh > variable τ not in x, t, the following formula syntactically expresses that the ODE has a global solution because its > solutions can reach time τ, for any arbitrary τ: > ∀τ hx0 > = f(x), t0 > = 1i t > τ (8) > Proving formula (8) shows global existence of solutions for the ODE x0 > = f(x). The simplest instance of (8) is > for the ODE t0 > = 1 by itself without any ODE x0 > = f(x). In this case, the formula (8) is valid because t0 > = 1 is an > ODE with constant RHS and its solution exists for all time. The axiom TEx below expresses this fact and it is derived > directly from the solution axiom of dL [Pla17a]: > Lemma 5 (Time existence). The following axiom is derivable in dL. > TEx ∀τ ht0 > = 1it > τ > Proof in Appendix A.2. > Other instances of (8) can be proved using axioms BDGh·i,DDGh·i with appropriate assumptions about the initial > conditions for the additional ODEs x0 > = f(x). This is exemplified for the ODE αb next. > Example 1 (Velocity of particle with air resistance). The ODE αb can be viewed as a model of the velocity of a particle > that is slowing down due to air resistance. Of course, it does not make physical sense for the velocity of such a particle > to “blow up”. However, the solution of αb only exists globally if the particle starts with positive initial velocity v > 0, > 4For consistency, the ODE x0 = f(x) is assumed to not mention t even if this is not always strictly necessary. Proposition 11 gives conditional completeness for global existence when a global solution is representable in the term language; a representable provable norm bound can also suffice. The report explicitly notes that its polynomial syntax excludes even the exponential solutions of Example 2, though extensions allow more functions. This result does not say that every global polynomial ODE has an automatically discoverable certificate, or that arbitrary liveness is decidable. The related-work discussion notes undecidability of global existence even for polynomial ODEs. [Evidence: Q13, §4.3 complete conditional completeness, Proposition11 and representability limits, PDF pp.15–16; Q28, §8–9 complete related work and conclusion, PDF pp.31–33; complete exact passages in quotes.json.] Source (Q13, §4.3 complete conditional completeness, Proposition11 and representability limits): > 4.3 Completeness for Global Existence > The derivation of the existence axioms GEx,BEx,GBEx and rule DEx illustrate the use of liveness refinement for prov- > ing existence properties. Moreover, BDGh·i is the sole ODE diamond refinement axiom underlying these derivations > (recall DDGh·i is derived from BDGh·i). This yields a natural question: are there ODEs whose solutions exist glob- > ally, but whose global existence cannot be proved syntactically using BDGh·i? The next completeness result gives a > conditional completeness answer: all global existence properties can be proved using BDGh·i, if the corresponding > ODE solutions are syntactically representable. > Proposition 11 (Global existence completeness). If the ODE x0 > = f(x) has a global solution representable in the dL > term language, then the global existence formula (8) is derivable for x0 > = f(x) from axiom BDGh·i. > Proof Sketch (Proof in Appendix B.1). Suppose that ODE x0 > = f(x) has a global solution syntactically represented > in dL as term X(t) dependent only on the free variable t, the (symbolic) initial values x0 of variables x, and the > (constant) parameters for the ODE. The equality x = X(t) is provable along the ODE x0 > = f(x), t0 > = 1 because > solutions are equational invariants [Pla17a, PT20]. The proof uses BDGh·i with the bounding term p = kX(t)k2 > , so > that the required hypothesis of BDGh·i, i.e., [x0 > = f(x), t0 > = 1]kxk2 > ≤ kX(t)k2 > proves trivially using the equality > x = X(t). > The following remark illustrates the usage and limitations of Proposition 11. > Remark 1 (Syntactically representable solutions). Consider the example ODE u0 > = u, v0 > = uv proved to have global > solutions in Example 2. Mathematically, its solution is given by the following functions (defined for all t ∈ R), where > u0, v0 are the initial values of u, v at time t = 0 and exp is the real exponential function. > u(t) = u0 exp(t), v(t) = > v0 > exp(u0) > exp(u0 exp(t)) (15) > Since the solution (15) is defined globally, Proposition 11 seemingly provides an alternative way to prove global > existence for the ODE. The caveat is that Proposition 11 only applies when the solution is syntactically representable > in the term language. The term language of this article (Section 2.1) only accepts polynomial solutions. However, dL’s > 16 Y. K. Tan and A. Platzer > term language extensions [PT20] considerably extends the class of syntactically representable solutions to include7 > , > e.g., towers of exponentials, like those found in (15). Thus, the usefulness of Proposition 11 is limited by which > solutions are syntactically representable. > Notably though, the proof in Proposition 11 actually only requires a provable upper bound X(t) with kxk2 > ≤ > kX(t)k2 > , rather than an equality. Such an upper bound, if syntactically representable in dL, also suffices for proving > global existence. The complicated closed form solution (15) also highlights the advantage of axioms BDGh·i,DDGh·i > and their use in the derived axioms of Corollaries 7–10 because they implicitly deduce global existence without needing > an explicitly representable solution for the ODEs. For an unconstrained target, an atomic differential variant is a quantity whose derivative is bounded below by one fixed positive constant until the goal. Strict positivity alone can decay toward zero and fail to reach the goal. A constant positive rate also fails if another coordinate blows up before enough time passes. Corollary 12 therefore makes sufficient duration explicit or uses provably global solutions. Equational goals use continuity; higher-order variants use a positive higher Lie derivative to obtain polynomial-in-time progress. Staging-set rules keep the trajectory in a region until the goal and force exit: a bounded set bounds continuous terms, while a compact set lets a strictly positive derivative attain a positive minimum. The set-Lyapunov rule requires compact K and open target P, correcting a merely closed-K version reported in the survey. [Evidence: Q14, §5.1 atomic differential variants and duration/progress limitations, PDF pp.16–18; Q15, §5.1 equational and higher differential variants, Corollaries13–14, PDF pp.18–19; Q16, §5.2 complete staging-set rules, Corollaries15–16, PDF pp.19–19; Q18, §5.2 complete set-Lyapunov rule and compactness correction, PDF pp.20–20; complete exact passages in quotes.json.] Source (Q14, §5.1 atomic differential variants and duration/progress limitations): > 5 Liveness Without Domain Constraints > This section presents proof rules for liveness properties of ODEs x0 > = f(x) without domain constraints, i.e., where Q > is the formula true. Errors and omissions in the surveyed techniques are highlighted in blue. > 5.1 Differential Variants > The fundamental technique for verifying liveness of discrete loops are loop variants, i.e., well-founded quantities that > increase (or decrease) across each loop iteration. Differential variants [Pla10] are their continuous analog, where the > value of a given term p is shown to increase along ODE solutions by showing that its rate of change is bounded below > by a positive constant ε() > 0 along those solutions. Recall this article’s syntactic convention (Section 2.1) that term > ε() is not allowed to depend on any of the free variables x1, . . . , xn appearing in the ODE and must therefore remain > constant along the ODE solution. > Corollary 12 (Atomic differential variants [Pla10]). The following proof rules (where < is either ≥ or >) are derivable > in dL. Terms ε(), p0() are constant for ODE x0 > = f(x), t0 > = 1. In rule dV<, the ODE x0 > = f(x) has provable global > solutions. > dVΓ > < > ¬(p < 0) > . > p ≥ ε() > Γ, p = p0(), t = 0, hx0 = f(x), t0 = 1i p0() + ε()t > 0 >
> hx0 = f(x), t0 = 1ip < 0 > dV< > ¬(p < 0) > . > p ≥ ε() > Γ, ε() > 0 hx0 = f(x)ip < 0 > Proof Sketch (Proof in Appendix B.2). Rule dVΓ > < is derived from axiom Kh&i with G ≡ p0() + ε()t > 0 >
    > : > Γ, p = p0(), t = 0 [x0 > = f(x), t0 > = 1 & ¬(p < 0)] p0() + ε()t ≤ 0 >
> Kh&i > Γ, p = p0(), t = 0, hx0 > = f(x), t0 > = 1i p0() + ε()t > 0 >
> hx0 > = f(x), t0 > = 1ip < 0 > Monotonicity M[0 > ] strengthens the postcondition to p ≥ p0() + ε()t with the domain constraint ¬(p < 0). A > subsequent use of dI< completes the derivation: > ¬(p < 0) > . > p ≥ ε() > dI< > Γ, p = p0(), t = 0 [x0 > = f(x), t0 > = 1 & ¬(p < 0)] p ≥ p0() + ε()t >
    > M[0 > ] > Γ, p = p0(), t = 0 [x0 > = f(x), t0 > = 1 & ¬(p < 0)] p0() + ε()t ≤ 0 >
> Rule dV< is derived in Appendix B.2 as a corollary of rule dVΓ > < because the ODE x0 > = f(x) is assumed to have > solutions which (provably) exist globally. > In both rules dVΓ > <,dV<, the lower bound ε() > 0 on the Lie derivative > . > p ensures that the value of p strictly > increases along solutions to the ODE. Geometrically, as illustrated in Fig. 3a, the value of p is bounded below over > time t by the line p0() + ε()t with offset p0() and positive slope ε(). Since p0() + ε()t is non-negative for sufficiently > large values of t, the (lower bounded) value of p is also eventually non-negative. > 7Nevertheless, even such a syntactic extension is insufficient because Turing machines can be simulated by solutions of polynomial differential > equations [GCB08, Theorem 2]. It is possible to construct polynomial ODEs whose solutions do not blow up, but grow like the (Turing-computable) > Ackermann function, i.e., faster than any tower of exponentials. > An Axiomatic Approach to Existence and Liveness for Differential Equations 17 > p > p0()+ε ()t > 0 0.1 0.2 0.3 0.4 0.5 0.6 t > p0 > (a) p = 2u + 3v − 4, initial value u = 1, v = 0 > p p0()+ p >  > 0()t +ε() > t2 > 2! > 0 1 2 3 4 5 6 t > p0 > (b) p = −2 + 2u − u2 > − 5u3 > + 5v + uv − 2u3 > v + v2 > − > 5uv2 > − uv3 > , initial value u = −0.52, v = 0 > p > p0()+ε ()t > 0 0.1 0.2 0.3 0.4 0.5 0.6 t > p0 > (c) p = u + v − 3, initial value u = 1, v = 0 > p > 0 2 4 6 8 10 12 t > p0 > (d) p = −10(u2 > + v2 > ) − 1, initial value u = 0.49, v = 0 > Figure 3: The solid blue and red curves show the value of various terms p evaluated along solutions of the ODE αn (2) > from respective initial values p0 over time t. The blue curves in Figs. 3a and 3b are respectively bounded below by a > dashed black line (corresponding to Corollary 12) and a dashed quadratic curve (corresponding to Corollary 14) which > imply that p is eventually non-negative along their respective ODE solutions. The red curve in Fig. 3c is also bounded > below by the dashed black line, but its solution only exists for 0.575 time units (vertical red dashed asymptote) so > the direct bound from Corollary 12 fails, even though p is eventually non-negative along the solution. The red curve > in Fig. 3d has strictly positive time derivative but asymptotically increases towards a negative value (horizontal red > dashed asymptote). > Two key subtleties underlying rules dVΓ > <,dV< are illustrated in Figs. 3c and 3d. The first subtlety, shown in Fig. 3c, > is that ODE solutions must exist for sufficiently long for p or, more precisely its lower bound, to become non-negative. > This is usually left as a soundness-critical side condition in liveness proof rules [Pla10, SJ15], but any such side > condition is antithetical to approaches for minimizing the soundness-critical core in implementations [Pla17a] because > it requires checking the (semantic) condition that solutions exist for sufficient duration. The conclusion of rule dVΓ > < > formalizes this side condition as an assumption. In contrast, rule dV< requires provable global existence for the > ODEs (provable as in Section 4). The rest of this article similarly develops ODE liveness proof rules that rely on the > global existence proofs from Section 4. In all subsequent proof rules, the ODE x0 > = f(x) is said to have provable > global solutions if the global existence formula (8) for x0 > = f(x) is provable. For example, if x0 > = f(x) were > globally Lipschitz (or, as a special case, linear), then its global existence can be proven using axiom GEx from > Corollaries 7 and 8. For uniformity, all proof steps utilizing this assumption are marked with GEx, although proofs of > global existence could use various other techniques described in Section 4. All subsequent proof rules can be soundly > presented with sufficient duration assumptions like dVΓ > <, but those are omitted for brevity. > The second subtlety, shown in Fig. 3d, is that rules dVΓ > <,dV< crucially need a constant positive lower bound on > the Lie derivative > . > p ≥ ε() for soundness [Pla10] instead of merely requiring > . > p > 0. In the latter case, even though the > value of p is strictly increasing along solutions, it is not guaranteed to become non-negative in finite time because the > rate of increase can itself converge to zero. In fact, as Fig. 3d shows, p may stay negative by asymptotically increasing > 18 Y. K. Tan and A. Platzer > towards a negative value as t approaches ∞. The running linear spiral reaches a smaller circle and then an enclosing annular target by continuity. The nonlinear spiral u′=−v−u(1/4−u²−v²), v′=u−v(1/4−u²−v²) can blow up outside its small stable region, yet still reaches squared norm 2 from the unit circle using compact staging in 1≤u²+v²≤2. Thus global existence is one useful sufficient condition, not a necessary property of every successful finite reachability proof. For constrained variants, the initial target-false condition and open/closed domain requirements remain explicit. A closed annulus can permit reaching its outer boundary; excluding that boundary from the domain makes the same target impossible. The combined and compact-eventuality rules join higher derivatives, compact staging and domain refinement. [Evidence: Q17, §5.2 complete Example5, Corollary17 and §6 motivating/domain example including footnote8, PDF pp.19–21; Q19, §6 topology/duration requirements, Corollaries18–20, PDF pp.21–22; Q20, §6 staging with domains, Corollary21 and complete Example7 boundary reasoning, PDF pp.22–23; Q21, §6 combined/compact-eventuality Corollaries22–23, PDF pp.23–24; complete exact passages in quotes.json.] Source (Q17, §5.2 complete Example5, Corollary17 and §6 motivating/domain example including footnote8): > Example 5 (Nonlinear liveness). The liveness property that Fig. 1 suggested for the nonlinear ODE αn (2) is proved > using rule SPc by choosing the staging set formula S ≡ 1 ≤ u2 > +v2 > ≤ 2 and the differential variant p = u2 > +v2 > . The > proof is shown on the left and visualized on the right below; the goal u2 > + v2 > ≥ 2 is shown in green while S is shown > as a blue annulus. The Lie derivative > . > p with respect to αn is 2(u2 > + v2 > )(u2 > + v2 > − 1 > 4 ), which is bounded below by 3 > 2 > in S. Thus, the right premise of SPc closes trivially. The left premise requires proving that S is an invariant within the > domain constraint ¬(u2 > + v2 > ≥ 2). Intuitively, this is true because the blue annulus can only be left by entering the > goal. Its elided invariance proof is easy [PT20]. > ∗ > S [αn & ¬(u2 > + v2 > ≥ 2)]S > cut,R > u2 > + v2 > = 1 [αn & ¬(u2 > + v2 > ≥ 2)]S > ∗ > R > S > . > p > 0 > SPc > u2 > + v2 > = 1 hαniu2 > + v2 > ≥ 2 > -1 0 1 u > -1 > 0 > 1 > v > This proof exploits the flexibility provided by staging sets in two ways. First, the formula S is chosen to char- > acterize a compact set (as required by rule SPc). As explained in Section 4, solutions of αn can blow up in finite > 20 Y. K. Tan and A. Platzer > time which necessitates the use of BEx for proving its liveness properties. Second, S cleverly excludes the red disk > (dashed boundary) characterized by u2 > + v2 > ≤ 1 > 4 . Solutions of αn behave differently in this region, e.g., the Lie > derivative > . > p is non-positive in this disk. The chain of refinements (6) behind this proof can be seen from the derivation > of rules SPb,SPc in Appendix B.2. The chain starts from the initial liveness property BEx with concrete8 > time bound > 2 > 3 . The first Kh&i step shows that the staging set is ultimately exited (hαni¬S), while the latter shows the desired > liveness property: > hαn, t0 > = 1i(t > > 2 > 3 > ∨ ¬S) > Kh&i > −→hαni¬S > Kh&i > −→hαniu2 > + v2 > ≥ 2 > The need to use axiom BEx (or otherwise, assume global existence) is subtle and is often overlooked in the > surveyed liveness arguments. An example of this is an incorrect claim [PR07, Remark 3.6] that a liveness argu- > ment [PR07, Theorem 3.5] works without assuming that the relevant sets are bounded. This article’s axiomatic ap- > proach can be used to find and fix errors involving these subtleties. As another example, the following set Lyapunov > function proof rule adapts ideas from the literature [RS10, Theorem 2.4, Corollary 2.5] for proving liveness when the > postcondition P characterizes an open set. The latter assumption on P enables a convenient choice of staging set in > rule SPc because ¬P characterizes a closed set. > Corollary 17 (Set Lyapunov functions [RS10]). The following proof rule is derivable in dL. Formula K characterizes > a compact set over variables x, while formula P characterizes an open set over those variables. > SLyap > p ≥ 0 K ¬P, K > . > p > 0 > Γ, p < 0 hx0 = f(x)iP > Proof Sketch (Proof in Appendix B.2). Rule SLyap is derived from rule SPc with S ≡ ¬P ∧K, since ¬P characterizes > a closed set, and the intersection of a closed set with a compact set is compact. > Rule SLyap was claimed [RS10, Theorem 2.4, Corollary 2.5] to hold for any closed set K, when, in fact, K > crucially needs to be compact as seems to have been assumed implicitly in the proofs [RS10]. > 6 Liveness With Domain Constraints > This section presents proof rules for liveness properties x0 > = f(x) & Q with domain constraint Q. These properties > are more subtle than liveness without domain constraints, because the limitation to a domain constraint Q may make > it impossible for an ODE solution to reach a desired goal region without leaving Q. > -1 0 1 u > -1 > 0 > 1 > v > Consider the following liveness property for αl (1) (visualized on the right), which > adds domain constraint Q ≡ u2 > + v2 > 6= 9 > 16 restricting solutions from entering the red > dashed circle before reaching the green goal region. > hαl & u2 > + v2 > 6= > 9 > 16 > i > 1 > 4 > ≤ k(u, v)k∞ ≤ > 1 > 2 >
    > (16) > As proved in Example 4, solutions starting from the black circle u2 > + v2 > = 1 reach > the green goal region. However, the continuous solutions must cross the red dashed > circle u2 > + v2 > = 9 > 16 to reach the goal, see discussion of implication (5). This violates > the domain constraint and falsifies (16) for initial states on the black circle. > Axiom DRh·i with R ≡ true provides one way of soundly and directly generalizing the proof rules from Section 5, > as shown in the following example. > Example 6 (Nonlinear liveness with domain). The liveness property u2 > + v2 > = 1 → hαniu2 > + v2 > ≥ 2 was proved > in Example 5 for the nonlinear ODE αn (2). The following derivation proves a stronger liveness property with the > added domain constraint 1 ≤ u2 > + v2 > by extending the proof from Example 5 with a DRh·i refinement step. The > resulting left premise is an invariance property of the ODE whose proof is elided [PT20]; intuitively, solutions starting > 8The value of u2 + v2 grows at rate 3 > 2 > per time unit along solutions and the initial states satisfy u2 + v2 = 1. Thus, a lower bound on time > required to leave the staging set (when u2 + v2 > 2) is (2 − 1) / 3 > 2 > = 2 > 3 > time units. > An Axiomatic Approach to Existence and Liveness for Differential Equations 21 > from u2 > + v2 > = 1 grow outwards, and so they remain in the domain 1 ≤ u2 > + v2 > (see Fig. 1). The resulting right > premise is proved in Example 5. The implementation offers an existential variant rule that lets arithmetic search find the positive derivative lower bound, with a manual-instantiation option to avoid that search. A semialgebraic variant rule handles disjunctions/conjunctions of polynomial inequalities through a progress formula and invariant reasoning, rather than adding a nonsmooth min/max function to the logic. Example 8 proves u′=−u eventually enters [−1,1]. Closed-domain refinement uses an interior-set obligation. Its practical strictification of nonstrict inequalities underapproximates that interior; Appendix B explicitly explains why it need not equal the interior, for example x≤x versus x<x. [Evidence: Q22, §7–7.1 implementation overview, existential and semialgebraic variants, PDF pp.24–26; Q23, §7.1 complete Example8, conjunction/disjunction progress and implementation assumptions, PDF pp.26–27; Q24, §7.1 complete Lemma26, Corollary27 and strictification explanation, PDF pp.27–27; Q34, AppendixB.4 complete Corollary27 proof and interior-underapproximation explanation, PDF pp.55–55; complete exact passages in quotes.json.] Source (Q22, §7–7.1 implementation overview, existential and semialgebraic variants): > 7 ODE Liveness Proofs in Practice > The preceding sections show how axiomatic refinement can be used to fruitfully navigate and understand the zoo of > ODE existence and liveness arguments from various applications (Table 1). The generality of the approach enables > the sound and foundational derivation of those arguments from a parsimonious basis of refinement steps. This section > provides a complementary study of how the refinement approach and its derived ODE existence and liveness proof > rules are best implemented in practice. There are two canonical approaches for such an implementation: > 1. Implement the foundational refinement steps and let users build their own arguments using those steps, e.g., by > following the derivations and proofs from Sections 4–6. > 2. Implement the zoo of proof rules from Sections 4–6 directly and let users pick from from those rules for their > particular ODE liveness applications. > The low-level flexibility of Approach 1 is also its drawback in practice because users need to tediously reconstruct > high-level ODE liveness arguments from basic refinements for each proof. Approach 2 provides users with those > high-level arguments but limits users to proof rules that have been implemented, which squanders the generality of the > refinement approach. Moreover, users would still need to navigate the redundancies and tradeoffs among the zoo of > proof rules to select one that is best-suited for their proof. To account for these drawbacks, this section advocates for > a middle ground between those two extremes: implementations should provide users with the basic refinement steps, > bundled with a set of carefully curated, high-level proof rules (Section 7.1) and associated proof support (Section 7.2) > that help users navigate the common cases in their liveness proofs. > These ideas are put into practice through an implementation of ODE existence and liveness proof rules in KeY- > maera X [FMQ+ > 15]. Proof rules and proof support are implemented as tactics in KeYmaera X [FMBP17], which > are not soundness-critical. Such an arrangement allows for the implementation of useful ODE liveness proof rules > and their associated proof support with KeYmaera X’s sound kernel as a safeguard against implementation errors or > mistakes in their derivations and side conditions. This core design decision underlying KeYmaera X is discussed > elsewhere [FMQ+ > 15, FMBP17, Pla17a]. All of the ODE liveness examples in this article have been formally proved > in KeYmaera X (Section 7.2.3). By leveraging existing infrastructure in KeYmaera X, the implementation can also be > used as part of liveness proofs for hybrid systems. It is used for the liveness proofs of a case study involving a robot > model driving along circular arcs in the plane [BTM+ > 19]. > The basic refinements steps from Section 3 and the proof rules in Sections 4–6 are mostly straightforward to > implement by following their respective proofs. Thus, Sections 7.1 and 7.2 focus on a select number of new proof > rules and proof support that are beneficial in the implementation. For the sake of completeness, syntactic derivations > of all liveness proof rules presented in these sections are given in Appendix B.4. > An Axiomatic Approach to Existence and Liveness for Differential Equations 25 > 7.1 Liveness Proof Rules > Atomic differential variants dV< is a useful primitive proof rule to implement in KeYmaera X because many ODE > liveness proof rules, e.g., dVM > = ,SP, derive from it. From a practical perspective though, rule dV< as presented in Corol- > lary 12 still requires users to provide a choice of the constant ε(), e.g., the proof in Example 4 uses ε() = 1 > 2 . The > following slight rephrasing of dV< enables a more automated implementation. > Corollary 24 (Existential atomic differential variants [Pla10]). The following proof rule (where < is either ≥ or >) > is derivable in dL, where ε is a fresh variable and ODE x0 > = f(x) has provable global solutions. > dV∃ > < > Γ ∃ε > 0 ∀x ¬(p < 0) → > . > p ≥ ε >
> Γ hx0 = f(x)ip < 0 > Proof Sketch (Proof in Appendix B.4). Rule dV∃ > < is derived from dV< as a corollary. > Just like rule dV<, rule dV∃ > < requires a positive lower bound ε > 0 on the derivative of p along solutions. The > difference is that the premise of rule dV∃ > < is rephrased to ask a purely arithmetical question about the existence of a > suitable choice for ε. This can be decided automatically to save user effort in identifying ε, but such automation comes > at added computational cost because the decision procedure must find a suitable instance of ε for the ∃ quantifier > (or decide that none exist) rather than simply check a user-provided instance. Thus, the implementation gives users > control over the desired degree of automation in their proof by giving them the option of either invoking an arithmetic > decision procedure R on the premise of dV∃ > < or manually instantiating the existential quantifier with a specific term for > ε. > Another useful variation of rule dV< is its semialgebraic generalization, i.e., where the goal region is described > by a formula P formed from conjunctions and disjunctions of (in)equalities. Rules dVM > = ,SP provide examples of such > a generalization, but they are indirect generalizations because users must still identify an underlying (atomic) differ- > ential variant p as input when applying either rule. In contrast, the new semialgebraic generalization of dV< below > directly examines the syntactic structure of the goal region described by formula P. Its implementation is enabled > by KeYmaera X’s ODE invariance proving capabilities which are, in turn, based on dL’s complete axiomatization for > ODE invariants [PT20]. > Corollary 25 (Semialgebraic differential variants). Let b be a fresh variable, and term ε() be constant for ODE > x0 > = f(x), t0 > = 1. Let P be a semialgebraic formula in the following normal form [PT20, Eq 5], and GP be its > corresponding ε-progress formula (also in normal form): > P ≡ > M > _ > i=0 >  m(i) > ^ > j=0 > pij ≥ 0 ∧ > n(i) > ^ > j=0 > qij > 0 >  > GP ≡ > M > _ > i=0 >  m(i) > ^ > j=0 > pij − (b + ε()t) ≥ 0 ∧ > n(i) > ^ > j=0 > qij − (b + ε()t) ≥ 0 >  > The following proof rule is derivable in dL, where the ODE x0 > = f(x) has provable global solutions, and > . > (¬P)(∗) > , > . > (GP )(∗) > are semialgebraic progress formulas [PT20, Def. 6.4]10 > with respect to x0 > = f(x), t0 > = 1. > dV > ¬P, > . > (¬P)(∗) > , GP > . > (GP )(∗) > Γ, ε() > 0 hx0 = f(x)iP > dV∃ > Γ ∃ε > 0 ∀b ∀t ∀x ¬P ∧ > . > (¬P)(∗) > ∧ GP → > . > (GP )(∗) >
> Γ, ε() > 0 hx0 = f(x)iP > Proof Sketch (Proof in Appendix B.4). Rule dV∃ > is derived from dV similar to the derivation of rule dV∃ > < from dV<. > The derivation of dV is similar to rules dVΓ > <,dV<, but replaces the use of rule dI< with the complete ODE invariance > proof rule [PT20, Theorem 6.8]. The fresh variable b is used as a lower bound of the value of all polynomials pij, qij > appearing in the description of P along solutions of the ODE. > 10The arithmetic formula > . > P(∗) exactly characterizes that the ODE x0 = f(x) makes local progress in P for some nonzero duration, see prior > work [PT20, Def 6.4, Thm. 6.6]. The semialgebraic progress formula operator commutes with logical negation for semialgebraic formulas P, i.e., > the equivalence > . > (¬P)(∗) ↔ ¬( > . > P(∗)) is provable [PT20, Cor 6.7]. Hence, local progress into ¬P is equivalent to the solution locally staying away > from P for nonzero duration. > 26 Y. K. Tan and A. Platzer > The intuition behind rule dV is similar to rule dV<: as long as the solution has not yet reached the goal P, it grows > towards P at “rate” ε(). The technical challenge is how to formally phrase the “rate” of growth for a semialgebraic > formula P, which does not have a well-defined notion of derivative. Rule dV uses the ε-progress formula GP , together > with the semialgebraic progress formulas > . > (¬P)(∗) > , > . > (GP )(∗) > and dL’s completeness result for ODE invariants [PT20, > Theorem 6.8] for this purpose. These formulas give sufficient, although implicit, arithmetical conditions for proving > liveness for P. Rule dV∃ > rephrases dV with an arithmetical premise, similar to how dV∃ > < rephrases dV<, to give users > the added flexibility of choosing between invoking an automated decision procedure or manually instantiating the > existential quantifier for ε and reasoning about the resulting progress formulas. More explicit arithmetical premises > for dV,dV∃ > can be obtained by unfolding the definitions [PT20, Def. 6.4] of > . > (¬P)(∗) > , > . > (GP )(∗) > as exemplified below. Proof support obtains dependency groups by topologically sorting strongly connected components of the ODE variable-dependency graph. Affine groups can be handled automatically; nonlinear groups can need user-provided bounds, with an additional arithmetic method for an isolated univariate nonlinear group. Compatible invariant assumptions can strengthen box premises only when the antecedent ODE/domain permits at least the relevant trajectories. This is a controlled use of context: arbitrary initial-state assertions cannot be retained as if they were invariants. [Evidence: Q25, §7.2.1–7.2.2 dependency sorting, nonlinear user bounds and compatible invariant assumptions, PDF pp.27–30; Q3, §2.3 Lie derivatives, base proof rules and constant-context restrictions, PDF pp.5–6; complete exact passages in quotes.json.] Source (Q25, §7.2.1–7.2.2 dependency sorting, nonlinear user bounds and compatible invariant assumptions): > 7.2 Proof Support > Beyond enabling the sound implementation of complex ODE liveness proof rules such as those in Section 7.1, tactics > can also provide substantial proof support for users. > 28 Y. K. Tan and A. Platzer > x1 x4 > x5 > y4 > x2 > x6 > y3 > x3 > y2 > x7 > x8 > y1 > Figure 4: A dependency graph for the ODE (22) over the variables x1, . . . , x8. There is a directed edge xi −→ xj if > the RHS for x0 > j depends on free variable xi. Each dashed rectangle is a strongly connected component. Topologically > sorting these components (according to the order induced by the edges) yields one possible grouping of the variables > y1, . . . , y4 in dependency order. The vertices in y1 are not connected to those in y2, y3, y4, so the order between these > groups can be chosen arbitrarily. > 7.2.1 Automatic Dependency Ordering > Recall derived axiom GBEx from Corollary 10, which proves (global) existence of solutions for an ODE x0 > = f(x). > Users of the axiom must still identify precisely which dependency order (9) to use, and provide the sequence of > bounded sets Bi for each group of variables yi involving nonlinear ODEs. The canonical choice of such a dependency > order can be automatically produced by a tactic using a topological sort of the strongly connected components (SCCs)11 > of the dependency graph of the ODE. > More precisely, to prove global existence for an ODE x0 > = f(x), consider the dependency graph G where each > variable xi is a vertex and with a directed edge xi −→ xj if the RHS fj(x) for x0 > j depends on free variable xi. First, > compute the SCCs of G, and then topologically sort the SCCs. The groups of variables yi in dependency order can be > chosen according to the vertices in each SCC in topological order. An illustrative dependency graph with four SCCs > for the following 8-dimensional ODE is shown in Fig. 4. > x0 > 1 = x5, x0 > 2 = x3 + x2 > 6, x0 > 3 = x2 > 3, x0 > 4 = x1 + x2 > 3 + x2 > 6, x0 > 5 = x4, x0 > 6 = x2 > 2, x0 > 7 = x8, x0 > 8 = −x7 (22) > After finding the appropriate SCC-induced dependency order (as in Fig. 4), the global existence tactic can prove > global existence for the variable clusters yi that have affine dependencies within the cluster automatically. For example, > the SCC y4 ≡ {x1, x4, x5} has affine dependencies because the RHS of the ODEs x0 > 1, x0 > 4, x0 > 5 are affine in x1, x4, x5, > so the solution of ODE (22) is automatically proved to be global in those variables following the proof of Corollary 8. > The generated dependency order enables such a proof even though the RHS of x0 > 4 depends nonlinearly on variables > x3, x6 from earlier clusters. On the other hand, the SCC y3 ≡ {x2, x6} has nonlinear dependencies on x2, x6, so users > are prompted to input a bounded set (or a bound on derivatives) over variables x2, x6 in order to prove global existence > for those variables. This continues similarly for the SCCs y2 (nonlinear dependency) and y1 (affine dependency) until > global existence is proved for the full ODE. This semi-automated proof support minimizes the manual effort required > of the user in proving global existence by focusing their attention on the automatically identified nonlinear parts of the > ODE that may cause finite-time blowup of solutions. > To drive global existence proof automation further, key special cases can be added to the method described above. > One such special case for univariate ODEs is shown below. > Remark 2 (Global existence for univariate ODEs). Consider the case where a variable group has just one variable and > no incoming dependencies, e.g., y2 ≡ {x3} in Fig. 4 or αb (7). Global existence for such univariate polynomials ODEs > is decidable [GBC08], even if the RHS is highly nonlinear, because all of its solutions either asymptotically approach > a root of the polynomial RHS or diverge to infinity. > This result is best illustrated through the dynamical systems view of ODEs shown in Fig. 5 for the ODE x0 > = > x4 > − 5x2 > + 4. This example ODE has global solutions from all initial states satisfying x ≤ r4 because the solution > from all such states are globally attracted to one of the fixed points. Conversely, for all other initial conditions (x > r4), > the ODE blows up in finite time because the RHS is quartic in x. > 11A strongly connected component of a directed graph is a maximal subset of vertices that are pairwise connected by paths. > An Axiomatic Approach to Existence and Liveness for Differential Equations 29 > x > f(x) > r1 r2 r3 r4 > Figure 5: The univariate ODE x0 > = x4 > − 5x2 > + 4 is can be illustrated by plotting its RHS f(x) = x4 > − 5x2 > + 4 > (vertical axis) against x (horizontal axis). Points on the horizontal axis evolve towards the right (red arrow) when > f(x) ≥ 0 and towards the left (blue arrow) when f(x) ≤ 0. The fixed points r1, r2, r3, r4 are roots of the polynomial > RHS where f(x) = 0. These fixed points either attract trajectories (like r1, r3), or repel them (like r2, r4). All points > on the horizontal axis evolve asymptotically towards exactly one fixed point or approach ∞. > More generally, for a nonlinear univariate polynomial ODE x0 > = f(x) and initial assumptions Γ, it suffices to > check validity of the following arithmetical sequent to decide global existence: > Γ ∃r f(r) = 0 ∧ (f(x) ≥ 0 ∧ r ≥ x > | {z } > a > ∨ f(x) ≤ 0 ∧ r ≤ x > | {z } > b > ) >
> The existentially quantified variable r corresponds to a fixed point (a root with f(r) = 0). Disjunct a checks > whether the solution approaches r from the left, e.g., the points between r2 and r3 in Fig. 5 approach r3 from the > left. Alternatively, disjunct b checks whether the solution approaches r from the right. The implementation checks > validity of this sequent for univariate nonlinear ODEs and then proves global existence using BDGh·i because the > solution is provably trapped between the initial value of x and the fixed point r. > 7.2.2 Differential Cuts for Liveness Proofs > Differential cuts dC provide a convenient way to structure and stage safety proofs for ODEs in dL. An in-depth > discussion is available elsewhere [Pla18], but the idea is illustrated by the following derivation: > Γ [x0 > = f(x) & Q]C1 > . . . > Q ∧ C1 ∧ C2 ∧ · · · ∧ Cn P > dW > . > . > . > dC > Γ [x0 > = f(x) & Q ∧ C1 ∧ C2]P > dC > Γ [x0 > = f(x) & Q ∧ C1]P > dC > Γ [x0 > = f(x) & Q]P > The derivation uses a sequence of differential cut steps to progressively add the cuts C1, C2, . . . , Cn to the domain > constraint. A final dW step completes the proof when the postcondition P is already implied by the (now strengthened) > domain constraint. Intuitively, the differential cuts are akin to dynamical lemmas in this derivation. For example, by > proving the premise Γ [x0 > = f(x) & Q]C1, the cut C1 can now be assumed in the domain constraints of subsequent > steps. Just like the cut rule from sequent calculus, differential cuts dC allow safety proofs for ODEs to be staged > through a sequence of lemmas about those ODEs. > For proof modularity and maintainability, it is desirable to enable a similar staging for ODE liveness proofs. > Concretely, suppose that the formula [x0 > = f(x) & Q]C has been proved as a cut: > Γ [x0 > = f(x) & Q]C · · · > cut > Γ hx0 > = f(x) & QiP > The challenge is how to (soundly) use this lemma in subsequent derivation steps (shown as · · · ). Naı̈vely replacing > Q with Q ∧ C in the domain constraint of the succedent does not work. This may even do more harm than good > because the resulting ODE liveness question becomes more difficult (Section 6). > 30 Y. K. Tan and A. Platzer > The refinement-based approach to ODE liveness provides a natural answer: recall that each refinement step in the > chain (6) requires the user to prove an additional box modality formula. The insight is that, for these box modality > formulas, any relevant lemmas that have been proved can be soundly added to the domain constraint. For example, > suppose that rule Kh&i is used to continue the proof after the cut. The left premise of Kh&i can now be strengthened > to include C in its domain constraint: > Γ, [x0 > = f(x) & Q]C [x0 > = f(x) & Q ∧ ¬P ∧ C]¬G > dC > Γ, [x0 > = f(x) & Q]C [x0 > = f(x) & Q ∧ ¬P]¬G Γ, [x0 > = f(x) & Q]C hx0 > = f(x) & QiG > Kh&i > Γ, [x0 > = f(x) & Q]C hx0 > = f(x) & QiP > Users could manually track and apply lemmas using dC as shown above, but this becomes tedious in larger live- > ness proofs. The implementation instead provides users with tactics that automatically search the antecedents Γ for > compatible assumptions that can be used to strengthen the domain constraints. These tactics also use a form of ODE > unification when determining compatibility. More precisely, consider the sequent Γ [x0 > = f(x) & Q]P, which may > arise as a box refinement during a liveness proof. An antecedent formula [y0 > = g(y) & R]C in Γ is called a compatible > assumption for the succedent [x0 > = f(x) & Q]P if: > 1. The set of ODEs y0 > = g(y) is a subset of the set of ODEs x0 > = f(x). This is order-agnostic, e.g., the ODE > u0 > = v, v0 > = u is a subset of the ODE v0 > = u, u0 > = v, w0 > = u + v + w. > 2. The domain constraint Q implies domain constraint R, i.e., Q → R is valid. > Under these conditions, the ODE y0 > = g(y) & R permits more trajectories than the ODE x0 > = f(x) & Q. Thus, > if formula C is always true along solutions of the former ODE, then it also stays true along solutions of the latter. > Combining compatible assumptions with implementations of liveness proof rules yields turbo-charged versions of > those rules. For example, in rule dV∃ > <, instead of simply assuming the negation of the postcondition (¬(p < 0) → · · · ) > when determining the existence of suitable ε, all postconditions of compatible assumptions can be assumed, e.g., with > ¬(p < 0) ∧ C → · · · for postcondition C of a compatible assumption. The authors report approximately 155 changed soundness-critical code lines and approximately 1,500 tactic lines. The tactic implementation is untrusted relative to the KeYmaera X kernel. They report formally proving the article’s examples and external ODE cases, including liveness from a robot circular-arc model. This record did not run those proofs or examine the implementation’s actual trusted base. A kernel-checked result remains an author-reported evaluation result here; the paper’s printed derivations and the implemented proofs are separate evidence. [Evidence: Q1, §1 complete surveyed corrections, contributions and trust/implementation claims, PDF pp.1–3; Q26, §7.2.3 complete metrics, hardware, paired-proof discussion and Table2, PDF pp.30–31; Q27, §7.2.3 complete trusted-kernel/untrusted-tactics and external-case discussion, PDF pp.31–31; complete exact passages in quotes.json.] Source (Q1, §1 complete surveyed corrections, contributions and trust/implementation claims): > 2020 > 2 Y. K. Tan and A. Platzer > Table 1: Surveyed ODE liveness arguments with highlighting in blue for soundness-critical corrections identified in > this article. The applications (and corrections, if any) for each surveyed argument is briefly described here. The > referenced corollaries are corresponding derived proof rules with details of the corrections. > Application Without Domain Constraints With Domain Constraints > Hybrid systems verification [Pla10] OK (Cor. 12) if open/closed, initially false (Cor. 18) > Auto. ODE verification [PR05, PR07] [PR07, Rem. 3.6] is incorrect if conditions checked globally (Cor. 23) > Finding basin of attraction [RS10] if compact (Cor. 17) if compact (Cor. 20) > Staging set ODE liveness proofs [SJ15] OK (Cor. 15) OK (Cor. 21) > Switching logic synthesis [TT10] if global solutions (Cor. 13) if global solutions (Cor. 19) > by several difficulties: i) solutions of ODEs may converge towards a goal without ever reaching it, ii) solutions of > nonlinear ODEs may blow up in finite time leaving insufficient time for the desired goal to be reached, and iii) the goal > may be reachable but only by (illegally) leaving the evolution domain constraint. In contrast, invariance properties > for ODEs are better understood [Pla10, GP14, LZZ11] and have a complete dL axiomatization [PT20]. Motivated by > the aforementioned difficulties, this article presents dL axioms enabling systematic, step-by-step refinement of ODE > liveness properties, where each step is justified using an ODE invariance property. This refinement approach is a > powerful framework for understanding ODE liveness arguments because it brings the full deductive power of dL’s > ODE invariance proof rules to bear on liveness proofs. Using invariance (or safety) properties to deduce liveness is > a well-known proof technique for (discrete) concurrent systems [MP92, OL82]. This article shows that those ideas > work just as well in the continuous setting—as long as the aforementioned difficulties are appropriately handled. > To demonstrate the applicability of the approach, this article surveys several arguments from the literature and > derives them all as (corrected) dL proof rules, see Table 1. This logical presentation has two key benefits: > • The proof rules are syntactically derived from sound axioms of dL, which guarantees their correctness. Many > of the surveyed arguments contain subtle soundness errors (Table 1, middle and right). These errors do not > diminish the surveyed work. Rather, they emphasize the need for an axiomatic, uniform way of presenting and > analyzing ODE liveness arguments instead of relying on ad hoc approaches. > • The approach identifies common refinement steps that form a basis for the surveyed liveness arguments drawn > from various applications (Table 1, left). This library of building blocks enables sound development and jus- > tification of new ODE liveness proof rules, e.g., by generalizing individual refinement steps or by exploring > different combinations of those steps. Corollaries 14, 16, and 22 are examples of new ODE liveness proof rules > that can be derived and justified from the uniform approach that this article follows. > This article extends the authors’ earlier conference version [TP19]. The key new insight is that all of the aforemen- > tioned liveness arguments (Table 1) are based on reducing liveness properties of ODEs to assumptions about sufficient > existence duration for their solutions. In fact, many of those arguments become significantly simpler (and sound) when > the ODEs of concern are assumed to have global solutions, i.e., they do not blow up in finite time. It is reasonable > and commonplace to make such an assumption for the continuous dynamics in models of CPSs [Alu15, Section 6]. > After all, mechanical systems do not simply cease to exist after a short time! An example from control theory is Lya- > punov stability which guarantees global solutions near stable equilibria [Kha92, Definition 4.1][HC08, Theorem 3.1]. > Control systems are designed to always operate near stable equilibria and so always have global solutions. Logically > though, making an a priori assumption of global existence for ODEs means that the correctness of any subsequent > verification results for the ODEs and hybrid system models are conditional on an unproved existence duration hypoth- > esis. While global existence is known to hold for linear systems, even the simplest nonlinear ODEs (see Section 4) > fail to meet the hypothesis without further assumptions. This article therefore adopts the view that (global) existence > should be proved rather than assumed for the continuous dynamics in hybrid systems. > The new contributions of this article beyond the authors’ earlier conference version [TP19] are: > • Section 4 presents deductive dL proofs of global existence for ODE solutions. Together with the liveness proofs > of Sections 5 and 6, this enables unconditional proofs of ODE liveness properties entirely within the uniform > An Axiomatic Approach to Existence and Liveness for Differential Equations 3 > dL refinement framework without existence presuppositions. > • Section 7 shows how to apply the insights from Sections 4–6 in practice. This includes: i) the design of proof > rules that are practically useful and well-suited for implementation (Section 7.1) and ii) the design of proof > support to aid users in existence and liveness proofs (Section 7.2). > The practical insights of Section 7 are drawn from an implementation of ODE liveness proof rules in the KeY- > maera X theorem prover for hybrid systems [FMQ+ > 15]. The unconditional liveness proofs enabled by Sections 4–6 fit > particularly well with an implementation in KeYmaera X because axiomatic refinement closely mirrors KeYmaera X’s > design principles. KeYmaera X implements dL’s uniform substitution calculus [Pla17a] and it is designed to mini- > mize the soundness-critical code that has to be trusted in order to guarantee its verification results. On top of this > soundness-critical core, KeYmaera X’s non-soundness-critical tactics framework [FMBP17] adds support and au- > tomation for proofs. Liveness proofs are similarly based on a series of small refinement steps which are, in turn, > implemented as (untrusted) tactics based on a small basis of derived refinement axioms. More complicated liveness > arguments, such as those from Table 1 or from new user insights, are implemented by piecing those tactics together > using tactic combinators [FMBP17]. The implementation required minor changes to ≈155 lines of soundness-critical > code in KeYmaera X, while the remaining ≈1500 lines implement ODE existence and liveness proof rules as tactics. > These additions suffice to prove all of the examples in this article and in ODE models elsewhere [SJ15, BTM+ > 19] > (Section 7.2.3). > Throughout this article, core dL axioms underlying the refinement approach are presented as lemmas, which are > summarized and proved in Appendix A. Existence and liveness proof rules that are derived syntactically from those ax- > ioms, e.g., Table 1, are listed as corollaries and their derivations are given in Appendix B. Counterexamples explaining > the soundness errors in Table 1 are given in Appendix C. Table 2 has 11 rows: six manual/automatic pairs for this article’s examples, three external Sogokon/Jackson cases, and two robot properties. That is 17 proof configurations, rather than 17 independent application scenarios. Metrics are manual tactic steps, internal kernel steps, and execution seconds averaged over five runs on Ubuntu 18.04, a 2.70 GHz Intel Core i7-6820HQ and 16 GB memory. Example 8 drops from 28 manual tactic steps to one automated step, while time rises from 0.575 to 0.990 seconds and kernel steps from 1,747 to 2,571. Automation is slower in four of the six pairs; it is faster in Examples 2 and 4. This measures proof-execution cost and user tactic counts, not user-study time, LLM success or broad scalability. No independent reproduction is claimed. [Evidence: Q26, §7.2.3 complete metrics, hardware, paired-proof discussion and Table2, PDF pp.30–31; Q27, §7.2.3 complete trusted-kernel/untrusted-tactics and external-case discussion, PDF pp.31–31; complete exact passages in quotes.json.] Source (Q26, §7.2.3 complete metrics, hardware, paired-proof discussion and Table2): > 7.2.3 Microbenchmarks > The KeYmaera X implementation is used to formally prove all of the ODE liveness examples from this article and > elsewhere [SJ15, BTM+ > 19]. Table 2 provides a summary of statistics from these proofs: “Tactic Steps” counts the > number of (manual) user proof steps; “Kernel Steps” counts the number of internal steps taken by the soundness- > critical KeYmaera X kernel; and “Proof Time” measures the time taken (in seconds, averaged over 5 runs, rounded > to 3 decimal places) for the proof to execute in KeYmaera X. All experiments were run on an Ubuntu 18.04 laptop > with a 2.70 GHz Intel Core i7-6820HQ CPU and 16GB memory. None of the proofs have been optimized to favor > any specific metric. The specific timings and proof steps are naturally subject to change on different hardware and > as various aspects of the KeYmaera X theorem prover are improved. Nevertheless, the key takeaways from these > microbenchmarks remain broadly applicable. > (M)anual and (A)utomatic Proofs. The implementation provides users with powerful proof support but also ex- > poses low-level primitives for users who prefer more fine-grained control over (parts of) their proofs. Both types of > proofs are shown for this article’s examples in Table 2. Proofs that heavily exploit the proof support and automation are > more convenient for users and require fewer manual tactic invocations. This gap is most pronounced for Example 8, > where the 28 step manual proof requires just one automated dV step. > On the other hand, the automated proofs are slower than their manual counterparts on four out of six examples. > Most of this overhead arises when there is significant proof search in the automation. In particular, the automated > proof of Example 1 is significantly slower and requires almost six times more kernel steps compared to its manual > counterpart. This gap arises because the automated proof uses the decision procedure for univariate global existence > outlined in Remark 2 while the manual proof uses the direct argument in Example 1. However, the latter proof required > user insight about the physical system. This illustrates the need for a flexible implementation that lets users navigate > the convenience and efficiency tradeoff according to their needs and proof insights. > An Axiomatic Approach to Existence and Liveness for Differential Equations 31 > Table 2: Proof statistics for ODE existence and liveness properties proved using the implementation. For this article’s > Examples 1–8, two proofs are presented: (M)anual proofs closely follow the pen-and-paper derivations shown in > this article, while (A)utomatic proofs make extensive use of the implemented proof support. The cells in bold font > indicate lower (more desirable) values. The stronger ODE liveness property proved in Example 7 implies those from > Examples 5 and 6. Examples 11, 12 and 15 refer to the correspondingly numbered examples from Sogokon and > Jackson [SJ15]. > Liveness Property > Tactic Steps Kernel Steps Proof Time (s) > (M) (A) (M) (A) (M) (A) > Example 1 7 3 2040 12156 1.778 3.716 > Example 2 8 2 962 898 0.220 0.203 > Example 3 7 3 1562 1580 0.551 0.759 > Example 4 29 5 3958 3501 3.286 3.034 > Example 7 (Examples 5 and 6) 50 20 5549 6141 1.714 1.952 > Example 8 28 1 1747 2571 0.575 0.990 > [SJ15] Example 11 - 50 - 11272 - 9.090 > [SJ15] Example 12 - 19 - 4818 - 1.388 > [SJ15] Example 15 - 1 - 4781 - 1.730 > [BTM+ > 19] Goal Position Reachability - 34 - 8159 - 2.182 > [BTM+ > 19] Velocity Bounds Reachability - 37 - 10521 - 3.042 > Finally, the automated proofs are in fact faster for Examples 2 and 4, which both involve linear ODEs. The > speedups here can be attributed to the well-tuned implementation of global existence proofs for affine systems and to > the use of rule dV∃ > < for the latter example. Thus, the aforementioned tradeoff can be further skewed towards favoring > user convenience by tuning the implemented automation. Appendix C supplies five concrete failure cases. Counterexample 9 adds an irrelevant-looking coordinate u′=u², u(0)=1, to v′=1, v(0)=0: u blows up at time 1, preventing the target v=2 despite constant progress of v. Counterexample 10 begins outside domain u≤1, making the diamond false even with target u≥0 initially true. Counterexample 11 demands u>1 while staying in u≤1. Counterexample 12 uses u′=0,v′=1 from (0,1), closed unit-disk domain and open-disk target; coincident boundaries make a surveyed boundary condition vacuous, and the solution exits immediately. Counterexample 13 uses a bounded open domain with the slice v=0 removed; the upward trajectory reaches the target only after crossing that forbidden slice. These are source-supplied examples against the specific earlier statements quoted in the report, not new independent checks of those original publications. [Evidence: Q35, AppendixC.1 complete Counterexample9 and duration explanation, PDF pp.55–56; Q36, AppendixC.2 complete unsound earlier variant rule and Counterexamples10–11, PDF pp.56–56; Q37, AppendixC.2 complete quoted Conjecture30 and Counterexamples12–13, PDF pp.57–57; complete exact passages in quotes.json.] Source (Q35, AppendixC.1 complete Counterexample9 and duration explanation): > C Counterexamples > This appendix gives explicit counterexamples to illustrate the soundness errors identified in Sections 5 and 6. > 56 Y. K. Tan and A. Platzer > C.1 Finite-Time Blow Up > The soundness errors identified in Section 5 all arise because of incorrect handling of the fact that solutions may blow > up in finite time. This phenomenon is studied in detail in Section 4, and it is illustrated by αn (2), see Fig. 1, or αb (7), > see Example 1. The following is a counterexample for the original presentation of dV= (and dVM > = ,dV=&,dVM > = &) [TT10]. > Similar counterexamples can be constructed for [PR07, Remark 3.6] and for the original presentation of SLyap,SLyap& [RS10]. > Counterexample 9. Consider rule dV= without the restriction that the ODE has provable global solutions. This unre- > stricted rule, denoted dV=, is unsound as shown by the following derivation using it with ε()=1: > ∗ > R > v − 2 < 0 1 ≥ 1 > dV=v − 2 ≤ 0 hu0 > = u2 > , v0 > = 1iv − 2 = 0 > The conclusion of this derivation is not valid. Consider the initial state ω with values ω(u) = 1 and ω(v) = 0. > The explicit solution of the ODE from ω is given by u(t) = 1 > 1−t , v(t) = t for t ∈ [0, 1). This solution does not > exist beyond the time interval [0, 1) because the u-coordinate asymptotically approaches ∞, i.e., blows up, as time > approaches t = 1. It is impossible to reach a state satisfying v − 2 = 0 from ω along this solution since at least 2 time > units are required. > This counterexample further illustrates the difficulty in handling nonlinear ODEs. Neither the precondition (v − > 2 ≤ 0) nor postcondition (v − 2 = 0) mention the variable u, and the ODEs u0 > = u2 > , v0 > = 1 do not depend > on variables v, u respectively, so it is tempting to disregard the variable u entirely. Indeed, the liveness property > v − 2 ≤ 0 → hv0 > = 1iv − 2 = 0 is valid. Yet, for liveness questions about the (original) ODE, u0 > = u2 Manual printed-formula check: §4 gives v′=−v² the expression v(t)=v0/(v0+t), calls v0 its initial value, and gives negative-state blow-up time −v0. The printed expression has v(0)=1 rather than arbitrary v0. Direct substitution instead gives v(t)=v0/(1+v0t), with negative-state horizon −1/v0. The source’s classification by sign remains correct. Nearby prose calls a squared-norm derivative non-negative while displaying a ≤0 premise and concluding the norm is non-increasing; the adjective should be non-positive. Footnote 8 calls 2/3 a lower bound on escape time where the positive progress lower bound supplies an upper time bound. These are manually checked illustration/prose defects, not counterexamples to the formal existence or variant rules. [Evidence: Q7, §4–4.1 finite-time blow-up example, clock existence and Lemma5, PDF pp.10–10; Q8, §4.1 complete Example1 proof and derivative-sign prose, PDF pp.11–11; Q17, §5.2 complete Example5, Corollary17 and §6 motivating/domain example including footnote8, PDF pp.19–21; complete exact passages in quotes.json.] Manual derivation-diagram check: Appendix B.4’s Corollary 24 diagram and part of Corollary 25’s diagram print an evolution-domain Q absent from the main unconstrained rules and unsupported by their premises. An arbitrary-Q conclusion is false: choose Q=false, x′=1, target x≥0, initial x=−1 and derivative bound 1; no domain-respecting segment exists. Removing the stray Q matches the main rules, other derivation steps and accompanying prose. This diagnoses the printed diagrams only; it does not demonstrate an unsound main unconstrained rule or an error in the implemented kernel/tactics. [Evidence: Q22, §7–7.1 implementation overview, existential and semialgebraic variants, PDF pp.24–26; Q32, AppendixB.4 complete Corollary24 derivation, including unsupported printed domain Q, PDF pp.54–54; Q33, AppendixB.4 complete Corollary25 derivation, including printed domain Q, PDF pp.54–55; complete exact passages in quotes.json.] For the requested topic, the main transfer is explicit proof obligations: generated liveness arguments must account for enough execution duration, domain membership at endpoints, progress bounded away from zero, and the difference between search code and its trusted checker. Reader proposals, not author results: LLM evaluation could use the five Appendix C cases and require a correction that preserves the original property. TLA+ finite abstractions or Verus implementations would need a separate refinement linking discrete code to the real ODE model. The article reports no Verus, verified-Rust, TLA+ or LLM experiment, and it does not settle concurrent distributed liveness. [Evidence: Q2, §2.1–2.2 syntax, standing ODE model and modal semantics, PDF pp.3–5; Q35, AppendixC.1 complete Counterexample9 and duration explanation, PDF pp.55–56; Q36, AppendixC.2 complete unsound earlier variant rule and Counterexamples10–11, PDF pp.56–56; Q37, AppendixC.2 complete quoted Conjecture30 and Counterexamples12–13, PDF pp.57–57; Q27, §7.2.3 complete trusted-kernel/untrusted-tactics and external-case discussion, PDF pp.31–31; complete exact passages in quotes.json.]
  • limits: Autonomous polynomial real ODEs, unique local trajectories, rational-polynomial syntax, first-order-real-arithmetic domain/target, finite diamond reachability with domain on all endpoints. Rule-specific existence, derivative, topology, compactness, fresh-variable and constant-context assumptions. No independent execution or broad scalability/user-study/LLM evaluation. Completeness only conditional global-existence representability, not all liveness. Manual printed solution/sign/time-bound and AppendixB.4 stray-Q concerns do not show main-rule/kernel unsoundness. Prior papers cited by source not independently reviewed.
  • how much was read: most of it read
  • source
  • record id: an-axiomatic-approach-to-2020
• Aneris (2020)
  • title: Aneris: A Mechanised Logic for Modular Reasoning about Distributed Systems
  • what: Aneris is a Coq-mechanized higher-order distributed concurrent separation logic for modular specification, partial correctness and refinement; the repository contains examples and case studies.
  • number: load balancer impl/spec/proof 18/78/95 lines
  • number: two-phase commit: 18 and 11 impl lines, 181 joint spec lines, 265 and 280 proof lines
  • number: replicated logging plus commit: 1,272 lines
  • limits: README-level account; publications linked from the README are separate sources.
  • how much was read: most of it read
  • source; notes: papers
  • record id: aneris-2020
• APKeep: Realtime Network Verification for Real Networks (2020)
  • what: APKeep incrementally checks a symbolic model of network forwarding, filtering and header rewriting. Its Port-Predicate Map separates logical functions and their applications, and maintains Boolean packet equivalence classes by splitting only for changed behavior and merging equal port sets. An informal inductive proof establishes a minimum partition for the basic immediate-merge algorithm; experiments measure update-plus-loop-check cost, partition sizes, memory, link-failure queries and synthetic NAT updates. Records the precise EC equivalence relation, rule priority/hit analysis, split/transfer/merge algorithm, rewrite closure, delayed merging and separate partition optimizations, invariant and policy traversal, vendor PBR case, all dataset and comparison tables, partial-run counting and synthesized workloads. Distinguishes the basic minimum-partition theorem from optimized execution and exposes printed formula/pseudocode/data inconsistencies without inferring implementation faults.
  • limits: §2.1: Every element sends each header to exactly one logical action port. Headers in an EC must select the same port at every element, even elements the header never reaches. This partition can be finer than physical device behavior or reachable paths. An element topology node is an application of a logical element; one ACL applied twice has two nodes but one shared model update. §2.1/§3.2/Appendix A: Disjoint ECs cover all headers. Minimum partition additionally requires equal port vectors to imply same EC. Appendix A uses informal induction over split/transfer/merge and rule updates; it is not machine checked and does not prove fidelity of parsers, Java code, device behavior or every invariant checker. §3.2/Algorithm 1: Rule hit subtracts higher-priority matches; identify only action changes, including default. Pseudocode uses strict priority comparisons and assumes a well-defined priority order. Rule deletion omitted; modification represented by delete plus insert. No detailed argument for atomic multi-device update semantics. §3.2/Algorithm 2: Split predicates on partial overlap; copy port sets, transfer changed part, merge equal port sets and propagate transferred-set D. BDDs encode arbitrary sets rather than header rectangles. Equality is model forwarding/action equality, not observational equivalence of stateful network executions. §3.4/Algorithm 3: Rewriting to constants existentially forgets overwritten bits then constrains new values. Maintain pre-to-post predicate table; recursively split images until rewrites are representable by current predicates. This closure can require additional splits beyond the simple port-vector partition. Appendix A does not explicitly extend its minimum-partition induction to rewrite closure. §3.4 Eq.(2), visually confirmed: printed existential quantification joins true/false cofactors with conjunction. Existential elimination mathematically requires disjunction. Treat as a printed formula error, not evidence that JDD implementation uses wrong operation. Algorithm 3 calls UpdateRW although prose calls this Algorithm 2; rewrite-table notation abbreviates rule association. §3.5: Delayed merging records candidates and merges only when predicate count exceeds 500 by default. The immediate-minimum theorem does not literally describe states between these merges. Forwarding and ACL partitions are updated separately; loop validation checks a nonempty conjunction of one predicate from each, avoiding cross-product false positives. Minimum per component does not imply a globally minimum joint partition. §3.3/Appendix B: Incremental delta forwarding graph uses transferred predicates; loop means revisiting a device without modification, blackhole means no forwarding rule. Intentional ACL denial is not this blackhole definition. Printed traversal remembers graph nodes; device-versus-element, topology applications, ingress reachability and rewrite-aware history are abstracted rather than fully formalized. Appendix B/Algorithms 4–5: Construct graph from ports holding D, with virtual default node. Traverse from updated element applications, carrying predicate intersections/history. Algorithm 5 line 4 passes undefined predicates after initializing pset; default-edge check precedes edge intersection, apparently allowing an empty-intersection edge to flag. These are presentation concerns; no executable bug reproduced. §3.3/§5.1: BDD match plus regular-expression path policies/automata described, but implementation reports only loop/blackhole invariant checker and what-if link analyzer. No policy-checker experiment or formal soundness/completeness theorem for the full checker. §4: Vendor PBR redirect can be modeled by cascading classifiers and connecting permit to redirect, deny to ordinary forwarding. Extra symbolic length/time fields can encode static conditions. Traffic statistics, mirroring, rate limiting and congestion avoidance are explicitly outside the model; stateful middlebox semantics not evaluated. §5.1: Around 5K Java/JDD lines; configuration parsers for three vendors, update parser for one, JSON intermediate form. Linux 3GHz Core i5/32GB. Microbenchmarks check loops after each update; threshold is 24h timeout or 32GB overflow. No end-to-end live-device detection-latency measurement. §5.1/Table 1: First three datasets generated using ONOS/Delta-net, not all production traces. Last five derive sequences from snapshots: insert ACL rules round-robin, then FIB rules round-robin, then delete in reverse. Purdue forwarding rules synthesized with shortest paths because original source has only ACLs. Such orders and synthesized routes limit workload representativeness. §5.1: AP Verifier modified for updates/loop checker; NetPlumber translated transfer-function rules with defaults preinserted and source per device. VeriFlow splits port ranges into prefixes. Delta-netMF is authors’ C++ multi-field extension using a multi-layer tree and explicitly may not be best extension. Java/C/C++ implementation differences and adaptations confound isolated algorithm comparisons. §5.2/Table 2: APKeep averages 6–127µs across eight datasets; at least 91.7% are under 250µs, rather than every update meeting a hard real-time bound. Pure-IP Delta-netMF often faster; disabling merges can improve small-partition workloads but costs on 4Switch/multi-field workloads. No worst-case guarantee derived from CDF. §5.3/Table 3/Figure 6: Failing methods’ Purdue EC counts show first 3,000 updates only. Stanford/Purdue Delta-netMF EC counts obtained by running creation-related functions despite full verifier failing. Counts/reduction percentages are not all completed end-to-end verification runs. §5.4/Table 4: Delta-net what-if numbers reused from prior paper on 3.47GHz Xeon; APKeep uses this paper’s 3GHz i5. Claimed 17×/93× loop-inclusive ratios are cross-machine measurements, not controlled same-host experiments. §5.5/Figure 7: Synthetic NAT rules choose edge-port predicates/prefixes and translate addresses; appended after forwarding rules. Prose names Stanford* and Purdue*, while Figure 7 labels Stanford* and Internet2. Prose says 0–20 NATs with 25 rules each yield 0–1000 rules, whereas arithmetic yields 0–500. Preserve ambiguity rather than silently assigning dataset or count. §7: Bootstrap fetches full state once, then requires sufficiently frequent updates. Asynchronously collected state can produce false alarms. Suspect-then-recheck time window is proposed with detailed design left to future work; no demonstrated solution for lost/reordered updates, device model fidelity or consistent global snapshot. No Verus, verified Rust, TLA+ or LLM proof/specification experiment. Contribution is symbolic network modeling, partition argument and empirical checking performance, not verified implementation or distributed protocol correctness. No artifact executed.
  • how much was read: most of it read
  • source
  • record id: apkeep-realtime-network-verification-2020
• Armada (2020)
  • title: Armada: Low-Effort Verification of High-Performance Concurrent Programs
  • what: Armada is a language and tool for formally verifying high-performance concurrent programs using SMT automation, rely-guarantee, TSO elimination, reduction and alias analysis. Its README describes four case studies and build commands.
  • number: 4 concurrent case studies
  • number: barrier: 57 executable SLOC; second layer 35 annotations, 114 lemma lines, 46,404 generated proof lines
  • number: four cases: barrier, distinct-pointer reorder, MCS lock, liblfds queue
  • number: about 6 person-days to write the proof levels for one queue, mostly finding the inductive invariant (§6.4, PDF p.12)
  • limits: README describes a PLDI paper and commands; no local build was run.
  • how much was read: most of it read
  • source; notes: Armada: Low-Effort Verification of High-Performance Concurrent Program
  • record id: armada-2020
• AVR (2020)
  • title: AVR: Abstractly Verifying Reachability.
  • what: Presents AVR, a push-button word-level model checker for source-level transition systems. It combines syntax-guided abstraction/refinement with word-level IC3, SMT backends, BMC and interpolation, and emits independently checkable inductive-invariant certificates or BTOR2 counterexample witnesses. The paper details AVR architecture and interfaces (Verilog/Yosys, VMT/MathSAT, BTOR2/Btor2Tools), IC3+SA abstraction atoms, incremental refinement and caching, data abstraction, property-directed splitting, interpolation and extract/concat handling. Proof certificates are SMT-LIB inductive invariants externally checked by Z3/Yices; failed properties produce simulator-checkable BTOR2 traces. A multi-engine proof race runs configurations in parallel. Case studies cover patched Apache buffer overflows, Needham–Schroeder authentication, and finite-to-unbounded distributed-protocol invariant generalization.
  • number: less than one minute for each Apache case
  • number: 3 initiators and 3 responders in Needham–Schroeder instance
  • number: HWMCC 2019 single-bit-vector track
  • limits: Targets primarily safety properties over quantifier-free bit-vectors, arrays, uninterpreted functions and linear integer arithmetic. Word-level abstraction can be ineffective when bit-precise data dominates; current support is limited for nonlinear arithmetic, floating point, quantifiers, liveness and fairness. Distributed-protocol generalization is preliminary and requires human/generalization reasoning beyond finite AVR runs. Certificates rely on an external SMT checker and traces on a witness simulator.
  • how much was read: most of it read
  • source
  • record id: avr-2020
• Cloud spatial model checking (2020)
  • title: Cloud Deployment Tradeoffs for the Analysis of Spatially-Distributed Systems of Internet-of-Things
  • what: Builds a runtime spatial-verification architecture for resource-constrained IoT systems. Trajectory-derived accessibility graphs become closure spaces evaluated with Spatial Logic for Closure Spaces (SLCS); model checking is packaged as microservices and deployed on VMs, containers, AWS Lambda FaaS, or a hybrid. The paper explains how points of interest and trajectories induce a quasi-discrete closure model, how SLCS closure/surround operators express bike-sharing requirements, and how services maintain model/state updates. It compares monolithic VM, containerized ECS, FaaS and hybrid load balancing, using a Beijing taxi trace and a 30-second SLA. A mobile-device baseline averages 99 seconds per invocation. Lambda stays near 12 seconds across load rates; monolith is 9–12 seconds through 20× load but violates SLA at higher peaks; containers time out at 20× or more due to scale-up; hybrid splits 65–35% monolith/FaaS at 60× and has about 20 seconds median calls, with load-balancer overhead under 300 ms.
  • number: 15,456 propositions / 5,152 nodes
  • number: 30-second SLA
  • number: 99 seconds mobile invocation
  • number: 536 requests in peak experiment
  • limits: The spatial model is finite, graph-derived and qualitative; only three properties and one model checker are evaluated. Cloud resources are assumed available, and cost/SLA conclusions depend on AWS instance sizes, 30-second SLA choice, taxi workload shape and preallocation. The hybrid is a proof of concept with tunable threshold/cache policies. The architecture centralizes verification and can suffer network latency, privacy and single-point-of-failure issues; edge decentralization and quantitative/metric properties are future work.
  • how much was read: most of it read
  • record id: cloud-spatial-model-checking-2020
• Context-bounded multithreaded liveness (2020)
  • title: Context-Bounded Verification of Liveness Properties for Multithreaded Shared-Memory Programs
  • what: Proves decidability and complexity results for termination, fair non-termination and fair starvation of dynamically spawning recursive threads under a fixed context-switch bound, introducing VASS with balloons as the key intermediate model. The paper formalizes Dynamic Networks of Concurrent Pushdown Systems (DCPS), thread identities, scheduler swaps/resumptions and fairness. Ordinary termination reduces through downward closures to VASS non-termination, yielding the 2EXPSPACE result. Fairness is not downward-closure preserving, so VASS with balloons stores semi-linear multisets of future spawns; progressive runs and a shallow-run theorem reduce DCPS fair behavior to VASSB reachability, then to ordinary VASS reachability. A separate Ramsey/pumping and consistency construction reduces starvation to fair termination. The paper gives proof machinery rather than an implementation or empirical benchmark.
  • number: For K ≥ 1, K-bounded non-termination is 2EXPSPACE-complete
  • number: For every K, fair non-termination and fair starvation are decidable
  • number: Fair decision procedures are non-elementary, already for K=0 via VASS reachability
  • number: VASSB has decidable progressive runs and every progressive run has a shallow counterpart
  • limits: The bound K is fixed per decision instance and fairness means every thread ready infinitely often is eventually scheduled (with identity-equivalence subtleties handled by an angelic scheduler argument). Results concern the DCPS model: finite global state, pushdown stacks, shared global control and restricted scheduler rules. Fair problems are decidable but non-elementary; unbounded context switching remains outside the decidability claim.
  • how much was read: most of it read
  • source
  • record id: context-bounded-multithreaded-liveness-2020
• Coq-Flow-Equivalence (2020)
  • title: Formal Verification of Flow Equivalence in Desynchronized Designs
  • what: Formalizes flow equivalence between synchronous latch-based specifications and desynchronized bundled-data asynchronous implementations in Coq, finding a counterexample to a published highly concurrent protocol while proving two less-concurrent controllers correct. Defines marked-graph execution and flow-equivalence semantics, mechanizes rise-decoupled and fall-decoupled correctness proofs, isolates the flawed induction hypothesis in Cortadella et al.’s proof, and checks a concrete three-stage pipeline counterexample. The proof scripts and definitions are publicly available.
  • number: Coq proofs mechanize both preserved-equivalence theorems and the counterexample
  • number: About 50 lines of Coq tactics automate a key lemma with fewer than 20 proof-script lines
  • number: Public repository contains all Coq definitions and proofs
  • limits: Results concern the specified latch/desynchronization timing model and safety equivalence; liveness results are left for future work. The counterexample shows protocol requirements alone are insufficient, while proofs cover only the less-concurrent controllers examined.
  • how much was read: most of it read
  • record id: coq-flow-equivalence-2020
• Curry Chiang Goldstein Dickerson pointwise RegretNet certificates2020 (2020)
  • title: Certifying Strategyproof Auction Networks
  • what: The unresolved main-paper Appendix?? and Table?? references have concrete targets in an available official supplement: A provides layer sizes/training constants; B provides hardware and clipped-payment scaling/IR tables. Original main-paper account is inherited: Curry,Chiang,Goldstein andDickerson modify RegretNet so a mixed-integer solver can maximize a bidder’s utility over all supported misreports at a fixed true valuation profile. Sparsemax and piecewise-linear activations permit exact mathematical encoding; architectural individual rationality needs bilinear constraints,while a distilled penalty-trained alternative is linear but may violate individual rationality. Experiments certify nonzero manipulation regret in small learned auctions and compare it with gradient estimates. Separates the quantified bid search at one fixed profile from global strategyproofness or population guarantees. Records dependence on solver global-optimality reporting,architectural versus learned individual rationality,numerical consistency rather than proof-object checking,and differing sample sets for empirical/certified averages. Saves concrete time/regret/revenue tradeoffs,scalability exceptions,an open-versus-closed-simplex display issue,and the missing referenced appendix details.
  • limits: Main Table2 explicitly has no payment clipping; supplemental Table3 does. Their different times/regrets are different settings, not a demonstrated contradiction. Multiplier notation is ambiguous: mu_i is first20, followed by mu as5. The formula also uses rho_irv; no silent implementation-level repair is assumed. Table4 values are sample statistics. Filtering sampled violating profiles does not prove universal individual rationality, and per-profile regret optimization is not a uniform strategyproofness certificate. No solver/network source, checkpoint, pickle, result file or experiment was opened/run. Archive member names and sizes were inspected only to locate the prose PDF.
  • how much was read: most of it read
  • record id: curry-chiang-goldstein-dickerson-pointwise-regretnet-certificates2020-2020
• EEV BNN verification (2020)
  • title: Efficient Exact Verification of Binarized Neural Networks
  • what: Presents EEV, an exact (sound and complete) verifier for binarized neural networks. BNN layers compile to reified cardinality constraints; MiniSatCS adds native propagation for these constraints. BinMask induces balanced layer-wise sparsity, Cardinality Bound Decay (CBD) shrinks threshold bounds, and adaptive gradient cancelling trains networks whose exact robustness is tractable. The SAT encoding uses {0,1} activations, sparse {-1,0,1} weights, quantized inputs, thermometer-encoded perturbation intervals, and cached network clauses. The paper explains why balanced sparsity matters more than total sparsity and why lower cardinality bounds reduce sequential-counter encoding size, improve propagation, and make outputs predictable. Standard hard-tanh straight-through adversarial training can produce high PGD but low exact robustness; tanh/adaptive gradients and verifier-generated adversaries narrow this gap. EEV also encodes ensemble reject queries requiring all models to agree on the same wrong class.
  • number: MiniSatCS >100x over unmodified SAT
  • number: EEV total speedup 338.28–2440.65x vs real-valued exact verifier
  • number: BinMask solve 756.288→0.002s MNIST and 0.267→0.003s CIFAR10
  • number: CBD mean bound 148.3→2.7 MNIST; 123.8→2.1 CIFAR10
  • limits: Exactness applies to the quantized BNN and encoded infinity-norm perturbation domain, not arbitrary floating-point inference. Inputs are quantized (s=1/255 or 2epsilon), final batch normalization is restricted to scalar statistics, and verification remains NP-hard with timeouts for harder settings. Robustness/accuracy tradeoffs are severe on CIFAR10 at large epsilon; CBD can reduce natural accuracy. Results use MNIST/CIFAR10 architectures and do not prove properties of real-valued or distributed systems.
  • how much was read: most of it read
  • record id: eev-bnn-verification-2020
• Flow-CTL* Petri nets (2020)
  • title: Model Checking Branching Properties on Petri Nets with Transits (Full Version)
  • what: Introduces Flow-CTL* for branching properties of data-flow chains in Petri nets with transits, while retaining LTL assumptions for control fairness and maximality; reduces checking to ordinary Petri-net LTL model checking. Transit relations separate control tokens from data-flow chains. Flow-CTL* formulas combine flow-tree branching requirements with run-level control assumptions. The construction builds Büchi-automaton subnets, supports stuttering and activation tokens, and proves correctness of the reduction from a transit net and Flow-CTL* formula to a safe Petri net with inhibitor arcs and an LTL formula.
  • number: Theorem 1 gives triple-exponential model checking time for Flow-CTL*
  • number: Flow-CTL model checking runs in double-exponential time
  • number: constructed automata use O(|APᵢ∩T|·|N|+|N|) states and O(|N|³) edges for a flow component
  • number: future tool implementation/evaluation is explicitly planned
  • limits: The theorem is for safe Petri nets with transits and inherits automata-construction blowups. The stated bound is triple-exponential for Flow-CTL* and double-exponential for Flow-CTL; no implementation benchmark is reported, and the conclusion explicitly leaves tool evaluation and a corresponding case study for future work.
  • how much was read: most of it read
  • record id: flow-ctl-petri-nets-2020
• Gauntlet: Finding Bugs in Compilers for Programmable Packet Processing (2020)
  • what: Gauntlet finds P4 compiler crashes with well-formed random programs, semantic mistakes in accessible compiler passes through SMT equivalence checking, and backend miscompilations through model-derived input/output packet tests. Its symbolic P4 interpreter supplies both oracles. The authors report96confirmed distinct bugs across P4C,BMv2 and Tofino over eight months,54fixed, and six specification changes. This is compiler bug finding with conditional translation validation of tested transformations, not verification of every compiler execution or correctness of the user network program. Captures generator probability/size controls, independent block semantics, symbolic table encoding and parameter directions, undefined-behavior taint and unstable-code distinction, parser/ToP4 dependencies, per-pass reparse/check workflow, constrained backend test generation and dropped-test limits. Preserves all bug status/location counts, timing rows, six concrete bug families, specification ambiguities, recent-merge count inconsistency, manual reduction and unmeasured coverage.
  • limits: §1–2: P4_16 finite bit-vector state and bounded/forbidden loops make equivalence decidable in principle. Control-flow loops are forbidden; parser loops are bounded by packet processing, so headline “no loops” should not be generalized to absence of every parser cycle. Efficient practical checks still depend on small programs and limited branching. This restriction distinguishes the method from unrestricted C; it is not an equivalence decision procedure for arbitrary Rust or distributed programs. §2.1/Table1: Crash bug means abnormal compiler termination without usable output/error, including assertion failure, segmentation fault,incomplete error and out-of-memory. Semantic bug means compiled behavior differs from input-program semantics, including packet outputs. Taxonomy levels1–7 are ASCII,words,syntax,type,static,dynamic,model conformity. Focus is static and higher-level failures rather than lexer/parser fuzzing alone. Some concrete failures reveal valid input incorrectly rejected; legality/specification uncertainty is resolved with developers. §2.2–2.3: Goal is many bugs, not completeness or a verified compiler. Differential testing across P4 targets cannot assume identical target semantics; independent same-target compilers were unavailable. Gauntlet tests mature P4C,BMv2,Tofino, excluding preliminary eBPF/uBPF/PSA toolchains. Its principal tests deliberately avoid target-specific extern calls. This is not a proof a particular P4 application satisfies network safety properties. §3/§5.2: Package parameters define input/output observables. Each programmable block is encoded separately; BMv2 v1model has Parser,VerifyChecksum,Ingress,Egress,ComputeChecksum,Deparser. out/inout form outputs; in/inout are symbolic inputs. Paths yield nested if-then-else expressions containing resulting parameter tuples. Copy-in is left-to-right; out values start uninitialized, and out/inout copy back on return. Correct interpretation of these effects is part of the trusted semantics. §4: Random generation grows a P4C IR AST probabilistically and emits P4 with ToP4. Node probabilities steer language coverage and keep programs small in lines/paths. A skeleton captures each target package/restrictions; two generator backends correspond to BMv2 and Tofino. A correctly rejected ill-typed/generated input is a generator bug, not a compiler bug. P4Fuzz comparison is qualitative; no matched-budget bug-yield experiment is reported. §4/§5.2: Unlike Csmith, generator permits undefined behavior and interpreter tracks affected expressions, so suspicious legal refinements are distinguishable from true miscompilation. Undefined-variable taint propagates through affected values. Replacing tainted expressions only in the before-pass formula classifies legal reductions of undefinedness as unstable code; changing a previously defined expression into undefined behavior remains a bug. Such warnings are not counted automatically as semantic bugs. §5.2: Interpreter took five months to become reliable enough for finding compiler semantic bugs. Developed with >600 P4C tests and >100 custom tests, generator co-evolved to expose interpreter mistakes, authors consulted compiler/specification maintainers. Their belief that discrepancies on audited regression tests probably indicate interpreter bugs is a debugging heuristic, not proof of the oracle. Formal semantics, Z3, IR parser and ToP4 are trusted dependencies; no machine-checked interpreter-correctness theorem is given. §5.2: Interpreter avoids compiler transformation passes, relying on the P4C parser and ToP4, and handles pre-desugared programs to detect earliest front-end bugs. p4test emits intermediate P4 after each pass; unchanged hashes skip checks, each changed output reparsed. Pairwise inequality queries compare corresponding programmable blocks; satisfiable query produces an input/table assignment and localizes a candidate faulty pass. Correctness is conditional on accurate semantics, preserved block interfaces and solver result; tested-program proof does not quantify over all source programs. §5.2/Figure3: Each table application uses one symbolic match key and symbolic action selector, rather than one variable pair per possible table entry. Matching condition selects an available action or default. This encodes outcomes for the represented table call, not a concrete exhaustive table configuration dump. Figure3 table exact-match hdr.a has assign and NoAction/default, yielding Hdr(1,hdr.b) only when key matches and action=1. Relational behavior across target-specific tables/extern state is outside stated coverage. §5.2: Header-validity interpretation follows P4C and maintainer clarification: marking previously invalid header valid gives undefined fields; final invalid header fields treated invalid. Extern returns and mutable arguments become arbitrary symbolic values, while target-specific extern semantics are not implemented for the reported generator campaign. Modeling arbitrary effects does not provide a precise implementation contract for a real device extern. §6.1–6.2: Model-based tests reuse original-program semantics to obtain one candidate input/output pair per controllable path; target output compared with expected output. BMv2 uses STF/capture files; Tofino uses PTF and software simulator. Authors initially reconfirmed every Tofino semantic bug on hardware, later used simulator only for speed; all counted bugs confirmed with developers. Therefore not all later reports independently exercised physical hardware. §6.2: Unknown/undefined path influences cannot be forced on real hardware, so constraints restrict paths. Undefined output bits marked don’t-care, invalid header members omitted. Solver chooses random nonzero input/output assignments because zero defaults can mask bugs. One tested representative per path is not exhaustive over all packet values on that path; finite-state exhaustive equivalence applies to accessible-pass SMT checks, not these backend tests. §6.3: Device minimum packet size,MAC restrictions and silent drops can make semantic-model tests unexecutable; such cases discarded, reducing coverage. P4 does not specify all transformations between programmable blocks, which complicates end-to-end expected packets. Many branches can generate exponentially many paths and millions of packet pairs. Current small programs avoid that observed bottleneck; no demonstrated complete path coverage for large deployed programs. §7/Tables2–3: Eight-month longitudinal search,96new distinct developer-confirmed bugs=62crash+34semantic;54fixed=31crash+23semantic. Filed reports are not all confirmed bugs: Table2 lists117filed reports. Status and confirmation at publication, not current repository state. No total generated-program denominator, matched alternative-fuzzer budget, independently adjudicated false-negative rate or compiler source-code coverage is supplied. Internal fixed-count discrepancy: Table2 printed fixed-crash cells27+4+8 sum39, and fixed-semantic22+1+0 sum23, yielding62fixed overall, whereas abstract reports31fixedcrash/23fixedsemantic/54total and conclusion54total. Preserve all as reported; no independently established resolution. §7.1: P4C59confirmed=33crash+26semantic;BMv2five=4+1;Tofino32=25+7. Tofino excludes P4C frontend/midend bugs reproducible there and two downstream crashes filed as upstream missed optimizations. Shared P4C bugs likely affect backends, but exact Tofino pass list unavailable. BMv2 tested less extensively and Tofino more complex; counts cannot rank intrinsic compiler quality. §7.1/Table3: P4C front-end38 and mid-end21;backend37=BMv2five+Tofino32. All P4C semantic bugs found by translation validation, Tofino semantic bugs by model testing; where possible P4C findings reproduced with packet pairs. Five-month interpreter preparation and weekly ~10,000 random programs are reported; eight-month campaign is not eight months of equally mature fixed-method automated runs. §7.2/Table4: Times are semantics generation for single programs/passes, not whole-compiler certification latency. tna_simple_switch1940LOC5s;switch_tofino_x0 5751LOC51s;switch_tofino2_y0 6024LOC53s;fabric958LOC2s;P4_14-converted switch5894LOC10m20s. Dense parser branching and Python implementation blamed for cost; formula equality typically <1s is authors’ observation, not universal time bound. No machine configuration,repetitions,CI or solver-timeout rate for these timings is given. §7.3/Figure5a–c: Missing SideEffectOrdering transformation of ternary nested in addition crashes Tofino; missed InlineFunctions also leaks unsupported calls to backend. Unknown-width shift crashes type inference and prompts specification prohibition. A valid slice expression instead becomes illegal through StrengthReduction index overflow. These demonstrate source legality, downstream symptoms and originating faulty pass must be distinguished. §7.3/Figure5d: Passing low-byte slice as inout while assigning disjoint high-byte slice should preserve high-byte assignment. SimplifyDefUse assumed entire variable copied back and deleted the assignment. At least11/26P4C semantic bugs concern side effects/copy-in-copy-out;21/33P4C crash bugs involve type checker. These are scoped classifications, not incidence rates for arbitrary programs. §7.3/Figure5e: Invalid-header write/read folded into constant assignment on valid header is allowed by undefined behavior, but can conflict with backend no-op expectations; maintainer warning accepted. This is unstable code, not necessarily miscompilation. Figure5f exit ambiguity: authors expected copy-out even after exit, whereas pass moved assignment after exit and lost updates; clarification changed spec and ensuing implementation changes introduced ≥3 further bugs. §7.1 versus §7.3: Paper reports16/59P4C bugs from recent merges in §7.1, but19/59 in §7.3. Preserve both counts as an unresolved internal discrepancy. Predication change caused at least six bugs(one crash,five semantic); independent user report duplicated earlier finding. Six specification changes include header validity/initialization,unknown-width shifts,exit/copy-out. These are reported campaign outcomes, not claims that all such ambiguities now resolved. §7.3–7.4: Four invalid intermediate-P4 emission bugs were fixed but explicitly excluded from96. Reparsing can expose ToP4,parser or transform bugs, even where final execution unaffected. Distinct assertion messages help crash deduplication; thin nanopasses help isolate semantic defects. Almost all crashes assertion failures suggests missing assertions might convert some into silent semantic failures, an authors’ inference rather than measured counterfactual. §7.4/§8: Open-source maintainers responded quickly, while opaque Tofino tracker and infrequent binary updates cause repeated rediscovery. Manual reduction: inspect each flagged program and prune to reportable case; automatic reduction is future work. Backend translation validation, safe-optimization plugin and long-term CI analysis are proposed, not evaluated results. Public open-source Gauntlet and P4C CI integration reported; no artifact execution in this reading. §8: Generator omits extern calls,method overloading,type definitions,varbit vectors,runtime indices,longest-prefix/ternary matches,generic-body type inference,annotations and custom table properties. Interpreter covers more features than generator; do not confuse those coverages. Compiler code coverage unmeasured. Extern modeling especially difficult without hardware semantics. Performance/resource-usage regressions not detected by current correctness techniques. §9: P4K and petr4 provide language-foundation work; netdiff compares dataplane semantics; p4pktgen starts from backend JSON and therefore cannot expose source-to-JSON transformation errors in the same way. These references motivate complementary tools, not independently verified claims of their current coverage. No Verus,verifiedRust,TLA+,distributed-consensus proof or LLM-generated proof experiment. Direct relevance is trustworthy semantics/oracles and distinguishing generated-test evidence from quantified translation checks.
  • how much was read: most of it read
  • source
  • record id: gauntlet-finding-bugs-in-2020
• GSPACER (2020)
  • title: Global Guidance for Local Generalization in Model Checking
  • what: Adds explicit global guidance to local IC3-style lemma generation. Three general rules—implemented as GS PACER on top of Z3 SPACER—use the current lemma set to introduce blocking states/lemmas and mitigate locality failures. The paper specifies subsume, concretize, and conjecture mechanisms, instantiates them for Linear Integer Arithmetic with model-based projection and anti-unification, and compares interpolation-enabled and interpolation-free configurations. Global guidance preserves the IC3 architecture and can support non-linear CHCs/LRA in the implementation.
  • number: Intel E5-2690 v2 3GHz, 128GB RAM, 10-minute timeout
  • number: SPACER solved 60% of CHC-COMP 2018 and 85% of 2019; GS PACER solved 214 safe/67 unsafe (CHC-18, fw) and 202/84 (CHC-19, fw)
  • number: Best GS PACER configurations solve significantly more instances than every SPACER configuration; interpolation-off GS PACER is best on CHC-18 and only slightly worse on CHC-19
  • number: On PLDI18, GS PACER solved 284 safe/68 unsafe versus SPACER 216/68 and Linear Arbitrary 270/65
  • limits: Main implementation targets LIA; LRA and non-linear CHC support are described as extensions, with details deferred. Results depend on CHC-COMP and artifact benchmark distributions and a 10-minute timeout on one CPU/memory setup. Authors note SMT runtime nondeterminism and leave theories lacking interpolation (e.g., bit-vectors) as future work.
  • how much was read: most of it read
  • record id: gspacer-2020
• HYDRA distributed BMC (2020)
  • title: Distributed Bounded Model Checking
  • what: Presents HYDRA, an adaptive distributed BMC algorithm that dynamically unfolds call graphs and splits path sets into disjoint verification partitions farmed to cluster clients. It modifies Microsoft CORRAL, uses solver complexity to choose split points, and adapts split intervals to idle workers. A server coordinates partitions while clients run standard BMC; split decisions encode required/avoided control nodes, preserving completeness because any counterexample lies in one partition. HYDRA includes client backtracking, partition prioritization and solver-informed splitting, retaining SMT solvers as black boxes.
  • number: 32 clients achieve 20x speedup; mean 20.4x, median 9.7x
  • number: CORRAL solved 58 instances within 1000s; HYDRA solved substantially more (figure)
  • number: Experiments use 16 clients/server and split parameters delta_c=0.5s, K=20
  • number: Hard instances required at least 200s serial solving or timed out
  • limits: BMC is bounded by loop/recursion limits and proves only the encoded bound. Network/server coordination and partition overhead can dominate with few workers. Results target CORRAL/SDV C benchmarks and may not transfer to other languages or symbolic engines.
  • how much was read: most of it read
  • record id: hydra-distributed-bmc-2020
• Hyperliveness Verification (2020)
  • title: Verifying Hyperliveness?
  • what: Develops model-checking and synthesis techniques for HyperLTL hyperliveness properties with quantifier alternation, treating existential quantifiers game-theoretically as reactive strategies. The work extends MCHyper to one alternation with manually supplied strategies, gives complexity/prophecy-variable results, and builds a bounded SMT synthesis tool for strategies and reactive systems. Experiments cover software doping, mutual exclusion, dining cryptographers and symmetry properties, checking precise alternating formulas rather than universal approximations.
  • number: software-doping times 1.8–160.1 s
  • number: Bakery symmetry times 27.5–472.3 s
  • number: synthesis example reaches 840 s
  • number: dual-core 3.3 GHz machine with 16 GB RAM
  • limits: Hardware model checking uses supplied AIGER strategies and bounded synthesis scales much less than checking with given strategies. Experiments use small benchmark families and a dual-core machine; full dining-cryptographers synthesis timed out, and automatic strategy synthesis remains limited.
  • how much was read: most of it read
  • source
  • record id: hyperliveness-verification-2020
• KPNer-CTLK (2020)
  • title: Petri Net Based Symbolic Model Checking for Computation Tree Logic of Knowledge
  • what: Presents KPNer, a symbolic CTLK model checker using Knowledge-oriented Petri Nets, reachability graphs with equivalence relations, OBDD encodings, a structure-aware variable-order heuristic, and lazy generation of only formula-required transition/equivalence relations. Defines recursive satisfaction algorithms for temporal and epistemic operators, explains how KPN structure controls variable ordering, and compares parallel/sequential Dining Cryptographers models against MCMAS using common CUDD. The implementation exploits concurrency structure rather than constructing a complete Kripke model before checking formulas.
  • number: KPNer verifies 100 sequential cryptographers in 3 minutes while MCMAS times out beyond 12 hours on some cases
  • number: KPNer reaches 1200 parallel cryptographers in under 14 hours and about 10^1080 states (abstract); sequential runs reach 600 in under 14 hours
  • number: For n=100 sequential, KPNer T11/T12/T13 = 1.359/17.547/113.829 s; MCMAS times out
  • number: φ4 and φ5 scale to more than 6000 atomic propositions and 3600 operators in the largest abstract case
  • limits: KPN’s interacting-process portion is an abstraction/simulation and its epistemic places may not correspond to MAS variables or actions. Results depend on heuristic variable ordering and OBDD behavior; state counts become uncountable by CUDD beyond 1024 Boolean variables (reported as INF). Experiments are protocol benchmarks, not broad industrial MAS workloads.
  • how much was read: most of it read
  • record id: kpner-ctlk-2020
• Leaderless SMR ROLL limits (2020)
  • title: Leaderless State-Machine Replication: Specification, Properties, Limits
  • what: Defines leaderless state-machine replication using possibly cyclic dependency graphs, separates committing from stabilization/execution, and decomposes decision into dependency discovery plus per-command consensus. Claims ROLL tradeoff 2F+f−1≤n between failure tolerance f and fast-quorum size n−F under Reliability, Optimal Latency, Load Balancing. For protocols on its parameter frontier, every chain length k has some failure-free 2-asynchronous run with a live dependency chain of length k. A five-site Google Cloud experiment illustrates EPaxos tail latency increasing with contention, unlike Mencius; proofs in conference paper are sketches with formal treatment deferred. Records graph phases, stable agreement modulo aborted dependencies, batch execution order, DDS visibility/weak agreement, exact ROLL quantifiers, quorum partition proof, skyline examples and chain induction. Separates empirical tail/correlation observations from existential worst-case chains, nice runs from synchrony, decision from execution, and stated abstract properties from a machine-checked implementation. Replaces earlier record that lacked later sections.
  • limits: Fixed n≥2 message-passing processes, fail-stop rather than Byzantine faults, deterministic replicated state machine and unbounded command/log space. Model extends asynchronous wait-free computation with failure detectors; precise detector admissibility/fairness assumptions are deferred to [22]. Do not read Reliability as solving consensus in pure asynchrony without such an assumption. Clients are not modeled; replicas proxy submissions, and different replicas may submit the same command. Conflicts safely overapproximate semantic noncommutativity, considering both final state and response values; relation is symmetric and nonreflexive. Distinct nonconflicting commands may execute in different orders. Classic logs append immutable slots; Generic SMR uses acyclic partial logs with incoming-prefix closure and compatible upper bounds. Safety properties are distinct from termination and real-time/client-response contracts; no complete client refinement proof printed. Leaderless graph maps each command to pending⊥, aborted⊤, or a committed dependency set; phases pending/abort/commit/stable/execute. Aborted commands are removed from dependency sets permanently. A committed command is stable only when no command in its transitive dependency closure remains pending. Stability agrees on stable dependencies globally; conflicting committed commands must have at least one direct dependency between them, allowing cycles rather than a prechosen total order. Algorithm1 executes the largest still-stable subset of a stable command’s closure, in reachability order between components and canonical total order within a cycle. Already executed dependencies need not execute again. Invariant1 excludes an unexecuted dependency outside an earlier batch; Invariant2 says if conflicting c precedes d within a batch then c is in d’s transitive dependencies. It is not simply arbitrary SCC iteration: batch includes eligible dependency predecessors too. Abort pruning, stable-versus-execute status and canonical order must be made explicit in a formal implementation. Theorem1 states Generic SMR reduces to Leaderless SMR without messages, with proof deferred. Direction is an implementation/refinement claim, not equivalence of arbitrary cyclic dependency states with Generic acyclic logs. Ordering all commuting commands to recover Classic SMR would require extra communication. The common dependency graph itself is not yet an agreed total execution log. Algorithm2 calls DDS.announce(c), returning dependency set D or abort⊤ and fast flag b; slow path invokes per-command consensus, then records and broadcasts outcome. Coordinator or a process suspecting it may submit/recover. A nice run has no failures and a perfect failure detector, so only the coordinator calls that command’s consensus. Leaderless does not mean no coordinator: each command has one, with no single primary ordering all commands. DDS Visibility: two conflicting nonaborted announcements include each other in at least one returned set. Weak Agreement: if one announcement of c returns a nonaborted set with fast=true, every other announcement of c returns a nonaborted set; differences contain only commands whose every announcement aborts. Thus raw dependency sets may differ, but aborted differences are removed before stable agreement. Theorem2 claims Algorithm2 correctness, proof in [22]; consensus, detector, and DDS are assumed abstract services, not implemented or verified here. Examples: rotating coordinators preassign order and always use slow flag; Clock-RSM uses timestamps and majority wait, propagates clocks for stabilization; Mencius aborts unannounced prior slots and needs everybody for fast flag; EPaxos example omits sequence numbers, unions observed conflicts, uses spontaneous agreement, and falls back/recovery to a majority; Caesar timestamps and waits/rejects inconsistent higher-timestamp conflicts. These are explanatory decompositions, not verified full protocol implementations or safety audits of recovery rules. Reliability states every submitted command eventually decided at every correct process when at most f failures. This is decision, not by itself a quantitative execution-latency guarantee. Surrounding prose inconsistently says after f failures no progress or less than f; retain the explicit inclusive property. Stable termination of dependency closures and outcomes of submissions by faulty coordinators require the detailed model. Footnote3 discusses reconfiguration/persistent recovery informally, outside the fixed fail-stop proof. Optimal Latency: in every nice run, announce returns after two message delays with nonaborted D containing only previously announced commands; if no concurrent conflicting command, fast flag true. With contention it may be slow-flagged despite two-delay DDS completion, and complete execution may wait arbitrarily longer. Load Balancing: any quorum Q containing coord(c) with |Q|≥n−F can serve its announcement in a nice run. This is freedom of quorum choice, not an empirical guarantee of equal load or geographic latency. Theorem3 ROLL assumes those properties and an available pair of noncommuting commands. Bound 2F+f−1≤n is necessary, not sufficient to construct a protocol. Together with majority-style bounds f,F≤floor((n−1)/2), skyline means no simultaneous parameter improvement. For fixed f the algebra gives quorum q=n−F≥ceil((n+f−1)/2). Do not substitute arbitrary fast-consensus quorums: ROLL quorums must contain that command’s coordinator. Proof sketch assumes violating inequality, partitions P1,P2 of sizeF−1 and Q of size n−2F+2. CAP premise 2F<n gives two coordinators p1,p2 in Q; fast quorums Q1=P1∪Q−p2 and Q2=P2∪Q−p1 have size n−F. Solo nice runs decide empty dependencies. Concurrent run delays cross messages then crashes Q; integer violation implies |Q|≤f. Survivor cannot distinguish carefully spliced runs, forcing empty dependencies for both conflicting commands, contrary to Visibility/Consistency. Detector-history equivalence and eventual stability are essential deferred proof details; the conference sketch invokes Reliability (defined as decision) to obtain stability without fully showing that bridge. Printed consequence that a plain majority fast quorum tolerates at most one failure is not implied by its displayed inequality. For odd n=2m+1, q=m+1 permits f≤2; for even n=2m, q=m+1 permits f≤3, subject also to f≤floor((n−1)/2). Its own n5(F,f)=(2,2) example gives majority q3 with f2, contradicting the unqualified consequence. This is a printed inference conflict, not a demonstrated implementation or refutation of Theorem3. Frontier examples: n5 only(F,f)=(2,2), n7 (2,3),(3,2); EPaxos attains first n7 tuple, Atlas offers(3,1). Paper calls EPaxos/Alvin optimal for n=2f+1, Atlas for f1 and even n or n3. Fast quorum floor(3n/4) for EPaxos needs integer rounding; nearby f+(f+1)/2 notation is unrounded for even f. Table1 rotating-coordinator quorum0 should not be treated as a legal coordinator-containing fast quorum; protocol lacks Optimal Latency and uses no fast DDS path. Table1 marks Caesar as having Optimal Latency, but §7 explicitly says Caesar lacks it because even contention-free commitment may need two round trips. Keep this internal classification conflict rather than certifying either claim from the unread Caesar paper. Table1 has Clock-RSM and rotating coordinator without Optimal Latency, Mencius with it but nonoptimal frontier; EPaxos/Alvin/Atlas with stated frontier conditions. Historical protocol optimality/current best claims are not checked beyond this2020paper. Chain c1…ck means ci∈deps(ci+1), so dependencies run toward the first element. §5.1 defines live as first command not stable at any process; §5 introductory overview instead says last, which is inconsistent. With pending d and deps(a)={b},deps(b)={a,c,d}, chain dba blocks a; c alone stable. A live finite chain does not assert an infinite run, inevitable starvation, or every execution having a long chain. k-asynchrony bounds overlaps: if any message overlaps both first and last messages of a causal message path, path length≤k. Overlap is real-time interval overlap, not Lamport independence of endpoint events. Formal definition is universal over all messages/paths, unlike introductory prose saying existence of a path. 2-asynchronous is not a fixed bound on wall-clock message latency, delay ratio, or clock skew; nice means failure-free/perfect detector, not lock-step synchronous. Theorem4: for every finite k>0, there exists a 2-asynchronous nice run of any ROLL-optimal protocol with live chain sizek. This is a worst-case existence theorem, not a probability distribution, expected latency, or measured percentile bound. Conference statement does not give a numeric command-latency formula in milliseconds or require every command to suffer. Full proof in [22]; conflict-pattern/termination assumptions belong to that detailed model. Chain sketch splits each announcement into request-send S, intermediate M, reply-return R. Induction constructs complete nice σi with no pending messages, chain ci…c1, and interposed Γprime whose paths have size≤1 and whose participating overlap with Qi is Pi of sizef−1. Alternate quorums and indistinguishable coordinator views force next dependency. Truncating final replies makes the chain live. Figure4 gives n5,k7 and quorums{p1,p2,p3}/{p3,p4,p5} with intersection{p3}. Exact general quorum/induction case analysis deferred; sizek need not mean k different replicas. Experiment: Google Cloud, five sites South Carolina, Finland, Canada, Australia, Taiwan (leader),128 closed-loop clients each, no-op service, synthetic key conflicts atρ=0,2,5,10,30percent for EPaxos; Paxos and Mencius baselines. Latency submission-to-execution at steady state, not commit acknowledgment. Each operation picks common key42 with probabilityρ, unique otherwise; ρ is hot-key choice probability, not directly fraction of conflicting random command pairs (under independent choices that pair probability isρ²). No-op operations commute semantically, so key conflicts are an intentional safe overapproximation. Figure1 CDF shows EPaxos tails increasing with synthetic contention and Mencius lower median; paper reports latency/batch-size correlation>0.7. No named correlation estimator, sample count, duration, repeated-run uncertainty, machine types, protocol versions, or fault injection specified in this conference paper. No exact quantiles tabulated; graph readings must not be invented. Correlation plus worst-case theorem supports a mechanism, not measured causal attribution of every tail sample or general workload performance. Mitigation discussion: pure writes may return at commit or durable f+1 receipt, but footnote5 requires later reads to wait for all preceding writes to preserve linearizability. Claimed read dependency exclusion assumes cited per-read single-process execution scheme, not arbitrary reads. Waiting for prior announcements can still allow chain of sizen by rotating coordinators, stated without proof here. These are tradeoffs, not new verified algorithms. ROLL Optimal Latency/Load Balancing enforce request-reply form with no pending messages at announcement completion. Weaker latency permitting background messages can sidestep the bound in a fully synchronous model by sharing replies among quorum members. Discussion says partially synchronous version retains ROLL and chaining requires more asynchrony. Thus theorem is relative to its formal properties, not a universal impossibility for every system called leaderless or every weaker fast-path definition. Entire supplied17-page paper now read, including previously missing §§4–8. Theorems1–2 proofs and formal versions of ROLL/chaining deferred to arXiv2008.02512. No machine-checked proof, Verus/Rust/TLA+ specification, LLM involvement, artifact audit, experiment rerun, or independent verification of underlying protocol papers. Citation[4] about dependency-set decomposition names an unrelated local-independent-set approximation paper in bibliography; original intended source cannot be recovered from that reference here.
  • how much was read: most of it read
  • source
  • record id: leaderless-smr-roll-limits-2020
• Lexicographic stochastic games (2020)
  • title: Stochastic Games with Lexicographic Reachability-Safety Objectives
  • what: Studies finite turn-based zero-sum stochastic games whose ordered objectives are reachability or safety, and computes the lexicographic value and optimal strategies. For absorbing targets, removes locally suboptimal actions and characterizes optimality as local lex-optimality plus almost-sure reachability of a final set. It reduces safety objectives to quantified reachability, then handles non-absorbing targets by recursively solving stages for visited target sets (up to 2^n−1), composing stage strategies with n-bit memory. It proves determinacy, deterministic strategies with at most 2^n−1 memory classes, PSPACE-hardness and an NEXPTIME∩coNEXPTIME upper bound (NP∩coNP for constant n or absorbing objectives).
  • number: Dice[50]: 96,295 states, 3 s lex solve; Hallway 10x10: 400,000 states, 548 s; Avoid Observer 20x20: 1,436,404 states, 281 s; stages used 1/3 for Dice and 4/7 for AV; all instances solved within minutes on 2.4 GHz quad-core i5 with 4 GB Java VM
  • limits: Finite state, turn-based stochastic games with Borel reachability/safety objectives; values use lexicographic sup-inf and the algorithm relies on a single-objective solver (experiments use approximate PRISM-games value iteration, so exact lex-values are not measured). General-case complexity leaves a PSPACE-vs-NEXPTIME gap; only reachability/safety are treated, and parity or richer quantitative objectives are future work.
  • how much was read: most of it read
  • record id: lexicographic-stochastic-games-2020
• Lively RaTT guarded-recursion liveness (2020)
  • title: Diamonds are not forever: Liveness in reactive programming with guarded recursion
  • what: Introduces Lively RaTT, a modal functional-reactive language combining guarded fixed points with an LTL-like until type constructor. A step-indexed Kripke logical relation proves productivity, causality, termination, liveness, fairness, and absence of implicit space leaks. Separates the LTL time-step modality from guarded recursion’s modality, defines events and fair streams, gives evaluation/step/reactive semantics, and proves metatheoretic properties through worlds, support, and logical relations. The system explains why unrestricted identification of the modalities breaks termination guarantees.
  • number: No runtime benchmark; guarantees are metatheoretic (§5)
  • number: Proves productivity, causality, termination, liveness, fairness and no implicit space leaks (Abstract)
  • number: Future extension to dependent/temporal inductive types (§7)
  • limits: The language is a typed functional/reactive calculus with guarded recursion and specific modal/temporal types; results are semantic and do not provide empirical performance or automatic model checking. Expressing termination and richer dependent specifications remains future work, and ordinary inductive/coinductive extensions require care.
  • how much was read: most of it read
  • record id: lively-ratt-guarded-recursion-liveness-2020
• Local Reasoning About the Presence of Bugs: Incorrectness Separation Logic (2020)
  • what: The cited technical appendix is an author-hosted full version of the same paper, rather than an unrelated report. A supplies an OpenSSL null-dereference example; B gives the strengthened frame-preserving induction and syntactic soundness; C gives all footprints and the framing characterization; D lists the symbolic execution rules. Original main-paper account is inherited: Incorrectness separation logic combines under-approximate reachability triples with separation logic’s frame rule. Owning an invalidated location as a negative heap resource prevents unsound framing after deallocation. The paper states logic soundness, a footprint characterization covering successful and erroneous executions, and soundness of a begin-anywhere symbolic execution calculus. Pulse illustrates bounded path pruning and inferred heap assumptions; its practical call-skipping mode has weaker guarantees than the calculus. Distinguishes a satisfiable error result reachable from some inferred local state from whole-program reachability, all-path correctness, or a failed proof. Explains the negative-heap counterexample, domain monotonicity, reversed consequence/bi-abduction entailments, error reporting without assuming the error, optional allocation-reuse pruning, and the explicit gap between sound intra-procedural rules and heuristic treatment of calls. Preserves all reported experimental counts and the limits of fixes as evidence.
  • limits: The appendix itself omits analogous Havoc/Store proof cases and supplies one-line induction arguments for some lemmas; reading it does not supply those omitted derivations. Appendix D lists rules; it has no separate expanded proof of the main symbolic-execution theorem. The OpenSSL program is adapted to the toy ISL language and uses assumed procedure contracts, not a fresh audit of OpenSSL implementation. The rendered complement bar above mod(C) in Lemma 1 is lost in extraction; agreement is outside the modified-variable set. Rendered p29 was checked. The analysis explicitly omits Alloc2 (reuse of known-invalidated addresses) to avoid branching. This is permitted pruning in the under-approximate setting; all actual bugs are not thereby covered. Figure11 p34 prints foot(skip) epsilon as empty-heap identity for every exit, but the p35 skip proof requires an empty error footprint. For epsilon=er(l), the identity pair is outside skip error semantics, contradicting literal Lemma2 inclusion and Theorem5 equality. Reader diagnosis: apparent printed base-case typo; restrict the identity to ok and give error exits empty footprints. This local repair is not an implementation finding or an independent certification of the intended theorem.
  • how much was read: most of it read
  • source
  • record id: local-reasoning-about-the-2020
• Madkour Conceptual Work Products SPIN (2020)
  • title: Semantic based model of Conceptual Work Products for formal verification of complex interactive systems
  • what: Proposes translating UML class/state diagrams for declarative conceptual work-product specifications into RDF/OWL plus SPARQL Inferencing Notation (SPIN), so consistency and solvability can be checked before model checking interactive workflows. The case study is Multiple Sclerosis outpatient case management. Sections 2–3 distinguish declarative product requirements from procedural workflows, enumerate UML/OWL mismatches (multiplicity, aggregation/composition, value partitions), and give concrete translation alternatives. Section 4 maps classes, associations, state transitions and guards to OWL properties and SPIN ASK/CONSTRUCT/RULE queries; seven Order constraints check gender, cross-class patient names, dates, IDs and composition cardinality, while rules initialize and mutate order states. A scenario simulation in TopBraid Composer validates firing of the state rules.
  • number: 49% of 303 published UML metamodels reported not well-formed (cited study)
  • number: 48.5% of OCL constraints in OMG documents reported erroneous (cited study)
  • number: 12 enumerated order transitions
  • number: 7 Order constraints in Figure 5
  • limits: OWL alone lacks behavioral constraints and full UML aggregation semantics; closed-world/deterministic SPIN reasoning and unique-name assumptions are used. The work is a proof of concept with one clinical model, no quantitative scalability or independent soundness/completeness study, and the authors have not yet connected the conceptual-product model to a BPMN model checker. Translation choices for composition, value partitions and multiplicity can change semantics.
  • how much was read: most of it read
  • record id: madkour-conceptual-work-products-spin-2020
• MORA (2020)
  • title: MORA - Automatic Generation of Moment-Based Invariants
  • what: Presents MORA, a Python tool that automatically derives expected values and higher-order moment invariants for Prob-solvable probabilistic loops. It rewrites random polynomial updates into monomial expectation equations, solves resulting constant-coefficient recurrences, and emits text or LaTeX invariants. The grammar permits uniform/Gaussian random variables and probabilistic branches subject to linear self-dependence and polynomial dependence on earlier-updated variables. The parser computes only monomials needed by requested goals; the core orders triangular recurrences and reuses partial solutions. A random-walk example derives first/second moments and cross terms. The reimplementation is about 350 Python lines using diofant and scipy, and improves runtimes over the earlier Julia/SymPy proof of concept.
  • number: around 350 lines of Python
  • number: moments 1–3
  • number: STUTTERING C 2144→73.9 seconds at moment 3
  • number: SQUARE 8.70→1.67 seconds at moment 3
  • limits: Only grammar-conforming Prob-solvable loops are accepted; invalid input stops. The method depends on C-finite constant-coefficient recurrences and therefore does not cover arbitrary guards, distributions, or non-polynomial updates. This is a tool demonstration referring theoretical foundations to prior work, with a small benchmark subset rather than a broad probabilistic-program evaluation.
  • how much was read: most of it read
  • source
  • record id: mora-2020
• MPI-SV (2020)
  • title: Combining Symbolic Execution and Model Checking to Verify MPI Programs
  • what: Introduces MPI-SV, a verifier that combines symbolic execution for input/path coverage with CSP model checking for MPI programs containing non-deterministic and non-blocking operations. It generates path-level CSP models, checks properties with PAT, and feeds model-checking results back to prune symbolic execution. The paper defines static matching and CSP generation for MPI communication traces, proves equivalence of the generated static CSP model with an ideal matching model and consistency with MPI semantics, and evaluates original and mutated open-source MPI programs. Besides deadlock freedom, it checks non-reachability properties and compares against pure symbolic execution, CIVL, and MPI-SPIN.
  • number: MPI-SV completes 100 of 111 tasks (90%) within one hour versus 61 (55%) for pure symbolic execution
  • number: average 19x speedup verifying satisfaction and 5x speedup finding violations
  • number: 48 deadlocks detected and manually confirmed; MPI-SV averages 5x speedup on those
  • number: MPI-SV verifies deadlock freedom for 52 tasks versus 17 for symbolic execution
  • limits: The static matching relation may include false matchings; the proof relates it to an ideal matching procedure under CSP failure-divergence semantics. Evaluation uses bounded process counts, one-hour timeouts, selected mutations, and a Cloud9/KLEE/AzequiaMPI implementation. Large CSP models with many non-wildcard operations can erase the benefit, and unsupported MPI operations remain future work.
  • how much was read: most of it read
  • record id: mpi-sv-2020
• Multi-scale verification of distributed synchronisation. (2020)
  • what: Connects explicit networks of discrete pulse-coupled oscillators with counting population models; gives probabilistic correspondence proofs and a reduction eliminating non-firing states. The concrete DTMC tracks each oscillator’s phase and start/update mode plus an environment firing counter; a descending-phase evaluation handles same-step firing cascades. The population model counts indistinguishable oscillators per phase and enumerates binomially weighted broadcast-failure vectors. Theorems preserve unbounded synchronisation reachability and adapted expected rewards when deterministic non-firing paths are collapsed. A counting map at round boundaries establishes two-way weak simulation and equal aggregate transition probabilities.
  • number: 41-page arXiv v1
  • number: 48,621 to 11,441 states for N=8,T=10
  • number: 128,936 to 50,883 transitions
  • number: R=5: 10.38 versus 0.047 seconds checking (N=4,T=10)
  • limits: Fixed population, fully connected network, identical oscillator dynamics, discrete bounded phases, non-negative increasing phase response and a global broadcast-failure probability. Population states erase node identity and topology. The model reduction preserves the specified unbounded reachability/reward properties, not arbitrary step-bounded properties. Parameterised inductive verification is proposed future work. The identified source is the 2018 preprint, not the publisher’s 2020 DOI version; results were not reproduced.
  • how much was read: most of it read
  • source
  • record id: multi-scale-verification-of-2020
• NetSMC: A Custom Symbolic Model Checker for Stateful Network Verification (2020)
  • what: NetSMC checks temporal policies on models of stateful network functions with persistent tables and one packet traversing the network at a time. It translates a restricted LTL language into CTL and represents sets of network states as existential first-order formulas. Backward preimages and a containment algorithm adapted from database query containment avoid general solver costs. A packet-order argument gives equivalence to interleaved executions for selected policies under an order-preservation condition. Benchmarks compare VMN, a Z3 containment variant, NuSMV and Cubicle; author-run exercises inject configuration mistakes into real network functions. Records exact NF/packet transition semantics, commutation and order-preservation conditions, restricted temporal operators and full appendix proofs, EFO preimage and containment construction, proof/implementation boundaries, printed listing/formula concerns, every Table2 timing and the narrow scopes of speedup, planted faults and model fidelity.
  • limits: §§4/8: A fixed topology and NF rule set; packets contain modeled header/application fields, not arbitrary payload processing. State is a collection of finite key-value maps; tests use specified finite domains, updates assign modeled expressions or increment/decrement by constants, expressions may choose nondeterministically from a domain. No multicast/broadcast, averages, generic computations, clocks/timeouts or direct network failures. Failures require separate enumerated scenarios. Integer/counter bounds and overflow semantics are not developed into an implementation-level finite-state proof. §§4.1/4.3/AppendixA: Exactly one matching NF rule; sequential commands are atomic at NF network-step granularity. A link preserves packet and tables. Drop/Exit permits an arbitrary next packet at arbitrary ingress, retaining all tables. Correct rules/topology/initial tables/model extraction are trusted; sequential packets do not mean tables reset between packets. Nondeterministic backend choice abstracts a concrete policy rather than verifies its implementation. §4.3/AppendixC: Every packet eventually leaves or drops; transient loops allowed, indefinite loops excluded. Unique immutable IDs distinguish packets. Interleaved model buffers unordered sets, not FIFO queues, and proof considers finite closed traces with no unfinished nonterminal packets. No general liveness/fairness or live controller-update verification. AppendixC/Definitions4–5/Lemma1: Non-conflict means swapping two same-NF processing steps preserves both output packets and final table valuation for every relevant initial valuation. A strict total packet order must be respected wherever packets conflict. Adjacent inversion swaps decrease an out-of-order index until packets can be serialized with identical per-packet located-packet traces. Conditions are assumptions on networks; no checker that establishes them for arbitrary input models is evaluated. §5/AppendicesB/D: Policies universally quantify outer variables; basic predicates inspect fields/location/tables. Permitted temporal forms are basic, F basic, within-packet eventual f basic, X(guard→formula), G(guard→formula), and within-packet g(guard→formula). f/g expand to restricted strong-until formulas terminated by Drop/Exit. General until, arbitrary quantifier alternation, generic temporal nesting/past properties excluded. A positive answer for arbitrary policies under serialization does not establish concurrent correctness. §5/AppendixD/Theorem7/Corollaries2,8: Conditional equivalence explicitly covers isolation, tag preservation and tag-based isolation on order-preserving networks. Other policies such as flow affinity/NAT consistency/service chaining are checked under the one-packet model and may miss interleaving bugs. Do not read Table1 sound/conditionally-complete labels as unconditional verification of all concurrent deployments. AppendixD qualified proof-scope concern: Theorem7 syntactically uses basic guards without explicitly excluding table predicates, although Lemma1 preserves only located-packet input/output traces, not every intermediate table valuation while a packet waits. Reordered unrelated processing can alter such valuations. The printed transfer argument therefore needs a restriction to predicates determined by those traces or an additional preservation proof; isolation/tag examples avoid this issue. This is a reading concern, not an executed counterexample against the tool. §6.2: EFO state formulas are disjunctions of conjunctive clauses with membership, inequality, location/field equality and table lookup. Variables are existential and outermost; denotation is a set of concrete packet/table valuations. This is a symbolic representation, not sampling of packet histories. §6.3/Algorithms1–2: Preimage unions NF-rule, link and new-packet predecessors. Commands processed in reverse order; tests conjoined. New-packet transition drops successor field/location constraints but preserves their variable/table relationships, restricts successor ingress and predecessor Drop/Exit. Table updates split equal-index overwritten entry versus an unequal index retaining old value. Helper expression translation F and link routine are omitted; precise implementation behavior is not reconstructed from pseudocode alone. §6.4/Algorithm3: Interpret clauses as conjunctive queries; homomorphism maps variables of candidate containing clause into contained clause. Inequalities require splitting equality patterns into atomic clauses; finite domains need emptiness checks (e.g., singleton variables forcing incompatible table values). Every nonempty atomic clause must map to some disjunct of target. This avoids a naive implication query to Z3, while still potentially expanding many clauses. §6.4/Theorem3 and AppendixE: Authors state exact True iff satisfaction under one-packet semantics. Appendices provide detailed semantics, trace reordering, policy transfer and structural LTL→CTL arguments (Theorem9/Lemmas10–12); no separate complete proof of Algorithm1/2 preimages, Algorithm3 domain splitting/emptiness, or Python refinement appears. Theorem3 is not a machine-checked verified implementation. Algorithm2/p188 printed-listing concerns: loop binds β_j on line14 but line15 passes β_i, and line21 recursive COMPUTECLS call omits expression-environment arguments present in its signature. Figure11/p196 sequence rule leaves c2 as a pending command without giving the corresponding continuation rule in the displayed semantics. Treat as incomplete/inconsistent presentation; no artifact tested. AppendixF/p200 printed-policy concerns: NAT consistency formula contains p without the displayed outer binder (only ∀i), despite closed-formula requirement. Flow affinity shown for S1 needs analogous instances for other servers. Conditional reachability uses G(loc=B→f(loc=A)) from the same arrival state at B, so without distinguishing request arrival from new reply injection it can demand that the current packet return to A; the prose speaks of packets sent afterwards. Qualified formula/specification boundary, not a measured tool failure. §7: Python prototype,20core2.8GHz/128GB server. CPU model/OS/Python/solver versions, source LOC, repeated-run statistics, confidence intervals and memory usage not reported. Alembic-generated NF models and manual POX translation used; authors assert high fidelity, but no formal extraction/refinement theorem or measured model-fidelity error rate is provided. §7.1/Figures6–8: Synthetic host/rule scaling and extended fattree/Ai3/Sprint topology isolation checks; flow-space sliced for both tools. Specific speedups depend on policy/model and baseline. VMN lacks service-chain policy support, so policy-complexity comparison uses only NetSMC/Z3. NuSMV fixed16-entry table and NetSMC without that size constraint are different encodings; Cubicle750× lacks detailed absolute timing/setup in text. §7.2: Red team authors2/3 inject secret deleted/modified rules; blue team author1 diagnoses with NetSMC, then rechecks fixed model. Four described real-NF exercises and nine modeled Table2 scenarios all succeed as reported; no production-discovered fault count, exhaustive fault set, detection rate, false-positive rate or independent user study. All benchmark/tool outcomes here are authors reports, not reproduced.
  • how much was read: most of it read
  • source
  • record id: netsmc-a-custom-symbolic-2020
• Parameterized PDL model checking (2020)
  • title: Parameterised Complexity of Model Checking and Satisfiability in Propositional Dependence Logic
  • what: Classifies parameterized complexity of model checking (MC), satisfiability (SAT), and exact-team-size satisfiability (m-SAT) for propositional dependence logic (PDL). It proves a dichotomy: most listed parameters yield fixed-parameter tractability, while team-size, dependence-atom arity, or split count can make problems paraNP-complete. The paper defines team semantics and syntax-circuit treewidth, then gives explicit reductions and algorithms. MC parameterized by team-size is solved by bottom-up enumeration of subteams in time polynomial in formula size and O*(2^(2k)); MC by split count is paraNP-complete via a 3-coloring reduction with three team splits. SAT reduces to singleton assignments because PDL is downward closed, making dependence atoms true and split disjunction classical; SAT by split count is solved by partial assignments with conflict markers and at most 2^k candidates. m-SAT adds a unary requested team size and is FPT for number of variables, formula size, or depth but paraNP-complete for team-size or dep-arity. The table leaves m-SAT under formula-treewidth and split count unresolved.
  • number: MC is NP-complete classically
  • number: MC team-size algorithm runs |Phi|·O*(2^(2k))
  • number: SAT split-count algorithm runs O(2^#splits(Phi)·|Phi|^O(1))
  • number: MC split count and dep-arity are paraNP-complete
  • limits: The logic uses atomic negation only and lax split-junction semantics, though the authors state complexity is unchanged under strict semantics and proofs work for both. Inputs are already binary-encoded, so database-value encoding blowup is not included in parameters. Hardness/FPT claims are parameterized-complexity results, not implementations or empirical benchmarks; open cases remain. Downward closure makes ordinary SAT equivalent to singleton-team satisfiability, which does not apply to m-SAT.
  • how much was read: most of it read
  • record id: parameterized-pdl-model-checking-2020
• Plankton: Scalable network configuration verification through model checking (2020)
  • what: Network configuration verifier combining trie-derived packet equivalence classes (PECs), dependency-aware analysis and SPIN exploration of a reduced path-vector protocol (RPVP). RPVP replaces asynchronous message buffers by shared best paths while preserving converged outcomes under stated assumptions. Domain-specific partial-order reduction, policy pruning, failure symmetry and route-entry interning make model checking much faster on evaluated OSPF/BGP/static-routing configurations. Records precise converged-state-only abstraction theorem, consistency-based pruning theorem and proof structure; full fixed-filter/ranking/message assumptions; PEC dependency and correlated-choice limitations; distinction between exact route-entry interning and lossy bitstate hashing; all evaluation setups, full numerical tables and adverse resiliency/memory/ablation cases. Establishes finite configuration/model checking rather than implementation correctness or protocol convergence.
  • limits: Inputs are concrete finite device configurations, Boolean correctness policy and environment such as bounded link failures/external advertisements. Prototype supports OSPF/BGP/static routing, full system visibility and internal dynamics; external peers/advertisements require modeled stubs. No vendor implementation conformance, packet-processing code proof, arbitrary protocol support or deployment-level bug absence follows. State model/config parser/policy callback/SPIN implementation are trusted. Checks only converged data-plane states, not transient loops, update safety during convergence, absence of oscillation, guaranteed eventual convergence or recovery latency. A configuration with no converged outcome can satisfy a universal converged-state property vacuously. SPVP may diverge on some/all schedules; RPVP deliberately discards divergent/transient behavior. BGP multipath is unsupported; OSPF has a special multipath extension whose theorem details are omitted. Extended SPVP has reliable FIFO buffers per peer, atomic advertisement handling, rib-in per peer and best-path. Origins start with empty path, others no route; ranking is a partial order permitting time-based tie persistence and may change over time for IGP cost. Fixed import/export filters reject with bottom; imports reject forwarding loops and otherwise preserve path; export appends local node and otherwise preserves path. Bottom ranks lowest. Failed sessions discard buffers and deliver route withdrawal. No link-recovery/changing-filter correctness theorem is supplied. RPVP state retains only current best path at each node; enabled if current path invalid or a neighbor offers a preferred acceptable path. Choose node, reset invalid route to bottom, choose best acceptable update nondeterministically among tied best peers. All investigated failures occur before execution and ranking uses its final version. Theorem1 says every converged extended-SPVP state under failed-link setL is reachable in RPVP withL already failed, including an execution where each node makes its final path choice once. Soundness is argued by simulating RPVP steps with SPVP, not a machine-checked refinement. AppendixC proof uses Lemma1 stale suffixes must eventually force a path change, Corollary1 final suffix nodes converge first, then orders nodes by last path-change time to construct one-choice-per-node RPVP execution. Theorem2 extends any partial execution consistent with a target convergence by induction on final path length. Its purpose is preservation of converged states under pruning; it does not justify choosing an arbitrary enabled node without a genuine determinism/independence condition. PEC trie includes advertised/route-map/static prefixes and retains original prefix lengths inside each region because route selection/filters depend on lengths. Control plane is run per original prefix and results combined into FIB for a PEC. This separation restricts aggregation: exact-match route maps on an aggregated prefix may not apply to modeled specifics. Equivalence is conditional on all modeled packet distinctions appearing in configuration extraction, not a theorem over arbitrary headers/application state. Cross-PEC dependencies from recursive routes/iBGP are grouped by strongly connected components. Dependencies run first, save all converged outcomes plus nondeterministic choices in memory-backed files; dependents read them. Failure choices are coordinated across PECs. Protocol-timing correlations are not fully coordinated: combining independently reachable outcomes can yield infeasible joint states and false-positive policy violations. Authors call this unlikely in typical deterministic recursive OSPF, which is an empirical expectation rather than a general guarantee. Policies are arbitrary Boolean functions of a single PEC converged FIB, with optional source/interesting-node information enabling reductions. Equivalent states have equal source-path lengths and same interesting nodes in same positions. Omitting these annotations conservatively assumes every node. Reachability/waypoint/loop/blackhole/path-length/multipath-consistency are implemented; path-consistency additionally inspects control plane. Multi-PEC policies are proposed but not performance-evaluated; transient policies out of scope. Consistent-execution pruning abandons a path if any node must change its selected route; Theorem1 ensures at least one retained execution per convergence. Deterministic-node heuristic must only label a choice deterministic when no reachable convergence would change it. OSPF uses cached shortest paths ordered by distance; BGP uses conservative localpref/ASpath/IGP bounds. Missing deterministic nodes costs performance; falsely identifying one risks coverage. Decision independence uses already-fixed intervening nodes; failures are strictly ordered. Policy pruning can stop once source nodes make final choices. Stronger influence pruning is only implemented for single-prefix PECs and disabled when other PECs depend on that class, because non-source routers may affect recursive reachability. Failure symmetry groups device/link equivalence classes, isolates interesting nodes, refines after each failed-link choice, and runs on original topology. It is disabled for cross-PEC dependencies; it is distinct from Bonsai whole-network compression. Exact route-entry interning stores immutable routing entries once in a hash table and keeps64-bit pointers in per-state copies, reducing repeated memory. This is not the optional SPIN bitstate Bloom-filter exploration: bitstate can skip unseen states due to collisions and miss violations. Figure9 reports estimated coverage>99.9% from SPIN statistics, not a formal exhaustive guarantee. Bitstate was disabled in all other experiments. Printed Algorithm1 assumes meaningful invalid(bottom/empty-path) predicates and nondet selection from a nonempty best-peer set. If an invalidated node has no acceptable alternative, resetting to bottom leaves no update to select; a guarded empty-update case is needed for a literal executable formulation. Implementation/external formal semantics not inspected, so record as specification detail rather than reproduced bug. Theorem2 proof has minorN/N-prime wording slips; intended construction is to finish shorter paths then longer ones. Prototype373Promela/4870C++LOC excludes SPIN. Ubuntu16.04,3.4GHzIntelXeon,32hardwarethreads,188GBRAM. Handcrafted tests cover shortest paths,nondeterministic convergence,redistribution,recursive routing,stable-path examples andBGPwedgies; no test-case counts/seed/repetition/confidence intervals or independent proof certificate checker supplied. Matched policy outcomes with Minesweeper when both ran are useful differential tests, not proof of full abstraction/implementation correctness. OSPF synthetic equal-weight fat trees originate prefixes at edge switches; static core routes create loop-pass and loop-fail variants. Plankton uses1–32cores; Minesweeper defaultCPU fluctuates1–16cores. Plankton faster even1core on tested sizes, but compute budgets are not uniformly identical. Minesweeper timesout4h at500devices and at245forpassing loop checks; larger cases not run. At2205devices Plankton uses~170GBper process; claim ncore linear speed/memory scaling is an expectation under identical independent PECs, not benchmarked at that memory footprint. BGP fat-tree waypoint tests use RFC7938-like routing, random acceptable aggregation-waypoint subsets and deliberately disabled multipath/missing steering to expose age-based ties. All are counterexample searches; early stopping matters. Worst reported times<2s including320nodes; Figure7c extends beyond the245device example in prose. Fast selected violation checks do not show exhaustive enumeration of all stable outcomes in large nondeterministic networks. Semi-synthetic RocketFuel AS topologies use real OSPF weights and random ingress withdegree>1; check all destinations under any single-link failure and find a violation in every case.16/32core results can coincide because a violation is found in first PEC batch. iBGP-over-OSPF tests evaluate dependent loopback PEC handling, unlike independent shortest-path cases. Minesweeper network-copy encoding sometimes>300times larger; this is authors’ explanation for speed difference, not universal SMT limitation. Bonsai comparison measures verifier time after preprocessing; preprocessing time is not included in those plotted comparisons. Bonsai cannot preserve supported policies under link failures and current implementation does not support loop policy, so these tests use separate settings. ARC comparison uses0/<=1/<=2failures,8Planktoncores versusARCdefault1–6cores. Plankton wins most rows but loses at2failures for both AS rows (106.57vs38.83s and155.28vs46.52s); resiliency scaling degrades materially. Ten real configuration sets fromthree organizations include Stanford, with sizes52/63/71/63/36/2/30/30/3 andStanford count not specified in Figure7h. Allbutone use recursive routing; dependency SCCs are singleton though selfloops exist; observed nondeterminism only failurechoice. This selected sample does not establish general real-network determinism. Minesweeper comparison unavailable due parser incompatibility, Stanford fails after parsing. Reported advantage over earlier similar-size benchmarks is indirect, not same-input head-to-head. Figure7i real networksII/III/IV,18checks,32cores:8.79–29.81s and2.31–2.88GB acrossloop/multipath/pathconsistency with0/<=1failures. Contrast with Figure7h single-core policy checks. Correctness results for individual real policies are not tabulated in these panels; do not invent deployment bugs or counts. Ablations show reductions not uniform: disabling deterministic-node detection AS1221iBGP improves27.54→25.43s withsimilar memory because other POR compensates; disabling it or policypruning in20nodeBGPDC changes46ms to>5min. For245nodeOSPFFatTree disabling failure-equivalence changes4.297→64.97s,1908→72862MB. Optimization summary4.95–24968timesstate-space reduction has no percase explored-state table; preserve authors’ claim separate from independently derived timing ratios. No Verus, verified Rust, TLA+ or LLM-agent study. Formal contribution is a hand-proved reduction and concrete SPIN-based finite configuration analysis; correctness still assumes abstraction/extraction/heuristics/toolchain fidelity. Claims about competitors are evaluated only in stated configurations/versions and not independently reproduced for this record.
  • how much was read: most of it read
  • source
  • record id: plankton-scalable-network-configuration-2020
• Presburger stage graphs (2020)
  • title: Checking Qualitative Liveness Properties of Replicated Systems with Stochastic Scheduling.
  • what: Develops Presburger stage graphs for sound and complete verification of stable-termination/liveness properties of replicated systems with an unknown number of indistinguishable agents and stochastic scheduling. A stage graph is a finite DAG of inductive Presburger configuration sets with ranking certificates. The authors give a decidability/completeness result, an incomplete practical constructor using Z3, well-quasi-order and Petri-net techniques, and evaluate it on population protocols, leader election and mutual exclusion. The paper formalizes replicated systems as 1-conservative Petri/VAS-style multiset rewriting and assumes a scheduler whose transition probabilities depend only on the current configuration and are nonzero for every enabled transition. Proposition 2 characterizes fair-run progress by ranking certificates; Proposition 3 and Theorem 2 establish stage-graph soundness/completeness, while Theorem 3 reduces candidate checking to Presburger satisfiability. Algorithm 1 starts from a potential-reachability overapproximation, computes eventually dead transitions (linear ranking or layer functions), and splits stages when needed. Exact dead-state sets are computable via backward reachability but can be doubly exponential; the practical procedure is incomplete. Z3 experiments build mostly chains of at most three stages (five for approximate majority), verify infinite families of protocols, and produce independently checkable invariant/ranking certificates.
  • number: Z3 implementation on Intel Xeon E5-2630 v4 2.20GHz, 8GB RAM
  • number: timeout 1 hour; most stage graphs ≤3 stages, approximate-majority graphs 5 stages
  • number: fast-majority instances up to m=21,d=1: 466s; m=21,d=20: 3301s (timeouts shown)
  • number: flock-of-birds c=80: 1217s; threshold c=8: 1089s; remainder m=20: 1646s
  • limits: Systems are finite-state agent programs with fixed population size per run, clique-style rendezvous/multiway transitions, and stochastic scheduling satisfying the two stated probability assumptions. The complete decision problem has non-elementary complexity; the implemented constructor may fail or time out and uses existential Presburger formulas/linear certificates. Population-protocol families are checked instance by instance, not universally over the family parameter. The method addresses qualitative almost-sure stable liveness, not quantitative probabilities, arbitrary fairness notions, Byzantine faults, or Rust implementation details.
  • how much was read: most of it read
  • source
  • record id: presburger-stage-graphs-2020
• PRISM-games 3.0 (2020)
  • title: PRISM-games 3.0: Stochastic Game Verification with Concurrency, Equilibria and Time.
  • what: Describes PRISM-games 3.0, adding concurrent stochastic games (CSGs), social-welfare-optimal Nash-equilibrium properties and turn-based probabilistic timed games. The release extends model/property languages, value-iteration and game-solving engines, and strategy synthesis, with security, networking, robot and scheduling case studies. CSG models associate players with modules whose actions are chosen simultaneously; joint labels and joint probability distributions express interference and rewards. rPATL gains instantaneous rewards and coalition syntax for zero-sum and equilibria objectives. Zero-sum solving uses value iteration plus per-state matrix-game linear programs; equilibria solving uses bimatrix games, labelled polytopes, SMT solvers and dominated-strategy elimination, yielding finite-memory strategies and only ε-Nash guarantees for unbounded properties. Timed games use digital-clock translation to discrete-time TSGs.
  • number: robot coordination: 159,202 states and 10,765,010 transitions; 114.5 s zero-sum, 1,080 s SWNE
  • number: future markets: 1,398,441 states/7,374,616 transitions; 1,030 s zero-sum; 13,110 s equilibrium
  • number: user-centric networks: 2,993,308 states; 1,061 s
  • number: Aloha equilibrium model: 3,334,681 states; 3,129 s
  • limits: CSG verification uses explicit-state Java engines and numerical value iteration, so convergence and floating-point accuracy matter. Exact Nash equilibria may not exist; unbounded synthesis is ε-Nash. CSG costs are driven by action choices and repeated matrix-game solves. Timed support is turn-based only; digital clocks can expand states with time bounds. Multi-coalitional, partial-information and concurrent timed games remain future work.
  • how much was read: most of it read
  • source
  • record id: prism-games-3-0-2020
• Quantum certificates for replica equality (2020)
  • title: Brief Announcement: Distributed Quantum Proofs for Replicated Data
  • what: Announces a distributed quantum Merlin-Arthur protocol that certifies equality of replicated n-bit data using logarithmic-in-n quantum certificates and one neighbor-communication round, contrasting classical linear certificate lower bounds. §1 defines local certificate checking: legal states admit certificates causing all nodes to accept; illegal states must make some node reject regardless of certificates. It explains the distant equality case using Alice and Bob at path endpoints, and distinguishes randomized dMA from deterministic proof-labeling. §2 states the informal main result for t terminal strings in a graph with radius r = min_i max_j dist(u_i,u_j): per-node certificate size O(tr^2 log n) qubits and messages O(tr^2 log(n+r)) qubits in one round. Honest equal-instance certificates retain their quantum nature and can be reused after local relocation. The classical comparison already applies for two terminals on a four-node path, even when neighbor communication is allowed multiple rounds. This short publication states results and context but delegates protocol details, precise classical lower bound and proofs to arXiv:2002.10018.
  • number: certificate O(tr^2 log n) qubits
  • number: message O(tr^2 log(n+r)) qubits
  • number: one round of neighbor communication
  • number: classical certificates Omega(n) bits; lower-bound example t=2, four-node path
  • limits: This is a quantum communication/certification model, requiring quantum states, exchanges and local computation. Acceptance is a probabilistic completeness/soundness notion, but this announcement does not give explicit error constants or the detailed proof. The exponential advantage is in data length n, holding replica count t and terminal radius r comparatively small; costs grow polynomially in t and r. Reusability is promised for legal equal-data instances; illegal instances may consume/discard certificates and need recovery/reassignment. Checking one distributed configuration does not prove correctness of the application maintaining it, crash recovery, consistency under writes, or a deployed implementation.
  • how much was read: most of it read
  • record id: quantum-certificates-for-replica-equality-2020
• Reasoning over Permissions Regions in Concurrent Separation Logic (2020)
  • what: Introduces SLLP, an extension of concurrent separation logic for fractional permissions over arbitrary shared regions. It combines strong and weak separating conjunctions with nominal labels and a jump modality to recover permission distribution and recombination principles without precision side conditions. The paper diagnoses failures of weak separation on imprecise predicates, formalizes a permissions algebra and p-heap semantics, proves algebraic entailments for the two separating connectives and labels, and gives three worked CSL proofs: parallel read, recursive tree processing, and channel-based cross-thread transfer. The transfer proof shows how labels and magic wands recover full ownership after a subtree is sent and modified.
  • number: Proposition 4.1 algebraic laws
  • number: Lemma 4.2 weak/strong distribution
  • number: Lemma 4.3 permission distribution for strong separation
  • number: three worked verification examples
  • limits: Uses a fixed permissions algebra satisfying associativity, commutativity, cancellativity, non-zero, top, divisibility and distributivity axioms; p-heaps are finite and predicate interpretations are supplied externally. Examples use binary-tree predicates and simplified channel rules. The strong frame rule requires a syntactic condition that commands do not receive resources; automation and tractable fragments remain future work.
  • how much was read: most of it read
  • record id: reasoning-over-permissions-regions-2020
• REVEL (2020)
  • title: Neurosymbolic Reinforcement Learning with Formally Verified Exploration
  • what: The five-page official supplement (printed 12–16) is fully read: A safe imitation and Algorithm 3, B definitions/mirror-descent theorem/bias proof, and C ten benchmark descriptions/protocol plus all ten Figure 6 panels. The original 12-page main-paper reading and reported tables/results are inherited, with a targeted fresh check of main PDF page8. REVEL combines a verified symbolic fallback with neural exploration and periodically resynthesized shields. New material fills in evaluation budgets and five seeds, while exposing a gap in the printed bias proof. This gap concerns the convergence argument; it does not by itself refute invariant-based shielding safety.
  • limits: Inherited safety conditions: sound closed-form worst-case transition overapproximation, an already safe shield/invariant containing initial states, monitor membership checking and fixed unsafe set. Guarantees are relative to this model and bounded time horizon. A safe-parameter search must return a set containing the current controller and only safe controllers over chi; abstract interpretation must be sound. Projection into S preserves safety only under these premises. The text says trimming continues until verified, with no demonstrated termination/complexity bound. B assumes convex J with Lipschitz gradient, bounded policy domain, bounded stochastic-gradient bias/variance, positive action-probability floor, finite-dimensional parameterization, strong convexity/smoothness of R and bounded approximate-projection error. These restrictive assumptions do not certify global optimization of practical nonconvex neural controllers. B also calls H a vector space and H bounded; a nonzero normed vector space is unbounded. Interpret a bounded feasible domain within an ambient vector space if repairing this modeling statement; the PDF does not explicitly make that distinction. The printed covariance estimate leaves a nonvanishing constant before its O(L_J zeta) conclusion. A direct O(zeta) argument would need a uniform bound on the policy-gradient integrand; the displayed proof does not establish the claimed constant dependence. The statement that the gradient of log is bounded above by one is also incorrect as a scalar fact (d log p/dp=1/p). C supplies five independently randomly chosen seeds, interaction/episode budgets, five shield updates and CPO tolerance reduction 25→1. It does not provide a complete neural architecture, learning-rate, optimizer or hardware specification. Figure6 supplies no exact numeric table, aggregation explanation or uncertainty bands.
  • how much was read: most of it read
  • record id: revel-2020
• SAW weakly-hard safety analysis (2020)
  • title: SAW: A Tool for Safety Analysis of Weakly-Hard Systems
  • what: Presents SAW, a tool for infinite-time safety verification of general nonlinear weakly-hard systems under (m,K) deadline constraints. It partitions the safe state region into grids, builds Flow*-based one-step reachability graphs, uses dynamic programming to enforce local safety for all K-step paths with at most m misses, then reverse-searches for the largest inductive safe set. Algorithm 2 labels edges by deadline meet/miss and discards grids whose Flow* overapproximation intersects the unsafe set. Algorithm 3 computes DP(v,n,k) over miss counts and horizon K; Algorithm 4 removes states that can reach the unsafe complement in the K-step graph. The method avoids prior exponential-stability/Lipschitz assumptions and handles nonlinear benchmarks #5/#6. Example 1 and Table 2 show every benchmark initial set contained in SAW safe set while one-dimensional abstraction often returns none or an insufficient set; granularity and Flow* step size materially change conservatism.
  • number: (m,K)=(2,5) example
  • number: p=50 yielded 19,354 one-step edges and safe initial region size 1,622
  • number: benchmark #6 runtime 750.77 s
  • number: p=100 step-size 0.1 runtime 4.713 s
  • limits: Safety is guaranteed for the discretized/overapproximated model; uniform grid resolution p, Flow* reachability precision and sampling period determine conservatism and cost. The (m,K) model bounds misses in every K consecutive executions; controller applies zero input on a miss. Complexity is quadratic or worse in number of grids, and the authors note grid granularity tradeoffs and no probabilistic uncertainty model.
  • how much was read: most of it read
  • record id: saw-weakly-hard-safety-analysis-2020
• Schwarzweller FIELD_5 renamings Kronecker 2020 (2020)
  • title: Renamings and a Condition-free Formalization of Kronecker’s Construction
  • what: Schwarzweller removes an inherited polynomial-disjointness restriction from the formalized Kronecker root-adjoining construction. The article analyzes why one concrete extension representation fails to preserve disjointness,proves a stronger disjointness invariant for another representation,and transports field operations to fresh set-theoretic names. It concludes that every nonconstant polynomial over any field has an extension containing a root and an extension where it splits,without the earlier carrier-disjointness premise. Records precise model-dependent failure and preservation results,linear-case equality versus isomorphism,strong disjointness quantifying over every ring,and the explicit operation transport via an injective renaming. Distinguishes removal of an accidental representation premise from removal of algebraic assumptions or axiom-of-choice dependencies. Separates existence of a splitting extension from minimality,a computable algorithm or algebraic closure.
  • limits: MML FIELD_5 version8.1.10 5.63.1382 identifies the article. The Summary defines polynomial-disjoint fields bycarrierF∩carrierF[X]=empty and reports this premise in earlier formalizations. This is about the set-theoretic representations of elements,not the usual abstract fact that scalars embed as constant polynomials. The author explicitly states that this formalization of renaming existence relies on the axiom of choice;the paper does not establish that choice is logically necessary for every possible disjoint-copy construction (p.129). Results1–7 provide set/natural arithmetic compatibility facts and a stated meeting relation betweenN and2^N;the imported ordinal/set exponent conventions are not independently audited. Result8 supplies an object outside any set. Results9–11 concern cardinalities:9has a disjointY with|X|≤|Y|,10selects a subsetZ⊆Y equinumerous withX under|X|≤|Y|,and11produces a disjoint equinumerous copy. Missing double bars in raw extraction do not meanX⊆YandX∩Y=empty or literalX=Y (p.130,rendering). Results12/13 relate subfields,subrings and the field predicate. For an extension towerF⊆E⊆K,14embedsVecSp(E,F) as a subspace ofVecSp(K,F);15eitherKhas infinite degree overF orEhas finite degree anddeg(E,F)≤deg(K,F). Result16boundsdeg(p modq)<degq for nonzeroq over a field. These are infrastructure,not a theorem that the final splitting extension is minimal or has a stated finite degree bound (pp.130–131). Definition1means linear polynomial degree exactly1. Registrations over fields give linear polynomials roots/irreducibility and make nonlinear polynomials with roots reducible;over an integral domain a linear times nonconstant polynomial is nonlinear. These are typed ring/field/domain claims;the record does not generalize them to arbitrary degenerate rings or zero-divisor coefficient rings (p.131). Definition2canHomP(p):F→PolyRing(p) maps scalars to constant polynomials,for nonconstantp,and registers an injective unital ring homomorphism. For polynomial-disjointF and irreduciblep,the embedded field using that map is an actualF-extension. Definition3transports a priorKrRoot through inverse isomorphisms,and17shows its extended evaluation underp iszero. The proof invokes earlier quotient/polynomial homomorphism identities rather than reproving them (pp.131–132). Results18–21analyze linearp:both the reduced-polynomial modelPolyRing(p) and the quotient-ring modelF[X]/(p) are isomorphic toF;their embedded extensions have the same carrier asF. Literal field equality in19/21additionally requiresstrictF. Isomorphism of abstract fields is weaker than equality of their carriers/records (p.132). Result22assumes polynomial-disjointF and irreduciblep and proves the extensionembField(canHomP(p)) is polynomial-disjoint iffpislinear. Thus for degree>1 this particular reduced-polynomial representation cannot preserve the invariant required for the old construction’s next step. It does not say the abstract field extension is invalid or that adjoining roots is mathematically impossible (p.132). Result23says if the quotient-model embedded extension is polynomial-disjoint,then the base field must be polynomial-disjoint. Results24/25show carrier disjointness of the base and quotient model for prime residue fieldsZ/n andQ and nonconstantp;irreduciblepregistrations make their embedded fields polynomial-disjoint. Primality is essential for the field scope ofZ/n,not an all-moduli field claim (p.133). Definition4strengthens disjointness:each elementa ofR differs from every polynomialp over every ringS,not merely every polynomial overR. Registrations give this for the standard integer,rational,real and nontrivial modular ring representations,and state both strong and nonstrong fields exist. Result26preserves this stronger invariant forE=embField(embedding(p)) whenFstrongly disjoint andpirreducible (p.133). Definition5Renaming(X,Z) assumesnonemptyX,exactdomainX,injectivity andrange disjoint fromX∪Z. Renaming is not just changing printed variable names;it moves every underlying element to a fresh object outside a specified forbidden set. Result27makes its inverse ontoX;the function is a bijectionX→range by its exactdomain/injectivity (pp.133–134). Definitions6/7transport operations onto the fresh range by r(r^−1(a)+r^−1(b)) and r(r^−1(a)r^−1(b)). Definition8RenField usesrange,those operations,andr(0),r(1);registrations establish all field laws. Result28gives an additive,multiplicative,unital bijective inverseRenField→F. Result29therefore gives an isomorphic fieldEwhose carrier avoidscarrierF∪Z. Disjointness concerns carriers;the fields remain algebraically equivalent (p.134). Results30/31assume only fieldF and nonconstantf∈F[X],with no polynomial-disjoint premise and no irreducibility assumption onf. Result30gives anF-extension containing a root;31gives anF-extension wherefsplits. “Condition-free” removes the earlier representation condition;it does not remove being a field,nonconstancy,the ambient foundations or the reported choice dependency (p.134). The31sketch introduces a degree-indexed predicate universally quantifying over fields and nonconstant polynomials,states the linear base case and all positive degrees,and choosesdegf. It does not display the detailed induction step. Standard reconstruction,not a printed full proof:adjoin a root of an irreducible factor,divide out a linear factor and continue with smaller degree while transporting representations. No exact renaming sequence or full dependency proof is independently checked here (p.134). Final31asserts existence of an extension wherefsplits,not that the chosen extension is generated by its roots or is the minimal splitting field. No uniqueness up toF-isomorphism,separability,normality,finite degree bound,algebraic closure ofF,canonical names or executable polynomial-factorization/root algorithm is stated in30/31 (p.134). Reading example,not printed:overQwithf=X²−2,an abstract extensionQ(sqrt2) supplies roots and splitting. Result22says the reduced-polynomial embedded representation for this irreducible quadratic loses polynomial-disjointness;the quotient model’sQ/strong-disjointness results avoid that obstacle. The distinction is representation and proof reuse,not whetherQ(sqrt2)is a valid field. All seven pages,sixsections,eight definitions,31results/all clauses/supplied sketches,registrations,ten references/date read;both sheets and enlarged p.130 inspected. Quotations retain raw extraction,not visual formulas;cardinalities,constant-polynomial notation,quotients/exponents/inverses are distorted. This reading did not execute formal artifacts. The paper reports no runtime,proof-size,automation or empirical benchmark,and no distributed/Verus/Rust/TLA+/LLM-agent experiment.
  • how much was read: most of it read
  • source
  • record id: schwarzweller-field-5-renamings-kronecker-2020-2020
• SMC HyperPCTL* (2020)
  • title: Statistical Model Checking for Hyperproperties
  • what: Extends probabilistic hyperproperty logic with HyperPCTL* and supplies sequential-probability-ratio-test algorithms for statistical checking on discrete-time Markov chains. HyperPCTL* adds explicit path quantification, arithmetic over probabilities, nested probability/temporal operators, and a multidimensional indifference region. The algorithms identify worst-case boundary hypotheses for composite tests, compose errors for nested operators, and use SPRT to guarantee chosen false-positive and false-negative bounds.
  • number: αFP=αFN=0.01; average worst-case execution time under 30 s
  • number: GabFeed violations found with confidence 0.99
  • number: noninterference runs: 0.49–7.10 s for N=20–100 and δ=.01/.001
  • number: dining cryptographers: 0.14–3.27 s, accuracy 0.98–1.00
  • limits: Statistical guarantees require an indifference region excluding probabilities near each threshold. Case studies use finite sampled traces, 100 runs per task, and DTMC models; one observed accuracy exception is attributed to sampling error. Exhaustive HyperPCTL* checking and timed hyperproperties are future work.
  • how much was read: most of it read
  • record id: smc-hyperpctl-2020
• Theorem Proving for CPS (2020)
  • title: Formal Verification of Cyber-Physical Systems using Theorem Proving
  • what: Survey of theorem-proving approaches and case studies for CPS functional, probabilistic, performance, dependability, hybrid, and physical-component analysis. Maps HOL4, HOL Light, Isabelle/HOL, Coq, PVS and KeYmaera to CPS analysis domains, summarizing formalizations of optics, quantum circuits, software kernels, transforms, reliability, Markov chains, robotic systems, and hybrid differential invariants. It contrasts theorem proving’s sound mathematical reasoning with discretization and numerical limitations of model checking.
  • number: Table 1 is a capability matrix across six theorem provers and nine analysis categories; no aggregate runtime or accuracy benchmark
  • number: survey cites seL4 safety/no-crash proofs and numerous component case studies but reports no new measurements
  • limits: This is a literature survey rather than a new verification algorithm or controlled benchmark. Coverage depends on existing libraries and case studies; the survey notes only KeYmaera is dedicated to hybrid systems and calls for richer libraries that combine continuous and discrete dynamics.
  • how much was read: most of it read
  • record id: theorem-proving-for-cps-2020
• Tiramisu: Fast Multilayer Network Verification (2020)
  • what: Tiramisu verifies distributed routing configurations by building multilayer graphs of routing processes, VLANs, physical links and route attributes. It chooses a policy-specific algorithm: path-vector simulation for actual path selection, integer linear programs for quantitative path metrics, and graph traversal for potential path existence. A Yen-based accelerator avoids enumerating some failures. The paper gives conditional handwritten correctness arguments and performance comparisons on real and synthetic configurations. Records RAG tainting and TPG construction, L2 contraction, routing-algebra operations and convergence boundary, physical-failure correlation, complete ILPs and TDFS/TYEN listings, ACL repair example, all tables, detailed baseline conditions/core counts, unsupported feature combinations, and qualified printed-formula/listing/proof concerns rather than treating broad speed or correctness claims as universal.
  • limits: §§4.1–4.2: A routing adjacency graph (RAG) is built per destination subnet. Vertices are routing processes and static-route holders; paired edges encode BGP/OSPF adjacency and directed edges encode redistribution. Route-origin vertices are tainted, propagating except across consecutive iBGP edges. This preliminary phase assumes active adjacencies and no filtering; traffic propagation graphs (TPGs) subsequently model those dependencies and filters. §4.2: A TPG is built per source/destination subnet pair. Vertices include process RIBs, per-device VLAN ingress/egress, source and destination. Edges encode physical VLAN-compatible links, L2 flooding, process dependence on L2 or OSPF routes to BGP next hops, and attachments to processes tainted for destination. VRFs replicate process vertices. Parsing/device configuration, topology, protocol settings and concrete advertised prefixes form the trusted input. §4.2: Prefix/neighbor route filters and source/destination IP ACLs prune edges. Other edge labels add/remove/block route tags or carry metric vectors (administrative distance, local preference, AS-path length, OSPF cost). Import/export actions are placed on importing-process outgoing edges. Traffic traverses opposite to route advertisements: blocked-tag information propagates toward tag-adding edges. Shared physical-link variables correlate multiple logical protocol edges under failures. §5.1: Layer-3 TPG contracts L2 paths whenever connectivity exists, combining non-overlapping labels. Routing algebra has signatures, a preference relation, labels, a composition operator and origination signature. Composition and comparison are per protocol: BGP sets local preference, adds AS-path length and uses OSPF tie-breaking; administrative distance mediates protocol choice. Full protocol implementation semantics and parser refinement are not mechanized. §5.1/Algorithm 1/Appendix C.1: TPVP starts destination with origination and other nodes empty, repeatedly composes neighbor paths/signatures and picks locally preferred paths in shared-memory order until paths stop changing. Theorem 1 is conditional on network convergence and supported routing algebras. Lemmas 2–6 argue permitted-path, contraction and ranking correspondence by node/protocol cases, then compare round-robin TPVP to path-vector protocol scheduling. Footnote 4 assumes the algebra has all properties needed for convergence; no general termination theorem for arbitrary configurations. Appendix C.1 qualified proof boundary: The scheduling argument says any ordering leads to a valid solution. That supports a stable solution under its premises; it does not separately establish unique outcomes across multiple stable states or equivalence to every possible concrete convergence schedule. Do not infer universal deterministic path selection from convergence alone without the requisite algebra/uniqueness assumptions. No Verus, Rust, TLA+ or proof-assistant development provided. §5.2/Appendix A: TYEN replaces Yen’s Dijkstra step with TPVP, forms candidates by root/spur perturbations and checks configured preference order. Acceleration requires strictly monotonic path-cost composition. Removing root vertices prevents loops; removing next edges excludes already enumerated paths. Candidate-specific eRemoved tracks these exclusions, not only realizable physical-failure sets. Category-i checks without acceleration may enumerate failures. Appendix A/Algorithm 3 qualified listing concern: The prose chooses the shortest candidate, but line 23 appends to the end of listB and line 26 removes its first entry. No sorting or priority-queue operation is printed. A FIFO list can choose a worse earlier spur candidate before a better later one. This is a discrepancy in the printed listing; the implementation was not executed or inspected to establish a tool failure. §6.1/Appendix B.1: KFAIL means reachability with strictly fewer than K physical-link failures. The ILP minimizes failed physical links, represents traffic reachability/propagation and reverse-flow blocked tags, ignoring irrelevant cost preferences. Theorem 9 is stated for no ACLs. Logical AND/OR are said to be expressible as ILP constraints; actual solver encoding/refinement and external solver correctness are trusted. Appendix B.1/Table 2/Eqs.4–5 qualified printed-formula defect: oNodes excludes both src and dst; Eq.4 constrains reachability only on oNodes, and Eq.5 constrains propagation only for edges entering oNodes. Rdst=0 therefore has no connection to incoming traffic. On a connected tag-free graph the literal formulas admit zero failures with Rdst=0. An incoming-flow/destination-reach constraint is needed. Theorem 9 proof invokes Eq.4 at dst although its quantifier excludes dst. This is about the published encoding, not an executed artifact counterexample. §6.1: ACLs can drop data while route advertisements still attract it. Authors explicitly show pruning an ACL path can overestimate resilience: P1 preferred to ACL-blocked P2 preferred to P3, all edge-disjoint; one failure of P1 causes a drop, whereas pruning P2 yields apparent min-cut two. Repair computes N for graph disconnection and L for choosing an ACL path, returning min(N,L). TYEN finds the first ACL path M, keeps the union of preceding M−1 paths, and min-cuts it for L. §6.1 qualified ACL proof boundary: Cutting the union of earlier preferred paths is not explicitly constrained to keep the first ACL path available; a shared cut might remove that path too. The paper does not separately prove that only the first ACL-bearing path suffices for arbitrary overlaps. Treat this reduction as needing a preservation/completeness argument, not a reproduced failure. §6.2/Appendix B.2: BOUND maximizes selected inter-device edges with unit source output, unit destination input, internal flow conservation and tag constraints. The text uses length ≤ K although Table 1 prints length < K. Equal Bound changes the objective to minimum length and compares extrema. No separate end-to-end mechanization proves ILP soundness/completeness. Appendix B.2/C.2 qualified printed-formula defect: Unit endpoint flow and internal conservation allow a valid src–dst path plus a disconnected directed cycle, all selected edges equal one. Maximizing their sum counts the cycle as additional path length. The printed constraints have no connectivity or subtour elimination condition. Theorem 10 proof incorrectly assumes every invalid selected flow must have an unbalanced node; a cycle is balanced. No implementation failure claimed. §7/Algorithm 2/Appendix C.3: TDFS first checks raw disconnection, then reachability with blocking edges removed, then blocking-edge-to-destination reachability with adding edges removed, then blocking/adding pair connectivity after removing tag-removing edges. Theorem 13 uses four path cases and claims exact always-unreachable classification. Supported tag treatment excludes multiple tags affecting the same destination. Description claims a constant number of DFS calls, while pair checks in the listing can scale with tag edges. Algorithm 2 line 7 qualified generic-listing concern: It searches from any blocking edge to dst without requiring a compatible prefix from src to that edge. A graph with sole src path s→b1(block t)→a1(add t)→d and an unrelated source-unreachable branch x→b2(block t)→d passes this check via b2 although the src path is blocked. A source-relevance invariant or prefix check is needed for the generic listing. Realizability under every TPG construction invariant is not proved here; no network or artifact test executed. §7/Appendix D: Waypoint checks remove the waypoint then test reachability; waypoint-chain checks remove nodes for each waypoint and search between preceding/following chain nodes. Multipath consistency retains multiple best signatures and compares best-path counts with/without ACL pruning. Blackhole checks consider ACL-attracting routers or static next hops without destination reachability. These inherit graph/model/algorithm assumptions; no arbitrary temporal or transient-routing property language. §9/Appendix C.1: Concrete external advertisements only; no existential/universal symbolic advertisement search, control-plane equivalence or quantitative prefix-count policy. IP-based ACLs only; port/protocol ACLs, ACLs affecting routing advertisements, community groups/AS-path filters and multiple tags affecting one destination are outside coverage. iBGP route deflection and local preferences/tag filters assigned to received iBGP routes cannot be modeled correctly; Appendix C case iii-d explicitly states this. §8: Real universities include VRF/VLAN and cannot be modeled by compared tools in that evaluation. Real datacenter and synthetic Zoo/Rocketfuel inputs support different feature subsets; no single baseline comparison covers all claimed generality. Plankton uses 32 cores versus Tiramisu one core. Baseline versions, complete runtime distributions, memory totals, seeds and confidence intervals are not given. No new real configuration bug yield or correctness differential count reported. §8: Results are author measurements: median over 100 runs for 100 different traffic classes, standard-deviation bars. This wording does not clearly establish 100 repeated trials per class. Faster per-policy verification does not quantify coverage of unsupported constructs or correctness of the published formulas. Abstract <2.2 s on large networks and Zoo <0.12 s refer to different described workloads; retain both rather than silently equating them. §8.3 calls one failure k=1 despite the strict <K convention elsewhere.
  • how much was read: most of it read
  • source
  • record id: tiramisu-fast-multilayer-network-2020
• Tjandraatmadja et al Cut-to-Verify affine-input ReLU hull2020 (2020)
  • title: The Convex Relaxation Barrier, Revisited: Tightened Single-Neuron Relaxations for Neural Network Verification
  • what: The authors convexify the graph of an affine map followed by ReLU over a box in the original input/output coordinates. This yields stronger single-neuron bounds than convexifying only the scalar ReLU input. They state an exponential inequality description with linear-time separation, and use selected inequalities in propagation and cutting-plane verifiers. Seven MNIST/CIFAR-10 network settings show higher certification counts than their baseline implementations. Newly read official Appendices A–F provide both hull proofs, linear separation proof, propagation algorithms/complexity, a four-ReLU worked example, explicit approximate-problem numerical preprocessing and additional across-network experiments. New findings and display inconsistencies are preserved in diagnostics. Records the precise single-neuron domain, exact-hull versus finite-cut distinction, rational-data complexity assumption, newly recovered full proof appendices, practical one/three-iteration settings, all Table 1 counts/timings, altered convolutional networks, attack-count meaning and two visibly inconsistent mathematical displays. Separates mathematical enclosure arguments from numerical implementation soundness.
  • limits: The target is a fixed finite feedforward ReLU network, including possible skip connections, with learned weights/biases held fixed. A query maximizes a linear functional c·f(x) over a specified polyhedron X and asks whether the maximum is at most β. A sound overapproximation gives an upper bound: success proves the modeled inequality, while failure can be inconclusive rather than a counterexample (§2). The conventional triangle relaxation is the convex hull of scalar (preactivation, postactivation) pairs. It drops relationships between individual inputs to the affine preactivation. Their graph S={(x,y):L≤x≤U,y=max(0,w·x+b)} retains those coordinates and substitutes away the preactivation variable. The bounds L,U must enclose all true preceding activations; invalid box bounds would invalidate the certificate (§§2.1/2.2/3). Theorem 1 characterizes the tightest convex hull of one affine-plus-ReLU graph over a box with coordinatewise L<U. Sign-adjusted endpoints handle negative coefficients. The stable positive case gives y=w·x+b; the stable negative case y=0; otherwise lower inequalities y≥0,y≥w·x+b accompany the family of upper inequalities 6b. The number can be exponential in nonzero weights d, not merely total neuron count. This is a local hull, not the exact convex hull of an entire network (§3). Proposition 1 is an existence result: for every input dimension there are affine data and an input where the additive upper-bound gap between triangle and the new hull grows Ω(n). It does not promise that gap on every neuron or a dimension-independent multiplicative gain. Newly read Appendix B gives a short proof via the earlier example (§3). Separation either confirms membership in this local hull or finds a violated inequality. The displayed sorting procedure costs O(n log n); Proposition 2 states an O(n) routine. Corollary 1 invokes separation plus ellipsoid for rational network weights/biases and polynomial encoding complexity. The proofs and faster weighted-median method in Appendices A/B are now read; the implementation description chooses sorting instead. The practical dual-simplex implementation explicitly has no polynomial worst-case runtime guarantee (§3/§5.1). The prior ideal lifted MIP relaxation projects to the same local convex hull, according to the paper. The new description avoids one auxiliary variable per intermediate neuron and directly fits propagation in original coordinates. It does not establish a strictly stronger hull than that lifted formulation (§3). Proposition 3 assumes affine lower/upper functions enclose every true activation over X; optimizing the resulting relaxed system upper-bounds the true objective. Backward substitution chooses a bound by the changing objective coefficient, then solves the remaining input LP. For a box this is coordinatewise. The forward pass reconstructs an optimizer of the relaxed affine-bound problem using those selected bounds, not necessarily a feasible trajectory of the true ReLU network (§§4.1/4.3). In §4.2 p.6, the printed stable-case order is reversed: Uhat≤0 is paired with the affine value, and Lhat≥0 with zero, respectively. For ReLU these must be zero and affine. This was visually verified. It contradicts the definition and correct stable cases in Theorem 1; it is not evidence that the source implementation has the same error. The p.6 scalar-lower-bound formula also uses C^(L,i) without locally defining it. No missing definition was silently supplied. The nontrivial triangle formulas apply only for lower preactivation<0<upper preactivation, as footnote 6 says. Fast-Lin uses a shifted parallel lower line; DeepPoly/CROWN-Ada choose lower zero or affine according to triangle area. Dynamic updating replaces an upper affine function with a violated 6b inequality. Replacement is not accumulation and need not improve every iteration, so the algorithm retains its best bound (§§4.2/4.3). Practical FastC2V initializes from DeepPoly/CROWN-Ada and runs one iteration. Practical OptC2V starts from the triangle LP, adds a most-violated cut for each predecessor, performs three separation rounds, and regenerates cuts for every bound. Three rounds do not imply solving the complete exponential hull LP to exact optimality. Both methods keep the better of computed and interval bounds (§5.1). The local DeepPoly baseline is their sequential implementation with a best-of-interval modification; it differs from the cited original. LP solves the conventional triangle relaxation. RefineZono and kPoly results are imported from the earlier paper, whose timings are explicitly said possibly incomparable. No controlled comparison of identical implementations across all methods is supplied (§5.1/5.2). The intended robustness property is: every pixel vector inside the clipped L∞ box around a correctly labeled image has target logit strictly larger than every rival logit. The displayed formula p.8 instead maximizes over all k∈K, including target t, then requires a negative maximum; its self-margin is zero, so that display cannot hold. The next sentence correctly uses k≠t. This is a visible formula inconsistency, not an independently established code defect (§5.1). ERAN settings: non-adversarially trained MNIST fully connected 6×100 and 9×100 at ε=.026, 6×200 and 9×200 at ε=.015; non-adversarial MNIST ConvSmall, three layers, ε=.12; MNIST ConvBig, six layers, DiffAI training, ε=.3; CIFAR-10 ConvSmall, three layers, PGD training, ε=2/255. They examine first 1,000 test images excluding originally incorrect classifications. The eligible denominator need not be 1,000 for each model (§5.1). Appendix E reports unstable convolutional LPs and sets any weight or generated bound below 10^-5 to zero for LP-based methods. It reports Gurobi feasibility/optimality tolerances 10^-6 and explicitly admits solving an approximate rather than exact problem. There is no error-transfer certificate connecting this modified problem to unchanged original-network verification. Therefore the inherited convolutional certification counts retain this qualification even though the mathematical local hull is exact. Reading this implementation description did not inspect or execute implementation contents. Implementation is C++, Gurobi 8.1 dual simplex, incremental solves, Intel Xeon E5-2699 2.3GHz and 128GB RAM. Supplied pages provide no independent rational certificate checker, proof-assistant encoding or comprehensive floating-point soundness argument. Exact mathematical relaxations do not alone prove numerical implementation soundness; no artifact was independently executed (§5.1). Table 1 column order is MNIST 6×100,9×100,6×200,9×200,ConvSmall,ConvBig,CIFAR-10 ConvSmall. DeepPoly verified counts:160,182,292,259,162,652,359; mean seconds:.7,1.4,2.4,5.6,.9,7.4,2.8. FastC2V counts:279,269,477,392,274,691,390; seconds:8.7,19.3,25.2,57.2,5.3,16.3,15.3. These are per-setting means, not a bound on every image (Table 1). In the same column order, LP counts:201,223,344,307,242,743,373; seconds:50.5,385.6,218.2,2824.7,23.1,24.9,38.1. OptC2V counts:429,384,601,528,436,771,398; seconds:136.7,759.4,402.8,3450.7,55.4,102.0,104.8. RefineZono counts:312,304,341,316,179,648,347. kPoly counts:441,369,574,506,347,736,399. Attack-derived upper counts:842,820,901,911,746,831,482 (Table 1). Reader calculation from Table 1: FastC2V exceeds LP certification counts in six of seven settings; MNIST ConvBig is the exception (691 versus743). OptC2V exceeds kPoly in five of seven; it loses MNIST6×100 (429 versus441) and CIFAR ConvSmall (398 versus399). Both new methods beat their own natural baselines in every listed setting. These are observed counts, not universal method dominance. The prose claims OptC2V takes approximately1.2–2.7 times LP time, but Table 1 MNIST ConvBig gives102.0/24.9≈4.10 and CIFAR gives104.8/38.1≈2.75. The first is a material omitted exception. All FastC2V setting means are below one minute, with maximum57.2s; no per-instance guarantee or confidence interval follows (§5.2/Table1). The upper count uses gradient descent with20steps, learning rate.01,100random starts except10for MNIST ConvBig/CIFAR ConvSmall, validating found attacks. Failure to find an attack is not a proof of robustness. Subject to matching network/domain and valid attacks, number of attack failures upper-bounds the truly robust count, leaving a gap between certification and attack evidence (§5.1). Outlook proposes hybrid algorithms and combination with multi-neuron methods; neither is experimentally implemented here. Their relaxation does not exploit correlations between multiple neurons in the same layer. Broader Impact explicitly distinguishes the formal robustness model from everyday robustness and warns incorrect modeling can give false confidence. Funding Disclosure says no third-party funding (§5.2/Broader Impact). Reader example, not printed: for x1,x2∈[0,1], y=ReLU(x1+x2−1), at fixed x=(0,1), true y=0 and the affine-input hull forces y=0. The scalar triangle over preactivation[−1,1] admits y=.5 at preactivation0. This illustrates information lost by keeping only the summed scalar; it is not a benchmark result. The prior 12-page main reading is inherited. All official Appendices A–F on combined pages13–30 are now fully read, including mathematical statements/proofs, Algorithms1–4, worked example, Figures3–7 and implementation/experiment prose. No implementation contents, scientific artifacts or formal tools were inspected, loaded or run; review/acceptance pending.
  • how much was read: most of it read
  • source
  • record id: tjandraatmadja-et-al-cut-to-verify-affine-input-relu-hull2020-2020
• Two-Layer HLC/SMT Monitor (2020)
  • title: Efficient Two-Layered Monitor for Partially Synchronous Distributed Systems
  • what: Combines an efficient HLC γ-extension filter with an accurate SMT predicate detector. The filter controls false-positive/false-negative trade-offs; the SMT second layer checks only marked windows, yielding constant-size clocks and large monitoring-time reductions for partially synchronous distributed systems. The model assumes bounded clock skew ε but no message-delay bound, and expresses violations as predicates over process variables. ε-extension considers all states within skew to remove false negatives for supported predicates, while γ<ε reduces candidate windows at the cost of recall. The second layer encodes event intervals, causality, skew, and predicate truth as SMT constraints; batching 100 windows amortizes solver calls. Experiments simulate 10 round-robin processes (one million iterations each) and evaluate precision/recall across message probability α, state-true probability β, delay δ, skew ε, and duration ℓ, then test mutual exclusion in time-division multiplexing.
  • number: γ=0.045 setting: precision falls 0.929→0.295 as γ goes 0.1ε→ε while recall rises 0.009→1
  • number: for n=10, δ=10, ε=100, α=0.1: two-layer 3.1 s versus single-layer 81 s
  • number: average cost reduction 90%, minimum 85%; second-layer maximum 2.5 s
  • number: γ=0.25ε example costs 228 ms with false-negative rate 0.627
  • limits: Partial synchrony and known (or estimated) ε are required for the accuracy guarantees; predicate detection remains NP-complete in general. HLC γ-extension cannot handle all predicates and may produce false negatives when γ<ε. The two-layer monitor has perfect precision because SMT filters false positives, but recall is only perfect at γ=ε and runtime may become a bottleneck if the filter marks too many windows. Experiments are simulations and one mutual-exclusion application.
  • how much was read: most of it read
  • record id: two-layer-hlc-smt-monitor-2020
• Unbounded SDE safety (2020)
  • title: Unbounded-Time Safety Verification of Stochastic Differential Dynamics.
  • what: Reduces infinite-horizon probabilistic safety for nonlinear polynomial Ito SDEs to finite-horizon verification. Exponential stochastic barrier certificates give an exponentially decreasing tail bound; time-dependent polynomial barriers and SDP then bound the selected finite interval. Defines the stopped diffusion and infinitesimal generator, uses vector supermartingales and Doob maximal inequality to prove tail bounds, and gives sufficient conditions for time-dependent finite-time certificates. The reduction picks a horizon after which the tail is below any requested epsilon. SDP templates synthesize both certificate types, while matrix exponentials handle vector certificates. The full paper evaluates three examples: scalar population dynamics, a noisy harmonic oscillator and a two-dimensional nonlinear drift system.
  • number: All examples successfully tackled within 30 s
  • number: Nonlinear-drift total bound 0.196593 vs 0.265388 prior method
  • number: Population certificate bound 0.12498/e^T; harmonic oscillator vector bound shown analytically; finite-time plots compare choices of T
  • limits: Drift and diffusion are time-homogeneous polynomial fields satisfying a global Lipschitz condition for unique Ito solutions. Bounds are sufficient probabilistic guarantees, not deterministic invariants; no certificate means no conclusion. SDP is numerical and may be unsound without a-posteriori validation. Results depend on domain, initial/unsafe sets, template degree and chosen matrix parameters. Future work includes controls, convergence with degree and necessary/sufficient conditions.
  • how much was read: most of it read
  • source
  • record id: unbounded-sde-safety-2020
• VerifAI TaxiNet (2020)
  • title: Formal Analysis and Redesign of a Neural Network-Based Aircraft Taxiing System with VerifAI.
  • what: Presents an integrated VerifAI design workflow for an industrial Boeing TaxiNet aircraft-taxiing controller: Scenic models semantic runway environments, active search drives X-Plane closed-loop simulation, counterexamples are analyzed and targeted tests confirm causes, and retraining uses discovered failures. The TaxiNet requirement is expressed in Metric Temporal Logic (MTL). The paper extends Scenic with externally assigned parameters so active samplers can replace fixed probabilistic draws, and implements a VerifAI client/server interface to X-Plane datarefs. In the six-dimensional case study, 4,000 nominal runs found only 55.2% satisfying the eventually-centerline property and 9.1% leaving the runway. Visualization localized failures to dim lighting, cloud/time interactions, runway intersections around 1,450 m, and aircraft shadows; disabling shadows confirmed the hypothesized root cause. Replacing the neural net with ground-truth errors made every counterexample satisfy the property, localizing faults to perception. Generic, Halton, and specialized retraining raised satisfaction to 82%, 83%, and 86%, respectively, and reduced runway departures to 3.9%, 0.6%, and 0.5%; cross-entropy sampling learned a failure-focused distribution, but augmentation experiments sometimes regressed performance.
  • number: ~4,000 nominal falsification runs: 55.2% satisfy eventually property, 9.1% leave runway
  • number: Tgeneric: 82% satisfy, 3.9% leave runway
  • number: THalton: 83% satisfy, 0.6% leave runway (15x departure reduction)
  • number: Tspecialized: 86% satisfy, 0.5% leave runway
  • limits: The study uses a prototype TaxiNet and X-Plane simulation, not a deployed aircraft or exhaustive proof. Search covers a six-dimensional scenario space, 30-second simulations, daylight/weather ranges, and a specified runway; failures outside those abstractions are not assessed. MTL robustness guides search but nonnegative/negative sampled results are not a universal safety guarantee. Retraining leaves a 14% specification-failure rate and depends on training-set size, simulator rendering, and controller/network architecture.
  • how much was read: most of it read
  • source
  • record id: verifai-taxinet-2020
• A Certificate-Based Approach to Formally Verified Approximations (2019)
  • what: HAL provides the referenced related version with both Appendices A/B on one page. These are printed explanatory code/contract listings in the paper, with brief prose, rather than a separate proof narrative. Original main-paper account is inherited: Coq library computes rigorous univariate function approximations as basis coefficients plus interval remainders. Abstract operation/containment structures separate ideal real algebra from interval enclosure propagation. Implements monomial and Chebyshev arithmetic, and validates approximate division/square roots through residual/contraction bounds and Banach fixedpoint theorem. Reports absolute-value approximation and Abelian-integral examples. Records model containment quantifiers, parametricity/proof obligations, interval precision/failure behavior, Clenshaw invariant and Chebyshev range/multiplication, complete-space close versus equality, exact division/square-root certificate inequalities, actual in-Coq oracle deployment, all timing/enclosure values and proof-scope limits. Concrete wrong-oracle and printed stable-ball counterexamples clarify trust and specification boundaries.
  • limits: These appendices state contracts but do not display their proof bodies. No claim of independent Coq proof checking follows. The printed page has notation slips, including p/P/Q, undefined primed mu/radius symbols, and msqrt versus msqrt′. These are observed in the PDF; the repository implementation was not inspected. The HAL page marks this as a related full version, not a publisher-hosted standalone supplementary attachment.
  • how much was read: most of it read
  • source
  • record id: a-certificate-based-approach-2019
• A Process Calculus for Formally Verifying Blockchain Consensus Protocols (2019)
  • what: # Whole-paper read: A Process Calculus for Formally Verifying Blockchain Consensus Protocols (authored by agents unless marked 🧑) Wolfgang Jeltsch; arXiv1911.08033v1,19November2019,16pages. The result is the ♮-calculus, pronounced “natural calculus,” and an Isabelle/HOL theory for reasoning about process behavior. It is infrastructure for a proposed verified Ouroboros implementation. The paper says, “We plan to very soon start using our process calculus for developing a formally verified implementation of the Ouroboros family of consensus protocols.” It does not report that implementation or a consensus safety/liveness proof. [Q0,Q1,Q12] ## Language and execution model A process calculus describes communicating programs and the steps they may take. This one embeds its terms in a functional host language. Higher-order abstract syntax means a binder is represented by a host-language function: Receive takes a function from received data to the remainder process, and NewChannel takes a function from the fresh channel to the remainder process. The host handles variable binding, renaming and ordinary computation. The paper focuses on Isabelle/HOL; it describes Haskell execution and automatic conversion to Isabelle terms as the intended workflow, deferring discussion of that embedding. No verified Haskell translation or runtime correspondence result is supplied here. [Q2,Q3] The five constructors are Stop, Send, Receive, Parallel and NewChannel. Processes are coinductively defined, allowing infinite terms. Examples include forwarding a received value to two channels, forwarding only when the value differs from a given value, and replication represented by p∞=p∥p∞. Send has no continuation. Although the communication rule synchronizes sender and receiver, this restriction makes synchrony unobservable in the stated calculus. There is no explicit nondeterministic-choice constructor; this does not make concurrent scheduling deterministic. Computation, branching and recursion are placed in the host language. [Q3] The calculus permits arbitrary transmitted data, including pairs or lists containing several local channels. Publishing such data can open several channel scopes at once. A single conventional transition rule would then combine sending, scope opening and closing. The paper separates these concerns into two layers. Basic transitions expose opening as its own step. Proper transitions combine opening steps with sending, while receiving and internal communication refer back to basic transitions. The printed one-channel and two-channel publication rules show how this composition works. Some symmetric/general rules and the complete proper-residual datatype are omitted from the exposition, with formalization sources linked separately. [Q4,Q5] A residual bundles a transition’s label with its target process, because a label’s bound channel can also bind occurrences in that target. Thus transitions relate a source process to a residual rather than treating source, label and target as independent entities. Basic residuals have acting and opening constructors; nesting residuals supports later composition. To compare residuals, a lifting operation extends a relation on processes to matching labels and related targets. In the opening case the targets must be related for every channel argument. Bisimilarity then means each process can match the other’s transitions while preserving that relation. [Q5,Q6] ## Generic results and assumptions The main reuse mechanism is to prove transition theory once for an abstract residual lifting operation, then establish its axioms for each concrete residual type. Section3.1 prints preservation of equality, relational composition and converse. These are presented as the laws of a relator, a mapping on types and relations that preserves that structure. This differs from an ordinary Haskell functor on types and functions. Isabelle-generated datatype relators supply the intended concrete instances. The source locale additionally makes monotonicity explicit; the printed three-law presentation and actual locale assumptions should therefore be kept distinct. I do not establish whether that additional law is derivable from the printed ones. [Q7,Q8,S3] Strong bisimilarity matches individual steps. Weak bisimilarity permits internal communication to be ignored. Since the generic residual interface hides labels, the paper introduces silent, which adds a silent label, and fuse, which removes silence from nested residuals. Weak transitions are inductively generated by strong steps, empty silent steps and composition through lifted weak transitions followed by fuse. Five printed laws—two naturality laws, two neutrality laws and associativity—give a monad structure on types and relations. They are assumptions of the reusable construction, not proved facts about every possible transition system. The paper reports formal proofs that weak bisimilarity equals mixed bisimilarity, where strong steps are matched by weak ones, and that strong bisimilarity is contained in weak bisimilarity. [Q9] For the usual single silent label, Section3.3 requires a natural silent relation that is left-total and unique on both sides. It derives fuse as the union of the converse of silent and its lifted converse, and states that these satisfy the general weak-residual laws. This reduces the per-instance proof burden. These are generic behavioral-equivalence results; no fairness, adversarial stake model, probabilistic security, real-time bound or consensus termination theorem is established in this paper. [Q10] ## Known limits and concrete counterexample The proper transition system can open a scope even when the channel is not transmitted. The author explicitly gives νb.a◁x → a◁νb.x with target0, where x does not depend on b, and says a fix is under investigation. This is a disclosed semantic issue in the presented concrete calculus. It does not by itself invalidate the generic theorems conditional on residual laws, which are largely independent of this calculus. [Q5] Higher-order abstract syntax also permits process structure to depend on channels, including local channels. Such channel-dependent branching is unwanted here, while branching on ordinary data is intended. Related work excludes or separately characterizes these terms; the author explains that making channels abstract does not eliminate them in classical Isabelle/HOL. Preventing channel-dependent behavior while retaining host-language binding remains future work. These unresolved expressiveness/semantics restrictions matter before treating the calculus as an adequate model of a particular network implementation. [Q11,Q12] ## Evaluation and pinned source inspection The evidence is mathematical construction, worked syntax/transition examples and reported Isabelle formalization. The paper says “large parts” of the calculus and the “complete theory of transition systems” were formalized, and that the document was produced from Isabelle source checked against that formalization. It gives no runtime experiment, benchmark table, proof-development time, proof-size accounting, end-to-end protocol case or comparison of verification effort. Its acknowledgements mention network-equivalence proofs, without presenting a measured evaluation of them. There are18references and no numbered figures or tables. [Q1,Q12] Reference10 pins input-output-hk/fm-ouroboros at bbeec3136ae68e7bb6800680e216b12db6c1113a. I statically read seven saved files: README, Channels.thy, Processes.thy, Residuals.thy, Weak_Residuals.thy, Std_Weak_Residuals.thy and Weak_Transition_Systems.thy. They total28,155bytes; each SHA256 and Git-blob identity matches the nontruncated188-entry pinned tree. The source directories use Chi_Calculus naming. Channels declares abstract chan/val types, Processes has the five constructors, and the weak-transition theory includes explicit proof scripts for weak/mixed equivalence and strong-bisimilarity inclusion. This is a targeted sample, not an audit of the complete calculus or dependency closure. Imported theories, the referenced binder-preservation ML and Haskell implementation were not read or run. [S0–S6] The pinned weak-residual interface uses silent plus an absorb operation, deriving lift from them; the paper instead presents lift/silent/fuse. Its weak-transition composition rule is correspondingly expressed through absorb. The standard-weak-residual theory proves a sublocale interpretation into that interface. These are source/presentation differences, not a checked equivalence between the two formulations. Residuals.thy explicitly assumes lift monotonicity; Weak_Residuals.thy assumes absorb monotonicity and notes that this is needed for the inductive weak-transition definition. [S3–S6] The README specifies Isabelle2018 and offers a default properly build rejecting sorry, plus a qnd build accepting fake proofs. I did not run either mode, so the build instructions do not establish a fresh successful check. No assertion about the admission status of the entire uninspected dependency closure follows from this source sample. The paper’s machine-checking statements remain author-reported; the saved source supplies statically inspectable declarations and proof scripts. [S0,S2–S6] ## Contribution to the requested topic This adds an approach to reusable mechanized semantics for distributed programs: represent binding in residuals, separate channel-scope handling from communication, and prove behavioral-equivalence infrastructure against explicit algebraic interfaces. For specification/proof agents, my inference is to evaluate semantic adequacy, locale assumptions, concrete instantiations, source-version correspondence and intended protocol properties separately from the presence of proof scripts. The paper contains no Verus/verified-Rust, TLA+ or LLM-agent experiment. [Q2,Q5,Q7–Q12,S3–S6] Read all16pages,18references,every printed constructor/rule/formula/example and all16page renders. Official and inventory PDFs are byte-identical. Read the seven static source files above. No author code or embedded ML was executed/imported; no compiler, checker, prover or solver was run; no serialized scientific results were loaded.
  • limits: conditional residual/weakresidual algebra;spuriousscopeopening;channeldependentHOAS;no implemented Ouroboros proof or measured evaluation;sourcepresentationdiffers
  • how much was read: most of it read
  • source
  • record id: a-process-calculus-for-2019
• A Timeless Model for the Verification of Quasi-Periodic Distributed Systems (2019)
  • what: Eliminates the global clock from a calendar model of quasi-periodic publish/subscribe processes. A user-parameter constraint problem and predicates on buffer/channel lengths replace time-dependent synchronization. [Q1–Q2] A DSL specifies periods, clock drift, delay bounds, buffer sizes, minimum arrivals, and permitted consecutive buffer-overflow losses. Six constraint families enforce ordered delivery, exact buffer bounds, minimum arrivals, and restrictions on communication cycles. The paper proves a stuttering simulation from calendar executions to timeless executions and implements the model with Z3 and SPIN. [Q1–Q2]
  • number: 3 benchmarks
  • number: 10 s exhaustive pilot-flying run
  • number: 148 s and 155 s bitstate runs
  • number: AGREE 276 s from prior publication
  • limits: Soundness is conditional on the supplied timing/buffer/topology constraints; it does not cover arbitrary asynchronous systems. The abstraction can introduce false safety alarms and is explicitly unsuitable for liveness. Only the pilot-flying experiment uses exhaustive state storage; ground-vehicle and thermostat runs use bitstate hashing and can miss bugs. The AGREE runtime comes from another paper on a slower machine because AGREE could not be installed, so it is not a controlled performance comparison. [Q3–Q6]
  • how much was read: most of it read
  • source
  • record id: a-timeless-model-for-2019
• A Verified and Compositional Translation of LTL to Deterministic Rabin Automata (2019)
  • what: Isabelle/HOL formalization of a modular LTL-to-deterministic-Rabin-automata construction: a logical Master Theorem decomposes formulas into simpler languages, a reusable automata library combines their translations, and executable refinement exports a language-correct StandardML translator with a proved double-exponential state bound. Separates logical decomposition, automata operations and executable data refinement. The transition-system locale separates execute from enabled and represents nondeterministic choices in transition labels. Translation locales explicitly require equivalence refinement, quotient laws and congruence of derivatives/advice. Proves unrestricted-alphabet language equality before finite-alphabet export; identifies unverified text parsing/serialization in the final CLI. Includes a general finite-set induction rule constrained by rank and a derivative/reset construction for GF of least-fixed-point formulas.
  • limits: LTL syntax is in negation normal form with literals, Boolean connectives, X,U,R,W,M; F/G are abbreviations. Semantics concerns infinite words, not finite-trace semantics. μ fragments exclude R/W; ν fragments exclude U/M. The Master Theorem ranges X over least-fixed-point U/M subformulas and Y over greatest-fixed-point R/W subformulas. Advice is not an unchecked oracle: all candidate sets are enumerated and the component languages check the needed GF/FG conditions. Definition22 requires equivp(~), constants-equivalence ≤ ~ ≤ language-equivalence, Abs(Rep x)=x, equality of Abs images iff formula equivalence, and congruence of both af and ν-advice. Language equivalence bounds alone do not suffice to instantiate the locale. Executable instantiation uses propositional equivalence, implemented with prior Boolean-expression-checker code. Theorem25 covers abstract DRA over UNIV; executable Theorem27 covers Pow(atoms φ), finite because the input syntax has finitely many atoms. This finite-alphabet restriction enables explicit DFS exploration. It is not a direct statement that the exported automaton accepts words with arbitrary extraneous propositions without a projection convention. Lemma26 is a verified upper bound on reachable state count, not an empirical speed claim or a new lower-bound proof. The abstract claims asymptotic optimality against a known lower bound. Concrete alphabet enumeration/output can still be enormous. Core correctness is relative to Isabelle/HOL definitions and trusted proof/code-generation infrastructure. Final LTL parser and HOA serializer are explicitly unverified; compilation uses mlton or polyc. This paper does not establish end-to-end correctness from a user text string through machine execution and serialized output. Automata acceptance is introduced at concrete levels; union/intersection are not all proved once in the most general transition-system locale. Executable refinements similarly live mainly at concrete representations. Figure1 is a selected operation inventory, not a complete Boolean algebra or complement implementation for every automaton. Only A2/GF(μLTL) is detailed in the proceedings construction section; A1 and A3 are said to be formalized analogously and their proof exposition is deferred. General framework potential for NBA/LDBA or generalized/transition-based DRA does not mean those derived translators are completed here; §6 lists extensions as future work. No benchmark suite, runtime/state-count experiments, machine specification, repeats or quantitative comparison with Spot/other translators. Evidence is mathematical/formal development and an illustrative command; reader did not run the translator, Isabelle session or downstream tools.
  • how much was read: most of it read
  • source
  • record id: a-verified-and-compositional-2019
• A Verified Compositional Algorithm for AI Planning (2019)
  • what: HOL4 soundness proof for synthesizing a concrete plan by composing instantiated solutions to an augmented descriptive quotient. Builds a polymorphic factored transition-system library, sufficient subplan precedence/coverage conditions and an action-filtering repair. Formalization exposes two missing assumptions in an earlier mathematical algorithm and generalizes soundness beyond Boolean finite-state symmetry-derived quotients. Needed initial assignments, a pairwise precedence relation, coverage by actual subproblems, bijective variable renaming, cross-instantiation variable consistency and restoration of shared needed resources jointly justify concatenation. A total no-op semantics for inapplicable actions makes individually harmless plan steps dangerous after composition; rem-cless deletes them before instantiation/concatenation. The final theorem is conditional on supplied quotient, valid instantiations and a quotient solution, not a verified general-purpose planner search procedure.
  • limits: States are finite maps from variable type α to arbitrary value type β. Actions are pairs of finite maps for preconditions/effects; applying one with unsatisfied preconditions leaves the state unchanged. Effects override existing assignments. This differs from classical planning semantics that prohibit inapplicable steps. Valid problems require the initial-state domain equal the union of action domains and the goal domain contained there. Although β and the action set can be infinite/uncountable, each valid state is a finite map and a returned plan is a finite action list. Generic assignment semantics does not already formalize arbitrary continuous dynamics or functional numeric preconditions/effects. A solution consists of actions from the problem’s action set and reaches a state extending the goal. Theorems establish soundness when the premises hold; they do not promise finding a quotient, a plan, complete reachability search, optimality, termination of a subplanner, or successful planning for every solvable concrete input. Needed assignments include initial assignments occurring in any action precondition or the goal. They are conservative sufficient support, not a claimed smallest plan-dependent set. Transfer of a plan to another compatible state also requires every step’s precondition hold when run from the needed partial state. Precedence requires the first goal contain the second problem’s shared needed assignments and both goals have identical assignments on the intersection of the two problem domains. Concatenation requires this relation for every earlier/later pair, not merely adjacent problems. Subproblem coverage requires consistent initial submaps, action-set inclusion and covering every concrete goal assignment. Variable instantiations must be bijective on relevant variable sets, and pwise-valid prevents distinct quotient variables from colliding across different instantiations. Shared quotient variables may map to the same concrete variable. Final HOL statement additionally requires distinct instantiation functions and injectivity of the induced instantiated-problem mapping. The quotient goal is augmented to restore initial values of common needed variables; the final theorem requires the augmented instantiated problems cover the concrete problem. Any ordering of a finite valid instantiation list then works after rem-cless filtering. No assumption that the quotient came from symmetry is needed once these explicit conditions hold. The assurance is HOL4 theorem derivation over the specified action semantics/library. The paper does not give an extracted implementation refinement, end-to-end parser/executable proof, verified symmetry detector or verified subplanner. Reader did not rerun the available scripts. No distributed-system implementation, Verus/Rust proof, TLA+ integration, LLM agent experiment or user study is evaluated. Murphi compositional model checking is a suggested adaptation, not a verified result of this development.
  • how much was read: most of it read
  • source
  • record id: a-verified-compositional-algorithm-2019
• A Verified LL(1) Parser Generator (2019)
  • what: Vermillion is a Coq-verified LL(1) parse table generator and a table-parameterized parser with user-defined semantic actions. The generator has soundness and conditional completeness proofs. The parser has soundness and completeness relative to an LL(1) prefix derivation relation, terminates even with malformed tables, and avoids internal left-recursion errors with correct tables. Separates generic termination from error exclusion under table correctness; details a finite-set complement measure for dataflow analysis and a lexicographic accessibility proof for mutually recursive parsing. A dependent suffix result moves token-length reasoning into erased proofs, removing an observed extraction performance problem. Generator completeness has an explicit duplicate-production restriction, and parser correctness includes the semantic value and unparsed suffix.
  • limits: Grammar gives a start nonterminal, finite production sequence and Coq semantic type for each symbol. Tokens pair terminals with values; each production carries a dependently typed Coq semantic action from its RHS tuple to its LHS type. These are total Coq functions, not unrestricted effectful host-language callbacks. Correctness is relative to sym_derives_prefix, whose DerNT rule includes LOOKAHEAD. The paper does not separately prove equivalence to an unrestricted context-free derivation relation. Definitions of NULLABLE, FIRST, FOLLOW and lookahead are part of the specification to assess. parseTableOf_sound requires successful generation and establishes parse_table_correct. parseTableOf_complete additionally requires unique_productions: duplicates are compared ignoring actions. It yields a returned map extensionally equal to the given correct map, not definitional identity of finite-map representations. parse_sound, parse_complete and parse_terminates_without_error assume parse_table_correct tbl g. Total termination also covers arbitrary tables, where dynamic cycle detection may return Error. Invalid token input may return Reject even with a correct table; absence of Error does not mean every input is accepted. Parser and derivation both describe prefixes and remainders. The top-level parse wrapper does not test that the returned remainder is empty. Full-input acceptance requires the caller to enforce that condition. No byte-level lexer correctness theorem is given. Left recursion in §4.3 is lookahead-qualified nullable_path g la s s, not every syntactic occurrence reachable on a left edge. Nullable prefixes permit reaching the next nonterminal without consumption. This definition matters for unproductive grammar cycles with no lookahead facts. Termination of the Coq functions is established without fuel. This excludes infinite parser recursion in the formal setting; it does not establish quantitative resource bounds, extracted stack safety, or immunity to every resource-exhaustion attack. OCaml extraction, OCaml compiler/runtime, finite-map implementation execution and the external lexer/tokenizer remain execution trust considerations. The paper reports extraction and testing, not a verified compiler chain from Coq to machine code. JSON evaluation is one small dataset with means of ten trials; hardware, exact dataset, tool versions and dispersion are not specified in §5. The lexer omits Unicode escape sequences. Menhir uses LR(1), Vermillion LL(1), so the measured ratio does not isolate verification overhead. The paper describes observed linear behavior and theoretical LL(1) complexity, but does not supply a formal complexity theorem for the complete extracted implementation. Removing unreachable dynamic errors and emitting specialized parser source code are future work.
  • how much was read: most of it read
  • source
  • record id: a-verified-ll-1-2019
• An Axiomatic Approach to Liveness for Differential Equations (2019)
  • what: # Continuous reachability from invariants, with explicit duration and boundary conditions (authored by agents unless marked 🧑) Quotation fidelity: the anchored passages below reproduce raw PDF extraction exactly, not faithful mathematical typography. Extraction prints the generic comparison symbol for either ≥ or > as <, and its dual as 4; it also drops overbars for topological closure and flattens derivatives/fractions. Use the separately labelled PDF-checked transcriptions and original page images for mathematics. The raw offsets and text remain unchanged. Tan and Platzer present a deductive framework for finite-time reachability of ordinary differential equations (ODEs) in differential dynamic logic (dL), a logic for discrete and continuous programs. This record reads the complete 37-page arXiv:1904.07984v2 report, dated 10 July 2019, including Appendices A–C and all 31 references. The paper derives liveness rules from a small collection of refinement and existence axioms, and gives counterexamples to several earlier rules. These are paper proofs and examples. This version reports paper proofs and examples, with no implementation evaluation or proof microbenchmarks. [Evidence: Q0, Title, complete abstract and §1 motivation, PDF pp.1–2; Q1, §1 complete survey table, claimed corrections and contribution scope, PDF pp.2–3; Q14, §7 complete conclusion and acknowledgments, PDF pp.15–16; complete exact passages in quotes.json.] Source (Q0, Title, complete abstract and §1 motivation): > An Axiomatic Approach to Liveness > for Differential Equations > Yong Kiam Tan André Platzer ∗ > Abstract > This paper presents an approach for deductive liveness verification for ordinary differen- > tial equations (ODEs) with differential dynamic logic. Numerous subtleties complicate the > generalization of well-known discrete liveness verification techniques, such as loop variants, > to the continuous setting. For example, ODE solutions may blow up in finite time or their > progress towards the goal may converge to zero. Our approach handles these subtleties by > successively refining ODE liveness properties using ODE invariance properties which have a > well-understood deductive proof theory. This approach is widely applicable: we survey several > liveness arguments in the literature and derive them all as special instances of our axiomatic re- > finement approach. We also correct several soundness errors in the surveyed arguments, which > further highlights the subtlety of ODE liveness reasoning and the utility of our deductive ap- > proach. The library of common refinement steps identified through our approach enables both > the sound development and justification of new ODE liveness proof rules from our axioms. > Keywords: differential equations, liveness, differential dynamic logic > 1 Introduction > Hybrid systems are mathematical models describing discrete and continuous dynamics, and inter- > actions thereof [6]. This flexibility makes them natural models of cyber-physical systems (CPSs) > which feature interactions between discrete computational control and continuous real world physics > [2, 19]. Formal verification of hybrid systems is of significant practical interest because the CPSs > they model frequently operate in safety-critical settings. Verifying properties of the continuous > dynamics is a key aspect of any such endeavor. > This paper focuses on deductive liveness verification for continuous dynamics described by > ordinary differential equations (ODEs). We work with differential dynamic logic (dL) [16, 17, 19], > a logic for deductive verification of hybrid systems, which compositionally lifts our results to the > hybrid systems setting. Methods for proving liveness in the discrete setting are well-known: loop > variants show that discrete loops eventually reach a desired goal, while temporal logic is used to > specify and study liveness properties in concurrent and infinitary settings [12, 13]. In the contin- > uous setting, liveness for an ODE means that its solutions eventually enter a desired goal region > ∗ > Computer Science Department, Carnegie Mellon University, Pittsburgh, USA {yongkiat|aplatzer}@cs.cmu.edu > arXiv:1904.07984v2 > [cs.LO] > 10 > Jul > 2019 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations The model uses autonomous polynomial ODEs over real states, rational-polynomial terms and first-order real-arithmetic domain/target formulas. Polynomial fields have unique right-maximal local solutions, whose maximum duration can be finite. A diamond property requires some finite solution segment to reach its target while satisfying the domain at every point, including both endpoints. Duration zero can succeed only when target and domain initially hold. Parameters remain constant; topological conditions concern sets over the evolving ODE variables with parameters fixed. This finite continuous reachability property is separate from concurrent-system fairness or infinitely recurring progress. Background completeness is for real-arithmetic ODE invariants, not all liveness. [Evidence: Q2, §2.1–2.2 complete syntax, standing ODEs and semantics, PDF pp.3–5; Q3, §2.3 complete invariant calculus and constant-context explanation, PDF pp.5–6; Q15, AppendixA parameter-fiber topology, decidability and sufficient syntactic criteria, PDF pp.20–21; Q13, §6 complete related-work discussion and automation scope, PDF pp.15–15; complete exact passages in quotes.json.] Source (Q2, §2.1–2.2 complete syntax, standing ODEs and semantics): > -1 > 0 > 1 > v > -1 0 1 u > -1 > 0 > 1 > v > Figure 1: Visualization of αl > (above) and αn (below). Solutions > of αl globally spiral towards the > origin. In contrast, solutions of αn > spiral inwards within the inner red > disk (dashed boundary), but spi- > ral outwards otherwise. For both > ODEs, solutions starting on the > black unit circle eventually enter > their respective shaded green goal > regions. > The grammar of dL terms is as follows, where v ∈ V is a > variable and c ∈ Q is a rational constant. These terms are > polynomials over the set of variables V: > p, q ::= v | c | p + q | p · q > The grammar of dL formulas is as follows, where ∼ ∈ {= > , 6=, ≥, >, ≤, <} is a comparison operator and α is a hybrid > program: > φ, ψ ::= > First-order formulas of real arithmetic P,Q > z }| { > p ∼ q | φ ∧ ψ | φ ∨ ψ | ¬φ | ∀v φ | ∃v φ > | [α]φ | hαiφ > The notation p < q (resp. 4) is used when the compar- > ison operator can be either ≥ or > (resp. ≤ or <). Other > standard logical connectives, e.g., →, ↔, are definable as in > classical logic. Formulas not containing the modalities [·], h·i > are formulas of first-order real arithmetic and are written as > P, Q. The box ([α]φ) and diamond (hαiφ) modality formulas > express dynamic properties of the hybrid program α. We fo- > cus on continuous programs, where α is given by a system of > ODEs x0 > = f(x) & Q. Here, x0 > = f(x) is an n-dimensional > system of differential equations, x0 > 1 = f1(x), . . . , x0 > n = fn(x), > over variables x = (x1, . . . , xn), where the LHS x0 > i is the time > derivative of xi and the RHS fi(x) is a polynomial over vari- > ables x. The domain constraint Q specifies the set of states > in which the ODE is allowed to evolve continuously. When > there is no domain constraint, i.e., Q is the formula true, the > ODE is written as x0 > = f(x). > Two running example ODEs are visualized in Fig. 1 with > directional arrows corresponding to their RHS evaluated at > points on the plane. The first ODE, αl ≡ u0 > = −v − u, v0 > = > u − v, is linear because its RHS depends linearly on u, v. > The second ODE, αn ≡ u0 > = −v − u(1 > 4 > − u2 > − v2 > ), v0 > = > u − v(1 > 4 > − u2 > − v2 > ), is non-linear. The non-linearity of αn results in more complex behavior for its > solutions, e.g., the difference in spiraling behavior shown in Fig. 1. In fact, solutions of αn blow > up in finite time iff they start outside the disk characterized by u2 > + v2 > ≤ 1 > 4 > . Finite time blow up is > impossible for linear ODEs like αl [5, 31]. > 3 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > When terms (or formulas) appear in contexts involving ODEs x0 > = f(x), it is sometimes > necessary to restrict the set of free variables they are allowed to mention. These restrictions are > always stated explicitly and are also indicated as arguments2 > to terms (or formulas), e.g., p() means > the term p does not mention any of x1, . . . , xn free, while P(x) means the formula P may mention > all of them. > 2.2 Semantics > States ω : V → R assign real values to each variable in V; the set of all states is written S. > The semantics of polynomial term p in state ω ∈ S is the real value ω[[p]] of the corresponding > polynomial function evaluated at ω. The semantics of formula φ is the set of states [[φ]] ⊆ S in > which that formula is true. The semantics of first-order logical connectives are defined as usual, > e.g., [[φ ∧ ψ]] = [[φ]] ∩ [[ψ]]. > For ODEs, the semantics of the modal operators is defined directly as follows.3 > Let ω ∈ S and > ϕ : [0, T) → S (for some 0 < T ≤ ∞), be the unique, right-maximal solution [5, 31] to the ODE > x0 > = f(x) with initial value ϕ(0) = ω: > ω ∈ [[[x0 > = f(x) & Q]φ]] iff for all 0 ≤ τ < T where ϕ(ζ) ∈ [[Q]] for all 0 ≤ ζ ≤ τ: > ϕ(τ) ∈ [[φ]] > ω ∈ [[hx0 > = f(x) & Qiφ]] iff there exists 0 ≤ τ < T such that: > ϕ(τ) ∈ [[φ]] and ϕ(ζ) ∈ [[Q]] for all 0 ≤ ζ ≤ τ > Informally, [x0 > = f(x) & Q]φ is true in initial state ω if all states reached by following the ODE > from ω while remaining in the domain constraint Q satisfy postcondition φ. Dually, the liveness > property hx0 > = f(x) & Qiφ is true in initial state ω if some state which satisfies the postcondition φ > is eventually reached in finite time by following the ODE from ω while staying in domain constraint > Q. For the running example, Fig. 1 suggests that formulas4 > hαli 1 > 4 > ≤ k(u, v)k∞ ≤ 1 > 2 >
    > and hαniu2 > + > v2 > ≥ 2 are true for initial states ω on the unit circle. These liveness properties are rigorously proved > in Examples 1 and 2 respectively. > Variables y ∈ V \ {x} not occurring on the LHS of ODE x0 > = f(x) remain constant along > solutions ϕ : [0, T) → S of the ODE, with ϕ(τ)(y) = ϕ(0)(y) for all τ ∈ [0, T). Since only > the values of x = (x1, . . . , xn) change along the solution ϕ it may also be viewed geometrically > as a trajectory in Rn > , dependent on the initial values of the constant parameters y. Similarly, the > value of terms and formulas depends only on the values of their free variables [17]. Thus, terms (or > formulas) whose free variables are all parameters for x0 > = f(x) also have constant (truth) values > along solutions of the ODE. For formulas φ that only mention free variables x, [[φ]] can also be > viewed geometrically as a subset of Rn > . Such a formula is said to characterize a (topologically) > open (resp. closed, bounded, compact) set with respect to variables x iff the set [[φ]] ⊆ Rn > is > 2 > This understanding of variable dependencies is made precise using function and predicate symbols in dL’s uniform > substitution calculus [17]. > 3 > The semantics of dL formulas is defined compositionally elsewhere [17, 19]. > 4 > Here, k(u, v)k∞ denotes the L∞ > norm. The inequality k(u, v)k∞ ≤ 1 > 2 is expressible in first-order real arithmetic > as u2 > ≤ 1 > 4 ∧ v2 > ≤ 1 > 4 (similarly for 1 > 4 ≤ k(u, v)k∞). > 4 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > topologically open (resp. closed, bounded, compact) with respect to the Euclidean topology. These > topological conditions are used as side conditions for some of the axioms and proof rules in this > paper. In Appendix A, a more general definition of these side conditions is given for formulas φ that > mention parameters y. These side conditions are decidable [3] when φ is a formula of first-order > real arithmetic and there are simple syntactic criteria for checking if they hold (Appendix A). > Formula φ is valid iff [[φ]] = S, i.e., φ is true in all states. In particular, if the formula I → > [x0 > = f(x) & Q]I is valid, the formula I is an invariant of the ODE x0 > = f(x) & Q. Unfolding the > semantics, this means that from any initial state ω satisfying I, all states reached by the solution of > the ODE x0 The proof method starts from a known diamond property and refines it into the desired one. DR changes the domain when a box invariant justifies doing so. K<&> establishes that a known reachable region cannot be reached before the desired target. Existence axiom GEx supplies arbitrary clock duration for globally Lipschitz ODEs. BEx instead says that a solution reaches the requested clock threshold or exits a bounded region. Appendix B proves these existence axioms semantically using global solution existence or the unbounded norm near finite-time blow-up. [Evidence: Q4, §3 refinement rationale, Lemma2 and chaining illustration, PDF pp.6–7; Q5, §3 complete Lemma3 existence axioms and duration explanation, PDF pp.7–7; Q17, AppendixB complete Lemma3 existence soundness proof, PDF pp.21–22; complete exact passages in quotes.json.] Source (Q4, §3 refinement rationale, Lemma2 and chaining illustration): > These additional constant contexts are useful when working with assumptions on symbolic param- > eters e.g., v() > 0 to represent a (constant) positive velocity. > 3 Liveness via Box Refinements > Suppose we already know an initial liveness property hx0 > = f(x) & Q0iP0 for the ODE x0 > = f(x). > How could this be used to prove a desired liveness property hx0 > = f(x) & QiP for that ODE? > Logically, this amounts to proving: > hx0 > = f(x) & Q0iP0 → hx0 > = f(x) & QiP (1) > Proving implication (1) refines the initial liveness property to the desired one. Our approach > is built on refinement axioms that conclude such implications from box modality formulas. The > following are two basic derived refinement axioms: > Lemma 2 (Diamond refinement axioms). The following h·i refinement axioms are derivable in dL. > DRh·i [x0 > = f(x) & R]Q → hx0 > = f(x) & RiP → hx0 > = f(x) & QiP >
    > Kh&i [x0 > = f(x) & Q ∧ ¬P]¬G → hx0 > = f(x) & QiG → hx0 > = f(x) & QiP >
    > In axiom Kh&i, formula [x0 > = f(x) & Q ∧ ¬P]¬G says the solution cannot get to G before > getting to P as G never happens while ¬P holds. In axiom DRh·i, formula [x0 > = f(x) & R]Q says > that the ODE solution never leaves Q while staying in R, so the solution getting to P within R > 6 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > implies that it also gets to P within Q. These axioms prove implication (1) in just one refinement > step. Logical implication is transitive though, so we can also chain a longer sequence of such steps > to prove implication (1). This is shown in (2), with neighboring implications informally chained > together for illustration: > hx0 > = f(x) & Q0iP0 > DRh·i with [x0=f(x) & Q1]Q0 > z}|{ > → hx0 > = f(x) & Q1iP0 > Kh&i with [x0=f(x) & Q1∧¬P1]¬P0 > z}|{ > → hx0 > = f(x) & Q1iP1 > → · · · → hx0 > = f(x) & QiP (2) > The chain of refinements (2) proves the desired implication (1), but to formally conclude the > liveness property hx0 > = f(x) & QiP, we still need to prove the hypothesis hx0 > = f(x) & Q0iP0 on > the left of the implication. The following axioms provide a means of formally establishing such an > initial liveness property: Domain changes need more than an invariant restricted to the target’s negation. COR requires an initially false target and matching open/open or closed/closed topology of target and new domain. SAR replaces the until-condition with the negation of target-and-domain together; its proof uses local progress into a semialgebraic set or its complement. Appendix B additionally handles closed targets or open domains without that general local-progress step. Appendix A explains decidable real-arithmetic topology checks and sufficient syntactic tests. Invariant rules generally discard initial-state assertions when reasoning along trajectories; constant-parameter assertions can remain. [Evidence: Q6, §3 complete Lemma4 and topological/semialgebraic conditions, PDF pp.8–8; Q3, §2.3 complete invariant calculus and constant-context explanation, PDF pp.5–6; Q15, AppendixA parameter-fiber topology, decidability and sufficient syntactic criteria, PDF pp.20–21; Q18, AppendixB complete Lemma4 topological refinement soundness proof, PDF pp.22–24; complete exact passages in quotes.json.] Source (Q6, §3 complete Lemma4 and topological/semialgebraic conditions): > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > Lemma 4 (Topological refinement axioms). The following topological h·i refinement axioms are > sound. In axiom COR, P, Q either both characterize topologically open or both characterize > topologically closed sets over variables x. > COR ¬P ∧ [x0 > = f(x) & R ∧ ¬P]Q → hx0 > = f(x) & RiP → hx0 > = f(x) & QiP >
    > SAR [x0 > = f(x) & R ∧ ¬(P ∧ Q)]Q → hx0 > = f(x) & RiP → hx0 > = f(x) & QiP >
    > Axiom COR is the more informative topological refinement axiom. Like the (unsound) axiom > candidate DRh·i, it allows formula ¬P to be assumed in the domain constraint when proving the > box refinement. For soundness though, axiom COR has additional topological side conditions on > formulas P, Q so it can only be used when these conditions are met. Axiom SAR applies more > generally but only assumes the less informative formula ¬(P ∧ Q) in the domain constraint for > the box modality formula in the refinement. Its proof crucially relies on Q being a formula of > real arithmetic so that the set it characterizes has tame topological behavior [3], see the proof > in Appendix B for more details.6 Corollary 5’s explicit-duration differential variant requires a fixed positive derivative bound until the target and a premise ensuring enough evolution time. Its shorter rule assumes the entire ODE is globally Lipschitz. The equational variants, higher-Lie-derivative rule and ordinary staging rule likewise use global Lipschitz continuity in this version. Merely local Lipschitz continuity gives no global-duration guarantee. A derivative that stays positive but tends toward zero also need not yield finite reachability. Higher derivatives provide a polynomial-in-time lower bound, whose positive leading coefficient eventually forces progress. [Evidence: Q7, §4.1 complete Corollary5 and derivative/duration explanation, PDF pp.8–9; Q9, §4.1 complete Corollaries6–7 with global Lipschitz assumptions, PDF pp.10–10; Q19, AppendixB complete Corollary7 higher-Lie-derivative proof, PDF pp.25–27; complete exact passages in quotes.json.] Source (Q7, §4.1 complete Corollary5 and derivative/duration explanation): > 4 Liveness Without Domain Constraints > This section presents proof rules for liveness properties of ODEs x0 > = f(x) without domain con- > straints, i.e., where Q is the formula true. Errors and omissions in the surveyed techniques are > highlighted in blue. > 4.1 Differential Variants > A fundamental technique for verifying liveness of discrete loops is the identification of a loop > variant, i.e., a quantity that decreases monotonically across each loop iteration. Differential vari- > ants [15] are their continuous analog: > Corollary 5 (Atomic differential variants [15]). The following proof rules (where < is either ≥ > or >) are derivable in dL. Terms ε(), p0() are constant for ODE x0 > = f(x), t0 > = 1. In rule dV<, > x0 > = f(x) is globally Lipschitz continuous. > dV∗ > < > ¬(p < 0) > . > p ≥ ε() > Γ, p=p0(), t=0, hx0 = f(x), t0 = 1i p0()+ε()t>0 >
> hx0 = f(x), t0 = 1ip < 0 > dV< > ¬(p < 0) > . > p ≥ ε() > Γ, ε() > 0 hx0 = f(x)ip < 0 > Proof Sketch (Appendix B). Rule dV∗ > < derives by using axiom Kh&i with the choice of formula > G ≡ p0()+ε()t>0: > 6 > By topological considerations similar to COR, axiom SAR is also sound if it requires that the formula P (or resp. > Q) characterizes a topologically closed (resp. open) set over the ODE variables x. These additional cases are also > proved in Appendix B without relying on the fact that Q is a formula of real arithmetic. > 8 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > Kh&i > Γ, p=p0(), t=0 [x0 > = f(x), t0 > = 1 & ¬(p < 0)]p0()+ε()t ≤ 0 > Γ, p=p0(), t=0, hx0 = f(x), t0 = 1i p0()+ε()t>0 >
> hx0 = f(x), t0 = 1ip<0 > Monotonicity M[0 > ] strengthens the postcondition to p ≥ p0() + ε()t with the domain constraint > ¬(p < 0). A subsequent use of dI< completes the derivation: > ¬(p < 0) > . > p ≥ ε() > dI< > Γ, p = p0(), t = 0 [x0 > = f(x), t0 > = 1 & ¬(p < 0)]p ≥ p0() + ε()t > M[0] > Γ, p = p0(), t = 0 [x0 > = f(x), t0 > = 1 & ¬(p < 0)]p0() + ε()t ≤ 0 > Rule dV< is derived in Appendix B as a corollary of rule dV∗ > <. It uses the global existence > axiom GEx and rule dGt to introduce the time variable. > The premises of both rules require a constant (positive) lower bound on the Lie derivative > . > p > which ensures that the value of p strictly increases along solutions to the ODE, eventually becoming > non-negative. Soundness of both rules therefore crucially requires that ODE solutions exist for > sufficiently long for p to become non-negative. This is usually left as a soundness-critical side > condition in liveness proof rules [15, 28], but such a side condition is antithetical to approaches > for minimizing the soundness-critical core in implementations [17] because it requires checking > the (semantic) condition that solutions exist for sufficient duration. The conclusion of rule dV∗ > < > formalizes this side condition as an assumption while rule dV< uses global Lipschitz continuity > of the ODEs to show it. All subsequent proof rules can also be presented with sufficient duration > assumptions like dV∗ > < but these are omitted for brevity. Bounded staging removes the global Lipschitz requirement: the trajectory stays in a bounded staging region until the target, and one fixed positive derivative forces it to exit. Compact staging needs only a strictly positive derivative because a continuous derivative attains a positive minimum there. The set-Lyapunov rule requires compact K and open target P; the authors explain that a surveyed merely closed-K statement omitted boundedness needed by its proof. These conditions distinguish sufficient finite-duration reasoning from assuming all trajectories last forever. [Evidence: Q10, §4.2 complete staging rules, nonlinear Example2 and compactness correction, PDF pp.10–12; Q20, AppendixB complete Corollaries8–10 staging/compactness derivations, PDF pp.27–29; complete exact passages in quotes.json.] Source (Q10, §4.2 complete staging rules, nonlinear Example2 and compactness correction): > 4.2 Staging Sets > The idea behind staging sets [28] is to use an intermediary staging set formula S that can only be > left by entering the goal region P. This staging property is expressed by the box modality formula > [x0 > = f(x) & ¬P]S and is formally justified as a refinement using axiom Kh&i with G ≡ ¬S. > 10 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > Corollary 8 (Staging sets [28]). The following proof rule is derivable in dL. Term ε() is constant > for ODE x0 > = f(x), which is globally Lipschitz continuous. > SP > Γ [x0 > = f(x) & ¬P]S S p ≤ 0 ∧ > . > p ≥ ε() > Γ, ε() > 0 hx0 = f(x)iP > In rule SP, the staging set formula S provides a choice of intermediary between the differential > variant p and the desired postcondition P. Proof rules can be significantly simplified by choosing S > with desirable topological properties. All proof rules derived so far either have an explicit sufficient > duration assumption (like dV∗ > <) or use axiom GEx by assuming that ODEs are globally Lipschitz. > To make use of axiom BEx, an alternative is to choose staging set formulas S(x) that characterize > a bounded (or even compact) set over the variables x. > Corollary 9 (Bounded/compact staging sets). The following proof rules are derivable in dL. Term > ε() is constant for x0 > = f(x). In rule SPb, formula S characterizes a bounded set over variables > x. In rule SPc, it characterizes a compact, i.e., closed and bounded, set over those variables. > SPb > Γ [x0 > = f(x) & ¬P]S S > . > p ≥ ε() > Γ, ε() > 0 hx0 = f(x)iP > SPc > Γ [x0 > = f(x) & ¬P]S S > . > p > 0 > Γ hx0 = f(x)iP > Proof Sketch (Appendix B). Rule SPb derives using BEx and differential variant p to establish a > time bound. Rule SPc is an arithmetical corollary of SPb, using the fact that continuous functions > on a compact domain attain their extrema. > Example 2. Liveness for the non-linear ODE αn (as suggested by Fig. 1) is proved using rule SPc > by choosing the staging set formula S ≡ 1 ≤ u2 > +v2 > ≤ 2 (blue annulus) and the differential variant > p = u2 > + v2 > . The Lie derivative > . > p with respect to αn is 2(u2 > + v2 > )(u2 > + v2 > − 1 > 4 > ), which is bounded > below by 3 > 2 > in S. Thus, the right premise of SPc closes trivially. The left premise (abbreviated 1 ) > requires proving that S is an invariant within the domain constraint ¬(u2 > + v2 > ≥ 2). Intuitively, > this is true because the blue annulus can only be left by entering u2 > +v2 > ≥ 2. Its (elided) invariance > proof is easy [20]. > 1 > ∗ > R > S > . > p > 0 > SPc > u2 > + v2 > = 1 hαniu2 > + v2 > ≥ 2 > ∗ > S [αn & ¬(u2 > + v2 > ≥ 2)]S > cut,R > 1 : u2 > + v2 > = 1 [αn & ¬(u2 > + v2 > ≥ 2)]S > -1 0 1 u > -1 > 0 > 1 > v > There are two subtleties to highlight in this proof. First, S characterizes a compact, hence > bounded, set (as required by rule SPc). Solutions of αn can blow up in finite time which necessitates > the use of BEx for proving its liveness properties. Second, S is cleverly chosen to exclude the red > 11 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > disk (dashed boundary) characterized by u2 > + v2 > ≤ 1 > 4 > . As mentioned earlier, solutions of αn > behave differently in this region, e.g., the Lie derivative > . > p is non-positive in this disk. The chain of > refinements (2) behind this proof can be seen from the derivation of rules SPb,SPc in Appendix B. > It starts from the initial liveness property BEx (with time bound 1 / 3 > 2 > = 2 > 3 > ) and uses two Kh&i > refinement steps, first showing that the staging set is left (hαni¬S), then showing the desired > liveness property: > hαn, t0 > = 1i(¬S ∨ t > > 2 > 3 > ) > Kh&i > → hαni¬S > Kh&i > → hαniu2 > + v2 > ≥ 2 > The use of axiom BEx is subtle and is sometimes overlooked in surveyed liveness arguments. > For example, [24, Remark 3.6] incorrectly claims that their liveness argument works without > assuming that the relevant sets are bounded. The following proof rule derives from SPc and adapts > ideas from [25, Theorem 2.4, Corollary 2.5], but formula K in the original presentation is only > assumed to characterize a closed rather than compact set; the proofs (correctly) use the fact that > the set is bounded but this assumption is not made explicit [25]. > Corollary 10 (Set Lyapunov functions [25]). The following proof rule is derivable in dL. Formula > K characterizes a compact set over variables x, while formula P characterizes an open set over > those variables. > SLyap > p ≥ 0 K ¬P, K > . > p > 0 > Γ, p < 0 hx0 = f(x)iP > 5 Liveness With Domain Constraints > This section presents proof rules for liveness properties x0 > = f(x) & Q with domain constraint Q. Example 1 proves that the linear spiral u′=−v−u, v′=u−v reaches an annular target from the unit circle. For p=1/4−u²−v² the derivative is at least 1/2 before reaching squared radius 1/4, giving an analytic time threshold 3/2. Continuity then yields the circle and enclosing sup-norm annulus. The trajectory does not reach the origin in finite time; its shrinking rate tends to zero. Example 2 uses the nonlinear spiral u′=−v−u(1/4−u²−v²), v′=u−v(1/4−u²−v²). Compact staging in 1≤u²+v²≤2 and derivative at least 3/2 prove it reaches squared norm 2 before its later blow-up. The 2/3 threshold is an analytic bound, not a measured runtime. [Evidence: Q8, §4.1 complete Example1, finite-goal versus asymptotic-origin distinction and analytic bound, PDF pp.9–10; Q10, §4.2 complete staging rules, nonlinear Example2 and compactness correction, PDF pp.10–12; complete exact passages in quotes.json.] Source (Q8, §4.1 complete Example1, finite-goal versus asymptotic-origin distinction and analytic bound): > Example 1. Rule dV< enables a liveness proof for the linear ODE αl as suggested by Fig. 1. The > proof is shown on the left below and visualized on the right. The first monotonicity step Mh0 > i > strengthens the postcondition to the inner blue circle u2 > + v2 > = 1 > 4 > which is contained within the > green goal region. Next, since solutions satisfy u2 > + v2 > = 1 initially (black circle), the Kh&i step > expresses an intermediate value property: to show that the continuous solution eventually reaches > u2 > + v2 > = 1 > 4 > , it suffices to show that it eventually reaches u2 > + v2 > ≤ 1 > 4 > (see Corollary 6). The > postcondition is rearranged before dV< is used with ε() = 1 > 2 > . Its premise proves with R because > the Lie derivative of 1 > 4 > − (u2 > + v2 > ) with respect to αl is 2(u2 > + v2 > ), which is bounded below by 1 > 2 > with assumption 1 > 4 > − (u2 > + v2 > ) < 0. > ∗ > R 1 > 4 > < u2 > + v2 > 2(u2 > + v2 > ) ≥ 1 > 2 > 1 > 4 > − (u2 > + v2 > ) < 0 2(u2 > + v2 > ) ≥ 1 > 2 > dV< > u2 > + v2 > = 1 hαli1 > 4 > − (u2 > + v2 > ) ≥ 0 > u2 > + v2 > = 1 hαliu2 > + v2 > ≤ 1 > 4 > Kh&i > u2 > + v2 > = 1 hαliu2 > + v2 > = 1 > 4 > Mh0i > u2 > + v2 > = 1 hαli 1 > 4 > ≤ k(u, v)k∞ ≤ 1 > 2 >
> -1 0 1 u > -1 > 0 > 1 > v > 9 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > The Lie derivative calculation shows that the value of u2 > + v2 > decreases along solutions of > αl, as visualized by the shrinking (dashed) circles. However, the rate of shrinking converges to > zero as solutions approach the origin, so solutions never reach the origin in finite time! This is > why dV∗ > <,dV< need a constant positive lower bound on the Lie derivative > . > p ≥ ε() instead of > merely requiring > . > p > 0. > It is instructive to examine the chain of refinements (2) underlying the proof. The first dV< > step refines the initial liveness property from GEx, i.e., that solutions exist globally (so, for at least > 3 > 4 > / 1 > 2 > = 3 > 2 > time), to the property u2 > + v2 > ≤ 1 > 4 > . Subsequent refinement steps can be read off from > the proof steps above: > hαl, t0 > = 1it> > 3 > 2 > dV< > → hαliu2 > + v2 > ≤ > 1 > 4 > Kh&i > → hαliu2 > + v2 > = > 1 > 4 > Mh0i > → hαli > 1 > 4 > ≤k(u, v)k∞≤ > 1 > 2 >
> The latter two steps illustrate the idea behind the next two surveyed proof rules. In the original > presentation [30], the ODE x0 > = f(x) is only assumed to be locally Lipschitz continuous, which is > insufficient for global existence of solutions, making the original rules unsound. See Appendix C > for counterexamples. Domain variants retain the initial target-false and topology requirements. Equational domain variants assume a closed domain and global Lipschitz ODE. Domain staging uses an invariant until not(target-and-domain), a staging set implying the domain, a bounded-above progress quantity and a uniform positive derivative. Example 3 strengthens the nonlinear reachability proof to stay in the closed annulus. A half-open annulus omitting its outer boundary cannot reach the same outer-boundary goal. The final combined rule joins compact staging, a strictly positive higher derivative and domain refinement. Compact eventuality requires Q∧¬P compact and checks conditions on the full region needed by the proof, correcting a narrower surveyed condition. [Evidence: Q11, §5 complete domain arguments and Corollaries11–14, PDF pp.12–14; Q12, §5 complete Example3, Corollaries15–16 and boundary/global-condition discussion, PDF pp.14–15; complete exact passages in quotes.json.] Source (Q11, §5 complete domain arguments and Corollaries11–14): > Axiom DRh·i provides direct generalizations of the proof rules from Section 4 with the following > derivation choosing R ≡ true: > Γ [x0 > = f(x)]Q Γ hx0 > = f(x)iP > DRh·i > Γ hx0 > = f(x) & QiP > This extends all chains of refinements (2) from Section 4 with an additional step: > · · · → hx0 > = f(x)iP > DRh·i > → hx0 > = f(x) & QiP > Liveness arguments become much more intricate when attempting to generalize beyond DRh·i, > e.g., recall the unsound conjecture DRh·i. Indeed, unlike the technical glitches of Section 4, > our survey uncovers subtle soundness-critical errors here. With our deductive approach, these > intricacies are isolated to the topological axioms (Lemma 4) which have been proved sound once > and for all. As before, errors and omissions in the surveyed techniques are highlighted in blue. > 12 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > 5.1 Topological Proof Rules > The first proof rule generalizes differential variants to handle domain constraints: > Corollary 11 (Atomic differential variants with domains [15]). The following proof rule (where < > is either ≥ or >) is derivable in dL. Term ε() is constant for the ODE x0 > = f(x) and the ODE > is globally Lipschitz continuous. Formula Q characterizes a closed (resp. open) set when < is ≥ > (resp. >). > dV<& > Γ [x0 > = f(x) & ¬(p < 0)]Q ¬(p < 0), Q > . > p ≥ ε() > Γ, ε() > 0, ¬(p < 0) hx0 = f(x) & Qip < 0 > Proof Sketch (Appendix B). The derivation uses axiom COR choosing R ≡ true, noting that p ≥ 0 > (resp. p > 0) characterizes a topologically closed (resp. open) set so the appropriate topological > requirements of COR are satisfied: > Γ [x0 > = f(x) & ¬(p < 0)]Q > ¬(p < 0), Q > . > p ≥ ε() > . . . > Γ, ε() > 0 hx0 > = f(x)ip < 0 > COR > Γ, ε() > 0, ¬(p < 0) hx0 > = f(x) & Qip < 0 > The right premise follows similarly to dV< although it uses an intervening dC step to add Q to the > antecedents. > The original presentation of rule dV∗ > < [15] omits the highlighted assumption ¬(p < 0). This > premise is needed for the COR step and the rule is unsound without it. In addition, it uses a form > of syntactic weak negation [15], which is also unsound for open postconditions, as pointed out > earlier [28]. See Appendix C for counterexamples. Our presentation of dV<& recovers soundness > by adding topological restrictions on the domain constraint Q. > The next two corollaries similarly make use of COR to derive the proof rule dVM > = & [30] and > the adapted rule SLyap& [25]. They respectively generalize dVM > = and SLyap from Section 4 to > handle domain constraints. The technical glitches in their original presentations [25, 30], which > were identified in Section 4, remain highlighted here: > Corollary 12 (Equational differential variants with domains [30]). The following proof rules are > derivable in dL. Term ε() is constant for the ODE x0 > = f(x) and the ODE is globally Lipschitz > continuous in both rules. Formula Q characterizes a closed set over variables x. > dV=& > Γ [x0 > = f(x) & p < 0]Q p < 0, Q > . > p ≥ ε() > Γ, ε() > 0, p ≤ 0, Q hx0 = f(x) & Qip = 0 > dVM > = & > Q, p = 0 P Γ [x0 > = f(x) & p < 0]Q p < 0, Q > . > p ≥ ε() > Γ, ε() > 0, p ≤ 0, Q hx0 = f(x) & QiP > Corollary 13 (Set Lyapunov functions with domains [25]). The following proof rule is derivable > in dL. Formula K characterizes a compact set over variables x, while formula P characterizes an > open set over those variables. > SLyap& > p ≥ 0 K ¬P, K > . > p > 0 > Γ, p > 0 hx0 = f(x) & p > 0iP > 13 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > The staging sets with domain constraints proof rule SP& [28] uses axiom SAR: > Corollary 14 (Staging sets with domains [28]). The following proof rule is derivable in dL. Term > ε() is constant for ODE x0 > = f(x) and the ODE is globally Lipschitz continuous. > SP& > Γ [x0 > = f(x) & ¬(P ∧ Q)]S S Q ∧ p ≤ 0 ∧ > . > p ≥ ε() > Γ, ε() > 0 hx0 = f(x) & QiP > The rules derived in Corollaries 11–14 demonstrate the flexibility of our refinement approach > for deriving surveyed liveness arguments as proof rules. Our approach is not limited to these sur- > veyed arguments because refinement steps can be freely mixed-and-matched for specific liveness > questions. Appendix C makes the failures concrete. Counterexample 4 adds u′=u², u(0)=1, to v′=1, v(0)=0: blow-up at time 1 prevents v=2 despite constant progress of v. Counterexample 5 begins outside domain u≤1 although target u≥0 holds initially. Counterexample 6 requires u>1 while staying in u≤1. Counterexample 7 starts upward flow u′=0,v′=1 at (0,1), with closed unit-disk domain and open-disk target; coincident boundaries make a surveyed boundary condition vacuous, while the trajectory exits immediately. Counterexample 8 uses an open bounded disk with v=0 removed; upward trajectories from its lower part reach the upper target only after crossing the forbidden slice. The record checked these examples in this source; it did not independently review the earlier publications being criticized. Figure 2 deliberately separates boundaries for visibility and says the actual boundaries coincide. [Evidence: Q21, AppendixC.1 complete Counterexample4 and duration coupling explanation, PDF pp.34–35; Q22, AppendixC.2 complete earlier invalid rule and Counterexamples5–6, PDF pp.35–36; Q23, AppendixC.2 complete quoted Conjecture19, Counterexamples7–8 and Figure2 caption, PDF pp.36–37; complete exact passages in quotes.json.] Source (Q21, AppendixC.1 complete Counterexample4 and duration coupling explanation): > C Counterexamples > This appendix gives explicit counterexamples to illustrate the soundness errors identified in Sec- > tions 4 and 5. > C.1 Finite Time Blow Up > The soundness errors identified in Section 4 all arise because of incorrect handling of the fact > that solutions may blow up in finite time. This phenomenon is illustrated by αn (see Fig. 1), but > occurs even for very simple non-linear ODEs. The following is a counterexample for the original > presentation of dV= (and dVM > = ,dV=&,dVM > = &) [30]. Similar counterexamples can be constructed > for [24, Remark 3.6] and for the original presentation of SLyap,SLyap& [25]. > Counterexample 4. Consider rule dV= without the restriction of global Lipschitz continuity of the > ODE. This unrestricted rule is denoted dV=. It is unsound, as shown by the following derivation > using rule dV= with ε() = 1: > ∗ > R > v − 2 < 0 1 ≥ 1 > dV=v − 2 ≤ 0 hu0 > = u2 > , v0 > = 1iv − 2 = 0 > 34 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > The conclusion of this derivation is not valid. Consider an initial state ω satisfying the formula > u = 1 ∧ v = 0. The explicit solution of the ODE from ω is given by u(t) = 1 > 1−t > , v(t) = t for > t ∈ [0, 1). The solution does not exist beyond the time interval [0, 1) because the u-coordinate > asymptotically approaches ∞, i.e., blows up, as time approaches t = 1. It is impossible to reach a > state satisfying v − 2 = 0 from ω along this solution since at least 2 time units are required. > This counterexample further illustrates the difficulty in handling non-linear ODEs. Neither the > precondition (v − 2 ≤ 0) nor postcondition (v − 2 = 0) mention the variable u, and the ODEs > u0 > = u2 > , v0 > = 1 do not depend on variables v, u respectively. It is tempting to discard the variable > u entirely: indeed, the liveness property v − 2 ≤ 0 → hv0 > = 1iv − 2 = 0 is valid. Yet, for liveness > questions about the (original) ODE u0 > = u2 > , v0 > = 1, the two variables are inextricably linked > through the time axis of solutions to the ODE. Evaluation is mathematical: three worked examples, full proof derivations, semantic axiom arguments and five explicit counterexamples. Table 1 compares the assumptions of surveyed arguments. The report supplies no tested implementation, proof-time table, hardware configuration, empirical user study, LLM benchmark or scaling experiment. Related-work discussion of reachability analysis, optimization and constraint-based search describes other approaches rather than an implementation evaluated here. No independent prover execution was performed for this reading. [Evidence: Q1, §1 complete survey table, claimed corrections and contribution scope, PDF pp.2–3; Q13, §6 complete related-work discussion and automation scope, PDF pp.15–15; Q14, §7 complete conclusion and acknowledgments, PDF pp.15–16; Q16, AppendixB complete proof-scope introduction and Lemma2 derivation, PDF pp.21–21; complete exact passages in quotes.json.] Source (Q1, §1 complete survey table, claimed corrections and contribution scope): > Table 1: Surveyed ODE liveness arguments with our corrections highlighted in blue. The refer- > enced corollaries are our corresponding (corrected) derived proof rules. > Source Without Domain Constraints With Domain Constraints > [15] OK (Cor. 5) if open/closed, initially false (Cor. 11) > [23, 24] [24, Remark 3.6] is incorrect if conditions checked globally (Cor. 16) > [25] if compact (Cor. 10) if compact (Cor. 13) > [28] OK (Cor. 8) OK (Cor. 14) > [30] if globally Lipschitz (Cor. 6) if globally Lipschitz (Cor. 12) > in finite time without leaving the domain of allowed (or safe) states.1 > Deduction of such ODE > liveness properties is hampered by several difficulties: i) solutions of ODEs may converge towards > a goal without ever reaching it, ii) solutions of (non-linear) ODEs may blow up in finite time leav- > ing insufficient time for the desired goal to be reached, and iii) the goal may be reachable but > only by leaving the domain constraint. In contrast, invariance properties for ODEs are better un- > derstood [9, 11] and have a complete dL axiomatization [20]. Motivated by the aforementioned > difficulties, we present dL axioms enabling step-by-step refinement of ODE liveness properties > with a sequence of ODE invariance properties. This brings the full deductive power of dL’s ODE > invariance proof rules to bear on liveness proofs. Our approach is a general framework for under- > standing ODE liveness arguments. We use it to survey several arguments from the literature and > derive them all as (corrected) dL proof rules, see Table 1. This logical presentation has two key > benefits: > • The proof rules are derived from sound axioms of dL, guaranteeing their correctness. Many > of the surveyed arguments contain subtle soundness errors, see Table 1. These errors do not > diminish the surveyed work. Rather, they emphasize the need for an axiomatic, uniform way > of presenting and analyzing ODE liveness arguments rather than ad hoc approaches. > • The approach identifies common refinement steps that form a basis for the surveyed liveness > arguments. This library of building blocks enables sound development and justification of > new ODE liveness proof rules, e.g., by generalizing individual refinement steps or by explor- > ing different combinations of those steps. Corollaries 7, 9, and 15 are examples of new ODE > liveness proof rules that can be derived and justified using our uniform approach. > All proofs are in Appendix A and B. Counterexamples for the soundness errors in Table 1 are > given in Appendix C. > 2 Background > This section reviews the syntax and semantics of dL, focusing on its continuous fragment which > has a complete axiomatization for ODE invariants [20]. Full presentations of dL, including its > 1 > This property has also been called, e.g., eventuality [24, 28] and reachability [30]. To minimize ambiguity, this > paper refers to the property as liveness, with a precise formal definition in Section 2. Other advanced notions of > liveness for ODEs are discussed in Section 6, although their formal deduction is left for future work. > 2 > Y. K. Tan and A. Platzer An Axiomatic Approach to Liveness for Differential Equations > discrete fragment, are available elsewhere [17, 19]. > 2.1 Syntax > -1 0 1 u For the requested topic, the paper contributes precise obligations for progress proofs: enough evolution duration, legal domain endpoints, uniform progress and compactness. It illustrates why safety reasoning alone needs a justified bridge to reachability. Reader proposals, not author results: generated proofs could be tested against the independent blow-up coordinate and forbidden-boundary cases, requiring repairs that preserve the stated property. TLA+ finite abstractions or Verus code would need a separate relation to continuous real trajectories. This report contains no TLA+, Verus/verified Rust or LLM result and does not prove distributed fairness or eventual message delivery. [Evidence: Q2, §2.1–2.2 complete syntax, standing ODEs and semantics, PDF pp.3–5; Q21, AppendixC.1 complete Counterexample4 and duration coupling explanation, PDF pp.34–35; Q22, AppendixC.2 complete earlier invalid rule and Counterexamples5–6, PDF pp.35–36; Q23, AppendixC.2 complete quoted Conjecture19, Counterexamples7–8 and Figure2 caption, PDF pp.36–37; complete exact passages in quotes.json.] PDF-checked mathematical transcriptions (reader transcriptions, not raw quotations): §2.1 and §4.1, generic comparisons (PDF pp.3,8): Write ≽ for the paper’s generic comparison: either ≥ or >; its dual is either ≤ or <. Thus p≽0 does not mean p<0. See the comparison convention on PDF p.3 and Corollary5 on p.8. §4.2 Corollary10 (PDF pp.12): K is compact and P open. The premises are p≥0 ⊢ K and ¬P,K ⊢ p-dot>0. The conclusion is Γ,p≽0 ⊢ ⟨x′=f(x)⟩P, with the generic ≽ meaning either ≥ or >. The raw extraction’s p<0 in this conclusion is not the printed condition. AppendixC.2 Conjecture19 (PDF pp.36): Let f∈C(Rⁿ,Rⁿ); bounded X,X₀,Xᵣ with X₀⊆X and Xᵣ⊆X; B∈C¹(Rⁿ). Conditions: (6) B(x)≤0 for x∈X₀; (7) B(x)>0 for x∈closure(∂X ∖ ∂Xᵣ); (8) (∂B/∂x)f(x)<0 for x∈closure(X ∖ Xᵣ). Claimed conclusion: for every x₀∈X₀ there is T≥0 with x(T)∈Xᵣ and x(t)∈X for all t∈[0,T]. Here closure(S) is the smallest closed set containing S, and ∂S its topological boundary. The overbar covers the whole difference in each of (7) and (8). This is a source conjecture that Counterexamples7–8 refute, not an accepted rule.
  • limits: Autonomous polynomial ODEs over reals with unique maximal local solutions, finite diamond reachability and endpoint-inclusive evolution domains. Global Lipschitz assumptions for several variant/staging rules; bounded/compact staging supplies alternative duration reasoning. Fresh clocks, constant contexts, rule-specific topology and uniform progress conditions. No independent prover execution, implementation study, LLM benchmark or distributed fairness result. Counterexamples checked in this source; earlier criticized originals not independently reviewed. Invariant completeness does not imply general liveness completeness.
  • how much was read: most of it read
  • source
  • record id: an-axiomatic-approach-to-2019
• Approximate synthesis (2019)
  • title: Synthesizing Approximate Implementations for Unrealizable Specifications
  • what: Synthesizes reactive implementations against environments whose infinite input words have bounded ultimately periodic representations. A k-lasso-precise implementation satisfies the specification for every input word represented by a lasso of length at most k. An ε-k approximation instead satisfies it on at least a 1−ε fraction of those distinct input words. Sections 3–4 formalize transition systems, lassos and the difference between bounding input words and bounding environment state. Proposition 1 connects the two using an implementation-size factor. A deterministic automaton recognizes bounded-lasso prefixes; an exponential lower bound shows why this recognition is costly. Composing it with a deterministic parity specification yields an exact synthesis algorithm. Section 5 gives a bounded-state QBF encoding with O(|φ|+n²+k²) formula size as stated by the paper, with input-alphabet size present in the variable count. Section 6 reduces approximation to maximum model counting over transition/output choices and input words. Auxiliary unrollings of length 2k prevent double counting different lassos that denote the same infinite word. Section 7 implements the encodings with CAQE and MaxCount and evaluates greedy and round-robin arbiters.
  • number: 11 experimental rows
  • number: round-robin: 2 states, k=4, rate 0.5 in 26 s
  • number: round-robin: 4 states, k=2, exact 12.15 s, approximate rate 0.88 in 283 s
  • number: greedy: 1 process, 2 states, k=2, exact 0.41 s, rate 1 in 0.79 s
  • limits: All correctness and approximation claims are relative to bounded input lassos, not unrestricted environments or an empirical probability distribution. A bounded environment state space and bounded lasso length are related but distinct restrictions. The automata algorithms are exponential in k; symbolic instances also grow quickly with state bound and process count. Table 1 contains timeouts and an approximate solver result of 0.88 even for a case where exact QBF synthesis succeeds, so the reported MaxCount solutions need not reach the optimal rate. Hardware and timeout duration are not specified in the experimental section.
  • how much was read: most of it read
  • source
  • record id: approximate-synthesis-2019
• ATL star vCGS undecidability (2019)
  • title: Model Checking ATL* on vCGS
  • what: Shows that model checking ATL* and ATL on visible concurrent game structures (vCGS) is undecidable by a polynomial-time reduction from imperfect-information concurrent game structures (iCGS). The construction adds an environment agent, atoms encoding actions, states and indistinguishability classes, visibility predicates, turn variables and guarded commands. It simulates each iCGS step with two vCGS transitions, so formulas duplicate each next operator. Theorem 1 states PTIME reducibility and Corollary 1 transfers undecidability; under positional strategies, the known PSPACE/ΔP2 completeness results also transfer.
  • number: PTIME reduction
  • number: ATL* and ATL undecidable under imperfect information/perfect recall
  • number: positional-strategy cases PSPACE-complete and ΔP²-complete
  • limits: The reduction is for the specified vCGS semantics and imperfect-information/perfect-recall iCGS source; it establishes decidability limits rather than an executable implementation. Formula translation duplicates next operators, and the complexity claims distinguish unrestricted perfect recall from positional strategies. No experiments are reported.
  • how much was read: most of it read
  • record id: atl-star-vcgs-undecidability-2019
• Bayer et al. DPRM 2019 (2019)
  • title: The DPRM Theorem in Isabelle
  • what: Reports ongoing Isabelle work toward the Davis-Putnam-Robinson-Matiyasevich theorem, that recursively enumerable natural-number sets are Diophantine. Completed components include an exponentiation representation and register-machine execution implying satisfaction of 15 encoded equations. The converse direction and two Diophantine relation proofs remain unfinished in this paper; the later halting-undecidability connection is also future work. Reads both arithmetization directions and unfinished dependency chain, variable-binding/representation difficulties, finite-base trace packing, initial validity conditions, exponentiation proof resources and two boundary errors in the printed arithmetic statements. Distinguishes a whole-paper reading from a completed formalization.
  • limits: Polynomials use integer constants with natural parameters and existential natural witnesses. A predicate is Diophantine when equivalent to an existential polynomial-zero equation. Closure under conjunction/disjunction requires correct relabeling and separation of witnesses; it does not imply closure under arbitrary negation or universal quantification (§2). Tuple choices include finite lists versus index-to-natural maps, with separate or combined parameter/witness namespaces. The currently most successful implementation uses one nat⇒nat map for both. Exchange/relabeling is a major proof burden; alternative implementations are still being explored. These representation choices are consequential proof-engineering evidence rather than an automatic general compiler (§2). Binary orthogonality forbids shared 1 bits; masking requires each bit of a to be at most the corresponding bit of b. AND is characterized by c masking both a,b and residuals (a−c),(b−c) orthogonal. Number-theoretic digit operations and Lucas’s theorem support these reductions, but §6 explicitly leaves binary AND/masking Diophantine integration unproved. A displayed mathematical relation is not evidence every is_diophantine obligation was discharged (§2). Exponentiation uses α_b(0)=0, α_b(1)=1 and α_b(n+2)=bα_b(n+1)−α_b(n), b≥2. α_2 is linear; larger b gives exponential bounds. A 2×2-matrix route supplies divisibility/congruence facts and, for b>3, 15 equations in eight witnesses plus a,b,c parameters for a=α_b(c). This 15-equation system is distinct from the later 15 register-machine equations (§3). Theorem 4’s exponentiation representation is reported fully formalized in 2800 lines and 86 intermediate lemmas, plus 270 lines for is_diophantine Pexp. This component does not complete the register-machine or overall DPRM proof. No formal source audit/checker rerun was performed (§3). Reader-identified printed errors, confirmed on rendered p.33:4: the q=0 branch uses r<0 despite all variables natural, so cannot express 0^r=0 for positive r. Example p=0,q=0,r=1 has true exponentiation but no displayed branch: the first/second fail, and the third has m=bq−q²−1≤0, making p0. Also the preceding congruence q^r≡qα_b(r)−α_b(r−1) needs r≥1 under the declared natural indexing: at r=0 the truncated r−1 gives right side 0, not 1 modulo m>1. The later expanded formula avoids the negative index. These presentation defects do not establish a false underlying formal theorem. Minsky machines have finitely many natural-valued registers and states; program states contain increment-and-jump, conditional decrement-and-jump or halt. Configuration is (program counter, register list), and execution follows a fetch/update/step cycle. Initial validity includes in-bounds register/state references and exactly one halt state. The paper does not enumerate all implementation invariants or provide machine instruction code (§4 and footnote 2). Arithmetization introduces register values, one-hot state indicators and nonzero indicators at each time. To replace an input-dependent number of time-indexed equations, packs each finite history into digits of one natural number using a sufficiently large power-of-two base; masking expresses zero-indicator bit bounds. Existentially encoded finite traces establish halting, not a fixed universal time bound for every input (§4). The reported completed direction is halting of an initially valid machine implies satisfaction of the 15 time-independent equations (2400 lines). The reverse, equation satisfaction implies an actual halting execution, is unfinished (1100 lines so far), needing equation properties and digit utilities. This missing direction matters: without it, spurious arithmetic witnesses have not been formally excluded (§4). §5 defines recursively enumerable sets through machines starting at counter 0 and tape [a,0,…,0], halting exactly for members. Theorem 6 prints the intended implication is_recursively_enumerable A⇒is_diophantine A, but §6 states the overall formalization remains incomplete. Treat Theorem 6 as the target mathematical theorem and dependency assembly, not a finished end-to-end Isabelle proof. Even completing DPRM does not by itself constitute this project’s formalized undecidability proof of Hilbert’s tenth problem. §6 still requires a bridge to halting undecidability for this specific machine implementation, either proving equivalence to existing Abacus/Turing formalizations or proving its undecidability directly. Mathematical equivalence known externally does not discharge that formal proof obligation. Project reports 20 months elapsed and implementation by undergraduates with no prior formalization experience; supervisor was not directly implementing. The first-major-nonexpert claim is qualified by the authors’ knowledge. This is a descriptive experience report, not a controlled study of novice performance or proof-agent productivity. No runtime, resource benchmark or proof-checking metrics are reported (§6). Paper links the evolving GitLab formalization and plans an AFP submission. Present-day repository completion was not investigated; record reflects this 2019 paper only. No artifact run, distributed-system protocol, Verus/verified Rust, TLA+ or LLM evaluation. Relevance to proof/specification evaluation is a reader inference about accounting for missing directions and dependencies.
  • how much was read: most of it read
  • source
  • record id: bayer-et-al-dprm-2019-2019
• Brown et al. HOTG 2019 (2019)
  • title: Higher-Order Tarski Grothendieck as a Foundation for Formal Proof
  • what: Constructs a standard model of higher-order Tarski Grothendieck set theory assuming a 2-inaccessible cardinal, then combines Isabelle/HOL and Isabelle/Mizar results by proving representation bijections and preservation of operations. Demonstrates number-theory theorem transfer and alignment of lists, functions, groups and rings. Separates mathematical model construction from the explicitly Isabelle-formalized integration section; records the least-universe/choice construction, restricted domains, type and index conversions, concrete theorem scope, two repairable printed errors, manual integration and the limited evaluation evidence.
  • limits: §2 uses Church simple types, nonempty Henkin domains, logical equality/quantifiers and Hilbert choice. Standard frames contain all functions between domains; general Henkin frames may contain subsets. Models require a total logical interpretation of terms. Soundness/completeness is cited from existing literature; this paper focuses on axiom sets rather than a new proof calculus. §3 adds set type ι and membership, empty set, union, powerset, replacement and an explicit least-universe constructor. Ten axioms include extensionality, membership induction and four universe clauses. Choice is required for the claimed equivalence between explicit universes and existence-only presentations. §2 leaves equivalence of alternative HOTG axiomatizations to future work; do not treat that equivalence as already formally proved here. §4 assumes ordinary well-founded set theory and large cardinals. A 2-inaccessible cardinal is a regular limit of inaccessible cardinals, whose existence is assumed, not proved. Theorem 9 supplies a sufficient relative satisfiability result, not unconditional consistency, a converse or an equiconsistency theorem. The model interprets set objects as Vκ, truth values as {0,1}, and arrow types as full function spaces. Universes are transitive and closed under pairs, powersets and indexed unions, giving union/image closure. For each A, an inaccessible κ′ above its rank and below κ supplies a containing universe; intersecting all such universes yields the least one. Choice on Vκ+ω supplies variables and typed choice operators. Higher-order function objects need not themselves be members of the set domain Vκ (§4, Theorems 7–9). Theorem 7 checks each HOTG axiom for a standard set-theoretic interpretation with a universe function. Theorem 8 constructs that interpretation under the 2-inaccessible assumption. These are written mathematical proofs. The paper explicitly says all §5 definitions/theorems were formalized in Isabelle; it does not explicitly make the same machine-formalization claim for the §4 model construction. Reader-identified printed error, visually confirmed on p.9:7: the UnivMin proof defines f on ℘(℘A), then writes f(A)=x. An arbitrary A need not belong to that domain. The witness f(℘A)=x repairs the pair argument because A∈℘A and ℘A∈℘(℘A), with f(∅)=y. This local presentation error does not establish a false main result or an unsound formal artifact. Reader-identified printed error, visually confirmed on p.9:8: Definition 10 types s2h:ι→σ and h2s:σ→ι but its last condition is ∀x:σ.s2h(x)∈d, generally ill-typed. The displayed Isabelle definition on the same page correctly uses h2s(y) in d. The intended range condition is h2s(x)∈d; no formal-source defect inferred. §5 uses two object logics inside the Isabelle logical framework, with separate HOL/set equalities and meta/object implication. This is not a verified import of arbitrary native Mizar kernel derivations. §6 limits this work to the Isabelle specification of Mizar and re-formalized MML parts. Introductory library sizes describe context, not complete successful integration of those libraries. beIsoS combines inverse equations, restricting the set-to-HOL inverse to elements of d, and the HOL-to-set range condition. Since HOL types are nonempty, the corresponding set must be inhabited. Type/domain restrictions remain necessary even when syntactic contexts hide them. A matching name or unproved correspondence is insufficient: transfer uses proved bijections and operator-preservation equations (§5). Natural-number alignment relates Mizar’s least limit ordinal and HOL’s subtype of individuals. Recursive zero/successor maps are inverse on Nat; the inverse is defined on all sets with undefined outside Nat. Termination uses proper subset ordering on Peano naturals. Proved preservation includes addition, multiplication, comparison, divisibility and primality (§5.1). Transfers Lagrange’s four-square theorem and Bertrand’s postulate by higher-order rewriting. Integer alignment is analogous; missing exponentiation is lifted by converting set inputs to HOL, applying the HOL operation and converting its output back. Fermat-divides-3-4 covers integer x,y,z and natural n divisible by 3 or 4, concluding xyz=0 if x^n+y^n=z^n. This is not the full Fermat theorem for every exponent above 2 (§5.1). Polymorphic HOL lists (Nil/Cons) correspond to one-based finite-sequence functions, parameterized by the element bijection. Cons maps to singleton concatenation; the inverse takes index 1 and shifts the tail. Its termination follows length. Length/concatenation/index preservation includes the zero-based HOL versus one-based Mizar successor offset. Set-of-pairs functions correspond to HOL functions under domain/range bijections and preserve application (§5.2). Group and ring alignment must reconcile HOL type classes/records with explicit set carriers, named fields and intersection types. Mizar additive and multiplicative groups have distinct library theories. Omitting an explicit unit field in one forward representation does not remove the neutral-element proof obligation; the inverse selects 1.g. Ring mapping preserves zero, one, addition, multiplication and ring validity; the integer ring is aligned explicitly (§5.3). Introduction claims transfers involving Euclidean spaces, Brouwer fixed points and topological invariance results, while detailed §5 examples cover numbers, lists, functions, groups and rings. The printed paper supplies no displayed topological transfer derivation; the linked artifact remains unread, so those introduction claims are not independently confirmed by artifact inspection. Evaluation is a model argument plus formal examples and reported proof-development size: 18 definitions, 135 theorems, 2667 proof lines. No transfer runtime, proof-checking runtime, automatic alignment accuracy, benchmark comparison or repeated-run measurements are reported. Integration is described as mostly manual. Dependent-type foundation integration is future work (§§1,7). The Isabelle/TLA mention is related-work context about higher-order features in object logics, not an evaluated TLA+ distributed-protocol verification. No distributed algorithm, verified Rust/Verus implementation or LLM proof/specification agent experiment appears. Relevant methodological lessons about preserving meaning across representations are reader inferences. Artifact not fetched or executed.
  • how much was read: most of it read
  • source
  • record id: brown-et-al-hotg-2019-2019
• Characteristic Formulae for Liveness Properties of Non-Terminating CakeML Programs (2019)
  • what: Extends CakeML characteristic formulae and Hoare triples to prove total-correctness liveness properties of diverging programs. Divergent results carry lazy I/O traces; a clocked big-step semantics defines divergence as timeout at every clock and the supremum of finite-clock I/O prefixes. A transfinite-induction rule for repeat loops reduces proofs to terminating loop-body triples plus a limit-stream equation. A verified source transformation rewrites tail-recursive functions to repeat form. The framework is mechanized in HOL4 and integrated with CakeML. The semantics adds Div and FFIDiv results and POSTd predicates while preserving local separation reasoning. The repeat rule has base, successor and limit cases and a limited_parts side condition controlling all FFI resources. The transformation injects a runtime error in non-tail return branches so a transformed terminating function cannot be incorrectly treated as diverging; it is proved sound only for POSTd. Examples include silent pureLoop, conditional condLoop, infinite/finite catLoop over lazy input, cyclic pointerLoop, uncurried myRepeat, and a seL4 UAV filter. The filter proof shrinks from 1,971 lines of direct operational-semantics HOL to 1,479 lines with CF and yields an operational theorem; compiler liveness transfer remains conditional on no out-of-memory.
  • number: {‘printed_pages’: 19, ‘filter_cf_hol_lines’: 1479, ‘filter_direct_hol_lines’: 1971, ‘filter_message_bound’: 256, ‘myrepeat_proof_lines’: 8, ‘cat_proof_approx_lines’: 90}
  • limits: Divergence semantics is a supremum of I/O traces over all clock values; divergent runs have no final heap state. The repeat transformation currently handles single-argument tail-recursive, non-mutually-recursive functions; mutual recursion, curried/multiple arguments and recursion through store are future work. The induction principle requires limited_parts to bound possible FFI calls and user proofs of each terminating iteration and the infinite trace equation. The seL4 filter assumes infinite input, null termination and message length ≤256; the paper says the communication backend enforces these. Binary liveness after CakeML compilation is conditional on not running out of memory; no unconditional space bound is proved here. Formal results are HOL4/CakeML proofs, not Verus/Rust or TLA+ specifications and not LLM-generated proofs.
  • how much was read: most of it read
  • record id: characteristic-formulae-for-liveness-2019
• Communication closure / ATHOS (2019)
  • title: Communication-Closed Asynchronous Protocols
  • what: Reduces verification of communication-closed asynchronous fault-tolerant protocols with crashes, message loss, and reordering to round-based synchronous multi Heard-Of protocols. Synchronization tags encode abstract time; a rewriting algorithm preserves local executions and enables simpler deductive proofs.
  • number: five communication-closure conditions
  • number: verified agreement for leader election, Normal-Op, and Multi-Paxos
  • number: Multi-Paxos broadcast repeats three rounds
  • number: VeriFast and Z3 used in the prototype
  • limits: A user must provide a synchronization tag satisfying all five conditions; VeriFast checks the C embedding and manually inserted assertions, not arbitrary executable implementations. The reduction preserves local properties such as agreement, while liveness depends on protocol/network assumptions and catch-up jumps. The approach does not yet handle reactions to old messages; future work relates closure to FIFO assumptions. Rewriting may produce pessimistic nesting and uses mHO round abstractions.
  • how much was read: most of it read
  • source
  • record id: communication-closure-athos-2019
• convex relaxation barrier (2019)
  • title: A Convex Relaxation Barrier to Tight Robustness Verification of Neural Networks
  • what: Unifies LP-relaxed neural-network verifiers in a layer-wise convex-relaxation framework and characterizes the optimal relaxation within that framework. The primal and dual formulations are shown equivalent through convex conjugacy and layer-wise bounds. LP-ALL computes tight preactivation bounds in parallel, then solves the final LP exactly; LP-GREEDY and LP-LAST are weaker baselines. Large experiments compare these relaxations against PGD and MILP on normally and robustly trained MNIST/CIFAR networks. Even the optimal layer-wise relaxation only modestly improves existing relaxed bounds, leaving a persistent gap to PGD/MILP and motivating methods beyond this framework.
  • number: >22 CPU-years and 1000 CPU nodes
  • number: MNIST distortion gap 1.5–5× PGD
  • number: CIFAR-10 gap 1.5–2× PGD
  • number: LP-ALL optimal within the layer-wise framework
  • limits: The barrier applies to methods expressible as layer-wise convex relaxations, especially ReLU networks; it does not rule out non-convex, branch-and-bound, or other verification methods. LP-ALL requires many per-neuron LPs and large parallel compute. MILP comparisons use time limits, and PGD is an attack upper bound rather than a proof. Results are MNIST/CIFAR experiments, not all architectures or training regimes.
  • how much was read: most of it read
  • record id: convex-relaxation-barrier-2019
• CVDNI compiler (2019)
  • title: Verifying That a Compiler Preserves Concurrent Value-Dependent Information-Flow Security
  • what: Decomposes a two-execution secure-refinement obligation for concurrent value-dependent noninterference (CVDNI) into an ordinary simulation plus checks for consistent execution pace, stopping behavior and a concrete coupling invariant. Uses the principle to verify in Isabelle/HOL a proof-of-concept compiler from a locking While language to generic RISC-style assembly. Section 2 defines low-equivalence modulo access modes, memory-dependent classifications, per-thread bisimulation and closure under permitted interference. Secure refinement preserves all shared memory, not only low observations. Section 3 introduces a pacing function and proves the decomposition sound in Theorem 9. Section 4 reduces one hand-written refinement proof from about 3.6 kLOC to 2 kLOC. Section 5 implements the wr-compiler with a register-expression map and an assumption record; locks identify variables and classification-control variables that remain stable, enabling redundant-load removal while rejecting unsafe expressions and inconsistent mode changes. A refinement relation, 0/1-step pacing and same-program/same-PC coupling invariant establish CVDNI preservation for non-High-branching source bisimulations. Theorem 17 connects successful compilation and consistent initial states to that relation. Section 6 executes compilation on both threads of a desktop-compositor model and composes their security results.
  • number: proof comparison: ~3.6k → ~2k proof lines, 44% reduction
  • number: example: 9 source commands → 16 concrete commands
  • number: wr-compiler ~7k lines
  • number: CDDC verification + compilation ~1.6k proof-script lines
  • limits: Other threads must obey the synchronization discipline and satisfy their own security obligations. Source and target hide program locations/code/registers from other threads and the attacker. Shared memory is modeled as a finite variable set with total maps and deterministic per-thread steps; weak-memory effects are not considered. Microarchitectural side channels are omitted, with the paper discussing hardware/OS partitioning assumptions. Source/target languages lack pointers and arrays; enough registers are assumed and spilling is future work. The compiler result excludes branching on sensitive values even though the general decomposition handles a hand-written example that branches on a secret. The lock interpretation and classification function must satisfy stated conditions. The case study is a two-thread model, not the later three-thread CDDC model requiring shared-data invariants.
  • how much was read: most of it read
  • source
  • record id: cvdni-compiler-2019
• Declarative Proof Translation (2019)
  • what: Classifies incompatible declarative-proof features and implements outline transformations from200 Mizar Mathematical Library articles into Isabelle/Isar in Isabelle/Mizar object logic. Isabelle accepts15301 top-level outlines and the skeleton transformations are justified,but most individual Mizar by steps remain assumed. This is checked proof-structure translation with substantial unproved leaf obligations,not complete independent re-verification of15301 mathematical proofs. Compares reasoning paths,inline existential introduction,definition unfolding,cases,thesis references,existential elimination and diffuse statements across Mizar,Lean,Isabelle/Isar,Coq declarative mode and two HOL modes. Translation assumes compatible foundations and an existing per-statement syntax translation. Existential intro becomes a cut with existential lemma; diffuse blocks acquire explicit reconstructed theses; cases become a coverage lemma plus case-to-thesis implications. Missing thesis references are expanded; reasoning-path targets reconstruct universally quantified,implicational and conjunction-shaped theses with introduction rules. Identifier ambiguities trigger renaming. Equivalent but syntactically different reconstructed final theses require additional cuts; postprocessing removes unnecessary parentheses/references and uses target conveniences. Case study quantifies substantial restructuring:20233 subproofs,14827 final-thesis cuts,5144 explicit definition unfoldings,13027 extra existential proof blocks;17 identifier ambiguities. Among3236 case proofs,1354 need coverage justifications and the largest has16 cases. These details expose translation workload hidden by top-level acceptance counts.
  • number: {‘MML_articles’: 200, ‘accepted_top_level_outlines’: 15301, ‘subproofs’: 20233, ‘thesis_adjustment_cuts’: 14827, ‘explicit_unfolding_subproofs’: 5144, ‘additional_existential_blocks’: 13027, ‘case_proofs’: 3236, ‘case_completeness_justifications’: 1354, ‘max_cases’: 16, ‘identifier_ambiguities’: 17, ‘proof_size_factor’: 1.7, ‘supplied_PDF_pages’: 7}
  • limits: §3 explicitly assumes compatible foundations and known individual-statement syntax translation. Feature-rewriting algorithms alone do not establish that arbitrary assistants have compatible logics or faithful statement translations. 15301 counts accepted top-level proof outlines in Isabelle/Mizar object logic. Most individual Mizar by justifications are assumed because automation cannot yet handle them. Skeleton acceptance does not remove these assumptions or audit all source proof steps. Examples give stronger evidence than the bulk metric: Drinker’s paradox can be fully justified with existing automation; Lagrange’s theorem requires additional algebraic/reflexivity facts for term generation. Figure2 omits leaf justifications and points to accompanying formalization. Mizar structures and proof schemes are future extensions needed for a larger subsequent library portion. Further target-text readability refinement and stronger Mizar-like automation remain future work. Only size expansion and structural counts are reported; no translation timings,hardware,complexity bound,readability/user study or independently executed artifact validation. Linked accompanying translated formalization was not opened/rechecked for this record.
  • how much was read: most of it read
  • source
  • record id: declarative-proof-translation-2019
• Deconstructing Stellar Consensus (Extended Version) (2019)
  • what: # Reading: Deconstructing Stellar Consensus (Extended Version) (authored by agents unless marked 🧑) García-Pérez and Schett’s arXiv 1911.05145 v3 (13 December 2019) gives a mathematical account of Stellar’s ballot protocol. Its main construction separates federated voting, an idealized abstract consensus protocol and a concrete protocol that compresses voting statements. Read all 43 pages, eight main sections, Appendices A–E, four algorithms, four figures, all numbered arguments and 16 references. The paper has five theorem statements, four corollaries and 44 lemmas. All 43 page renders inspected through 11 contacts; pages 5, 12, 23, 29, 30, 33, 36 and 37 individually. The paper supplies mathematical proofs and illustrative executions, not a mechanically checked development or an evaluation of deployed Stellar code. The model fixes a finite universe V. A correct node follows the protocol; an honest node may additionally stop; a malicious node may deviate otherwise. Every pair has an authenticated perfect link. Partial synchrony provides a finite unknown GST after which message delays are bounded; correct timers have bounded disagreement over a given delay after GST. Trust configuration is an input to the proofs. Open membership motivates federated quorums, but this model does not prove dynamic membership changes, trust-list discovery or correctness of a complete blockchain (§§1–2). A federated Byzantine quorum system (FBQS) assigns each node a nonempty family of slices, each containing that node. A nonempty set is a quorum if every member has a slice wholly within it. Two correct nodes are intertwined when any quorum containing the first intersects any quorum containing the second in a correct node. An intact set I is itself a quorum and its projection has the required intersection between its members. Lemma 3 gives intersection inside I for any two quorums that touch I; Lemma 4 makes intersecting intact sets merge, hence distinct maximal intact sets are disjoint. Agreement is local to an intact set. The four-node Example 2 with faulty v3 has maximal intact sets {v1,v2} and {v4}; the two sets can disagree. In contrast, the classical 3f+1 construction with 2f+1 slices and at most f faults has all correct nodes in one maximal intact set (§2; Appendix A). The specification requires output once, agreement within each maximal intact set, and weak validity conditional on every node being honest. Under that condition, unanimous proposals force their value and any decided value must have some proposer. It does not require a correct proposer when malicious nodes exist. Its liveness condition is non-blocking: from any prefix, an undecided intact node eventually decides in every admissible continuation where all malicious nodes stop. The authors explicitly say that continuing malicious traffic with good timing can delay termination permanently for their chosen timeout strategy. Thus this is not unconditional Byzantine termination. Section 3’s subsequent broad sentence about entailing usual weak consensus in 3f+1 systems, and its phrase “if every correct node is honest,” need that earlier condition retained: correctness already entails honesty, and cardinality quorum intersection alone does not remove the continuing-malicious-traffic case (§3, pp4–5). Federated voting (FV) is a tagged Bracha-style primitive. A node first sends VOTE(a); a quorum containing the recipient enables READY(a); a set intersecting every one of that recipient’s slices also enables READY(a); a quorum containing the recipient enables delivery. Those slice-intersecting sets are called v-blocking. Each intact node’s blocking set touches I. Therefore its first READY for a value is justified by a quorum, preventing conflicting READY values inside I. Theorem 6 proves no duplicate deliveries, totality inside I, consistency for intertwined nodes and delivery when all nodes in I vote alike. A finite propagation argument yields an unknown bounded post-GST delivery delay δ_I once one node in I has delivered. FV alone does not guarantee a decision from arbitrary split votes (§4; Appendix B). The condition that the recipient belong to the supporting quorum is essential. In Example 2, {v3} is a quorum. If v3 is malicious and the recipient-membership condition is removed, it can send different READY values to v1 and v2 and make these intact peers deliver differently. Figure 1 gives a separate benign voting pattern over four classical nodes: two correct nodes vote false, one votes true and the malicious node helps false. The last correct node changes from its VOTE(true) to READY(false) after a blocking set persuades it. Changing a readiness value relative to one’s vote is intended behavior, rather than equivocation (§4, Figure 1, Example 8). The abstract SCP (ASCP) uses ballots (n,x), ordered first by positive round n and then totally ordered value x, plus a null ballot. It runs a Boolean FV instance for each ballot. Voting false aborts that ballot; voting true tries to commit it. To prepare b, a node delivers false for every lower ballot carrying a different value. It may then raise its candidate to the prepared ballot and vote true. Committing b decides x and stops the node. Safety combines Lemma 9, that a committed ballot had an intact preparer, with Lemma 10, that preparing a higher incompatible ballot excludes an intact READY-to-commit for a lower one. Lemma 11 tracks a largest prepared value back to some proposal when all nodes are honest. Ready-trees, whose leaves are voting quorums, support this validity argument (Algorithm 2; §§5 and Appendix C). ASCP is an idealization: it allocates infinitely many FV states and can process infinitely many ballot messages in one step. Batched network semantics sends possibly infinite sequences atomically and processes an entire received batch atomically in ballot order. These semantics do substantive proof work; they are not a measured implementation optimization. A formalization must specify admissible ordered sequences and existence of the maxima used by later definitions; a bare totally ordered value domain does not by itself provide every enumeration or maximum. The paper abstracts from Stellar’s nomination protocol and assumes arbitrary consensus proposals, so its result covers the ballot protocol, not nomination, transaction validation or a ledger implementation (§5, including footnote 1). A quorum of messages endorsing higher rounds starts or restarts a timer with delay F(round). A timeout advances to the next round, retaining the largest prepared value if any, otherwise the candidate’s value. F doubles with the round. The liveness proof defines a round’s prepare-footprint as contributing voting-quorum leaves, its abort interval as their sending interval, and its window as δ_I after the first intact preparation. Lemma 12 claims that sufficiently late windows stop overlapping when faulty nodes stop. Corollary 29 then synchronizes the largest prepared ballot across I; Theorem 13 concludes the peers either commit it or advance together with its value. Figure 2 depicts the required inequality F(n) > δ_A(n)+δ_P+δ_I. A machine proof must bound the round-dependent abort interval and justify eventual domination and persistence of this inequality; doubling F alone does not establish those steps. No numerical termination bound is supplied (§5; Appendix C, pp22–24). Concrete SCP (CSCP) replaces the infinite FV array with one bunched-voting (BV) process. A prepare statement for b summarizes aborting all lower incompatible ballots; a commit statement names b. BV stores the highest ballots voted, readied and delivered for a prepare statement, plus sets of ballots voted, readied and delivered for commit. A node votes prepare only as its maximum rises; commit voting additionally requires b to equal its maximum voted prepare. Quorum and blocking conditions combine prepare statements by inclusion of the lower-incompatible sets. Algorithm 4 keeps the abstract candidate/prepared/round logic and replaces Boolean FV calls with prepare/commit indications. State is finite at each finite execution prefix; the growing ballot numbers and commit sets are not a fixed finite-state bound (§6, Algorithms 3–4). The printed Algorithm 3 has a material guard mismatch. Line 8 checks max-voted-prep < b, whereas the surrounding explanation and the corresponding Appendix D proof use max-readied-prep < b. The statement in the prose describing lower-incompatible inclusion also reverses its direction relative to the displayed formula. A hand case exposes the guard consequence: use four correct nodes with classical three-node quorums, values {0,1}, and unanimous proposals 0. After all invoke prepare((1,0)), their maximum voted prepare is (1,0); the greatest ballot justified by those matching VOTE messages is also (1,0), so the printed strict guard rejects it. With no READY messages, the blocking rule cannot start. In a lockstep execution, timeouts make every node prepare((r,0)) before that round’s votes arrive, repeating the same rejected equality each round despite timely delivery. This identifies behavior of the literal displayed guard; it does not refute the intended max-readied-prep version. The paper’s own Figure 4 readiness steps also require the intended version (Algorithm 3, p12; §6, p13; Appendix D, p33). Theorem 14 claims observational refinement: every CSCP execution has an ASCP execution with the same proposal/decision history projected to I. Appendix D defines a simulation σ that expands prepare statements into abort batches, commit messages into true-voting batches, and preserves external events. It proves candidate/prepared/round agreement and several voting-state invariants, then checks all concrete event cases. Lemma 37 handles finite prefixes; the theorem extends to complete traces. These are paper proofs, not a simulation run or proof-tool output (§6; Appendix D). Several simulation details need explicit repair or justification before mechanization. Definition 31’s φ is a maximum over ballots whose lower incompatible ballots have delivered false, and its commit expansion uses φ(σ(τ)) < b′ ≤ b. One must fix the implicit node parameter, establish that the maximum exists, and explain which pre- or post-preparation cutoff includes the true votes generated during preparation. Lemma 33 states a readied commit ballot is at most max-delivered-prep, but Lemma 35 invokes it as a bound by max-readied-prep; the statement and use need reconciliation. The READY(cmt) cases in Lemma 37 assume b > max-readied-prep, a guard not present in Algorithm 3’s commit-readiness rules. Receiving a message at a correct recipient also does not by itself rule out contradictory earlier messages from a malicious sender. These are identified proof/encoding obligations, not completed disagreement executions (Appendix D, pp29–35). The step from finite prefixes to complete traces and the transfer of conditional properties require more than proposal/decision equality. A fair infinite concrete run must map to an admissible fair abstract run with the relevant timing and stopped-malicious-node conditions. Otherwise every finite prefix could be legal while the infinite execution starves an enabled action. Likewise, weak validity’s all-honest premise must survive the construction of abstract behavior outside I, whose external proposals are absent from I’s history. Corollary 15 cites history equality to transfer all four properties without separately spelling out these premise-preservation arguments. This reading records the claimed refinement and non-blocking result while leaving those obligations open; it supplies no general refutation of SCP (§6; Appendix D, p36). The authors illustrate matching abstract/concrete histories in Figures 3 and 4 with correct proposals 3, 3 and 1. Nodes first prepare (1,1), then prepare (1,2) with malicious support, fail to gather a commit quorum, timeout, then commit (2,2) and decide 2. The displayed concrete trace is inconsistent with Algorithm 3: besides the already identified READY-prep guard mismatch, v4 votes commit((1,2)) without ever voting prepare((1,2)). Its max-voted-prep remains (1,1), so the line-18 commit guard rejects that vote even after fixing line 8. This is an author illustration, not a certified literal execution of the printed pseudocode; the local mismatch does not by itself establish disagreement or refute the repaired protocol. No correct node proposed 2, which is permitted by the stated validity under malicious behavior. The abstract execution expands an infinite abort batch when entering round two; the concrete one represents it with one prepare statement. These are worked executions, not empirical benchmark results (Appendices C–D, Examples 30 and 38). Subjective FBQS permits each correct node to have its own view of malicious nodes’ slices, while all correct-node slices agree across views. The intact sets coincide across these views (Lemma 16); any two known quorums touching I intersect inside I (Lemma 17). These facts lift FV, ASCP and the refinement to that setting, yielding Theorems 18–19 and Corollary 20. Appendix E gives the lifted lemmas and analogous proofs. It does not allow correct nodes to disagree arbitrarily about each other’s slices, nor does it prove that a real trust configuration contains an intact set. The self-reference in Lemma 50’s proof is a visible citation error; its intended non-subjective precursor is Lemma 11 (§7; Appendix E). There are no measured performance results, production-code equivalence claim backed by an artifact, test statistics, TLA+ model, verified Rust/Verus development or LLM-agent experiment in this edition. Its contribution to distributed verification is the explicit guarantee boundary around intact sets, reusable voting lemmas and a concrete-to-abstract proof structure. The guard mismatch, assumption-preserving refinement and finite-prefix/fairness distinctions are concrete cases for evaluating specification/proof agents; that use is a reader inference. No author code, compiler, checker, solver, prover, model checker or scientific-result artifact was executed or loaded. Hand cases above are source reasoning only.
  • limits: fixed finite universe, authenticated perfect links, eventual bounded message delay/timer disagreement; intact-set local agreement; weak validity all-honest; malicious stopping for non-blocking; infinite atomic batches in abstract model; intended concrete guard differs from print; assumption/fairness-preserving refinement obligations
  • how much was read: most of it read
  • source
  • record id: deconstructing-stellar-consensus-extended-2019
• Dijkstra Monads for All (2019)
  • what: Generalizes the construction so that one executable model of an effect can have several logical specifications (for example, exceptions allowed or forbidden). Has examples in F* and Coq.
  • number: no benchmark rate, timing or proof size reported
  • number: No benchmark rate, solving time, proof lines or human effort reported
  • number: Pythagorean search example picks triples from the list 1 through 10 (§3.4)
  • limits: F* did not implement the proposed specification metalanguage. The Coq version omits the linear type system and assumes a semantic condition.
  • how much was read: most of it read
  • source; notes: Dijkstra Monads for All; notes: Dijkstra Monads for All; notes: Concrete problem records
  • record id: dijkstra-monads-for-all-2019
• EAST-ADL to UPPAAL verification (2019)
  • title: A Formal Verification Technique for Architecture-based Embedded Systems in EAST-ADL
  • what: Defines formal EAST-ADL behavioral semantics and model-to-model rules that transform AnalysisFunctions, ports, triggers and behavioral constraints into UPPAAL timed automata, then model-checks safety, timing, deadlock and liveness requirements. The verification criterion restricts the source to functions, ports/connectors, artifacts and Behavioral Annex constraints; each AnalysisFunction becomes a timed automaton with atomic urgent READ/WRITE port actions. The transformation uses broadcast channels and global/local variables, with explicit rules for periodic time-triggering, event-triggering and bounded end-to-end response via an observer automaton. A six-function Volvo steering-system-unit (SSU) model is translated directly from Papyrus EAST-ADL without SAVE-CCM; UPPAAL checks deadlock freedom, leads-to/data correspondence, state exclusion, local execution bounds and observer-based bounded liveness.
  • number: 25 SSU properties were verified successfully
  • number: UPPAAL took around 2 seconds per property on an Intel T9600 2.80 GHz processor
  • number: Maximum explored state space was 38,166 states
  • number: Periodic execution-time bound example uses 0 ≤ clk ≤ 2
  • limits: The method targets the Analysis level and assumes a FunctionalAnalysisArchitecture, broadcast communication, run-to-completion non-blocking functions and overwritable port buffers. The SSU case assumes a perfect one-time-unit periodic clock and mutually unsynchronized periodic functions; only three of six automata are shown due to space. Results are model-checking results for one industrial case, and future work explicitly leaves schedulability, resource properties and cross-level refinement for later.
  • how much was read: most of it read
  • record id: east-adl-to-uppaal-verification-2019
• Flow-LTL network update checking (2019)
  • title: Model Checking Data Flows in Concurrent Network Updates (Full Version)
  • what: Extends safe Petri nets with transit relations to track unbounded data flows, defines Flow-LTL over global runs and individual flow chains, and reduces checking concurrent network updates to finite Petri-net and hardware-circuit LTL model checking. Transit relations specify flow splitting, merging, deletion and creation without one token per packet; Flow-LTL separates run formulas (fairness/maximality) from universal flow formulas over each chain. The transformation composes one subnet per flow subformula, rewrites next/atomic propositions to skip unrelated transitions, and proves net/formula size bounds and semantic equivalence. The circuit encoding uses latches for places and invalid-input handling, then ABC IC3, interpolation and BMC. Switch Failure, Redundant Pipeline and 31-topology Routing Update cases check connectivity, packet coherence, loop/drop freedom and realistic concurrent configurations.
  • number: O(|N|·n+|N|) places in transformed net
  • number: O(|N|³·n+|N|) transitions
  • number: single-exponential decision procedure
  • number: up to 400 latches/27,619 gates verified
  • limits: The main theorem assumes safe Petri nets with transits and fairness/maximality assumptions expressed in run formulas; unbounded flows are represented symbolically via flow chains. The construction is single-exponential and has PSPACE-hard lower bound. Experiments use a prototype and 30-minute timeout; larger circuits can be falsified but not fully verified, and network updates are modeled at the chosen abstraction level rather than deployed switch implementations.
  • how much was read: most of it read
  • record id: flow-ltl-network-update-checking-2019
• Formal debate model checking (2019)
  • title: Formal Verification of Debates in Argumentation Theory
  • what: Translates abstract-argumentation debates and dispute trees into finite interpreted systems, formalizes grounded, admissible and ideal winning strategies in ATL/Strategy Logic, and evaluates MCMAS/MCMAS-SLK against specialized argumentation solvers. The translation uses Pro, Opp and Env agents; local states remember each player’s last argument while Env stores turn, last argument and attacks seen. Attack actions become protocol transitions, and propositions Pro_a/Opp_a identify who played each argument. Theorems characterize grounded acceptance with ATL reachability, admissible acceptance with SL formulas requiring one proponent strategy and opponent counter-strategy conditions, and ideal acceptance by additionally ruling out admissible opponent strategies at every opponent node. Experiments generate random frameworks with AFBenchGen2, translate each to interpreted systems, and compare MCMAS (grounded) or MCMAS-SLK (preferred/ideal) with CoQuiAAS, ArgSemSAT and Pyglaf under 1,800-second timeouts.
  • number: grounded MCMAS timed out at 80 arguments with p≥0.5
  • number: grounded MCMAS 60-argument averages 617.72 s (low p) and 1532.4 s (high p)
  • number: preferred MCMAS-SLK 6-argument high-p average 122.65 s; 10 arguments memory error
  • number: ideal MCMAS-SLK 6-argument high-p average 131.66 s; 8+ arguments often memory error
  • limits: Argumentation frameworks are finite and debates follow the dispute-tree attack relation; the generated interpreted system assumes deterministic environment action and finite-state model checking. Random attacks are sampled with one probability p and one random queried argument, so workloads do not represent structured debates. General-purpose model checkers incur state-space and Strategy Logic blowups; the paper explicitly leaves ATL formulations for admissible/ideal semantics open and provides no distributed implementation or proof assistant artifact.
  • how much was read: most of it read
  • record id: formal-debate-model-checking-2019
• Formal Proof and Analysis of an Incremental Cycle Detection Algorithm (2019)
  • what: Coq/CFML verification of an OCaml incremental directed-cycle detector, proving functional correctness and worst-case amortized asymptotic complexity together. Replaces Bender et al. fixed backward-search threshold with the source vertex current level, giving an online algorithm with total sequence bound O(m min(sqrt(m),n^(2/3))+n). Extends separation logic to integer time credits and reports a machine-checked metatheory update. A modular six-statement interface hides representation and potential while exposing telescoping credit charges. Cycle results consume the valid graph capability, so clients cannot keep using the structure after a rejected edge. Local replete-level invariants and partially relaxed forward-search invariants connect correctness to complexity. Negative credits remove repeated subtraction side conditions, but debt may not be discarded; this is backed by an updated soundness argument.
  • limits: Graph updates are sequential. Vertices must be fresh for add_vertex; both edge endpoints must already exist and the edge must not already be present. IsGraph owns the graph exclusively and entails acyclicity. No concurrent-client or distributed execution theorem is provided. On Ok, add_edge_or_detect_cycle restores IsGraph for G plus the new edge. On Cycle, it proves reachability w→*v in the original G but returns no IsGraph ownership. Subsequent calls are unsupported, even if a particular failure branch happened not to mutate anything. Time model counts one unit per function call and zero for other primitives. Source-level asymptotic claims do not bound physical CPU time, memory allocation/GC, machine stack or wall-clock latency on a specified platform. OCaml signed integers are modeled as mathematical Z, and the paper explicitly ignores finite-precision overflow. Level increments, marks and fuel reasoning therefore retain this ideal-integer assumption. No verified OCaml compiler/runtime theorem is supplied. Auxiliary graph/mark/level/adjacency operations have specifications and constant-time requirements; a concrete implementation is supplied and verified according to the authors. Enumeration is via returned collections and iteration, not a claim that traversing an arbitrary adjacency list takes constant total time. Integer credit splitting is unconditional, but only nonnegative credits are affine, meaning discardable. Negative credit records debt. DisposeGraph requires nonnegative stored potential and prevents hiding debt in an abstract graph assertion. A valid bound requires both a sound logic and discharge of final debt. Complexity is a worst-case AMORTIZED bound for a valid sequence, not a uniform bound of that amount divided by m on every individual call. Supplied charges are differences in the abstract monotone psi; actual operation cost can be paid by credits already stored in IsGraph. The top-level sequence illustration covers n fresh vertex additions and m successful distinct edge additions after initialization. A cycle-reporting call has its own specified charge but invalidates the representation. The API is not an online service that rejects cycles and continues indefinitely. The verified detector does not maintain strong components. Coq universe constraints with strict/non-strict order need a more general algorithm whose verification is future work; the cited 25-to-18-minute Coq result concerns that previously unverified algorithm. Read scope is the complete 20-page proceedings paper. Appendix A of the separate extended version contains additional mathematical proofs and was not read here. The saved record does not independently audit repository proofs, validate reported Dune deployment, or reproduce speed measurements.
  • how much was read: most of it read
  • source
  • record id: formal-proof-and-analysis-2019
• Formal Proofs of Tarjan’s Strongly Connected Components Algorithm in Why3, Coq and Isabelle (2019)
  • what: Three mechanized total-correctness developments for an abstract functional version of Tarjan’s strongly connected components algorithm on finite directed graphs. The returned set is exactly the graph’s SCC partition. Compares Why3 first-order VC automation, Coq/SSReflect higher-order proof and Isabelle/HOL with reconstructed automated proofs, using related invariant ideas and deliberately avoiding richer refinement infrastructure. Details invariant discovery, seven Why3 assertions and two interactive Coq obligations, termination via lexicographic measures versus fuel, removal of explicit colors/stack in Coq, and Isabelle domain-conditioned recursion. Reports proof sizes, checking times, interaction patterns and trust differences. Representation changes improved clarity/reduced Coq proof size but sometimes impaired SMT stability. Separates external proof discovery from kernel reconstruction.
  • limits: Finite vertices and successor closure. Sets, maps and graph operations remain abstract. Arbitrary nonempty-root choice is handled by underspecification and correctness for any legal choice. No mutable-array/pointer, machine-overflow, memory-safety or executable-code refinement theorem is supplied. Preserves linear-time algorithmic structure under suitable concrete implementations; does not present a machine-checked cost bound or executable performance evaluation. Coq reconstructs a stack from serial numbers and is not asserted to extract directly to efficient code. Why3 trusts translations and automatic backends without independently checking their proofs; two obligations use Coq proofs. Coq and Isabelle check final proofs with their kernels. Formal statements, libraries and kernels remain trust boundaries. External solver success alone does not suffice for Isabelle acceptance. Coq and Isabelle developments follow the initial Why3 proof and share its mathematical strategy. This is not blinded independent discovery or a controlled productivity comparison. Initial Why3 effort includes other graph algorithms; later efforts benefit from existing invariants. Partial correctness proves postconditions if a call terminates. Total correctness also proves valid-call termination. Isabelle recursion can diverge on malformed environments; recursive equations require domain conditions until valid-call termination is established. Human contracts, invariants, lemmas, decomposition and hints remain essential. Automatic proof lines do not mean autonomous verification. Table4 usability/readability ratings are explicitly subjective and historically scoped. Different hardware, timing scopes and proof units prevent direct ranking from the reported times/line counts. Isabelle interactions are coarser than Coq lines. No matched-hardware comparison, randomized user study, solver ablation or timing variance.
  • how much was read: most of it read
  • source
  • record id: formal-proofs-of-tarjan-2019
• Formal Verification of Quantum Algorithms Using Quantum Hoare Logic. (2019)
  • what: # Whole reading: Quantum Hoare Logic in Isabelle/HOL (authored by agents unless marked 🧑) Liu et al. mechanize a partial-correctness quantum Hoare calculus, prove its soundness and relative completeness against denotational semantics, and derive a symbolic Grover triple for the exact-success parameter family. The work includes the matrix-limit and tensor algebra needed to interpret loops and local quantum operations. It reports proof effort rather than execution speed. The record covers all 21 pages, Sections 1–7, Figure 1, the statistics table, acknowledgements, all 64 references and the license. Source excerpts remain literal; equations repaired by looking at rendered pages are saved separately. See cases and diagnostics for assumptions and evaluation limits.
  • limits: Finite-dimensional fixed variable signature; initialization omitted and modeled by precondition; well-formed matrices; partial calculus only; shallow HOL predicates for relative completeness; Grover requires natural exact R, 0<M<N, n>1 and K>R. Manual assertions/invariant and predicate side conditions; square-matrix identity automation only. Printed counter update has an unresolved n/K ambiguity. See D1–D8.
  • how much was read: most of it read
  • source
  • record id: formal-verification-of-quantum-2019
• Game-based lifted CTL checking (2019)
  • title: Variability Abstraction and Refinement for Game-based Lifted Model Checking of full CTL (Extended Version)
  • what: Introduces Verify, the first variability-specific abstraction-refinement procedure for full CTL over featured transition systems. It abstracts feature configurations into modal transition systems, solves three-valued CTL through game graphs, and refines only indefinite/failure regions by splitting configurations on the may-transition responsible for the tie. Definitions formalize TS/FTS/MTS projections, may/must semantics, and full CTL three-valued evaluation. A preservation theorem shows the join abstraction conservatively preserves true and false CTL results. Game nodes encode state/subformula positions; failure nodes identify a may-edge whose feature condition is split into ψ and ¬ψ. Theorem 3 proves Verify terminates and is correct, and incremental refinement reuses definite game-node colours. The beverage-vending example needs successive feature splits to isolate violating products. Experiments compare Verify with family-based NuSMV on synthetic n-feature models and a four-floor Elevator with nine optional features; Verify handles n=11 where fNuSMV times out after two hours and gives 28×/2.7×/2.6× speedups on Elevator properties.
  • number: full CTL (not only universal LTL)
  • number: n=11 gives 2^11 variants
  • number: Elevator 9 features / 512 variants
  • number: 28×, 2.7×, 2.6× speedups
  • limits: Feature configurations are finite Boolean sets and FTS transitions are guarded by propositional conditions; CTL is evaluated over finite abstractions with may/must transitions. Verify may require one refinement per distinguishing configuration and can still face exponential variants. Elevator translation from fNuSMV was manual, and results depend on game-graph implementation and hardware. The method targets full CTL variability models, not code-level refinement or liveness beyond CTL properties; indefinite answers require further splits.
  • how much was read: most of it read
  • record id: game-based-lifted-ctl-checking-2019
• Generating Verified LLVM from Isabelle/HOL (2019)
  • what: Isabelle-LLVM shallowly embeds a structured subset of LLVM in Isabelle/HOL, generates LLVM text, supplies a total-correctness separation logic and kernel-checked verification-condition generator, and retargets Sepref to synthesize imperative programs with explicit memory deallocation. Binary search and KMP refine mathematical specifications to fixed-width arrays/words. Details the executable state-error monad and structured memory semantics, proof-producing normalization to monomorphic instructions/recursive equations, separation ownership including allocation-size tags, framed total-correctness triples, and synthesis rules that insert deallocators when variables leave scope. Connects abstract algorithm proofs to overflow-safe64bit implementations while explicitly identifying the unverified text translation and ABI/runtime boundary.
  • limits: Total correctness is established for the shallow Isabelle-LLVM semantics through successful SUCC results, excluding FAIL and NTERM under the proved preconditions. Translation from shallow logical constants to actual LLVM text remains trusted; no proved correspondence to a deep LLVM semantics, optimizer, assembler, physical machine or OS is supplied. Memory is a finite list of allocation blocks with an unbounded supply of new blocks with structured pairs, pointers and fixed-width integers, rather than byte-level target memory. Pointer addresses have no finite bit width in the model. Floating point, poison values and structures beyond nested pairs are outside the supported fragment. Generated allocation calls use C calloc/free with architecture-dependent size_t; generator refuses potentially lossy size downcasts. Allocation-failure code exits1 after an error. Thus the claimed actual-program behavior permits out-of-memory termination rather than guaranteeing the modeled successful result under all finite resources. Recursive calls implicitly have unbounded stack in the semantics. Stack probing/split-stack protection is future work; likely guard-page termination is an informal engineering argument, not a proved resource bound or implemented universal protection. Application binary interface and correct C header are user responsibilities; C/LLVM ABIs only partially match. Correct callers, library behavior and target configuration therefore matter beyond proved Hoare triples. Refinement assertions impose representability and arithmetic bounds. Binary search requires sorted list, valid array/length representation and signed64bit elements; KMP requires |s|+|t|<2^63 and its arrays/word representations. Correctness is relative to these formal specifications, not arbitrary external input encodings. Kernel-checked preprocessing/VCG/Sepref proofs rely on Isabelle inference kernel and modeled logic. Incomplete preprocessing can fail or produce rejected shapes without supplying an unchecked proof. Trusted shallow semantics/text generation remains separate from these checked transformations. Only medium-complexity binary search/KMP case studies are demonstrated. Existing Imperative HOL basic data structures cannot simply be reused because of words/pairs; nested imperative containers currently need ad-hoc separation proofs. Large model-checker/SAT-solver ports and general overflow-refinement automation are future work.
  • how much was read: most of it read
  • source
  • record id: generating-verified-llvm-from-2019
• GTS for ATL+ (2019)
  • title: Game-Theoretic Semantics for ATL+ with Applications to Model Checking
  • what: Defines bounded, finitely bounded, and unbounded game-theoretic semantics for ATL+, proves equivalence to standard perfect-recall semantics, gives model-checking algorithms, and identifies tractable ATL_k fragments plus memory bounds. Transition games track a truth function for temporal/strategic relative atoms, a seeker that constructs finite paths, timers, and bounded seeker alternations. Positional determinacy is proved for bounded and unbounded games; a finite model has stable timer bound |States|*|At(Φ)|. The unbounded GTS yields PSPACE-completeness for ATL+ and PTIME-completeness for fixed Boolean strategic width k. Transducer constructions bound memory by 3^k-2^k generally and 2^k-1 for reachability-only ATL_kF, with a matching exponential lower bound.
  • number: stable finite-model timer k=|St|*|At(Φ)|
  • number: ATL+ model checking PSPACE-complete
  • number: fixed ATL_k model checking PTIME-complete
  • number: memory upper bound 3^k-2^k; reachability-only 2^k-1
  • limits: Standard-equivalence arguments use perfect-recall strategies and finite concurrent game models for finite timer bounds; infinite/image-infinite models may require transfinite timers (the finitely bounded semantics can differ from unbounded). ATL_k tractability assumes fixed k. The memory lower bound uses a specially constructed family of games, and no implementation benchmark is reported.
  • how much was read: most of it read
  • record id: gts-for-atl-2019
• HomuSat-HFL (2019)
  • title: A Type-Based HFL Model Checking Algorithm
  • what: Introduces HomuSat, a practical HFL model checker based on a type-based characterization and saturation-style construction of a subgame; proves termination, soundness and completeness despite HFL’s hyper-exponential worst-case complexity. Algorithm 1 computes flow/type environments as an over-approximation, then solves the resulting typability game. The paper supplies separate soundness and completeness theorems, optimizations, an implementation, and a controlled comparison against HorSatP on translated higher-order recursion-scheme benchmarks.
  • number: 136 benchmarks; 83 have no µ/ν alternation; maximum alternation count 4
  • number: Most LTSs have around 10 states, with some |Q| > 100; HES sizes range below 100 to about 10,000
  • number: Experiments ran on 2.3GHz Intel Core i5 with 8GB memory; HorSatP comparison timeout 180 seconds
  • number: Figures report HomuSat often outperforming HorSatP and runtime growing less rapidly than worst-case complexity
  • limits: Evaluation uses HORS problems mechanically translated to HFL, not native HFL verification problems; authors explicitly defer direct-HFL benchmarks. Benchmark sizes are moderate and HorSatP uses different optimizations, so runtime comparisons do not establish algorithmic superiority. Worst-case complexity remains k-EXPTIME/hyper-exponential.
  • how much was read: most of it read
  • record id: homusat-hfl-2019
• k-multiparty compatibility (2019)
  • title: Verifying Asynchronous Interactions via Communicating Session Automata.
  • what: Introduces k-multiparty compatibility (k-mc) for deterministic communicating session automata. k-mc combines k-safety (eventual reception and progress within channel bound k) with k-exhaustivity (all k-reachable sends can fire within the bound), strictly broadening synchronous multiparty compatibility. The paper proves soundness, local bound-agnosticity characterizations and pspace-completeness, then implements bounded checks with partial-order reduction. Sections 2–4 define FIFO configurations, k-reachability, stable property, output/input bound independence (k-obi/k-ibi), k-exhaustivity and k-mc. Theorem 1 gives safety for k-obi/ibi systems; Theorem 3 characterizes k-exhaustivity by local bound-agnosticity; Theorems 4–7 relate existential boundedness and synchronisability. The client-server-logger example accepts fire-and-forget sends rejected by synchronous criteria. The full benchmark table includes buggy/fixed gen_server, elevator, cloud, SMTP, HTTP, Fibonacci and industrial protocols. Section 5 reports reduced transition systems and generated worst-case chains, including the largest 12,222-state/22,220-transition run.
  • number: 20 literature examples
  • number: 0.01–0.16 s typical
  • number: 12222 states/22220 transitions
  • number: under 17 min
  • limits: Results apply to deterministic communicating automata without mixed states, with each state sending, receiving or final, and transitions subject-consistent. Soundness requires k-obi and ibi in addition to k-mc. Bounds are finite positive integers and FIFO point-to-point channels. The tool checks bounded reduced systems; unbounded safety follows only under the stated theorems. Some literature examples are modified to remove mixed states, and k-mc is not a universal replacement for all session models.
  • how much was read: most of it read
  • source
  • record id: k-multiparty-compatibility-2019
• ML prediction of LTL checks (2019)
  • title: Predicting the Results of LTL Model Checking using Multiple Machine Learning Algorithms
  • what: Trains Random Forest, KNN, decision tree and logistic-regression classifiers to predict whether a Kripke structure satisfies an LTL formula, using synthetic NuSMV-generated datasets. The aim is to avoid expensive model-checker runs for long formulas. Features encode Kripke structures/formulas and labels are NuSMV outcomes; GraphLab trains classifiers at formula lengths 25 and 500. The paper reports accuracy and speedup relative to NuSMV, but datasets are made-up and methodology follows prior work.
  • number: Accuracy at length 500: RF 97.87%, KNN 98.21%, DT 97.14%, LR 98.21%
  • number: Reported efficiency ratios at length 500: RF 7,102,500x, KNN 598x, DT 4,132,364x, LR 5,543,415x
  • number: NuSMV generated 405 and 400 records; Windows 10, i7-4790 3.60GHz, 8GB RAM
  • limits: Synthetic data may not represent real protocol distributions; predictions are not proofs and false positives/negatives are possible. Formula-length and feature-generation assumptions limit generalization. Hardware and implementation details are old, and no confidence-based abstention is reported.
  • how much was read: most of it read
  • record id: ml-prediction-of-ltl-checks-2019
• Model Checking Constrained Markov Reward Models with Uncertainties. (2019)
  • what: Studies constrained and stochastic Markov reward models with imprecise rewards, reducing bisimilarity and reward-logic analysis to linear real-arithmetic formulas. Defines affine-parametric rewards/transitions under linear constraints, encodes bisimilarity using binary relation variables and couplings, and proves a PRCTL satisfaction-set encoding when only rewards are parametric. For stochastic affine rewards, proves measurability and reduces satisfaction probability to the probability that sampled base variables lie in the symbolic parameter set. Uses quantifier elimination before Monte Carlo sampling rather than repeatedly checking each concrete MRM.
  • number: 7-state example
  • number: Example 7: approximately 0.156061; epsilon=0.005; n=198070
  • limits: PRCTL reduction requires fixed transition probabilities; the more general bisimilarity reduction permits affine-parametric transitions. Stochastic rewards are affine combinations of pairwise independent base random variables, although derived rewards may correlate. Evidence is a small running model and Mathematica/mjollnir prototype, without scalability benchmarks. Equation (9) and the examples use inconsistent descriptions of the confidence parameter; numerical values are reported as printed, not independently verified.
  • how much was read: most of it read
  • source
  • record id: model-checking-constrained-markov-2019
• Molinari interval model checking thesis (2019)
  • title: Model Checking: the Interval Way
  • what: Develops model checking for Halpern–Shoham interval temporal logic (HS) over finite Kripke structures and timeline-based system models. It proves decidability and EXPSPACE hardness for full homogeneous HS, classifies many fragments, compares interval and point logics, studies regular-expression extensions, and derives timed-automata procedures for timeline planning and MITL model checking. The thesis builds BEk descriptors for a nonelementary decidability procedure, reductions proving EXPSPACE hardness, and fragment-specific small-model/oracle/automata algorithms ranging through PSPACE and bounded-query polynomial hierarchy classes. It compares HS variants with LTL, CTL, and CTL* under homogeneous semantics, then relaxes homogeneity using regular expressions while preserving or increasing fragment complexity. For dense-time timelines, unrestricted planning is undecidable; simple future trigger rules are decidable via timed automata, with EXPSPACE completeness for non-singular intervals and PSPACE completeness for intervals in Intv(0,∞). MITL model checking reduces inclusion to timed-automata emptiness.
  • number: Full homogeneous HS MC decidable with nonelementary upper bound and EXPSPACE-hard
  • number: Simple-trigger future timeline planning decidable; EXPSPACE for non-singular intervals and PSPACE for Intv(0,∞)
  • number: MITL-over-timelines MC in EXPSPACE or PSPACE under corresponding interval restrictions
  • number: Low-level HS fragments classified into PSPACE, co-NP, and bounded-query polynomial-hierarchy classes
  • limits: Homogeneity is a major semantic assumption when evaluating HS on point-based Kripke structures and limits expressiveness. Complexity varies sharply by fragment; full HS exact complexity remains open (the thesis conjectures elementary/possibly EXPSPACE-complete). Timeline planning with unrestricted trigger rules is not known decidable, and results require simple trigger rules or interval restrictions. The thesis uses theoretical reductions and algorithms rather than implementation benchmarks.
  • how much was read: most of it read
  • record id: molinari-interval-model-checking-thesis-2019
• MPL predicate abstraction BMC (2019)
  • title: Bounded Model Checking of Max-Plus Linear Systems via Predicate Abstractions
  • what: Introduces automatically generated predicate abstractions for max-plus linear systems and a BMC procedure for time-difference specifications, with an explicit completeness-threshold upper bound from transient and cyclicity. Generates predicates from system matrices and target specifications, constructs DBM-based abstract states/transitions, checks lasso paths with NuSMV, and compares abstraction runtimes and completeness thresholds against tropical abstractions.
  • number: 10 independent runs per dimension
  • number: at n=15 predicate abstraction average 4.68 min versus tropical 27.73 min
  • number: predicate abstraction faster on average beyond dimension 8
  • number: 20 random irreducible matrices for each n=3,4,5 threshold comparison
  • limits: The experiments use randomly generated MPL matrices with two finite entries per row and time-difference formulas. BMC remains bounded and depends on the abstraction; concurrent extensions are not addressed.
  • how much was read: most of it read
  • record id: mpl-predicate-abstraction-bmc-2019
• Nakasho Shidama NDIFF_9 implicit differentiability 2019 (2019)
  • title: Implicit Function Theorem. Part II
  • what: Nakasho and Shidama formalize differentiability of an implicit solution map,building on the existence/uniqueness theorem of PartI. The article splits bounded operators on product spaces into unique coordinate operators,proves differentiability of operator inversion,and derives g′=−(D_y f)^(−1) composed with D_x f. Its final theorem supplies a unique continuously differentiable local solution of f(x,g(x))=c near a point where D_y f is invertible,for a normed parameter space and nontrivial real Banach solution/output spaces. Separates pointwise differentiability of an already continuous branch from C1 regularity and from local existence/uniqueness. Records exact space/completeness and inverse-domain contracts,operator norm estimates,quadratic inversion remainder and the implicit remainder absorption argument. Preserves local ball/range guards and imported PartI dependency rather than treating a derivative formula as a global solution theorem.
  • limits: MML NDIFF_9 version8.1.09 5.57.1355 identifies the article. It explicitly cites PartI [6] for existence/uniqueness and an earlier invertible-operator article [5]. The present record reads the fifteen-page paper,not the NDIFF_9 proof script or every imported lemma;PartI is separately recorded as formal805 (pp.117,130–131). Results1/2 preserve differentiability and total/partial derivative values when restricting to an openZ containing the base point and lying in the domain. The2proof constructs a small coordinate ball whose reprojection lies inZ. These are local domain guards,not unrestricted identities for boundary restrictions (pp.117–118). Result3 constructs a continuous H(s)=B(f(s),g(s)) on exactdomainS from a globally continuous bilinearB and factors continuous at every point ofS. Result4 constructs the continuous graph embedding x↦(x,g(x)) on exactdomainA. Result5 gives pointwise continuity of composition when the composite is defined at the point;6bounds the product norm by the sum of coordinate norms. No exact formula for the imported product norm is asserted here (pp.118–119). The printed proof of4 switches from its statement’s subsetA and outputx2 to symbolsS andH. Result5’s one-line sketch refers to a sequences1 not introduced in that displayed sketch. These are incomplete/inconsistent expository fragments,not independently established failures of the formal source or checker (p.119). Results7–9 decompose a linear operator L:E×F→G into uniquely determined L1(x)=L(x,0),L2(y)=L(0,y),and reconstructL(x,y)=L1x+L2y. Results10/11 preserve Lipschitz boundedness in both directions. Result12 gives ||L||≤||L1||+||L2|| and ||L1||,||L2||≤||L||;13 gives uniqueness as points of bounded-operator normed spaces. The estimates are inequalities,not an equality of norms (pp.119–122). Result14 assumes full differentiability atz in real normed spaces and proves both partial derivatives exist and Df(z)(h,k)=D_xf(z)h+D_yf(z)k. Its proof restricts the full remainder to coordinate axes and proves each is a little-o remainder. It does not assert that arbitrary existing partial derivatives suffice for full differentiability (pp.122–123). Result15 is pointwise and assumes real normedE,F,G,open exactdomainZ of f,z=(a,b)∈Z,f(z)=c,full differentiability atz,positive radii,an already supplied branchg with domainBall(a,r1),range inBall(b,r2),g(a)=b,continuity ata,and f(x,g(x))=c. It assumes injective D_yf and a total Lipschitz linearQ:G→F equal to its inverse,plusP=D_xf. It concludes differentiability ofg ata andg′(a)=−Q composed withP;it neither constructs the branch nor requires C1 f on a neighborhood (pp.123–124). The typedQ hypothesis in15 is stronger than injectivity alone:an inverse defined on allG supplies the missing surjectivity/bounded-inverse condition. Reading it as mere injectivity would be unsound. Continuity ofg first keeps its graph in a neighborhood ofz;the proof then defines R1(h)=−Q R(h,g(a+h)−g(a)),using the full derivative remainderR (pp.123–124). The15proof bounds the transformed remainder by one half of ||h||+||g(a+h)−g(a)||. WithL=Q composed withP,it absorbs the second term to obtain ||g(a+h)−g(a)||≤(2||L||+1)||h|| locally. This local estimate lets the full remainder become little-o in||h|| and provesg’s differentiability. It is derived rather than a pre-assumed Lipschitz condition on the branch (p.124). For16–18,X,Y are nontrivial real Banach spaces. Result16 gives K≥0,s>0 such that ||d||<s preserves invertibility ofu+d and ||Inv(u+d)−Inv(u)−[−Inv(u) composed withd composed withInv(u)]||≤K||d||². Parentheses around the inverse argument are essential:the raw expression Inv u + d means Inv(u+d),not Inv(u)+d (pp.124–125,rendering). Result17 identifies the derivative of inversion at invertibleu as d↦−u^−1 d u^−1,where DI(u) maps L(X,Y) to L(Y,X);its value atd is−u^−1 composed withd composed withu^−1,acting Y→X→Y→X. Its proof builds that bounded linear derivative and a quadratic remainder. Result18 packages inversion as a bijection between InvertOpers(X,Y) and InvertOpers(Y,X),whose inverse is also differentiable. It does not state higher derivatives,analyticity or a numerical inversion algorithm (pp.125–126). Result19 returns to real normedE,F,G and openA,B,Z withA×B⊆Z. Given a continuous branch ata,full differentiability off at(a,g(a)) and invertible D_yf there,it provesg′(a)=−Inv(D_yf)D_xf. The sketch restrictsg to a small ball,applies15,and transfers the local derivative back. This pointwise result has no explicit Banach assumption because invertibility already supplies the bounded inverse (pp.126–127). Result20 assumesE real normed andF,G nontrivial real Banach,f differentiable on openZ with continuous derivative,openA/B withA×B⊆Z,and an already continuous branchg:A→B satisfyingf(x,g(x))=c. Invertibility ofD_yf is required at every graph point. It provesg is differentiable onA with continuous derivative and the same formula. The continuity proof composes partial derivative fields with the continuous graph embedding,continuous inversion,and continuous bilinear operator composition;it is not a bare differentiation of an assumed-smoothg (pp.127–128). Result21 assumes the sameE/F/G space classes,f C1 on its open exactdomainZ,(a,b)∈Z,f(a,b)=c,and D_yf(a,b) invertible. It yields positive open-ball radii with product inZ,existence and pointwise uniqueness of a root in the solution ball for each parameter in the parameter ball,a C1 branch withg(a)=b,and invertibility ofD_yf at every graph point. Any two branches with the same exact parameter-ball domain,range in the solution ball,and equation coincide,without separately assuming their continuity (pp.128–130). The21proof first uses openness of the invertible-operator set and continuity ofD_yf to shrinkZ so invertibility persists;it restrictsf without changing local total/partial derivatives,applies the PartI existence/uniqueness result,and then20for C1 regularity. Uniqueness is inside the selected solution ball,not for all roots inF. The theorem gives no explicit radius,global continuation,branch-selection algorithm or guarantee outside those balls (pp.129–130). Reading examples,not printed:forf(x,y)=y²−x near(1,1),D_yf=2 andD_xf=−1 give the positive branchg(x)=sqrt(x),g′(1)=1/2. The negative branch near(1,−1) does not contradict local uniqueness because it lies outside a sufficiently small ball around1. Forf(x,y)=y³−x at(0,0),D_yf=0 is noninvertible and the continuous cube-root branch is not differentiable there;the inverse premise cannot be discarded. All fifteen pages,21results/all clauses/supplied sketches,11references/date read;four sheets covering all pages inspected. No numbered definitions,figures,tables,footnotes or appendices. Quotes preserve raw extraction,not visual formulas;operator inverse scope,composition,pairs,norms and derivative subscripts can be distorted. No formal artifact execution,proof timing/size,empirical benchmark or distributed/Verus/Rust/TLA+/LLM-agent experiment.
  • how much was read: most of it read
  • source
  • record id: nakasho-shidama-ndiff-9-implicit-differentiability-2019-2019
• On the parallels between Paxos and Raft, and how to port optimizations (2019)
  • what: # Reading: porting Paxos optimizations to Raft* (authored by agents unless marked 🧑) Wang, Zhao, Mu, Chen and Li study a modified Raft called Raft*, not a proof that original Raft and Paxos are interchangeable. The whole 61-page extended paper, Appendices A–C, six printed TLA+ modules, 15 figures and 67 references were read. Exact supporting passages are staged in quotes.json with section and PDF-page anchors. The central construction starts with already-correct specifications A, its optimization AΔ, and B refining A. A non-mutating optimization introduces state/actions or conjuncts without changing A’s existing state updates. Given state and action-parameter mappings, translating the added clauses produces BΔ. Section 4.3 sketches BΔ refining both AΔ and B, preserving their invariants. This is a conditional specification transformation, not a general liveness or performance theorem. Added guards can prevent progress; added actions must explicitly preserve old state, and initialization and new-variable frames must be compatible. The paper leaves implementation to developers and states in §1 that correctness is guaranteed only at specification level. Raft* prevents deletion of accepted entries by returning extra log entries during elections, selecting safe suffix values, and rejecting shorter appends. A separate accepted-ballot field distinguishes an entry’s original Raft term from its latest Paxos acceptance ballot. Figure 3 maps leader self-acceptance as well as explicit messages. One Raft* action can cover multiple Paxos operations, so porting must account for every relevant action, including implicit self-acceptance. The two implemented cases are quorum leases (PQL) and Mencius. PQL allows a leaseholder to read locally only after relevant pending writes are applied; writes notify the leaseholders of an intersecting quorum. Translating f+1 Paxos acknowledgments to f remote Raft acknowledgments must include the leader’s implicit acknowledgment and its own leaseholders. The authors describe a handwritten version that omitted those leaseholders. Mencius assigns default log-slot proposers round-robin. Nondefault recovery proposes no-ops; skipTags allow default no-ops to become executable early. The optimization must be applied to every action corresponding to Paxos acceptance, including BecomeLeader and AppendEntries, not only ReceiveAppend. Appendix B abstracts leases with one global timer; distributed-clock and real lease-expiry correctness require additional implementation assumptions. Evaluation uses five AWS regions (Oregon, Ohio, Ireland, Canada, Seoul), two m4.xlarge instances per region for client/server, 4 vCPUs, 16 GB RAM, SSD and stated 750 Mbps network. WAN latency spans 25–292 ms. Closed-loop YCSB-like workloads use 100,000 keys, a configurable shared hot-key probability and otherwise region-partitioned uniform keys. Each trial lasts 50 seconds with a stated 10 seconds for warm-up and cool-down; whether 10 seconds applies jointly or separately is unclear. Results are medians of five trials. Implementation builds on etcd c4fc8c09, retaining custom networking/batched forwarding that the authors say improves throughput 2.4×. Oregon is the favorable Raft leader placement. PQL uses 2-second leases, renewal every 0.5 seconds, default 90% reads and 5% conflict, and 50 clients per region for latency. About 90% of reads take 1 ms; leader-lease leader reads take 1.6 ms, while a 1% follower tail reaches approximately 137 ms from conflicting writes. PQL reports 1.6× throughput at 90% reads and 1.9× at 99%; write latency rises because leaseholders must acknowledge. Figure 9(d)’s x-axis runs from 50% conflict on the left to 0% on the right. Its rising speedup therefore agrees with the prose that lower conflict helps. An earlier apparent contradiction came from overlooking that reversed axis and is withdrawn. Figure 9 captions/legends use Raft where parts of the prose discuss Raft*; keep that baseline wording distinction. Mencius uses 100% puts, 0% or 100% conflict, and 8-byte or 4-KB payloads. The CPU case reaches about 55,000 versus 41,000 operations/s (about 1.34×); the network case reports 70% higher throughput than Raft-Oregon. Oregon itself beats Seoul by 30% in the stated comparison. Execution can still wait for remote earlier slots: the paper reports roughly 360 ms versus 110 ms for Mencius conflict/no-conflict cases, and about 79 ms at the Raft-Oregon leader. These are workload/deployment measurements, not a verification result, fault campaign, or universal optimization guarantee. The paper claims a machine-checkable TLAPS refinement proof in §6. Appendix C is a manual prose proof outline, and Appendix B supplies specifications and invariant statements, not executable TLAPS proof bodies. The referenced GitHub master-tree request and, after waiting over five minutes, repository metadata endpoint returned HTTP 404 on 19 October 2026 UTC. No external proof source was recovered; artifact-acquisition.json records the later response. A missing retrieval does not disprove that a historical proof existed. Appendix C calls a batch-to-sequence correspondence ‘stuttering’, although true stuttering leaves the mapped abstract state unchanged. Its one-step simulation statement needs an abstract batch action or a justified intermediate-state argument. Its BecomeLeader safe-prefix/suffix claims are asserted without derivation in this outline. Its mapping table also uses lastLogEntry.Term where the main text distinguishes the accepted ballot. Several printed specifications require repair before treating them as checker inputs. These omissions can affect semantics, so they are not classified as merely cosmetic syntax errors. Figure 4 leaves unrelated state unconstrained, uses logs’[i]=v in B versus singleton {v} in A/BΔ, and BΔ initialization quantifies k while referring to i. Appendix B’s quorum assumption prints Q⊆Quorum rather than Q⊆Acceptor (Raft variants print both). UpdateLog prints logBallot’[i] without the acceptor index. ProposeEntries prints IF i1=0 THEN raftlogs[a][i1−1][1] ELSE −1, reversing the expected initial-index test. Some modules omit introduced variables from vars/init and omit frames for new variables; PQL Apply, GrantLease and UpdateTimer preserve MP!vars but leave other PQL variables unconstrained. These are findings about the printed artifact, not executed counterexamples against the authors’ implementation or an independently obtained historical proof. For distributed-system verification, this contributes a concrete specification-transformation method and useful cases of implicit acknowledgments, state mappings and safe optimization transfer. It also separates invariant preservation from progress and measured speed, and highlights the need to check exact proof artifacts, initialization, frame conditions and batch simulation. It contains no Verus, verified-Rust or LLM proof-agent experiment. No author code, prover or model checker was run.
  • limits: already-correct input specifications; valid state and parameter mappings; added actions preserve old state with explicit frame conditions; compatible initialization; quorum intersection, crash faults and persistent state; real lease-clock implementation; invariant preservation does not imply general liveness; manually written implementation is not verified; reported TLAPS proof source not recovered; printed listing concerns are not executed counterexamples
  • how much was read: most of it read
  • source
  • record id: on-the-parallels-between-2019
• Origami (2019)
  • title: Efficient Verification of Network Fault Tolerance via Counterexample-Guided Refinement
  • what: Introduces Origami, which compresses symmetric routing networks and uses CEGAR to refine abstractions until bounded-fault reachability is proved or a real counterexample is exposed. Its soundness uses label approximation: concrete routes need only be at least as good as abstract routes under well-formed routing policies. The paper defines Stable Path Problems with Faults (SPPFs), including topology, attributes, preference order, transfer function, destination and failure bound. It gives local effective-approximation conditions (forall-exists topology, rank-equivalence and transfer-equivalence) and proves every concrete solution has a label-approximating abstract solution. The refinement loop uses min-cut plausibility, policy-aware unusable edges learned from counterexamples, candidate breadth and counterexample minimization. Models cover RIP and simplified BGP; Section 7 distinguishes pure shortest-path SP40 from policy-rich FT20/FT40/FbFT and explains actual failures when min cuts are below k+1.
  • number: 1–3 orders of magnitude fewer edges
  • number: 500–2,000 nodes; 8,000–64,000 edges
  • number: FT20 5 failures: 96/720 abstract
  • number: FT40 5: 109/880
  • limits: SPPFs are single-destination, bounded-link-failure models and must be strictly monotonic and isotonic; these assumptions ensure convergence and approximation but exclude poorly behaved policies. The approach proves reachability-like reliability, not bandwidth, congestion probability or latency. Evaluation uses synthetic Google/Facebook fattree topologies and configured routing policies, not production traces; abstraction search breadth affects runtime.
  • how much was read: most of it read
  • record id: origami-2019
• Ornaments for Proof Reuse in Coq (2019)
  • what: Devoid Coq8.8 plugin discovers a restricted algebraic ornament, a relation between structurally matching inductive types where a new index is determined by folding the old data. Generates promotion/forgetting/indexer functions, lifts definitions and proofs while eliminating old-type references, and unpacks sigma results. Binary-tree experiments compare lifted code/terms with Equivalences for Free! (EFF), showing strong large-input/term-size benefits but nontrivial fixed overhead in repeated lifts. Records exact equivalence and coherence laws, structural/input-term restrictions, heterogeneous semantic guarantee, optional proof generation versus kernel typechecking, unverified transformation-specification boundary, eliminator/constructor search rules, preprocessing limitations, user interface proof work, boolean-index encoding, all runtime/size data and comparison fairness limits.
  • limits: §3, pp.4–5: algebraic ornament adds one index determined by a unique fold. A(indices) equivalent to sigma n:B(index n indices), with promote/forget mutual inverses (section/retraction) and indexer a=first projection(promote a). Existing indices may remain. This is not a claim that a list is equivalent to vectors of any one fixed length. New fields/constructors or arbitrary invariants are outside this specific class. §3.1, p.5: search assumes B is an algebraic ornament of A, same constructor count/order, no recursive self references under products, and exactly one additional index hypothesis per recursive occurrence matching new recursive index. It synthesizes components under these assumptions; paper does not establish a decision procedure recognizing every arbitrary pair as related/unrelated. More detailed Assumptions.v is not read. §3.2, p.6: Lift assumes search preconditions/guarantees, new index type IB not A, well-typed fullyeta-expanded source term, no explicit promote/forget applications and no reference to target B. Semantic relation is heterogeneous univalent parametricity: equivalence up to transport, necessary for dependent proofs of differently typed conclusions. Nondependent functions map equivalent inputs to equivalent outputs. Guarantees include no references to source type in lifted body; reverse direction has extra B-use restrictions not fully specified here. §§3/4/5/8, pp.5–6/10/12–13/17–18: proof that generated components form equivalence is optional and disabled by default. Lift uses laws metatheoretically without receiving their proofs. Coq kernel checks generated terms, protecting typing/proof validity for actual output propositions, but does not alone show intended semantic preservation/specification correspondence. Paper gives relational algorithms and intuition; proofs that implemented commands satisfy their specifications and generated lifted-term coherence proofs remain future work. Do not call plugin or transformation correctness machine-verified. §4, pp.6–12: formal algorithm language CIComega has primitive eliminators/sigma projections, fresh named variables and standard typechecking/definitional equality omitted from figures. Priority order resolves relational rules, default keeps original unmatched term. Indexer search traverses eliminator cases of A/B in parallel, skips new index hypotheses, replaces recursive hypotheses by recursive indexer values and extracts target constructor index. Promote instead rebuilds B at computed index and packs; forget goes opposite way, drops index and eliminates projected value. Full forget rule presentation omitted. §4.2, pp.10–12: lifting motives/cases moves forgetting inside eliminator and changes induction domain. Constructor rule normalizes one promoted constructor, then recursive core internalizes conversions. Retraction removes explicit forget applications while lifting eliminators; coherence replaces indexer by projection; equivalence rule maps A to packed B. Remaining rules recurse through lambda/product/app/other inductives. ηexpansion assumption enables constructor normalization to expose required shape. §5.1, p.13: Preprocess translates matches/fixpoints to eliminator applications, but only fixpoints structurally recursive on immediate substructures. Supports individual definitions/modules including List, not every valid Coq recursive program. Nonprimitive sigma projections lack definitional eta, so terms sometimes must be repacked rather than relying on reflexivity. Refolding constants/projections after normalization avoids huge/unreadable expanded constructors. §5.2–5.3, pp.13–14: implementation delays reduction with reversed argument lists, lazilyeta-expands and caches constants/search results. Optional equivalence proofs use induction, rewriting and reflexivity; coherence proof reflexivity. Unpack handles simple functions by packing arguments/projecting outputs, splits higher-order functions into two, and rewrites equality proofs into dependent equality. These improve usability, not arbitrary automatic interface reconstruction. §§2/5.3, pp.3–4/14: packed zip accepts vectors of independent lengths and has computed result index. Unpack exposes vectors but length remains first projection of packed computation. Human-friendly equal-length zip interface requires lifting a length theorem and rewriting. Proof interfaces require equalities between equalities; for nat use h-set/UIP property. General index-independent method preliminary. Interface step is additional user work, so full automatic lift does not mean all desired types produced automatically. §6, pp.14–15: cases restricted to full binary trees. Single lift tree→sizedtree for three traversals and a permutation proof. Multiple lifts tree→BST→AVL use four intermediate types (one index per step), and BST search→AVL one intermediate. Boolean indices track validity/balance rather than only inhabited well-formed trees; authors acknowledge unnatural representation to fit algebraic ornaments. Packing over all boolean indices retains invalid as well as valid shapes, necessary for equivalence with all source trees. §6.1, p.15: Devoid-generated components suffice without added axioms for tested lifts. EFF additionally needs equivalence and inductive univalent-parametricity proofs; Devoid generates first set, small manually supplied specialized proofs second. Lifting pre_permutes via EFF required function extensionality in case study. This is an observed dependency in that workflow, not a theorem every use of EFF requires the axiom. §6 setup, p.14: runtimes are medians of10 Time Eval vm_compute runs in Coq8.8.0 on i5-5300U2.30GHz/16GB. Sizes normalized then counted by coqwc, a formatting-sensitive LOC measure, not kernel-term-node count or proof-check time. Inputs approximately10..100000nodes; rounding to0ms hides small timings. Search/lifting-generation time, peak memory, confidence intervals, source annotation burden and broad production-corpus evaluation not reported. §6.2/footnote3, p.15: EFF more general and can skip intermediates; main comparison deliberately follows Devoid incremental workflow. Alternate EFF workflow on100nodes author-reported hundreds/thousands times slower for search/traversal and pre_permutes failed normalization at1hour. Results depend on equivalence/workflow; no claim all EFF uses slower. Direct induction lifting as performance explanation explicitly author suspicion, not isolated controlled causal result. §7–8, pp.16–18: EFF supports arbitrary equivalences/opaque terms while Devoid requires transparent definitions and algebraic ornaments. CoqEAL supports broader relations but function transfer only in cited version. Other ornaments, constructors, recursion-under-products, coinductives, general fixpoints, lifted coherence/specification proofs and better interfaces are future work. No artifact build, Coq command replay or external-source/library review here.
  • how much was read: most of it read
  • source
  • record id: ornaments-for-proof-reuse-2019
• PAC statistical model checking for MDPs and stochastic games (2019)
  • title: PAC Statistical Model Checking for Markov Decision Processes and Stochastic Games
  • what: Develops an anytime PAC statistical model-checking algorithm for unbounded reachability in MDPs and stochastic games, supporting black-box sampling with only a minimum transition-probability bound and grey-box sampling that also knows successor counts.
  • number: 16 benchmark/property combinations
  • number: grey-box ε′<0.1 on 14/16 within 6 min
  • number: grey-box ε′<0.01 on 15/16 within 30 min
  • number: black-box ε′<0.1 on 6/16
  • limits: The model is finite-state in the formal game definition, non-blocking, and strategies are restricted to memoryless/positional ones (sufficient for reachability). Black-box access requires an initial state, player/action oracle, successor sampling and known lower bound pmin; grey-box additionally knows successor counts. Guarantees are probabilistic, and the anytime theorem permits a practically poor ε′; convergence schedules can require infeasibly many simulations. Evaluation uses reachability only, one core, fixed Nk=10,000 and 30-minute limits; black-box performance remains weak on several benchmarks.
  • how much was read: most of it read
  • record id: pac-statistical-model-checking-for-mdps-and-stochastic-games-2019
• Partial abstract transformers for AED programs (2019)
  • title: Verifying Asynchronous Event-Driven Programs Using Partial Abstract Transformers.
  • what: Presents a sound but incomplete verifier for P-style communicating machines with unbounded queues: exact bounded exploration plus finite list abstractions, dequeue-only best abstract transformers, convergence detection, and optional queue invariants. The αp abstraction preserves a fixed queue prefix and first occurrence of each suffix event, making a finite monotone Rk sequence. Theorem 4 proves convergence when Rk=Rk−1 and dequeue transformers add no abstract states; Corollary 5 then proves safety for all queue bounds. QuTL expresses queue-head/event-count temporal invariants; abstract checking reduces to an LTS, with conjunction handled conservatively to avoid unsoundness. PTester implementation adds candidate-invariant assistance.
  • number: 14 benchmarks; most kmax≤5; German-1 invariant-assisted 15.65 s/45.65 MB and German-2 629.43 s/284.75 MB; TokenRing-fixed 1,849.25 s; OpenWSN 2,574.25 s
  • number: Pat overhead close to PTester under bounded runs; 1 h timeout and 4 GB memory
  • limits: Assumes fixed machine count, finite event alphabet and queues as the only unbounded source (P dynamic creation excluded). QUBA is undecidable; if convergence never holds, analysis loops forever. Abstract conjunction checks may yield false positives (extra work), though not unsoundness. Evaluation is 14 P benchmarks, single Windows machine, 1 h/4 GB limits; German protocol required manually discharged invariants.
  • how much was read: most of it read
  • source
  • record id: partial-abstract-transformers-for-aed-programs-2019
• Peuter Sofronie-Stokkermans invariant synthesis (2019)
  • title: On Invariant Synthesis for Parametric Systems
  • what: Develops goal-oriented invariant synthesis for transition systems over local theory extensions. Starting from a universal safety formula, Algorithm 2 repeatedly checks inductiveness and strengthens the candidate by eliminating primed and non-parameter symbols with symbol elimination; the paper proves partial correctness and derives termination conditions. The extended paper supplies the improved two-stage symbol-elimination algorithm, assumptions (A1)–(A5), proofs of Lemmas 7–8 and Theorem 9 (partial correctness), flat/linear-variable bounds (Theorems 12–13), array-property-fragment preservation (Theorem 17), and finite-term termination (Theorem 19). Worked examples cover linear arithmetic, sorted arrays, water-tank control, and nontermination when too many state symbols are retained; eliminating additional symbols can recover a finite invariant language. It also documents an implementation using H-PILoT plus Redlog and explains why manual variable selection was needed.
  • number: Algorithm 2 iterative synthesis
  • number: assumptions A1–A5
  • number: Theorems 6, 9, 12, 13, 17, 19
  • number: H-PILoT and Redlog toolchain
  • limits: Soundness depends on local theory-extension chains, decidable ground satisfiability, quantifier elimination or equality-defined updates, flat/linear clauses, and locality of all generated candidates. The algorithm is only partially correct if it terminates and may not terminate even for linear integer programs; formulas can grow exponentially or worse under Fourier–Motzkin elimination. The method targets universal invariants and selected function signatures, and the array examples rely on APF/locality assumptions rather than arbitrary programs.
  • how much was read: most of it read
  • record id: peuter-sofronie-stokkermans-invariant-synthesis-2019
• Power2SC context-bounded POWER checking (2019)
  • title: Context-Bounded Model Checking for POWER
  • what: Defines a POWER-specific context bound and a polynomial code-to-code translation from K-bounded POWER executions to K-bounded sequential-consistency executions, then implements the reduction in Power2SC over CBMC. The paper gives an operational POWER semantics with fetch, initialize, commit and propagation events, dependency and coherence predicates, and extensions for address operators plus sync/lwsync/isync. The translation uses nondeterministically guessed initialization/commit/propagation contexts and timestamps, per-process/variable summaries, and a verifier process that checks summaries at context boundaries. Theorem 6.1 establishes a reachability equivalence for complete K-bounded runs; examples show POWER outcomes impossible under SC, including message passing and sync/lwsync behavior. Experiments cover 913 litmus tests and 24 C/Pthreads benchmarks, plus scaling with loop and context bounds.
  • number: polynomial translation size in program and K
  • number: 913 litmus tests
  • number: 24 C/Pthreads benchmarks
  • number: at most 6 contexts for reported bugs
  • limits: Analysis is an under-approximation parameterized by K contexts; it does not bound context length or storage size, so a missed bug remains possible when K is too small. The finite-data decidability consequence relies on finite data, and the backend must support nondeterministic data choices. The grammar initially omits load-reserve/store-conditional (CAS) instructions; ARM and C11 extensions are future work. CBMC experiments unroll loops and use 1800-second timeouts, and safe results mean safety only within the chosen context bound.
  • how much was read: most of it read
  • record id: power2sc-context-bounded-power-checking-2019
• PPV probabilistic higher-order logic (2019)
  • title: Formal Verification of Higher-Order Probabilistic Programs
  • what: Introduces PPV, a suite of unary and relational logics for higher-order probabilistic programs with continuous sampling and conditioning. Semantics in quasi-Borel spaces supports sound reasoning about expectations, convergence, Bayesian inference and optimization; embeddings show expressiveness relative to existing probabilistic logics and liftings. Develops weakest-preexpectation/relational judgments, axioms for distributions, conditioning and scoring, and a semantic interpretation in QBS. Examples formalize rejection sampling, Bayesian posterior properties, Metropolis-Hastings-style inference, stochastic optimization and machine-learning routines. Relational lifting is internalized parametrically, enabling coupling-style reasoning for probabilistic programs with higher-order values.
  • number: No runtime benchmark; paper reports several formal examples from statistics, inference and machine learning
  • number: PPV soundness established semantically in quasi-Borel spaces (§Abstract)
  • number: Embeddings of existing logics shown parametrically via lifting
  • limits: Programs are functional and use mathematically ideal distributions/conditioning; operational costs and floating-point effects are abstracted. Soundness depends on QBS semantics and admissibility/integrability conditions for expectations. The logic proves stated probabilistic properties but does not automatically synthesize proofs or verify arbitrary implementations. Evaluation is theorem/example based, not empirical benchmark timing.
  • how much was read: most of it read
  • record id: ppv-probabilistic-higher-order-logic-2019
• Proof Pearl: Purely Functional, Simple and Efficient Priority Search Trees and Applications to Prim and Dijkstra (2019)
  • what: Verifies a purely functional priority map with decrease-key by augmenting balanced search-tree nodes with subtree minimum bindings. Uses it to refine Prim’s minimum-spanning-tree algorithm and Dijkstra’s distance algorithm down to executable red-black-tree implementations in Isabelle/HOL. Main contribution is functional data-structure simplicity plus end-to-end abstract-to-concrete correctness, rather than a new distributed protocol or measured benchmark. Records getmin’s nonempty-map contract, annotation membership/minimality invariant, hybrid undirected-edge model, adjacency/parser contracts, root-component MST semantics, exceptional first-iteration refinement, update-before-removal proof choice, five queue/predecessor invariant clauses, deterministic ADT instantiation and Dijkstra distance-only coupling. Separates informal asymptotic efficiency from verified functional correctness and supplies concrete boundary/pseudocode/precondition cases.
  • limits: §§3.1–3.2, pp.2–3: priorities and keys are linearly ordered. Priority map is keyed uniquely, with update replacing a binding and subsuming decrease-key. getmin only promises a present binding of minimal priority when representation invariant holds and map is nonempty; ties can be arbitrary and implementation-specific. It returns the minimum pair; removal is a separate delete operation. §3.2, p.3: augmented node stores ordinary key/priority binding, balancing information and a cached minimum pair. invpst requires cached pair belong to that subtree and have minimum priority, recursively. Smart constructor recomputes min from node binding and child caches. Transform every constructor occurrence, including balancing rotations; carrying stale annotations through a structural change is not enough. §3.2, p.3: replacing each constructor with constant-size comparison work preserves underlying search-tree asymptotic operation costs under usual unit-cost comparison/constructor assumptions. Balanced red-black update/delete/lookup are described as logarithmic; root cached getmin is constant time. No mechanized cost semantics, whole-algorithm complexity theorem, benchmark timings or code/proof line counts are supplied. §4, pp.4–5: undirected graph type contains finite vertex set, symmetric irreflexive relation, and endpoints in vertex set. This models simple graphs, not parallel edges. Directed pairs support existing relation/path lemmas; doubleton {u,v} identifies opposite orientations for edge equality/weight summation. Natural-number weights are nonnegative and unbounded mathematically; claimed generalization beyond naturals is not proved in paper. §4, pp.4–5: constructor takes symmetric closure, drops self-loops and adds endpoint nodes; empty path allows u=v even outside explicit node set. Connectedness quantifies graph nodes, and tree is connected/cycle-free. Their simple path forbids repeated undirected edges, a trail convention rather than necessarily distinct vertices. Weight counts each undirected edge once via the doubleton image. §4.2, p.6: graph ADT gives adjacency list, empty and insertion of a fresh nonloop edge; adjacency order and duplicate occurrences are unspecified, but set of entries must match graph edges and weights. Non-node adjacency is empty. Empty weight function is fixed zero for determinism. Graph invariant and abstraction functions mediate every operation, avoiding direct data-structure inspection. §4.3, p.7: foldr parser accepts only lists with no loops and no repeated undirected edge, including opposite-direction duplicates. It then preserves exactly endpoints, symmetric edges and weights. Edge-list input cannot name unrelated isolated vertices; the selected root/reachable-component construction is separate. No hostile text parser or machine-integer conversion is verified here. §§5.1–5.2, pp.7–9: fix root r in graph for the main development and work on its reachable component rg, avoiding whole-input connectedness precondition. Generic safe-edge argument maintains A as subset of an MST. Prim additionally maintains paths from every selected edge endpoint back to root; adding a minimum cut edge preserves invariant and decreases number of unreached component vertices. §5.3/Definition1, pp.9–11: abstract queue maps vertices to enat, with infinity meaning absent. Predecessor edges whose source has infinite queue value encode the completed tree. Queue stores frontier vertices only after special initialization. Continued invariant states MST subset/root reachability, root has no predecessor and is absent, every cut’s outside endpoint is queued, every predecessor is a real component edge into selected vertices, and every queued finite weight matches its predecessor and is minimum among its crossing edges. §5.3, p.10: initial queue contains only root at zero, so it does not refine the abstract already-rooted tree state through the usual continued invariant. Disjunctive initial/continued invariant plus piecewise variant handles this first iteration. Updating neighbors before deleting chosen vertex lets inner proof use original loop invariant; reversing order would need an intermediate-state assertion. §5.4, p.11: foreach is foldr over adjacency entries. Update checks vertex not root, not already finished via queue/predecessor status, and strictly improved weight. Partial-list generalization enables induction; repeat adjacency entries are harmless under valid invariant. Displayed equality omits an explicit invariant antecedent and is not sound for arbitrary malformed Q/pi states; concrete case below. §§5.5–5.6, pp.12–14: abstract choices intentionally remain relational proof obligations rather than deterministic HOL code; tie breaking/order is fixed only by concrete ADTs. Locale-parametric implementation assumes graph/map/priority-map contracts, then instantiates all maps as red-black trees and graph as node-to-adjacency-list tree. While correctness uses invariant plus well-founded decreasing variant. Isabelle code generator targets SML/OCaml/Haskell/Scala; generated compiler/runtime behavior was not independently validated here. §§6.1–6.2, pp.15–16: directed graph is weight function V×V→enat, edge iff finite weight; finiteness is a separate assumption, not in graph type. Dijkstra returns distances, not paths or predecessors. Abstract D gives upper bounds, exact values on finished S, and relaxation bounds via finished vertices. Refined disjoint maps Q(frontier)/V(finished) combine into D, with S=dom V; nonnegative natural weights justify finalizing minimum estimate. §5.7/§7, pp.14/17: authors claim first verified executable Prim with efficient data structures; earlier work comparisons and novelty are author assessments, not independently surveyed here. They explicitly expect manual obligation generation against informal abstract sketches to scale poorly and point to Isabelle Refinement Framework. AFP artifacts are linked but unbuilt; no distributed communication/failure model or LLM-generated proof evaluation.
  • how much was read: most of it read
  • source
  • record id: proof-pearl-purely-functional-2019
• Quantitative Hyperproperty Counting (2019)
  • title: Model Checking Quantitative Hyperproperties
  • what: Replaces huge HyperLTL self-compositions with a counting-based model-checking algorithm using logarithmic counters and a Max#SAT prototype. Quantitative formulas count valuations of selected atomic propositions across witness traces. Automata construction proves logarithmic space in the quantitative bound and polynomial space in system size; the Max#SAT encoding uses lasso bounded-model-checking and maximization/counting variable sets. The approach supports deniability formulas beyond MCHyper’s quantifier alternation fragment.
  • number: For 8-bit passcode, MCHyper times out at 5-, 6-, and 8-bit leakage; MCQHyper takes 8 s, 335 s, then times out at 8-bit
  • number: MCQHyper uses 32/64/256 maximization variables for 5/6/8-bit cases versus MCHyper’s 32/64/256 quantifier expansion
  • number: theorem guarantees logarithmic space in quantitative bound and polynomial space in system size
  • limits: The practical prototype targets existential HyperLTL subformulas and bounded lasso encodings; MaxCount enumerates assignments and uses a one-hour timeout. Worst-case space remains polynomial in system size, and the benchmark is an 8-bit passcode checker where every instance is a violation.
  • how much was read: most of it read
  • record id: quantitative-hyperproperty-counting-2019
• Quantum physics QMC model checking (2019)
  • title: Model Checking Applied to Quantum Physics
  • what: Models discrete quantum evolution as quantum Markov chains (QMCs), interprets LTL atomic propositions either as observable-expectation intervals or traces of super-operator matrix representations, and develops an approximate model-checking algorithm for periodically stable QMCs. The paper characterizes periodic stability through peripheral eigenvalues, constructs epsilon neighborhoods of trajectories, and reduces approximate verification to omega-regular language intersection/inclusion with Buchi automata. Theorem 1 gives O(2^O(|phi|) d^8) complexity. Case studies instantiate the method on AKLT and cluster matrix-product states: halving epsilon from 0.5 to 0.125 changes unknown to true for both always-nonzero and eventually-always-nonzero specifications.
  • number: complexity O(2^O(|phi|) d^8)
  • number: AKLT and cluster: true after epsilon 0.5, 0.25, 0.125 sequence
  • number: dimension d=2 in case studies
  • limits: Approximate verification applies to periodically stable QMCs; irrational peripheral eigenphases can prevent convergence, and the returned answer may be unknown. The algorithm is asymptotic/epsilon-based, not exact for arbitrary QMCs. The experiments cover two 1-D MPS models with dimension 2 and do not establish scalability to large many-body systems. Non-periodically-stable QMCs are explicitly left for future work.
  • how much was read: most of it read
  • record id: quantum-physics-qmc-model-checking-2019
• Refinement with Time – Refining the Run-Time of Algorithms in Isabelle/HOL (2019)
  • what: Extends the Isabelle Refinement Framework with NREST, a nondeterminism monad carrying per-result worst-case time bounds, and adapts Sepref synthesis into timed Imperative/HOL. Relates abstract operation costs to concrete heap/time-credit assertions, hiding amortized potential within data-structure representations. Reports formal correctness and cost developments for dynamic-array append, duplicate removal, Kruskal minimum spanning forest and Edmonds–Karp maximum flow. The evidence is formal theory, rules and case developments, not elapsed-time benchmark measurements. Records lattice/failure/infinity semantics, latest-starting-time calculus, orthogonality of data refinement, exact HNR resource accounting, limited automation and operation-rule requirements, explicit dynamic-array constants and potential, duplicate-removal cost specification, label-dependent Kruskal complexity, reused versus newly difficult BFS arguments, and limitations of the cost model and target backend. Preserves printed mismatches separately from verified-artifact claims.
  • limits: §2.1, pp.2–3: α NREST = RES(α→enat option) | FAIL, with enat=N∪{infinity}. A map entry gives the upper cost allowed for that result, None excludes it. None is bottom, lifted pointwise; FAIL is top, empty result map bottom. Refinement reduces allowed results and cost upper bounds. FAIL permits everything as a specification and models failed assertions/nontermination; finite total-correctness claims require an appropriate nonfailing specification. An arbitrary infinite-cost NREST value is not a finite runtime guarantee. §2.1, p.3: return costs0; consume adds cost; bind takes supremum over all reachable intermediate results and adds costs. Any reachable failure makes the compound FAIL, so nondeterministic alternatives are treated conservatively. Per-result bounds can become infinite even when each separate path has finite cost. NREST is stated to form a complete lattice and monad with monotone bind/consume. §2.2, p.4: recursion RECT uses greatest fixed point in a separate flat ordering with FAIL top; F must be monotone in both flat and refinement order (mono2), otherwise RECT returns FAIL. This is not simply greatest fixed point in the cost-refinement lattice. Framework derives while/foreach/fold and monotonicity rules. Folding a finite list requires no extra termination argument; general recursive proofs still need suitable invariants/cost arguments. §§2.3–2.4, pp.5–7: latest starting time lst c Q is an infimum of per-result specification-minus-program slack, or None for failure, forbidden results or excessive cost; unreachable results contribute top. c≤RES Q iff Some0≤lst c Q. Composition lst(bind m f) Q = lst m (λy.lst(f y)Q) enables syntax-directed rules for return/consume/SPEC/bind/recursion/loops. Fold rule uses processed/remaining-list invariant and uniform body cost; VCG creates obligations, not all proofs automatically. §§2.5–2.6, pp.7–8: concretization maps an abstract result/time map through a relation, taking supremum of costs for related abstract values. Data refinement changes map domains, not time values. Refinement VCG simulates structurally similar abstract algorithms in lock step, reducing to local refinement and cost inequalities; valid relation and data invariants remain user proof obligations. §3.1, pp.8–9: concrete Heap procedure maps heap to optional(result,heap,natural-cost). Separation algebra uses abstracted heap plus time credits, allowing heap ownership and potential to split. Total-correctness Hoare triple requires termination and t≤n credits, leaves n−t credits and permits garbage collection via separating true. Basic array/reference operations cost one model step; whole-array operations cost length+1. These are semantic operation counts, not measured CPU instructions, wall time, allocator overhead or arbitrary-precision arithmetic bit costs. §§3.2–3.3, pp.9–11: Sepref symbolically executes NREST, synthesizing structurally similar timed Imperative/HOL and refinement assertions. HNR is conditional on abstract m≠FAIL; concrete execution uses heap credits n plus ta reserved for a related abstract result, preserves Γ′ and result relation R with leftover n+ta−t≥0. Hidden credits support amortized implementations. Result-dependent bounds are needed for compositional bind; constant final SPEC P (λ_.t) gives an equivalent ordinary time-credit Hoare triple. §4, pp.11–12: abstraction separates algorithmic cost proof from concrete data operations; generic BFS and greedy minimum matroid basis can be reused. Automatic steps include generating specification VCs, lock-step algorithm refinement and Sepref synthesis using available HNR leaf rules. Side-condition automation is limited; assertions carry size/precondition facts. Concrete operation proofs use timed separation logic/sep_auto with time-credit frame inference, sometimes interactive proofs. §4.1 Table1, p.12: matrix array create O(n²), lookup/update O(1); red-black set/map create O(1), operations O(log n); array set/map create O(n), operations O(1); dynamic-array list create/append amortized O(1), lookup/update O(1); union-find initialization O(n), union/find O(log n). Those representation-specific bounds are not claimed for all abstract sets or arbitrary unbounded labels. §5.1, pp.13–15: dynamic-array append worst-case raw budget5n+9 and amortized19 with potential10n−5capacity. Advertised HNR append budget19; client reserves23. Potential proof requires unfolding implementation, not merely applying coarse raw triple. Duplicate-removal client uses red-black sets and dynamic output arrays, reserves membership/insertion cost in input length rather than actual set size, and uses assertions to prove this overestimate sufficient. §5.2, pp.15–16: Kruskal development starts from minimum weight basis in a matroid, instantiates cycle matroid, replaces independence with disjoint-set comparison, then fixes natural-number vertex labels and union-find domain0..M where M is maximal label. Final minimum weight spanning forest bound O(E log E + M + E log M) assumes linear edge-list extraction, O(n log n) sorting and logarithmic union/find. This bound depends on numeric label range, not merely number of vertices. Only logarithmic union-find proof is supplied; inverse-Ackermann bound cited from a separate Coq development. §5.3, p.16: Edmonds–Karp refinement reuses abstract BFS, shortest augmenting paths and residual-graph operations. Outer augmentation bound O(VE) already prepared in earlier correctness development; final timed Imperative/HOL cost O(VE(E+V)). Tight BFS O(E+V) needs an additional amortized argument beyond its earlier lexicographic termination proof. Residual matrices implemented with arrays; source says linear initialization, while Table1 gives O(n²) matrix creation, so the unit of size matters. §§5.2–5.3, pp.16–17: authors report functional proof obligations reusable unchanged after adding time, but extra size assertions and runtime VCs needed. No lines-of-proof/reuse percentage, check-time table, machine timings, dataset or head-to-head empirical speed benchmark is supplied. The working hypothesis that old termination proofs transfer cheaply holds only for coarse bounds; fine bounds can demand substantial new work. §6, p.17: timing-function parameters remain inconvenient; abstract operation currencies and exchanges are proposed future design. Only runtime upper bounds studied; lower bounds, stack, energy, generalized source/target Sepref, timed LLVM semantics and stronger automation left future work. Mention of existing untimed LLVM generation does not establish this paper’s time guarantees for native LLVM code. No distributed-system,TLA+,Verus,Rust or LLM-agent experiment.
  • how much was read: most of it read
  • source
  • record id: refinement-with-time-refining-2019
• RMC-Regular (2019)
  • title: Regular Model Checking with Regular Relations
  • what: Extends regular model checking from rational transition relations to MSO-definable regular relations over infinite strings, introducing nondeterministic streaming string transducers on infinite strings (ω-NSSTs). Proves ω-NSST and ω-NMSOT express exactly the same relations; gives a PSPACE type-checking procedure by automata products and summary maps; uses closure under composition to obtain decidable bounded model checking even when a regular relation’s post-image is not regular. It also identifies functional-fixed-point and inductive-invariant conditions that can certify unbounded safety.
  • number: Theorem 1: ω-NMSOT = ω-NSST
  • number: Theorem 2: ω-NSST type checking is decidable in PSPACE
  • number: Corollary 1: bounded model checking with regular relations is decidable
  • limits: Unbounded regular model checking remains undecidable, even for rational relations. Iterative image computation is unavailable because regular-relation images may be non-regular and non-context-free. Safety certificates require a suitable functional stabilization or supplied ω-regular invariant; no implementation benchmark is reported.
  • how much was read: most of it read
  • record id: rmc-regular-2019
• SecCSL (2019)
  • title: SecCSL: Security Concurrent Separation Logic.
  • what: SecCSL extends concurrent separation logic with relational assertions for data-dependent value sensitivity and location sensitivity. Assertions can express pointers, arrays, shared invariants, and security labels; lock invariants combine functional heap facts with policies for attacker-observable sinks. The logic’s compositional noninterference property is timing-sensitive, so branches on secret values are forbidden. The authors mechanize soundness in Isabelle/HOL and implement SecC, a symbolic-execution verifier for a C subset. The central case study is a lock-protected record whose classified flag controls data sensitivity and whose public OUTPUT_REG sink must never receive secret data; a variant of Covern’s CDDC case study and known benchmark problems are reported as verified within milliseconds in the abstract/overview.
  • number: SecC targets a subset of C
  • number: well-known benchmark problems reported within a few milliseconds
  • number: one concurrent lock/record/OUTPUT_REG case study plus CDDC variant
  • number: soundness mechanized in Isabelle/HOL
  • limits: The logic targets shared-memory, lock-based synchronization and passive attackers; security includes timing of observable updates. Secret-dependent branching is prohibited to preserve compositionality, though the authors suggest future relaxation. The extracted paper contains the design/overview and reports but limited detailed benchmark tables. Verification assurance depends on SecCSL soundness and the modeled C subset; it does not cover arbitrary concurrency primitives or active attackers.
  • how much was read: most of it read
  • source
  • record id: seccsl-2019
• Sibai-Mokhlesi-Fan-Mitra CacheReach (2019)
  • title: Multi-agent Safety Verification Using Symmetry Transformations.
  • what: Develops symmetry-based reachability caching for parameterized hybrid/dynamical agents. Equivariant dynamics map modes and initial sets into a common virtual system; cached virtual reachtubes are transformed back instead of recomputed. CacheReach implements tube and safety caches, supports multi-agent collision checks, and derives finite-cache proofs of unbounded-time/agent safety under scenario-coverage assumptions. Theorem 2 proves transformed over-approximated reachtubes remain sound for parameterized systems; Theorem 3 constructs a virtual parameter pv and inverse transformations for every mode. symComputeReachtube covers an initial set with cached tubes, extends/truncates horizons, computes uncovered regions, and unions results (Theorem 4). symSafetyVerif reuses monotone cache results; unsafe answers can be false positives because over-approximation and cache cells may include extra states, while safe answers are sound (Theorem 5). Theorem 6 lifts one safe virtual scenario to infinitely many transformed scenarios, and symMultiVerif time-aligns guard-triggered mode tubes for pairwise collision checks.
  • number: up to 66% safety-verification time savings
  • number: up to 2.7× runtime reduction for 3 linear agents
  • number: 1–3 agents per model
  • number: 3-D linear and 4-D nonlinear aircraft models
  • limits: Agent vector fields must be Lipschitz and Γ-equivariant with invertible transformations; virtual-system coverage requires every mode to map to a fixed pv. Reachtubes are over-approximations, so unsafe reports may be spurious; cache cells and grid quantization trade savings for conservatism. CacheReach assumes agents share dynamics and do not interact, and unbounded safety requires proving no new virtual scenarios appear. Experiments cover only 3-D linear and 4-D fixed-wing models.
  • how much was read: most of it read
  • source
  • record id: sibai-mokhlesi-fan-mitra-cachereach-2019
• Strong observational refinement and forward simulation (2019)
  • title: Putting Strong Linearizability in Context: Preserving Hyperproperties in Programs That Use Concurrent Objects
  • what: Defines strong observational refinement by matching, for each deterministic concrete scheduler and arbitrary client, an abstract scheduler with exactly the same set of projected client observations. Proves hyperproperty preservation and claims equivalence to interface forward simulation; specializes this to strong linearizability against atomic specifications, and derives disjoint-object composition and base-object instantiation rules. Motivates non-atomic reference objects for implementations that are not strongly linearizable. Entire conference proofs assessed; printed formalization/proof and simplified snapshot qualifications retained. Records exact client/object isolation, scheduler and observable-alphabet contracts; finite trace semantics; stack information-leak schedule; necessity proof using recorded calls and guessed continuation languages; composition versus instantiation; prefix-consistent linearization witnesses; non-atomic snapshot/partial-order reference examples. Supplies a concrete repeated-value counterexample to literal Figure3 and marks compressed proof/notation defects without claiming all intended theorems false.
  • limits: Objects and client programs are deterministic labeled transition systems in the step sense: a full action trace determines state, while multiple differently labeled actions may be enabled. State/alphabets may be infinite. Call/return actions carry method, data and operation ID; internal object actions disjoint from program actions. Histories pair calls/returns and obey well-formedness; thread assignment is suppressed. Executions/traces defined here are finite sequences. No machine-checked metatheory or runtime implementation is delivered. Clients communicate with objects exclusively by calls/returns, not auxiliary shared memory. Observations are projected program-internal actions; explicit recording actions can include calls, arguments and results. Refinement requires trace-set inclusion for every client, equivalent to history inclusion under inherited natural object assumptions. Footnote5: calls cannot be disabled or disable other actions and may commute left; returns cannot enable other actions. These restrictions matter when transferring generic LTS statements to arbitrary APIs. Atomic specification LTS stores current historyh and legal sequential linearizationhs. Calls extend h, internal lin(k) appends an operation to hs, returns extend h only for an already linearized operation. Valid-state and well-formedness restrictions are essential; atomic does not mean calls/returns cannot overlap, but effects occur at one ordered internal point. Ordinary linearizability/refinement applies to trace properties; it cannot alone justify arbitrary properties of sets of traces. Scheduler maps full past action sequences to sets of next actions. Admitted scheduler is nonempty at every consistent prefix and chooses only enabled actions. Deterministic means S(trace) is entirely program-internal or a singleton, resolving implementation nondeterminism while permitting unresolved client alternatives. It may react to prior observed high inputs/coins; no future oracle. Formal wording does not force every coin branch to remain. Nonempty admission on terminal/deadlocked states needs an explicit terminal/totalization convention to model terminating programs; no such convention is spelled out here. Strong observational refinement quantifies forallP forall admitted deterministicS1 exists admitted deterministicS2 with equality of projected observation sets. This is stronger than choosing a separate abstract run for each concrete run. Hyperproperty satisfaction means every deterministic scheduler observation set belongs to the desired set-of-sets. Theorem4 then transfers every abstract hyperproperty to concrete. Probabilistic interpretation assumes randomness is client-internal and probabilities can be encoded in action names; no probabilistic object behavior or statistical benchmark is analyzed. Forward simulation relates initial states and universally matches each concrete transition from each related abstract state by a finite sequence with the same call/return projection. Internal steps may match zero or more abstract internal steps; visible step matches exactly the same one visible label, surrounded by internals. Theorem8 claims iff strong refinement. Fixed linearization points are one instance, not the only form of forward relation. Relation can be nonfunctional and require ghost/history state to construct consistent witnesses. Lemma6 sufficiency rewrites concrete scheduler traces: replay program actions unchanged, replace each object step by a chosen matching abstract sequence. Printed proof temporarily treats a sequence as one scheduled choice, then says to schedule it one step at a time. A rigorous construction must resolve overlapping abstract prefixes consistently and account for arbitrary internal stuttering/admission; no infinite-run or progress guarantee follows merely from this finite matching relation. Later register paper read in formal655 explicitly confines corresponding iff to finite traces and notes progressive variants needed for infinite traces. Lemma7 necessity constructs a one-state most-general client with record(a) and guess(H) actions for arbitrary continuation-history setsH. Scheduler records each interface event, offers guesses for successor continuation languages, then chooses an object action consistent with selected guess. It claims O1 to scheduler-restrictedO1[S1] simulation using equality of after1 languages, then equal client observations yield a forward simulation toO2 and relations compose. Construction is semantic and may use enormous/infinite alphabets, not an implementable finite verification algorithm. The crucial Lemma7 after-language equality to matching successor-language step is asserted by simple induction. Equality of trace languages alone generally does not imply such branching simulation; full proof must justify the stronger property from special scheduler/object structure. The conference paragraph does not supply that justification. This is a proof-construction qualification, not an independently established counterexample to Theorem8 under all intended object assumptions. Full version not examined. Printed Γ-determinism definition onp5 asks a given Γ-traceτ to be a subsequence of some longer traceτprime reaching a unique state, rather than equality of observable projection. Taken literally τ=empty makes every reachable state from a state unique, far stronger than ordinary observable determinism and incompatible with examples. Do not copy that definition without clarification. p8 parenthesis says forward simulations do not suffice for refinement, although Definition5 immediately implies trace inclusion; intended issue is that they are not necessary for arbitrary refinement. Theorem9 locality assumes products of objects with disjoint state and action alphabets, including distinct operation identifiers. Strong refinement of product iff both component refinements; theorem stated without detailed proof from projection/product of relations. Theorem10 instantiation is different: context and base object synchronize on the base interface; if O(Spec1) strongly refines Spec and B1 strongly refines Spec1, then replacing base withB1 preserves it. Hiding/renaming internal base labels must keep top-level client interface consistent. Does not license sharing unmodeled memory between components. Strong linearizability functionf maps full concrete traces (including internals) to legal sequential histories, preserves prefixes, and linearizes each history. Theorem13 claims equivalence to interface forward simulation toward atomic object. Lemma11 selects hs from a possibly relational F; arbitrary independent selection need not be prefix preserving. To obtain the theorem, choose witnesses recursively along the execution tree, extending previously chosen abstract path. Conference shorthand omits this consistent selection; not a refutation of existence. Lemma12 relates state(τ) to(histτ,fτ). Its printed call/return cases assume f stays fixed on a call and, at a new returning operation, adds exactly that operation. General prefix-preservingf may also append other pending operations or a newly called operation at those steps. A complete proof must simulate the entire appended block, or first normalizef; otherwise the chosen next pair need not belong to that F. Internal-step case already permits such a block. This is an omitted case/normalization in proof as written, not a demonstrated counterexample to Theorem13. Printed real-time preservation definition onp6 uses iff for whether each return precedes each call in history versus linearization. Standard linearizability requires only preserving existing order, allowing serialization to order formerly overlapping operations. Two overlapping completed operations cannot satisfy literal iff in either sequential order. The record uses the intended one-way condition for main results and marks printed biconditional as a formal wording defect. Stack example Figure1: threads push0/pop and push1/pop, third waits for both pushes then push2/high Boolean input. Concrete stack saves range at pop start and atomically removes highest non-null cell below that bound. Schedule both pops after saving bound2, then push2/high; later select which pop takes1 versus0 based on high, forcing low1=high. Atomic stack cannot give same set of completed low/high outcomes under that schedule. Described hyperproperty is this particular noncorrelation condition, not a full formal proof of every security noninterference notion. Figure3 literal snapshot implementation uses plain cell values, scans repeated sequential collects and returns when consecutive collected arrays match. No version tags or no-repeated-update promise appears. With arbitrary repeated values this can return a vector never present in memory; a concrete n2 schedule below refutes ordinary snapshot linearizability and the literal claimed refinement to instantaneous-snapshot reference. The cited original Afek algorithm is not independently read/refuted; footnote10 labels printed code simplified. Monotone/versioned cell data or another repair is needed to justify this example. Figure3 reference scan accumulates instantaneous snapshots then nondeterministically returns any saved array, enabling deferred adversarial response. Caption initializes snaps with initial mem and loop may run zero times, so it can also return a stale initial array after completed updates. Thus literal reference is more permissive than a legal atomic snapshot and is not automatically itself linearizable. Hyperproperty preservation via a valid refinement can be useful with an overapproximate reference; claim of concrete-to-reference refinement still needs proof and fails for the repeated-value example as printed. Even a repaired double-collect scan need not be wait-free under continually changing cells; no progress theorem given. Figure3 strong-refinement argument and simulations for queues/stacks are only discussed with pointers to full version/prior work. Queue/stack non-atomic specs store elements in a real-time partial order; enqueue/push adds, dequeue/pop picks minimal/maximal. Underlying Herlihy–Wing queue, Time-Stamped Stack and Afek stack implementations and detailed proofs not audited here. Entire supplied17-page conference version read including previously missing §§4–7. No separate arXiv1905.12063 read, mechanized proof, proof assistant artifact, Verus/Rust/TLA+ model, LLM involvement, source execution or performance measurements. Current claims about later infinite-trace refinements are supported by formal655 paper, not attributed to this2019source. Printed example/proof issues do not justify discarding the central refinement approach or inventing a general theorem counterexample.
  • how much was read: most of it read
  • source
  • record id: strong-observational-refinement-and-forward-simulation-2019
• Symbolic Monitoring Against Specifications Parametric in Time and Data (2019)
  • what: Introduces parametric timed data automata (PTDA) and an online monitoring algorithm that symbolically returns the complete validity domain of both timing and data parameters for a finite timed event log. The automata include unbounded data variables, memory, aggregation and unobservable transitions, allowing parameter inference and timed pattern matching in one formalism. Defines typed data guards and updates separately from clocks: rational data support linear arithmetic; strings support equality/disequality and assignments. Timing parameters are positive rationals. Observable and unobservable symbolic configurations propagate clock/parameter and data constraints; accepting configurations project to parameter valuations, and a final unobservable closure catches matches after the last observed event. Theorem 1 establishes termination when symbolic restriction/update, emptiness and projection terminate, under the global no-unobservable-cycle assumption. Convex polyhedra and finite string-constraint representations provide concrete terminating instances. SyMon implements strings and integers in C++ with PPL and merges adjacent polyhedra. Experiments explain bounded configuration counts in the selected automata rather than asserting a general linear complexity result.
  • number: more than 10,000 events monitored in one or two minutes
  • number: Copy is 50–100 times faster than Dominant/Periodic under the chosen constraints
  • number: Dominant with 2,000 events: SyMon 14 s and 6.9 MiB; IMITATOR exceeds 3.75 GiB
  • number: observed linear time and roughly constant memory on the three benchmark families; exponential behavior possible in general
  • limits: Assumption 1 excludes any loop of unobservable edges. Termination also depends on the chosen data domain supporting terminating restriction/update, emptiness and projection. The experiments use three original generated benchmarks; near-constant memory and linear event-time follow from their bounded active configurations. The authors explicitly allow exponential growth for other automata. They do not prove a general expressiveness superiority theorem. Comparisons with MonPoly/DejaVu concern different, less parametrized properties; those tools can be faster on the tasks they support. A comparison against a competing parametric signal monitor was unavailable because its implementation was not public.
  • how much was read: most of it read
  • source
  • record id: symbolic-monitoring-against-specifications-2019
• Synchronous threshold automata BMC (2019)
  • title: Verifying Safety of Synchronous Fault-Tolerant Algorithms by Bounded Model Checking
  • what: Introduces synchronous threshold automata (STA) for round-based fault-tolerant algorithms, proves parameterized reachability undecidable in general, and uses SMT to infer parameter-independent diameters as completeness bounds for bounded model checking safety. Defines STA counter systems with parameterized locations, linear threshold guards, resilience conditions and synchronous transitions. A two-counter-machine reduction establishes undecidability. For monotonic 1-cyclic STAs, schedules can be shortened to O(|Ψ|c), where Ψ is guard-atom count and c longest automaton path; trapped guards imply monotonicity. BMC encodes violations with quantified Presburger formulas, handling both ordinary and clean-round algorithms. Python tooling with Z3/CVC4 evaluates reliable broadcast, FloodMin/Floodset, k-set agreement, phase king/queen and other fault models; it found a published phase-king threshold bug.
  • number: diameters 1–4
  • number: phase king diameter 4
  • number: phase queen diameter 3
  • number: 4GB RAM
  • limits: Bounded BMC is complete only when a valid diameter exists or a theoretical monotonic/1-cyclic bound applies. General STA reachability and diameter can be unbounded/undecidable. Clean-round algorithms require the clean-round condition encoded manually; automatic detection is future work. Encodings assume linear guards/constraints and SMT quantifier performance; liveness is not addressed.
  • how much was read: most of it read
  • source
  • record id: synchronous-threshold-automata-bmc-2019
• The Marabou Framework for Verification and Analysis of Deep Neural Networks. (2019)
  • what: Presents a modular SMT-style satisfiability engine for piecewise-linear neural-network queries. Custom revised simplex repairs linear constraints; activation objects repair or case-split nonlinear constraints; topology-aware bound tightening simplifies them; timeout-driven input partitioning supports parallel solving. Reports comparisons on 180 ACAS Xu, 500 CollisionDetection and 81 TwinStream queries. Soundness/completeness is asserted through an extension of the cited Reluplex proof, not proved in this tool paper or machine-checked here. Specifies contracts for activation satisfaction, local fixes, equivalent exhaustive linear case splits and entailed bounds. Describes an ordered engine loop and queue-based D&C timeout escalation, plus symbolic input-dependent neuron bounds. At four cores Marabou generally beats Planet but not ReluVal; at 64 cores the authors report better average ACAS runtime, with ReluVal crashes qualified and their treatment in averages unspecified. Arithmetic trust, imported proof details and exact solved counts and per-query timing data remain outside the presentation.
  • limits: Query variables represent neurons; weighted sums are linear equations and activations are piecewise-linear constraints. Supports fully connected and convolutional feed-forward DNNs, with built-in ReLU and Max. Modularity does not establish support for arbitrary smooth activations, recurrence or every TensorFlow operator. Activations are restricted to guarantee termination. The solver checks satisfiability of network plus property constraints. To verify safety, encode a violating behavior: UNSAT excludes violations, while SAT supplies a satisfying assignment/counterexample relative to that encoding. The text mentions nonlinear property constraints, but no decision procedure for arbitrary nonlinear input/output relations is specified. Soundness, completeness and eventual termination are author claims said to follow from a straightforward extension of Reluplex. No full proof, machine-checked development, proof certificate checker or rounding analysis appears here. Imported proof assumptions and correspondence to actual C++ execution are not independently established. State includes the current assignment, variable bounds and constraints. Custom revised simplex uses implicit matrices, steepest-edge selection and Harris ratio tests. Replacing GLPK avoids repeated translation and supports deductions tailored to activations. No ablation isolates these choices or validates numerical behavior. Activation objects implement satisfied, getPossibleFixes, getCaseSplits and getEntailedTightenings. A local fix can violate other constraints; SAT requires all constraints. Splits must be equivalent and exhaustive; bounds must be entailed. New classes must meet these obligations, which extensibility alone does not prove. Repeatedly violated activations are case-split to ensure progress. For Max, cases select either maximal input and permit overlap at ties. The paper provides examples/contracts, not an implementation-level proof for all branches and pivot heuristics. Constraint deduction uses activation notifications and row equations. Network deduction expresses neuron bounds as linear functions of inputs; tighter inputs can force activation phases. Bounds must enclose every feasible value. Reader observation: an uncertain ReLU cannot be replaced by one chosen phase without a valid bound or case split. Ordered engine rules: split after repeated fixes; backtrack or UNSAT on inconsistency; repair linear violations; repair activation violations; otherwise SAT. Deduction uses heuristics. Stack management, cycling avoidance, thresholds, tolerances and implementation invariants are not fully specified. D&C queues query/timeout pairs starting at (phi,T). UNSAT removes a subquery; SAT ends search; timeout partitions into k queries with timeout m*t. UNSAT aggregation requires complete input coverage; any SAT branch suffices. Partition heuristics and parallel coordination are not formally verified. This is not a distributed-protocol correctness result. Smaller input regions may improve sequential deductions, but no controlled single-core D&C ablation appears. Partition overhead and imbalance prevent inferring linear speedup. Core theoretical termination does not guarantee completion within experimental timeouts. Interfaces accept compiled C++ queries, NNet/text files and Python/TensorFlow protobuf. Parser correctness, operator translation and correspondence to deployed floating-point inference are unproved here; results concern the encoded query. Four-core comparisons use 180 ACAS Xu queries with Marabou D&C T=5,k=4,m=1.5 and one-hour timeout. ReluVal/Planet comparisons explicitly use four cores; Reluplex parallelism is unstated. The additional Planet comparison uses 500 CollisionDetection and 81 TwinStream queries: 761 total named queries by reader arithmetic. ReluVal could not run CollisionDetection/TwinStream due to technical difficulties. At four cores Marabou generally beats Planet, not ReluVal; Figure3 also shows many gains over Reluplex and outliers. No solved-count table, SAT/UNSAT split, medians, repeats, machine configuration or exact revision hash appears. TO/ERR bins are not finite runtime measurements. Figure2 plots average ACAS runtime for P1–P4 at 2,4,8,16,32,64 CPUs. Authors claim better overall average at64 cores and completion within two hours, except a few ReluVal segfaults. ReluVal remains faster on P4, so this is not superiority on every property. Exact means, crash counts, censoring treatment and raw data are absent; no plot values were digitized. Figure3 has logarithmic axes, Marabou vertical, comparator horizontal, equal-time diagonal and TO/ERR categories. Bottom-right legend calls the prose CollisionDetection family CollisionAvoidance; no extra distinct dataset is inferred. Overlapping points prevent exact solved-count recovery. Front page bears a CAV/AEC Artifact Evaluated badge. Reference14 links https://github.com/guykatzz/Marabou/tree/cav_artifact; modified BSD license is reported. Published evaluation is distinct from this reader’s execution/replication. Source, imported proof and benchmark artifact were not opened or run. Future work includes abstract interpretation, heuristics and tighter integration of linear/nonlinear solving; current parts remain relatively separate. No LLM proof-agent, Verus/verified Rust, TLA+ or verified distributed implementation result appears.
  • how much was read: most of it read
  • source
  • record id: the-marabou-framework-for-2019
• Timed-automata abstraction refinement (2019)
  • title: Abstraction Refinement Algorithms for Timed Automata
  • what: Develops abstraction-refinement algorithms for timed-automata safety reachability by restricting clock constraints used to define zones, then adding constraints extracted from spurious counterexamples. It provides a lazy enumerative zone algorithm and a symbolic Boolean/BDD algorithm. The paper defines timed-automaton runs, DBM zones and clock-predicate domains, proves a density bound (|C0|/2) for minimal zone interpolants and O(|C|^4) interpolation. The enumerative algorithm assigns domains per exploration node/location, uses covering nodes, concrete feasibility checks and cut heuristics; Theorem 6 establishes termination and correctness. The symbolic algorithm encodes predicates/minterms and abstract post operations with Boolean formulas, refines unsatisfiable transitions, and supports discrete variables/urgent/committed locations in the prototype.
  • number: implementations in OCaml/CUDD and C++/Uppaal DBM library
  • number: 8 GB memory and 30-minute timeout on Intel i7 3.2 GHz Linux laptop
  • number: symbolic best on mono-/multi-process scheduling; enumerative best on asynchronous computation
  • number: Uppaal best on CSMA/CD; symbolic did not scale and PAT failed to terminate
  • limits: The abstraction restricts integer clock-difference predicates and may introduce spurious transitions; interpolation and search order affect refinement count. Enumerative and symbolic variants have complementary scaling, and the authors cannot predict which is best for a model. Experiments use finite timed-automata benchmarks and 8 GB/30-minute limits; symbolic encoding does not scale on CSMA/CD cases, while enumerative can run out of memory on scheduling cases. Future work includes discrete-variable predicates and SAT versions.
  • how much was read: most of it read
  • record id: timed-automata-abstraction-refinement-2019
• TLA+ Toolbox (2019)
  • title: The TLA+ Toolbox
  • what: Describes the TLA+ Toolbox IDE workflows, integrating TLC model checking, TLAPS hierarchical proofs, PlusCal translation, CloudTLC distributed execution, a profiler for state-space explosion, and trace exploration. CloudTLC provisions cloud instances and imports results transparently; profiler records invocation/cost and action state statistics, exposing inefficient expressions. Results/history are versionable XML, and Trace Explorer handles traces with thousands of states. Toolbox is open source and designed for engineers rather than theorem-prover experts.
  • number: Previous Toolbox release downloaded approximately 20,000 times; standalone model checker about one-tenth
  • number: Trace Explorer handles traces with thousands of states
  • number: Example profiler: action b produced 87 states, 29 distinct; action d evaluated 153 times with zero states
  • limits: TLC checks finite models; TLAPS handles deductive proofs but finding invariants remains manual. Profiling adds non-negligible overhead and is unavailable in distributed mode. Cloud startup dominates short runs; TLA+ is specification-level and does not generate implementation code.
  • how much was read: most of it read
  • record id: tla-toolbox-2019
• tree ensemble robustness verification (2019)
  • title: Robustness Verification of Tree-based Models
  • what: Develops exact and anytime lower-bound verification for decision-tree ensembles under l∞ perturbations. A single tree is verified in linear time; an ensemble is reduced to maximum K-clique search in a K-partite box-intersection graph, and a multilevel clique algorithm gives progressively tighter robustness lower bounds. Each leaf corresponds to a d-dimensional axis-aligned box. Ensemble leaf tuples are feasible exactly when their boxes intersect, yielding a K-clique; Theorem 1 bounds exact verification by min{O(n^K), O((2Kn)^d)} for at most n leaves/tree and d features. The multilevel algorithm merges T tree parts into pseudo-nodes, preserving boxes and refining a bound level by level until exact. It also handles multiclass attacks, arbitrary query boxes, unimportant features and anchor-like analyses. Across nine datasets and standard/robust GBDTs (500 examples where feasible, 10-step binary search), bounds are close to MILP while up to roughly 3000x faster; for robust MNIST the reported bound ratio is 0.96 and 12.6s versus MILP hundreds of seconds.
  • number: single tree O(n) verification
  • number: ensemble complexity min{O(n^K), O((2Kn)^d)}
  • number: up to about 3000x speedup
  • number: 200-tree robust MNIST example 12.6s versus about 10 min MILP
  • limits: The formal reduction uses axis-aligned tree splits and l∞ boxes; general ensemble verification remains exponential/NP-complete. Lower bounds are guaranteed but may be loose if terminated early; exactness requires completing clique enumeration. Experiments use XGBoost-compatible models and normalized data, with some MILP rows estimated from only 50 examples due to very long runtimes.
  • how much was read: most of it read
  • record id: tree-ensemble-robustness-verification-2019
• Using Statistical Model Checking to Assess Reliability for Bathtub-Shaped Failure Rates. (2019)
  • what: The paper proposes assessing non-repairable-system reliability by modeling time to failure and system fault behavior as stochastic timed automata (STA), then estimating reliability quantities with UPPAAL SMC instead of requiring a closed-form lifetime distribution or exhaustive probabilistic model checking. The target is full bathtub-shaped hazard behavior, including burn-in, approximately constant working life, wear-out, and optional failure humps or parameter changes representing stress and technology effects. The bathtub STA begins at start and probabilistically branches among three components. q1 models burn-in with an exponential distribution parameter λ1a. q2a/q2b model constant/wear-out behavior; the authors state that two uniform distributions are composed into a Normal distribution whose mean is u2b-u2a and whose standard deviation is half that difference. q3a/q3b/q3c model a failure hump with one uniform and two exponential distributions. Each generated time-to-failure eventually signals fail[id], and the template can be instantiated for several independent faults. The system-level STA is then driven by those fault events. The SPX example has one component and enters failure on its fault. The TMR example has three independently failing replicas; after the first fault it remains operational in faulty1, stores which replica failed, and enters failure when a different second replica faults. Reliability properties are estimated with UPPAAL SMC; an example asks for reaching M.failure within 100000 time units. Probability uncertainty ε controls the accuracy/cost trade-off. There is no formal correctness proof connecting the constructed bathtub generator to empirical hardware populations, and no parameter-estimation procedure from observed field data is given.
  • number: example SMC time bound: 100000 SPX MTTF time units: implicit: 865 hump: 830 newer CMOS: 654 higher stress: 314 TMR MTTF time units: implicit: 330 hump: 317 newer CMOS: 265 higher stress: 259 scenario changes from implicit: hump: p3 = 500 newer CMOS: u2b = 5000 higher stress: p1 = 750, λ1a = 1/10, u2a = 5000 TMR replicas: 3 TMR faults tolerated before failure state: 1 parameter classes: probabilistic choice: p1 p2 p3 exponential: λ1a λ3a λ3b uniform: u2a u2b u3a u3b
  • limits: explicit scope: only non-repairable systems are treated author assumption: an STA composition chosen by the modeller adequately represents the desired time-to-failure/hazard shape author assertion: SMC avoids exhaustive-state limitations and scales favorably; this paper itself does not provide a controlled scalability comparison against PRISM or Monte Carlo baselines limitation: parameter fitting or validation against measured failure data is not described limitation: four bathtub scenarios and two small architectural models demonstrate expressiveness but do not establish general predictive accuracy limitation: the paper discusses confidence/probability uncertainty but does not report a complete statistical validation protocol for the representative MTTF values evaluation caution: precise runtime, memory, and run-count values are shown graphically; no independent graphics inspection was performed, so only textual trends and captioned numerical values are recorded scope note: supplied text and references were read; no UPPAAL model/code/artifacts were inspected
  • how much was read: most of it read
  • source
  • record id: using-statistical-model-checking-2019
• VerifAI: A Toolkit for the Formal Design and Analysis of Artificial Intelligence-Based Systems. (2019)
  • what: Introduces a Python toolkit integrating semantic scenario generation, black-box simulation, property monitoring, sampling search and counterexample analysis for AI-based closed-loop systems. Demonstrates autonomous-driving falsification/fuzzing, counterexample-guided neural-network data augmentation, cart-pole robustness testing and mountain-car training-parameter search. Formal models and temporal-logic monitors guide finite simulation; the paper provides no machine-checked correctness theorem or exhaustive safety certificate. Explains how one semantic feature representation connects six workflows: falsification, fuzz testing, counterexample analysis, data augmentation, hyperparameter synthesis and model-parameter synthesis. Scenic supplies conditioned scenario distributions; monitor scores guide adaptive sampling; feature-valued error tables support PCA and recurring-value analysis. Concrete examples expose perception-to-controller failure propagation and distinguish rewards, training settings and system parameters. Quantitative evidence is mainly a1000-sample cart-pole illustration with38violations; substantial augmentation/algorithm detail is delegated to prior publications.
  • limits: Inputs are a simulatable closed-loop system(controller, perception and plant), a modeled environment and a property. Controller/perception can be arbitrary executable code. The simulator is a black box, so the evidence concerns simulations of this chosen composition and environment. No proof of correspondence to physical dynamics, renderer fidelity, implementation semantics or every possible environment is given. Semantic/abstract features describe objects, positions, headings, colors and parameters rather than raw pixel arrays. They can be hierarchical products of boxes/finite sets/structures/arrays or a Scenic probabilistic program. Scenic constraints condition the scenario distribution and a renderer/simulator creates concrete sensor inputs. This is a generative search space; the paper supplies no abstraction-soundness theorem covering every concrete image or real environment. Perception is assessed through system-level behavior because component specifications are difficult; the same classification mistake matters when it causes a closed-loop failure. This does not establish correctness of perception outside modeled/rendered contexts. Distribution assumptions and permitted agents/behaviors are designer choices, explicitly acknowledged as incomplete environment modeling. The initial release uses sampling, not exhaustive symbolic exploration. Listed passive methods are uniform random, simulated annealing, Halton and Scenic samples; active methods are cross-entropy and Bayesian optimization. The prose groups simulated annealing among no-feedback samplers; its specific implementation is not explained, so the record does not infer an algorithmic contract from that label. Directed/exhaustive and symbolic/adversarial methods are future extensions. Monitors accept MTL, objective functions or arbitrary Python code; MTL Boolean and quantitative semantics use py-metric-temporal-logic. A monitor score can guide search and identify a violating trace. The paper gives no formal monitor implementation proof, sampling-completeness theorem, stopping rule, discretization error bound or statistical assurance theorem. No discovered violation is not a proof of universal satisfaction. Error-table rows are counterexamples and columns are semantic features. PCA is offered for ordered domains and recurrent-value subsets for unordered domains, either offline for debugging or online for sampling. Correlation is the stated interpretation, not demonstrated causal attribution. The paper gives no numeric PCA output, significance assessment or validation of inferred feature importance. Communication is client-server over IPv4 sockets: VerifAI sends a configuration and the simulator returns trajectories, supporting multiple simulators. This is interoperability infrastructure, not verification of a distributed protocol, socket delivery guarantees or concurrency correctness. AV experiments use commercial Webots2018. Lane following uses non-ML line detection; squeezeDet-based perception estimates cone distance and initiates a lane change below15m. The MTL property requires cone clearance and avoiding overshoot, but its exact formula, clearance threshold, horizon and robustness normalization are not printed. First AV case varies object positions/orientations, disabled-car color, cruising speed and reaction time. The orange car is mistaken for cones, triggering a premature/incomplete lane change and crash. This is a concrete found failure, not a quantified search-efficiency comparison; sample counts, runtimes, seeds and baseline performance are absent. The acknowledgements identify a Titan Xp GPU used for the research, without specifying a complete machine or its assignment to this experiment. Second AV case models an occluded intersection accident with sampled initial positions. One car turns using an OpenStreetMap/Intelligent-Intersections trajectory; the other maintains velocity or brakes on a simulated smart-intersection warning. The authors say this can identify sufficient advance notice, but provide no numerical warning bound, exhaustive guarantee or experiment table. Figure3 is explicitly a partial Scenic program; missing world-model definitions and spot2 prevent treating it as standalone runnable code. Data-augmentation example renders road images for squeezeDet, then selects additions by random error-table samples, top-k closest samples or PCA generation. Figure4 shows two cars counted as one. Accuracy improvement and detailed results are attributed to reference9; this paper prints no accuracy values, held-out split, number of new images, retraining budget or comparative statistics. Prior-paper results have not been independently read here. Cart-pole controller is trained using PPO with100k training episodes. Test variations named in the prose are initial lateral position/rotation and pole mass/length; Figure5 visually plots pole length, cart mass and pole mass. Record retains that presentation difference without guessing an implementation error. Reward is described using2.4m displacement and12degree angle, then testing thresholds are said to be slightly modified without supplying values. Cart-pole Figure5 reports38violations among1000randomly sampled parameter configurations. Main text also says sampling was guided by reward; the precise sampling law is unspecified. Reader arithmetic38/1000=3.8percent describes this plotted set only, not a deployment failure probability, iid confidence interval or general robustness certificate. No runtimes, repeated seeds, statistical uncertainty, comparator or numerical failure coordinates are reported. Mountain-car experiment searches discrete training-algorithm choices and training-set size. It negates the goal-distance reward so falsification becomes finding settings yielding a successful learned controller. A table of safe hyperparameters and PCA sensitivity are claimed but neither values nor counts/results are printed. Safe here is simulation success in this study; no guarantee for all training randomness, environments or future policies follows. Novelty/first-tool claims concern integration and extension of prior methods. The paper explicitly delegates algorithms/formalisms to refs7–10,12,15,22 and augmentation results to ref9. It contains no formal theorem, proof, verified tool kernel or code-generating proof agent. Integration claims are author statements, not an independently established priority survey. Implementation/examples are linked at https://github.com/BerkeleyLearnVerify/VerifAI with expected outputs. No commit hash, full dependency lock, complete experiment hardware configuration, wall-clock results or reproduction is supplied here. Acknowledgements identify a Titan Xp GPU used for the research. The front page displays Artifact evaluated and Functional badges; this is published artifact-evaluation evidence, not this reader’s execution or independent replication of every experiment. CARLA and X-Plane interfaces already exist according to the conclusion, whereas applications and symbolic search are future work. No artifact source or simulation was executed in this reading. Relevance to specification/proof-agent evaluation is methodological: preserve the scenario model, executable target, explicit monitor, generated witness and training/test distinction. Sampling-guided repair and reward optimization can find improvements without supplying a proof. No LLM agent, Verus, verified Rust, TLA+ or distributed-system verification experiment is reported.
  • how much was read: most of it read
  • source
  • record id: verifai-a-toolkit-for-2019
• Verified Decision Procedures for Modal Logics (2019)
  • what: Lean formalization of terminating sound and complete tableau decision procedures for modal K, KT and S4, with histories for reflexive/transitive logics and verified backjumping for K. Returns an unsatisfiability proof or a constructed tree representation carrying evidence of a satisfying Kripke model. The S4 construction handles ancestor-loop requests by propagating invariants and fulfilling them at the root. Explains dependent output types, early-terminating dependent map for recursive transition branches, downward propagation of sequent invariants, upward propagation of partially constructed S4 models, lexicographic termination measures and responsibility sets enabling backjumping. Separates terminating search and semantic correctness from practical VM evaluation, explicit finite-model formalization and fully executable S4 model reachability, which remain qualifications.
  • limits: Input is a finite list of propositional modal formulas in negation normal form, with natural-number atoms, atomic negation, conjunction/disjunction, box and diamond. A correctness-preserving translation from arbitrary negation is described as easy rather than developed here. No first-order quantification, temporal fixed points or arbitrary global knowledge-base assumptions are added to these algorithms. K permits arbitrary Kripke accessibility; KT requires reflexivity; S4 additionally requires transitivity. Satisfaction requires a designated state, so empty carriers cannot witness satisfiability. Logical model assumptions are the target specification, not claims about external distributed-system executions. Correctness/termination are Lean function/type-theory proofs. The paper says the functions could run with #reduce but this is too slow for direct use in a Lean proof; experimental evaluation instead uses #eval on Lean’s virtual machine. It does not establish verification of that VM or kernel replay of the experimental outputs. K output is closed with a proof of unsatisfiability or open with a tree state and satisfaction evidence. Tree models are inductive finite syntax with list-valued atoms/children; interpretation functions recover the Kripke structure. S4 additionally uses histories, signatures, ancestors, pending backward-edge requests and several proven invariants. K termination follows decreasing connective count. KT needs a pair: maximal modal-operator count in a formula and main-sequent connective count, with handled box formulas moved into history. S4 needs closure-bounded history/handled sets and a lexicographic triple; no formal runtime/space complexity bound is claimed. Backjumping implementation/proof is for K only. Extension to KT/S4 is future work even though the authors argue the closed-branch nature makes it portable. Other optimizations and alternative data structures are prospective. The finite-model theorem is explicitly not separately formalized. Authors infer it from finite tree objects. K/KT valuation and relation are computable; S4 semantic relation uses reflexive transitive closure, and explicit verified finite reachability computation remains future work. The returned S4 object should not be described as an already implemented finite adjacency matrix with an executable edge checker. Formal proofs rely on the supplied Lean/library environment. The paper reports no verified compiler/VM, independent proof audit or executable refinement to an external prover. Reader did not replay the scripts. A small benchmark is evidence of practical evaluation, not a complete assurance argument for all deployments.
  • how much was read: most of it read
  • source
  • record id: verified-decision-procedures-for-2019
• Weaver hypersafety reduction (2019)
  • title: Automated Hypersafety Verification.
  • what: Presents Weaver, a counterexample-guided verifier that simultaneously searches for a reduction of a k-copy product program and a safety proof of that reduction, thereby reducing hypersafety to ordinary safety reasoning. Programs are regular trace languages and proofs are finite assertion sets inducing regular infeasibility languages. Looping tree automata (LTAs) represent sets of sleep-set reductions; closure and emptiness enable decidable proof checking. The paper proves finite counterexample sets and strong progress under an interpolation assumption, proves every sleep-set reduction is sound and optimal per Mazurkiewicz class, and gives antichain and partition optimizations. Weaver implements total-order and partition algorithms, Craig interpolation and atomic-block abstraction, covering sequential, concurrent and stress benchmarks.
  • number: >50 benchmarks
  • number: looping 2-safety: 5 cases, 47.03 s average
  • number: looping 3-safety: 8 cases, 448.36 s average
  • number: loop-free: 27 cases, 0.15 s average
  • limits: Input programs are regular trace languages over a finite statement alphabet with a sound, fixed dependence relation; D-reductions rely on semantic commutation of independent statements. General reduction existence is undecidable, so the LTA sleep-set class is sound but incomplete (partition optimization is additionally incomplete relative to all sleep-set reductions). Termination requires a proof for some explored reduction and an interpolation oracle that returns subsets of a target proof. Atomic-block optimization is sound but incomplete. The tool handles simple imperative programs without procedure calls and uses finite benchmark properties.
  • how much was read: most of it read
  • source
  • record id: weaver-hypersafety-reduction-2019
• Will My Program Break on This Faulty Processor?: Formal Analysis of Hardware Fault Activations in Concurrent Embedded Software (2019)
  • what: Defines the question of whether a concurrent program can activate a known processor memory-consistency fault described by a litmus test. Gives an execution-graph formulation and an outline of an exact approach, then implements a stricter partial solution with conventional sequentially consistent model checkers. Distinguishes starts-before from finishes-before dependencies and intersects control-consistent program executions with fault-activating extensions of a forbidden litmus outcome. The proposed exact method matches litmus patterns against consistent execution graphs, transfers implied dependencies into a microarchitectural happens-before graph, tests cycles, alters reads-from edges and rechecks control consistency. The implemented approximation instead builds parametric automata for litmus threads and looks for one SC-reachable state enabling all threads’ matching paths independently. It excludes intervening accesses to matched variables, control depending on matched reads, and certain other sequential operations. Peterson’s algorithm illustrates why a fault activated only after weak-memory behavior can be missed.
  • number: 2–20 threads; 5–50 variables; 1–10 litmus tests
  • number: per process: 16 GB and 1,200 s limits
  • number: 64-core/512 GB server
  • number: 22-page saved draft versus Crossref pages 1–21
  • limits: Exact solution is an outline, not the evaluated implementation. SC reachability and stricter independence conditions cause false negatives, so absence of a match does not prove hardware-fault freedom in the full weak-memory model. All proposed approaches ignore processor behavior outside the memory-consistency mechanism, notably speculative execution; Section 7 explicitly says its example invalidates Theorem 5.1 under speculation. The theorem also assumes minimal litmus tests. Completeness of manufacturer-provided litmus tests is an admitted threat. Evaluation uses synthetic load/store programs rather than production applications. Some memory-model background descriptions are simplified; they are not a substitute for ISA/C11 specifications. Saved PDF prints placeholder DOI 10.1145/1122445.1122456, volume 18 issue 4/article 111 and 22 pages. Saved Crossref record for requested DOI 10.1145/3358238 matches title/authors/year but gives issue 5s/pages 1–21; publisher-version differences were not checked.
  • how much was read: most of it read
  • source
  • record id: will-my-program-break-2019
• Attestor graph-based Java pointer verification (2018)
  • title: Let this Graph Be Your Witness! - An Attestor for Verifying Java Pointer Programs.
  • what: Describes Attestor, an automated Java/bytecode verifier for dynamic pointer structures. Symbolic execution builds graph-based abstract heap states guided by user graph grammars; heap propositions label states, and off-the-shelf LTL model checking checks structural and functional specifications with counterexamples and procedure contracts. Details six-phase architecture: parse/mark inputs, generate abstract state space by local grammar concretization, execute bytecode, rectify garbage/dead variables, abstract via backward grammar embedding and heap-automata labels, then subsume states. Full Java bytecode is handled; arithmetic and payload tests are safely over-approximated. Contracts can summarize recursive procedures. Outputs distinguish satisfied, definitely violated and possibly violated formulas, and can produce non-spurious concrete initial heaps.
  • number: about 20,000 LOC Java
  • number: 13–10,388 states in main table
  • number: 67,941 states, 17.36 s total for Lindstrom tree traversal
  • number: Intel i7-7500U 2.70 GHz, 2 GB RAM
  • limits: Finite abstraction requires a graph grammar covering runtime data structures; malformed or unsupported payload arithmetic/Boolean tests are over-approximated. Markings needed for visit/neighborhood properties impede abstraction. Results may be “possibly not satisfied” when abstraction is inconclusive. Evaluation uses hand-selected Java benchmarks and no standardized cross-tool suite; about 20k LOC implementation.
  • how much was read: most of it read
  • source
  • record id: attestor-graph-based-java-pointer-verification-2018
• Brief Announcement: Generalising Concurrent Correctness to Weak Memory (2018)
  • what: Defines causal atomicity for partially ordered object executions, extending the authors’ causal linearizability work to transactional memory. States compositionality for objects with disjoint operation alphabets and client abstraction. Defines causal opacity by combining transaction operations into atomic blocks; outlines an operational specification adapted from TMS2 for simulation proofs. An execution structure has a finite event set, strict precedence order and a communication relation satisfying three coherence axioms. A valid logical order must include precedence and be contained in communication; every total extension of that order must be a legal sequential execution. Thus checking one arbitrary linearization is insufficient. The stack/STM example shows why cross-object communication and the third coherence axiom matter: a transaction that observes written values induces communication, which forces Push before an empty Pop and exposes the stack violation. The client theorem compares compatible orders on client-local events. The final paragraph describes a transactional sequential specification whose causally atomic executions remain atomic after transaction-block abstraction.
  • limits: Finite event structures over fixed operation alphabets; Theorem 3 requires disjoint alphabets for the two sequential objects. Communication captures synchronization between low-level operations; precedence alone does not characterize correctness under weak memory. The three-page brief states theorems without supplying full proofs or concrete STM implementations. The client abstraction statement concerns matching observations with compatible local-event orders; the brief does not claim arbitrary hyperproperty preservation. Causal atomicity here differs from Farzan–Madhusudan’s same-named notion, which the footnote says is not compositional.
  • how much was read: most of it read
  • source
  • record id: brief-announcement-generalising-concurrent-2018
• Central-limit probabilistic model checking (2018)
  • title: Central Limit Model Checking
  • what: Develops scalable approximate model checking for time-bounded CSL and reward properties of CTMCs induced by stochastic reaction networks. A central-limit/Gaussian process approximation is projected onto linear combinations defining convex-polytope targets, discretized into a low-dimensional time-inhomogeneous DTMC, and checked numerically with convergence guarantees as population size grows. The paper formalizes density-dependent SRNs, CTMC/CME semantics, Gaussian CLA equations, convex predicates, CSL syntax/semantics and reward operators. Time and space discretization produce DTMC transition kernels; Theorems 2–4 establish convergence/soundness for reachability abstraction and Theorem 5 extends convergence to CSL. Reward propositions cover instantaneous, cumulative and bounded-reachability rewards. Case studies compare Matlab CLA results with PRISM statistical model checking: gene-expression reachability where mean-field methods fail, and a seven-species phosphorelay at N=400/800. Errors decrease with smaller timestep and larger population; for N=800,h=0.1, average relative error is 0.0015 and max 0.0217, while PRISM’s 30,000 simulations take hours.
  • number: CLA O(|Λ|²) differential equations independent of population size
  • number: 30,000 PRISM simulations
  • number: N=400 and N=800 phosphorelay populations
  • number: N=800,h=0.1 average relative error 0.0015, max 0.0217
  • limits: The SRN rates are real analytic and density dependent; CLA convergence is asymptotic in population size and only finite-time. Targets must be convex polytopes expressed by linear inequalities, and discretization introduces timestep/grid error. The Gaussian approximation can be inaccurate at low populations or in tails; time-unbounded properties are excluded. Results depend on well-mixed stochastic kinetics and bounded/continuous reward assumptions, and exact CTMC uniformization remains infeasible for evaluated models.
  • how much was read: most of it read
  • record id: central-limit-probabilistic-model-checking-2018
• Chiari Mandrioli Pradella OPTL (2018)
  • title: Temporal Logic and Model Checking for Operator Precedence Languages
  • what: Introduces Operator Precedence Temporal Logic (OPTL) for expressing and automatically checking properties of operator-precedence languages, whose hidden parse structure strictly generalizes visibly pushdown languages. It defines operator-precedence automata (OPA), chain and summary/hierarchical temporal operators, and an automata construction for model checking finite and infinite words. Sections 2–4 define OPA stack semantics and the non-visible chain relation, then give examples of matching-next/back, summary until/since, and hierarchical modalities for handlers and nested procedure traces. Every NWTL formula is translated linearly to OPTL on an encoding of nested words; hierarchical operators can be eliminated with exponential formula blowup. Section 5 gives closure/atom construction rules for automata, stack auxiliaries for maximal chains, summary and hierarchical operators, and a generalized Büchi extension for infinite words.
  • number: OPA size 2^O(|formula|)
  • number: NWTL-to-OPTL translation linear in formula length
  • number: hierarchical-elimination translation O(n^2 2^n |alpha|)
  • number: OPTL automata support finite and omega words
  • limits: The OPM on atomic-proposition sets supplies the word structure; complete matrices are needed for universal languages, and formulas rely on compatible chains. The construction is exponential in formula length (2^O(|phi|)); translating hierarchical operators can itself be exponential. Infinite-word checking is only sketched via generalized Büchi acceptance and requires extra bookkeeping for obligations buried forever on the stack. The paper reports no implementation or empirical benchmark and leaves expressiveness completeness and user-friendly requirements open.
  • how much was read: most of it read
  • record id: chiari-mandrioli-pradella-optl-2018
• Cubicle-W (2018)
  • title: Parameterized Model Checking Modulo Explicit Weak Memory Models
  • what: Extends MCMT array-based backward reachability with explicit weak-memory access operations and implements it as Cubicle-W, supporting interchangeable TSO/PSO-like memory models. Weak-memory transition systems encode reads, writes, buffers and reorderings explicitly; backward preimage operators account for memory events. A mutual-exclusion example demonstrates reachability under TSO-like behavior, and modular architecture permits changing memory semantics without rewriting the verifier.
  • number: Initial experiments with TSO-like model reported as promising
  • number: No detailed benchmark count/runtime table in supplied text
  • limits: Array-based transition systems and explicit axiomatic memory models determine scalability; only initial TSO-like experiments are reported. The framework is safety/reachability-oriented and does not establish general liveness or all hardware memory models.
  • how much was read: most of it read
  • record id: cubicle-w-2018
• DEL S5 Model Checking Complexity (2018)
  • title: On the Computational Complexity of Model Checking for Dynamic Epistemic Logic with S5 Models
  • what: Gives a fine-grained complexity classification for DEL model checking under S5 epistemic/event models, varying agents, pointedness, postconditions and announcement type. A polynomial algorithm uses bisimulation representatives and memoization for one-agent, single-pointed, no-postcondition updates. Reductions from lexicographically maximal SAT and QBF establish Δ2^p-hardness and PSPACE-hardness for small relaxations, including two agents and three propositions; semi-private announcements are also PSPACE-hard.
  • number: Table 1: one agent/single/no postconditions P; one agent/single/with postconditions Δ2^p-hard; one agent/multi PSPACE-complete; ≥2 agents PSPACE-complete
  • number: PSPACE-hardness holds with two agents and three propositions
  • number: no empirical runtime benchmark
  • limits: Results are worst-case complexity classifications, not performance experiments. The polynomial fragment depends on one agent, single-pointed S5 models and no postconditions. Hardness rises when any of those restrictions is relaxed; the paper suggests QBF/structural parameterizations as future algorithmic directions.
  • how much was read: most of it read
  • record id: del-s5-model-checking-complexity-2018
• Domain-Knowledge Parametric MC (2018)
  • title: Efficient Parametric Model Checking Using Domain Knowledge
  • what: Introduces ePMC, which precomputes closed-form QoS expressions for domain-specific Markov-chain fragments and composes them in whole-system parametric analyses. The two-stage workflow identifies reusable SEQ, PAR, PROB and replicated/service deployment patterns, stores component QoS expressions, and analyzes annotated system-level chains with a pattern-aware checker. The tool supports service-based systems and multi-tier architectures, emitting rational functions that can be evaluated or plotted independently of repeated symbolic state elimination.
  • number: FX ePMC runtimes about 0.33–0.54 s per QoS property; Storm reaches 545.33 s for 5-service PROB and timeouts on many patterns; PRISM/PARAM often OOM/timeout
  • number: formula-size examples: ePMC 287 operations/2.6 s versus Storm 285,425 operations/8.2 h for P1; ePMC 198/1.3 s versus Storm 171,166/2.5 h for P3
  • number: 20 random FX combinations: ePMC mean 0.33 s versus Storm 52.12 s (P1), 88.41 s (P2), 67.18 s (P3)
  • number: multi-tier ePMC stays under 1 s from 6 to 40 instances; competing tools time out on larger/complex deployments
  • limits: Requires domain-expert identification of modeling patterns and correct annotations. Experiments use fixed hardware and 15-minute timeout for competing tools; ePMC repository-read/startup overhead dominates its roughly constant runtime. The approach has only evaluated the two reported domains and depends on rational parametric Markov-chain formulas.
  • how much was read: most of it read
  • source
  • record id: domain-knowledge-parametric-mc-2018
• DPA/MCMT (2018)
  • title: Formal Specification and Verification of Dynamic Parametrized Architectures
  • what: Defines Dynamic Parametrized Architectures (DPAs), where indexed component sets, connections, initial configurations, invariants and reconfiguration transitions are first-order formulas over unbounded index sets. It translates information-flow reachability into array-based transition systems and checks the resulting safety problem with MCMT/Yices. The formal language separates parametrized architecture guards from dynamic formulas, restricts transition syntax so index sets and parameter arrays can be rewritten into array updates, and translates component presence plus taint propagation into an array-based safety system. The paper proves that the translation stays in the array-based fragment and that information-flow witnesses correspond exactly to unsafe traces. A C/GNU-Bison extended-AADL translator and five scalable benchmark families expose transition-count, quantifier and solver-call bottlenecks.
  • number: MCMT timeout 1000 seconds
  • number: Converging safe n=6: 29,907 SMT calls; transition limit at n=7
  • number: Converging unsafe transition limit at n=5
  • number: Sequence timeout n=6 safe and n=7 unsafe
  • limits: Index sets are finite subsets of a countable universe, while the state space is unbounded across configurations. Component and connection guards are quantifier-free; initial, invariant and transition formulas obey restrictive quantifier/update/frame syntaxes. Verification targets reachability-style information flow, not noninterference or liveness; the paper explicitly leaves noninterference open. MCMT imposes at most two universal variables in Init, two existential variables per transition, 50 transition disjuncts, four existential variables in unsafe formulas and ten index variables per term. General dynamic information flow is undecidable (Minsky 2-counter encoding), and experiments time out or hit these limits.
  • how much was read: most of it read
  • record id: dpa-mcmt-2018
• Eager abstraction symbolic model checking (2018)
  • title: Eager Abstraction for Symbolic Model Checking
  • what: Introduces eager symbolic model checking (ESMC): propositional skeletons reduce first-order/infinite-state transition systems to finite-state systems, while user-selected theory-explication axiom schemata add sound relational facts before abstraction. IVy turns the result into AIGER and uses ABC to check safety.
  • number: four case-study protocols
  • number: Tomasulo model-checking proof 248 tokens, 0.39 s
  • number: German 29 tokens, 0.60 s
  • number: FLASH 122 tokens, 69 s
  • limits: Soundness is one-sided: proving the abstract property proves the concrete one, but spurious counterexamples require human invariant/abstraction refinement. Trigger matching can loop, so implementation bounds matching to one generation; richer needs require additional schemata. Proofs target safety (Hφ)⇒φ in the current IVy/AIGER implementation; liveness is future work. Case-study proof-size comparisons are explicitly unreliable because they use one user and different methodological expertise. Abstraction quality depends on manually supplied invariants, prophecy variables, history variables and non-interference lemmas; many unbounded ordered sorts make proofs harder.
  • how much was read: most of it read
  • record id: eager-abstraction-symbolic-model-checking-2018
• Efficient Formal Safety Analysis of Neural Networks (2018)
  • what: Neurify checks input/output constraints of feedforward ReLU networks using symbolic linear relaxation plus directed splitting of uncertain ReLU activation cases. An unsatisfiable overapproximation excludes violations; satisfiable candidates are run through the concrete network before being reported, and spurious candidates trigger refinement. Implementation/evaluation combines mathematical relaxation arguments with solver-based experiments on ACAS Xu, MNIST, Drebin and DAVE models. This verifies specified bounded network properties, not autonomous-system correctness or arbitrary LLM-generated programs. The newly read official seven-page supplement supplies local relaxation proofs, full 2^n activation-case exactness, numerical/parallelization descriptions, benchmark details and additional results. Its Figure 3/prose percentages conflict; see the supported diagnostics. Records lower/upper symbolic-bound equations, minimax approximation claim and newly read supplementary proofs and their idealized assumptions, gradient-directed activation splitting, solver/counterexample workflow, nonlinear perturbation handling, rounding dependency, exact network and test counts, full comparative tables/ablations, and differences between safe/violated/timeout outcomes. Highlights numerical inconsistencies and metric definitions instead of repeating headline speedup and scaling claims.
  • limits: §§2–3: Scope is specified network/input set/output condition with piecewise-linear ReLU computation. Interval propagation must enclose every feasible concrete output; linear relaxation overapproximates uncertain activation regions. Solver UNSAT is evidence only if the enclosure and property encoding are sound. A satisfiable relaxed point may be spurious, so it is checked on the actual network. Timeout is unknown, not a safe or unsafe result. Neither local robustness nor concrete counterexample implies correctness of a complete aircraft/car system. §2: Symbolic interval analysis keeps affine dependencies until uncertain ReLUs require approximation; input bisection narrows boxes but scales poorly with many input dimensions. Background convex triangle isz≥0, z≥z′, z≤u(z′−l)/(u−l)forl<0<u. For fixed-sign preactivation, ReLU is exact identity/zero. Text’s earlier concretized uncertain-case interval is shorthand; mathematical soundness still requires output nonnegativity. §3.1, Eq 1: For lower symbolic preactivation Eqlow with range[llow, ulow] and upper Equp with range[lup, uup], use lower line ulow/(ulow−llow)Eqlow and upper chord uup/(uup−lup)(Equp−lup), with separate fixed-sign cases. Lines preserve partial input dependence, with maximum relaxation gap−lu/(u−l) for each corresponding concrete range. Claimed tightness is in a least-maximum-distance linear-relaxation sense, not exact reachable-output characterization. Supplement §1.2 was newly read: it gives local distance and minimax proofs; the theorem is not whole-network exactness without splitting. §3.2, Eqs 2–3: Refine an overestimated node by branching preactivation≤0 or>0, eliminating its ambiguous ReLU relaxation; prioritize larger output gradients. This covers both activation cases under exact arithmetic, but exponential branch growth remains possible. Text suppresses lower/upper distinctions into one Eq for exposition; implementation must preserve true preactivation constraints and coverage when symbolic bounds differ. Newly read supplement §1.3 proves exactness after all n overestimated nodes are split into 2^n cases. This does not make exhaustive refinement scalable or polynomial. §3.2–3.3: Class-invariance text says target confidence should be greater than every competing output, but Eq 3 searches lower-target−upper-other<0; UNSAT ensures nonnegative separation, so ties require an explicit classification/tie-breaking convention or strict-margin encoding. Reader qualification, not an audited implementation bug. Concrete candidate validity also depends on perturbation-domain enforcement, including discrete feasible malware features. §3.3: L∞ input constraints are boxes. L 1 absolute-value and L 2 quadratic perturbation constraints need extra encoding/solver support; L 1 can be linearized though text groups them as non-linear. Main text writes sumxi²≤ε forL 2≤ε without explaining squared-radius convention; a precise specification must fix radius versus squared radius. Brightness/contrast parameter coupling, valid pixel range and simultaneous bisection require more than reading a bounding box as proof of the exact intended physical transformation. Supplement §3 now read: author prose claims outward rounding after every floating-point operation using 32-bit floats, thread-local lp_solve and queue rebalancing; Gurobi handles quadratic objectives. It does not provide a complete rounding/tolerance/certificate specification. No code audit or independently validated numerical guarantee was performed. §§1,4.1: Authors say nine networks over five datasets and six property types; Table 1 identifies nine architecture entries across four named dataset groups(ACAS Xu, MNIST, Drebin, Car). §3.3 enumerates five perturbation families plus custom benchmark properties elsewhere. Preserve these scope descriptions without inventing a fifth dataset. ACAS entry is a family, with 178 property checks; architecture count is not necessarily one trained network per row. §4.1, Tables 1–2: DAVE Table 1 gives 80 safe/82 violated/58 timeout=220 cases. Table 2 shows four families×five parameters×10 images=200 cases; summing displayed percentages gives 66 safe/79 violated/55 timeout. Main text does not reconcile this difference. Table 3 Drebin column labels 10/50/100/150/200 are not adequately defined in the main text; do not infer a perturbation interpretation or monotonicity theorem from them. §§1,4.2, Table 4: Introduction says average 5000×overReluplex;§4.2 says up to 5000×, while Table 4 contains 148872×forφ6 and 19664×forφ12. Preserve actual table/mean qualifiers rather than treating 5000 as an observed maximum. Different Reluplex timeouts and a reported rounding bug affect comparison; φ12 is slower thanReluVal(0.13 svs 0.104 s). No universal dominance follows. §4.3, Table 5: Improve percentages 114.23/126.38/103.63 equal(NIA−SLR)/SLR×100 approximately, not percentage reduction of initial widths. Actual width reductions are≈53.3%,55.8%,50.9%; prose saying tighten by at least 100%must not be read as eliminating>100%of a width. Earlier 59.64%overestimation-error claim is a separate measure not directly recoverable from Table 5 widths. §4.3, Table 6: Eight displayed rows show 151 additional resolved cases out of 800, i.e.18.875 percentage points averaged across rows, printed 18.88%more. This is not 18.88%relative improvement over already resolved count. Figure 4/5 pool proved-safe and disproved cases; more resolved cases can arise from easier counterexamples as perturbation bounds increase, not stronger certification. The official seven-page supplement is now fully read and resolves the previous missing-prose gap. Local mathematical proofs and exhaustive activation-case exactness are source claims under ideal arithmetic/coverage assumptions. Numerical implementation correctness, benchmark reproduction, and prior main-paper inconsistencies remain separate limitations. Table3,p7: Drebin_FC3 column150 prints Safe4, Violated23, Total33 although4+23=27. Preserve this printed inconsistency rather than deriving timeout as100−33 or100−27 without qualification.
  • how much was read: most of it read
  • source
  • record id: efficient-formal-safety-analysis-2018
• Flat-Freeze-LTL-1CA (2018)
  • title: Model Checking Flat Freeze LTL on One-Counter Automata
  • what: Resolves the open decidability problem for model checking the flat fragment of Freeze LTL on one-counter automata by reducing it to reachability/Büchi problems for one-counter automata with parameterized equality and disequality tests, then encoding computations in Presburger arithmetic. Introduces folded-path rewriting that isolates equality tests, proves soundness and termination of rewriting, bounds irreducible path lengths, and constructs existential Presburger formulas for reachability and repeated control-state reachability. The resulting decision procedure establishes both reachability decidability and flat Freeze-LTL model-checking decidability.
  • number: Corollary 4.6: existential model checking for flat Freeze LTL on 1-CA is decidable
  • number: Naive upper bound for the presented procedure is 2NEXPTIME
  • number: Reduction uses Presburger sentences with an ∃∀ prefix, refinable to purely existential sentences
  • limits: The result targets flat Freeze LTL and one-counter automata; unrestricted Freeze LTL remains undecidable. The construction can be exponential in automaton size and yields a naive 2NEXPTIME upper bound because the Presburger formula is double exponential; optimal complexity is left open.
  • how much was read: most of it read
  • record id: flat-freeze-ltl-1ca-2018
• FMT Smart Building PMC (2018)
  • title: Efficient Probabilistic Model Checking of Smart Building Maintenance using Fault Maintenance Trees
  • what: Formalizes fault-maintenance trees as composed continuous-time Markov chains, maps reliability/availability/cost/failure-count metrics to CSL rewards and probabilities, and decomposes large trees into abstract CTMCs for PRISM analysis. Defines CTMC semantics for deterministic-delay approximations, extended basic events, repair/inspection modules, RDEP and OR gates, then gives a graph decomposition and recomposition algorithm. The HVAC case uses Erlang phase approximations and compares six inspection/repair/overhaul policies, showing the state-space reduction makes numerical PMC feasible.
  • number: abstract CTMC has 62,779 states; full CTMC not computable
  • number: maximum metric computation time 1.47 minutes over 0–25 years
  • number: strategy M1 (annual repair, 20-year replacement, weekly inspection) best cost/failure trade-off
  • number: inspection every 2 or 5 years greatly increases expected failures
  • limits: Deterministic times are Erlang approximations (N=3 in the case study), exponential degradation and synchronized simultaneous maintenance are assumed. Only OR/RDEP and listed modules are implemented; full HVAC CTMC explodes and future work adds gates/lumping.
  • how much was read: most of it read
  • record id: fmt-smart-building-pmc-2018
• FO-Geometric-Graphs (2018)
  • title: FO model checking of geometric graphs
  • what: Establishes FPT first-order model checking results for restricted dense geometric graph classes—circular-arc, circle, box, disk and polygon-visibility graphs—by interpreting bounded-width posets, and proves hardness when restrictions are relaxed. Gives explicit FO interpretations and parameterizations: bounded nesting chains for circular arcs, bounded independent sets for circle graphs, and restricted box/disk and weak-visibility polygon classes. Hardness reductions encode arbitrary graphs through consecutive-neighborhood representations, delimiting the tractability frontier.
  • number: Theorem 3.1, 3.3, 3.6 and 3.7 give FPT cases for the named geometric classes
  • number: Theorem 5.4: weak-visibility polygon FO model checking is FPT parameterized by reflex vertices
  • number: Hardness reductions show unrestricted cases are AW[*]-hard / as hard as general graphs
  • limits: FPT guarantees require structural parameters; unrestricted versions become as hard as FO model checking on general graphs. Some results assume labelled geometric representations or bounded reflex vertices, and existential-FO parameterized complexity for unlabelled cases remains open.
  • how much was read: most of it read
  • record id: fo-geometric-graphs-2018
• FreqHorn-2 syntax-guided invariants (2018)
  • title: Accelerating Syntax-Guided Invariant Synthesis
  • what: Presents FreqHorn-2, a syntax-guided inductive-invariant synthesizer that deterministically bootstraps from program subexpressions and Craig interpolants, then samples grammar mutants while using Houdini inductive-subset extraction and counterexample-to-induction (CTI) second chances. The paper specifies the two-stage Algorithm 4 in detail: seeds from Init/Tr/Bad are augmented with bounded-safety interpolants; initiation filtering and Houdini extract an inductive subset; failed candidates are grouped by CTIs and retried after learned lemmas invalidate their blockers. It proves termination outcomes (bug or synthesized invariant), explains grammar normalization and pruning, and reports that merged seeds/interpolants solve 114 of 171 safe programs before randomized mutants; mutants are needed in 57 cases. On 128 instances FreqHorn-2 beats old FreqHorn in 90, reaches 233x speedup, and averages 4x faster, while showing anomalies from blind grammars, large disjunctions and interpolation.
  • number: 171 safe programs
  • number: 103 solved from seeds with inductive subset vs 63 one-by-one
  • number: 70 solved from interpolants
  • number: 114 solved from merged seeds and proofs
  • limits: The target is a transition system encoded as linear or nonlinear constrained Horn clauses, with a conjunction of lemmas as a safe inductive invariant checked by SMT. Bounded interpolation is limited to LIA, so 17 NIA benchmarks skip it; sampling remains nondeterministic and grammar construction may miss useful constants or large disjunctions. If BMC finds a counterexample below the configured bound N, no invariant exists and the algorithm reports a bug. Experiments are on 171 safe programs and unsafe instances only for testing, with 60-second timeout comparisons and three timing runs; no completeness guarantee for mutant search is given.
  • how much was read: most of it read
  • record id: freqhorn-2-syntax-guided-invariants-2018
• Higher-Order Bounded Model Checking (2018)
  • what: Defines a bounded model-checking translation for HORef, a higher-order call-by-value language with higher-order references, using SMT formulas, SSA return variables and nominal method names; adds a local points-to analysis and evaluates prototype BMC-2. The translation maps a valid configuration and call-depth bound to a formula whose satisfying assignments correspond (up to fresh-name permutations) to bounded outcomes. It propagates fail/nil through a guard, joins conditional and method-application branches with SSA store maps, and handles unknown higher-order references by branching over repository methods of the matching type. A soundness theorem covers closed terms and ground-typed free variables. The points-to pass computes finite method-name sets for references, variables and returned terms, lock-steps with translation, and cuts factorial method choices to linear growth in a recursive triangular-number example. BMC-2 parses an OCaml-like syntax and emits SMT-LIB for Z3.
  • number: 20 MoCHi benchmark programs, three runs per program and bound, Intel i7-6700/16GB, 10-second timeout and maximum k=10.
  • number: Points-to analysis reduced mean execution time 55.8% and reached a maximum 96.8% decrease at k=3; k=1’s maximum increase was 2.4%.
  • number: hrec timed out at k=3 without points-to and k=9 with it; hors timed out before but did not time out with it and could be checked beyond k=200.
  • number: All benchmark bugs were found within k=2.
  • limits: HORef has global references (no fresh-reference construct), integer arithmetic and dynamically named methods; the bound limits nested calls, so unsatisfiable formulas only establish bounded behavior unless bounds are complete. Open higher-order free variables are unsound because unknown code is not modeled; the authors suggest making such checks unsatisfiable. The basic translation can explore all matching methods, and SSA joins/repository duplication add clauses; points-to is an over-approximation. Experiments use 20 MoCHi-derived examples, k≤10 and 10-second timeouts; MoCHi comparison was unreliable.
  • how much was read: most of it read
  • record id: higher-order-bounded-model-2018
• HOT-PDL (2018)
  • title: Propositional Dynamic Logic for Higher-Order Functional Programs
  • what: Introduces HOT-PDL, a dynamic logic over higher-order traces (HOTs) with call/return (CR), caller-to-callee (CC) and returned-function-to-caller (RC) pointers. It specifies temporal control flow of call-by-value higher-order functional programs, including stack-based access control and dependent refinement-type properties, and proves model checking decidable for bounded integers by reduction to modal μ-calculus checking of higher-order recursion schemes. HOTs are labeled DAGs whose events are linearly ordered by next-event edges and whose pointer conditions enforce unique call/return and higher-order links. The paper gives trace semantics for a simply typed ML-like language with recursion and bounded integers, translates dependent refinement types into HOT-PDL, and refines stack inspection so function origin is tracked through higher-order passing (rejecting unsafe partial-application examples that ordinary stack paths miss). Decidability expands each HOT DAG into a HORS-generated tree and translates path expressions to μ-calculus fixpoints; an event monitor/handler simulates pointer traversal, assuming CPS (without loss of generality via transformation).
  • number: HOT edges use four labels N, CR, CC and RC
  • number: bounded-integer ML-like programs; finite and infinite traces
  • number: decidability via modal μ-calculus model checking of higher-order recursion schemes
  • limits: The core language is call-by-value, pure apart from nondeterministic bounded integer input, simply typed, with finite integer domain; branching properties are outside HOT-PDL. CPS is assumed for the HORS construction. Expanding DAGs into trees relies on formula truth being unaffected by node sharing; adding path intersections loses this property and leaves decidability open. Call-by-name and effectful languages are future work.
  • how much was read: most of it read
  • record id: hot-pdl-2018
• HS Interval Logic Expressiveness (2018)
  • title: Interval vs. Point Temporal Logic Model Checking: an Expressiveness Comparison
  • what: Compares model-checking expressiveness of Halpern–Shoham interval temporal logic under state-, computation-tree- and trace-based semantics with LTL, CTL and CTL*. The paper proves HS on traces is expressively equivalent to LTL, computation-tree HS is equivalent to finitary CTL*, and state-based HS strictly extends computation-tree HS. It also proves incomparability of trace HS with the branching variants and exponential succinctness of basic-interval formulas over LTL.
  • number: Theorem 3.5: BE/HS interval formulas can be at least exponentially more succinct than LTL
  • number: HSct and finitary CTL* have the same expressiveness
  • number: HSlin and HSst, and HSlin and HSct, are expressively incomparable
  • limits: Results use finite Kripke structures and the homogeneity assumption, where propositions hold on an interval exactly when they hold at every component state. The work is primarily expressiveness, not implementation benchmarking; complexity issues are treated unevenly across variants and several extensions remain open.
  • how much was read: most of it read
  • record id: hs-interval-logic-expressiveness-2018
• ICE refinement types (2018)
  • title: ICE-Based Refinement Type Discovery for Higher-Order Functional Programs
  • what: Extends the ICE invariant-learning framework to infer refinement types for recursive higher-order OCaml programs. It generalizes implication constraints from (x,y) to ({x1,…,xk},y) for nonlinear Horn clauses, learns multiple mutually dependent predicates, verifies candidates with SMT, and iterates counterexamples. Formalizes a simply typed call-by-value higher-order language with recursion and a refinement type system whose typability implies main never fails. Verification conditions become Horn clauses; the teacher extracts positive, negative and generalized implication samples from falsified clauses, while a decision-tree learner synthesizes predicates. Effect analysis and Horn-clause reduction shrink predicate sets. RType (OCaml frontend) plus HoIce (Rust solver using Z3) was evaluated on 162 safe programs; 63/164 OCaml programs generated nonlinear Horn clauses, and failures exposed missing qualifiers or type-system incompleteness.
  • number: 162 benchmark programs
  • number: 63 of 164 OCaml programs yielded nonlinear Horn clauses
  • number: 100 s timeout
  • number: HoIce solved 162 benchmarks
  • limits: Target language has integers (booleans encoded as 0/nonzero), no algebraic data types, and requires simple typing; type soundness is stated but the refinement system is incomplete. Benchmarks include only safe programs because RType is not refutation-sound. Qualifier mining misses forms such as x+y≥z unless explicit; nine cases are refinement-untypable. 100-second timeout and solver-dependent learning limit scalability; unsatisfiable Horn clauses are a poor fit.
  • how much was read: most of it read
  • record id: ice-refinement-types-2018
• ImgQL-Topochecker (2018)
  • title: Spatial Logics and Model Checking for Medical Imaging Extended Version
  • what: Introduces ImgQL, extending Spatial Logic for Closure Spaces with distance and statistical region-similarity operators, and extends topochecker with efficient distance-transform algorithms for declarative MRI image segmentation. Implements Euclidean and shortest-path distance operators, a texture-similarity SCMP operator, incremental in-memory/on-disk caching, and declarative pipelines for glioblastoma/oedema and rectal-carcinoma segmentation. Reports linear image-size analysis and a preliminary Dice-style comparison.
  • number: Glioblastoma procedure tested on five images
  • number: Distance-transform algorithms are linear in image size; topochecker never ran out of memory in experiments
  • number: Preliminary single-patient Dice coefficient comparison reported as encouraging but not clinically significant
  • number: Rectal-cancer 3D analysis yielded better results than slice-wise processing
  • limits: Clinical validation is preliminary: glioblastoma testing used five images and one quantitative patient case; thresholds require careful calibration and preprocessing/resampling assumptions. The authors state results are insufficient for clinical use and plan broader datasets and parameter learning.
  • how much was read: most of it read
  • record id: imgql-topochecker-2018
• Ivy liveness-to-safety (2018)
  • title: Reducing liveness to safety in first-order logic
  • what: After a finite prefix of an execution, picks a finite projection of the state (the freeze point). Proves that no two later states can agree on that projection while all fairness obligations are met. This turns a progress proof into a safety proof about a finite bad pattern. Cases: ticket, alternating bit, TLB shootdown, Paxos, Multi-Paxos, Stoppable Paxos.
  • number: finding the invariants ‘requires a sophisticated user’; conjecture counts for liveness are ‘2 - 4 times higher’ than for safety (§7.2, pp.26:27-28)
  • number: six cases: ticket protocol, alternating bit, TLB shootdown, Paxos, Multi-Paxos, Stoppable Paxos
  • number: checking takes 3.7 to 219 seconds excluding invariant discovery
  • number: liveness needs two to four times as many invariant conjectures as safety (§7.2)
  • limits: The user still supplies the inductive invariants (facts preserved by every step). Humans applied the reduction by hand. Paxos assumes that the actions of a chosen leader or quorum are fair, that messages are eventually delivered, and that competing proposals eventually stop. Multi-Paxos and Stoppable Paxos cover one incarnation with fixed membership. The comparison counts invariants, not person-time.
  • how much was read: most of it read
  • source; notes: Ivy: dynamic abstraction and temporal prophecy
  • record id: ivy-liveness-to-safety-2018
• JBMC (2018)
  • title: JBMC: A Bounded Model Checking Tool for Verifying Java Bytecode
  • what: JBMC translates Java bytecode into CPROVER GOTO programs and checks assertions/runtime errors by bit-accurate symbolic execution, bounded loop/recursion expansion and SAT/SMT solving. It models common Java library classes and handles dispatch, exception propagation and quantified string constraints. This tool paper reports benchmark accuracy and runtime comparisons, not a machine-checked correctness proof of its frontend, operational model or solver [Q1–Q10,Q13–Q19]. §2 makes the trusted modeling boundary explicit: java.lang plus selected java.util models remove performance optimizations, use assume and CPROVER builtins, and verification harnesses provide nondeterministic values. Virtual dispatch becomes a runtime-type switch; exceptions propagate through a global variable and conditional control flow. §3 evaluates 368 short programs from four sources, including177 of JBMC’s own regression tests (known bugs/hard unsupported cases included). Figures2–3 expose feature-specific outcomes and timing rather than uniform superiority [Q3–Q9,Q11–Q18].
  • number: 368 benchmarks:177 own regression,104 JPF,23 recursive,64 minepump
  • number: JBMC327 correct,14 incorrect,21 timeouts,6 errors
  • number: reported correct-result rates89%,51%,75% for JBMC,JayHorn,JPF
  • number: 300s and15GB analysis limits
  • limits: A fixed –unwind k success only covers the selected expansion depth (§2.4); the experiment instead uses a stepwise loop-unwinding approach described as proving unbounded safety (§3.1), without explaining a general unbounded algorithm or proof. JNI and reflection are unsupported; generics, lambdas and multithreading are ongoing work in this2018 version. Operational models and harness assumptions constrain behavior. Benchmark programs average40 LOC; about48.1% are the tool’s own tests. Fourteen incorrect JBMC results, including five incorrect-safe cases, preclude treating reported success as an independently trustworthy certificate [Q5–Q13,Q15].
  • how much was read: most of it read
  • source
  • record id: jbmc-2018
• k-synchronizability (2018)
  • title: On the Completeness of Verifying Message Passing Programs Under Bounded Asynchrony
  • what: Introduces k-synchronous bounded analysis for finite-state processes communicating through unbounded FIFO buffers. Each phase has at most k sends followed by corresponding receives. The paper decides k-synchronizability, proves reachability over k-synchronous executions complete when synchronizability holds, and establishes PSPACE-completeness. Defines traces with program-order and send-receive edges, k-synchronous semantics and happens-before equivalence. A conflict-graph characterization detects bad cycles or cycles larger than k; monitor processes reduce invariant checking to reachability. The paper handles unbounded buffers, gives examples where small k suffices or fails, and proves the decision procedures and complexity bounds.
  • number: k-synchronizability PSPACE-complete
  • number: k-synchronous reachability PSPACE-complete
  • number: unbounded FIFO buffers
  • number: finite-state process assumption
  • limits: Finite-state processes and FIFO channels are assumed. Completeness is conditional on a finite k-synchronizability result; general asynchronous programs may fail it. Preserved equivalence is happens-before trace equivalence, and the method targets reachability/invariants rather than liveness. PSPACE procedures can still be costly.
  • how much was read: most of it read
  • source
  • record id: k-synchronizability-2018
• Layered Concurrent Programs (2018)
  • what: Formalizes layered concurrent programs, a single imperative concurrent notation containing a sequence of concrete-to-abstract programs with common code written once. A type system extracts each layer and checker programs; refinement is reduced to cooperative safety of checkers plus safety of the top abstraction. Defines gated atomic actions, parallel calls, preemptive and cooperative semantics, and mover-type commutativity. The projection and reduction theorems show that cooperative checker executions cover preemptive behaviors; instrumentation tracks snapshots and exactly one abstract action across preemption-free fragments. The lock example refines CAS/RESET spinlock to an ownership-aware abstract lock and then skip; Civl uses Boogie and has verified a garbage collector and race detector, with about fifty smaller examples including ticket lock and lock-free stack.
  • number: three-layer spinlock example
  • number: h checker programs for h refinement steps
  • number: around fifty smaller Civl programs
  • number: Section 6: around fifty smaller programs; large cases are a concurrent garbage collector and a data-race detector
  • limits: Soundness requires pairwise commutativity and mover annotations, disjoint outputs/linearity conditions, safe checker programs under cooperative semantics, and a safe top abstract program. The result is safety/refinement only, not liveness. The paper reports no new quantitative benchmark table; executable code generation, scalability, and IDE integration remain open, and concrete atomic-action gates remain trusted specification points.
  • how much was read: most of it read
  • source; notes: Civl and inductive sequentialization
  • record id: layered-concurrent-programs-2018
• Lazy Self-composition for Security Verification. (2018)
  • what: Combines symbolic path-sensitive taint analysis of one program copy with precise two-copy safety verification to avoid eager full self-composition. Ifc-CEGAR validates candidate taint leaks, transfers relational invariant information and refines taint updates. Ifc-BMC duplicates only possibly tainted computations while unrolling, and can prove safety early when all live initial taint disappears. SeaHorn prototypes are compared to eager composition on small security benchmarks. Details observability/declassification predicates, the one-sided meaning of taint, proof-trace rewriting versus strengthening and the model refinement needed to restore induction. Keeps conditional completeness separate from prototype support; preserves no-fresh-secret condition for BMC termination, unknown handling, bitvector/struct limitations, all benchmark values and the narrow evidence behind scalability/constant-time claims.
  • limits: §§3–4: transition-system variables and quantifier-free first-order theory formulas describe Init, Tr and Bad. Tr is assumed reflexive so either program copy may stutter. H identifies initially secret variables and L is its complement. Security is defined relative to the chosen operational model and observation predicates, not every possible timing/cache/network observation. §4: Obs_x specifies when a low variable is adversary-observable. The terminal-output policy, concurrently executing observers and selected declassification contexts are modeled by these predicates. Setting Obs false or explicitly marking a value untainted changes the permitted policy and must be justified externally; it is not a derived no-leak theorem. §4.1: taint marks high variables true and low variables false initially. Theta(expression) disjoins taint of its variables; conditional update taint includes condition taint and the chosen branch expression. It tracks explicit and implicit flows but overapproximates value dependence, e.g. different expressions with the same result. The final prose reverses x1/x2 dependency direction; the displayed update gives the intended meaning. §4.2: self-composition starts low variables equal and leaves high values independent. Bad requires one low value unequal while both copies satisfy its observation predicate. Results concern this paired-execution definition under the chosen stuttering model; termination behavior or microarchitectural leakage is not automatically covered. §5 Corollaries1–2: real self-composition leaks imply possible taint leaks; no taint leak proves no modeled leak. A tainted output alone does not prove insecurity. Untainted implies equality across the related copies, whereas equality need not imply untainted in the original abstraction. §5.1 Algorithm1: taint solver SAFE ends the check; a taint counterexample triggers a constrained self-composed problem. One described Constraint choice bounds all self-composed executions by the counterexample length k rather than merely replaying one control path. An actual paired witness gives UNSAFE; a spurious one supplies relational facts for refinement. §5.1: ReWrite adds single-copy facts and entailed equalities/disequalities while preserving claimed inductive traces, without itself improving the taint abstraction. Strengthening additionally uses proved equalities to require no taint, which can destroy induction. Refine changes selected next-taint functions under the strengthened frame condition to restore induction; it is not merely adding an unproved invariant to the original model. §5.1 Theorem1 assumes a sound and complete first-order-theory model checker maintaining inductive traces. It states Ifc-CEGAR soundness/completeness under that assumption and gives a proof sketch, not unconditional decidability or termination for arbitrary C/CHCs or a proof that Spacer always terminates. Lemma claims/trace transformations are not mechanically verified here. §5.1 printed formula issues, visually confirmed: equations10/12 initialize a trace over Y=X∪Xt using Init_d, which is defined over X∪Xd; displayed component-preservation implications on p.145 use frame i on both sides instead of i+1; equation13 switches superscript d to s. The record follows the stated algorithmic intent without silently treating the typeset formulas as a complete executable correctness proof. §5.2 Algorithms2–3: an UNSAT taint query permits the duplicate value to reuse the original computation. SAT or UNKNOWN conservatively duplicates it. At BND without a conclusive result return UNKNOWN; failure to find a bounded counterexample alone is not safety. The simplified bad formula omits Obs only for exposition. §§1,5.2: early safety requires no live variable tainted and no leak found in the checked prefix. Initial secret taint must be exhausted and no new secret input introduced later; the introduction explicitly states this assumption and says later tainted inputs need a modified check. Does not provide a general finite completeness bound for ongoing distributed services. Algorithm notation issues: Algorithm2 calls LazySC(M,Mt), whereas Algorithm3 header orders(Mt,M); Algorithm1 advertises UNKNOWN but main loop has no solver-UNKNOWN branch, and its UNKNOWN return follows until-infinity. These are high-level sketches; practical resource/solver-unknown handling is not completely specified. Algorithm2 also does not explicitly distinguish an unknown composed-property query before its early-safety check. §§6–6.2: prototype initially described as not bit-precise and not supporting complex lists. More specifically CEGAR uses LLVM instrumentation plus Spacer and cannot handle benchmark structs or bitvector operations; BMC works over CHCs with Z3 and handles all evaluated programs. Do not generalize CEGAR restrictions to the list/BV BMC rows or infer full C bit-precise semantics from them. §§6.2–6.4: Intel Core i7-4578U,8GB RAM;300s timeout. Eager comparisons use the same backend on two copies. All seven CEGAR rows are safe, only pwdcheck2 needs one refinement; the other six are discharged by taint analysis with no self-composition refinement. Eight BMC rows include two unsafe variants. These selected small/microbenchmarks are not a large deployed-code security audit. §6.4: Table3 runtime at array size64 is85.44s, supporting under2min on that instance. Author statement of exponential runtime growth is a qualitative characterization of eight observations, not a proved asymptotic bound or scaling to unbounded arrays. Exact BND values, program sizes, solver versions, repetition variance and memory consumption are not supplied. §§7–8: security-type, dynamic-taint and product-program comparisons are discussion claims without separate head-to-head benchmark data here. General k-safety and quantified relational invariants for unbounded data structures are future work. No verified implementation, certificate validation, Verus/Rust/TLA+ or LLM evaluation is reported. Frontend, instrumentation, policy and solvers remain trusted.
  • how much was read: most of it read
  • source
  • record id: lazy-self-composition-for-2018
• LLUMC (2018)
  • title: Unbounded Software Model Checking with Incremental SAT-Solving
  • what: Presents LLUMC, translating optimized LLVM IR from sequential C into four DimSpec CNF formulas for unbounded reachability, solved by incremental SAT (IncPlan) or IC3 (MinireachIC3). It targets assertion failures and undefined signed arithmetic overflows. The encoding uses curr/pred basic-block identifiers and selected live variables as bit-vectors; I, G, U, and T represent initial, goal, universal-state, and transition constraints. Explicit assert/assume/error calls and nsw arithmetic generate error transitions. The paper states a soundness claim but omits a structural proof, relying on assumptions about C-to-LLVM preservation and closed state transitions. IC3 can prove safety, while incremental SAT finds counterexamples and may not terminate on unreachable goals.
  • number: 24 benchmarks: 14 incorrect and 10 correct, 14–646 LOC, 151–116,777 clauses
  • number: MinireachIC3 solved 20/24 within 600 s; IncPlan frequently timed out on safe cases
  • number: larger erroneous s3 client: 198.93 s and 940.5 MB (abcdSat)
  • number: overflow smaller: IC3 0.83 s; gcd-4 safe: IC3 6.853 s
  • limits: Only sequential C supported; memory accesses, floating point, recursion, concurrency, and unsupported LLVM operations are excluded in evaluation. Global memory is ignored by the bit-vector encoding. Error means failed assert or specified signed overflow, not all undefined behavior. The authors explicitly say the central claim lacks a formal structural induction proof. SAT reachability alone cannot prove unreachability and large instances time out.
  • how much was read: most of it read
  • record id: llumc-2018
• Local/global distributed proof complexity (2018)
  • title: Local Verification of Global Proofs
  • what: Compares local labels, one shared global proof, and mixed proofs for constant-radius distributed verification, quantifying the cost of distributing global evidence. Defines local, global and mixed certificate sizes s_l, s_g and s_m and proves s_l≤s_m≤s_g, s_m≤n s_l and s_g≤n s_l+O(n log n). The price of locality is n s_l/s_m. Uniform local proofs yield Θ(n) price; At-most-one-selected (Amos) has O(log n) uniform labels and Θ(n) price. Minimum Spanning Tree has O(log²n) local proofs and O(n log n) global proof, giving Θ(log n). At-least-one-selected requires Ω(n log n) mixed proof, and reversing decision therefore needs Ω(log n) local or Ω(n log n) global evidence. A block-neighborhood counting argument supplies the lower bound and is lifted to leader election, spanning tree and odd-cycle. Bipartite global proofs are conjectured Θ(n log n), with bounds depending on identifier range. The paper connects local/global nondeterministic hierarchies to communication-complexity hierarchies.
  • number: s_l≤s_m≤s_g
  • number: s_g≤n s_l+O(n log n)
  • number: Amos price Θ(n)
  • number: MST price Θ(log n)
  • limits: Verification radius is constant and verifiers are uniform unless explicitly discussing identifier range; IDs are polynomial-range O(log n) bits for the main model. Local labels are assumed equal size, so concatenation is exactly n times one label. Lower bounds use oriented cycles/blocks and can depend on connectedness, IDs and proof model. The Bipartite Θ(n log n) global lower bound remains a conjecture; communication-complexity hierarchy separations are open.
  • how much was read: most of it read
  • record id: local-global-distributed-proof-complexity-2018
• Modular Paxos verification (2018)
  • title: Paxos Consensus, Deconstructed and Abstracted (Extended Version)
  • what: # Paxos Consensus, Deconstructed and Abstracted: whole paper reading (authored by agents unless marked 🧑) Álvaro García-Pérez, Alexey Gotsman, Yuri Meshman and Ilya Sergey’s extended Paxos Consensus, Deconstructed and Abstracted is arXiv:1802.05969v1,16 February 2018. All 44 pages were read: eight sections, Appendices A–E, all 17 figures, four theorems, five lemmata, four definitions, examples 1–6, all printed proof outlines and 32 references. All 11 contact sheets and individual15,18,21,22,28,32,33,44 were inspected. The original, local and official PDFs match. No author code, scientific-result artifact or formal checking tool was executed or loaded. [Evidence: Q0, frontmatter/v1 identity, PDF pp.1–1; literal spans in quotes.json.] The paper separates two verification problems: proving single-decree Paxos through composable shared-memory object specifications, and deriving Multi-Paxos by transformations of message handling. It adapts Boichat et al.‘s Paxos→Round-BasedConsensus→Round-BasedRegister decomposition. The lower specifications deliberately admit unsuccessful operations that nevertheless expose values to other operations. The aim is to preserve each unchanged module’s proof when changing another module or the network implementation. Claims of being the first such modular verification belong to these authors; this reading does not establish historical priority. [Evidence: Q1, §1, two contributions, PDF pp.2–3; Q28, §7, complete comparisons/claimed novelty, PDF pp.24–25; literal spans in quotes.json.] The setting is crash-stop, majority-quorum consensus, not Byzantine consensus or crash-recovery with durable storage. The basic network neither invents, changes, drops nor duplicates messages, delivers with unbounded delay, and has nonblocking send/blocking receive. Later transformations explicitly introduce selected read-request duplication. Leader election is omitted under an assumption that one correct process trusted by all other correct processes always exists. No failure-detector implementation, storage-recovery proof or general termination proof is supplied. Finite trace refinement and linearizability establish safety properties, not eventual completion: lower specifications may repeatedly choose failure. [Evidence: Q2, §3, decomposition/leader assumption, PDF pp.4–5; Q3, §3, network/imperative language, PDF pp.5–5; Q4, §1, safety scope, PDF pp.1–1; Q19, Definition1, full configuration traces, PDF pp.18–18; literal spans in quotes.json.] Acceptors retain promised round r, accepted round w and value v. A read(k) gathers distinct-sender acknowledgments from ceil((n+1)/2) acceptors and chooses the value with highest accepted round, or undef. A write(k, v) gathers an equal majority; either operation can fail after a nack. Acceptors accept requests at k≥r and atomically update state with their acknowledgment send. A proposer uses rounds pid, pid+n, pid+2n,…; this guarantees disjoint rounds between processes under one continuing invocation per process. Reinvoking the printed entry operation resets k to pid, so repeated independent calls need fresh-instance state or persistent counters. Fixed process identities and trustworthy message origins under the assumed transport model, plus matching request rounds, are essential. [Evidence: Q6, Figure3/§3, complete read/write implementation, PDF pp.6–6; Q7, Figures4–5, acceptor and entry implementation, PDF pp.7–7; Q8, §3, entry and unique rounds, PDF pp.8–8; Q3, §3, network/imperative language, PDF pp.5–5; literal spans in quotes.json.] The top sequential specification stores one value, choosing the first proposal and returning that value thereafter. Its concurrent implementation can decide another process’s previously exposed proposal; ghost pending-thread entries let one invocation linearize that proposing operation first and then itself. This is helping: a thread’s logical effect may occur during another thread’s step. The proof assumes unique proposal values, one pending slot per process and single-assignment result cells. A concrete invocation identity or a justification that unique tagging preserves client-visible equality would be needed to generalize beyond that stated setting. Abstract results are declared Boolean in Figure 7 although proposal values have type val; this is a printed typing mismatch. [Evidence: Q5, Figure2, atomic entry specification, PDF pp.4–4; Q10, §4/Figure 7/Theorem 1, complete top refinement, PDF pp.9–10; Q30, Appendix A, complete top-level proof outline, PDF pp.27–29; literal spans in quotes.json.] Figure 6 gives the reason for weakening the intermediate abstractions. A low-round write can fail overall yet reach one acceptor, after a higher-round quorum has already decided another value. An overlapping read may see that isolated value and complete successfully, although its subsequent write will fail. Real-time order and this information flow can require the failed write to linearize before the read. The abstract specifications therefore retain sets of exposed values rather than only the globally decided value, allow reads at stale rounds and allow a write at an otherwise eligible round to fail because a concurrent operation overtakes it. [Evidence: Q9, §3/Figure 6, complete histories and rationale, PDF pp.8–9; Q11, §4/Figure8, round consensus contract, PDF pp.10–12; Q12, Figure9/§4, complete register contract, PDF pp.12–12; literal spans in quotes.json.] Round-BasedConsensus’s atomic proposeRC(k, v0) nondeterministically selects vD and a success flag. If vD is already exposed or equals v0, it adds vD to valsRC even on failure; success additionally needs k≥roundRC and retains the first decided vRC. Round-BasedRegister is weaker: every write exposes its input, a successful eligible write updates roundRR and vRR, and a read may return any exposed value when its round is stale. Its vRR is not itself an immutable consensus decision. The enclosing read-before-write discipline and unique increasing rounds are needed to recover the deterministic top specification. Theorem 2 places logical effects at failed read or completed write. [Evidence: Q11, §4/Figure8, round consensus contract, PDF pp.10–12; Q12, Figure9/§4, complete register contract, PDF pp.12–12; Q13, Theorem 2, round consensus linearization, PDF pp.12–12; literal spans in quotes.json.] The register proof uses prophecy variables: ghost values selected according to how an operation eventually returns. Successful reads are intended to linearize when the quorum-th read acknowledgment is sent, successful writes at the quorum-th write acknowledgment, failed reads at their nack return, and failed writes at the first accepting response or at the failure return if none accepted. These are proof annotations, not an implementable ability to predict network schedules. Ghost counters count acknowledgments sent, whereas concrete quorums count acknowledgments received. The basic no-duplication premise is used in relating those quantities. [Evidence: Q14, §4, register prophecy/linearization explanation, PDF pp.12–14; Q15, Figure10, complete instrumented read/write, PDF pp.14–14; Q16, Figure 11/Theorem3, complete annotated acceptor, PDF pp.14–15; Q32, Appendix C, complete register proof outline/invariants, PDF pp.31–41; literal spans in quotes.json.] Reader source-level objection to the printed read annotation: Figure 11 requires both count_r[k]=quorum−1 and proph_r[k]=(true, v), where v is that particular acceptor’s local value. The eventual read result is instead the maximum accepted-round value among received acknowledgments. With n=3, let A1 hold (vA, w=1) from a failed write and A2 hold undef. A read at k=3 returns vA after receiving A1’s then A2’s replies. When A1 sends, count=0 rather than 1; when A2 sends, count=1 but its undef differs from the prophecy vA. A third sender sees count=2. No successful-read annotation fires. This ordinary schedule substitution identifies a proof-instrumentation gap, not a conflicting-decision attack or an executed trace. The proof needs an annotation tied to the relevant quorum maximum, not equality with an arbitrary quorum-th sender’s value. [Evidence: Q15, Figure10, complete instrumented read/write, PDF pp.14–14; Q16, Figure 11/Theorem3, complete annotated acceptor, PDF pp.14–15; Q32, Appendix C, complete register proof outline/invariants, PDF pp.31–41; Q9, §3/Figure 6, complete histories and rationale, PDF pp.8–9; literal spans in quotes.json.] The incomplete-operation case also needs care. The paper leaves a never-returning write’s prophecy undef and never linearizes it, although it may already change an acceptor and supply a value read by another operation. A standard linearizability proof can complete selected pending operations; this annotation needs to support those completions rather than erase every nonreturning writer. Separately, after correcting the acknowledgment predicate notation, Appendix C’s intended Val(j, v) invariant equates the current value with existence of a historical write acknowledgment for v. After accepting v1 then v2, the retained message history still contains the acknowledgment for v1 but the current value is v2, contradicting the reverse implication. The intended invariant needs a latest-round qualification. These are reader proof obligations, not a rejection of Paxos’s ordinary quorum argument. [Evidence: Q14, §4, register prophecy/linearization explanation, PDF pp.12–14; Q16, Figure 11/Theorem3, complete annotated acceptor, PDF pp.14–15; Q32, Appendix C, complete register proof outline/invariants, PDF pp.31–41; literal spans in quotes.json.] The appendices contain additional transcription problems material to mechanization. Appendix A’s loop annotations use pid=k mod n despite initializing k=pid and maintaining the owner formula ((k−1) mod n)+1; n=3, pid=3, k=3 gives3≠0. They also assert a false pending flag after an unsuccessful iteration, although that branch does not clear it. Appendix B’s rely relation prints an index condition (k mod n)≠(k mod n), with no distinct index, which would exclude all interference literally. Appendix C’s req/ack predicates reuse the same message identity for a request and its reverse-direction acknowledgment; for different endpoints those fields cannot both hold. These details must be corrected before treating the outlines as machine-checked proofs. [Evidence: Q30, Appendix A, complete top-level proof outline, PDF pp.27–29; Q31, Appendix B, complete round consensus proof outline, PDF pp.29–31; Q32, Appendix C, complete register proof outline/invariants, PDF pp.31–41; literal spans in quotes.json.] The network layer models local states, protocol transition relations and a multiset of uniquely identified messages retained after reception with active=false. A simple execution chooses an internal step, send or receive at one node. Appendix D flattens proposer code, carries the residual program text in each local state and gives send/receive rules; it leaves ordinary WHILE-language semantics assumed. Thus program counters and auxiliary loop variables are part of this encoding, not invisible implementation details. Receive rules in Figures13–14 also print an unbound n where the destination-node update is intended. [Evidence: Q17, §5.1, local states/messages/transition relations, PDF pp.16–17; Q18, Figure13/§5.1, network steps, PDF pp.17–18; Q33, Appendix D, complete code-aware encoding, PDF pp.41–44; literal spans in quotes.json.] Out-of-thin-air semantics adds selected read requests without changing local state, justified by predicate P when the proposer has reached at least that round. Lemma 1 claims its complete configuration traces are included in the simple semantics. Appendix E’s entire argument says a read request does not change proposer state and has no nontrivial precondition. That does not directly match Appendix D’s code-aware encoding, where executing send advances the residual program and loop, and a particular round/destination request is sent once. Extra duplicate requests with unchanged program state therefore need an explicit observation/projection or a different reusable-send protocol. The source’s exact-trace inclusion is stronger than client-visible equivalence and its printed one-sentence proof does not bridge them. [Evidence: Q20, §5.2, complete OTA rule/predicate/Lemma 1, PDF pp.18–18; Q19, Definition1, full configuration traces, PDF pp.18–18; Q33, Appendix D, complete code-aware encoding, PDF pp.41–44; Q34, Appendix E, complete transformation/composition proofs, PDF pp.44–44; literal spans in quotes.json.] Slot replication runs an independent single-decree instance per slot; projection to any slot recovers its base behavior up to stuttering. Widening then copies a triggering read request to all slots at the same recipient. Its refinement requires OTA compliance and P-monotonicity: a request justified at one sender slot must be justified at every other sender slot. Example 4 correctly excludes independently advancing rounds and supplies fixed-round instances as a positive case. Example 5 immediately invokes the unrestricted Section 3 implementation, whose rounds retry independently; the required synchronization/restriction is not established there. An independent-slot source-level case uses n=3, pid=1, with sender slots at rounds 4 and 1: request k=4 satisfies P in the first slot but not the second. The refinement must state a shared-round discipline rather than infer it from ordinary slot independence. [Evidence: Q21, §5.3/Figure14/Definition2/Lemma2, independent slots, PDF pp.18–20; Q22, §5.4/Definition 3, widening rule/OTA compliance, PDF pp.20–21; Q23, §5.4, Definition4/Examples4–5/Lemma3, PDF pp.21–21; literal spans in quotes.json.] Two further printed conditions need explicit scope. Definition 3 introduces a triggering subset T but then quantifies all messages m∈M instead of m∈M∩T; its read-only P would reject ordinary write/ack messages. Optimized widening’s receiveAndAct applies a received message to every slot without an explicit m∈T branch, despite T appearing in the rule’s name. Applying a slot-specific write everywhere would not preserve independent slots. Restrict the optimized rule to triggering read requests and retain ordinary per-slot reception for other messages. These are literal-rule qualifications, not evidence about the linked Scala implementation. [Evidence: Q22, §5.4/Definition 3, widening rule/OTA compliance, PDF pp.20–21; Q24, §5.5, all-slot optimized rule/Lemma 4, PDF pp.21–22; Q23, §5.4, Definition4/Examples4–5/Lemma3, PDF pp.21–21; literal spans in quotes.json.] Reader refinement qualification also applies to Lemmata 3–4. Widening consumes one active request and inserts replicas in the same transition; separate slot-replicating receive and OTA send transitions introduce intermediate configurations. Appendix E explicitly says, “This allows us to emulate this step by a per-slot execution of the OTASend.” That establishes a multistep simulation argument, while Lemma 3 states inclusion of complete configuration traces. Lemma 4 permits compression of intermediate configurations, but expanding receives also leaves inactive replica requests in message history; the optimized rule does not insert that same history. A specified observation/refinement mapping must account for grouped steps and internal request histories, not just remove intermediate configurations. These are source-level proof obligations, not executed counterexamples or consensus-safety violations. [Evidence: FR_FQ19, §5.1, observation definition, PDF pp.17–17; FR_FQ25, §5.4, WStepReceiveT adds replicas while consuming the original, PDF pp.20–20; FR_FQ26, §5.5, optimized widening has no triggering-set guard, PDF pp.21–21; FR_FQ27, §5.5, Lemma 4 configuration compression, PDF pp.22–22; FR_FQ40, Appendix E, Lemma 3 simulation uses multiple steps, PDF pp.44–44; literal spans in quotes.json.] Optimized widening batches one recipient’s per-slot receive, local and reply steps; Lemma 4 relates it to expanding those local sequences. Bunching packages the resulting replies in a message, caches/unpacks them on demand and maps them back to separate messages in Lemma 5. The intended benefit is amortized Phase 1 across slots while reusing single-decree proofs. Because the model permits infinitely many slots, its all-slot batch needs a finite or lazy representation before implementation. The register-provider interface exposes independent write-once slots; it does not itself prove client request deduplication, gap-free log execution, application linearizability or leader-lease correctness. [Evidence: Q24, §5.5, all-slot optimized rule/Lemma 4, PDF pp.21–22; Q25, §5.6/Figure15/Lemma 5, bunching/unpacking, PDF pp.22–23; Q26, §5.7–6, composition/interface/stability, PDF pp.23–24; Q27, §6, Scala/Akka prototype/Theorem 4, PDF pp.24–24; literal spans in quotes.json.] Theorem 4 composes Theorem 1 with the transformation lemmata to claim refinement of an array of atomic write-once registers. Appendix E supplies short proofs of Lemmata 1–3 and Theorem 4; Lemmata 4–5 have statements/explanations in the body but no separate extended proofs. Stable rely/guarantee assertions are the stated condition for transporting program reasoning across network transformations. The paper’s conclusion proposes Raft, PBFT, Mencius, master leases and epoch numbering as future applications, without establishing those results here. [Evidence: Q26, §5.7–6, composition/interface/stability, PDF pp.23–24; Q34, Appendix E, complete transformation/composition proofs, PDF pp.44–44; Q29, §8, contributions/proposed extensions, PDF pp.25–26; literal spans in quotes.json.] Validation is a Scala/Akka proof-of-concept linked at github.com/certichain/protocol-combinators, plus handwritten specifications, annotations and proof outlines. The paper reports no benchmark configurations, performance measurements, experiment counts or machine-checked artifact for its own argument. “Executable” and “provably correct” are the authors’ descriptions; source-code refinement and runtime-library correctness were not inspected in this reading. TLA+, PVS, Isabelle, EventML, PSync, Ivy, IronFleet, Verdi and Disel appear as related work, not tools used to check these particular proofs. [Evidence: Q27, §6, Scala/Akka prototype/Theorem 4, PDF pp.24–24; Q28, §7, complete comparisons/claimed novelty, PDF pp.24–25; Q34, Appendix E, complete transformation/composition proofs, PDF pp.44–44; literal spans in quotes.json.] For this database the main contribution is proof reuse across both object abstraction and protocol-aware network optimization, with failed-write information flow as a concrete test of specification adequacy. Reader follow-ups are a TLA+ model of ghost-free concrete histories and slot/round synchronization; Verus/Rust ownership and typed sender/instance proofs for a finite lazy network adapter; and LLM proof-agent tasks checking prophecy coverage, pending-operation completions, stable interference assertions and exact refinement observations. No Verus, verified Rust or LLM evaluation is reported. These proposed checks should distinguish repairing printed proof outlines from discovering an actual consensus safety violation. [Evidence: Q1, §1, two contributions, PDF pp.2–3; Q14, §4, register prophecy/linearization explanation, PDF pp.12–14; Q23, §5.4, Definition4/Examples4–5/Lemma3, PDF pp.21–21; Q27, §6, Scala/Akka prototype/Theorem 4, PDF pp.24–24; Q29, §8, contributions/proposed extensions, PDF pp.25–26; literal spans in quotes.json.]
  • number: Module proofs can be reused across implementations
  • number: Crash-failure Paxos setting
  • limits: Crash-stop failures; majority quorums; reliable transport with no invented, modified, lost or duplicated base messages; fixed process identifiers; unique proposals and disjoint increasing rounds under one continuing invocation per process; correct trusted leader assumed. Handwritten proof annotations require repairs. Transformations need stable assertions, cross-slot P-monotonicity, triggering-message guards, and an observation/refinement mapping.
  • how much was read: most of it read
  • source
  • record id: modular-paxos-verification-2018
• Nagini static verifier for Python (2018)
  • title: Nagini: A Static Verifier for Python.
  • what: Presents Nagini, an automated modular verifier for statically typed concurrent Python 3. It translates annotated Python through Mypy and a Viper encoding to verify memory safety, data races, functional and I/O properties, finite blocking, termination and deadlock freedom.
  • number: test suite over 12,500 lines
  • number: ten-run averages
  • number: Lenovo Thinkpad T450s, Ubuntu 16.04, Python 3.5, OpenJDK 8
  • limits: Programs must satisfy static nominal typing and the supported Python subset; reflection, dynamic code generation and overridden magic attribute methods are unsupported or rejected. External-library stubs are trusted under their specifications. Top-level statements are non-modular and require reverification after any change. Verification depends on user annotations and Viper backends; the paper reports no formal completeness and examples avoid dynamic features/external libraries. Finite blocking covers lock/join blocking, not arbitrary liveness.
  • how much was read: most of it read
  • source
  • record id: nagini-static-verifier-for-python-2018
• Peregrine population-protocol analyzer (2018)
  • title: Peregrine: A Tool for the Analysis of Population Protocols.
  • what: Introduces Peregrine, a web tool for designing, simulating, statistically sampling and parameterized-verifying population protocols. It verifies silent protocols over all infinitely many initial populations using layered termination and Presburger overapproximations, with LoLA confirmation and counterexample replay. The paper defines protocol/configuration/fairness semantics and illustrates majority voting. The UI supports graphical or script descriptions, manual/random simulation with rewind, convergence-speed statistics and JSON export. Verification first proves layered termination (a sufficient condition for silence), then searches an iteratively strengthened Presburger overapproximation for bad initial-to-terminal executions; candidate counterexamples are checked for concrete reachability by LoLA and replayed/exported. It distinguishes ordinary and increased-accuracy consensus classification, where LoLA checks whether a nonterminal consensus can later be broken.
  • number: 5000 random executions in illustrated statistics
  • number: population size at most 25 and execution length at most 40
  • number: verification up to about 100 states and a few thousand transitions
  • limits: Parameterized verification is supported only for silent protocols; if layered termination fails the tool derives no conclusion. Reachability is approximated, so satisfiable bad formulas require LoLA confirmation and unsatisfiable formulas prove correctness only under the approximation theorem. Fairness abstracts random interactions. Constraint-system size limits current verification to roughly 100 states and a few thousand transitions; arbitrary non-silent protocols and finite-state tools’ scalability are outside scope.
  • how much was read: most of it read
  • source
  • record id: peregrine-population-protocol-analyzer-2018
• POS concurrency sampling (2018)
  • title: Partial Order Aware Concurrency Sampling
  • what: Presents POS, a randomized concurrency scheduler that samples partial orders rather than redundant total interleavings. It assigns random priorities to events, executes the highest-priority enabled event, and reassigns priorities of events racing with the executed event. The paper formalizes sequentially consistent concurrent machines, event independence, partial-order equivalence and minimum partial-order coverage probability. BasicPOS uses immutable priorities but suffers propagated constraints; POS versions priorities by per-object access counts, yielding bipartite constraints and a theorem with a race-count-dependent lower bound. Implementation supports read-only-event relaxation and a periodic priority reset workaround for busy loops. Micro benchmarks use 16 events across four threads/objects; macro tests use SCTBench and Maple, with explicit exclusions and conservative geometric-mean handling.
  • number: POS micro-benchmark geometric mean 2.87e−6 versus random walk 2.14e−8 and PCT 2.00e−8
  • number: POS about 7.0× better overall (134.1× excluding RAPOS and BasicPOS)
  • number: read-only POS* about 1.4× better than POS and 5.0× better than other methods
  • number: macro geometric mean POS about 2.6× PCT and 4.7× random walk
  • limits: The machine model assumes sequential consistency, each statement accesses at most one shared object, disabled events eventually enable, and executions terminate (finite traces). POS needs a race predicate and probabilistic priorities; fairness is probabilistic and implementation resets priorities every 10^3 voluntary context switches, with claimed minimal effect. Guarantees are lower bounds on partial-order coverage, not exhaustive testing; read-only relaxation depends on correctly classifying races.
  • how much was read: most of it read
  • record id: pos-concurrency-sampling-2018
• ProFeat: feature-oriented engineering for family-based probabilistic model checking (2018)
  • what: ProFeat extends PRISM’s model/property languages with features, feature controllers, arrays, loops, templates, attributes and family parameters. It translates families to one combined PRISM model or separate instance models and translates analysis output back into feature-oriented tables, formulas or decision diagrams. Describes blocking versus nonblocking actions for inactive features, controller synchronization for simultaneous switches, guard strengthening to preserve valid feature combinations, and maximal-size array/module allocation for combined models. Symbolic result processing uses Quine–McCluskey with invalid configurations as don’t-cares, rounding, and MTBDD variable sifting. Also supports basic family partitioning and dynamic-mode modeling of adaptive communication links.
  • number: BSN: 298 configurations; 1 s combined versus 129 s sequential
  • number: elevator: 192 instances; MTBDD 29 s combined versus 1199 s sequential
  • number: up to 32 parallel instance analyses
  • number: dynamic network about 120 million states; about 40% MTBDD reduction
  • limits: Read version is a repository post-peer-review/pre-copyedit postprint for the exact DOI, not the publisher PDF. Models are finite DTMCs, CTMCs or MDPs; semantics is delegated to cited frameworks/translation rather than fully specified in this paper. Translation correctness, PRISM numeric approximation, and modeling fidelity remain trust boundaries. Postprocessing supports PRISM logs; special symbolic explanations are limited to static feature combinations. All-in-one performance depends on shared behavior and BDD ordering and can lose to one-by-one analysis. Quine–McCluskey has exponential worst-case complexity. Model/code artifacts were not inspected or executed.
  • how much was read: most of it read
  • source
  • record id: profeat-feature-oriented-engineering-2018
• Program Analysis Is Harder Than Verification: A Computability Perspective (2018)
  • what: Defines a computability model of assertion domains, total recursive analyzers and total recursive verifiers, then studies when finding an assertion is reducible to checking one. An analyzer can always be converted constructively to an equally powerful verifier; the paper states a converse reduction for finite domains of assertions and an impossibility result for infinite domains under its stated conditions. An abstract domain is countable with a concretization into program sets and a decidable semantic implication relation; the base definition does not require a complete lattice. Verifiers return true or unknown, analyzers return an assertion, and soundness/completeness are defined independently. Extensional domains depend only on input-output semantics. Rice-style theorems 5.3/5.4 limit precise analyzers and nontrivial monotone precise verifiers to trivial extensional domains. Theorem 7.1 constructs a verifier by testing whether the analyzer result entails the requested assertion. Reasonable verifiers are nontrivial, monotone and finitely meet-closed. Theorem 7.6 constructs an equivalent analyzer on a nonempty finite domain by finite enumeration and a strongest verified assertion. Lemma 7.7 uses a countably infinite bounded-convergence domain whose equivalent analyzer would decide termination; Theorem 7.8 states the general impossibility of a total recursive verifier-to-equivalent-analyzer transformation for infinite domains. Examples distinguish semantic assertions from intensional resource assertions and connect the abstract framework to intervals and polyhedra.
  • number: Theorems 5.3/5.4: Rice-style limitations on precise procedures over extensional domains
  • number: Theorem 7.1: analyzer-to-equivalent-verifier transformation on any domain
  • number: Theorem 7.6: converse for nonempty finite domains and reasonable verifiers
  • number: Lemma 7.7/Theorem 7.8: infinite-domain impossibility via termination reduction
  • limits: The model uses deterministic Turing-complete programs and total recursive procedures; verifier unknown is allowed and is distinct from refutation. The finite converse requires the paper’s reasonable-verifier conditions, including finite meet closure. The infinite result concerns a general constructive reduction preserving assertion-proving power, not the claim that every concrete synthesis instance or infinite-domain analysis is uncomputable. These are computability statements, not practical running-time, NP-hardness or model-quality bounds. The theorem proofs are mathematical within the presented model; no mechanized proof artifact or empirical evaluation is reported.
  • how much was read: most of it read
  • source
  • record id: program-analysis-is-harder-2018
• Program Verification by Coinduction (2018)
  • what: # Program verification by coinduction: whole reading (authored by agents unless marked 🧑) Brandon Moore, Lucas Peña and Grigore Roșu’s chapter is ESOP 2018, LNCS 10801, pp. 589–618, DOI 10.1007/978-3-319-89884-1_21. The inventory’s 2011/CPP metadata is incorrect. All 30 pages were read, including seven main sections/every subsection, Figures 1–6, Tables 1–2, Definitions 1–4, Lemmas 1–4, Theorems 1–2, code/formulas, references 1–45 and the open-access notice. The authors report Coq mechanization and experiments; full source proofs are linked as reference 16. This reading covers the entire chapter, not that repository or its proof certificates, and does not independently recheck the formalization. [Evidence: Q0, frontmatter/abstract/publisher2018ESOPidentity, PDF pp.1–1; Q1, §1 introduction/RQ1–2/contributions/artifactpointer, PDF pp.1–3; Q25, complete references 1–45, PDF pp.27–30; Q26, CCBY4openaccessnotice, PDF pp.30–30; exact source and character/LF/page anchors in quotes.json.] The contribution is a reusable Coq verification core parameterized by an operational transition relation R over configurations C. Specifications are sets of pairs (c,P), where c is a starting configuration and P is a set of target configurations; Coq predicates can describe those sets. Symbolic execution uses the supplied language semantics, while guarded coinduction handles loops/recursion. The same mathematical core is imported across languages; successor-finding tactics and domain reasoning still need instantiation. The authors’ novelty is applying existing coinduction mathematics to program verification and building reusable machinery/automation, not inventing the underlying general coinduction theorem. [Evidence: Q1, §1 introduction/RQ1–2/contributions/artifactpointer, PDF pp.1–3; Q4, §2.2 coinductiveoverview/Definition 1/Figure 3, PDF pp.6–9; Q5, §2.3 threestyleoperationalrelations, PDF pp.9–9; Q6, §3 introduction/§3.1 Definitions 2–4/Lemma 1/Theorem 1/allpath/until, PDF pp.9–11; Q23, §6.3 priorcoinductionschemata/noveltyscope, PDF pp.26–26; exact source and character/LF/page anchors in quotes.json.] The default validity notion is one-path partial correctness: c can reach some state in P or has an infinite execution. Definition 3 therefore uses an existential successor. Reader consequence: on a nondeterministic system one successful or diverging path can satisfy the claim despite another bad path; it does not prove all schedules correct, request completion or termination. A finite stuck execution outside P does not itself satisfy validity. Section 3.1 separately defines all-path validity, requiring a successor outside P and validity of every successor, so no path gets stuck before passing through P. This still allows infinite paths that never reach P. Its all-path until variant additionally constrains every transition before P by a relation T; it is not an unconditional eventual-delivery theorem. [Evidence: Q3, §2.1 Hoarecomparison/Figure 2/onepathvalidity/sideeffects, PDF pp.3–6; Q6, §3 introduction/§3.1 Definitions 2–4/Lemma 1/Theorem 1/allpath/until, PDF pp.9–11; exact source and character/LF/page anchors in quotes.json.] Theorem 1 assumes monotone functions F,G on sets and, for every A, G(F(A))⊆F(G*(A)), where G* is the least closure containing its argument and closed under G. It concludes X⊆νF from X⊆F(G*(X)), with νF the greatest fixed point. Lemma 1 instantiates this to stepR, where a claim either already meets its target or takes a semantic step. The outer stepR matters: replacing stepR(stepR*(S)) with stepR*(S) makes the premise trivially true for every S. Thus circular reasoning is guarded by real semantic progress unless the target is already met. Sequential composition relates an intermediate target Q to claims for every d∈Q; transitivity is another admissible G only after its theorem condition is established. The chapter states this general theorem and cites Coq/full proofs externally; no reader verification of those files is claimed. [Evidence: Q4, §2.2 coinductiveoverview/Definition 1/Figure 3, PDF pp.6–9; Q6, §3 introduction/§3.1 Definitions 2–4/Lemma 1/Theorem 1/allpath/until, PDF pp.9–11; Q7, §3.2 sumproof/Lemma 2/fullframes, PDF pp.11–13; exact source and character/LF/page anchors in quotes.json.] The running sum example is s=0; while(–n){s=s+n;} with unbounded integers. For positive initial n it exits with n=0 and s=n(n−1)/2; for nonpositive n it diverges. Figure 1 shows initial n=4 ending with s=6. The illustrated Hoare rules assume side-effect-free expressions, so the authors first rewrite –n into explicit assignments; that is a limitation of those displayed rules, not every possible Hoare logic. Their coinductive proof uses the original side-effecting program, splits initialization from a loop claim, symbolically executes until the guard is decided, and either reaches the target or re-enters the parameterized claim with decremented n. Arbitrary remaining code/store frames are made explicit in §3.2. This establishes the stated partial-correctness claim rather than total correctness for all integers. [Evidence: Q2, §2 overview/sum/Figure 1, PDF pp.3–3; Q3, §2.1 Hoarecomparison/Figure 2/onepathvalidity/sideeffects, PDF pp.3–6; Q4, §2.2 coinductiveoverview/Definition 1/Figure 3, PDF pp.6–9; Q7, §3.2 sumproof/Lemma 2/fullframes, PDF pp.11–13; exact source and character/LF/page anchors in quotes.json.] Figure 3/§2.3 consider small-step structural operational semantics, reduction semantics with evaluation contexts, and K-style semantics. The latter exposes subterms at the front of a computation list; reduction semantics needs context splitting/plugging. The authors report changing the successor-search tactic while preserving the core proofs. The step relation must faithfully represent the chosen language, and diverging executions must yield infinite traces. Reader qualification: taking an arbitrary relation as a parameter does not prove that relation agrees with a real compiler/runtime, finite-width arithmetic, memory model or external environment. The language-specific trust boundary is smaller than a separate program logic, but the Coq checker and correctness of specifications/semantic definitions remain relevant. [Evidence: Q2, §2 overview/sum/Figure 1, PDF pp.3–3; Q5, §2.3 threestyleoperationalrelations, PDF pp.9–9; Q6, §3 introduction/§3.1 Definitions 2–4/Lemma 1/Theorem 1/allpath/until, PDF pp.9–11; Q24, §7 conclusion/Kcertificateexport/higherorderconcurrencyfuturework, PDF pp.26–27; exact source and character/LF/page anchors in quotes.json.] The three main experimental languages are HIMP, a heap/recursive-function extension of IMP with integer addresses and allocation/deallocation; Stack, a Forth-like language with explicit control syntax and a shared data stack; and Lambda, call-by-value lambda calculus with heap operations, primitive pairs/integers/nil, De Bruijn indices and a CEK/CESK-style machine. HIMP/Stack use five-component configurations; Lambda uses four. Figure 4 gives destructive append in all three and Figure 5 their syntax. These are experimental languages; references to C, Java and JavaScript describe other operational-semantics/reachability-logic work rather than this chapter’s completed direct verification of those full languages. [Evidence: Q9, §4 introduction/§4.1 HIMPStackLambda/Figure 5, PDF pp.14–16; Q1, §1 introduction/RQ1–2/contributions/artifactpointer, PDF pp.1–3; Q17, §5 reachabilitylogic introduction, PDF pp.22–22; exact source and character/LF/page anchors in quotes.json.] For heap specifications the experiments use matching-logic patterns, although the core permits arbitrary Coq-definable state predicates. emp describes an empty map, k↦v a singleton, and PQ a disjoint heap split. Lists use two consecutive cells per node and a null pointer at the end; list segments and binary trees are also defined. Reusing representation predicates permits common domain tactics across languages. Section 3.3 sketches reverse using the same core. Reader source issue: its printed code says y := (x+1), with no dereference, while the surrounding list-reversal explanation needs the next pointer stored at x+1; the rendered PDF page 13 confirms this is not just extraction loss. Treat this as an apparent presentation omission, not a verified artifact bug or a silent repair of the quoted source. The full implementation was not inspected. [Evidence: Q8, §3.3 reverse/sketch/printedmissingdereference/Figure 4, PDF pp.13–14; Q10, §4.2 matchinglogic/heaprepresentationpredicates, PDF pp.16–16; exact source and character/LF/page anchors in quotes.json.] Table 1 specifies head, tail, add/add-prime, swap, deallocate, length, sum, reverse, append, copy and delete. The call helper retains arbitrary remaining code/environment/stack/function map and frames an untouched heap Hf; stmt expresses intermediate loop claims. A repeated abstract-list predicate can permit nodes to move to different addresses, so an explicit bound heap H is reused when exact physical preservation is intended. Add-prime uses a list segment plus H to preserve the input list as an unchanged suffix. These are meaningful specification choices that a syntactically accepted proof can otherwise miss. [Evidence: Q11, §4.3 callstmt/framing/completeTable1, PDF pp.16–18; Q10, §4.2 matchinglogic/heaprepresentationpredicates, PDF pp.16–16; exact source and character/LF/page anchors in quotes.json.] The tactic heuristic first tries the target predicate, then already specified claims by transitivity, then semantic execution/case analysis. Generic fixed-point manipulations are shared; map/numeric tactics and language-specific successor tactics supply details. Automation can stop with reachability subgoals for manual help and resume afterward. Most Table 1 cases use one invocation; the last four need domain assistance: append/copy use append associativity, reverse relates tail-recursive reversal to Coq’s rev, and delete needs case reasoning. The authors report verbatim reuse of the shown scripts across the three languages, except Lambda append/copy do not need the associativity lemma. One-line scripts invoke substantial shared tactics; they are not a measure of all development effort or fully automatic specification discovery. [Evidence: Q12, §4.4 tacticheuristic/manualdomainlemmas/reuse, PDF pp.18–19; Q11, §4.3 callstmt/framing/completeTable1, PDF pp.16–18; exact source and character/LF/page anchors in quotes.json.] Schorr-Waite first marks trees without sharing/cycles, then general graphs represented by a depth-first tree with back references. The graph predicate includes physical addresses, so call(Mark,[p],grph(G,0,p),λr.grph(G,3,p)) preserves the represented graph/locations while changing marks. A zipper-like stack predicate uses mark1/mark2 and reversed pointers for left/right contexts, with separate loop claims for descending/ascending states. Semantic steps are automated; manual work concerns the graph/context predicates. Section 4.6 compares a reported 514-line proof with earlier roughly 470/over 1400-line proofs and explicitly calls line counts crude. Table 2 separately lists 116 /tree and 203 /graph proof lines; the chapter does not explain enough to equate their sum with 514 or identify all shared overhead. This is no controlled proof-effort comparison with matched definitions and automation. [Evidence: Q13, §4.5 otherdatastructures, PDF pp.19–19; Q14, §4.6 SchorrWaite/graphaddresses/zipper/context/effort, PDF pp.19–20; Q16, §4.8 completeTable2/provecheck/Bedrockcomparison, PDF pp.21–22; exact source and character/LF/page anchors in quotes.json.] Divergence is encoded with an empty target P=∅, so success cannot come from already reaching the target. Reported examples include an omega combinator and the sum loop with guard true, across the semantic styles/languages. Reader qualification: under default existential validity, an empty-target claim establishes existence of an infinite path for each initial configuration in the claim. To assert every nondeterministic run diverges requires the all-path notion or another appropriate condition; the chapter’s deterministic examples should not become a general fairness/liveness result for distributed systems. [Evidence: Q15, §4.7 divergence/emptytarget/examples, PDF pp.20–21; Q6, §3 introduction/§3.1 Definitions 2–4/Lemma 1/Theorem 1/allpath/until, PDF pp.9–11; exact source and character/LF/page anchors in quotes.json.] Table 2 has 29 example rows: seven simple, seven tree, 13 list and two Schorr-Waite cases. It reports source/specification/proof-script lines and separate prove/check times, with example-specific auxiliary definitions/lemmas charged to specification/proof. Prove time runs tactics/search to construct a certificate; check time rechecks it. Examples: list reverse8/5/3 lines and 15.0/2.2 seconds; copy14/11/3 and 55.0/9.3; iterative tree flatten24/17/4 and 150.3/22.8; Schorr-Waite tree14/91/116 and 60.1/7.6, graph14/91/203 and 133.6/18.2. Shared framework/tactic-development effort is not represented by those per-example script lengths. The chapter does not give hardware, Coq version, repetition counts or uncertainty estimates for these timings. [Evidence: Q16, §4.8 completeTable2/provecheck/Bedrockcomparison, PDF pp.21–22; exact source and character/LF/page anchors in quotes.json.] The preliminary Bedrock comparison times SinglyLinkedList.v, covering length/reverse/append, at 93 seconds to process scripts and 31 to recheck. After modifying their own programs to use consecutive-address list fields for a closer representation match, the authors report 20 seconds and 4 seconds. These are a small author-run comparison with representation/automation choices, not a broad performance ranking or a reproduction here. The presentation distinguishes proof construction from certificate checking; neither is runtime performance of the verified object program. The full Table 2 source values remain quoted, including 9.11 seconds for iterative list sum. [Evidence: Q16, §4.8 completeTable2/provecheck/Bedrockcomparison, PDF pp.21–22; exact source and character/LF/page anchors in quotes.json.] Theorem 2 formalizes a translation of the displayed reachability-logic proofs into coinductive claims. A pattern rule maps to all pairs (c,ρ(post)) with c∈ρ(pre). The relation R must satisfy each semantic axiom by at least one real step followed by valid reachability. Lemma 3 connects the induced relation with logical validity; Set Circularity gathers the goal and circularity-rule conclusions into a set C; Lemma 4 handles circularity-free derivations, assuming C is nonempty, by induction on proof rules. Write C_claims for the union of translated configuration/target claims from rules in C. The resulting inclusion C_claims⊆stepR(derivedR(C_claims)) meets Theorem 1. The authors report mechanized Lemmas 3–4/full translation in reference 16. This is an independent soundness route for that reachability-logic system, not an execution of the existing K prover or completed automatic certificate export from it. The conclusion places that integration in future work. [Evidence: Q18, §5.1 comparison/Figure 6, PDF pp.22–23; Q19, §5.2 circularities/progress/translationclaim, PDF pp.23–23; Q20, §5.3 fulltranslation/Theorem 2/Lemmas 3–4/SetCircularity, PDF pp.23–24; Q24, §7 conclusion/Kcertificateexport/higherorderconcurrencyfuturework, PDF pp.26–27; exact source and character/LF/page anchors in quotes.json.] The related-work criticisms of Why/Boogie translations, Verifiable C’s reported 40,000-line logic, FLINT specialization and Iris are the authors’ 2018 assessments. Their belief that extra program logics are unnecessary is not an established universal result, nor a current review of those tools. The paper claims soundness/relative completeness and shows a soundness theorem plus reachability-logic subsumption; it does not claim its tactic decides every valid specification. Modular higher-order specification work is preliminary; modular concurrent verification, additional reuse evaluation and time-cost semantics are future directions. The chapter does not demonstrate distributed consensus, Verus, Rust, TLA+ or an LLM agent. [Evidence: Q21, §6 introduction/§6.1 author2018toolassessments, PDF pp.24–25; Q22, §6.2 VerifiableC/FLINT/Iris/authorassessments, PDF pp.25–26; Q23, §6.3 priorcoinductionschemata/noveltyscope, PDF pp.26–26; Q24, §7 conclusion/Kcertificateexport/higherorderconcurrencyfuturework, PDF pp.26–27; Q6, §3 introduction/§3.1 Definitions 2–4/Lemma 1/Theorem 1/allpath/until, PDF pp.9–11; Q20, §5.3 fulltranslation/Theorem 2/Lemmas 3–4/SetCircularity, PDF pp.23–24; exact source and character/LF/page anchors in quotes.json.] For LLM-generated specifications/proofs, the concrete evaluation lesson is to inspect the validity notion and semantic target before counting a checked certificate: distinguish one-path/all-path, partial correctness/termination, final-state properties/transition invariants, abstract contents/physical framing, and guarded progress/unrestricted circular assumptions. Reader proposals are to use those distinctions in generated Verus/Rust/TLA+ proof tasks and to report tactic construction time separately from trusted checking time. Transferring this framework to distributed concurrency needs a model of schedules, fairness and implementation behavior appropriate to the claim; no such end-to-end result is supplied here. No author code or scientific-result artifact was executed/imported/loaded, and no compiler, checker, solver, prover or model checker was run. [Evidence: Q6, §3 introduction/§3.1 Definitions 2–4/Lemma 1/Theorem 1/allpath/until, PDF pp.9–11; Q11, §4.3 callstmt/framing/completeTable1, PDF pp.16–18; Q12, §4.4 tacticheuristic/manualdomainlemmas/reuse, PDF pp.18–19; Q16, §4.8 completeTable2/provecheck/Bedrockcomparison, PDF pp.21–22; Q24, §7 conclusion/Kcertificateexport/higherorderconcurrencyfuturework, PDF pp.26–27; exact source and character/LF/page anchors in quotes.json.]
  • limits: authoritativetransitionsemantics/Coqchecker/specadequacy/monotonicityandup-tocondition/guardedprogress/defaultonepathpartialcorrectness/allpathvariantnottermination/finitewidthandfairnessnotautomatic;externalproofsourceunread
  • how much was read: most of it read
  • source
  • record id: program-verification-by-coinduction-2018
• QWIRE Coq verification (2018)
  • title: QWIRE Practice: Formal Verification of Quantum Circuits in Coq
  • what: Embeds the QWIRE quantum-circuit language in Coq, with linear-wire typing, higher-order abstract syntax (HOAS), translation to explicit-variable circuits, and density-matrix semantics. The paper reports three concrete correctness lemmas: a closed coin flip yields diag(1/2,1/2); any supported unitary followed by its conjugate transpose equals the identity on every well-formed input matrix; and dynamic lifting followed by bit reconstruction agrees with measurement. These are paper-reported Coq results, subject to acknowledged unproved foundational lemmas [Q1–Q4,Q15–Q20]. §3 explains how context equations are solved by commutative-monoid cancellation with at most one existential variable, followed by pairwise-disjointness proofs. HOAS delegates variable binding/substitution to Coq; fresh patterns turn it into flat circuits for semantics. §4 uses function-valued matrices, interpretation of patterns by wire permutations, gates extended by identity on untouched wires, and finite summation over measurement branches for lifting. §5 gives theorem statements and proof-size descriptions rather than benchmark experiments. Deutsch–Jozsa is a motivation for induction, not a proved case reported here [Q6–Q18].
  • number: 14 pages, printed119–132
  • number: 12-line flip_toss proof, author-reported
  • number: unitary_trans_id proof fewer than20 lines, author-reported
  • number: 3 syntactic circuit forms: output, gate, lift
  • limits: Authors leave several matrix lemmas, preservation of mixed-state well-formedness, and composition/denotation compatibility unproved. Matrix equality uses functional extensionality. The explicit scalability observation concerns (non-parametric) circuits with more than a few qubits. Finite wire interpretations permit enumerating lifting outcomes, but the gate set need not be fixed. Printed foundational formulas have defects recorded as reader deductions; no implementation-level conclusion follows [Q5,Q9–Q14,Q20–Q21].
  • how much was read: most of it read
  • source
  • record id: qwire-coq-verification-2018
• RCMC (2018)
  • title: Effective stateless model checking for C/C++ concurrency.
  • what: Explores consistent execution graphs directly under the repaired C/C++11 model RC11, using revisitable reads to avoid enumerating thread interleavings and storing all previously visited states. The algorithms maintain sequenced-before/reads-from prefixes, modification order and revisitable-read sets. New writes trigger independent read subsets to be revisited, discard affected suffixes, and preserve forced RMW revisits. Correctness covers all RC11 modes and fences; no redundant execution is guaranteed only without RMWs and SC atomics. SC consistency is normally checked before reporting an error because premature pruning can lose executions. WRC11 removes explicit modification order and weakens coherence of concurrent writes. Separate OCaml and LLVM/C++ implementations informed development.
  • number: 32-page published article
  • number: optimal only absent RMWs and SC atomics
  • number: lastzero0(15): 14.93 versus 4974.60 seconds
  • number: ms-queue(3): 4.37 versus 21.21 seconds
  • limits: Formal presentation uses loop-free deterministic threads with finite values and locations; implementation handles infinite programs through unrolling. Optimality excludes RMWs and SC atomics. Clang translation to LLVM IR is unverified and may remove source behaviors. Compared tools implement different memory models, so benchmark performance need not generalize. Real-world-code comparisons use different CDSChecker bounding mechanisms and are expressly not fair. Read the complete published 32-page version; the separately downloaded 53-page technical-appendix version was not read or counted, and artifacts were not executed.
  • how much was read: most of it read
  • source
  • record id: rcmc-2018
• Specification inference from demonstrations (2018)
  • title: Learning Task Specifications from Demonstrations
  • what: Formulates learning a temporal Boolean task specification from finite demonstrations as maximum-a-posteriori inference over a candidate concept class. A maximum-entropy likelihood depends on the teacher’s task-satisfaction rate and the probability that uniformly random actions satisfy the candidate; the posterior is proportional to an indicator that the demonstrator is at least as good as random times a Bernoulli KL information gain. For concept classes represented as chains/lattices, monotonicity enables binary-search or breadth-first algorithms that minimize expensive random-satisfaction queries. In a gridworld, the method learns a missing wet/recharge constraint and composes it safely with an existing recharge-and-avoid-lava specification.
  • limits: Demonstrations are modeled as i.i.d. fixed-length traces from a teacher in a finite probabilistic automaton; candidate specifications form a finite concept class with known subset relations (chain or bounded lattice). The posterior assumes the demonstrator is at least as good as random and uses empirical satisfaction N_phi/|X|. Computing random satisfaction is generally #P-complete, so Monte Carlo/BDD or SAT approximations are needed. The experiment uses discrete gridworlds and finite-horizon traces; future work explicitly lists infinite-horizon specifications and continuous dynamics. The paper notes Boolean specifications cannot directly encode every objective (for example ‘run as fast as possible’).
  • how much was read: most of it read
  • source
  • record id: specification-inference-from-demonstrations-2018
• Symbolic liveness analysis (2018)
  • title: Symbolic Liveness Analysis of Real-World Software
  • what: Defines a generic liveness property for real-world programs—eventually consuming input or terminating—and implements symbolic lasso detection in KLEE to find violations. The paper formalizes transition systems with productive actions, deterministic computation except for input, and finite memory; it proves that any violating trace has a finite stem followed by a non-productive cycle. The implementation tracks per-path state fingerprints (register/memory fragments plus serialized path constraints), uses symbolic execution to cover input space, and reports concrete reproducing inputs. Evaluation covers GNU Coreutils, BusyBox and toybox, including interpreter behavior in sed, runaway counters, allocation-sensitive pointers and state explosion. Five previously unknown defects (three Coreutils, two BusyBox) were confirmed and fixed; all reported violations had concrete witnesses.
  • number: 354 tools evaluated
  • number: 5 previously unknown defects: 3 Coreutils and 2 BusyBox
  • number: BusyBox hush violation 71.73±5.00 s over 30 runs
  • number: toybox sed violation 4.99±0.25 min
  • limits: Target machines are deterministic apart from input, have finite memory, and input functions provide at least one bit; terminal states are modeled as productive self-loops. The method can miss cycles involving huge counters, repeated allocations whose addresses change, and equivalent symbolic states whose serialized names differ. It inherits symbolic-execution path explosion and repeated SMT solving; sed reports intentional/interpreter-related violations and yes intentionally loops forever.
  • how much was read: most of it read
  • record id: symbolic-liveness-analysis-2018
• TOrPEDO topological proofs (2018)
  • title: Integrating Topological Proofs with Model Checking to Instrument Iterative Design
  • what: Introduces TOrPEDO, combining three-valued model checking of partial Kripke structures with topological proofs that identify model slices sufficient for definitive or possible LTL satisfaction. Refinements/revisions can be syntactically rechecked against these clauses. Defines TP clauses for labels, outgoing transitions and initial states; computes them by encoding optimistic/pessimistic Kripke approximations and extracting unsatisfiable cores in separated normal form. Theorem 2 proves returned clauses preserve > or ? satisfaction under related revisions; Theorem 3 characterizes the re-check algorithm. Vacuum-cleaner example shows counterexamples and proofs guiding two revisions.
  • number: proofs smaller than source models in all reported satisfied cases
  • number: callee models 5 states/15 transitions; caller models 6–7 states; caller-callee 6–7 states
  • limits: Three-valued semantics is implemented; thorough semantics is guaranteed only for self-minimizing LTL formulas. PKS transitions are left-total. Evaluation modifies literature phone-call models, uses LTL patterns rather than original CTL, and has limited examples. Scalability inherits model-checking and unsat-core costs.
  • how much was read: most of it read
  • record id: torpedo-topological-proofs-2018
• Tracer-RA (2018)
  • title: Optimal Stateless Model Checking under the Release-Acquire Semantics
  • what: Develops an optimal dynamic partial-order reduction algorithm for stateless model checking under C/C++11 Release-Acquire semantics. It explores program-order/read-from relations directly, avoids redundant coherence-order exploration, and implements the Tracer tool. Introduces feasibility checking for read-from relations under RA, saturation and postponed-write procedures, and proves each program-order/read-from (weak-trace) class is explored exactly once. Extensive comparisons cover litmus, SV-COMP, synthetic, parameterized, and concurrent-data-structure benchmarks.
  • number: Tracer explores 521,288 executions in 3m03s on 8064 litmus tests; CDSChecker explores 2,383,704 in 6m28s
  • number: Tracer has zero wrong answers on litmus tests; Rcmc/Wrc11 has 81
  • number: Tracer explores 40% fewer executions and is about 3x faster than Rcmc in general SV-COMP comparisons
  • number: Tracer has best performance in 9 of 10 SV-COMP examples and handles larger parameterized cases in under 1 minute
  • limits: Optimality is for terminating programs under the RA fragment and weak-trace equivalence; the saturation scheme is not complete for sequential consistency, and extension to relaxed C/C++11 or stronger RA is future work. Results depend on instrumented libraries and one-hour benchmark timeouts.
  • how much was read: most of it read
  • record id: tracer-ra-2018
• unified PL-NN branch-and-bound verification (2018)
  • title: A Unified View of Piecewise Linear Neural Network Verification
  • what: Recasts major PL-neural-network verification methods as branch-and-bound optimization and introduces a benchmark suite for comparing their bounds, branching and search behavior. Boolean output properties become a scalar minimization/counterexample problem by adding linear and max-pooling layers. Reluplex, Planet, MIPplanet, BaB, BaB-input, BaB-relusplit and BaBSB are described as choices of bounds, splitting and search in one algorithmic template. The paper argues that rebuilding convex approximations after each split tightens bounds, proposes input-domain branching and Kolter-Wong smart branching, and releases CollisionDetection, ACAS and PCAMNIST benchmarks. Higher-level relaxations and non-PL activations are identified as extensions when suitable bounds exist.
  • number: 98.40% BaBSB ACAS success at one hour
  • number: 79.26% Reluplex ACAS success at two hours
  • number: two-hour timeout and 20GB memory cap
  • number: 500 CollisionDetection and 188 ACAS properties
  • limits: Formal guarantees target bounded-input piecewise-linear networks and Boolean formulas over linear inequalities; sigmoid/tanh and approximate or undecidable approaches are outside the comparison. Verification is NP-hard and experiments use a two-hour/20GB single-core limit, so timeout is unresolved rather than proof of failure. BlackBox and MIP rely on Gurobi; random upper bounds must produce valid counterexamples.
  • how much was read: most of it read
  • record id: unified-pl-nn-branch-and-bound-verification-2018
• Verifying concurrent software using movers in Cspec (2018)
  • what: Cspec is a Coq framework for implementing and proving concurrent systems through state-machine refinement, composable layers and reusable proof patterns. Right/left movers reduce interleavings to atomic execution of larger code blocks. Fully mechanized patterns verify a Maildir-like server, Cmail, and a locked counter over an x86-TSO model. Extracted Haskell Cmail scales on a twelve-core tmpfs benchmark. Records state/argument-dependent commutation and stable enablement, finite-prefix safety scope, protocol proof obligations, error-state elimination, zero-effect retries and partition lifting. Captures six concrete mail concurrency cases, conservative PID-filtered directory listing, two naming plans, all TSO layers and the previous-owner buffer invariant. Saves all framework/layer LOC and pattern counts, measured setup, development anecdotes and precise trusted boundaries.
  • limits: §§1,5,7: Programs, operation/state definitions, implementations, abstraction relations, invariants and proofs are written manually within Cspec/Coq; it cannot directly verify arbitrary existing software. Executables use Coq extraction to Haskell (OCaml is mentioned as an alternative). The result is not a proof of arbitrary compiled C, Rust or a native binary. §§5.2,7: Correctness is trace inclusion, with every finite prefix representing possibly infinite behavior. Only safety properties are targeted. No scheduler fairness, termination, starvation freedom, eventual successful delivery or lock acquisition follows. The proof may insert a never-executed stably enabled left-mover into an equivalent execution; it does not make the actual scheduler run it. §§1–2,8.6: Node failures are outside scope. File-system crash behavior and durability are not proved despite the Maildir motivation. Top-level intended behavior and bottom-level file-system model must be correct. Coq soundness and standard assumptions including functional extensionality, extraction/runtime, driver and concrete syscall mapping are trusted. §§1,5.3,8: SMTP/POP3 parsing and protocol implementation are unverified. The Haskell network/file-system driver lies outside the proof. Compatibility with Go SMTP, postal and rabid is testing, not protocol conformance proof. TLS, spam filtering and logging are absent. §6.1 Figures 10–12: Commutation must preserve both operations’ individual return values and final state across distinct PIDs. Atomic blocks have right-movers, at most one non-mover, then left-movers. State-dependent properties need only hold after the already-executed prefix but require proofs for all reachable modeled states, not sampled interleavings. §6.1: Disabled intermediate operations require stable enablement when moving an operation earlier: enablement survives undoing another process’s step. An existing locked-file read can be a left-mover although reading arbitrary newly created/temporary files is not. Lock ownership rules must ensure other processes cannot release this process’s lock. §6.2: Protocol semantics disables forbidden operations, such as unlocked accesses. Sound use requires proving every API user follows the protocol under unrestricted semantics. Merely restricting the environment would assume away the race; Cspec requires the refinement proof. §6.3 Figure 13: The abstraction pattern keeps operation types fixed, preserves the return value and relates successor states for every low-level step. Invariant introduction uses an identity relation. An absorbing abstract error state can relate to any low-level state, but a later protocol proof must show it unreachable before obtaining the final guarantee. §6.4: Retry-loop bodies must either perform the correct successful effect and exit, or have zero effect and retry. This supports a safety/atomicity proof without guaranteeing eventual success. Partition lifting requires proven single-shard refinement plus correct naming and disjoint decomposition at top and bottom. §§3–5 Figures 1,3,6: The displayed mail/file-system specifications permit a false delivery/link return with no effect, not solely a proved name-collision cause. They are permissive safety specifications and do not guarantee success. The paper uses atomic rename terminology later; earlier implementation/spec uses link followed by unlink, with no destination overwrite, so do not substitute unrestricted POSIX rename semantics. §8.1: With concurrent deletion, PID-filtered readdir deliberately permits a superset of existing names. It is a right-mover, not a both-mover, in that case. A name absent from the superset is free; a reported name need not still exist. Plan 2 describes random names but concretely uses the current timestamp and relies on retry rather than guaranteed collision freedom. §8.2 Figure 16: The x86-TSO case verifies a modeled counter built over shared memory and per-core store buffers. Any core may flush any portion of its buffer at each low-level operation. This is not validation of a physical processor, compiler memory model or executable counter benchmark. §8.3 Figure 17: Performance uses local simulated SMTP/POP3 requests on Linux tmpfs, avoiding network and persistent-storage bottlenecks. Authors implemented the unverified GoMail comparator. Request mix is 1:1 delivery versus read/delete over 100 random users. Message sizes, measurement durations, repetitions, error bars and raw runs are not supplied. §8.4 Figure 18: Effort is two people about six months part time, following another twelve months of failed alternative designs. Incremental deletion/naming/multi-user timings are author anecdotes, not controlled studies or independent replications. The text’s approximate 100–200 spec LOC per layer omits displayed extremes 63 and 323. §8.5 Figure 19: Proof-pattern counts are module uses and need not equal numbers of layers. The Cmail diagram describes naming plan 1; the count table also includes the retry pattern used in plan 2, which has one additional intermediate layer. §§2,8.6: The state-machine approach draws on TLA and I/O automata, but the work is not a TLA+ implementation/proof or a distributed node-failure theorem. No Verus, verified Rust or LLM-generated-specification/proof evaluation. Public artifact URL is recorded but not fetched or replayed.
  • how much was read: most of it read
  • source
  • record id: verifying-concurrent-software-using-2018
• A Storm is Coming: A Modern Probabilistic Model Checker (2017)
  • what: Introduces Storm, a modular C++ probabilistic model checker for Markov chains, MDPs and Markov automata with multiple modeling languages and solver engines. Sparse, decision-diagram, hybrid, exploration and abstraction-refinement engines share linear/Bellman, MILP, SMT and game solvers. Supports conditional rewards/probabilities, exact arithmetic, parameter synthesis backends, counterexamples and permissive schedulers. Native formats include PRISM, JANI, GSPNs, dynamic fault trees, probabilistic programs and explicit transitions. Appendix compares Epmc and discusses error handling and engine tradeoffs.
  • number: 361/380 versus 346/380 tasks
  • number: 24 models; 82 properties
  • number: 1800-second timeout; 8 GB RAM
  • number: up to 3 orders of magnitude for exact arithmetic
  • limits: This is arXiv v1 (14 February 2017), not a check of current Storm. No LTL, statistical model checking, probabilistic timed automata, multiobjective checking, fully symbolic CTMC analysis or stochastic-game input is supported in this version. Comparisons focus on runtime; appendix explicitly explains why memory consumption was not compared. Best-engine plots choose the fastest engine separately per instance.
  • how much was read: most of it read
  • source
  • record id: a-storm-is-coming-2017
• Auxiliary Variables in TLA+ (2017)
  • what: # Auxiliary Variables in TLA+ (authored by agents unless marked 🧑) Leslie Lamport and Stephan Merz, arXiv:1703.05121v2, paper dated 27 May 2017. This is a practical account of extending TLA+ specifications with history, prophecy and stuttering variables so that state expressions can connect different representations of a concurrent system. Its central requirement is equivalence after hiding the added variables, not just that an augmented specification has some behaviors of the original. The worked snapshot result concerns safety of a simplified algorithm whose reads may never terminate. General language-independent soundness and completeness proofs are explicitly deferred to future work (Q1,Q2,Q16,Q21). ## Reading and evidence scope Read the complete 71-page PDF: cover, abstract, contents, printed pages 1–69, all sections 1–6.6, two numbered theorems, displayed definitions/equations, all 27 figure listings and all nine bibliography entries. The introduction says 25 figures, but numbering continues through Figure 27. There are no numbered tables, appendix or checklist. References were read as bibliography entries, not recursively followed. All 71 page images were generated; only PDF pages 19,20,27,39,40,41,44,45,46,48,49,54,57,62,66,67,68,70 were individually inspected. Complete extracted text was read for every page; this does not claim visual inspection of every page. Read the complete official project webpage, downloaded its 317-member ZIP, and read nine selected plaintext assets whole: Prophecy.tla, Stuttering.tla, AfekSimplified.tla, AfekSimplifiedH.tla, NewLinearSnapshotPS.tla, and both MC.cfg/MC.tla pairs under AfekSimplifiedH Model_1/Model_2. Other ZIP modules, prettyprints, model copies and result/log files were inventoried but not read. The retained files are exact archive bytes; each has a SHA256 and explicit scope. No author code, TLA+ module, TLC model, TLAPS proof or checker was executed/imported; no model/checkpoint or serialized experiment data was loaded. Static symbolic traces below are reader reasoning, not rerun results. The official webpage calls these “small TLC models”; their existence does not establish universal verification (W1,C1–C9). ## What an auxiliary variable must preserve A TLA+ specification describes behaviors, sequences of states allowing steps that leave the observed variables unchanged. Hiding a variable uses a temporal existential quantifier: it chooses an entire value sequence and includes the logic’s treatment of stuttering. It is not ordinary quantification over one state value. The paper first gives an approximate behavior intuition, then explains why stuttering makes that intuition incomplete. Definitions must be expanded with bound-name renaming; its NotUnique substitution example demonstrates how naive textual replacement can turn a valid expression into a contradiction. Recursive definitions are treated as fixed-point abbreviations, not arbitrary source-text rewriting (Q3,Q4). A refinement mapping substitutes state expressions for abstract variables; the implementation must imply that substituted specification. Forgetting auxiliary variable a must recover the original specification: ∃a:Spec_a is equivalent to Spec. Merely proving the projection implies Spec would permit the extension to remove original behaviors, even all of them. The examples teach how to avoid this loss, rather than offering an unbounded mechanized proof for every stated transformation (Q2,Q3,Q5). ## History: remembering information the implementation discarded MinMax1 stores all integer inputs in a set; MinMax2 stores only extrema. Both classify each input as Hi, Lo, Both or None. The set maps readily to its minimum and maximum, but an extrema-only state cannot reconstruct all forgotten intermediate inputs. MinMax2H adds h, initially empty, recording the inputs on response steps, which supplies the missing refinement state. Infinity and MinusInfinity are distinguished noninteger values; assumptions on these sentinels matter to empty-history handling (Q5,Q6). Theorem 1 gives a syntactic history-variable rule: augment Init with h=exp_Init; choose a disjunctive representation of Next; replace each subaction A by A conjoined with h’=exp_A; include h in the variable tuple. Expressions must obey the stated variable/context restrictions after definition expansion. Earlier discussion permits using the old history value in updates. The point of a disjunctive representation is to expose each enabled choice and its bound identifiers without changing conjunction/disjunction scope (Q6,Q7). Theorem 2 permits replacing a subaction A by B when they are equivalent under an invariant and for every identifier in the subaction’s context. Equation 3.2 is an action formula, which the paper says TLAPS can prove but TLC cannot directly check; TLC can instead compare the full temporal specifications on chosen finite models. A reported successful small comparison is not a proof for arbitrary state domains. Adding history to a specification with liveness retains the original liveness conjunct. Fairness can be expressed through the augmented actions when the required correspondence and enablement hold (Q7,Q8). ## Prophecy: exposing a later choice earlier in a proof SendInt examples choose a sent integer at different stages. A history variable cannot manufacture a choice still in the future. A prophecy variable p predicts it, constrains the action consuming that prediction, and can then choose a fresh prediction. Validity requires that each reachable original action has an admissible good prediction, rather than demanding a prediction for every syntactically describable state pair. Predictions that are not consumed must keep their intended relationship across steps (Q9). SendSetUndo lets an implementation remove pending elements; its prophecy array predicts send versus undo, and the mapping retains only predicted sends. SendSeqUndo adds ordering and shifting indices. A partial injection maps surviving old prediction identities to new identities. Injectivity prevents identifying distinct predictions and accidentally excluding behaviors. The prose in §4.5 calls DomInj a “partial function”, but both the formal condition and retained Prophecy module require membership in PartialInjections. The formal requirement is the one used here (Q10,Q11,C1). The three conditions combined in ProphCondition are: an available good prediction, a partial injection with the correct old/new domains, and PredDom containing every index whose prediction can affect the action predicate. PredDom may overapproximate those dependencies; consuming extra predictions safely allows extra refreshes. NewPSet preserves predictions only along unconsumed mapped identities and leaves consumed/new ones free. These obligations are properties of reachable actions of the original specification. The paper explains why a TLC checking module may need to end before declaring p: the original Spec does not constrain that variable. It recommends checking these conditions before the final refinement, which gives useful intermediate debugging obligations (Q11,C1). Liveness is retained from the original specification, not blindly replaced with fairness of the newly constrained NextP. In §4.6, allowing the prophecy value infinity would permit an endless stall in the safety formula; original weak fairness excludes that prophecy choice. Thus the combined formula can fail to be machine closed: its liveness condition rules out an otherwise allowed finite prefix, rather than only requiring later progress. The authors permit this as an intermediate proof instrument and caution against using it to describe an implementation. This is a scope condition on the method, not evidence that prophecy is unsound (Q12). ## Stuttering: matching different internal step counts The clock example connects a 24-hour counter to an hour/minute clock by inserting 59 steps that leave the original hour unchanged. A stuttering variable stores which action/context is being expanded and a value that advances toward a bottom value. Despite the name decr, the example’s order can use j+1, initial 1 and bottom 59. A refinement expression recovers the minute from the auxiliary state. PreStutter requires a predicate equivalent to the chosen action’s actual enablement; otherwise it could start an unfinished expansion of an action that cannot run (Q13). PostStutter and PreStutter insert at least one step; MayPostStutter and MayPreStutter permit zero. Correctness needs a countdown closed in its domain and reaching bottom from every domain value, a valid initial countdown on reachable original actions, and correct enablement for the pre form. StutterConstantCondition expresses finite reachability of bottom through a recursive closure over Nat. The alternative version is justified for finite Sigma. Replacing Nat and Sigma with finite TLC domains checks those instances only (Q14,C2). There is an actual paper/archive difference. Figure 16 sets MayPreStutter’s first countdown to decr(initVal), whereas the retained root Stuttering.tla sets it to initVal. A static trace with bot=0, initVal=1, decr(j)=j−1 therefore adds one pre-action step in the printed version and two in the archived version. This concerns the exact extra-step count when initVal differs from bot; it does not by itself refute auxiliary preservation or the snapshot example, which uses MayPostStutter. The archive comment also says “one fewer” while giving 42 as both the original and May operator example count. Do not assume all embedded Stuttering copies are identical to this root file (Q13,C2,D1). Section 5.4 treats a different problem: an implementation whose original variables halt may need to represent an abstract behavior with infinitely many internal steps. A history counter on an added unchanged-vars action, plus weak fairness for that auxiliary action, supplies infinitely many hidden steps. This is distinct from accidentally making an ordinary countdown infinite. Section 5.5 retains the original liveness conjunct and states preservation of machine closure for the described stuttering construction (Q15). ## Snapshot case: assumptions and proof structure The generic linearizable-object specification uses BeginOp, DoOp and EndOp with visible operation interfaces and hidden object/internal state. Type and closure assumptions establish the legal operations and results; weak fairness describes eventual internal execution and return. The snapshot specialization has disjoint logical Readers and Writers, a nonempty value set with an initial value, and a register per writer. One physical process may act in both logical roles. These are atomic shared-memory specifications, with no network failure, crash recovery, weak-memory or Rust implementation model (Q16). The example simplifies the unbounded-storage Afek snapshot algorithm. Each atomic register contains a value paired with an unbounded write number, so repeated writes never look identical. A reader collects registers twice, in arbitrary order, and returns only when the tagged collections agree. The omitted helping mechanism in the full algorithm is what would ensure termination despite interference; this simplified reader can retry forever. The paper explicitly states that only safety is satisfied (Q17,C3). A direct state mapping to the usual linearizable snapshot fails. A reader can collect an old register value, a writer can install a new value, and the reader can still finish with the old snapshot. Its abstract read must occur before the write, but the original state then lacks the future information needed to choose that point. The authors move the hard prophecy construction to a more permissive abstract specification, NewLinearSnapshot. It records for each active reader the sequence of memory values during that read and chooses the returned member at completion. This reformulation gives the implementation a simpler history-only connection to the intermediate specification (Q18). NewLinearSnapshotPS predicts which positive sequence index each reader will return. It adds an auxiliary step after BeginRd if index 1 is predicted, and after a write for each reader whose newly appended memory value is the predicted one. A countdown set removes one chosen reader at a time; its refinement expression assigns the corresponding atomic abstract read to those added steps. The displayed module asserts separate safety and full-spec refinement theorems. Its assumptions include StutterConstantCondition over SUBSET Readers with one-element removal; that condition must hold, so it cannot silently be extended to an infinite reader set containing an infinite countdown subset (Q19,Q20,C5). AfekSimplifiedH instead records the memory sequence h for each active reader. BeginRd starts it, writes append to active histories, successful read completion clears it, and failed retries retain it. The mapping uses the first component of each tagged register for abstract memory, h for rstate, and wrNum/interface/tag relationships for abstract writer state. Figure 27’s final statement is exactly “theorem SpecH ⇒ NLS ! SafeSpec”. This is a safety target, even though some surrounding prose and a retained source comment loosely refer to the full Spec. No general liveness result for the simplified algorithm follows from that prose (Q21,C4). ## Evaluation and released model boundaries The paper reports the final theorem checked by TLC in about ten hours on a circa-2012 laptop, using two readers, two writers, two register values, reader/writer symmetry, a state constraint of at most three writes per writer and two workers. This is a finite, constrained example check. No state count, memory use, scaling sweep, repeated-runtime distribution or unbounded mechanized final proof is supplied. Some local algebraic obligations have displayed TLAPS proofs, such as Next/Nxt equivalence; the final refinement theorems in the selected source files have no accompanying TLAPS proof (Q22,C4,C5). The two retained shipped AfekSimplifiedH models use the same 2/2/2 reader/writer/value cardinalities, SpecH, TypeOKH and NLS!SafeSpec. Model_1 replaces Nat with 0..2 and constrains wrNum[i]<2; Model_2 uses 0..3 and wrNum[i]<3. Each defines symmetry as permutations of writers only. These retained settings differ from the prose’s reader-and-writer symmetry and at-most-three-writes description. Strict wrNum<3 permits completed initial-state transitions only while the counter is below 3; it is not an exact encoding of allowing the third increment while remaining inside the state constraint. Without the unread historical logs/configuration, neither file can be identified as the reported ten-hour run. The observations qualify source correspondence; no rerun discrepancy is claimed (C6–C9,D2). ## Contribution to the requested topics This is directly relevant to proving concurrent/distributed systems correct in TLA+: its concrete value is choosing additional proof state without restricting the system’s original behaviors, checking intermediate prophecy/countdown conditions, and separating safety from progress. It supplies substantial worked specifications and a concurrent snapshot refinement, rather than an empirical comparison of tools. It contains no Verus, verified Rust or LLM experiment. Possible applications to specification/proof agents are reader proposals: require the hiding-equivalence obligation, preserve fairness and parameter assumptions, distinguish finite model checks from general proofs, and record paper/source differences. An agent that merely obtains a passing refinement implication could have strengthened away required behaviors or proved only safety. This paper explains the mathematical obligations such an evaluation should expose; it does not measure agent performance.
  • limits: Temporal hiding equivalence;prophecy reachability/injection/dependency obligations;terminating countdown/correctenablement;originalfairness;atomicsharedmemory/unboundedtags;simplifiedreadmaynotterminate;finiteconstrainedTLCnotunboundedproof;paper/archiveandmodelcorrespondencedifferences.
  • how much was read: most of it read
  • source; notes: connecting different descriptions of the same behavior
  • record id: auxiliary-variables-in-tla-2017
• Cache-WCET-Refinement (2017)
  • title: Model Checking of Cache for WCET Analysis Refinement
  • what: Refines classical may/must cache analysis by invoking a model checker only on accesses classified as unknown, using a compact abstract LRU cache model to avoid state explosion and classify accesses as definite hits or misses. Defines an abstraction tracking younger blocks relative to a target block, slices/simplifies the CFG and cache model, and implements an LLVM-bytecode prototype. The model checker computes exact reachable abstract cache states for unresolved accesses, recovering precision lost by may/must analysis.
  • number: 12 TacleBench programs tested; sizes 26 to 582 memory blocks
  • number: Model checker newly classifies up to 57.8% of accesses left unknown by abstract interpretation
  • number: Authors summarize refinement as up to 60% of unknown accesses
  • number: Example table reports Nc values such as 57.8% for prime with 16-way cache
  • limits: Prototype operates on LLVM bytecode with an unrealistic fixed instruction-to-memory mapping and one cache set (4, 8, or 16 ways), rather than binary code or realistic mappings. It is a proof-of-concept; comparison with other refinement analyses and binary-level support are future work.
  • how much was read: most of it read
  • record id: cache-wcet-refinement-2017
• CAR (2017)
  • title: Safety Model Checking with Complementary Approximations
  • what: Introduces Complementary Approximate Reachability (CAR), which maintains both over-approximate reachable-state sequences for proving safety and under-approximate sequences for finding counterexamples. Minimal unsatisfiable cores refine over-approximations while minimal satisfying cubes extend under-approximations. Defines forward, backward and combined CAR modes, implements CARchecker, and analyzes complementarity with IC3/PDR and BMC/IMC portfolios. The paper explains concrete cases where non-relatively-inductive clauses let Forward CAR solve instances that IC3/PDR times out on.
  • number: Combined CAR solves 288 instances versus 271 for IC3/PDR, including 42 solved only by Combined CAR
  • number: Forward CAR + IC3/PDR solves 21 instances unavailable to IC3/PDR alone
  • number: Backward CAR solves 80 unsafe cases versus 72 for IC3/PDR and 51 for Forward CAR
  • number: CAR adds 19 solved instances to the BMC+IMC+IC3/PDR portfolio; Combined CAR adds two more
  • limits: CARchecker lacks incremental SAT and is less mature than ABC, so standalone Forward/Backward CAR does not dominate IC3/PDR. Evaluation is on 548 HWMCC 2015 hardware instances with 8GB and one-hour limits; performance is portfolio-dependent.
  • how much was read: most of it read
  • record id: car-2017
• CEGIS digital controller synthesis (2017)
  • title: Automated Formal Synthesis of Digital Controllers for State-Space Physical Plants
  • what: Synthesizes safe finite-precision state-feedback controllers for discretized linear time-invariant plants. A CEGIS loop combines stability-constrained controller search with either multi-stage bounded verification up to a completeness threshold or abstraction/refinement with abstract acceleration and explicit quantization/noise bounds. The paper models ADC/DAC, fixed-point arithmetic, plant representation and rounding errors as bounded nondeterministic noise and interval operations. The baseline synthesizes on one initial state, then checks all hypercube vertices, precision soundness and a stability-derived completeness threshold; convexity proves vertex sufficiency. The abstraction backend accelerates all closed-loop powers into an infinite reach-tube, returns iteration/initial-state counterexamples, and refines eigenvalue constraints. Worked examples show successive counterexamples and precision increases; ten control benchmarks compare both backends.
  • number: controller fixed point Ic=8,Fc=8
  • number: 10 benchmarks, one-hour per-benchmark timeout
  • number: abstraction median 1.4 s vs multi-stage 9.4 s
  • number: abstraction solves 9 vs multi-stage 8
  • limits: Plants are controllable LTI ODEs with full state observation, discretized at a fixed sampling rate; synthesis targets zero reference, bounded hypercube initial states/inputs, SISO benchmarks and box safety. Stability/eigenvalue and completeness arguments assume suitable nonrepeated eigenvalues and asymptotic convergence. Fixed-point precision choices, discretization heuristics and abstraction refinement can cause timeouts or UNSAT despite a possible controller; safety beyond boxes or complex temporal objectives is not addressed. Results may not generalize beyond the selected benchmarks and output-based/continuous-time control is future work.
  • how much was read: most of it read
  • record id: cegis-digital-controller-synthesis-2017
• Coghetto PASCAL real projective plane 2017 (2017)
  • title: Pascal’s Theorem in Real Projective Plane
  • what: Coghetto reports a Mizar verification of Pascal collinearity in the real projective plane, with an explicit nondegenerate Pascal configuration. The construction transports a nonzero quadratic conic through an invertible projective map, normalizes a four-point frame, turns incidences into determinant identities, cancels only nonzero brackets, and splits on whether the first three points are collinear. The paper reports Prover9/OTT2MIZ assistance for one lemma but no timings or success statistics. Literal printed equations in19/28 have a demonstrable missing factor; the underlying Mizar source was not audited. Records conic representative invariance, inverse-transpose quadratic transport, off-diagonal factors of two, exact intersection pairings,17 configuration noncollinearities,18 nonzero-bracket cancellation premises,case split and printed formula counterexamples.
  • limits: MML PASCAL version8.1.06 5.43.1297 identifies the article. The main geometry is over the real projective plane represented by directions of nonzero vectors in E^3. Some preliminary matrix-entry laws are stated over arbitrary fields, but the final theorem is not asserted over every projective plane/field (pp.107–109). Definition1 is q(u)=a u1²+b u2²+c u3²+d u1u2+e u1u3+f u2u3. Definition2 requires q(u)=0 for every nonzero representative of the projective point. Theorem10 proves equal directions preserve zero evaluation;11 promotes one representative to conic membership. Nonzero vector representatives and homogeneous degree2 matter (p.109). The zero coefficient tuple defines the entire projective carrier, but main Theorems33–36 explicitly exclude it. Nonzero quadratic form does not mean a nonsingular conic: reducible pairs of lines are allowed subject to the explicit configuration assumptions. The Summary identifies Pappus as a two-line degenerate case; no standalone Pappus theorem is established in this article. Preliminaries1–9 cover cyclic triple products, unique matrix entries, transpose/symmetry, symmetry of M^T N M and real/field matrix-vector representations. Definition3 packages a symmetric matrix with six entries. Theorem13 shows its off-diagonal entries occur twice in q, requiring d/2,e/2,f/2 in the matrix representing the original mixed coefficients (pp.108–110). Theorem16 transports the conic by N via M2=N^-T M1 N^-1; invertibility preserves nonzero representative and nonzero quadratic form. It proves the transformed point lies in the transformed conic;17 chooses one common nonzero coefficient tuple for all six transformed points. The printed14 uses swapped e/f half entries, which does not affect its symmetry-only conclusion;16 uses the correct original coefficient order (pp.110–112). Theorem18 evaluates at e1,e2,e3 and(1,1,1). A conic through those four frame points has a=b=c=0 and d+e+f=0, hence normalized equation r1 xy+r2 xz−(r1+r2)yz=0 with(r1,r2)≠(0,0). Nonzero coefficients and invertible frame normalization are needed for the determinant route (pp.112,116–117). Printed equations19 and28(v)/(vi) instead put r1+r2 e2 e3 (and analogous f terms) on the right, omitting multiplication of r1 by e2e3. This is visible in the PDF, not just extraction. Expanding Definition1 gives (r1+r2)e2e3. Literal28 is false: r1=1,r2=0,p5=p6=(1,0,0) satisfies both conic premises, but28(v) says0=1. This is a publication-formula defect, not evidence a Mizar checker accepted that literal sentence (pp.112–113). Literal19 is also false under its displayed premises: take r1=1,r2=0,e=(1,1,2),f=(2,1/2,3). Both printed equations reduce to1=1; with its eight specified matrices, the left determinant product is0 and the right is−9/2. Reading inference: replacing the right sides by (r1+r2)e2e3 and (r1+r2)f2f3 is consistent with the conic-based intended identity. No source-level repair or execution was performed. Theorems20–26 translate eight determinants to brackets and use six incidence-zero brackets to derive pairwise product relations. Theorem27 takes18 explicitly nonzero real factors and seven product equalities, yielding r287 r597=r297 r587. Its cancellation is not valid without those nonzero contracts. Theorem29 assembles this normalized result;30 turns it into [p7,p2,p5][p7,p8,p9]=0 (pp.112–114). Definition4 has17 noncollinearity conjuncts and six incidence conjuncts. Intersections are P9 on P1P5 and P2P4, P8 on P1P6 and P3P4, P7 on P2P6 and P3P5. P1P2P3 noncollinearity is deliberately absent; it is the later case split. Do not replace this contract with an unrestricted informal six-points-on-a-conic statement (p.115). Theorem31 is an incidence-only propagation lemma in a general collinearity-based projective space, with ten noncollinearity/six collinearity premises and11 noncollinearity conclusions. Theorem32 instantiates it for Definition4. Those derived conditions supply final nonzero brackets and justify cancellation. The summary says one lemma used Prover9 and OTT2MIZ, but does not explicitly identify its number or give a prover transcript;31 is not assigned to ATP as a proven fact (pp.107,114–115). Theorem33 lists all needed noncollinearities explicitly, including P1P2P3. Its proof chooses a homography taking P1,P2,P3,P4 to e1,e2,e3,(1,1,1), transports all six conic points by17, uses18/29/30, then cancels nonzero[p7,p2,p5] to obtain[p7,p8,p9]=0. Invertibility transfers the collinearity back. Theorem34 packages33 through Definition4 and32 (pp.116–117). Theorem35 handles P1P2P3 collinear by a different frame P1,P2,P4,P5. The displayed sketch obtains normalized q with a=b=c=0,d+e+f=0, third coordinate ofP3 zero and first two coordinates nonzero. It stops there; the remaining argument to final collinearity is not shown in the English sketch. Theorem36 joins34/35. The record reports this dependency without claiming the printed sketch is a complete proof (pp.117–118). The author says they follow Richter-Gebert projective proof techniques and some Harrison HOL Light ideas, use Prover9/OTT2MIZ for a lemma and do not use Skolem/Herbrand functions. Four footnotes link relevant pages/artifacts. Those are reported methodology claims; this reading did not inspect or run the linked implementations. No proof/check-time,size,automation success rate,benchmark suite or numerical geometry experiment is supplied (all pages). All 13 pages,four definitions,36 theorem statements/all clauses/sketches,four footnotes,14 references/date/funding read; no figures/tables/appendices. Quotations preserve raw brackets rendered h|…|i, paired vectors hh…ii, inverse/backtick notation, split fractions and U+0003 proof-end glyphs. Renderings govern formulas. No distributed protocol, Verus/Rust/TLA+ or LLM-agent result, and no MML/checker/source audit.
  • how much was read: most of it read
  • source
  • record id: coghetto-pascal-real-projective-plane-2017-2017
• Decorated-component synthesis (2017)
  • title: Look for the Proof to Find the Program: Decorated-Component-Based Program Synthesis
  • what: Introduces decorated-component-based synthesis (DCoS), which searches for a straight-line program and a bounded proof in a user-defined alternate semantics. Decorations add existential proof variables and can replace an expensive universal correctness check by an existential constraint when they abstract the concrete semantics.
  • number: 27 polynomial coefficients per program variable in the quadratic multiplication decoration
  • number: Table 1: search spaces approximately 10^9 to 2×10^25 and synthesis times about 1–50 s
  • number: ∃∀ block-cipher synthesis ~100 s versus ∃∃ ~1 s; hundreds of variants under 5 min
  • number: 30 secure-multiplication sketch variants
  • limits: Programs are bounded straight-line sketches; loops and richer proof systems are left as future work. The ∃∃ reduction is sound only when the decoration is a genuine abstraction and its alternate postcondition implies the concrete one; arbitrary decorations can encode useful nonfunctional filters but do not prove functional correctness. Security checks are deliberately sufficient and incomplete: the OT examples require posterior security verification. Human intuition is still needed to choose a proof domain and decorations, and unsatisfiable large families may scale poorly.
  • how much was read: most of it read
  • record id: decorated-component-synthesis-2017
• Developing Bug-Free Machine Learning Systems With Formal Mathematics (2017)
  • what: Presents Certigrad, an implementation of stochastic computation graphs in Lean, with a reported machine-checkable proof that stochastic backpropagation produces unbiased estimates of the mathematical gradient of expected cost. It demonstrates a workflow in which formal specifications and attempted proofs guide implementation and expose both code errors and missing assumptions. It also reports verified Gaussian integration/reparameterization optimizations and an MNIST variational-autoencoder experiment with performance comparable to TensorFlow. Separates an executable stochastic program from its mathematical expectation semantics using Dist n, built by primitive sampling, deterministic returns and composition. The paper gives expectation and RNG-threading equations for each constructor. The initial all-graphs unbiasedness specification is strengthened with WellFormed, GradsExist, IntegralsExist and CanDiffUnderInts preconditions. A simple single-parameter, nonmemoizing implementation is proved first; a multi-parameter memoizing implementation is then proved equivalent. A heuristic tactic proves model-specific preconditions for the transformed AEVB graph. The verified optimization sequence integrates Gaussian KL terms and replaces parameter-dependent Gaussian sampling with standard-normal sampling followed by scale/shift, preserving the objective while changing the gradient estimator.
  • limits: Correctness is relative to the stated mathematical specification and adopted axioms. The authors assume real numbers, integration and primitive mathematical laws rather than constructing their foundations. They report repairing initially unsound axioms by restoring integrability conditions, but this reading does not independently audit that axiom set. The final displayed scalar theorem requires unique node identifiers and scalar leaves (WellFormed), appropriate differentiability for all relevant stochastic choices (GradsExist), existence of integrals (IntegralsExist), and conditions allowing gradients through integrals (CanDiffUnderInts). The implementation is reported to handle arbitrary tensor shapes and multiple parameters; the displayed specification deliberately simplifies these. Proving the generic algorithm is insufficient for an arbitrary client graph: each graph must meet the preconditions. Some are undecidable in general, so the theorem-proving tactic is heuristic rather than a complete decision procedure. The proof concerns ideal infinite-precision real arithmetic. The authors explicitly say replacing reals with floating-point numbers technically invalidates the specification and may cause numerical instability; no floating-point error bound is established here. The running system trusts optimized Eigen tensor operations and a small C++ wrapper to match the formally reasoned operations, and relies on Lean VM/runtime and primitive pseudo-random sampling. The paper describes corresponding mathematical/procedural distribution interpretations but does not establish a checked correctness theorem for the concrete RNG, Eigen, C++ wrapper or execution platform. Unbiased stochastic gradients do not establish convergence of ADAM, bounded gradient variance, statistical validity, good generalization or model fit. The empirical AEVB training comparison addresses one example, not those general guarantees. The source repeatedly says proving exposes all implementation errors. The supported guarantee is absence of violations of the modeled specification under its assumptions; specification errors, inconsistent axioms and implementation layers outside the model remain material, as the paper itself discusses. Claims of reduced cognitive burden and finding all bugs early are the authors’ development experience, not a controlled developer study or complete empirical bug census. The paper reports increased overall workload but supplies no person-hour or proof-size measurements.
  • how much was read: most of it read
  • record id: developing-bug-free-machine-2017
• DFT-HOL-STORM (2017)
  • title: Dynamic Fault Trees Analysis using an Integration of Theorem Proving and Model Checking
  • what: Integrates HOL4 theorem proving with STORM model checking for dynamic fault trees (DFTs): formally proves gate simplification and original/reduced DFT equivalence, then model-checks reduced DFTs for quantitative failure probabilities. Formalizes DFT gates over failure times and verifies more than 80 simplification theorems, derives reduced cut sets/sequences, and uses equivalence proofs to justify replacing original DFTs before probabilistic analysis. Five benchmark systems cover cascaded PAND, heat rejection, multiprocessor, computer, and cardiac-assist systems.
  • number: Five DFT benchmarks; over 80 simplification theorems formally verified
  • number: CPAND: 148226 to 66050 states and 7.488 to 3.032 seconds at bound 1000
  • number: HECS: 1051 to 505 states; at bound 10, 16359.83 to 0.123 seconds
  • number: Original analyses for several bound-100 cases did not finish within 4 hours, while reduced analyses completed
  • limits: Quantitative analysis remains in STORM rather than HOL4; reduction and probabilities depend on modeled failure distributions and resolving nondeterministic dependencies. The paper reports five benchmarks and plans a complete theorem-prover quantitative framework as future work.
  • how much was read: most of it read
  • record id: dft-hol-storm-2017
• Dijkstra Monads for Free (2017)
  • what: The paper derives a weakest-precondition generator automatically from a simple definition of an effect such as state or exceptions. A weakest precondition is the least that must hold before code runs for its result to be correct. With this, F* can generate proof obligations for Z3.
  • number: no experiments, runtimes or proof sizes reported
  • number: No success rate, runtime, proof size or person-hours reported
  • number: Examples: state increment, division with exceptions, rollback state, dynamic allocation, information flow, continuations
  • limits: It is sound for total correctness (the code terminates and is right) in the paper’s calculus. Humans write the specification. In the functional-interpretation route it works only for terminating code. An information-flow policy needs a separate argument.
  • how much was read: most of it read
  • source; notes: Dijkstra Monads for Free; notes: Dijkstra Monads for Free; notes: Concrete problem records
  • record id: dijkstra-monads-for-free-2017
• DiVM: Model Checking with LLVM and Graph Memory (2017)
  • what: Presents DiVM, an LLVM-IR virtual machine with graph-organized memory and verification hypercalls, plus DiOS, a verification-oriented OS that supports POSIX-like C/C++ programs in explicit-state and abstraction-driven model checking. The VM represents heap objects as graph nodes linked by pointer edges, tracks pointer/definedness types in shadow memory, uses object-level allocation/free and stable object identifiers, and stores stacks as graph-linked activation frames. A small hypercall interface exposes nondeterministic choice, interrupt points, tracing, shared-object marking and machine control to a virtualized OS. This separation lets the verifier keep a simple initial/successor interface while the OS implements scheduling, threads, syscalls, monitors and faults. The paper explains τ and symmetry reductions, abstraction compatibility, and evaluates DIVINE 4 against DIVINE 3 and ESBMC.
  • number: DIVINE 4 runs 926 error-free models (from 1,045 total: 926 correct and 119 erroneous) in 8:15:44 and explores 33.0 million states.
  • number: Compared with DIVINE 3 on 457 models, DIVINE 4 takes 1:05:17 versus 7:00:33 and explores 4.729 million versus 11.6 million states.
  • number: Against modified DIVINE 3 on 448 models, DIVINE 4 takes 29:27 versus 5:01:40 and explores 1.820 million versus 5.803 million states.
  • number: ESBMC comparison covers 60 models: DIVINE 4 takes 10:22 versus ESBMC 2:43:39.
  • limits: The target is mainly C/C++ units with no uncontrolled external input; scheduling and failures are nondeterministic, while malloc/new are assumed non-failing for most benchmarks. Runtime typing is required because LLVM memory is untyped and casts defeat static recovery. Pointer-to-number conversions can invalidate heap canonicalization, so noncanonical state forms must be retained for successor generation. IPC/shared-memory pointers need OS translation to preserve isolation. Evaluation is explicit-state and depends on DiOS/library coverage; comparisons expose DIVINE 3 omissions and ESBMC’s limited C++ support.
  • how much was read: most of it read
  • record id: divm-model-checking-with-2017
• DryVR: Data-Driven Verification and Compositional Reasoning for Automotive Systems. (2017)
  • what: Combines black-box continuous simulators with white-box acyclic timed switching graphs. Learns exponential sensitivity bounds from sampled trajectory pairs, bloats simulations into reachable-state enclosures and refines initial/switching intervals. Provides trace-containment and sequential-composition arguments for extending selected bounded analyses. Reports five safe/three unsafe automotive benchmark configurations and two composition/containment illustrations. Correctness is conditional on learned functions actually being universal discrepancy bounds; sampled validation does not establish that premise. Defines graph/trajectory/hybrid semantics, sample-to-linear-program sensitivity learning, topological enclosure propagation and conditional safety. Separates polynomial sufficient graph simulation from general timed trace inclusion and gives an inductive repeated-composition closure theorem. Complete learning protocol/table/resource details expose the gap between empirical point coverage and universal verification. Reader counterexample refutes the printed generic separator sample bound and identifies formula/pseudocode defects without inferring implementation bugs.
  • limits: Finite modes and a directed acyclic transition graph with nonnegative closed bounded dwell-time intervals. Repeated modes are permitted at different vertices; cycles require bounded unfolding. Thus a graph describes finitely many switches within bounded time, not arbitrary unconstrained switching. Intervals are durations in current mode, not absolute global timestamps. Continuous trajectory sets are deterministic and prefix-closed, with connected compact initial domains and existence over every finite horizon. At a mode switch the next trajectory starts at the preceding final state: no reset map is modeled. Mode-local time constraints support settling requirements measured since last transition. Physical fidelity of the Simulink model and mode/initial/unsafe specification remains assumed. Execution ends with a terminal mode label and no terminal-mode trajectory. It does not analyze arbitrary evolution after arrival at that label. Reachability formula allows i=k although tau_k is absent, so terminal reach needs an endpoint convention; composition prose uses final arrival states. The terminal case and final-state projection are presentation assumptions rather than an inspected implementation semantics. Definition4 assumes perfect simulation values equal true trajectory samples; validated simulations are proposed as an alternative. MATLAB numerical solver use in experiments is not by itself proof of that assumption or a validated enclosure for every inter-sample point. Imported reach-bloating machinery and numerical error treatment were not independently audited. A discrepancy beta must bound all same-mode trajectory-pair distances and vanish as initial states coalesce. GED is norm(x1−x2)Kexp(gammat). Logdistance/time samples give linear inequalities in gamma,lnK; LP minimizes gammaT+lnK. Identical initial points or zero later distance require limiting/exclusion conventions for logarithms. Neither finite pairs nor sampled times establish the universal continuous-time premise without additional assumptions. Proposition4 prints k>=epsilon^(-1)ln(delta^(-1)) for any feasible sampled separator. Its proof treats the bad set B of the data-selected separator as fixed. Reader counterexample: Gamma={(y²,y):0<=y<=1}, uniform y, true separator x<=1. With k=2 choose sampled chord a=y1+y2,b=−y1y2, feasible on both samples. Its error is1−abs(y1−y2). For epsilon=.5,delta=.4,k2 satisfies the printed bound, yet probability(error>.5)=.75>.4. This refutes the stated generic feasible-learner guarantee/proof, not PAC learning generally and not necessarily a separately analyzed specific LP selection. Even a valid distributional PAC bound would constrain probability mass of missed pairs/time points rather than prove every trajectory satisfies beta. Correlated pairs/times, multiple learned modes, refined initial distributions, repeated calls and continuous-time interpolation need separate sampling/union/error arguments; these budgets are absent. Theorem1 explicitly assumes every returned beta is a valid discrepancy, and therefore cannot turn the reported test fraction into universal soundness. PED partitions time adaptively to keep gamma_i<2. Printed local condition uses exp(gamma_i*t) rather than elapsed local time, and displayed chained bound has only one K. Multiplying separate local bounds with K would normally introduce K^i as well as appropriate shifted times; global normalization/K=1 or another derivation is needed. The printed norm expression also has equality instead of subtraction in places. These are presentation/derivation issues; actual code not inspected. GraphReach topologically processes initial enclosures, learns beta per vertex/enclosure, bloats finite simulations and restricts the reach tube to each outgoing dwell interval as a successor initial enclosure. Multiple incoming sets can coexist. All states/times must be enclosed for safe-disjointness. Algorithm1 computes max over outgoing labels even for a terminal vertex, where that set is empty; terminal skipping/zero-time handling is unstated. VerifySafety partitions initial sets and refines initial/switching intervals on ambiguous overlap. Printed line3 calls GraphReach(H) after popping S without setting H.initial=S, although prose clearly intends analysis from S. Line6 types a tuple as a subset of U; a valid unsafe certificate requires an actual witness, or a slice guaranteed to contain a reachable state whose entire enclosure lies inside U; mere nonempty overapproximation overlap is insufficient. Visible line1 is nonempty-worklist inequality; raw extraction drops the slash and is not an actual printed defect. Theorem1 gives conditional SAFE/UNSAFE soundness if every learned beta is a true mode discrepancy; relative completeness is stated with proof following thesis[13], not established for inaccurate learned functions. No machine-checked proof or independently inspected imported proof is supplied. Robust separation/refinement and simulator assumptions matter for termination; table success does not establish a general total decision procedure. Definition2(c)(i) visibly uses (v,u_j) in R, not successor(v_prime,u_j). Along with label preservation this prevents the intended matching of a differently labeled successor. The expected successor-pair repair is reader inference. No implementation comparison was made; simulation/subsequent theorem claims are interpreted with intended successor matching rather than silently accepting the printed relation. Graph simulation checks a sufficient condition for prefix trace containment; not a complete containment procedure. The paper describes polynomial greatest-fixpoint removal and contrasts non-elementary general one-clock timed-language containment. Transferring safety also requires compatible initial sets, trajectory inclusion and interpretation of mode map/unsafe predicates; arbitrary relabeling alone does not preserve an unchanged physical unsafe set. Sequential composition identifies matching unique terminal/initial labels. Theorem2: if the terminal reach after one G cycle is contained in initial Theta, then every finite G^i reach is contained in one-cycle reach. It is an inductive closure result for generated compositions, not every arbitrary mode sequence. A sound enclosing terminal set B must be re-used as initial B and prove its own image subset B; checking unrelated component ranges alone is insufficient for correlated-set containment. Learning experiments use independently sampled initial states for10–20training traces,100–10000time points/trace, then1000test traces and all test pairs/times. Authors report96percent point coverage beyond10training and>99.9percent beyond20. These are empirical fractions of correlated test points across unspecified mode/seed distributions, not universal trajectory coverage or a per-mode confidence guarantee. Full per-mode results/repetitions/error bars are absent. Table1 has eight selected configurations: five Safe,three Unsafe, using GED. TH is explicitly shortest-path duration, not a maximum horizon. All times include simulation, learning, tubes, safety and refinements. i7-6600U/16GB laptop; no OS/solver versions, repeats, raw trace datasets or uncertainty estimates reported. PED claimed more precise on Powertrn and otherwise comparable, without quantitative ablation. Random simulation precheck can return Unsafe before VerifySafety; dash refinement counts are preserved as unspecified rather than changed to zero or assigned a cause. Figure2 AutoPassing initial sets differ from Table1; its farther-forward B interval[30,40] is unsafe while[15,17] is safe because fixed maneuver timing matters. This does not support a monotonic distance rule. Powertrain composition uses lambda terminal enclosure[14.68,14.71], next terminal[14.69,14.70], with containment of other variables asserted but not tabulated. GA composed with GB and with GB³ are reported safe with zero refinements; extending to all finite GB repetitions is conditional on actual full-state enclosure closure. This is not an unconditional arbitrary-time physical safety guarantee. Models/remaining initial coordinates and ATS details are deferred to arXiv:1702.06902 appendix; that version was not read here. Python implementation uses MATLAB Python API/Simulink,PyGLPK andZ3. GitHub https://github.com/qibolun/DryVR and a Python benchmark port are cited, uninspected/unrun. No LLM-agent,Verus/verified-Rust,TLA+or distributed-protocol proof is provided. Independent reviewer identified another literal pseudocode omission: Algorithm2 line10 offers graph refinement as an alternative to requeueing Partition(S) at line9, but does not explicitly requeue or recheck the popped ambiguous S. If taken as a standalone alternative on the last work item, the worklist can empty and line11 return SAFE without rechecking it. Intended refinement must retain the pending obligation; no implementation bug is inferred. Independent review: GraphReach initializes only one initial vertex v_init, while Definition1 allows multiple initial vertices and the explicit singleton assumption is introduced for sequential composition. Applying the algorithm to the general graph definition requires initializing every initial vertex or an additional unique-initial-vertex assumption.
  • how much was read: most of it read
  • source
  • record id: dryvr-data-driven-verification-2017
• Dynamic architecture pattern model checking (2017)
  • title: Verifying Patterns of Dynamic Architectures Using Model Checking
  • what: Defines a five-step model-checking approach for formalizing dynamic architecture patterns and their guarantees, and applies it to Singleton, Model-View-Controller and Broker patterns. The approach reviews pattern literature, formalizes component interfaces with algebraic signatures and configuration trace assertions, models component behavior as finite Mealy machines, states guarantees in LTL and translates interfaces/models/guarantees to NuSMV. Dynamic architectures are configuration traces of active components, port valuations and connections. MVC examples specify Model/View/Controller ports and state machines, then check eventual view updates and model-view consistency. Results identify Singleton activation/safety, MVC update/consistency and Broker service/registration properties; the paper reports ambiguities such as whether a Singleton can deactivate and be replaced. NuSMV models contain 68/89/309 lines for Singleton/MVC/Broker and analyze in 25/30/1000 ms average per LTL property.
  • number: Singleton model 68 lines, 2 LTL specs, 25 ms average and 50 ms total
  • number: MVC model 89 lines, 30 specs, 30 ms average and 1.5 s total
  • number: Broker model 309 lines, 6 specs, 1000 ms average and 6 s total
  • number: all three patterns exposed ambiguities or missing constraints
  • limits: Models abstract away concrete implementations and use finite-state bounded interfaces, arrays and component counts; guarantees hold for the modeled pattern instances and assumptions, not arbitrary deployments without conformance checking. Broker model omits bridge components, uses one broker and restricts requests; real deployments require marshalling. LTL model checking addresses safety/liveness properties but not direct quality attributes such as performance or availability. Effort and results come from one analyst and three patterns, limiting generality.
  • how much was read: most of it read
  • record id: dynamic-architecture-pattern-model-checking-2017
• Epistemic Model Checking of Atomic Commitment Protocols with Byzantine Failures (2017)
  • what: # Epistemic Model Checking of Atomic Commitment Protocols with Byzantine faults (authored by agents unless marked 🧑) Omar Ibrahim Al-Bataineh, arXiv1705.02515v3,10May2017. The official arXiv metadata calls the paper “Epistemic Model Checking of Atomic Commitment Protocols with Byzantine Failures”; the visible PDF title ends “with Byzantine faults” (M1,Q0). Official and inventory PDFs are byte-identical. The paper uses MCK to replace knowledge tests in a two-phase-commit program with concrete predicates, then studies cheating detection and termination in a synchronous reliable environment. The main qualification is its own Table2: global consistency, commit validity, abort validity and universal cheating detection fail. Eventual participant decisions and the stated coordinator/participant termination tests hold for the tested finite models. This is an analysis of a vulnerable protocol family, not a proof of Byzantine-correct atomic commitment (Q0,Q8,Q11). ## Scope and semantics Read all14PDFpages, sections1–8,17reference entries, all three protocol figures and three tables. Viewed individual renders7,8,9,12,13 to inspect complete pseudocode, formulas and tables. The PDF’s visible version/date is2017; its creation metadata says2019, which is not substituted for the publication date. The bibliography is not a recursive reading of its cited sources. No MCK program, checker, author code or solver was executed/imported; no serialized model/experiment data was loaded. Knowledge is defined through indistinguishability: Ki(phi) holds if phi holds at every point compatible with agent i’s local information. Perfect recall retains past observations. A knowledge-based program chooses actions using such formulas, whereas its concrete implementation uses predicates of observable variables and explicit history variables. Correct implementation requires equivalence at the program points/times where each knowledge test is used. Merely obtaining the same outcome on one run, or making a safe conservative replacement, is a weaker condition (Q1,Q2,Q3). The proposed workflow is partly automated. A human guesses a Boolean predicate/history update for each knowledge formula; MCK checks X^n(pc_i=l implies (predicate iff knowledge)). The human inspects counterexamples and revises the guess. The paper expressly says this requires “inspection and human reasoning” and possibly “some ingenuity.” It does not supply a fully automatic synthesis algorithm, a proof of search termination, or an agent evaluation. Its discussion of unique implementations depends on perfect recall and present-time knowledge tests, rather than arbitrary epistemic programs (Q3). ## Model, cases and reported properties One process coordinates a transaction and the others vote yes/no. An honest coordinator commits only when its own and all participant votes are yes; otherwise it aborts. It broadcasts its decision, receives acknowledgments and uses nested knowledge tests to decide when to stop. A Byzantine coordinator can choose an incorrect decision or send inconsistent decisions to different participants. The considered faults target outcomes rather than deliberately delaying or blocking termination (Q4,Q5,Q6,Q9). The environment delivers messages, handles synchronization and exposes the trap/cheatingDetected variables to participants. Communication is synchronous and reliable in the evaluated context, with bounded delays and chosen wait parameters. The general pseudocode also mentions undefined votes and communication failures; those are not evidence that the reported Byzantine-context checks include message loss. There is no arbitrary asynchronous scheduler, unbounded delay, crash recovery or cryptographic refinement result (Q5,Q9). A participant can detect cheating immediately when it voted no but receives commit. Participants may also open a run: they exchange their votes and received decisions, exposing contradictory decisions or a no vote paired with some commit instruction. A participant that detects cheating publishes that fact through the modeled variable. Such a publication mechanism assumes appropriate truth/correspondence in the environment; no executable authentication or dissemination implementation is supplied in the paper (Q5,Q7,Q10). The coordinator’s vote remains private to it. If every participant voted yes and the coordinator sends one consistent but incorrect decision, opening the participants’ observations does not expose its private vote. The paper reports a counterexample to universal cheating detection in this case. Its speculative policy follows the received decision when the participant does not know cheating occurred. That differs from requiring knowledge that no cheating occurred; the latter conservative policy is discussed as preventing commits in this information setting (Q10,Q11). Table1 gives three phase-specific predicate replacements. At point1, known cheating is a no vote paired with a received commit. At point2, detection also includes published cheating or an opened run with a no vote/commit pair or inconsistent decisions. Its point3 replacement for not knowing cheating is a yes vote with no publication/no trap, or a trap showing all participant votes yes and decisions equal. These are printed claimed equivalences, with the limitations below preserved (Q11). Table2 reports:1a global consistency fails;1b eventual participant decision holds;2a commit validity fails;2b abort validity fails;3 complete cheating detection fails;4a coordinator termination holds;4b participant termination holds. Specifications2a/2b explicitly constrain the coordinator’s decision variable, while1a/1b concern participant outcomes. These different variables should not be collapsed into a claim about every honest participant’s valid outcome. Failure of one displayed formula does not by itself identify all possible implementation failures; no full counterexample traces for every table cell are supplied (Q8,Q11). The models were checked for d=2,3,4,5 agents. The paper says “We conjecture that our present implementation can be shown to work for all number of agents” (§7,p13). Thus the all-size generalization is a conjecture, not a parameterized proof. It refers to “two contexts” there although this retained version presents only one Byzantine-context results row; a second unseen experiment is not inferred (Q12). ## Formula and predicate qualifications The explicit abbreviation Khat_i(decision) is Ki(decision=commit OR decision=abort). This says that agent i knows a decision has been made. It is weaker than knowing which decision: Ki(decision=commit) OR Ki(decision=abort). A two-point information set with commit at one point and abort at the other satisfies the first formula but neither disjunct of the second. Consequently the paper’s prose “knows the final decision” should be interpreted with this written formula in view. The printed formula does not alone establish value knowledge, even if other model observations might establish it in particular phases (Q7,Q8; reader semantic example). Table1 point3 also appears too narrow for its claimed equivalence to NOT Ki(cheating). Consider an honest coordinator sending abort after a participant voted no, with trap=false and cheatingDetected=false. Cheating is actually false. By the factivity of knowledge under the stated indistinguishability semantics, Ki(cheating) is false, so its negation is true. Yet both disjuncts of the printed replacement require the participant’s vote yes, making the predicate false. The program can still retain its already assigned abort outcome; this example challenges exact epistemic equivalence rather than proving an additional disagreement execution. The paper’s unreleased environment/control-point details would be needed to see whether it excludes this apparently ordinary reachable case (Q2,Q7,Q11; reader derivation). The no-vote stopping explanation appeals to abort validity while Table2 reports abort validity fails for the coordinator’s decision. Knowing the correct prescribed decision and knowing the actual Byzantine coordinator variable are different claims. The record preserves this ambiguity instead of deriving an unqualified early-stop theorem. Similarly, Specifications3/4a/4b and §7 use a free participant index i in the printed formulas; their prose talks about everyone. The coordinator pseudocode does contain an explicit conjunction over participants before breaking. Treat the displayed specifications as schematic per-participant tests unless the missing MCK model establishes their quantification (Q6,Q8,Q9). ## Run-length method and evaluation For a coordinator stopping condition T, the paper checks X^n(NOT T) universally over runs. Its first failed bound identifies an execution where T holds; the proposed doubling then binary search seeks the smallest such bound. To find a uniform upper bound it instead checks X^n(T), seeking the first bound where every run satisfies T; a counterexample at one step earlier illustrates a slow run. These are model time/communication bounds, not observed wall-clock latency or throughput (Q12). Binary search requires a monotone bounded predicate. Perfect recall preserves knowledge of past facts but does not, by itself, preserve knowledge of an arbitrary proposition about a changing current state. The one-shot decision/stopping model may provide the required persistence; its complete environment/transition model is needed to establish that. An asserted universal eventual stop also need not yield a finite uniform bound for arbitrary infinite-state systems. The paper’s finite tested cases and its explicit “if any” upper-bound search should remain visible (Q12; reader methodological qualification). Table3 reports a shortest run of one round and d−1 messages, and a longest run of three rounds and3(d−1)messages. Figure3’s optional participant all-to-all exchange can add2(d−1)(d−2) sends if each of d−1 participants sends both its vote and decision to each other participant. That is reader arithmetic from its loop. The paper does not explain how this optional traffic is charged in Table3, so its linear message totals should not become an unqualified bound including every opened-run exchange (Q8,Q12). No MCK version, hardware, state-space counts, checker runtimes, iteration counts, full environment listing, complete counterexample archive or source URL appears in the retained paper. Therefore its model-checking outcomes and timing/message claims remain author-reported. This read does not reproduce them or certify its printed formulas against a saved executable model. Future work includes coordinator replication, cryptography and improved fault detection (Q12,Q13). ## Contribution to the requested topic This provides a concrete specification-to-predicate refinement workflow for distributed protocols: preserving local observations/history, checking epistemic equivalence at exact control points and learning from counterexamples. Its negative results demonstrate that termination and detection improvements do not establish atomic-commit safety. There is no Verus/Rust implementation, TLA+ experiment or LLM agent. A reader proposal for proof/specification agents is to check formula/prose agreement, exact versus merely outcome-preserving predicate replacements, finite versus all-size coverage, hidden environment assumptions and complete message accounting separately.
  • limits: synchronousreliablecommunication;restrictedByzantinecoordinator;perfectrecall;finitetestedagentcounts;hiddenenvironment;negativecorrectnessresults;formula/predicatequalifications;noauthorreplay
  • how much was read: most of it read
  • source
  • record id: epistemic-model-checking-of-2017
• Error-Sensitive Proof-Labeling Schemes (2017)
  • what: Introduces local certificates that force at least alpha times the node-label edit distance to legality many rejecting nodes, for every certificate assignment on an invalid state. Claims existence exactly for locally stable languages, shows dependence on data representation, and proves compact spanning-tree and sketches MST schemes. Detecting many faults is distinguished from locating faults or completing recovery. Printed graph predicates, verifier checks and characterization proof have concrete gaps below; intended results are preserved as author claims. Records quantifier order, label-only repair distance, arbitrary certificate corruption, one-round unbounded LOCAL model, local-stability pasting criterion, universal-certificate decomposition, path obstruction, explicit compact verifier and 4k repair argument, distinct-weight MST premise and missing full proof. Includes small counterexamples to literal acyclic/verifier definitions and qualifies repair-runtime motivation rather than presenting it as evaluation.
  • limits: §2: connected simple undirected communication graph; no self-loops or parallel edges. Distinct node IDs. Synchronous LOCAL rounds with unbounded messages and computation; verifier takes exactly one exchange with neighbors. Some results use fixed edge weights. This is verification of a labeled snapshot, not a dynamic Byzantine execution with arbitrary verifier behavior. §2: input labels and proof certificates are separate binary strings. A distributed language is constructible (every underlying graph has some legal labeling) and Turing decidable. Edit distance changes whole node labels, with arbitrary string length at unit cost, on the same graph; IDs, graph edges, weights and certificates are not charged in that distance. Definition1: legal input has an existential prover assignment accepted at all nodes. Every illegal input, under every certificate assignment, has at least alphad rejectors, for one language-dependent constant alpha>0 independent of graph size. The rejecting set may depend on certificates and may be distant from any node whose input must be repaired. Legal inputs with corrupted certificates need not all accept. §1: at label distance at least epsilonn, rejector density is at least alphaepsilon. Uniform random node probes therefore have expected O(1/(alphaepsilon)) trials to hit a rejector, assuming a probe can obtain the node’s verifier outcome or sufficient neighborhood state. This is a consequence of the detection guarantee, not an implemented monitoring benchmark or recovery-time theorem. §3/Proposition2: intended directed forest has null-root distances as certificates. Each nonnull pointer decreases the distance by1; null pointers require0. Setting every rejecting node’s pointer to null is intended to repair at most k labels when k nodes reject, giving alpha≥1. The displayed acyclic predicate only checks the undirected union of pointer edges, which also permits mutual-pointer pairs; literal completeness fails for those inputs. §3: if every labeling is within constant distance of legality, the language is trivially approximable. Proposition3 states that any other language has some verifier that is not error-sensitive, even if another verifier is. Lemma4 says existence of an error-sensitive scheme implies the universal scheme is error-sensitive. Their proofs and the regular-subgraph impossibility example are deferred to the full version. The saved text notes regular is locally checkable; local checkability alone does not imply robust rejection counts. §3 universal certificates: every node gets the same triple (T,M,L), containing all IDs, adjacency matrix and all input labels. A node compares neighbor triples, checks its identity/neighborhood/label against that description, and centrally decides the described language. No compactness or efficient certificate construction follows. Size depends on ID and input-label lengths as well as n² adjacency bits. §4/Definition7: partition target graph vertices into connected subgraphs H_i, each also present in a legal labeled source G_i. Paste source labels onto each piece. Local stability requires repair distance at most beta times the union of piece-boundary vertices, counting boundaries in target G and source G_i. Internal omitted edges also contribute boundary under the definition. It is a structural label-repair property, not temporal stability. §4/Theorem8 necessity: paste correct certificates from each legal source. Nonboundary nodes have identical one-hop views and accept, so alpha*d≤boundary size. Sufficiency uses universal certificates: remove edges with two rejecting endpoints, yielding components with consistent descriptions; isolate all-rejecting components, replace labels using their legal source descriptions, then invoke local stability. Intended distance bound is (beta+1)k, hence alpha=1/(beta+1). Printed label/boundary equalities need qualification below. §4/Definition9: strong local stability allows replacement of one shared subgraph’s labels between two legal graphs, with repair cost proportional to its two boundaries. Lemma10 says it implies local stability; proof deferred. Strict separation in general and equivalence on bounded-degree graphs are asserted with proof in full version. Unique leader, adjacency-list spanning tree and MST corollaries are stated; some stability proofs omitted. §3/Proposition6: parent-pointer spanning-tree representation is claimed not error-sensitive. On an even path, opposing orientations toward endpoints pasted at the midpoint require at least n/2 pointer-label edits but any one-round verifier sees only two altered boundary neighborhoods. Conversely, symmetric adjacency-list tree representation admits compact robust certificates. A one-round conversion from pointers to incident lists does not preserve node-edit distance under reverse reconstruction. §5/Theorem14: certificate has root ID I(u), parent ID P(u), distance d(u). Intended checks enforce symmetric tree adjacency, agreement on root ID across every communication edge, parent existence and decreasing distances, and child consistency on selected edges. Root has P(u)=ID(u),d=0. Printed checks unconditionally demand a neighbor with P(u), contradicting self-parent at root on a loop-free graph, and do not explicitly require parent edge in the selected input tree. §5/Theorem14 repair: remove communication edges whose endpoints both reject and corresponding input incidences. Intended remaining selected edges form a forest. Each communication component has at most k_C+1 selected trees; component count≤k and total rejectors≤k, so at most2k forest trees. Reconnect by changing at most4k node labels, claiming alpha≥1/4. This repair is an existence argument used to bound edit distance, not a distributed correction protocol. §5/Theorem15: distinct edge weights assumed in preceding prose; certificate tables encode O(log n) Boruvka stages with rooted fragment/outgoing-minimum witnesses and stage-consistency checks, yielding O(log² n) bits under conventional bounded IDs/weights. Sketch removes edges between rejectors, relates surviving selected forest to MST edges via a relaxed Boruvka run, repairs components and then global tree. Full charging/relaxed-algorithm proof omitted, so no independent acceptance of the MST constant or complete construction here. §6: whether error-sensitive certification ever requires larger certificates than ordinary optimal certification remains open in this paper. Proximity sensitivity asks every error to have a nearby detector, stronger in certain dispersed-error settings, and is not proved by detector-count sensitivity alone. No experiments, implementation, Verus/TLA+/Rust code, mechanized proof or LLM-agent evaluation supplied.
  • how much was read: most of it read
  • source
  • record id: error-sensitive-proof-labeling-2017
• FlyFast (2017)
  • title: FlyFast: A Mean Field Model Checker
  • what: Presents FlyFast, an on-the-fly mean-field model checker for bounded PCTL properties of a selected individual in a large population of interacting objects, using occupancy-measure dynamics instead of explicit population state spaces.
  • number: Gmax=9, N=2500, n=500, s=100, c=50
  • number: 16,997 ms coverage analysis; 14,720 ms nested analysis
  • number: time independent of N for N≥2500
  • number: bounded PCTL; expansion/computation linear in expanded states/transitions
  • limits: The mean-field approximation assumes many similar, effectively independent objects with interactions represented through occupancy measures; models are discrete-time, time-synchronous DTMCs and properties are bounded PCTL. Continuous-time models require discretization and conditions from prior work. Results concern a selected individual and approximate large populations, not exact finite-population executions; small populations may violate approximation assumptions.
  • how much was read: most of it read
  • record id: flyfast-2017
• Formal versus experimental TDoS defense (2017)
  • title: On the Accuracy of Formal Verification of Selective Defenses for TDoS Attacks
  • what: Formalizes a coordinated-call telephony denial-of-service attack and three SeVen selective defenses in Maude/PVeStA, then compares statistical model-checking simulations with Asterisk/SIPp experiments. The model covers uniform, roulette, and k²-tournament dropping, exponential versus lognormal honest-call durations, Erlang-sized capacity/rates, and quality measures for complete, incomplete, unsuccessful calls and interrupted-call duration. Simulations predict attack effectiveness, defense ranking, and better lognormal behavior; network experiments validate availability trends but expose timing inaccuracies. The paper quantifies setup differences (proxy versus in-application defense, constant latency, omitted Asterisk workers and contention) and reports simulation minutes versus hour-long experiments.
  • number: simulations: k=24, 99% confidence, five attacker/legitimate proportions, 40 time units
  • number: experiments: k=200, 60 calls/min, 60 minutes and 3,600 calls each
  • number: 100-tournament: >70% exponential and >80% lognormal calls completed; >95% reached INCALL
  • number: roulette: >70% exponential and >75% lognormal complete, <6% incomplete
  • limits: Formal model abstracts Asterisk internals, competing CPU/network workloads, variable latency, and uses scaled-down parameters; attackers are indefinitely long calls and total traffic is kept at or below normal rate. Results are highly accurate for availability but less accurate for timing (up to roughly 30 percentage-point discrepancy); roulette-versus-uniform ranking was not predicted.
  • how much was read: most of it read
  • record id: formal-versus-experimental-tdos-defense-2017
• Futa Shidama VECTSP12 ring-module isomorphism 2017 (2017)
  • title: Isomorphism Theorem on Vector Spaces over a Ring
  • what: Futa and Shidama formalize the first isomorphism theorem for Mizar vector-space structures over a ring,that is,module-like additive groups with a left scalar action. A linear map descends to a quotient by a subspace contained in its kernel,and the kernel quotient is linearly bijective with the image. Separate field-only results handle bases,direct sums,finite dimensions and quotient complements. Finite sequence products and binary Cartesian products are constructed and related by explicit linear bijections. Records the switch from fields to rings before quotient definitions,the kernel-containment requirement and codomain restriction needed for surjectivity. Distinguishes ordered-pair carriers from finite-tuple carriers,and captures the operation-preserving maps relating them. Keeps lattice/LLL/cryptography as motivation rather than a verified algorithm or application.
  • limits: MML VECTSP12 version8.1.06 5.44.1305 identifies the article. Its “vector spaces over a ring” include module-like structures;the paper explicitly mentions Z-modules. The Summary’s lattice,LLL basis-reduction and cryptography references are motivation. No LLL algorithm,cryptographic implementation,security proof or performance experiment is formalized in these18results (pp.171,178). Results1–5 explicitly require fields. Result1 assumes finite-dimensionalV/W,a basisA ofkerT contained in a basisB ofV,and a linear combination supported onB\A,to commuteT with the sum via the displayed transported combination. Result2 preserves/reflects bases under a bijective linear map;3preserves finite dimensionality;4gives equal dimensions with finite-dimensional source;5equates two linear-combination transport operators under injectivity. Their notation is imported,not fully defined here (pp.171–172). Despite§2’s heading about modules over a ring,results6–9 also explicitly assume a fieldK. Direct-sum summand bases are disjoint;their union spans and is independent. Result9 gives a basis ofW1+W2 when the subspaces intersect in the zero subspace. It is not a theorem that arbitrary ring modules have bases or that every submodule has a complement (pp.172–173). Results10/11 assume a finite-dimensional vector space over a field and a subspaceW. Result10 constructs a linear complementS with the coset mapS→V/W bijective;11gives finite dimensionality anddim(V/W)+dimW=dimV. These stronger assumptions do not carry into the later ring-general first isomorphism result. Reading counterexample to extending complements to every ring module:2Z⊂Z has no complementary Z-submodule,andZ/2Z is not a free Z-module (p.173 plus labelled counterexample). Definition1 switches to an arbitrary ringK and requires carrierW⊆carrierkerf before definingf/W:V/W→U byf/W(a+W)=f(a). That containment makes the value independent of the representative. Definition2 specializes toW=kerf asCQFunctional f,registered injective. No field,finite dimension or freeness is stated for these quotient maps (p.173). Result12 states there is a bijective linearT:V/kerf→imf equal as a function toCQFunctional f. CQFunctional was originally typed intoU,so it is not generally ontoU;surjectivity arises by usingimf as codomain. Its short proof identifiesrangeT=rangef. This is an algebraic isomorphism with no topology,norm or boundedness assertions (pp.173–174). After12,the composition of two typed linear transformations over the same ring is registered linear. Definition3 defines a “sequence of vector spaces” as a nonempty finite sequence,with every entry a space overK. Thus the product construction here does not include an empty factor list or an arbitrary infinite index set (p.174). Definition4 collects each factor’s left scalar-multiplication operation,with the same sequence length. Definition5 forms the sequence product from the product carrier,coordinatewise addition,zero tuple and scalar action. Structural registrations establish Abelian-group and module distribution/associativity/unit laws. These are exact algebraic constructions,not an algorithm that enumerates a product carrier (p.174). Definitions6/7 separately construct a binary Cartesian product using ordered pairs and componentwise scalar multiplication. Results13/14 characterize vectors,addition,zero,scalar multiplication and additive inverse;14requires the indicated additive-group structure laws. Registrations transfer each remaining module law from the factors (pp.174–175). Result15 mapsx to the one-entry finite sequence〈x〉,giving a bijection X→product〈X〉 preserving addition,scalars andzero. Result16 maps an ordered pair(x,y) to the two-entry finite sequence〈x,y〉,with the same preservation laws. These are representation isomorphisms,not claims that the pair carrier and the finite-sequence carrier are literally equal (p.176). Result17 maps a pair of vectors from productsX andY to the concatenation of their finite sequences,bijectively and preserving addition,scalar multiplication andzero. Both factor lists are nonempty finite byDefinition3. Result18 transfers the componentwise formulas toproduct〈G,F〉 using16:tuple membership,addition,zero,negation andscalar action (pp.176–178). Reading kernel example,not printed:the Z-linear mapf:Z→Z/2Z sending an integer to its parity haskerf=2Z andimagef=Z/2Z,so12givesZ/2Z≅imagef although the source is a ring module and the quotient has torsion. This checks why first isomorphism remains valid when the earlier field-basis/complement premises cannot be used. All eight pages,seven definitions,18results/all clauses/supplied sketches,structural registrations,funding footnote,seven references/date and English-volume funding notice read;both sheets inspected. Quotes retain raw extraction,not visual formulas;linear-combination transforms,sum/product signs,cardinality bars and pair/tuple brackets may be distorted. No formal artifact execution,proof timing/size,automation rate,empirical evaluation or distributed/Verus/Rust/TLA+/LLM-agent experiment.
  • how much was read: most of it read
  • source
  • record id: futa-shidama-vectsp12-ring-module-isomorphism-2017-2017
• Gomes et al. SEC Isabelle (2017)
  • title: Verifying Strong Eventual Consistency in Distributed Systems
  • what: Builds a reusable Isabelle/HOL framework that formalizes strong eventual consistency (SEC), an asynchronous unreliable causal-broadcast network, and three operation-based CRDTs: Replicated Growable Array, Observed-Remove Set, and increment-decrement Counter. The abstract convergence theorem proves that distinct happens-before-consistent operation lists with the same set of operations yield the same state when concurrent operations commute, while a separate no-failure condition gives progress. The network locale has six axioms covering unique node histories, delivery cause, local delivery, globally unique message IDs, causal delivery, and valid broadcast operations; messages may be delayed, reordered, dropped, or nodes may crash permanently. RGA proof models immutable element IDs, tombstones, insertion ordering, causal validity, and proves concurrent operations commute and application never fails. ORSet uses add IDs and remove sets of observed IDs; Add/Remove commute only under a proved independence condition. Counter operations commute unconditionally. The framework is executable via Isabelle code generation; one counter implementation ran over TCP, but detailed performance/fault-tolerance evaluation was left for future work.
  • number: 3 CRDTs verified
  • number: 6 network axioms
  • number: ~620 lines network, ~380 convergence, ~775 RGA, ~270 ORSet, ~55 Counter
  • number: ORSet proof about four hours; Counter minutes
  • limits: Network assumptions are axiomatic: finite totally ordered per-node histories, unique events/IDs, causal delivery for dependencies, and valid-msg predicates supplied by the algorithm. The model uses crash-stop permanent node failure, not recovery, and does not model overlay implementation, timing, or resource limits. RGA retains tombstones; garbage collection is explicitly out of scope. The correctness claims are for operation-based CRDTs satisfying the five SEC locale obligations, not arbitrary distributed data types. Executable extraction demonstrates computability rather than performance.
  • how much was read: most of it read
  • source; notes: papers and boundaries
  • record id: gomes-et-al-sec-isabelle-2017
• HS interval model checking track representatives (2017)
  • title: Model Checking for Fragments of Halpern and Shoham’s Interval Temporal Logic Based on Track Representatives
  • what: Develops model checking for Halpern–Shoham interval-temporal-logic fragments over finite Kripke structures. For AABBE (and symmetrically AAEBE), it introduces finite track descriptors and bounded track representatives, yielding an EXPSPACE procedure and PSPACE-hardness; AABE/AB are PSPACE-complete and universal ∀AABE/Prop are coNP-complete. The paper maps every finite Kripke track to a homogeneous abstract interval model and defines B_k-descriptors encoding prefixes up to B-nesting depth k. Descriptor-element types, clusters, and k-indistinguishability identify repeated prefixes with identical descriptors; contraction replaces them while preserving the descriptor. The bound τ(|W|,k)=min(1+(1+|W|)^(2k+4)+|W|, 1+(k+3)|W|^(|W|²+1)+|W|) limits representative length. An unravelling algorithm explores forward/backward tracks with this bound, and recursive Check/ModCheck procedures are proved sound and complete. Examples encode scheduler mutual exclusion, reachability, and starvation; hardness reductions establish PSPACE-hard AABE/AB and coNP-hard propositional fragments.
  • number: AABBE model checking in EXPSPACE
  • number: AABBE PSPACE-hard (NEXP-hard with succinct formulas)
  • number: AABE and AB PSPACE-complete
  • number: ∀AABE and Prop coNP-complete
  • limits: Models are finite Kripke structures with left-total transitions; interval propositions use the homogeneity assumption (true on an interval iff true on all constituent states). The method bounds tracks for fixed B-nesting depth and can require exponential working space; descriptor counts are non-elementary in general. It addresses model checking, not satisfiability of full HS (known undecidable), and examples are illustrative rather than empirical system evaluations. Succinct formula encodings raise AABBE hardness to NEXP-hard.
  • how much was read: most of it read
  • source
  • record id: hs-interval-model-checking-track-representatives-2017
• K-Android position paper (2017)
  • title: Software Model Checking: A Promising Approach to Verify Mobile App Security
  • what: Argues for bytecode-level software model checking of Android apps using K-Android, with paired concrete and abstract Smali semantics and a soundness simulation proof for collusion/security analyses. The design verifies APK bytecode rather than decompiled Java, separates executable concrete semantics from an abstract semantics using virtual loop unrolling, memory abstraction, and constant propagation, and organizes proofs by roughly 20 instruction groups for reuse. Experiments analyze app collusion and produce counterexample traces to distinguish real collusion from false positives. The paper reports sub-minute checks for small examples of about 5K Smali lines, but the proof remains incomplete for the roughly 220-instruction language.
  • number: about 220 Smali instructions
  • number: about 20 proof instruction groups
  • number: about 5K Smali lines
  • number: verification below one minute for small examples
  • limits: Position paper with exploratory results; abstraction must be sound for the security property, and current correctness proof covers core constructs but not all instructions. No quantitative benchmark beyond small examples; Android-specific semantics and applicability to other mobile systems is conjectural.
  • how much was read: most of it read
  • record id: k-android-position-paper-2017
• Mitsch robot obstacle avoidance (2017)
  • title: Formal Verification of Obstacle Avoidance and Navigation of Ground Robots
  • what: Builds hybrid-system models of dynamic-window-style ground-robot controllers and proves safety and liveness in differential dynamic logic (dL). The series covers static, passive, passive-friendly, and passive-orientation safety, then adds actual acceleration, sharp turns, location/actuator/velocity uncertainty, asynchronous obstacle control, and arbitrarily many obstacles via quantified dL. KeYmaera X proofs are converted into ModelPlex runtime monitors. The models make control-loop delay ε, robot acceleration/braking, obstacle speed, and circular motion symbolic. Theorems 1–4 prove collision properties using loop and differential invariants; Theorem 3 additionally proves an obstacle has an execution that can brake safely, and Theorem 4 limits responsibility to visible orientation sectors. Refinements prove safety with actual acceleration (Theorem 5), trajectory-distance sharp turns (Theorem 6), location uncertainty (7), actuator damping (8), velocity uncertainty (9), asynchronous obstacle decisions (10), and quantified arbitrary obstacles (11). Liveness proofs establish waypoint reachability (12), intersection crossing (13), and deadline variants (14–15). Concrete instantiations analyze indoor doors/corridors, and synthesized ModelPlex conditions check sensor/actuator samples against the verified model and trigger fail-safe stopping on deviations. Proof statistics show automation but nontrivial QE cost.
  • number: Theorems 1–11 plus 12–15 cover safety/liveness variants
  • number: KeYmaera X static proof total 89 s; passive 268 s; passive-friendly 407 s; orientation 1,006 s
  • number: location uncertainty proof 485 s; actuator perturbation 299 s; velocity uncertainty 404 s; asynchronous 335 s
  • number: waypoint proof 125 s; intersection proof 182 s
  • limits: Guarantees are conditional on the hybrid model: forward planar motion, bounded acceleration/braking, bounded control delay, obstacle velocity bounds, and (for passive-friendly safety) obstacle braking/reaction bounds. Robot shape is abstracted to a point by inflating obstacles; infinity-norm distance overapproximates Euclidean distance. Liveness requires explicit fairness/nonblocking assumptions (e.g., obstacle minimum speed at intersections) and suitable goal/deadline conditions. Formal proof establishes correctness of the model, not realism; probabilistic bounds are only safe when converted to guaranteed intervals. QdL proofs use predecessor KeYmaera because KeYmaera X lacked QdL support.
  • how much was read: most of it read
  • record id: mitsch-robot-obstacle-avoidance-2017
• Monitoring Partially Synchronous Distributed Systems using SMT Solvers (2017)
  • what: Encodes detection of possible global predicate violations in a partially synchronous execution as SMT constraints over variable values and hybrid logical clock timestamps. Includes a SAT reduction explaining the worst-case limit of accurate, nonintrusive polynomial-time monitoring, then measures Z3 solving time on simulated traces. Makes the encoding concrete: clock-skew, send/receive causality, half-open value intervals, and a global predicate share one snapshot formula. Appendix A adapts the asynchronous NP-completeness argument by placing every process transition inside one skew window. The evaluation separates solver time from a proposed scheduling interpretation for keeping up with the application.
  • number: Z3 checks traces generated for one second, invoked periodically at a one-second period. Windows 8.1, 2.19 GHz Intel Core i5, 8 GB RAM are the stated solving environment
  • number: Default tick 0.01 ms; skew 10 ms; delay 1 ms; change probability beta=1%; minimum stable interval 0.1 ms; average 1000 messages/s. Around 70% of instances are satisfiable; instances with too-easy predicate satisfaction are deliberately avoided
  • number: Communication frequency sweep 100 to 10000 messages/s; delay sweep 0.1 to 100 ms; beta sweep 0.1% to 10%; stable interval sweep 0.01 to 10 ms; skew sweep 0.1 to 100 ms
  • number: Less communication and more stable variables generally reduce solver time. Clock-skew effect is nonmonotone: the conjunctive curve rises then falls. The window-count versus window-complexity explanation is explicitly a hypothesis
  • limits: Pairwise clock difference is bounded by epsilon; message delay may range from zero to infinity in the stated model; messages and variable events must be reported to the monitor, initially with FIFO reporting assumed The monitor asks whether a legal serialization of the recorded partial order satisfies the predicate; satisfiable means possible concurrency, not necessarily an observed simultaneous fault All instrumentation, clock assumptions, finite observation-window coverage and constraint construction are trusted; invoking Z3 does not itself prove those assumptions or the encoding correct The empirical study fixes ten processes, simulates one second per trace, and uses selected random workloads; no production deployment, arbitrary-predicate scalability study or independently reproduced run is reported A usable tool that can be combined with any application is future work; linked raw experimental data was not inspected The printed packed-clock skew constraint is not equivalent to the original constraint. With epsilon=1,c0=4,(li,ci)=(1,1),(lj,cj)=(0,0), both counters are below the multiplier: |li−lj|=1<=1 passes, but |4li+ci−(4lj+cj)|=5<=4 fails. A larger valid multiplier preserves lexicographic order but does not remove the corresponding skew-boundary discrepancy. The precision/recall claim requires a corrected encoding or extra restriction. This is a source-level arithmetic witness, not an author-code test or a measurement of missed detections [Q13].
  • how much was read: most of it read
  • record id: monitoring-partially-synchronous-distributed-systems-using-smt-solvers-2017
• MTL freeze monitoring with knowledge gaps (2017)
  • title: Runtime Verification of Temporal Properties over Out-of-Order Data Streams
  • what: Defines MTL with freeze quantifiers and a monotone three-valued semantics for partially known event streams, proves observational soundness/completeness of an incremental monitor, and benchmarks a Go prototype on reordered synthetic banking logs. §3 represents monitor knowledge by finite observations containing timestamp intervals, partial predicate interpretations and register assignments. Refinement splits intervals to add time points, removes bounded intervals known empty and fills in missing values. Theorem 6 proves truth monotonicity, so a Boolean verdict survives later information; another result conservatively relates this semantics to full timed words. Theorem 7 makes the underlying data-aware decision problem PSPACE-complete. §4 defines observational soundness/completeness relative to this compositional semantics, explicitly contrasting the undecidable requirement to decide a verdict whenever all possible completed behaviors agree. The monitor maintains a DAG indexed by subformula, interval and partial variable valuation; it propagates frozen data downward and Boolean values upward, preserving special temporal placeholders needed when intervals split. Theorem 13 states correctness for closed formulas and valid observations. §5 measures the cost of data quantification and disorder, and compares a semantically different in-order MONPOLY setup.
  • number: 60-unit logs; event rate 100 gives about 6000 events
  • number: five logs per plotted data point
  • number: P1 at rate 100: about 1s at disorder sigma=0 and 3.5s at sigma=10
  • number: MONPOLY up to 3 orders of magnitude faster on eligible in-order policy counterparts
  • limits: The logical model uses rational timestamps that are strictly increasing and nonzeno in complete timed words, plus a fixed finite predicate/register vocabulary. Incoming knowledge must be truthful and monotonically refine observations; bogus component messages are excluded. The algorithm assumes every message identifies a new timestamp, sender and per-sender sequence number so it can discover intervals with no missing events; it does not derive trustworthy global timestamps from a distributed clock protocol. Valid observation sequences assume infinitely many messages for simplicity. Message delay/loss has no bound, but this means some verdicts may remain unknown forever. Completeness is observational, not maximally decisive over all full extensions; even a classically contradictory temporal formula can remain unknown under incomplete observations. General memory usage is unbounded and complexity is PSPACE-complete. Experiments reorder messages but do not drop them; only four synthetic policies/log families are tested. Thousands or millions of events/s and realistic large-scale deployments remain future work. Proof details are referred to a full version; no mechanized proof of prototype code is reported.
  • how much was read: most of it read
  • record id: mtl-freeze-monitoring-with-knowledge-gaps-2017
• Multilevel Monte Carlo Method for Statistical Model Checking of Hybrid Systems (2017)
  • what: Develops statistical model checking for continuous-time stochastic hybrid systems that cannot be exactly simulated. It discretizes SDE executions, estimates first-exit/reachability distributions, and uses coupled multilevel Monte Carlo (MLMC) estimators with a tunable polynomial smoothing of the discontinuous indicator. The paper defines the ct-SHS model with mode invariants, Lipschitz bounded drift/diffusion and boundary-triggered switching; reduces safety to a first-exit distribution; derives standard-MC and MLMC mean-square error/cost rates; introduces a cubic smoothing function, decomposes error into smoothing, bias and variance, and gives an adaptive algorithm selecting smoothing level, maximal discretization level and sample counts. A thermostatically controlled load (TCL) case instantiates Euler discretization and reports variance/mean decay and cost gains.
  • number: TCL horizon is 1 hour with residential-air-conditioner parameters in Table 1
  • number: target accuracies epsilon=2^-k for k=3,…,8, 10^6 runs for decay plots and 100 runs for cost comparison
  • number: adaptive MLMC shows increasing computational gain as epsilon decreases; non-monotonicity remains from re-evaluating functionals when smoothing changes
  • limits: Drift and diffusion are bounded and Lipschitz; the exposition restricts to forced boundary jumps and continuous state at mode switches, though modifications are claimed for spontaneous jumps. The MLMC rates require exponential bias/cost and variance assumptions; adaptive estimates presume near-exact empirical means/variances. Smoothing changes the target and requires simulation through s+delta; experiments use one TCL and compare costs while assuming the SMC rate parameter known, favoring SMC.
  • how much was read: most of it read
  • record id: multilevel-monte-carlo-method-2017
• Nakasho Futa Shidama NDIFF8 implicit existence 2017 (2017)
  • title: Implicit Function Theorem. Part I
  • what: Nakasho, Futa and Shidama formalize continuous implicit-function existence and uniqueness using a parameterized contraction argument. The solution variable lives in a Banach space; only continuity of f and continuity/existence of its second partial derivative are assumed, together with a bounded inverse at the base point. Translation and inverse-derivative normalization produce a self-map contraction on a closed ball. A final shrink of the parameter neighborhood moves the continuous solution into an open ball. This Part I does not prove differentiability of the implicit solution. Records exact operator/partial-function contracts, geometric Picard estimates, parameterwise continuity with a uniform contraction constant, inverse normalization, quarter-to-half contraction bounds, invariant closed ball, open-target restriction and the printed translation typo.
  • limits: MML NDIFF_8 version 8.1.06 5.45.1311 identifies the Mizar article. Main Theorems35/36 use E,G real normed spaces and F real Banach, f:E×F→G on exact open domain Z, continuity of f, second-variable partial differentiability on Z and continuity of that partial-derivative map. They do not assume full C1 differentiability in both variables; completeness is required for the solution space F, not E/G (pp.269,276–280). At z=(a,b), f(a,b)=c. D_2f(z) is one-to-one and its inverse is stipulated to be a Lipschitz linear operator from all G into F. For a set-theoretic inverse this total domain also forces surjectivity of D_2f(z), so the condition is stronger than injectivity alone. No finite-dimensional argument replaces the bounded-inverse contract (Theorems35/36). Theorems1–3 fix the product norm sqrt(||x||²+||y||²) and its one-coordinate special cases. Theorems4–12 supply associativity, identity, pointwise composition, additivity and scalar laws for bounded/Lipschitz linear operators, including their typed BdLinOps representations. These justify forming Id-Q composed D_2f (pp.269–271). Definition1 introduces the closed ball ||p-q||≤r. Raw extraction drops its overbar and conflates it with open Ball; renderings distinguish them. Theorems13–19 give nonemptiness for positive radius, monotonicity, open/closed ball inclusions and symmetric norm membership. The closed ball is closed; the open ball is open and a neighborhood for positive radius (pp.271–272). Theorems20–24 give ambient openness by local balls, coordinate norm bounds, and a product of sufficiently smaller balls within a product-norm ball. Theorem25 gives a linear injective map trivial kernel. Theorems26/27 preserve open sets under plus/minus translation. These ensure translated domains remain open (pp.272–273). Theorem28 assumes nonempty closed S in a Banach X, exact dom f=S, range contained in S, and one K with0<K<1 bounding all pairwise differences. Iteration u_(n+1)=f(u_n) stays in S; increments≤||u1-u0||K^n and telescoping gives ||u_(n+k)-u_n||≤||u1-u0||K^n/(1-K). Completeness plus closedness keeps the limit in S; contraction gives fixedness and uniqueness. The paper prints these estimates in its sketch (pp.273–274). Theorems29/30 parameterize contractions F1(x,y). Parameter set A need not be open or complete; target B is nonempty closed in Banach F. F1 preserves B, is continuous in x for each fixed y relative to A, and contracts y with the same K<1 for every x. Uniformity of K is material. The fixed-point function has exact domain A, range in B, continuity relative to A and extensional uniqueness (pp.274–275). Continuity of the selected fixed point follows from (1-K)||g(x)-g(x0)||≤||F1(x,g(x0))-F1(x0,g(x0))||. Thus continuity only in the parameter at the fixed y=g(x0), together with a uniform contraction, suffices; a separate joint-continuity premise is unnecessary for29/30. This inequality is this reading’s derivation of the abbreviated sketch, not an executed checker trace. Theorems31/32 identify coordinate-slice maps when the fixed other coordinate agrees;33 makes the closed ball convex. Theorem34 literally says N-b is a neighborhood of both x-b and x+b. The second claim is false in general: in R, x=0,b=1,N=(-0.1,0.1) gives N-b=(-1.1,-0.9), not a neighborhood of1. Its proof correctly uses N+b for x+b, indicating a printed statement typo. Mizar source was not audited, so this is not a claim that a checker accepted that false sentence (pp.275–276). Theorem35 constructs H(x,y)=(x,y-b), inverse K(x,y)=(x,y+b), and translated open Z1=H(Z). With Q=(D_2f(a,b))^-1 it forms residual R(x,y)=f(x,y+b)-c and fixed-point map Phi(x,y)=y-Q(R(x,y)). Inverse identities give Phi(a,0)=0 and D_yPhi(a,0)=0. Fixed points correspond to original solutions using injectivity of Q (pp.276–277). D_yPhi(x,y)=Id-Q composed D_2f(x,y+b), and its continuity allows a product neighborhood with derivative norm<1/4. The proof chooses a smaller solution radius r2=r1/2 and parameter radius so ||Phi(x,0)||≤r2/2. A mean-value estimate on the convex closed ball gives a uniform contraction bound1/2 (weaker than1/4), and ||Phi(x,y)||≤||Phi(x,y)-Phi(x,0)||+||Phi(x,0)||≤r2 preserves that ball (p.278). Theorem30 then selects continuous Psi on the parameter ball with values in the closed ball centered0; translation g(x)=Psi(x)+b gives f(x,g(x))=c, g(a)=b and uniqueness among solutions in the closed target ball. Theorem35 explicitly includes parameter-open-ball times target-closed-ball contained in Z; its target range and uniqueness are closed-ball statements (pp.276–279). Theorem36 keeps that product containment with the closed target ball but shrinks the parameter radius using continuity of g at a to ensure ||g(x)-b||<r2. Restricting g to the smaller parameter ball yields range in the open target ball and uniqueness there. Its derivative assumptions remain the same, and no Dg formula/differentiability conclusion is provided in this Part I (pp.279–280). Proofs provide mathematical iteration and geometric estimates, but no executable inverse/implicit solver, numeric case, extracted program, floating-point bound, check-time/proof-size statistics, empirical benchmark or checker transcript. Nine references include bounded-operator and Banach-inverse libraries; they are not independently read in this record. No distributed protocol, Verus/Rust/TLA+ or LLM proof/specification-agent evaluation. Exact quotations preserve raw-extraction defects: lost ball overbars, U+0016 restriction/partial derivative glyphs, nested pair brackets, superscript/application ordering and geometric fraction layout. Renderings govern the open/closed interpretation. All 13 pages, one definition,36 theorems/clauses/sketches,footnote,nine references and final notes read; no source/checker/artifact execution.
  • how much was read: most of it read
  • source
  • record id: nakasho-futa-shidama-ndiff8-implicit-existence-2017-2017
• Narita Nakasho Shidama DUALSP05 Riesz 2017 (2017)
  • title: F. Riesz Theorem
  • what: Narita, Nakasho and Shidama formalize representation of every bounded real linear functional on continuous functions on a nondegenerate closed real interval by a bounded-variation Riemann–Stieltjes integrator, with total variation equal to the functional norm. The proof extends the functional to all bounded functions without increasing its norm, evaluates that extension on cumulative indicator functions, bounds all partition variations, then combines the Stieltjes norm inequality with the construction’s reverse bound. Records exact domains/topological bridges,positive interval length, endpoint-specific cumulative indicators, signed partition increments, removal of an initial-partition restriction and the two opposite norm inequalities. Distinguishes existence of a norm-optimal integrator from uniqueness or a general measure-space representation.
  • limits: MML DUALSP05 version8.1.06 5.44.1305 identifies the article. Definition1 constructs compact topology Cls2Cmp(A) on nonempty finite closed interval A=[a,b],a≤b. The main representation16 additionally assumes0<vol(A),hence a<b. This is the real continuous-function dual with the supremum norm, not the Hilbert-space inner-product Riesz theorem (pp.179–180,183). Theorems3/4 identify topological continuity of a map on a strict real-line subspace with continuity of the equal real partial function on its own domain. Theorem5 identifies the exact carrier with A;6 characterizes elements of C(Cls2Cmp(A);R) by dom u=A and partial-function continuity;7 embeds them among bounded functions. Continuity is relative to A, not a requirement of a continuous extension on all R (p.180). Theorems1/2 give |sgn d|≤1 and |x|=sgn(x)x. Theorem8 constructs m:A→BoundedFunctions(A),with m(a)=the all-zero function and m(s)=1 on[a,s],0 on(s,b] for s≠a. The exceptional value at a is intentional and differs from the singleton indicator1_[a,a]. Bounded indicator functions need not be continuous, motivating the enlarged functional domain (pp.179–180). The printed8 proof repeats C[s] for the F and G branches although C[s] means s=a; its claimed construction and theorem statement correctly use s=a versus s≠a. The branch proof text appears to have omitted the second negation. It is not treated as an independent executable proof or a false theorem accepted by Mizar (p.180). Definitions2/3 add an initial node at inf A to partition D: Dp1 takes m(inf A) for index1 and m(D(i−1)) thereafter; Dp2 analogously takes rho at those nodes. Their domain index is Seg(len D+1). Theorem9 constructs signed increments s_i=sgn(Delta rho_i)Delta m_i with exactly len D terms (p.181). Theorem10 commutes an additive functional with finite sums, proved by length induction. Theorems11/12 establish that bounded-algebra elements are actual real functions on A and evaluation of a finite function sum equals the corresponding scalar sum, again by induction. These bridges support the variation bound rather than assume function-algebra expressions are automatically pointwise (pp.181–182). Theorem13 assumes inf A<D(1),then assigns every t∈A to a partition interval,with t above the interval infimum except possibly the first interval. Thus cumulative-indicator differences are disjoint interval indicators,including the left endpoint in the first. Theorem14 extends a uniform var-volume-sum bound from such partitions to all partitions,assuming positive interval length (p.182). Theorem15 assumes a bounded-variation integrator rho and representation of a given dual functional f on every continuous u with exact dom u=A. The imported Riemann–Stieltjes inequality |integral u d rho|≤||u||sup TotalVD(rho) yields ||f||≤TotalVD(rho). It does not assert equality for every possible representing rho (p.182). Theorem16 first invokes the imported Hahn–Banach result to extend x from C(A) to a bounded linear functional f on V=all bounded functions on A, with ||f||=||x|| and exact restriction equal to x. It sets rho(s)=f(m(s));in particular rho(a)=0 for this construction. The statement only asserts existence; no uniqueness,right-continuity,positivity,monotonicity or measure-isomorphism conclusion is included (p.183). Reading explanation of the abbreviated variation step: for partitions with a<D(1),the signed sum of disjoint indicator increments has sup norm≤1 by13 and|sgn|≤1. Linearity and|d|=sgn(d)d make f of that sum equal to the sum of absolute rho increments, bounded by||f||=||x||. Theorem14 removes the partition restriction,so the supremum defining TotalVD(rho) is≤||x|| and rho has bounded variation. The English proof states these bounds without expanding every dependency (pp.181–183). The final sketch asserts x(u)=integral u d rho for every continuous u and then applies15 to get||x||≤TotalVD(rho),giving equality. It does not display a complete tagged-partition approximation/error argument for that representation; Riemann–Stieltjes existence and norm facts are imported from references6/8. This record does not claim a full independent reconstruction of the Mizar proof (pp.182–184). The positive-length condition excludes a real failure case for the displayed integral formulation: on singleton[a,a],evaluation of the constant1 is1 while every usual zero-length Riemann–Stieltjes increment sum is0. This is a reading inference explaining the explicit restriction,not a printed paper example. No representation claim for singleton intervals is inferred from the weaker interval definitions (Theorem16). The construction uses norm-preserving Hahn–Banach existence,not an executable integration/functional-extension algorithm. No numerical example,finite-dimensional benchmark,proof-size/check-time statistics,checker transcript or experiment appears. Eleven references include bounded/continuous function algebras,Hahn–Banach and Stieltjes integration libraries plus analysis texts; those dependencies were not independently read for this record. All six pages,three definitions,16 numbered results/all clauses/sketches,11references/date/funding read; no figures/tables/footnotes/appendices. Exact quotes preserve raw integral layout,rho rendered %,≤ rendered ¬,restriction U+0016,and U+0003 proof-end glyphs. Renderings checked. No source/checker execution,distributed protocol,Verus/Rust/TLA+ or LLM proof/specification-agent evaluation.
  • how much was read: most of it read
  • source
  • record id: narita-nakasho-shidama-dualsp05-riesz-2017-2017
• Parameterized leader-election abstraction for FTSP (2017)
  • title: An Abstraction Technique for Parameterized Model Checking of Leader Election Protocols: Application to FTSP
  • what: Develops a simulation-preserving abstraction for parameterized timed leader-election protocols with unique identifiers and arbitrary topologies. It abstracts non-leader nodes and network edges around a shortest path to the future leader, approximates clock drift with finite schedulers, and incrementally checks FTSP root election for all graphs bounded by leader distance K. The method first maps identifiers/messages to future-root versus non-root values and relaxes irrelevant sequence/entry variables, then completes the graph outside a chosen shortest path and merges those nodes into an environment process. Simulation lemmas establish that checking the finite abstract model implies LTL properties on every topology in G_K. Approximate-synchrony scheduler S_a(Δ) over-approximates real clocks for a finite horizon derived from σ_l,σ_u,Δ. An incremental proof initializes already-converged path nodes and uses a non-interference guard to remove spurious environment messages. A NuSMV semi-algorithm finds optimal FG bounds without storing all reachable states.
  • number: synchronous K=7: N=107 in 13 minutes; includes 13×13 (169-node) and 13×13×13 (2197-node) grids
  • number: asynchronous K=5: N=63 in 65 minutes; includes 81-node 2D and 729-node 3D grids
  • number: table bounds: K=1 N=8, K=2 N=14, K=3 N=23 synchronous/25 asynchronous, K=4 N=35/39
  • number: clock-rate guarantee for N=107 with periods [29.7,30.3], corresponding to ±1% rates
  • limits: FTSP broadcasts are assumed to complete before the next send event; nodes start in arbitrary configurations and no faults occur during the recovery window. Clock periods lie in [σ_l,σ_u], and finite approximate-synchrony simulation only covers a bounded execution horizon. The abstraction over-approximates behavior, so spurious traces require guard strengthening and proof of the non-interference lemma. Results concern FTSP root convergence, not full time synchronization or failures during the checked interval; asynchronous K=5 timed out beyond that range.
  • how much was read: most of it read
  • record id: parameterized-leader-election-abstraction-for-ftsp-2017
• Paxos Made EPR (2017)
  • title: Paxos Made EPR: Decidable Reasoning about Distributed Protocols
  • what: The paper transforms Paxos-family models so that checking a human-supplied proof falls in EPR. EPR is a first-order fragment where satisfiability is decidable (an algorithm always answers). It checks proofs. It does not discover invariants.
  • number: Six variants: Paxos, Multi-Paxos, Vertical Paxos, Fast Paxos, Flexible Paxos, Stoppable Paxos
  • number: Verified six protocol variants with EPR transformations
  • number: Z3 experiments repeated 10 times, 300s timeout, Linux Core-i7 1.8GHz
  • number: EPR verification conditions solved in a few seconds with no timeouts; semi-bounded runtimes grew with rounds; unbounded Z3 diverged
  • limits: Z3 did not terminate on unbounded checks of the original models. The URL of the original artifact returns 404, and the review notes found no verified copy.
  • how much was read: most of it read
  • source; notes: Paxos Made EPR
  • record id: paxos-made-epr-2017
• Safegame multiplayer game model checking (2017)
  • title: Model Checking in multiplayer games development
  • what: Defines a parameterized multiplayer-game model, translates it to a finite Kripke structure and NuSMV model, and presents Safegame for generating/reducing models and checking CTL/LTL properties on the Penguin Clash game. The game tuple includes actors, finite integer attribute vectors, parameters, action functions, collision operators and an evolution operator; simultaneous actions are partitioned by affected attributes and collision operators resolve conflicts. The resulting Kripke structure has states V, initial states Vinit and transition relation from evolution. Safegame templates substitute generated action/parameter expressions from YAML specifications and test-case modules, allowing projections/removal of irrelevant actions as a property-preserving reduction. In the reduced Penguin Clash model, NuSMV verifies reachability/death and collision properties, but finds a counterexample to the universal eventual-collision property because a dead first penguin and stationary second penguin can never collide. The full target NFA has about 10^9 states and verification takes roughly 2.5 hours.
  • number: approximately 10^9 target-NFA states
  • number: about 2.5 hours verification
  • number: four CTL properties: 3 pass, 1 counterexample
  • number: finite integer attribute domains
  • limits: Attributes are finite integer ranges, making the model finite but potentially huge; actions and collisions must be expressible as first-order formulas and generated templates. Reduction is claimed equivalent only for the selected property and can omit behavior relevant to other properties. The case study uses a simplified two-penguin scenario and NuSMV model generation, not the full commercial game or runtime code. Results are one machine/time measurement, and probabilistic/game-theoretic extensions are future work.
  • how much was read: most of it read
  • record id: safegame-multiplayer-game-model-checking-2017
• Social Network Model Checking (2017)
  • title: Model Checking Social Network Models
  • what: Defines social network models (SNMs) with users, relations and individual knowledge bases, and gives a model-checking algorithm for the epistemic language KBL. Under finite domains and computable functions, checking is decidable; knowledge axioms and translations to canonical Kripke models are proved sound and satisfaction-preserving. The algorithm expands finite quantifiers, evaluates functions, and delegates Ki subgoals to epistemic reasoning over each agent’s knowledge base. The paper proves KD4 soundness, common/distributed-knowledge rule soundness, an SNM-to-Kripke transformation, a marked reverse construction, and a complexity inequality showing local SNM checks are cheaper than building the complete canonical model.
  • number: Theorem 1: SNM KBL model checking decidable
  • number: canonical Kripke model size at most 2^|φ|
  • number: SNM local-check complexity strictly below complete canonical-model checking
  • number: illustrative Charlie query: at most 2^4+5 versus 2^(4+14+12)+5 steps
  • limits: Decidability assumes all domains finite and all functions computable. Knowledge bases must satisfy the paper’s consistency/self-awareness assumptions; negative introspection A5 is not sound. The complexity comparison excludes common and distributed knowledge and uses quantifier-free formulas without functions. Arbitrary Kripke models are only conjectured to translate back.
  • how much was read: most of it read
  • source
  • record id: social-network-model-checking-2017
• Starling concurrency views (2017)
  • title: Starling: Lightweight Concurrency Verification with Views
  • what: Introduces Starling, a lightweight proof-outline logic and tool for concurrent algorithms. Views are linear invariant units held by threads; constraints define their shared-state meaning and interactions. Starling translates outlines through the sound Views metatheory into finite verification conditions discharged by Z3 for shared variables or GRASShopper for heaps. ARC specifications use arc() tokens, countCopy constraints and iterated views to express reference ownership and prevent use-after-free; both shared-variable and heap implementations are verified. The Views rule preserves frames and parallel interference; defining functions and downclosure reduce arbitrary context quantification to finite proof terms, with a core rule over weakest contexts. Examples include Rust ARC, spin/ticket/reader-writer locks, Peterson, CLH queue-lock and lock-coupling list (memory safety, not linearizability).
  • number: SMT ARC: 40/40 proof terms, 1.62 s
  • number: GRASShopper CLH: 1,407 terms, 21 sent, 3.87 s
  • number: lock-coupling list: 5,019 terms, 35.31 s
  • number: 8 GB RAM dual-core Intel i5 benchmark machine
  • limits: Soundness relies on the pre-existing Views framework and valid monoid/reification/axiom-soundness conditions. Context reduction requires reification monotonicity and finite defining functions; iterated definitions need base and inductive downclosure obligations. Solver support is domain-specific (linear arithmetic SMT or separation-logic GRASShopper). Benchmarks are small hand-annotated proofs; lock-coupling verifies memory safety rather than linearizability.
  • how much was read: most of it read
  • record id: starling-concurrency-views-2017
• SymDIVINE PartialStore (2017)
  • title: SMT Queries Decomposition and Caching in Semi-Symbolic Model Checking
  • what: Introduces state decomposition/slicing for control-explicit data-symbolic model checking. Splitting symbolic states lets SymDIVINE issue smaller SMT equality queries, solve some syntactically, and cache quantified formulas that otherwise repeat. The paper formalizes non-empty state slicing and proves decomposition correctness, then implements PartialStore and SMTStore caching. On SV-COMP benchmarks, it compares baseline SMTStore, caching and PartialStore configurations, reporting solved counts, total times, equality checks and syntactic decisions.
  • number: PartialStore/cache solved up to 57 additional benchmarks in reported comparison
  • number: State slicing can save roughly 40–60% verification time when omitting ECA; under 2% equality queries sent to SMT in favorable categories
  • number: Tables report total time, solved count, equality checks and syntactic decisions
  • number: Correctness theorem 3.6 establishes decomposition equivalence
  • limits: Benefits depend on repeated symbolic parts and diamond-shaped state spaces; slicing can add overhead on small or rarely changing queries. Results include only benchmarks solved within timeout and exclude very easy instances; SMT solver behavior and benchmark categories affect gains.
  • how much was read: most of it read
  • record id: symdivine-partialstore-2017
• VLDL tree-automata reduction (2017)
  • title: VLDL Satisfiability and Model Checking via Tree Automata
  • what: Reduces Visibly Linear Dynamic Logic (VLDL) satisfiability and model checking to emptiness of nondeterministic Büchi tree automata. Infinite visibly-pushdown words are encoded as stack trees; formulas become polynomial-size 1-AJAs and then exponential tree automata via an adapted breakpoint construction. VPS traces are separately encoded and intersected with the negated specification for model checking. The stack-tree encoding folds matched call infixes into right subtrees and keeps a cardinal branch; Theorem 1 proves the encodings form a regular tree language. A VLDL formula is first normalized and translated compositionally to a Büchi 1-AJA, then to a tree automaton recognizing exactly its stack-tree models. The tree construction tracks direct/jump states, verifies guessed nested-infix effects, and uses breakpoint partitions to remove alternation. For a VPS, the model-checking automaton simulates states along the cardinal branch and verifies guessed matching-return states in nested subtrees. The resulting tree automata can use mature Büchi-game emptiness solvers.
  • number: Theorem 2 tree automaton size O(2^|φ|)
  • number: satisfiability ExpTime and asymptotically optimal
  • number: model checking automaton exponential in |φ| and polynomial in |S|
  • number: VLDL model checking ExpTime-complete
  • limits: The alphabet is visibly partitioned into calls, returns, and locals; stack behavior is visibly determined and systems are VPSs. Bounds are asymptotic and depend exponentially on formula size and polynomially on system size; no implementation, benchmark, or empirical comparison is reported. The conclusion says empirical evaluation and improved game reductions remain future work; tool-support claims are prospective.
  • how much was read: most of it read
  • record id: vldl-tree-automata-reduction-2017
• adaptive statistical model checking (2016)
  • title: Faster Statistical Model Checking for Unbounded Temporal Properties
  • what: Introduces SimAdaptive, a black-box statistical model-checking algorithm that monitors simulation prefixes to infer bottom strongly connected components (BSCCs), stopping runs early while retaining confidence guarantees for unbounded reachability, full LTL and mean-payoff properties. A path’s candidate BSCC is defined by a suffix that is a graph BSCC; k-candidates and strong candidates bound false detection using the minimum positive transition probability pmin. Candidate lifetimes and a union bound yield Algorithm ReachedBSCC with error δ, which feeds sequential probability-ratio testing for reachability. The paper extends the construction to LTL and derives mean-payoff estimators with bounded expected error, then proves an expected runtime bound depending on transient depth R, BSCC size B and hitting time T. Prism experiments compare SimAdaptive against topology-agnostic simulation, topology-aware analysis and numerical model checking across huge benchmark chains.
  • number: pmin lower bound required
  • number: α=β=ε=0.01; δ=0.001 reachability
  • number: 1,000-step candidate-check optimization
  • number: runtime bound O(sim · k^(R+B) · B · T)
  • limits: The chain is finite, discrete-time, and sampled from a fixed initial state; a positive lower bound pmin on every nonzero transition is required. Statistical answers are only guaranteed outside an ε indifference region and have α/β/δ confidence parameters. Candidate detection can be slow for deep systems or large BSCCs, with runtime bound O(sim · k^(R+B) · B · T); the implementation checks candidates every 1,000 steps and modifies some Prism models (self-loops for deadlocks, one initial state). The approach is not a replacement for topology-aware methods and extension to MDPs is future work.
  • how much was read: most of it read
  • record id: adaptive-statistical-model-checking-2016
• Alloy meets TLA+: An exploratory study (2016)
  • what: # Alloy meets TLA+: An exploratory study (authored by agents unless marked 🧑) Macedo and Cunha compare a manually embedded hotel locking model in Alloy and TLA+, then measure checking costs with Alloy Analyzer 4.2/MiniSat and TLC 2.08. This is a one-example exploratory study. Their scope is explicit: “using a concrete example” (§1, PDF p. 2, Q6). No general translator, equivalence theorem, implementation proof or named theorem is presented. The source is arXiv1603.03599v1, 11 March2016, 14pages; a further publication venue was not established. ## What the model assumes and checks (authored by agents unless marked 🧑) The front desk is disconnected from room locks. A lock accepts its current key or the next key in its room’s ordered, disjoint keypool; accepting a newer key invalidates the old one. Guests keep keys after checkout. Initially rooms are vacant, guests hold no keys and the front desk’s last-issued key equals the lock’s current key (§§2–2.1, PDF pp. 3–5, Q7–Q11). The authors describe the retained-key behavior directly: “allows the guest to keep the room key” (§2.1, PDF p. 5, Q11). The finite model has no fairness constraint (§3.1, PDF p. 9, Q22). The prose says a guest should enter only its own room. The printed assertion is narrower: “(Entry[t, t’, g, r, k] and some FD.occupant.t[r]) implies g in FD.occupant.t[r]” (Figure 1, PDF p. 4, Q10). It tests entry into an occupied room and allows entry into an empty room. The TLA+ property has the same nonempty-occupant guard (Figure 3, PDF p. 7, Q17). The experiment checks safety; discussion of finite-trace liveness pitfalls is not a liveness evaluation. The counterexample has five states: initialization; g0 checks into r1 with k1; g0 checks out; g1 checks into r1 with k2; g0 enters using k1 before g1 first uses k2 (Figure 2, PDF p. 6, Q15; §2.2, PDF p. 5, Q14). It demonstrates the delay between issuing a fresh key and updating a disconnected lock. The proposed restriction is to “assume that guests enter the room immediately” after check-in (§2.2, PDF p. 5, Q14). NoIntervening therefore changes allowed environment behavior. The authors report no counterexample after adding it in the checked models; this is not a verified implementation repair or an unbounded Alloy proof. The printed models and prose contain a reproducibility mismatch. Figure 1 includes NoIntervening and prints “check NoBadEntry for 3 but 30 Time” (Q10), while §2.2 describes 3 elements/5 Time and a counterexample (Q13), and §4 calls Figure 1 an n = 4/t = 30 model (Q30). Figure 3 also includes NoIntervening in Spec, while Figure 4 shows a counterexample (Q17–Q18). The evaluation explicitly ran with and without the restriction (Q29); the printed restricted listings alone should not be described as producing those unrestricted traces. ## What the embedding exposes (authored by agents unless marked 🧑) The study distinguishes TLA+ expressiveness from TLC’s executable subset (§3, PDF p. 6, Q16). Alloy’s static structures range over possible assignments, while a TLC constant assignment fixes one structure. To preserve the intended search, Room, Guest and keypools are initialized nondeterministically as variables and then held unchanged. Fixing exactly 3 rooms and 3 keys misses this bug because a room needs two spare keys for the successive check-ins (§3.1, PDF p. 8, Q19). This is a concrete example of a checker returning no counterexample after the search universe has been narrowed incorrectly. Alloy’s explicit Time ordering creates exact trace scopes. The authors warn that “there is no guarantee that counter-examples occurring” in smaller traces recur at larger exact scopes (§2.2, PDF p. 5, Q13). They therefore check every scope through t and accumulate the cost. A bound below 5 misses this bug. These are finite trace checks over finite key/room/guest universes, not a parameterized proof. The TLA+ version encodes Alloy facts through TypeInv in Next. The authors separately report checking TypeInv as an invariant and observing preservation by the actions (footnote 2, PDF p. 9, Q23); this is a reported finite-model check. TLC’s enumeration/order/next-state requirements and relational encoding issues constrain the manual embedding (§3.1, PDF pp. 8–10, Q20–Q24). No general derivation algorithm is supplied. Stuttering affects what counts as an observed event. When a registered key is used again, Entry changes no variable: “TLC will not recognize such” steps, “identifying instead a stuttering step” (§3.2, PDF p. 10, Q25). The box-action NoBadEntry accepts stuttering independently of its inner action condition. The paper leaves general action-semantic correspondence unresolved (§5, PDF p. 14, Q37). This record identifies that limit; it does not construct a reachable unauthorized stuttering entry or refute the restricted model. NoIntervening is rewritten from a constraint on three Time instants to a state predicate Post plus the next Entry; stuttering remains allowed and no fairness is added (Figures 1/3, Q10/Q17;Q22/Q27). Deadlock reporting was disabled for finite key exhaustion and state-preserving Entry (§3.2, Q26). No progress or deadlock-freedom result follows. ## What was measured (authored by agents unless marked 🧑) The study used a 1.8 GHz Intel Core i5, 4 GB, OS X 10.10, Alloy Analyzer 4.2 with MiniSat and TLC 2.08. Tests ran “multiple times”; no repetition count, variance or raw trials are supplied (§4, PDF p. 11, Q29). TLC breadth-first and depth-first searches were tested, with depth-first limited to 100. Thus the paper’s general description of unlimited TLC trace length must not be applied to every plotted curve. Figure 5 contains six panels and five series: TLA BF, TLA DF, Alloy, TLA En, Alloy En (PDF p. 12, Q31 and figure-evidence.json). Panels a/b vary n with Alloy t = 30; c/d use the different exact universe; e/f vary t with n = 4. The vertical axis is logarithmic seconds. All panels were inspected; no exact point timings were inferred from raster curves. No error bars or raw trials are provided. Here n denotes exact ordered-key count and maximum room/guest counts. Alloy’s time at t aggregates checks for all scopes 1 through t; BF finds a shortest witness directly (§4, Q30). The authors report that the Analyzer finds the n = 4 counterexample at t = 5 “in less than a second in contrast to TLC’s 415 seconds” (§4, PDF p. 11, Q30). The sentence does not identify which TLC search mode the 415 seconds denotes. This is verification runtime on this model and historical setup, not application latency or a general tool speedup. Generating static configurations is expensive. The original model has 776 initial states at n = 3 and 18,960 at n = 4. A second model fixes exactly n rooms and n guests and uses n + 2 keys, giving 108 and 960 states. The paper explicitly says these universes “are not directly comparable” at the same n (§4, PDF pp. 12–13, Q32–Q33). Do not treat the change as a semantics-preserving reduction of the original universe. A preliminary hybrid uses Alloy to enumerate initial structures and TLC to check each fixed structure. Alloy’s symmetry breaking reduces 18,960 to 520 representatives for n = 4, generated in “less than 2 seconds” (§4, PDF p. 13, Q34). Disabling symmetry recovers 18,960. The partition loses the global shortest-counterexample guarantee and state sharing. For counterexample timings the authors “considered a” portion of the initial states after measuring the fraction that produce a counterexample; neither fraction nor portion/order is supplied (§4, Q35). With NoIntervening they consider all initial states. The hybrid improves some TLC curves; its gains over pure Alloy “are not so evident” (Q35). No proven general translator or symmetry-preservation result accompanies this preliminary comparison. ## What it adds to the requested topic (authored by agents unless marked 🧑) The direct contribution is a detailed historical Alloy/TLA+ modeling comparison with a complete small example and measured checking costs. Distributed algorithms motivate systems with rich structures and dynamics (§1, Q3), but hotel locking is the sole evaluated case. No Verus, verified Rust or LLM experiment appears. For evaluating LLM-written specifications, I infer concrete checks from this example: compare exact versus maximum cardinalities; read the property’s guard; separate an implementation repair from an environment restriction; check event/stutter correspondence; distinguish checked invariants from imposed constraints; compare trace coverage and cumulative timing; retain sampled-state caveats. These are reader-derived evaluation lessons, not measured LLM results. The authors’ own conclusion keeps the main performance limit explicit: “the obvious caveat of the bounded search space” (§5, PDF p. 14, Q37). ## Evidence and limits of this read (authored by agents unless marked 🧑) Read all 649 layout-text lines, all 14 pages, every printed Alloy/TLA+ definition/configuration, five figures including six Figure 5 panels, Table 1 and all 11 references. Inspected seven contact sheets and the fullsize plot page. The bundle retains 38 literal line/character/page-anchored excerpts, 17 reader diagnostics, numeric evidence, visual evidence and hashes. combined.quote-source.txt is the staging source; source_files contains path strings and raw hashes are separate. No separate model/benchmark archive URL was identified in the paper or obtained. No author code, checker, solver or prover was executed, and no serialized scientific/model/results data were loaded. Results are author-reported and statically inspected, not independently reproduced. Historical language/tool claims should not be projected onto current versions.
  • limits: Disconnected front desk/locks; finite ordered disjoint disposable-key pools; guests retain keys after checkout; no fairness. Printed property checks only occupied-room entry. NoIntervening restricts environment behavior. Bounded exact Alloy trace scopes; finite TLC universes and depth-first limit 100. General translation and stutter/event correspondence unresolved. Printed scope/variant mismatch retained.
  • how much was read: most of it read
  • source
  • record id: alloy-meets-tla-an-2016
• alpha-L2S (2016)
  • title: Infinite-State Liveness-to-Safety via Implicit Abstraction and Well-Founded Relations
  • what: alpha-L2S checks that an infinite-state system eventually does something good (liveness). It reduces that question to a safety question, where nothing bad ever happens. It learns the needed predicates and ranking functions (measures that shrink toward the goal) by refining an abstraction. It is the direct predecessor of rlive and its baseline.
  • number: Fig 4: L2Sia-wfr solved 602 (477 valid, 125 violated) vs Ultimate-LTL 263 (185, 78)
  • number: timeout 1200 s, memory 6 GB
  • number: on 193 termination benchmarks T2 solves 191 vs 152 for this method
  • number: 835 total LTL instances
  • limits: It checks liveness on a model. Its benchmarks come from programs, so they test translated program semantics, not the programs themselves.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: αL2S
  • record id: alpha-l2s-2016
• Array Folds Logic (2016)
  • what: Array Folds Logic adds restricted deterministic folds and integer counting to finite unbounded-length integer arrays. Folds translate into reversal-bounded symbolic counter machines; products coordinate folds over the same array and Presburger encodings decide reachability. The paper claims PSPACE-complete satisfiability, NP-completeness for a fixed maximum number of folds per array, and undecidability with existential-universal quantification or concatenation. AFolder solves manually encoded parser, processor-mapping, loop-safety and histogram cases. Records the precise counter/control restrictions, implicit break semantics, model construction, why folds per array rather than total folds drives product cost, and the lack of automatic program-to-formula generation. Preserves all17 measured cases and source discrepancies in example code/formulas, a printed multiplication reduction, signed-value bounds, and a table count. These are reader observations about the chapter, not claims that the implementation or the underlying results have been disproved.
  • limits: §§2–2.2: arrays are finite integer sequences Z*, with natural array indices and integer elements/counters; length and values are unbounded across models. Free array/integer variables are implicitly existential. This models mathematical integers, not source-language bitvector overflow, pointer aliasing or C allocation. Read-over-write axioms are assumed, but out-of-bounds reads are not explicitly assigned a value in the supplied semantics. §2.1/Table1: fold input vector contains initial index and counters, with implicit state initially0. Each step consumes one current element; guards may also use integer terms with fixed array reads such as a[p]. It compares element/index/counter with an integer term and state with a constant, increments/decrements counters by constants, assigns constant control states, and increments index by1. No arbitrary multiplication, counter-to-counter update, arbitrary array mutation inside fold, or general higher-order lambda is allowed. §2.1: branch guards must be mutually exclusive; at most one update per implicit variable in a branch. If no guard matches, implicit break returns the current vector before consuming that element. Out-of-bounds index likewise terminates. Within each control-flow SCC, every counter has only nondecreasing or only nonincreasing updates; SCC changes bound reversals. Dropping this restriction invalidates the stated decision construction. §2.3: expressiveness examples include bounded values, a guessed pivot partition, alternating symbols, equal block counts, equal counts across arrays, histogram ratios, and length-prefixed fields. Sortedness requiring relationships between arbitrary pairs of indices is explicitly inexpressible; counting expressiveness does not subsume quantified array logics. Comparisons to other logics are the authors’ claims about cited contemporary fragments, not a survey of all later systems. §3: parser proof obligations use SSA names, fold summaries for inner loops, and bounded unfolding of the outer column loop. Satisfying formula gives a selected accepted-path test, not a proof of all parser behavior or safety. Last conditional’s failure branch is easy for Crest; accepted branch with required columns is hard. No fully automatic whole-program summarization front end is implemented in this paper. §4/Definitions1–3: SCM has finite control, a shared symbolic input integer per transition, constants/free parameters and counters; its product conjoins guards/input constraints and concatenates counter vectors. Products are needed when folds share an array, since independently satisfiable per-fold runs may require incompatible cell values. Arbitrary differing start/stop indices, negated fold equalities, reads/writes and signed counters need semantic handling beyond simply taking the displayed lockstep product. §4/Lemma1: claimed small model uses exponentially bounded array length and integer values, supporting polynomial-space guessing of parameter values and successive cells while simulating folds. Proof sketch chooses a satisfying Boolean valuation, uses counter regions/modes, compresses runs via integer linear programming and obtains short runs/cell values. Full proof is referred to separate arXiv version [14]. The statement prints an upper bound on signed integers but not an absolute-value/lower bound; the polynomial-bit representation conclusion needs both sides controlled. §4/Theorem1: PSPACE membership uses that small-model argument; hardness reduces DFA-intersection nonemptiness to simultaneous folds over one shared array. This is a formula satisfiability complexity theorem, not measured runtime or a proof of arbitrary array-program verification decidability. No formal proof-assistant mechanization is reported. §4.1: Theorem2 claims undecidability for ∃∀ AFL via Hilbert’s Tenth Problem/multiplication. Corollary1 derives concatenation undecidability using a quoted existing word-equation result (Theorem3) plus definability of unary counts. The printed multiplication encoding has a concrete counterexample recorded below; distinguish the intended result from validation of this displayed proof. §5: deterministic encoding separates nonfold constraints, product-machine reachability and initial/final linking. Counter-bound parameters are assumed in a fixed order. Regions and at most O(|phi|³) modes lead to an NFA, Parikh counts and constraints enforcing counter feasibility; generated Presburger formula has stated size O(|phi|^(m+4)) with at most m folds per array. Handling arbitrary parameter order is not detailed; guessing an order is compatible with NP reasoning but literal deterministic enumeration need not have the same polynomial size. §5/Lemma2: fixed m-AFL is NP-complete; Presburger arithmetic already gives hardness for0-fold formulas. Fixing the total number of folds is stronger than needed. The relevant bound is folds per shared array, after identifying arrays that must be equal; many independent arrays can each have one fold and still avoid one large product. §5 model generation: solve Presburger constraints, instantiate Parikh multiplicities, form a transition multigraph, recover an Eulerian path and choose cell values satisfying associated input constraints. This is witness construction as described, not independent solver-certificate checking. Materializing an exponentially long array can cost more than deciding existence. §6: AFolder is C++ with Z3 Presburger backend. Ubuntu14.04 64bit/IntelCorei5-2540M2.60GHz. Formula size counts logical operators plus branches, not source LOC or bits. Table has17 selected instances,10sat/7unsat, no reported timeouts or run variance. Translation/solving times are separate; array length is longest array in a sat model. No current repository build, proof-kernel check or independent model replay was performed. §6/SV-COMP: six simple manually modeled safety conditions are UNSAT below1s translation and below1s solving each. Authors state most competing SV-COMP tools fail them, but provide no side-by-side tool list, configuration or comparative timing table in this chapter. These results do not establish an end-to-end safe verdict for every source program absent correctness of its encoding. §7: automated proof-obligation generation and loop summarization, combinations with other decidable array fragments and implementation optimizations are future work. IPv6/TLV is motivation, not a verified network protocol case study. NUMA example counts processor assignments per thread; no concurrent scheduling, distributed protocol, Rust/Verus/TLA+ or LLM proof-agent evaluation is given.
  • how much was read: most of it read
  • source
  • record id: array-folds-logic-2016
• Automatic Abstraction in SMT-Based (2016)
  • title: Automatic Abstraction in SMT-Based Unbounded Software Model Checking
  • what: Spacer combines under-approximation 2BMC, proof-based abstraction and CEGAR in Horn-SMT/Z3. Alternates abstraction, feasibility and refinement; UNSAT proofs generalize safety while concrete counterexamples preserve bug guarantees.
  • number: 1990 initial; 608 evaluated; 369 unsafe solved by both; 42/55 hard safe solved within 15m
  • limits: No bit-vector/heap support; abstraction may hurt easy cases; results solver/time bounded.
  • how much was read: most of it read
  • record id: automatic-abstraction-in-smt-based-2016
• Automaton learning for infinite safety games (2016)
  • title: An Automaton Learning Approach to Solving Safety Games over Infinite Graphs.
  • what: Learns finite-state winning controllers for safety games over infinite or very large graphs. Rational arenas encode vertex sets as regular languages and edges as rational relations; an ICE-like teacher returns positive, negative, existential-implication or universal-implication counterexamples, and a SAT-based learner constructs minimal consistent DFAs. The paper proves closure properties of rational relations, defines winning sets and a generic automata-theoretic teacher, and gives SAT encodings whose satisfiability is equivalent to existence of an n-state DFA consistent with the sample. The minimal-consistent-DFA algorithm increments n and terminates at the minimum; the full learner terminates with a winning set when one exists. An RPNI heuristic is sound but incomplete and restricted to finite out-degree. Examples include unary encodings of grid positions, implication counterexamples, diagonal/box/evasion/follow games and program repair.
  • number: SAT learner solved all infinite-arena games; RPNI all but Follow
  • number: 9×9 planning: 7.8 s SAT, 2.1 s RPNI, 5.4 s TuLiP
  • number: RPNI m=50,000; SAT m=30,000; TuLiP m=10,000
  • number: 300 s timeout and 16 GiB memory
  • limits: Winner determination for rational safety games is undecidable, so the method is a semi-algorithm and assumes a winning set exists for the termination theorem. The SAT learner’s passive DFA identification is NP-complete in general; RPNI cannot guarantee minimality or completeness and handles only finite implication languages. Experiments use regular-language/transducer encodings and finite-state safety objectives; results do not establish liveness synthesis or arbitrary infinite-state game classes.
  • how much was read: most of it read
  • source
  • record id: automaton-learning-for-infinite-safety-games-2016
• BMC Probabilistic Programs (2016)
  • title: Bounded Model Checking for Probabilistic Programs?
  • what: Develops an on-the-fly bounded model-checking method for conditional probabilistic programs. Each finite unrolling constructs a finite operational MDP, and monotonic growth of conditional reachability probabilities and expected rewards yields sound lower bounds; parametric iterations can permanently classify valuations that already violate a property. The paper gives SOS semantics for a cpGCL language with probabilistic/nondeterministic choices, observations, divergence and post-expectation rewards. It treats universal scheduler semantics for MDP properties and explains finite expansion, model-checking calls and parameter-valuation elimination. Five benchmark families (Crowds, Herman, Robot, Predator, Coupon Collector and observation variants) show that useful bounds can arise before full expansion, while expected-reward queries currently permit only one unfolding step.
  • number: five benchmark families; examples with millions of states and infinite operational models
  • number: most probability queries exceed 90% of the full-model value after few unrollings
  • number: largest crowds-obs expands 3·10^6 states over three iterations
  • number: coupon-obs(5) reaches a precise expected-value lower bound after about 60,000 states
  • limits: Finite unrollings provide lower bounds and do not by themselves prove convergence or termination for unbounded loops; the method may time out or return only trivial bounds. Universal scheduler treatment can be conservative, and observe statements can make exploration harder. The prototype expands at most 10^6 states per model-checking call, uses a 3600-second timeout, and cannot yet handle more than one unfolding for expected values.
  • how much was read: most of it read
  • record id: bmc-probabilistic-programs-2016
• Bounded Model Checking and Feature Omission Diversity (2016)
  • what: Introduces swarm bounded model checking: run parallel BMC instances on program variants that omit randomly selected trace features, producing smaller constrained SAT problems and often faster counterexamples. The method defines features as log events, replaces retained/omitted logging behavior with assumptions, propagates constraints and slices, and explains the one-sided nature of results: a counterexample in any restricted program is valid for the original, but absence in all variants is not a proof unless coverage conditions hold. Small CBMC experiments cover a stack overflow, Array-Queue and Stack List faults, with and without slicing and parallel configurations.
  • number: stack example with slicing: default 49s, omit push 4s (verified), omit pop 14s counterexample, omit top 48s counterexample; no-slicing default 325s
  • number: stack swarm found a counterexample up to 71% faster
  • number: all Array-Queue omission configurations beat default at depths 1000–5000 with and without slicing
  • number: runs use CBMC 4.0 on four-processor Intel 2.8GHz/8GB RAM
  • limits: Feature omission can remove behaviors and therefore cannot establish full-program correctness by itself; BMC remains bounded by trace depth. Benefits depend on faults having short feature traces, independent runs, enough memory/cores and useful slicing. Experiments are preliminary, small C data structures, CBMC 4.0 and a four-core 2.8GHz/8GB machine; future work explicitly calls for larger systems and specialized slicing.
  • how much was read: most of it read
  • record id: bounded-model-checking-and-2016
• CCSroll safety and liveness (2016)
  • title: A Safety and Liveness Theory for Total Reversibility?
  • what: Defines CCSroll, a CCS extension with totally ordered keyed reductions and programmed rollback, and characterizes safety and liveness preorders using forward traces, rollback barbs and tree refusals. The syntax/semantics records memories and dependency histories so a rollback of key k deterministically returns all later reductions to the state before k. The authors prove rollback determinism and rollback/forward correspondence, then identify two semantic properties enabling forward-only reasoning. Observable trace inclusion is shown sound and complete for inverse may-testing safety; a rollback-aware tree-refusal model is sound and complete for should-testing liveness. Examples M1–M6 show safety conservatively extends CCS while rollback distinguishes systems that CCS cannot distinguish; the paper also gives compositional LTS, trace zipping/unzipping, and characteristic tests.
  • number: two semantic properties underpin forward models
  • number: Theorem 1 safety conservativity
  • number: Theorem 3 trace soundness/completeness
  • number: Theorem 4 refusal soundness/completeness
  • limits: CCSroll reductions are totally ordered, rollback is controlled by explicit rlh keys, and proofs rely on the two stated reachability properties, including the difficult liveness property. Liveness should-testing is justified under a fairness assumption that infinitely enabled outputs eventually happen. Results are semantic theorems, not mechanized proofs or implementation measurements; the authors leave applicability of the second property to other causal-reversibility calculi open. The theory concerns CCS-like processes and does not model data, failures or real distributed timing.
  • how much was read: most of it read
  • record id: ccsroll-safety-and-liveness-2016
• Counterexample Guided Abstraction Refinement for Stability Analysis (2016)
  • what: Presents CEGAR for Lyapunov stability of polyhedral switched systems. Weighted facet graphs bound distance amplification; cycles with product>1 are candidate instability witnesses. Uses a one-cycle collinear endpoint formula to seek genuine divergent repetitions, then refines either connectivity or exact worst-case amplification when the cycle is spurious. Implements validation/refinement over Averist and compares selected synthetic3–5dimensional examples against uniform predicate refinement. Reading identifies missing origin/time-progress conditions and gaps in printed fixed-point/refinement arguments; artifact behavior is not inferred. Defines unweighted/weighted reach operators, distinction between nonexistent infinite cycle and unattainable repeated edge maxima, potential-execution strict refinement, and a Kakutani-based proposed finite validation proof. Two different separator refinements target these distinct failure causes. Complete tables preserve stable/unstable/inconclusive outputs and component timing/experiment-label inconsistencies, rather than treating every abstract growth cycle as concrete instability or every refinement as globally terminating.
  • limits: PSS has finite locations/edges, continuous state R^n, compact convex sets of allowed derivative vectors, polyhedral invariants/guards, and no state resets at switches. Origin is assumed an equilibrium. Local Lyapunov stability means every execution starting within a suitable delta-ball stays within each epsilon-ball; it does not require convergence to the origin or asymptotic stability. Extending from nonlinear/linear systems requires a sound PSS abstraction not established by experiments here. Normal form assumes invariants/guards closed under positive scaling; it is justified by local behavior near origin with prior work[20,21]. Repeating a spatially scaled trajectory for constant derivative sets generally scales its duration as well. Scaling and initial-region restrictions must preserve the exact derivative/invariant/guard semantics; this is more specific than arbitrary hybrid dynamics. Definitions 6–8 do not require the region/facet partitions to be scaling closed. Proposition 2 nevertheless infers that f0 is scaling closed from the normal form of H. For example, Inv=R can be partitioned at x=1 while respecting H. Scaling preserves trajectories in H but need not preserve their membership in the same facets/cycle. A scaling-closed partition/facet condition needs to be added to justify that step; this is a printed proof-side-condition issue. Graph nodes are(location,facet), edges cross a common region when reach relation is nonempty, and weight is supremum of infinity-norm endpoint ratio. Prior results supply polyhedral reach relation/weight computation. Abstract paths overapproximate concrete amplification, but matching existential edges need not concatenate from compatible points, and separate edge suprema need not be jointly attainable. Theorem1 explicitly permits every simple-cycle product<=1 plus no exploding region; abstract counterexamples require product>1. Introductory discussion instead mentions absence of cycles with product>=1. Preserve theorem’s non-strict stable condition, not the intro paraphrase. In2dimensions necessity/sufficiency is attributed to[23]; higher-dimensional criterion is only sufficient. Ratios norm(y)/norm(x) require a nonzero initial point, but displayed weighted operators and edge-weight definitions do not state that restriction. Closed positive-scaling cones include origin. Explosion criterion P intersect Flow(q) nonempty also needs a nonzero direction convention: intersection containing only zero does not yield an unbounded trajectory. These origin conventions are important missing details, not an independently inspected Averist behavior. Printed psi_pi(m) existentially chooses points satisfying one-cycle reach constraints and x_k=mx_0, with m>=0; it does not explicitly require x_0!=0 or normalization. If the zero-to-zero relations are admitted, all-zero points satisfy every m including m>1 but do not diverge. V1’s geometric repetition therefore needs a nonzero/progress restriction beyond the displayed formula. No concrete tool false-positive is claimed. Theorem2 V1 gives a sufficient expanding witness; V2 uses absence of any collinear return to exclude complete executions; V3 distinguishes some return with no expanding return from a weight-respecting complete execution. It does not state that absence of m>1 alone disproves every possible divergent cycle execution. Algorithm appropriately refines rather than declaring Stable at failed validation. Treating this as full exact decision of all divergence would overstate the printed implications. Complete execution means time domain[0,infinity). Definition10 only requires a nondecreasing sequence of cycle times, not t_i tending to infinity. Repeated points can have zero-duration transitions unless excluded. In V3 proof with0<m<1, scaling a finite traversal with durationT yields total timeT/(1−m), not a complete infinite-time execution; an additional continuation/time-progress argument is needed. Paper does not provide one. This is a proof gap, not an executed artifact result. Proposition2 invokes Kakutani on S=Kernel(pi) intersect closed unit ball. A nonempty closed scaling cone contains zero, and the theorem does not ensure a nonzero fixed point. Thus s=0 does not establish divergence of K^js. If zero is excluded instead, closedness/compactness claimed for the kernel needs a different normalization. Merely switching to unit sphere loses convexity; a valid nonzero convex cross-section would need justification. The proof asserts WPreReach preserves convexity and closedness, but an exact infinity-norm ratio constraint is not generally convex without restrictions on norm sectors/facets. Reader predecessor relation: x1,x2>=0 and y=(x1+x2,0), with weight 1 and target set R^2. Predecessors (1,0) and (0,1) satisfy norm(y)=norm(x), but their midpoint (.5,.5) does not. This convex conical relation is not a complete PSS counterexample; it shows why additional sector properties must justify the assertion. Theorem4 states eventual emptiness of predecessor iteration when no complete execution exists, but no proof is given here. Subsequent separator prose alternates between empty intersection and intersection{0}. Refinement needs separation outside origin, consistent reach/zero conventions and strict potential-set removal; the generic fixed-point claims cannot be accepted solely because predecessor sets are polyhedral. Termination of each such iteration is distinct from termination of the entire CEGAR loop. Visible Definition6 omits i!=j in disjoint-interiors condition; interpreted literally at i=j it would force every region interior empty. Definition10/indexed predecessor formulas also have inconsistent modulo/index notation. Interpret intended distinct regions/cyclic indexing explicitly. Visible nonempty edge condition, Kakutani nonempty values and C1 leaving epsilon-ball use negation symbols lost by raw extraction; those are not printed defects. Refinement maintains original region partition and splits facets. Definition12 requires graph simulation with nonincreasing weights; strictness adds Pot(A_new) proper subset Pot(A_old). A finer facet partition alone does not imply strict semantic progress. Unweighted refinement removes incompatible edges when no complete cycle exists; weighted refinement lowers an unattainable worst-case weight when some cycle execution remains. Strict progress at one iteration does not prove a finite number of refinements suffices. Implementation is Python2.7.3,Z3 for polynomial first-order witness constraints,PPL for polyhedral operations,Averist for initial abstraction/model checking. m*x introduces bilinearity; efficient solving is measured on selected examples, not a polynomial-time guarantee for arbitrary NRA. No CPU/RAM/OS, solver versions, seeds, repeated trials, numeric tolerances, public artifact link or independently replayed witness is supplied. Benchmarks are variants of one synthetic3Dexample with altered flows, extended to4/5dimensions. Figure1 uses conical/pyramidal regions A–F and a z=1cross-section with z_dot1; actual complete model/flows are not enumerated numerically. They are not representative deployed-control evaluations or arbitrary nonlinear systems.2NScases serve as instability checks; no machine-checked soundness proof is provided. Table1 eleven rows:8Stable,2Unstable,1NoAnswer; dimensions3forrows1–8,4for9–10,5for11. Nine supplied Stab labels areY,twoN. Experiment3 exits on an exploding region, componenttimes0,total.15s; experiment5 validates instability with no refinement. Experiment4 is stable-labeled but unresolved after11iterations; NA is not instability and does not establish that the underlying method would never terminate. Iteration limit is 11. Ans description first mentions a preset time, while experiments/conclusion use an iteration cutoff. Table 2 says the baseline stops when running time exceeds 5 times CEGAR total. Reported baseline totals exceed that factor; the paper does not fully specify whether accounting is cumulative or per run, or how the cutoff is enforced. These are unequal stopping policies and baseline noncompletion, not eventual successful baseline runtimes. Table1 experiment6 prints abstraction12.55s and total5.72s, inconsistent if both are cumulative components of the same run. Preserve both and mark unspecified accounting/printing issue, not silently recalculate. Other totals also need not equal component sums because overhead is unreported. Table2 repeats5.72s for the151region/twoiteration run. Table2 experiment labels read2,2,3,4,5 with StabY throughout, whereas matching CEGAR region/iteration/time tuples map by inference to Table1rows2,4,6,7,9. Do not join by printed Exp alone or overwrite labels. Allfivebaseline rowsNA;CEGARfourS/oneNA. The first comparison uses85250regions/10658.26s versus287regions/204.50s. Claimed benefit is supported on selected cases, with no all-model completeness/fair-runtime claim. Relevance is validation of infinite liveness-like witnesses, abstraction spuriousness, separating local refinement progress from termination and preserving formula/proof/evaluation limits. No LLM specification/proof writing, Verus/verifiedRust,TLA+or distributed protocol/implementation result. Asymptotic stability/general classes are future work. Prior proofs/artifact not read/run.
  • how much was read: most of it read
  • source
  • record id: counterexample-guided-abstraction-refinement-2016
• cPJMP safety abstraction (2016)
  • title: Safety Verification of Continuous-Space Pure Jump Markov Processes
  • what: Characterizes bounded-time safety probabilities for continuous-space pure jump Markov processes, embeds them into a discrete-time Markov process, and abstracts that process to a finite DTMC with explicit error bounds under regularity assumptions.
  • number: N=8
  • number: 3.2×10^7 states for 4×10^3 bins each
  • number: error bound 0.23
  • number: 6,400-state coarse grid
  • limits: The process is measurable, pure-jump, right-continuous and non-explosive; the rate measure is bounded and has no self-jumps. Uniform convergence requires a bounded integral rate. Finite abstraction error requires a metric state space, bounded Lipschitz jump rate, and a jump kernel with a jointly measurable Lipschitz density. The case study uses piecewise-constant thermostat dynamics; meaningful bounds can require very large DTMCs and are conservative.
  • how much was read: most of it read
  • record id: cpjmp-safety-abstraction-2016
• Debois Hildebrandt Slaats Yoshida session liveness (2016)
  • title: Type-Checking Liveness for Collaborative Processes with Bounded and Unbounded Recursion
  • what: Extends binary session types with required-response annotations and a typing system for a process calculus with communication, internal/external branching, bounded iteration, and unbounded recursion. It proves that lock-free well-typed processes satisfy request-response liveness without state-space exploration. Defines response-aware labeled transition systems and responsive traces; proves strict language expressiveness over standard session types using a type requiring both labels infinitely often; gives subject reduction and liveness typing rules tracking accumulated selections, invariants, and pending obligations through recursion and conditionals. The main proof uses syntactic under-approximation A(P), decomposition of parallel traces, fairness/lock-freedom, and shows every requested response eventually appears. A shopping-cart/invoice process and an infinite-state data object illustrate checkout→invoice and write→read obligations.
  • number: strict inclusion of standard session-type languages in response-type languages
  • number: Theorem 6.19 liveness under lock-freedom
  • number: request/response labels AI, RI, CO, DI, SI in shopping-cart example
  • limits: Binary sessions only, no delegation/name passing or multi-party extension. Liveness theorem explicitly assumes process lock-freedom; typing recursive processes requires guessing suitable invariants. Data-dependent unbounded loops are not inferred automatically; bounded iteration is used to remove a dependency. The calculus abstracts BPMN and omits value types. No implementation benchmark or empirical evaluation; evidence is formal definitions, examples, and proofs.
  • how much was read: most of it read
  • record id: debois-hildebrandt-slaats-yoshida-session-liveness-2016
• Disk-based MDP checking (2016)
  • title: Explicit Model Checking of Very Large MDP using Partitioning and Secondary Storage
  • what: Presents disk-based explicit MDP model checking: partition state spaces, store sparse partitions sequentially on secondary storage, and run block-iterative value iteration for reachability/expected rewards. Implemented in the Modest Toolset, it reaches models up to 3.5 billion states. Partition exploration and value iteration share layout, minimizing random I/O; compression preserves runtime. Memory bounds depend on largest partition rather than total states. Time-bounded real-time models avoid the usual time-bound state explosion when partitions are balanced.
  • number: Largest model about 3.5 billion states; explored/analyzed in under 8 hours
  • number: Intel Core i7-4650U evaluation; partition sizes and memory in Table 1
  • number: Compression reduces storage without runtime impact
  • number: Time-bound explosion neutralized on tested real-time models
  • limits: Performance hinges on balanced partition function and sequential storage; poorly distributed transitions increase I/O and memory. Disk capacity and bandwidth become bottlenecks. Explicit MDP analysis does not provide symbolic proofs and supports selected reachability/reward properties.
  • how much was read: most of it read
  • record id: disk-based-mdp-checking-2016
• Dynamic Reductions for Model Checki (2016)
  • title: Dynamic Reductions for Model Checking Concurrent Software
  • what: Extends Lipton reduction with dynamic transactions and bisimulation; symbolic BMC and IC3 encodings use runtime mover/lock heuristics. VVT instruments phase variables and dynamic guards, preserving bisimulation; evaluates hash tables, dynamic locking, load balancing and SVCOMP.
  • number: Load balancing 15m->97s for 2 threads; dynamic handles 6 BMC/>7 IC3 lookup threads; 4 runs/instance, 1h timeout
  • limits: Benefit depends on workload; all-mutating threads gain little; SVCOMP unbounded threads capped at three; one-hour limits.
  • how much was read: most of it read
  • record id: dynamic-reductions-for-model-checki-2016
• FACT (2016)
  • title: FACT: A Probabilistic Model Checker for Formal Verification with Confidence Intervals
  • what: Introduces FACT, which computes statistically valid confidence intervals for PCTL and reward properties of parametric discrete-time Markov chains whose unknown transition probabilities are estimated from transition counts. It combines PRISM symbolic verification, simultaneous parameter confidence intervals, convex optimization, and optional hill-climbing allocation of confidence levels. Defines an extended PRISM PMC language with param declarations carrying observed transition counts and independent parameter sets. The verification pipeline first derives a rational function for the property, then computes simultaneous intervals at α^(1/m) per parameter set, solves a convex optimization for the property interval, and optionally reallocates α_i to narrow it. The modular Java architecture wraps PRISM, Kwong–Iglewicz intervals, YALMIP, and hill climbing. Supported formulas are non-nested PCTL P=? [Ψ] plus all PCTL reward forms; case studies cover web, tele-assistance, low-power wireless bus, bounded retransmission, and Zeroconf protocols.
  • number: 11 PCTL/reward properties across 5 models
  • number: up to 5 parameter sets and 13 parameters (Web)
  • number: confidence-level heuristic reported up to 14% interval-width reduction
  • number: BRP confidence interval synthesis 31.6 s
  • limits: Parameter sets must be statistically independent; transition observations must cover all outgoing transitions satisfying each guard. Current FACT handles discrete-time PMCs and non-nested probabilistic PCTL (plus rewards), not arbitrary nested formulas. The α^(1/m) allocation is conservative and may be widened; hill-climbing can reduce width by up to 14% but is time-consuming and off by default. Confidence intervals quantify sampling uncertainty, not model-structure or observation bias; implementation depends on external PRISM/MATLAB/YALMIP components.
  • how much was read: most of it read
  • source
  • record id: fact-2016
• Formal Verification of Monad Transf (2016)
  • title: Formal Verification of Monad Transformers
  • what: Tycon Isabelle/HOLCF formalizes polymorphic Haskell constructor classes and error, writer, resumption monad transformers. Deflation/domain model avoids first-class polymorphism; automation instantiates Functor/Monad classes and proves transformer invariants.
  • number: 3 transformers formalized; no numeric benchmark
  • limits: Pure lazy Haskell semantics; laws may require datatype invariants; no performance benchmark.
  • how much was read: most of it read
  • record id: formal-verification-of-monad-transf-2016
• Ivy repository (2016)
  • title: Ivy: Safety Verification by Interactive Generalization
  • what: Ivy is a research tool for interactive development of protocols and correctness proofs, with interactive visualization of automated proofs and a human/tool workflow for exposing errors.
  • number: Bounded verification about 10 transitions in a few minutes
  • number: Pages 614-630
  • limits: README is brief and points to the website for details.
  • how much was read: most of it read
  • source; notes: tools
  • record id: ivy-repository-2016
• Limit-deterministic Büchi automata for LTL (2016)
  • title: Limit-Deterministic Büchi Automata for Linear Temporal Logic
  • what: Gives a direct compositional translation from full LTL to limit-deterministic Büchi automata (LDBA). A nondeterministic initial component tracks after-formulas and guesses eventually true G-subformulas; a deterministic accepting component uses breakpoint G-monitors and auxiliary monitors to check the guess. The construction supports the standard quantitative MDP model-checking algorithm by encoding jumps as product actions. The construction defines Reach(ϕ) via the after-function modulo propositional equivalence, then builds one deterministic G-monitor for each guessed G-subformula and a product of monitors, plus an auxiliary monitor for the G-free residual. Stable sets characterize which G-subformulas eventually hold; Lemmas 4–8 establish monitor/product correctness and Theorem 1 proves language equivalence. Theorem 2 gives a double-exponential lower bound. Theorem 3 proves that the LDBA can be used directly in quantitative MDP checking by delaying the jump until a BSCC determines the eventual G-set. Optimizations remove sinks/transient jumps and simplify monitor states.
  • number: Reach and automata size upper bound double exponential in formula length
  • number: double-exponential lower-bound family
  • number: 4 GB memory and 5 min timeout per tool
  • number: 359 cumulative benchmark formulas
  • limits: Input LTL is in negation normal form without Release (Release can be expanded, potentially exponentially for syntax trees); formulas are interpreted over infinite words. The translation is double exponential in the worst case and has a matching lower-bound family. Quantitative correctness relies on the automaton’s only nondeterminism being jump transitions and on BSCC arguments for finite MDPs; no implementation-level memory or runtime guarantees are provided. Experimental comparisons are tool/timeout dependent.
  • how much was read: most of it read
  • record id: limit-deterministic-bu-chi-automata-for-ltl-2016
• Maximal Specification Synthesis (2016)
  • what: Given an incomplete program and a desired postcondition, this work derives the most permissive assumptions about unknown callees that still prove the client’s property. It solves by trying candidates and refining them from counterexamples.
  • number: six Windows-driver variants; 6-7 procedures; 1 to 184 seconds for initialization constraints
  • limits: It covers the safety of an imperative model. It does not prove that real libraries meet the assumptions. It is not an LLM system. Drivers abstract the heap.
  • how much was read: most of it read
  • source; notes: Maximal Specification Synthesis
  • record id: maximal-specification-synthesis-2016
• Model Checking C Programs with Loop (2016)
  • title: Model Checking C Programs with Loops via k-Induction and Invariants
  • what: Combines k-induction base/forward/inductive checks with affine polyhedral invariant inference for C loops. Iteratively increases k and injects inferred pre/post constraints; compares invariant and no-invariant implementations on loop benchmarks.
  • number: Polyhedral variant solves more tasks (abstract); exact table unavailable
  • limits: Affine domains omit nonlinear, heap and bit-vector invariants; bounded/solver limits can return unknown.
  • how much was read: most of it read
  • record id: model-checking-c-programs-with-loop-2016
• On Creation and Analysis of Reliability Models by Means of Stochastic Timed Automata and Statistical Model Checking: Principle (2016)
  • what: Builds reliability models in UPPAAL SMC from reusable stochastic timed automata for fault-time distributions, dynamic fault generators, fault lifetime/behavior and broadcast failure signaling. Replaces Markov failure-rate edges by waits for corresponding failure signals. Combines branches approximating bathtub failure distributions; dynamically spawns permanent/transient/intermittent fault processes and tracks active counts; maps several generators to shared fault definitions. Demonstrates TMR degradation by remembering the first failed replica and waiting for a different replica’s failure, with a probabilistic single-point-failure branch.
  • number: 3 fault behavior types
  • number: TMR uses 3 replica failure channels
  • number: selected trace examples use 1 simulation run
  • number: trace horizons 200, 1000 or 2000 time units
  • limits: Institutional author draft carries ISoLA2016 v1 and unremoved publisher-template headers; title/author match the DOI’s Crossref record. Statistical estimates are conditional on modeled distributions, simulation bounds and confidence settings, rather than exhaustive guarantees. Dependence modeling and more complex dynamic/hybrid systems are capabilities or future directions, not experimentally validated here. Most evaluation is graphical; figure graphics were not visually inspected. No measured scalability, runtime, analytical-validation error or stated simulation sample counts for probability estimates were found. The text calls interval-uniform occurrence a constant failure rate; an interval-uniform event-time distribution does not have constant hazard, so distribution versus hazard interpretation needs care.
  • how much was read: most of it read
  • source
  • record id: on-creation-and-analysis-2016
• Parsimonious, Simulation Based Verification of Linear Systems (2016)
  • what: Computes reachable sets for affine linear, possibly time-varying ODEs from n+1 validated simulations for n-dimensional state space. Generalized star sets retain an arbitrary coefficient predicate while advancing a center and basis vectors, allowing nonconvex and unbounded initial sets, sound safety proofs, and sound unsafety witnesses. Superposition makes the exact time-t image a basis transformation with the coefficient predicate unchanged (Algorithm 1, Theorem 1). Algorithm 2 uses synchronized convex enclosures of center/basis trajectories; existential formulas overapproximate the union of reachable states across a time interval, while universally quantified enclosures with existential coefficients underapproximate even the intersection across that interval (Theorem 2 proof). Only m+1 simulations are needed for m basis vectors. For normalized bounded polyhedral/ellipsoid coefficients, Theorem 3 gives a 3ε bloating bound enabling efficient LP checks. General predicates need bilinear reasoning and quantified real formulas. The hybrid extension applies guards, invariants and linear resets through a mode queue. Simulations can be reused for multiple initial predicates sharing the same center/basis. The implementation combines ODEINT fourth-order Runge-Kutta with separate rigorous error bounds, GLPK for polyhedra and Z3 quantifier elimination for general initial sets.
  • number: insulin: 9 simulations; safe 0.206 s versus SpaceEx 8.07 s; unsafe 0.2 s versus 7.89 s
  • number: platoon: 11 simulations; 0.356 s safe and 0.342 s unsafe; SpaceEx times out
  • number: Tank-10/15/18 safe: 0.951/1.688/2.274 s versus 4.886/8.176/10.466 s
  • number: helicopter: 29 simulations, 4.826 s versus SpaceEx 121.66 s
  • limits: Core results assume linear affine dynamics, valid numerical trajectory enclosures, synchronized time intervals and convex simulation regions; integration width tends to zero as step size tends to zero. n+1 bounds simulation count, not overall computational complexity. General OA/UA formulas contain NP-hard bilinear constraints and UA has alternating quantifiers. The hybrid-system queue may not terminate and all reported experiments are purely continuous. Nonconvex/unbounded examples are small and quantifier elimination is more expensive than polyhedral LP checks. Table 1 tank rows show roughly 4.6–5.5× speedups, so the prose claim of at least an order-of-magnitude SpaceEx improvement is stronger than those rows support.
  • how much was read: most of it read
  • source
  • record id: parsimonious-simulation-based-verification-2016
• RAHFT Horn-clause verification tool (2016)
  • title: RAHFT: A Tool for Verifying Horn Clauses Using Abstract Interpretation and Finite Tree Automata
  • what: Introduces RAHFT, a modular CHC safety verifier combining constraint specialization, convex-polyhedra abstract interpretation, finite-tree-automata trace abstraction refinement and SMT feasibility checks. It returns safe, unsafe or an abstract counterexample and can be reconfigured to use each component separately. The abstraction module specializes clauses without unfolding, computes a convex-polyhedra fixed point containing at most one constrained fact per predicate, and records derivation traces as an FTA. A verifier accepts an inductive model or selects an abstract false trace; infeasible traces are generalized by interpolant automata. The refinement module computes FTA difference via optimized determinization, then generates equisatisfiable refined clauses that split predicates, so previous refinements need not be retained. Ciao Prolog integrates Yices, Parma Polyhedra and FTA libraries.
  • number: over 7,000 lines of Ciao Prolog in 42 modules
  • number: Rahft solves the motivating invariant example in preprocessing alone
  • number: reported comparisons favor Rahft in runtime and instances solved (details in cited papers)
  • number: uses Yices SMT, Parma Polyhedra Library and optimized FTA determinization
  • limits: The current implementation targets CLP constrained Horn clauses over linear arithmetic; arrays, maps, sets and richer theories are unsupported. Convex polyhedra can bottleneck large programs; library arity limits and interpolant generation do not scale well. Counterexample/model reconstruction in the original program is difficult after transformations and external-library use. The paper reports comparative evaluation by reference to prior studies rather than a full new benchmark table.
  • how much was read: most of it read
  • record id: rahft-horn-clause-verification-tool-2016
• RSMC POWER relaxed-memory model checking (2016)
  • title: Stateless Model Checking for POWER
  • what: Derives an operational execution model from axiomatic POWER semantics and introduces Relaxed Stateless Model Checking (RSMC), which explores inequivalent Shasha-Snir traces exactly once for threadwise-deterministic bounded programs. States combine fetched and committed events with program order, coherence and read-from relations; a commit-before function constrains commits while preserving POWER-allowed speculative effects. Validity and deadlock-freedom conditions yield equivalence between axiomatic and operational semantics. RSMC detects read-write races, constructs generalized sub-runs and queues branches so that all complete traces are covered without duplicate complete traces. Theorems establish soundness under valid/deadlock-free models and optimality for POWER with cbpower. Nidhugg validates 8,070 POWER litmus tests, compares C/pthreads benchmarks with goto-instrument, and shows blocked runs are usually absent or at most 10%; fences can reduce a Dekker-style test from 184,759 to 3 traces.
  • number: 8,070 POWER litmus tests
  • number: Theorem 1 equivalence; Theorems 4 and 5 soundness/optimality
  • number: RSMC blocking at most 10% of runs
  • number: SB+10W+syncs: 3 versus 184,759 traces
  • limits: Programs are deterministic per thread with fixed inputs; executions are bounded by loop unrolling, and RSMC depends on a valid, deadlock-free commit-before function. POWER axiomatic semantics, event relations and model predicate are trusted inputs; incomplete runs can still be initiated when branches are later rejected. It does not cover unbounded loops, data nondeterminism or real hardware timing. goto-instrument may produce false negatives on relaxed-memory cycles, while RSMC precision is only within the chosen POWER model and compilation.
  • how much was read: most of it read
  • record id: rsmc-power-relaxed-memory-model-checking-2016
• RTD-Finder compositional real-time verification (2016)
  • title: RTD-Finder: A Tool for Compositional Verification of Real-Time Component-Based Systems.
  • what: Presents RTD-Finder, an automatic compositional verifier for RT-BIP real-time component systems. It computes local component invariants, interaction invariants and history-clock constraints into a global over-approximation, checks safety/deadlock with Yices, and refines spurious counterexamples by backward zone search.
  • number: 500 trains, 1 h 13 m 20 s
  • number: 300 rods, 5 m 47 s
  • number: 14 h 14 m for 50-rod refinement
  • number: UPPAAL 436519 explored states after 5 h
  • limits: The invariant is an over-approximation, so initial counterexamples may be false positives and refinement may be expensive. Safety syntax is limited to Boolean combinations of atomic clock constraints and location predicates; data variables in the gear example are abstracted. The method is for RT-BIP multi-party synchronization and does not give completeness for arbitrary timed systems. Deadlock in timed systems is difficult because eventual enablement depends on non-involved components; parametric timing and richer urgency/data are future extensions.
  • how much was read: most of it read
  • source
  • record id: rtd-finder-compositional-real-time-verification-2016
• short counterexample FTDA (2016)
  • title: A Short Counterexample Property for Safety and Liveness Verification of Fault-Tolerant Distributed Algorithms
  • what: Develops a short-counterexample property: violations of temporal specifications in threshold-guarded fault-tolerant algorithms have bounded representative counterexamples, enabling automated parameterized checking. The method models protocols as counter systems with threshold guards, searches steady schedules and short representative executions, and handles fairness for liveness. It gives reduction arguments for shortening schedules and completeness conditions for the search bound, targeting parameterized process/fault counts.
  • number: Method is automated and parameterized; representative schedule search is bounded
  • number: No concise runtime totals exposed in supplied extraction
  • number: 10 prominent fault-tolerant distributed algorithms verified
  • number: Counterexample length is bounded independently of process parameters
  • limits: The bound and completeness arguments rely on threshold-guarded, symmetric protocols and fairness assumptions. Liveness search requires schedule bounds; failure to find a short trace does not prove correctness outside the theorem’s class.
  • how much was read: most of it read
  • source
  • record id: short-counterexample-ftda-2016
• SLCS and CSLCS model checking (2016)
  • title: Model Checking Spatial Logics for Closure Spaces
  • what: Extends Spatial Logic for Closure Spaces (SLCS) with propagation and path-based surrounded operators, introduces collective SLCS (CSLCS) for sets of points, and supplies model-checking algorithms and an OCaml proof-of-concept tool for finite quasi-discrete closure models. The paper formalizes closure spaces as a generalization covering topological and graph structures, distinguishes Euclidean and directed quasi-discrete paths, and proves that its path-based surrounded operator coincides with the earlier boundary-based until on quasi-discrete models. CSLCS adds share and group operators; group satisfaction reduces to finding a path-connected superset, and derived operators express collective surrounding, partitioning and reachability. For finite quasi-discrete models, the SLCS checker uses recursive satisfaction plus breadth-first propagation, while CSLCS uses Tarjan-style strongly connected component search. Correctness and O(k·(|X|+|R|)) worst-case bounds are proved for formula size k.
  • number: Theorem 6.3: SLCS algorithm is correct; Lemma 6.2 gives O(k·(|X|+|R|)) steps
  • number: Theorem 6.4 gives the same worst-case order for CSLCS local checking
  • number: On roughly one million image points, formula φ5 takes around two seconds on a laptop
  • number: Example 7.5 distinguishes two mazes: collective blue-to-exit formula false in one and true in the other
  • limits: The practical checker targets finite quasi-discrete closure models; continuous spaces motivate semantics but are not handled by the implementation. Path notions depend on the chosen domain order and are not unified across Euclidean and directed spaces; the authors leave a universal path notion and temporal extension for future work. Collective formulas are deliberately layered to preserve tractability. The tool is proof-of-concept and experiments are illustrative rather than a broad performance study.
  • how much was read: most of it read
  • record id: slcs-and-cslcs-model-checking-2016
• SLRP liveness synthesis (2016)
  • title: Liveness of Randomised Parameterised Systems under Arbitrary Schedulers
  • what: Presents a fully automatic CEGAR method for liveness of randomised parameterised systems under arbitrary schedulers by reducing probabilistic protocols to two-player reachability games and synthesising regular progress relations with L*-learning and SAT. The method ignores nonzero probability values, retaining transition topology, and represents configurations as words with length-preserving transducers. Regular advice bits consist of an inductive reachable over-approximation and a well-founded progress relation; VERIFY checks four conditions while SYNTHESISE searches deterministic automata via SAT and eliminates counterexamples. An incremental variant composes disjunctive advice, refines reachable/winning sets, learns inductive invariants, and exploits automorphisms such as ring rotation. Soundness follows from the advice conditions; a completeness claim is given under existence of regular advice, minimum-length selection and minimum automata.
  • number: Lehmann–Rabin requires incremental plus invariant and rotation symmetry: 10 minutes versus 48 minutes without invariant
  • number: Israeli–Jalfon takes 9.7 s with all optimisations; Herman 1.5 s monolithic
  • number: Szymanski monolithic takes 5.7 s while incremental takes 27 min
  • number: Lehmann–Rabin run uses 23-state reachable DFA, 25 progress pairs and 4,324 refinement iterations
  • limits: Each finite instance is treated as an MDP whose liveness depends only on transition topology, so actual nonzero probabilities are abstracted away; this proves almost-sure reachability only under the chosen scheduler/game interpretation. Systems are encoded by finite-state letter-to-letter transducers, excluding non-length-preserving/data-rich protocols; fairness is not handled and is future work. Results are proof-of-concept on finite benchmark encodings, with hard-coded invariant precision n=5 and substantial SAT/refinement cost for complex cases.
  • how much was read: most of it read
  • record id: slrp-liveness-synthesis-2016
• Spatial model checking medical imaging (2016)
  • title: From Collective Adaptive Systems to Human Centric Computation and Back: Spatial Model Checking for Medical Imaging
  • what: Explores spatial model checking for medical images by extending closure-space logic with quantitative predicates, distance operations and statistical-comparison texture operations in experimental topochecker. Separates graph-neighborhood closure from metric distance. Describes global distance-transform evaluation, Euclidean versus shortest-path/Chamfer distance, and SCMP comparison of each voxel neighborhood with a selected reference region. Appendix A compares Euclidean, Chamfer, chessboard and cityblock metrics.
  • number: Illustrative image-processing outputs, no quantitative clinical accuracy or performance benchmark. Linear-time Euclidean distance-transform checking assumes negligible constraint evaluation and linear-time subformula checking.
  • limits: A preliminary position paper, with an illustrative glioblastoma MRI slice rather than a clinical validation study. SCMP syntax/interpretation and complexity remain experimental. Distance/texture thresholds need calibration; relations between closure and metric structures remain open. Figure pixels were not visually inspected.
  • how much was read: most of it read
  • record id: spatial-model-checking-medical-imaging-2016
• T2 (2016)
  • title: T2: Temporal Property Verification
  • what: Presents the open-source T2 framework, translating C/LLVM or native integer transition systems into safety, termination and temporal-logic proofs for CTL, Fair-CTL, CTL* and LTL reductions. T2 front-end builds location/transition graphs and uses LLVM simplifications. Safety proving uses Impact, Z3 GPDR or Spacer via linear Horn clauses. Termination alternates safety checks with lexicographic ranking-function synthesis and counterexample refinement; preprocessing removes directly provable loops (about 80%). Nontermination searches recurrent sets. CTL uses bottom-up precondition synthesis; Fair-CTL uses prophecy variables to reduce fairness; CTL* uses explicit future-outcome variables and is incomplete. Machine integer overflow is handled by normalization in the C front-end.
  • number: Termination benchmark timeout 300 s: AProVE 641 terminating/393 nonterminating/188 fail, avg 49.1 s; T2-GPDR 627/442/153, avg 23.6 s; T2-GPDR-NoP 589/438/195, 31.4 s; Spacer-NoP 591/429/202, 33.5 s; Impact-NoP 529/452/241, 37.2 s. Preprocessing removes ~80% loops. CTL 56/56 examples solved; T2 average 2.7 s vs Q’ARMC 3.6 s (100 s timeout).
  • limits: Core analysis supports only linear integer arithmetic fragments of C/native systems; numbers are mathematical integers unless front-end normalization handles machine overflow. Heap, recursion and concurrency are future work. Fair-CTL is relatively complete only relative to safety/termination procedures; CTL* is incomplete. Temporal experiments exclude Fair-CTL/CTL* due to lack of competing tools.
  • how much was read: most of it read
  • source
  • record id: t2-2016
• Witness-index array transformation for BMC (2016)
  • title: Scaling Bounded Model Checking By Transforming Programs With Arrays
  • what: Transforms array-manipulating ANSI-C programs with large loops into array-free, loop-free witness-index programs so off-the-shelf BMC can scale. A nondeterministic witness index ia and scalar xa represent one arbitrary array element. Array accesses matching ia use xa; other reads become nondeterministic, writes are conditional, and loop headers are removed while modified scalars are nondeterministically reset. Structural Lemmas 1–3 establish state representation, expression over-approximation and statement preservation; Theorem 1 proves original assertion violations remain violations after transformation. Precision rules require full-array loops, iterator-indexed accesses and no relevant loop-defined scalar/array dependencies; Theorem 2 proves exactness for invariant assertions meeting those rules. The implementation supports 1-D arrays and is tested on SV-COMP ArraysReach and three real applications.
  • number: Transformation+CBMC scaled all 118 SV-COMP programs and gave sound results for all
  • number: Precise results for 59/118 SV-COMP cases; CBMC alpha had 45 memory failures among those
  • number: 280 real assertions: 200 proved; 40–90% false-warning reduction across applications
  • number: Hardware: 16 Intel Xeon 2.4GHz processors, 20GB RAM; 30-minute CBMC timeout
  • limits: Formal language exposition restricts to one 1-D array, though implementation handles ANSI-C features and multiple arrays via a technical report. Transformation is generally an over-approximation: unsafe results can be spurious when precision criteria fail, and array accesses outside loops are not covered by precision claims. Partial loops and scalar dependencies introduce nondeterminism. BMC completeness remains backend-dependent; recursive function-pointer chains and non-full-array definitions caused failures.
  • how much was read: most of it read
  • record id: witness-index-array-transformation-for-bmc-2016
• Adam (2015)
  • title: Adam: Causality-Based Synthesis of Distributed Systems
  • what: Presents the Adam Java implementation of symbolic Petri-game synthesis: a separate controller for each process uses its causal past and exchanges knowledge at joint transitions. A winning strategy avoids bad places and avoids introducing deadlocks. The paper sketches a finite two-player reduction and reports controller-synthesis benchmarks. Cuts are maximal concurrent sets of places annotated by enabled decision sets and type-1/type-2 system tokens. Type-2 tokens will never synchronize, even indirectly, with the environment; type-1 tokens are blocked until its next move. Environment choices are delayed until an mcut so independent system choices cannot depend on unseen environment choices. The BDD encoding assigns places to tokens rather than arbitrary subsets of places. Phase 1 computes valid type-2 cuts by greatest fixed point; phase 2 combines greatest/least fixed points for winning mcuts and their predecessors; phase 3 extracts a strategy and per-player projections. Net invariants compact the place encoding.
  • number: CM 6/2: 15 tokens, 244 BDD variables, 46 places/48 transitions, 1042.2 s and 2.51 GB; strategy 105 places/36 transitions
  • number: CM 2/6: no winning strategy; 206.5 s and 5.43 GB
  • number: JP 11: 12 tokens, 762 BDD variables, 102 places/175 transitions, 434.8 s and 16.62 GB
  • number: DW 20: 22 tokens, 516 BDD variables, 1734.7 s and 15.85 GB; strategy 1264 places/861 transitions
  • limits: One environment player, an arbitrary but bounded number of system players, and safe nets (at most one token per place). Bounded nonsafe nets can be translated to safe nets. Players know their causal past and exchange it only when synchronizing; controllers need this modeled communication/memory. Safety plus deadlock avoidance is the objective, not general liveness: terminating net markings are permitted when the underlying unfolding itself has no enabled transition. Benchmark sizes and timings do not establish scalability for unbounded protocols. No TLA+, Rust, Verus, LLM, or machine-checked implementation evaluation.
  • how much was read: most of it read
  • source
  • record id: adam-2015
• Algorithms for Model Checking HyperLTL and HyperCTL* (2015)
  • what: Gives a direct alternating-Büchi-automaton construction for finite-state HyperLTL/HyperCTL* model checking, including quantifier alternation via nondeterminization and complementation. For a restricted alternation-free fragment, reduces checking to a small symbolic circuit with bad-state and strong-fairness constraints. Uses ABC to analyze hardware information flow, cross-execution symmetry of a finite Bakery implementation, and error-code Hamming distance. Preserves the temporal-placement restrictions in alternation-free syntax, current-path branching semantics, formula versus explicit-state complexity, latch-count encoding bound and assumptions behind circuit simplifications. Documents concrete invalid-ID, scheduling/tie-breaking and reset-polarity counterexamples, all benchmark rows, intended information flows versus vulnerabilities and missing quantitative-flow/experimental details.
  • limits: §2: Kripke structures have a successor from every state, hence infinite paths. Path assignments advance synchronously; a newly quantified path starts at the current state of the most recently quantified path epsilon. HyperLTL places all quantifiers in a prefix; HyperCTL* permits branching quantification inside temporal operators. These are finite-state model results, not parameterized proofs over arbitrary process counts. §3.1 Definition2: alternation-free means one quantifier type in negation normal form plus placement restrictions: no existential in the left of Until or right of Release; no universal in the right of Until or left of Release. Boolean combinations of separately checked blocks are handled. A formula with no textual ∀/∃ switch can still incur extra alternation through a forbidden temporal placement. §3.1: standard Boolean/Next/Until/Release automata are combined bottom up. Existential path elimination first applies Miyano–Hayashi nondeterminization, then products with the Kripke structure and projects a state component. This preserves a common witness path across alternating branches; projecting arbitrary alternating branches independently is not the construction. §3.1 Theorem2 states PSPACE-completeness in formula size and NLOGSPACE-completeness in explicit Kripke-structure size. This is not a logarithmic-space or polynomial-time claim in the number of circuit latches: a circuit represents an exponentially large state graph. Proposition1 gives correctness with structural-induction explanation; no mechanized metatheory or verified implementation is supplied. §3.2: full logic uses complementation of alternating automata and nondeterminization. With g(0,n)=n and g(k,n)=c^g(k-1,n), Theorem4 gives NSPACE(g(k,|formula|)) and NSPACE(g(k-1,|K|)), defining level-1 as NLOGSPACE. These are upper bounds parameterized by alternation depth; the practical circuit implementation/evaluation is for the restricted alternation-free fragment. §4: circuit transition is input-enabled and input-deterministic, with nonempty initial states. Associated Kripke structure adds a dummy initial state and shifts atoms by Next. Strong-fairness pair(a1,a2) requires a1 finitely often or a2 infinitely often. Validity is reduced to an initial formula output, no bad outputs and these fairness conditions; plain bounded safety search is not a complete substitute for fair reachability. §4 Proposition3 bounds latch count by |C|*k+|formula| for k path quantifiers; the paper defines circuit size as number of latches, abstracting the gate list. This does not bound every gate/transition-expression size by the same expression. Quantifier copies synchronize their starting latches; outputs track obligations and bad-state violations. Conjunction/Release circuit rules are explicitly omitted for space; correctness is sketched by structural induction. §5: implementation transforms AIGER circuits obtained by standard VHDL/Verilog synthesis; ABC supplies IC3/PDR, interpolation and BMC. Intel Core i5-4278U at2.6GHz. Defaults except starred Sym9; exact exceptional setting, timeout duration, RAM limit, repetitions and error bars are not specified. Dashes in BMC cells are not zero-second proofs, and TO is unresolved within an unspecified budget. §5.1: most I2C noninterference formulas intentionally fail because address/data transfer is the function of the bus. Failure alone is not a security vulnerability. NI3 holds with write enable off; NI5 fails because concurrent masters/arbitration affect later interpretation. Long-term NI7/8 fail, indicating information may persist. NI6 is listed/timed but has no separate prose explanation. §5.1: 3-bit address flow is determined for QNI1, while the log2(9)≈3.17-bit upper-bound query QNI2 times out. Neither quantitative-flow query is in Table1. The later assertion that all I2C properties were easily analyzed must be qualified by this reported timeout. §5.2: Bakery analysis is a synchronous finite Verilog model with select/pause inputs. Illegal select IDs advance process0. Excluding those paths, parameterizing tie resolution and contracting ID comparisons into one step change assumptions/model behavior before S3 is satisfied. Results do not show the unchanged original protocol is fully symmetric or prove starvation freedom/mutual exclusion under every scheduler. §5.2: printed S1–S3 use two universal path quantifiers, despite prose saying every execution has another swapped execution. Deterministic input-enabled circuit semantics support relating paired swapped inputs; do not silently rewrite the displayed formula to ∀∃. The weak-until rewrite removes a liveness-shaped part only under the stated input-determinism/input-enabledness conditions. §5.3: valid encoder properties depend on reset/control configuration and distinct data inputs. Huffman and8b10b are not error-correcting codes and only distance1 is expected. Hamming7–4 encodes4bits into7bits and is checked up to distance3. Active-high versus documented active-low reset is a specification/implementation discrepancy, not proof of failed correction on correctly configured messages. Printed source issues: §2 defines Release as ¬(¬phi1 U ¬phi1), repeating phi1 where standard duality uses phi2 on the right; visual PDF confirms. The §3.1 definition of K-equivalent languages is written only as an accepted-word implication, while later propositions use equivalence language. Record does not treat these presentation issues as an independent refutation of the algorithm. Hardware synthesis, circuit transformation, model semantics, specifications and ABC remain trusted. No proof certificates, independent checker or artifact execution are evaluated here. Claims of first/practical/industrial scale are author claims about selected cases. No Rust, Verus, TLA+ or LLM result is reported.
  • how much was read: most of it read
  • source
  • record id: algorithms-for-model-checking-2015
• Alloy LTL BMC (2015)
  • title: Bounded Model Checking of Temporal Formulas with Alloy
  • what: Extends Alloy relational models with standard LTL formulas for reactive systems and translates bounded temporal checking into Alloy Analyzer/SAT, avoiding error-prone ad-hoc temporal idioms. The encoding represents mutable fields via State-indexed relations, introduces traces and frame conditions, and translates X, G, F and U over bounded State orderings. It supports counterexample search within a finite scope and illustrates translating state-machine properties.
  • number: No large benchmark; paper demonstrates Alloy Analyzer encoding and examples
  • number: Verification bounded by Alloy scope and SAT solver
  • limits: Bounded model checking can miss violations beyond the chosen trace/scope; Alloy’s finite scopes and SAT semantics do not prove unbounded temporal properties. Fairness/infinite traces require finite approximations and careful loop handling.
  • how much was read: most of it read
  • source
  • record id: alloy-ltl-bmc-2015
• Automated and Modular Refinement Reasoning for Concurrent Programs (2015)
  • what: Introduces civl, a Boogie extension that proves multi-layer refinement of concurrent shared-memory programs. Cooperative yield semantics, mover-type automata, location invariants, linear permissions and modular ownership reduce preemptive concurrency reasoning to automated per-procedure obligations. A high-level atomic action is refined by a procedure whose paths contain exactly one implementing atomic block; other blocks preserve visible state. Mover types and the yield sufficiency automaton justify cooperative reasoning for sequentially consistent preemptive execution. Linear variables guarantee distinct thread identifiers or disjoint permission sets across threads. Location invariants are checked for sequential correctness and non-interference; modules own disjoint globals so quadratic checks are per module. A soundness theorem chains layers from safe high-level program to low-level implementation. Implementation infers verification conditions and atomic blocks, computes graph simulations in O(n·m), and supports variable hiding/data refinement.
  • number: 32 benchmarks, 17–539 LOC, total 20 s
  • number: GC ~2,100 Boogie LOC, six refinement layers, 60 s total
  • number: GC 54 s sequential/non-interference; remaining checks insignificant
  • number: yield-simulation algorithm O(n·m) in control-flow nodes/edges
  • limits: The paper focuses on sequential consistency and leaves weak memory models future work. Safety guarantee requires high-level safety, valid refinement, sequential/non-interference invariants, linear typing, pairwise commutativity, sufficient yields, and infinitely frequent yields on infinite executions. The full formalization is in a technical report. Modules require strict global-variable ownership. Location invariants cannot refer to other threads and can be incomplete. The approach verifies safety/refinement, not liveness or arbitrary functional properties.
  • how much was read: most of it read
  • source
  • record id: automated-and-modular-refinement-2015
• Automatic Completion of Distributed Protocols with Symmetry. (2015)
  • what: # Automatic Completion of Distributed Protocols with Symmetry (authored by agents unless marked 🧑) Rajeev Alur, Mukund Raghothaman, Christos Stergiou, Stavros Tripakis and Abhishek Udupa, arXiv:1505.04409v1. The arXiv comments identify this as the “Full version of paper presented at CAV 2015.” The paper gives a solver-and-model-checker loop that fills missing guards and state updates in finite distributed protocol sketches, requiring determinism, symmetry, deadlock freedom, safety and liveness under supplied fairness assumptions. Its empirical results cover Peterson mutual exclusion, a four-process self-stabilizing line, and five missing cache-coherence corner cases. Guaranteed correctness is explicitly limited to the finite synthesized instance (Q1,Q2,Q6,Q13,W1,W2). ## Reading and evidence scope Read all 21 pages, sections 1–6, all displayed definitions/formulas, nine figures, the complete five-row Table 1, and all 31 bibliography entries. There is no appendix, checklist, numbered theorem/proof or numbered pseudocode algorithm. Figure 2 is the synthesis workflow; §4 gives textual algorithms. Individually inspected page renders 3,8,11,13,14,15,16,17,18,19, covering every figure, the table, protocol diagrams and the weakest-precondition formula. This does not claim visual inspection of all pages. References were read as bibliography entries, not recursively followed. Retained the inventory PDF, raw/layout extractions and official arXiv metadata. The paper says the custom model checker is planned for future public release; it supplies no implementation URL. No implementation/model files or historical logs were acquired or read. A web-search tool request for code returned an error without results; this is not evidence that no code exists. No author contacted, author code executed/imported, checker/solver rerun, or model/checkpoint/serialized experiment data loaded. Source versions and reported runs were not independently reproduced (Q8,W1). ## Problem and modeling assumptions The designer provides extended state-machine sketches, not just an English request or temporal goal. Each process has finite control locations, finite typed variables/channels, an initial valuation, known and unknown typed functions, guarded transitions and fairness sets. All type cardinalities are required finite, including process-identity symmetric types and array domains. A completed function is initially a finite interpretation table. The environment is another specified machine with no unknown functions (Q3,Q4,Q6). Composition synchronizes matching output/input channels and sequences their updates so the receiver sees the transmitted value; independent internal actions interleave. Buffered unordered communication in the cache example is modeled within these finite-state machines, not assumed to be an unbounded reliable network. The formal product assumes disjoint process state variables and output ownership. Safety means no reachable error location. Liveness means no infinite fair accepting run of the supplied monitors; deadlock freedom is separate. Thus a finite deadlock cannot pass just because no infinite violating run exists (Q3,Q4). Weak fairness applies to a set of transitions: either the whole set is disabled infinitely often or some member occurs infinitely often. Strong fairness requires that a set enabled infinitely often has a member taken infinitely often. Fairness sets are attached to output/internal transitions; input behavior depends on the environment/composition. These assumptions matter to the guarantees. The paper argues that using only safety in synthesis permits trivial solutions that disable progress (Q2,Q3). Symmetry means behavior is invariant under renaming values of the designated types. Permutations act on array entries and indices, channel/process parameters and states. Unknown functions are constrained to commute with renaming, f(π(d))=π(f(d)). This is stronger than merely using the same source text while permitting special treatment of one numeric identity. Quantifiers are expanded over finite domains for the solver. The discussion mentions other symmetry notions as possible extensions; the implementation/evaluation described uses the stated finite symmetry treatment (Q5,Q7). The designer can restrict signatures to exclude irrelevant variables, fix known read-only updates, and add constraints across functions. The formal completion requires deterministic individual machines, a symmetric product, satisfaction of initial constraints, and a deadlock-free/safe/live composition. Determinism allows simultaneous input transitions only on distinct input channels. Guarantees concern that chosen environment, monitor and fairness model, not every implementation of the informal protocol name (Q6,Q7). ## Algorithm and what its checks establish The synthesis loop asks Z3 for interpretations satisfying current constraints, instantiates the protocol, then model-checks it. An erroneous candidate yields further necessary conditions excluding its counterexample or repairing the reason it violates the property. A successful interpretation may subsequently be converted to a symbolic expression using an enumerative syntax-guided synthesis solver. A symbolic grammar/output is therefore a later step; the initial solver does not directly synthesize arbitrary program syntax (Q6,Q10,Q13). The custom checker combines a symmetry-reduced annotated quotient graph with permutation tracking in a threaded graph, then searches accepting strongly connected components under fairness. Tracking the renaming matters because a compressed path can stand for multiple original paths and fairness obligations must be adjusted accordingly. The described procedure removes states enabling unmet strong-fairness sets and recomputes components until it finds a fair accepting cycle or rules one out. The authors build on cited algorithms and describe the search as sound and complete; this paper supplies no separate numbered soundness/completeness proof or implementation certification. Their historical limitations of Spin, Murphi, SMC and NuSMV are reports about their tool attempts, not a current feature comparison (Q8). For a deadlock, the next candidate must block the witnessed path or enable some outgoing action at its end. For a safety trace it must block the error path. The paper compiles product transitions to guarded commands, coalesces assignments and computes weakest preconditions; a guarded-command obligation uses guard implication, so a disabled step can break the trace. For liveness, a stem/cycle witness must become infeasible, fail to close, or become unfair. The Peterson example shows why simply banning the waiting loop is too strong: enabling a continuously neglected critical transition can make that loop unfair under the given fairness assumption (Q9,Q10). There is a printed indexing problem worth preserving without treating it as an implementation defect. §4.3 indexes a trace cmd1,…,cmdn but defines pre_i using cmd_(n−i−1). With n=1 and i=1 this refers to cmd_−1 rather than the sole command. The intended reverse traversal would require a corrected index/convention; no source code was available to determine what the implementation uses. The rendered page 11 confirms the printed formula. The liveness recurrence also reuses notation inconsistently around the named union of fairness sets. These are presentation limits on mechanically following the text, not reproduced failures of the tool (Q10,D1). Search heuristics prefer each error path to exercise few unknown functions while choosing diverse paths that collectively cover many. Shorter unknown-function dependencies can give stronger pruning constraints. Candidate costs favor minimally permissive guards, unchanged updates, then fewer input dependencies; bounds relax when the solver cannot satisfy them. Such constraints are search guidance, not protocol requirements. They strongly affect runtime, and Dijkstra required a different guard heuristic. No controlled ablation quantifies each optimization’s benefit (Q11,Q12). ## Concrete cases Peterson has two processes with my/other identity parameters, shared flag/turn variables, a critical-section safety condition and a starvation monitor. Figure 1 removes the waiting/critical guards; the experiment additionally leaves flag-update expressions unspecified and requires that at least one guard hold. Weak fairness of selected non-input transitions suffices for the stated monitor. The authors report an interpretation in under one second and expressions matching the known protocol. Table 1 reports three unknown functions; this count is retained as printed rather than inferred by counting the distinct update sites mentioned in prose (Q3,Q12,T1). The self-stabilizing case is four processes in a line, each with Boolean x/up state. The two middle processes have two unknown guarded commands, each with two unknown updates; corresponding middle-process completions must be identical. A legitimate state has exactly one globally enabled guarded command. The specification requires reaching legitimate states from arbitrary starts, staying legitimate thereafter, and reachability among legitimate states. The successful expressions match Dijkstra’s displayed rules. This is synthesis/verification for N=4; the general-N illustration is not itself a parameterized correctness proof (Q12). German/MSI has a directory, symmetric caches and one environment per cache; permissions are invalid/shared/exclusive. Its variant adds direct cache-to-cache data/acknowledgment, silent shared eviction and coordinated exclusive eviction. These optimizations create interactions absent from the simpler base protocol. One explicit race has a directory still listing a silently evicted cache as a sharer: that cache has already requested exclusive ownership when it receives an invalidation for another requester, and must acknowledge the invalidation despite its transient state. Two related races vary the pending read/write request (Q12,Q14). Two remaining missing behaviors arise when exclusive eviction/writeback races with another cache’s request: the cache receives an unexpected invalidation, while the directory receives unexpected writeback. The synthesized behavior treats the invalidation like a writeback acknowledgment for the evicting cache; the directory accepts the latest data and forwards it to the requester without requiring an extra acknowledgment. Figures 8/9 mark the missing behaviors and recovery messages. The designer still specifies which message kinds each unknown state must handle; §5.4 says this assistance was crucial to scaling. This is completion of supplied protocol structure, not autonomous discovery of all states, messages or correctness requirements (Q14,Q15). ## Measured results and limits Table 1 reports five configurations. Peterson: 3 unknown functions, search space 2^36, 60 states, 14 iterations, 97 ms SMT and 130 ms total. Dijkstra: 6 functions, 2^192 possibilities, about 2,000 states, 30 iterations, 27 s SMT and 64 s total. German/MSI-2: 16 functions, about 2^4700 possibilities, about 20,000 symmetry-reduced states, 217 iterations, 31 s SMT and 298 s total. German/MSI-4: 28 functions, about 2^7614, about 20,000 reduced states, 419 iterations, 898 s SMT and 1,545 s total. German/MSI-5: 34 functions, about 2^9000, about 20,000 reduced states, 525 iterations, 2,261 s SMT and 3,410 s total. The exponents were checked in the page render because the extraction flattens superscripts (T1). The suffix -n counts the missing transitions among five corner cases, not the number of caches. The paper does not state the exact cache-count/channel-capacity/value-domain configuration used for these rows, preventing a precise independent reconstruction from the paper alone. All runs use a Linux desktop with a 3.4 GHz Intel Core i7 and 8 GB memory. Multiple SMT seeds were run and the worst runtimes reported, but the number of seeds, dispersion and exact tool versions are absent. There is no broad benchmark population or matched competing-system comparison. Long cases spend much time solving heuristic constraints; German/MSI-5’s SMT fraction is 2261/3410≈66.3%, a reader calculation, not a new measurement (Q15,T1,D2). The authors say synthesized symbolic expressions were parametric and worked on larger instances, but explicitly qualify that interpretations are “only guaranteed to be correct for the finite instance of the protocol”. No sizes/results for the larger checks or cutoff/induction proof is supplied. Symmetry reduces a fixed instance’s state graph; it does not by itself prove correctness for every process count. Nor do these finite-state experiments establish crash/Byzantine tolerance or machine-code correctness (Q13). ## Contribution to the requested topics This is directly relevant distributed-protocol synthesis with safety and liveness checking, predating LLM-based agents. Its distinctive combination is finite extended state sketches, symmetry constraints, fine transition-set fairness, and automatically generated counterexample constraints. Its related-work claims distinguish earlier scenario completion, safety-only concurrent sketching, and template-based self-stabilization; these comparisons are attributed to the authors, without independently reading those cited works (Q2). For Verus/TLA+/LLM-agent work, the transfer is a reader proposal: preserve explicit environment/fairness assumptions, use deadlocks and fair cycles as separate feedback, constrain identity symmetry and keep programmer-supplied structure visible in evaluation. An SMT table, a readable symbolic expression, a finite checked instance and a general verified protocol are different outputs. The paper measures the first stages and fixed-instance checks; it contains no Verus/Rust development, TLA+ model, LLM agent or general parameterized proof.
  • limits: Allfinite types;specifiedenvironment/monitors/fairness;humanprovidedstates/messagekinds;fixedinstancecorrectness;unknowncachecapacities/version/seeds;noimplementationread/rerun;printedrecurrenceindexproblemnotcodefailure.
  • how much was read: most of it read
  • source
  • record id: automatic-completion-of-distributed-2015
• Bandwidth wavefront variable ordering (2015)
  • title: Bandwidth and Wavefront Reduction for Static Variable Ordering in Symbolic Model Checking
  • what: Uses sparse-matrix bandwidth/profile/wavefront ordering algorithms to choose static decision-diagram variable orders. A symmetrized dependency graph and optional total-graph construction let existing Boost/ViennaCL algorithms process transition-variable dependencies. Theorem 1 states span ≤ 2·bandwidth + 1, including the diagonal. The implementation splits the computed permutation into transition and variable orders, tests horizontal/vertical flips, and evaluates peak decision-diagram nodes as well as runtime. Sloan on the total graph gives the best aggregate peak-node result in the reported experiment.
  • number: 361 input models; 110 common completed models; 114798 runs across 53 categories including 5 timing runs. Reported large-case improvements of 1000–10000 in peak nodes and 10–100 in time are author observations, not guarantees.
  • limits: Evaluation retains only 110 of 361 Petri-net models that every category completed within 30 minutes and 4 GB. Concurrent experiment execution makes timing less reliable according to the authors. Results concern disjunctively partitioned reachability; conjunctive partitioning and SAT/SMT transfer remain proposed work. Figures were read through extracted labels/captions, not visually inspected.
  • how much was read: most of it read
  • record id: bandwidth-wavefront-variable-ordering-2015
• Coq hierarchical coherence and speculative CPUs (2015)
  • title: Modular Deductive Verification of Multiprocessor Hardware Designs
  • what: A Coq proof that speculative processors, composed with a hierarchical MSI memory, implement sequential consistency. It is parameterized over the number of processors and caches. It is built from proofs of separate components.
  • number: 12,000 lines of Coq
  • number: 80% can be reused as-is for other inclusive invalidation protocols
  • number: MSI proof about 12000 lines of Coq; authors say 80% reusable for related inclusive protocols
  • number: arbitrary processor/cache counts and hierarchy levels
  • limits: It covers safety only. It verifies the Coq hardware description, not that synthesis preserves it. No person-time is given.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: Modular Deductive Verificatio
  • record id: coq-hierarchical-coherence-and-speculative-cpus-2015
• DepthK (2015)
  • title: Model Checking Embedded C Software using k-Induction and Invariants (extended version)
  • what: Introduces DepthK, an automatic k-induction verifier for embedded C that combines base, forward, and inductive cases with polyhedral invariants generated by PIPS and translated into ESBMC assumptions. It transforms loops to loop-free programs, havocs loop variables, and rechecks invariant-strengthened results with BMC.
  • number: Intel Xeon E5-2670, 115 GB RAM; 15-minute CPU and 15 GB memory limits. DepthK versus ESBMC k-induction, CPAchecker variants and CBMC. On SV-COMP loops DepthK scored 140 versus ESBMC 105, CPAchecker no-inv 101, CBMC 53; 94 correct, 1 false-incorrect, 0 true-incorrect, 47 unknown/timeout. On embedded tests DepthK had 17 correct and 17 unknown/timeout; inductive-step proofs exceeded ESBMC by 25.35% (loops) and 29.41% (embedded).
  • limits: Affine/polyhedral invariants may be weak or non-convex; invariant over-approximation requires BMC rechecking. Global unwinding bound and max iterations (100) are configured; tool can return UNKNOWN on timeout, resource exhaustion, invariant-generation or implementation failures. Evaluation is limited to ANSI-C benchmarks and safe embedded programs.
  • how much was read: most of it read
  • source
  • record id: depthk-2015
• EHS regular-labelling model checking (2015)
  • title: Model Checking Epistemic Halpern-Shoham Logic Extended with Regular Expressions
  • what: Generalizes Epistemic Halpern-Shoham logic by labeling whole intervals with regular expressions over their state histories. It defines EHS+ over interpreted systems with regular labeling and EHSRE over point-based Kripke structures, proves polynomial reductions between them, and characterizes decidable fragments. ISRL models retain predecessor histories, finite local state/action sets, and a regular-expression labeling function; interval epistemic indistinguishability requires equal lengths and pointwise agent equivalence. EHS+ adds Allen interval modalities, knowledge/common knowledge and atomic regular labels. EHSRE moves regular expressions into formulas, enabling properties not expressible in CTLK* while remaining limited to finite intervals. Theorem 1 gives polynomial-time translations preserving satisfaction. BDE model checking is PSpace-complete; AB̄LN is decidable in non-elementary time via bounded modal-context trees and a pumping argument; fragments involving O remain open because HS O is undecidable.
  • number: 12 Allen interval operators plus next
  • number: PSpace-complete BDE model checking
  • number: non-elementary AB̄LN upper bound
  • number: polynomial-time reductions
  • limits: The semantics concerns finite intervals, so unbounded properties such as CTL AF p cannot be encoded. Full HS and O-related fragments retain undecidability/open status. The bounded AB̄LN proof depends on finite automata states and modal-context types; epistemic relations are interval-length sensitive. The paper gives complexity theorems and algorithms rather than an implemented performance evaluation.
  • how much was read: most of it read
  • record id: ehs-regular-labelling-model-checking-2015
• Empirical Software Metrics for Benchmarking of Verification Tools (2015)
  • what: Defines data-flow-derived source-code metrics and builds Verifolio, a learned selector of software verifiers. Variable-use roles, loop patterns, control-flow metrics and property type predict each tool’s correct/unknown/incorrect answer class; the selector prefers a predicted-correct tool and resolves ties by class probability. Empirical retrospective experiments on SV-COMP2014 and2015 show higher average held-out competition scores than any constituent tool. There is no proof that predictions or selected verifier answers are sound. Uses27 variable roles normalized by variable count, four loop-pattern frequencies and five CFG/function-pointer/recursion metrics plus property type. Roles are control-flow-insensitive fixed-point data-flow analyses. One classifier per verifier predicts correct,unknown or incorrect relative to benchmark-author expected answers; opted-out categories count unknown. Select a predicted-correct tool, else predicted-unknown, else competition winner. Probability-based tie-breaking beats runtime regression; weighted RBF SVM/LIBSVM and grid search handle rare incorrect-answer labels. Weights multiply score potential, criticality (inverse number of correct tools), category performance ratio and relative speed. Decisiveness-reliability plots show correct versus incorrect answer proportions separately from score, exposing scoring-policy dependence and unsound tool answers. This is predictive empirical evidence, not verification of a portfolio implementation.
  • number: {‘variable_roles’: 27, ‘loop_metrics’: 4, ‘control_flow_metrics’: 5, ‘training_fraction’: 0.6, ‘test_fraction’: 0.4, ‘random_repetitions’: 10, ‘median_feature_extraction_s’: 0.5, ‘median_prediction_s’: 0.5, ‘score_2014_portfolio’: 1494, ‘score_2014_CBMC’: 1292, ‘score_2015_portfolio’: 2511, ‘score_2015_CPAchecker’: 2228}
  • limits: Tasks are C source files with label-reachability or memory-safety properties; memory safety covers unsafe deallocation,unsafe pointer dereference and leaks. Expected truth labels are supplied by benchmark designers; historical tool results are reused rather than all constituent tools rerun under a reconstructed competition environment. Predictive assumption: similar source metrics imply similar verifier behavior. Paper documents failures caused by unsoundness,bugs,incompleteness and class imbalance; selection cannot guarantee a sound answer. Random60:40 task splits within each year, repeated10 times; this is not training exclusively on2014 and testing exclusively on2015. Grouped splits by program family and nested tuning/weight-construction boundaries are not described; independence from near-duplicate benchmark variants is not established by the paper. Competition participants supplied benchmarks; authors explicitly warn idealized-solver figures can be optimistic. Reported metric success alone does not isolate every feature’s marginal contribution. No parameterized distributed verification, liveness specification checking, Verus/Rust or LLM-agent proof generation is evaluated. No artifact execution performed for this reading.
  • how much was read: most of it read
  • source
  • record id: empirical-software-metrics-for-2015
• Espada et al. Android model-based testing (2015)
  • title: Using Model Checking to Generate Test Cases for Android Applications
  • what: Defines modular view and device state machines for realistic user/system interactions across Android applications, composes them with back-stack and inter-device communication semantics, and uses SPIN exhaustive exploration to emit each bounded execution trace as an executable UiAutomator test. The generated tests can feed runtime monitors such as DRAGONFLY. Formal definitions distinguish deterministic view machines, user versus system events, connection/return states, view reuse and automatic return, and device configurations containing active state plus histories. Composition rules R1–R7 model calls, returns, reuse, inter-device message production/consumption, and partial-order reduction. Because histories make the composed machine infinite, the implementation bounds trace depth MAX_TR. A tool chain extracts UI controls with UIAutomatorViewer, stores state-machine/XML models, generates PROMELA inlines and backstacks, runs SPIN, translates traces to UiAutomatorTestCase classes, compiles a .dex file, and executes via adb. The Facebook/YouTube case demonstrates cross-app behavior rather than random event fuzzing.
  • number: depth bound 4 in reported experiments
  • number: 20 and 26 test cases in single-device rows
  • number: two-device: 10 and 12 cases
  • number: up to 28,972,472 SPIN states and 3,445.2 MB
  • limits: Models encode intended/realistic behavior supplied by an expert; exhaustive traces cover only modeled views, controls, events, and depth. Device histories and matching make the unbounded semantics non-finite, so termination depends on a fixed maximum depth. Runtime tests can still fail from UI selector drift, unmodeled Android/OS behavior, timing, or environment; model checking traces are test generation, not a correctness proof of the app. Quantitative evaluation is small (three-run averages) and reports generation cost rather than defect detection or monitor findings.
  • how much was read: most of it read
  • record id: espada-et-al-android-model-based-testing-2015
• Existential FO on Posets (2015)
  • title: Faster Existential FO Model Checking on Posets
  • what: Proves existential FO model checking on width-w posets is FPT in formula size and width with quadratic dependence on poset size, and proves no polynomial kernel under a standard assumption. Reduces existential FO model checking to poset embedding. One algorithm enumerates chain assignments and solves min-polymorphism CSPs; a second reduces compatible embedding to a restricted multicolored clique problem for quadratic dependence. An OR-composition from colored clique establishes the kernel lower bound.
  • number: Theorem 1.1 runtime O(f(|φ|,w)·n²)
  • number: embedding algorithm Theorem 3.1: O(w^|Q|·|Q|^4·|P|^4)
  • number: first CSP algorithm O(n^4); second algorithm quadratic in n
  • number: no runtime benchmark
  • limits: Parameterization is formula size and poset width; the result concerns existential FO, while full FO follows only as a parameterized reduction context. The no-polynomial-kernel result assumes coNP ⊄ NP/poly. Algorithms have substantial f(|φ|,w) factors and no empirical implementation evaluation is reported.
  • how much was read: most of it read
  • record id: existential-fo-on-posets-2015
• Fairness Modulo Theory LTL checking (2015)
  • title: Fairness Modulo Theory: A New Approach to LTL Software Model Checking
  • what: Introduces Fairness Modulo Theory, reducing LTL software verification to absence of feasible fair paths in a Büchi program and prioritizing finite-prefix infeasibility proofs before expensive infinite-path ranking proofs. Ultimate LTLAutomizer implements the CEGAR loop with SMT trace abstraction and termination analysis. The paper defines Büchi programs/products and proves that P satisfies φ iff the product with A¬φ has no trace both fair and feasible. The algorithm maintains an automaton of known infeasible fair traces, checks stem/loop/concatenated finite prefixes, then invokes ranking synthesis only when needed; refineF and refineω generalize proofs. Implementation uses ACSL C parsing, LTL2BA, trace abstraction, ranking synthesis and Büchi automata operations. It reports benchmark behavior on Windows/PostgreSQL/Apache, RERS and coolant sets, including product-size and refinement observations.
  • number: most comparison benchmarks solved under five seconds
  • number: 20-minute timeout and 8 GB memory for authors’ runs; prior Term/DP data used four-hour timeout
  • number: roughly 43% of RERS benchmarks verified without modifications
  • number: Büchi product blow-up no more than four times on reported sets
  • limits: Finite-prefix feasibility and termination analyses are generally undecidable and can time out, yielding unknown. The approach depends on Büchi automaton translation and SMT theories, and ranking synthesis remains necessary for traces with no infeasible finite prefix. RERS verification succeeded on roughly 43% without modifications; a product optimization bug caused most abnormal results, and one Windows benchmark had undefined variables. Results are tool/benchmark dependent.
  • how much was read: most of it read
  • record id: fairness-modulo-theory-ltl-checking-2015
• Fine-Grained Caching of Verification Results. (2015)
  • what: Boogie caches whole implementation results using entity/dependency checksums, then reuses individual checked statements by injecting assumptions guarded by conditions that reconstruct the old call-contract assumptions. Unchanged failures can be reported immediately. Implemented for the Dafny IDE and tested on eight recorded expert development sessions. Details conservative control-flow statement hashes, separation of procedure bodies from contracts and transitive function definitions, guarded reuse after changed pre/postconditions and modifies clauses, old-failure eligibility, error-report-limit exclusion and loop handling. Explains why stable generated names matter and why many cached checks need not substantially reduce time when a remaining check dominates.
  • limits: §§3.1–3.2: frontends supply entity checksums from relevant AST parts; comments/whitespace may be ignored. Boogie computes dependency checksums. Correctness relies on complete semantic dependencies and valid cached outcomes. Hash equality is used operationally, not a proved semantic-equivalence decision; no collision analysis, cache corruption defense or solver/configuration invalidation specification is presented. §3.1: modular procedure calls depend on specifications rather than implementation bodies. A changed body alone need not invalidate callers; changed function definitions can invalidate transitive callers. The p.384 sentence says changed specifications may invalidate “callees”, while examples and modular dependency explanation concern callers. §4.1: each statement checksum hashes pretty-printed statement plus all preceding control-flow statement checksums, rather than precise data dependencies; function-call expressions also include callee dependency checksum. Loops first cut using invariants; preconditions become entry assumes and postconditions exit asserts. No cyclic hash fixpoint required. §4.3: fine-grained injection applies to medium/low-priority implementations whose cached run did not hit the limit on reported errors. Merely not having a reported failure cannot establish old success when error reporting was truncated. New implementations follow ordinary verification. §§4.2–4.3: changed call contracts are handled separately from plain statement hashes. If old transitive function definitions remain available and unchanged, reconstruct old precondition and postcondition/modifies assumptions; otherwise set a fresh assumption variable false and omit old precondition. This prevents unsound reuse when old formulas cannot be expressed with unchanged meaning. §4.3: snapshot old values of globals newly added to modifies; post-call guard combines old postcondition and equality of these globals with their old values. Removed modifies globals need no equality because old proofs already allowed arbitrary values. Assumption variables start true and update by conjunction, preserving failed old assumptions. §4.3: old successful checked condition P becomes assume(A⇒P) before its actual check, where A contains relevant assumption variables whose update can reach the use. If A holds, the check is discharged from cached knowledge; otherwise solver must verify it. A definitely-false relevant variable prevents reuse. Old failures are recycled only with no relevant assumption variables. §4.3: old-precondition placeholder is filled only if old call had no reported error and no relevant variable is definitely false; otherwise dropped. Loop optimization avoids havoc of assumption variables under modular loop reasoning; justification explicitly assumes no break for post-loop independence and notes previous unrolling can change initial values. §§4/7: supports strengthened contracts and weaker contracts whose old assumptions remain true in a relevant calling context. Not a general equivalence proof across program versions. More precise reuse for changed user assumes, preconditions and loop invariants, plus slicing, remains future work. §4: correctness explained through instrumentation arguments/examples, not a formal soundness theorem or mechanized cache proof. Depends on Boogie transforms, SMT outcomes, frontend dependency tracking and proper cached-result interpretation. Stores snapshots/results, not proof certificates. §4/Fig.5: Snapshot2 prose strengthens gcd postcondition to 1≤r, but printed line15 still asserts 0≤r. Caption says inserted assumes at lines7/9/13, while figure and p.389 prose show4/9/13; line7 is the still-failing assertion. Record these presentation inconsistencies without inferring an implementation bug. §5: eight unscripted expert IDE sessions with programs several hundred lines, not eight 30,000-line benchmarks. Ironclad >30,000 LOC is user-feedback context. No participant count, hardware, tool versions, repetitions/variance, controlled productivity study or full latency distribution reported. §5/Fig.6: default timeout 10s per procedure implementation, not per session. Timeout-reduction range applies to sessions with nonzero basic-cache timeouts. Reported average 17% is approximately mean per-session time reduction; it differs from reduction of aggregate total time. §5: larger benefit than parallel SMT instances is an author observation without numeric parallel baseline here. No artifact execution or independent reproduction. One remaining hard check can dominate despite many fully reused checks.
  • how much was read: most of it read
  • source
  • record id: fine-grained-caching-of-2015
• Giacobbe et al. GRN parameter synthesis (2015)
  • title: Model Checking Gene Regulatory Networks
  • what: For Wagner weighted gene-regulatory networks, synthesizes Boolean combinations of linear weight constraints characterizing all parameter assignments satisfying an LTL property. Symbolic bounded model checking plus SMT replaces repeated execution of each instantiated GRN and supports robustness computation under mutation distributions. The method encodes a parameterized labelled transition system without explicitly constructing or executing every GRN, recursively generates path constraints, and evaluates robustness by checking synthesized constraints. The motivating bistability network yields explicit inequalities; experiments cover five published GRNs and three oscillatory networks, with constraint evaluation up to three times faster in six of eight networks and exact/precision benefits when many samples are needed.
  • number: six of eight networks faster
  • number: up to 3× speedup
  • number: motivating example crossover around 1.2×10^5 samples
  • number: 95% confidence interval (0.8871, 0.8907) in motivating example
  • limits: Wagner’s model is synchronous, deterministic, Boolean, and uses fixed topology, thresholds, and bounded rational weight ranges; mutations are modeled independently across genome positions with a specified DTMC. Properties are LTL and checking is bounded, so scalability depends on horizon and SMT constraints. The authors identify missing expressiveness for multistate, asynchronous, nondeterministic, or stochastic GRNs and leave exact robustness point counting for future work.
  • how much was read: most of it read
  • record id: giacobbe-et-al-grn-parameter-synthesis-2015
• Hybrid Quantum Markov Chains (2015)
  • title: Quantum Markov chains: description of hybrid systems, decidability of equivalence, and model checking linear-time properties
  • what: Introduces hybrid quantum Markov chains and hybrid quantum automata that combine quantum states with classical control/input, proves equivalence reductions and polynomial-time trace equivalence, and studies linear-time safety properties. The paper shows hybrid quantum Markov chains can be simulated by ordinary quantum Markov chains, defines hybrid quantum automata with input-labeled quantum operations, and reduces finite automata language equivalence to quantum-state equivalence. Regular safety-property model checking is reduced to reachability-style linear algebra; general omega-regular properties remain harder.
  • number: Theorem 1 simulates hybrid quantum Markov chains by ordinary quantum Markov chains
  • number: Finite hybrid quantum automata equivalence is decidable in polynomial time
  • number: Trace equivalence of the corresponding quantum Markov chains is polynomial-time decidable
  • limits: Polynomial equivalence results are for finite automata/chains and rely on finite-dimensional linear-algebra representations. Safety checking assumes a regular bad-language automaton and excludes the empty bad language in the stated reduction. The authors do not establish a general omega-regular model-checking procedure.
  • how much was read: most of it read
  • record id: hybrid-quantum-markov-chains-2015
• Learning Commutativity Specifications (2015)
  • what: # Whole reading: Learning Commutativity Specifications (authored by agents unless marked 🧑) This paper learns compact commutativity conditions from black-box executions. Its logical theorems characterize approximation within a declared fragment; finite-sample success and formula stabilization do not establish soundness over all executions. Read the full saved 17-page PDF, §§1–9, references 1–23, all five figures and six numbered equations. No external supplement, author implementation or experimental artifact was inspected. ## D1: contribution Gehr, Dimitrov and Vechev infer logical specifications from black-box observations. The pipeline combines type-aware sampling, sample reduction, predicate discovery and exhaustive/greedy formula search. Commutativity of library data structures is the demonstrated application. Source: Q0, Q1, S1 in quotes.json; section/page/character/LF pointers are embedded in each anchor. Exact source passage (S1, title, abstract, §1 Introduction; physical PDF page 1, printed page 307): > In this work we present a new sampling-based “black box” > inference approach for learning the behaviors of a library component. ## D2: logical assumptions A fixed finite tuple of variables ranges over a relational structure with finitely many relation symbols, no function symbols or constants, and a Boolean-closed quantifier-free fragment; formulas are in negation normal form. Relations may themselves be defined with quantifiers. These restrictions yield finitely many isolated logical types. A logical type groups tuples satisfying exactly the same formulas; it is not a programming-language or type-theory type. Source: Q0, Q4, Q5, S2, S3 in quotes.json; section/page/character/LF pointers are embedded in each anchor. Exact source passage (S3, §3 Observation 2, Equation 2; §4.1 Theorem 1; physical PDF page 6, printed page 312): > We shall focus on the setting where: (i) the structure X is relational, i.e., it > mentions no function symbols (including constants); (ii) the relation symbols > are finitely many; and (iii) L(x) is the quantifier-free fragment of X. Combined, > these conditions guarantee that there are finitely many L(x)-definable relations > in the structure X, and therefore we can leverage Observation 2. We will further > assume that formulas are in negation normal form, i.e., that all negations are > pushed in front of atomic subformulas. ## D3: proved structural result Observations 1–2 state that definable relations are disjoint unions of type preimages and that a finite definable family yields finitely many isolated types. Theorem 1 characterizes the best definable under-approximation as the union of whole type preimages contained in the target relation. This characterizes the objective relative to a chosen fragment, not what finite sampling establishes about all behavior. Source: Q4, Q5, S4 in quotes.json; section/page/character/LF pointers are embedded in each anchor. Exact source passage (S4, §3 Observation 2, Equation 2; §4.1 Theorem 1; physical PDF page 6, printed page 312): > Theorem 1. The best under-approximation h ∈ H to any relation c over X > equals the disjoint union >  > {t ⊆ c | t is a preimage of some type}. ## D4: finite-sample objective Equation 3 maximizes accepted positives subject to accepting no sampled negative. Theorem 2 accepts types observed only positively and excludes negative or ambiguous types. A type is ambiguous when both labels occur; useful positive observations may therefore be rejected. Missing types remain unconstrained by this objective. Reader inference: a sample-optimal hypothesis need not be a sound under-approximation of the true relation. Source: Q6, S5, S6, S9 in quotes.json; section/page/character/LF pointers are embedded in each anchor. Exact source passage (S6, §4.1 Definition 5/Theorem 2/Equation 3; §4.2 Equation 4; physical PDF page 7, printed page 313): > Theorem 2. A hypothesis h ∈ H is optimal with respect to (3) for a given > sample (s+, s−) if and only if for every tuple u from X with non-missing type > u ∈ h ⇐⇒ tpL(x)(u) is positive > u ∈ h ⇐⇒ tpL(x)(u) is negative or ambiguous ## D5: search and minimality Dynamic programming enumerates formulas by Equation 4 size and identifies formulas equivalent on the sample. Exhaustive enumeration alone guarantees minimum size. Interleaved greedy weighted set cover seeks a disjunction of conjunctions false on all negatives; at size i these conjunctions have size less than i, and the algorithm returns a cover with fewer than 2i (two times i) conjunctions. The greedy path explicitly does not guarantee minimality, so do not attribute a universal smallest-syntax guarantee to the combined practical algorithm. Source: Q6, Q7, S7 in quotes.json; section/page/character/LF pointers are embedded in each anchor. Exact source passage (S7, §4.2 greedy search; §4.3 predicate discovery; physical PDF page 8, printed page 314): > it with a greedy algorithm, which does not guarantee minimality, but is much > faster in practice. ## D6: predicate discovery and limits The Boolean case removes opposite literals using sample monotonicity/antitonicity. Generalization uses literal-indexed neighbor relations on logical types; admissibility is defined for samples with no missing types. For integer order, types are ordered partitions, and neighbor operations swap or merge adjacent classes. The authors explicitly warn that missing types may prune literals needed by an optimal hypothesis. Source: Q7, Q8, S8 in quotes.json; section/page/character/LF pointers are embedded in each anchor. Exact source passage (S8, §4.3 Definitions 7–8/linear-order neighbors; §5 introduction; physical PDF page 9, printed page 315): > Because of missing types, the above method > may prune literals which are required for finding the optimal hypothesis. Thus, > our pruning approach is a heuristic that relies on good samples. ## D7: sampling and oracle assumptions Sampling trades type diversity (m examples overall) against evidence per type (k); it stops drawing from an ambiguous type. Reduction preserves one representative per positive/negative type and two opposite representatives per ambiguous type. When outputs cannot be chosen, sampling controls only the input type and classifies the completed argument/return tuple after execution. The commutativity oracle needs reproducible same-state runs and supplied abstract-state equality. Source: Q9, Q10, Q11, S12 in quotes.json; section/page/character/LF pointers are embedded in each anchor. ## D8: conditional soundness Section 5.1 guarantees a best sound approximation if every type has its observed status equal to its true status. Such a sample exists because type count is finite, but obtaining it can be infeasible; the authors suggest white-box verification. The paper does not give a probability or sample-complexity bound certifying that a particular finite sample satisfies this condition. Source: Q9, S9 in quotes.json; section/page/character/LF pointers are embedded in each anchor. Exact source passage (S9, §5.1 type-aware sampling, reduction and guarantees; physical PDF page 10, printed page 316): > Guarantees. If we obtain a sample of maximal informativeness, i.e., in which > every type has its observed status equal to its true status, then we are guaranteed > to infer (the best) sound approximation. Such a sample always exists (as there are > finitely many logical types) but obtaining it is often infeasible in practice. Thus, > we can combine our black-box approach with white-box verification, e.g., [12]. ## D9: stopping and termination Section 5.3 doubles new sample blocks, reruns search on cumulative examples from scratch, caps each search by that step’s sampling time, and returns the same formula after two consecutive outcomes. Theorem 3 states required search time is o(the increasing sampling-time limit) after sample reduction because reduced sample size is bounded by type count. This is a search/termination argument; stabilization supplies no proof of semantic soundness or PAC-style error/confidence bound. Source: Q10, S10, S11, S9 in quotes.json; section/page/character/LF pointers are embedded in each anchor. Exact source passage (S10, §5 Figure 3, §5.2 interface, §5.3 stabilization/Theorem 3; physical PDF page 11, printed page 317): > If the search gives the same result two consecutive times, then we > return the discovered formula. ## D10: commutativity meaning The two calls execute in both orders from the same initial state. A positive example requires matching final abstract states and corresponding return values; failure yields two negative examples. Equal(sigma1,sigma2) is supplied at the abstract level. The learned integer/Boolean equality/order fragment has arbitrary Boolean structure. The instantiated formulas omit the state and therefore approximate state-dependent specifications. Source: Q2, Q11, S12 in quotes.json; section/page/character/LF pointers are embedded in each anchor. Exact source passage (S12, §6 commutativity/Equation 5; §7 evaluation introduction; physical PDF page 12, printed page 318): > To compare states we assume that an abstract equality check, > Equal(σ1, σ2), is provided (naturally, we reason at the abstract level as opposed > to the bit for bit concrete level). ## D11: evaluation design and aggregation The paper evaluates method pairs of 21 data types, including six union-find variants, classic containers and bit structures. Initial sample size 5000 was tuned using Set/Map and reused. Figure 4 reports eight-run averages of each structure’s maximum across method pairs, separately for each column. Times are milliseconds unless seconds are explicitly marked; the full 21-row transcription is in evaluation.json. Source: Q11, Q12, S13 in quotes.json; section/page/character/LF pointers are embedded in each anchor. Exact source passage (S13, §7 UnionFind 6/Equation 6, Figure 4 and aggregation; physical PDF page 13, printed page 319): > For every data > structure we show the averaged maximum over all method pairs. ## D12: measured results and claim boundary Figure 4 reports formula sizes 1–19 and largest disjunct sizes 1–9, predicate-discovery search speedups 1.6–43.2 times, sampling values 35 ms–2.4 s, and search values 0.06–710 ms. These ranges are reader calculations over the reported averages of maxima, not confidence ranges. The authors report best approximations in every case, but the paper supplies no independent exhaustive/proof certification for every result. No experiments were reproduced for this record. Source: Q12 in quotes.json; section/page/character/LF pointers are embedded in each anchor. ## D13: sampling comparison Figure 5 compares type-aware and random sampling for Map put/put, get/put and get/get, with tuple lengths six, five and four. Typical illustrated runs stabilize at 15000 versus 75000 samples. Authors qualify faster exploration of new types as applying to larger tuples, about six components here, and note high random-sampling stabilization variance. The sample-count comparison does not establish a universal fivefold runtime improvement. Source: Q13, S14 in quotes.json; section/page/character/LF pointers are embedded in each anchor. Exact source passage (S14, §7 Figure 5/sampling comparison; §8 related work; physical PDF page 14, printed page 320): > We observe > that: (i) type-aware sampling explored new types more quickly than pure ran- > dom sampling, but only when sampling larger tuples (about 6 components in > this particular case); and (ii) type-aware sampling stabilized the inferred for- > mula much earlier (15 000 vs. 75 000 examples). In fact, in our experiments, we > observed large variance in stabilization time when sampling purely at random. ## D14: baselines and tradeoffs The paper reports that Daikon/DIG learned crude approximations because commutativity needs rich disjunctions, while explicitly saying the proposed approach is not strictly better: Daikon scales with more relations and DIG targets polynomial invariants. Perfect-separation learners fail on ambiguous types even when a useful approximation exists. The randomized method in reference 20 was not observed terminating with five or more variables. These comparisons lack a quantitative common-baseline protocol in the paper. Source: Q13, Q14, S15, S16 in quotes.json; section/page/character/LF pointers are embedded in each anchor. Exact source passage (S15, §8 comparisons and limitations; §9 Conclusion; physical PDF page 15, printed page 321): > That said, our approach is not strictly better. Daikon scales well when the num- > ber of relations in the fragment increases, and DIG specializes in polynomial > invariants. ## D15: reproduction limits The paper does not report hardware, all implementation settings, per-type k, seeds, detailed sampling distributions, uncertainty intervals, or complete baseline versions/timeouts. Eight-run averages alone do not quantify run variance; the text qualitatively notes large random-sampling variance. Reading the supplied PDF cannot establish unreported details. Source: Q9, Q10, Q12, Q13, Q14 in quotes.json; section/page/character/LF pointers are embedded in each anchor. ## D16: printed and extraction discrepancies Rendered §5.1 prints c- using nonmembership in s- while discussing the true target relation. Rendered Equation 5 repeats m2 in the reverse sequence; nearby invocation subscripts are inconsistent. Prose in §§2/6.2 resolves intended opposite-order semantics, but no implementation defect is inferred. Raw extraction also corrupts inequality, nonmembership, union, norms and superscripts; exact quotations retain raw characters, and separate rendered transcriptions explain the mathematics. Source: Q2, Q9, Q11 in quotes.json; section/page/character/LF pointers are embedded in each anchor. ## D17: distributed verification relevance: reader inference Direct relevance is discovery of conditions under which reordering preserves abstract state and returns. For distributed verification, one could use this as a source of candidate commutativity predicates or independence conditions, then separately check the required executions and state model. The paper itself does not prove a distributed protocol, linearizability or correctness under concurrency; its commutativity observations are pairs of sequential executions. Source: Q0, Q2, Q11 in quotes.json; section/page/character/LF pointers are embedded in each anchor. ## D18: Verus/Rust and TLA+ relevance: reader inference The learned predicates could motivate candidate Verus/Rust contracts or TLA+ action-independence conditions. Translation must state the logical fragment, abstract equality, state quantification and return-value meaning; a checker/proof must establish the candidate over the intended model. The paper contains no Verus, Rust or TLA+ implementation or evaluation, and supplies no such translation. Source: Q5, Q9, Q11, Q14 in quotes.json; section/page/character/LF pointers are embedded in each anchor. ## D19: specification/proof agents and evaluation: reader inference An agent could propose predicates, diversify examples by logical type, retain ambiguous examples and produce a compact formula. This paper supports separating candidate generation, sample consistency and whole-model proof. Evaluation should report the chosen fragment, oracle/equality assumptions, ambiguity and missing-type coverage, aggregation, actual proof/checker outcomes, and failures. Stable formulas alone do not certify soundness. No LLM or proof-writing agent is evaluated here. Source: Q6, Q8, Q9, Q10, Q11, Q12 in quotes.json; section/page/character/LF pointers are embedded in each anchor. ## Concrete cases and measurements Map put returns the old value. Equation 1 says distinct keys commute, or both puts leave their values unchanged: (k1 != k2) OR ((v1=r1) AND (v2=r2)). Figure 2 has six rows: four positive and two negative. Its first two rows have the same logical type despite different concrete values. This illustrates why logical-type diversity and removal of repeated types help. Source: Q2. unite(a,b) merges the classes under the representative of a and returns whether it changed the structure. Equation 6 is [((a1=a2) OR (a1=b2) OR (a2=b1)) AND r1 AND r2] OR (a1=b1) OR (a2=b2) OR ((NOT r1) AND (NOT r2)). This is a rendered transcription, not a literal raw quotation; it includes both changes, self-unions, and two no-change calls. Source: Q12. Figure 5 uses argument/return tuples of six, five and four components for put/put, get/put and get/get. The text reports stabilization at 15000 versus 75000 examples in typical illustrated runs and qualifies faster new-type exploration as applying to larger tuples here. Random sampling has high stabilization variance. Source: Q13, S14. Theorem 2 permits a useful best under-approximation even when a positive and a negative tuple have the same logical type. Such a type must be excluded wholesale; a classifier required to accept every positive would fail. A missing negative can leave a truly ambiguous type looking positive in a finite sample. Source: Q6, Q9, Q14. All 21 reported result rows, original time suffixes, aggregation and baseline limits are preserved in evaluation.json. Equations and printed discrepancies are separated from literal extraction in rendered_math_transcriptions.json. This record performs source reading and quotation validation, not empirical reproduction or formal checking.
  • limits: Finite relational/quantifier-free fragment and logical types; supplied black-box oracle and abstract state equality; sample-optimality versus conditional true-relation soundness; missing/ambiguous types; heuristic pruning/stabilization; incomplete experiment details; D2–D16.
  • how much was read: most of it read
  • source
  • record id: learning-commutativity-specifications-2015
• LTL distributed synthesis (2015)
  • title: Synthesis of Self-Stabilising and Byzantine-Resilient Distributed Systems
  • what: Synthesizes synchronous fault-tolerant distributed algorithms from LTL specifications, covering strong self-stabilization and Byzantine faults. Fixed-size bounded synthesis is complete for realizable specifications and optimizes implementation size and stabilization time. Defines universal transition systems, local transition systems and a bounded-synthesis SMT encoding. Byzantine synthesis uses an incremental CEGIS-like loop with error traces. The paper proves completeness for fixed network size, presents sufficient classes for arbitrary network-size correctness, and reproduces Dolev two-counting while extending to n-counting. Colorless specifications and majority-based abstraction support parameterized reasoning.
  • number: fixed-size synthesis complete for realizable specs
  • number: two classes with arbitrary-size correctness
  • number: n-counting extension beyond 2-counting
  • number: 64 GiB/8-core evaluation hardware
  • limits: Synchronous reactive processes with finite local state and a specified communication/failure model. Fixed-size completeness does not imply arbitrary-size correctness; the two arbitrary-size classes require stated structural hypotheses. Byzantine synthesis can be expensive; experiments use sequential solver runs and finite bounds. LTL specifications capture the modeled behavior, not physical network timing or implementation bugs.
  • how much was read: most of it read
  • source
  • record id: ltl-distributed-synthesis-2015
• Meeting a Powertrain Verification Challenge (2015)
  • what: Reports an extension of C2E2 that computes local trajectory-divergence bounds automatically and applies bounded-time reachability to a polynomial powertrain model. For two selected driver-behavior families, seven of ten printed properties are satisfied and three stricter variants are refuted, with50–53validated simulations for successes and2–4for failures. This is a model-verification case study; correctness/relative-completeness theory and detailed local-bound algorithm are delegated to earlier papers/report, not machine-checked here. Explains validated simulation plus discrepancy bloating, iterative initial-region refinement, Jacobian symmetric-part eigenvalue bounds, local coordinate changes and inactive-state reduction. Shows how selected STL obligations become timer-based safety requirements and preserves the limits of closed models and selected switching signals. Full result table exposes both positive and deliberately stronger negative specifications, with precise timings and hardware. Input schedules, initial radii, numerical validation and deferred proof assumptions prevent independently reproducing or generalizing the reported verification.
  • limits: Target is polynomial hybrid Model3 from the cited benchmark, not the full higher-fidelity engine suite. Four modes are startup, normal, power and sensor_fail. Continuous engine states are manifold pressure p, air/fuel ratio lambda, pressure estimate pe and integrator i. Introduction says five continuous variables; Figure1 lists these four plus throttle input, and an auxiliary timer is introduced for properties. The paper does not fully reconcile its state-dimension count; do not silently treat it as five autonomous engine states. Figure1 transitions: startup→normal when timer=Ts; normal→power when throttle>=70degrees; power→normal when throttle<=50degrees; normal→sensor_fail on sensorFail. Normal-mode equations are nonlinear polynomials in engine states with parameters ci, engine speed omega and throttle theta_in; Fc and mass flow are auxiliary expressions. Constants and other mode equations are not fully supplied, so this paper alone is not a complete numerical model specification. C2E2 handles closed automata only. Piecewise-constant driver inputs are closed by constructing a family of switching signals for each behavior of interest. Verification covers initial uncertainty and that selected family, not every possible driver, sensor-failure schedule or arbitrary open input. Authors choose two behavior sets said to visit all modes; exact signal ranges/schedules and branch-wise allocation to table rows are not printed. Initial uncertainty is a state-space ball. Its center, radius, exact cover and coordinate units are not supplied. Time horizon T=20 and startup Ts=9 are reported. Figure2 shows an illustrative trajectory/reachable envelope over startup/normal/power/normal; it does not by itself demonstrate sensor-fail coverage or reproduce all selected schedules. Validated simulation is defined as time-stamped regions enclosing the ODE solution on each interval with bounded diameter. A discrepancy function bounds distances between any compared trajectories and vanishes as initial points converge. These are mathematical obligations supporting bloated reachability; ordinary sampled trajectories without valid bounds would not suffice. Algorithm covers the initial region with delta-balls, validates a representative trajectory, bloats by discrepancy, then refines ambiguous balls. Disjointness from unsafe states establishes safety; violation needs a genuine unsafe execution or a certified enclosure contained in the unsafe region at a relevant time. Mere overlap of an overapproximation with unsafe states is inconclusive, not a counterexample. The terse interval/set exposition does not fully formalize this temporal decision rule. Soundness and relative completeness are attributed to the discrepancy properties and Theorem13 of ref6; full assumptions are not repeated. Vanishing enclosure error alone is not a claim that every boundary-touching model terminates or that safety is decided under all numerical conditions. Imported proof and its implementation correspondence have not been independently checked. Automatic local discrepancy uses Jacobian Jf and a Lipschitz constant Lf, a coarse short-time reachable enclosure, and an upper bound on the maximum eigenvalue of the symmetric Jacobian over that region. Rates may be negative. Full construction/correctness is deferred to ref10. Tool still requires a user-supplied Jacobian, so removal of discrepancy annotations is not removal of all mathematical input or proof obligations. Implementation uses Eigen for eigenvalues and interval arithmetic to maximize error-matrix norms. No exact arithmetic, outward-rounding contract, user-Jacobian validation or certified Eigen error bounds are described. These are uninspected implementation/trust boundaries, not demonstrated failures. Model translation from Simulink to the C2E2 automaton is not proved correct here. Local coordinate changes mitigate spurious positive divergence bounds for systems with complex eigenvalues, trading exponential-rate improvement against a multiplicative error factor. The coordinate-update horizon is tuned; no numeric setting or ablation is given. Startup/power reduction omits i from discrepancy computation only where i_dot=0 and i is absent from other right-hand sides; this is not unrestricted integrator elimination in normal mode. Properties reducible to bounded-time invariants use timers since trigger events. Here rise denotes throttle changing from0 to60. For rise, lambda stays within a reference band after eta and until zeta. Table settling intervals are open(eta,zeta), unlike some closed invariant intervals; boundary conventions matter. Arbitrary STL, unbounded liveness and path-integral properties are not covered; integral obligations were explicitly excluded. Reported parameters eta=eta_power=1, eta_s=.5, Ts=9,T=20,lambda_ref=14.7,lambda_power_ref=12.5,zeta=4. Seven positive rows use50or53simulations and615–718seconds; three negative rows use2or4simulations and24,43,45seconds. Simulation counts describe representatives/enclosure construction, not independent random tests or enumeration of every initial state. Experiments use an Intel Quad-Core i7,8GB RAM and Ubuntu11.10. No repeats, variance, parallelism settings, exact CPU model, solver tolerances or raw traces are printed. Faster negative rows are attributed to early exit, not a statistically established universal relation between satisfiable/violated-property runtime. Flow* is said to be unable to verify these models due to nonlinear complexity, but no version, resource limit, settings or comparison table is supplied. Treat as an author report, not a controlled head-to-head benchmark. First-verification priority is also an author knowledge-qualified claim. Tool/model link is http://publish.illinois.edu/c2e2-tool/powertrain-challenge/. Artifact contents, user Jacobian, initial set, switching family and returned witnesses were not opened/run. No machine-checked proof or independently reproduced verification result is established in this reading. Higher-fidelity variants with delay differential equations, actuation delays and lookup tables are future work and explicitly unsupported. No verified Rust/Verus, TLA+, LLM specification/proof agent or distributed-system implementation is evaluated. Methodological relevance is the separation between simulation testing and validated overapproximation, and between selected environmental assumptions and universal model coverage.
  • how much was read: most of it read
  • source
  • record id: meeting-a-powertrain-verification-2015
• Multi-core ESBMC partitioning (2015)
  • title: Applying Multi-Core Model Checking to Hardware-Software Partitioning in Embedded Systems
  • what: Extends ESBMC SMT-based bounded model checking with OpenMP-launched independent instances that search different hardware-cost bounds, applying it to NP-hard hardware/software partitioning and comparing against ILP and a genetic algorithm. The paper formalizes a directed task graph with hardware/software node costs and crossing-edge communication costs, fixes a software-cost limit, and asks for minimum hardware cost. Multi-core ESBMC launches one checker instance per available core, each testing a candidate optimum; instances share no verification state. ASSUME encodes software-cost constraints and ASSERT detects the optimum. Benchmarks include Patricia, CRC32, Dijkstra, clustering, RC6, Fuzzy and Mars; the paper reports exact solutions, runtimes, timeouts, memory-outs, GA error, and speedups. Results show parallel ESBMC is faster than single-core but still limited by state growth and problem size.
  • number: Multi-core ESBMC relative speedup 1.9–60.3 on solved benchmarks
  • number: exact solutions for Patricia, CRC32, Dijkstra, clustering; RC6/Fuzzy/Mars timed out or memory-out
  • number: ILP timed out on Fuzzy; GA errors ranged from -37.6% to 29%
  • number: conclusion identifies about 150 nodes as ESBMC practical limit and 400 nodes as broad limit for all tested methods
  • limits: The model has one software processor and one hardware context; hardware execution time is zero, software scheduling is omitted, and communication cost applies only across contexts. BMC guarantees counterexamples only to a selected bound and uses SMT backends that remain single-threaded; OpenMP parallelism is portfolio search, not a parallel solver. Benchmarks are synthetic/task-graph cases on a standard desktop, and scalability degrades beyond roughly 150–400 nodes.
  • how much was read: most of it read
  • record id: multi-core-esbmc-partitioning-2015
• Nidhugg chronological-trace DPOR (2015)
  • title: Stateless Model Checking for TSO and PSO
  • what: Introduces chronological traces for executions under TSO and PSO. The traces induce an acyclic happens-before partial order that is in one-to-one correspondence with Shasha-Snir traces, enabling Source-DPOR and Optimal-DPOR to explore complete equivalence-class representatives without redundant relaxed-memory executions. The paper formalizes TSO store buffers, loads, fences and auxiliary update threads, defines six chronological edge relations and proves equivalence with Shasha-Snir traces for completed executions. It proves DPOR coverage (at least one execution per class) and Optimal-DPOR minimality (exactly one), then implements Source-DPOR in Nidhugg over LLVM IR/pthreads, with spin-loop replacement by load/assume. Experiments cover racy mutual-exclusion benchmarks, robust mutex code, Apache Portable Runtime (~8000 lines), and comparisons with CBMC/goto-instrument; PSO slowdown is linked to one buffer per memory location.
  • number: 3 GHz Intel i7, 6 GB RAM
  • number: 10-minute cutoff
  • number: benchmark cores 36–118 C lines
  • number: Apache cases ~8000 lines each
  • limits: Programs consist of deterministic assembly-like threads with store/load/fence instructions; TSO uses FIFO per-thread buffers and PSO adapts buffering by location. Shasha-Snir equivalence is defined for completed executions, and coverage is bounded by explored test/program executions. Nidhugg interprets LLVM IR and pthread hooks, so unsupported language/architecture features and interpreter assumptions apply. Spin-loop collapsing is an optimization that may affect practical behavior; PSO memory use/time grows with the number of accessed locations. Planned Power, ARM and C/C++ memory-model extensions are not included.
  • how much was read: most of it read
  • record id: nidhugg-chronological-trace-dpor-2015
• Pak EULRPART Euler partition bijection 2015 (2015)
  • title: Euler’s Partition Theorem
  • what: Pąk formalizes a bijection proving that partitions of any natural n into odd parts and into distinct parts have equal cardinality. The Euler map replaces each distinct part o·2^a by2^a copies of odd o. Its formal definition groups positions by odd factor and specifies output multiplicities independently of grouping order. Injectivity uses distinct powers of two within each group; surjectivity expands each odd multiplicity in binary, concatenates the resulting distinct parts and sorts them. Records sequence rather than multiset representation,empty partition handling,position-group independence,preservation of weighted sums,exact multiplicity contracts and inverse binary reconstruction. Identifies cardinality bars missing from extraction and unexpanded injectivity reasoning.
  • limits: MML EULRPART version8.1.04 5.32.1237 identifies the article. n is a natural number including0. Definition3 represents a partition by a nonzero-valued,nondecreasing,natural-valued finite sequence summing to n. Nonzero refers to entries,not nonempty sequence: Theorem3 makes the empty sequence a partition of0. Distinct parts mean the sequence is one-to-one;odd parts mean every entry is an odd natural (pp.93–94). Definitions1/2 define odd-valued relations/functions by range inclusion or pointwise odd-natural entries;Theorem2 identifies the odd-natural set. Empty relations are odd-valued and odd singletons/concatenations retain that property. Theorem1 supports concatenating sorted sequences when the last entry of the first is≤the first entry of the second (p.94). Definition4 uses imported valued/double reorganizations of positions: block j holds exactly occurrences whose value is2j−1. Theorem4 recognizes such an organization. Theorem5 says group sums of another complex-valued sequence do not depend on which odd organization is chosen (provided it reorganizes the same domain);this supports an order-independent multiplicity specification (pp.94–95). Theorem6 decomposes each positive part p_i uniquely as odd O_i times2^a_i,with O and a of the same length as p. Its displayed proof chooses factor/exponent pairs and projects to sequences. Uniqueness of odd factor/exponent is used later in11 to handle every valid decomposition,not just the witnesses chosen by the construction (pp.95–97). Theorem7 realizes prescribed natural multiplicities on a finite set by a finite sequence,proved by induction on set cardinality. Theorem8 distributes pointwise products over aligned concatenations. Theorem9 recovers a natural sequence sum from value times occurrence count. Coim denotes an inverse-image set;its cardinality,not the set itself,is equated with a multiplicity in these formulas (p.95). Theorem10 creates a finite multiplicity vector of twice the organization length,with zero even positions and each odd position equal to the corresponding group sum. Theorem11 applies it to the powers2^a: c_(2j−1)=sum_(i:O_i=2j−1)2^a_i. Weighted sum of these multiplicities equals sum p=n; sorting a realization yields an odd-valued partition e. The statement quantifies over every compatible decomposition and organization (pp.96–97). Definition5 names that odd output the Euler transformation of a one-to-one partition. Theorem12 gives the equivalent compact contract using an odd organization and group sums. Output sorting and multiplicities determine a canonical sequence;organization order does not create a different partition. This is a formally specified map,not a performance-tested implementation (p.97). Theorem13 derives injectivity of the exponent sequence inside each odd-factor group from injectivity of O·2^a. Different exponents therefore contribute distinct binary powers. Theorem14 states equal Euler outputs imply equal original partitions,but gives no proof sketch on the page. Explaining14 through uniqueness of binary representation is mathematical reading inference supported by13 and the construction,not an inspected Mizar dependency trace (p.98). Theorem15 takes odd-part multiplicities H(k) for1≤k≤n,with weighted sum n. It chooses increasing exponent sequences representing H(k) as sums of distinct powers of two;nonempty groups require odd k because even multiplicities are0. Each group yields k·2^exponent;flattening and sorting gives a distinct-part partition. Within-group exponent distinctness and unique odd factor prevent collisions. The displayed sketch asserts these properties through imported lemmas rather than expanding all details (p.98). The final16 equates cardinalities of the two partition sets,using surjectivity15 and injectivity14. Raw extraction omits overbars and misleadingly renders this as equality of sets. The sets are generally different: (2) is a distinct-part partition of2 while(1,1) is odd-valued. The PDF shows cardinality bars,as it does over Coim occurrence sets and finite D (pp.95–98). Illustrative inference,not a printed example: distinct partition(1,2,3) of6 maps to(1,1,1,3),because1=1·2^0,2=1·2^1,3=3·2^0. Binary multiplicities3=1+2 for odd1 and1 for odd3 recover the original distinct parts. At n=0 both sides contain the empty partition and the construction has no nonempty groups. The article follows Wilf lecture notes and cites integer-partition texts and reusable finite-sequence/flexary-operation libraries. The multiplicity/sum proofs are partly displayed,but no generating-function proof,asymptotic counting formula,executable extraction,runtime bound,benchmark,proof/check-time statistics or checker transcript is supplied. The item45 listing is a reported motivation,not a new verification experiment (all pages). All seven pages,five definitions,16numbered results/all clauses/sketches,funding footnote,30references/date read. Quotation text is an exact excerpt of the saved raw extraction, not a visual transcription: defects include absent cardinality bars,composition rendered as spacing,exponent placement,ellipsis-based flexary sums,concatenation a,and U+0003 proof-end glyphs;11 proof also prints sort1 in its final line where s1 was used earlier. Renderings govern notation;MML/source/checker not run. No distributed protocol,Verus/Rust/TLA+ or LLM-agent result.
  • how much was read: most of it read
  • source
  • record id: pak-eulrpart-euler-partition-bijection-2015-2015
• Parallel explicit generalized Büchi checking (2015)
  • title: Parallel Explicit Model Checking for Generalized Büchi Automata
  • what: Develops parallel Tarjan- and Dijkstra-style SCC emptiness checks for transition-based generalized Büchi automata. Threads swarm DFS traversals while sharing only stable SCC/dead-state structure through a lock-free union-find augmented with acceptance marks; a mixed portfolio combines both strategies. The generic canvas defines shared stop/union-find state and local DFS, LIVE, livenum, and pstack structures. Tarjan propagates lowlinks on backtracking; Dijkstra merges partial SCCs on closing edges and detects acceptance earlier. Proof sketches establish safety of shared information and acceptance detection, while complexity analysis identifies union-find contention in large SCCs. Experiments with Spot and DiVinE compare 1–12 threads on BEEM products, separating empty (satisfied) and nonempty (violated) formulas and analyzing topology-dependent scaling.
  • number: 2–12 threads
  • number: 10 benchmark models per plot group
  • number: union-find operations m versus n−1 per SCC
  • number: 2015 TACAS prototype
  • limits: The automaton is finite and transitions carry generalized acceptance marks; correctness relies on lock-free compare-and-swap union-find and stable SCC/DEAD facts. Local traversals may redo work when another thread marks a state DEAD. Speedups depend strongly on SCC shape and union-find contention; prototype absolute times lag sequential CNDFS, and one comparison precomputes products for LTSmin due to a bug. The approach is explicit-state and does not address symbolic or unbounded systems.
  • how much was read: most of it read
  • record id: parallel-explicit-generalized-bu-chi-checking-2015
• PDR∀ universal invariants (2015)
  • title: Property-Directed Inference of Universal Invariants or Proving Their Absence
  • what: Extends IC3/PDR to universal first-order invariants using finite-model diagrams. On termination returns an inductive universal safety invariant, a concrete counterexample, or a proof that no such invariant exists over the chosen vocabulary. Implements the algorithm for linked structures and evaluates verification, deliberate bugs and invariant-expressibility failures. Finite-state models are generalized to existential diagrams specifying every relation/constant and distinct element, so their negations provide universal strengthening clauses. Lemma 1 shows that a diagram implies every closed existential formula true of its model. This makes diagram blocking precise relative to universal inductive invariants. Frames overapproximate bounded reachable states; recursive predecessor blocking, clause propagation and unsatisfiable-core generalization seek a fixed point. If blocking reaches initial states, bounded model checking distinguishes a genuine trace from a spurious diagram trace; Proposition 1 proves the latter excludes every universal safety invariant in the vocabulary. The shared-tail/traverseTwo example demonstrates the universal-submodel preservation obstruction: removing the shared tail from a reachable model creates a bad submodel. Implementation uses EAR reachability logic reduced to EPR, Z3 finite models and auxiliary allocation/input-membership/order predicates for rich specifications. Table 1 compares memory safety to prior human-template PDR shape analysis and also reports stronger functional verification.
  • number: 22 verified correct-program rows (11 singly-linked, 4 sorted singly-linked, 3 doubly-linked, 4 composite structures)
  • number: full verification: split 206 s, 8 frames, 1,143 Z3 calls, 36 clauses (19 universal)
  • number: full verification: sorted-merge 655 s; insertion-sort 1,934 s, 14 frames, 4,783 calls, 41 clauses (18 universal)
  • number: no universal invariant: shared-tail 3.6 s, 2 frames, 42 Z3 calls; comb 2 s, 3 frames, 52 calls
  • limits: No termination guarantee. Init, transition and Bad must be representable in the chosen first-order logic; satisfiable queries need finite models. The presentation assumes SAT/model procedures; implementation uses decidable EAR (relational ∃∀ with restricted deterministic transitive closure, no function symbols), reduced to EPR. More complex control flow is encoded via a program counter. Absence result is limited to universal inductive invariants over the fixed vocabulary, not program incorrectness or impossibility of richer proofs. Auxiliary predicates are used despite no user-supplied abstraction templates. EAR has limited ability to express list segments not pointed to by variables. Benchmarks are small list/data-structure algorithms; four bugs are deliberate. No liveness, distributed-protocol, Verus/Rust, TLA+, or LLM evaluation. Timing comparisons to [32] concern memory safety; that baseline’s functional specifications are stated to be weaker, so full-correctness columns are not directly like-for-like.
  • how much was read: most of it read
  • source
  • record id: pdr-universal-invariants-2015
• ROBMC fence insertion (2015)
  • title: Property-Driven Fence Insertion using Reorder Bounded Model Checking
  • what: Introduces ReOrder Bounded Model Checking (ROBMC), restricting exploration to executions with at most k weak-memory reorderings, and two fence-insertion algorithms (ROBMC and early-termination ROBMC-Et). The property-driven method seeks only culprit reorderings needed to satisfy assertions, avoiding innocent reorderings. Cbmc/Minisat implementation compares ROBMC against traditional SC restoration and iterative fence insertion on mutual-exclusion and work-stealing benchmarks under TSO and PSO.
  • limits: Concurrent C programs use pthreads and one shared variable per statement; reorder relations encode TSO or PSO weak-memory permissions. Bound K2 equal to all statement pairs is required for soundness; increasing k makes queries more expensive and does not remove asymptotic complexity. Results are bounded-model-checking/fence-placement results, not proof of unbounded program correctness.
  • how much was read: most of it read
  • source
  • record id: robmc-fence-insertion-2015
• SeaHorn (2015)
  • title: The SeaHorn Verification Framework
  • what: SeaHorn separates source/LLVM syntax and semantics, CHC verification-condition generation, and solver engines. It adds configurable small/large-block and heap abstractions, mixed-semantics assertion lifting, interprocedural error-carrying summaries, Spacer array projection and IKOS invariant support. Evaluation covers SV-COMP 2015, 215 selected hard C benchmarks and two autopilot programs, with source-level comparison limits.
  • limits: Safety results depend on compiler/preprocessing, inserted checks, LLVM semantics, selected abstractions and CHC engines. Broad LLVM-language support is a goal; experiments are C. Legacy front-end uses unsupported tools; heap uses a simpler context-insensitive DSA variant. No general verified compiler/encoding/solver theorem or mechanized end-to-end proof is supplied here. Hard cases are selected by SeaHorn failure/slowness, not an unbiased population. Avionics variants have different check counts and analyzer rows are insufficiently explained. Figure 6 includes interprocedural regressions.
  • how much was read: most of it read
  • source
  • record id: seahorn-2015
• Skipping Refinement (2015)
  • what: Introduces skipping refinement for optimized reactive systems whose concrete implementation can perform several abstract specification steps in one step. It defines skipping simulation by finite path partitions, defines refinement using a relation and refinement map, and gives well-founded and reduced well-founded skipping relations. Theorems 2 and 3 establish soundness and completeness of the reduced proof rule; Theorem 1 shows equivalence of the two local formulations. Three case studies cover a JVM-inspired buffered stack machine, an optimized memory controller, and scalar-to-vector SIMD compiler transformation. The proof rule handles four local cases: direct matching, left stuttering with a well-founded rank, right stuttering with a natural rank, and bounded-or-general reachability for skipping. Completeness constructs ordinal ranks from computation trees, and the authors argue refinement maps always exist. In experiments, BSTK/STK and OptMEMC/MEMC models ranged from 24K gates/500 latches to 2M gates/23K latches; four model checkers (TIP, IIMC, BLIMC, SUPER PROVE) were run with a 900-second timeout on a Xeon X5677, 16 cores, 3.4GHz, 96GB. Most I/O-equivalence configurations timed out while all except TIP solved all configurations with skipping refinement, with several-orders-of-magnitude improvement. ACL2s proved the infinite-state SIMD case; the authors report less manual effort than I/O-equivalence proofs.
  • number: {‘printed_pages’: 17, ‘model_checker_count’: 4, ‘timeout_seconds’: 900, ‘gate_range’: ‘24K–2M’, ‘latch_range’: ‘500–23K’, ‘hardware_cases’: 2, ‘compiler_cases’: 1}
  • limits: Transition systems have left-total relations and possibly infinite state spaces. The local reachability argument relies on a constant bound on the number of abstract steps a concrete step can skip for the optimized systems considered; unrestricted reachability is otherwise nonlocal. The SIMD case simplifies states to instruction sequence, program counter and store, assumes that a SIMD instruction operates on two sets of data operands simultaneously and basic-block parallelism, and excludes control flow. The paper says existing correctness notions do not allow skipping; its model-checking comparison uses I/O equivalence as a straightforward baseline, not an equivalent proof obligation. Experiments use relatively simple configurations and public artifacts were recorded but not rerun here. The paper leaves characterizing which temporal properties are preserved by skipping refinement to future work; it does not establish arbitrary temporal-property transfer.
  • how much was read: most of it read
  • source
  • record id: skipping-refinement-2015
• TLA+ to SMT-LIB encoding (2015)
  • title: Encoding TLA+ set theory into many-sorted first-order logic
  • what: Presents the translation used by a TLAPS SMT backend to encode TLA+’s untyped ZF-style sets and functions into many-sorted first-order logic. A universal sort represents non-Boolean TLA+ values, Boolification identifies propositions, and preprocessing rewrites/abstracts non-basic constructs before SMT solving. The encoding handles heterogeneous untyped expressions, set membership and extensionality, partial-domain functions, tuples, records, arithmetic bridges between TLA+ values and SMT integers, and deterministic Hilbert choice. A sound terminating/confluent rewrite system normalizes operators; abstraction introduces fresh symbols for residual non-basic terms, while definition elimination reduces user definitions. The backend targets shallow non-temporal obligations common in distributed-algorithm safety proofs. Benchmarks cover Peterson and Bakery mutual exclusion, Memoir type/refinement proofs, and finite-set cardinality, comparing CVC4/Z3 with ZIP backends and typed/untyped encodings.
  • number: CVC4 v1.3 and Z3 v4.3.0
  • number: 300-second timeout
  • number: Peterson/Bakery/Memoir and 7 finite-set benchmarks
  • number: three-step Preprocess: Boolify, Reduce to fixed point, then SMT embedding
  • limits: The target is non-temporal proof obligations rather than temporal model checking or deep set-theory theorems. General set extensionality is omitted for efficiency, so the encoding is incomplete unless users add needed extensionality instances. Quantifier generation can overwhelm SMT solvers; rewrite/abstraction may expand formulas. Arithmetic is linked through an injective embedding into a universal sort and relies on solver reasoning. External SMT solvers are temporarily part of TLAPS’s trusted base; proof reconstruction in Isabelle is future work.
  • how much was read: most of it read
  • record id: tla-to-smt-lib-encoding-2015
• ASM2Bogor (2014)
  • title: An Efficient Solution for Model Checking Abstract State Machine Using Bogor
  • what: Presents ASM2Bogor, an automatic translator from AsmetaL abstract-state-machine specifications to Bogor’s BIR language, including domains, functions, initialization, transition rules, monitored inputs, parallel/forall rules, LTL properties and invariants, followed by model checking and counterexample generation. The report defines validation for unsupported constructs (for example forall over infinite Integer domains), maps abstract/enumerated/subset/sequence domains and controlled/derived/monitored functions, encodes parallel rules using invisible guarded BIR locations and changed-variable tracking, and rewrites AsmetaL LTL/invariants into Bogor temporal-property functions. Six case studies exercise sluice-gate, one-way traffic-light, dining-philosophers, critical-section, tic-tac-toe and ferryman models.
  • number: 6 case studies
  • number: tic-tac-toe 596638 transitions/49304 states
  • number: dining philosophers 8801 transitions/353 states
  • number: sluice gate 1041 transitions/81 states
  • limits: Only AsmetaL constructs with a BIR mapping are accepted; infinite-domain forall is rejected, and monitored functions are represented by nondeterministic threads because environment interaction is unavailable. State-space exploration inherits Bogor’s finite-state/model-checking limits. The ferryman case exposes a false property and one error, showing modeling/specification mistakes are detectable rather than proving all models correct.
  • how much was read: most of it read
  • record id: asm2bogor-2014
• Bancerek AOFA_L00 algorithmic logic 2014 (2014)
  • title: Algebraic Approach to Algorithmic Logic
  • what: Bancerek formalizes an algebraic framework in Mizar: extensible sorted signatures, languages with substitution/free variables/equality, combined language/program algebras, and closed theories. It derives propositional and quantified logical laws and nine algorithmic consequences for assignment, composition and if/while constructs. Theorems concern membership in a theory satisfying explicit axiom/closure assumptions; no operational-semantics soundness/completeness or concrete program verification is supplied. Tracks fresh-symbol construction, algebra reduct preservation, sort-preserving substitution/capture avoidance, explicit theory closure and nonempty-versus-consistent distinction, stronger fresh-variable conditions for equality, exact loop premises and lack of termination theorem. Flags visually confirmed unusual Definition21 and its literal conflict with variable singleton support under later combined hypotheses, without claiming the unchecked Mizar artifact is inconsistent.
  • limits: Paper is a Mizar library article, AOFA_L00, release 8.1.03/5.25.1220. Stated foundations are Mendelson propositional/quantifier logic and Mirkowska–Salwicki Algorithmic Logic; program algebra and basic free-variable algebra are inherited. Includes 47 definitions and 162 propositions: foundation 1–34, propositional 35–105, quantifier/equality 106–153, algorithmic 154–162. Author reports formalized library results; reader did not rebuild Mizar or inspect full source proofs (p225, §§1–6). Base many-sorted signature Ω describes typed term operations. PC signature adds formula sort and six distinct properly typed Boolean connectives at positive offset n; QC adds two injectively indexed quantifiers per variable disjoint from Boolean connectives; AL adds a distinct program sort and three program×formula→formula operators. Correctness here denotes these signature/typing requirements, not semantic validity of every axiom (Definitions 4–6). Proposition 11 constructs an extension of any signature using ordinal suprema: formula sort sup(carrierΩ), program sort its successor, nine fresh connectives sup(operation-carrierΩ)+i, quantifiers tagged triples. Proof establishes disjointness using ordinals versus pairs, extends arities/result sort and pads connective sequence to chosen n. Essential signature additionally separates added operations/sorts from original Ω. Later disjoint renaming construction uses products and inverse first projections (Proposition 22). These are explicit symbol-allocation/type compatibility proofs, not parser correctness (§1–2). Tolerating means two functions agree on common domain. Extending variable families preserves old sort components, using empty sets for new sorts when required. Q is T-extension iff its Ω-reduct equals underlying algebra of T. Proposition 17 extends prescribed carriers on any subset I of new sorts; Proposition 18 preserves nonempty carriers given nonempty old algebra and new family. Proof uses override of sorted carriers and operations, not a claim that arbitrary chosen logical axioms are consistent (§1–2). Language combines sorted algebra, a free-variable map, sort-preserving substitution and equality operation on same-sort term pairs. Formula is an element of nonempty formula sort. Free variables for Boolean connectives are unions, for truth empty, and quantification removes bound singleton. Finite support is separate property. Capture-avoiding quantified substitution uses fresh z outside supports of replacement and body when binder occurs free in replacement; requires an available variable and records side conditions rather than eliding them (Definitions 8–37). Substitution-correct(1) gives identity x←x and homomorphism through nonquantifier operations; (2) replaces variable by same-sort term; (3) adds further support/renaming properties as literally printed. Equality substitution correctness distributes substitution over equality. Equality free-variable correctness gives support union and a variable its singleton support. Stronger equality theorems explicitly assume finite supports, infinite variable family in relevant sort and multiple substitution-correctness attributes (Definitions 16–17,21,44–45; §5). Reader source caveat: Definition 21 p. 236 literally requires y∉vf(τ1)(σ) for every variable y∈Y(σ) and arbitrary τ1, followed by additional conditional clauses. Visually confirmed, not extraction-only. Definition 45 p. 243 gives vf(y)=singleton y for a variable. Under later use Y=X extended by empty new sorts and nonempty/infinite X(σ), taking τ1=y makes these two printed requirements incompatible. Propositions 149–150 assume both substitution-correct(3) and vf-eq-correct plus infinite X(σ), so under a literal reading their premises cannot jointly hold. This is a reader deduction about printed definitions; no claim that actual Mizar code is inconsistent or that all other theorems are vacuous. Paper does not exhibit a model satisfying these combined stronger premises (§2–3, §5). Bialgebra combines language structure with program algebra carrier, characteristic operations and assignment map. AL-correct ties program carrier to program sort. If-while algebra packages nonempty/well-founded/nondegenerate strict syntax, base algebra extension, free-variable correctness, substitution and constructors for empty instruction, concatenation, conditional and while. Several attributes come from previous program-algebra paper and are not re-proved as operational semantics here. New M·α and union-like/intersection-like operators are algebraic formula constructors; flow extraction renders latter as d(M,α)/e(M,α), PDF shows large union/intersection symbols (Definitions 38–41, §3). PC theory is a subset of formulas containing classical Hilbert-style axiom schemas (including excluded middle) and closed under modus ponens. QC theory adds instantiation, side-conditioned quantifier movement, negation duality and universal generalization. Equality adds reflexivity and substitutivity. AL theory adds distribution, recurrence/monotonicity and assignment/composition/conditional/loop schemas relative to fixed formula φ. Theory membership α∈F is the result notion; paper does not identify it with truth under all state interpretations (Definitions 42–47). Existence of closed theories uses full formula carrier, which trivially contains every axiom and is closed under every rule. This proves nonemptiness/existence, not consistency, a proper nontrivial theorem set, or soundness/completeness. No claim of contradiction is inferred solely from this construction. No least theory construction, concrete state/transition model, solver runtime or empirical success rate supplied (§3). PC propositions 35–105 derive identity/transitivity/currying, conjunction/disjunction commutativity/associativity/distribution, contraposition, classical double negation, De Morgan laws and equivalence transport. Printed arguments mostly cite earlier proposition numbers; full derivation scripts are not reproduced. QC 106–145 derives monotonicity/duality/commutation, bound-variable support facts and moving fresh-independent formulas across quantifiers. For example x∉vf(α) needed for ∃x(α∧β)⇔α∧∃xβ; ∃x∀yα⇒∀y∃xα is one direction, not unrestricted exchange equivalence (§4–5). Equality 146–153 derives substitution stability, symmetry/transitivity, equality-mediated renaming/quantification and (α∧x=y)⇒α[x←y]. Proof assumptions vary: symmetry/transitivity add finite support, infinite variable sort and substitution(2)/(3); 149–150 additionally require vf-eq and vf-QC. Do not silently generalize all equality laws to arbitrary language structure; printed combined-premise caveat above applies (§5). AL closure explicitly assumes M distributes through binary conjunction/disjunction, union-like recurrence U(M,α)⇔α∨U(M,M·α), intersection-like recurrence I(M,α)⇔α∧I(M,M·α), and monotonicity for U/I. These fixed-point equations alone do not establish least/greatest fixed-point semantics over runs. Assignment substitutes term; sequential composition (M;M1)·α⇔M·(M1·α). Conditional evaluates algorithm M then tests fixed φ/¬φ before branch. These equations are theory axioms, not proved from a concrete execution model in this article (Definition 47). Nine final AL consequences: triple conjunction/disjunction distribution; U/I respect theory equivalence; two-step unrolling exposes α and M·α before recursive tail; variable-to-variable assignment is formula substitution; if-rule concludes from either test/branch pair; while-rule concludes if M·¬φ and α are known, or M·φ and M·(M1·(while M do M1·α)) are known. Recursive branch already mentions loop result. Thus Proposition 162 is not a loop-termination theorem, induction/invariant rule establishing arbitrary iterations, or a verified compiler/program implementation (Propositions 154–162). No concrete distributed protocol, fault/scheduling model, Rust/Verus, TLA+ translation, LLM agent or benchmark. No quantitative build-time/proof-size result. Contribution is reusable formal logic infrastructure; relevance to proof-agent evaluation is tracking definitional axioms versus derived facts, exact side conditions and possible vacuity of literal printed hypotheses. Archived release identifier is a source pointer, not reader validation.
  • how much was read: most of it read
  • source
  • record id: bancerek-aofa-l00-algorithmic-logic-2014-2014
• Big Data QoS Prediction (2014)
  • title: Big Data Analytics for QoS Prediction Through Probabilistic Model Checking
  • what: Combines runtime KPI monitoring, a parameterized continuous-time Markov model, and PRISM queries to predict QoS violations. A complex-event processor updates model parameters from measurements. Defines interval-restricted along/within temporal operators and predictive indicators eval(φ). KPI ranges map to queue positions; measured increments/decrements update rates with an EWMA, while thresholds trigger queue-size doubling or halving. The example models an energy distributor, producer and consumer as three queues.
  • number: Table I reports total build+check times 0.53, 9.18, 60.27, 217.64 and 535.089 seconds for queue lengths 20, 40, 60, 80 and 100. The demonstrated choice is queue length 40 with 20 MW units.
  • limits: Requires an available formal model, adequate parameter estimation, critical-state preservation after model reduction, and model-checking time compatible with monitoring updates. The Smart Grid validation uses three simulated scenarios; it does not establish general forecast calibration. Equation (2) text says next 15 minutes while its printed bound is 30. Extracted two-column order and mathematical notation are imperfect; no PDF visual inspection.
  • how much was read: most of it read
  • record id: big-data-qos-prediction-2014
• Bova-Ganian-Szeider existential logic posets (2014)
  • title: Model Checking Existential Logic on Partially Ordered Sets
  • what: Classifies existential first-order model checking and embedding on finite posets by structural invariants, proving fixed-parameter tractability for bounded width and polynomial-time isomorphism there, while establishing hardness for neighboring bounded invariants. The bounded-width algorithm computes a chain partition, compiles tuples of chains into semilattice structures, uses perfect hash families/color coding to reduce embeddings to polynomial-time homomorphism instances, and runs in 2^{O(k log k)} n^{O(1)} for pattern size k. A proposition equates existential model checking and embedding in parameterized complexity. Reductions from Clique give W[1]-hardness at bounded cover-degree, and SAT encodings give NP-hard embedding at bounded width and bounded degree in classical complexity. A distributive-lattice construction solves isomorphism in polynomial time on bounded-width posets.
  • number: embedding runtime 2^{O(k log k)} n^{O(1)}
  • number: bounded-width hardness gadget width at most 102
  • number: bounded-degree gadget cover-degree at most 8 and depth at most 3
  • number: existential model checking NP-hard on a fixed finite poset
  • limits: All structures are finite posets and the tractability parameter is the existential sentence/pattern size; bounded width is a fixed class invariant. The result does not cover full first-order logic, and hardness constructions rely on specialized poset gadgets. Classical existential model checking is NP-hard even on a fixed poset, so FPT rather than polynomial time is the meaningful target.
  • how much was read: most of it read
  • record id: bova-ganian-szeider-existential-logic-posets-2014
• CHR-Test-MC (2014)
  • title: Automatic Test Data Generation and Model Checking with CHR
  • what: Applies Constraint Handling Rules (CHR) to automated constraint-based test-data generation and symbolic model checking for mission-critical satellite-control software. Builds path constraints from control-flow paths, detects infeasible paths early with a CHR solver, combines structural coverage constraints with arithmetic state constraints, and reuses the solver for symbolic state-space enumeration/model checking. Examples include Euclid’s GCD and a satellite-control case study.
  • number: Toolchain supports both automated test-input generation and static verification/model checking
  • number: Infeasible paths are rejected during path construction rather than after blind test execution
  • number: Case study targets satellite-control defects
  • limits: The paper presents a workshop prototype and examples rather than broad quantitative benchmarking. Feasibility and scalability depend on the CHR constraint solver and path exploration strategy; full state-space explosion remains an open concern.
  • how much was read: most of it read
  • record id: chr-test-mc-2014
• Concurrent quantum protocol equivalence checking (2014)
  • title: Verification of Concurrent Quantum Protocols by Equivalence Checking.
  • what: Defines a concurrent quantum protocol language and verifies implementations against specifications by equality of superoperator semantics, using a stabilizer density-operator basis and exhaustive interleavings. CCS-style parallel processes, synchronous quantum/classical communication, measurement and allocation are given semantics. Functional protocols require deterministic output for each interleaving and identical output across interleavings, yielding a unique superoperator. Linearity and a stabilizer basis reduce equivalence to finite simulations and state-equality tests; examples include teleportation, secret sharing, error correction, dense coding, and remote CNOT.
  • number: complexity O(N 2^(2n) poly(m+n))
  • number: remote CNOT: 78,400 interleavings, 12,074 ms
  • number: secret sharing: 88,480 interleavings, 13,900 ms
  • number: 2.5 GHz Intel Core i3, 4 GB RAM
  • limits: Only stabilizer operations are supported; non-stabilizer Shor/Grover elements are excluded. Protocols must terminate, have input initially and output finally, be functional across all interleavings, and use synchronous handshaking. Equivalence does not express arbitrary security properties, and exhaustive interleavings grow combinatorially.
  • how much was read: most of it read
  • source
  • record id: concurrent-quantum-protocol-equivalence-checking-2014
• CSL checking for infinite Markov population models (2014)
  • title: Model Checking CSL for Markov Population Models
  • what: Presents a full truncation-based algorithm for CSL over infinite-state Markov population models. It combines GeoBound steady-state bounds with INFAMY transient analysis, advanced state-space truncations, and ternary truth values to return safe lower/upper probability bounds or decide a formula on the finite truncation. Handles CSL steady-state and, in some cases, unbounded-until operators by exploiting time bounds, atomic propositions, relevant steady-state mass, and direction-aware exploration. The advanced truncation and shortcut stop reduce explored states; case studies cover protein synthesis, gene expression, and an exclusive switch.
  • number: Protein synthesis explored 217–46,431 states with runtimes from 0.1 to 257.5 s (§4)
  • number: Gene-expression comparison reduced states from FSP 1,223–2,344 to Advanced+AP 495–971 for time bounds 1–4 (§4)
  • number: Unbounded-until example used 974 states and 1.5 s at precision 10−6 (§4)
  • number: Approach combines GeoBound and INFAMY (§1)
  • limits: Infinite CTMCs are approximated by finite truncations, so bounds can remain inconclusive and conditioning can widen error beyond ε. Exact unbounded-until handling is restricted to cases where the shortcut/truncation assumptions apply. Results depend on rate structure and chosen truncation depth/window.
  • how much was read: most of it read
  • record id: csl-checking-for-infinite-markov-population-models-2014
• Differential radical invariants (2014)
  • title: Characterizing Algebraic Invariants by Differential Radical Invariants
  • what: Characterizes invariant algebraic varieties of polynomial vector fields using a finite chain of successive Lie derivatives of one polynomial. The resulting differential-radical invariant rule is sound and complete for checking invariance over real-closed fields, and generation reduces to maximizing the kernel dimension (equivalently minimizing rank) of a symbolic matrix. Defines the Zariski closure of an ODE orbit as the smallest algebraic overapproximation, proves its soundness and differential-ideal property, and establishes the differential radical characterization theorem: h vanishes on an orbit iff finitely many Lie derivatives vanish initially. Theorem 2 gives a decidable invariant-variety check and a sound/complete proof rule; Theorem 3 says every invariant variety is a differential-radical ideal of one polynomial. Homogenization converts generation to biaffine symbolic linear algebra; Gaussian elimination searches parameter assignments and Proposition 3 gives a sound orbit overapproximation condition. Case studies recover trigonometric identities, airplane collision invariants, and three longitudinal-aircraft energy functions.
  • number: M2,1: 35×15, 90 nonzeros, kernel dimension 3
  • number: M2,3: 126×15, 693 nonzeros, kernel dimension 5
  • number: aircraft M3,1: 495×165, 2,115 nonzeros
  • number: one-hour Mathematica run on 1.7 GHz Core i5 / 4 GB
  • limits: Systems are autonomous polynomial ODEs with explicit vector fields and unique local maximal solutions; nonautonomous polynomial time can be encoded by a clock. Zariski closure abstracts away time direction and can be uninformative when the vanishing ideal is zero (e.g., generic one-dimensional evolving fields). Generation is at least NP-hard and PSPACE under stated no-parameter assumptions; de-homogenization may fail for projective candidates. Results target algebraic equalities, not general semialgebraic safety regions; upper bounds on differential-radical order and hybrid-system use remain future work.
  • how much was read: most of it read
  • source
  • record id: differential-radical-invariants-2014
• Distributed Protocols and Heterogeneous Trust: Technical Report (2014)
  • what: # Distributed Protocols and Heterogeneous Trust: Technical Report (authored by agents unless marked 🧑) Sheff, van Renesse and Myers use information-flow labels to reason about distributed protocols whose participants disagree about which machines may crash or lie. The central guarantee is participant-specific: a failure that violates one participant’s assumptions must not damage participants whose assumptions still hold (§1.1, Q2). They generalize Bosco Fast Consensus and the OARcast/Nysiad construction. Evidence consists of mathematical/prose proofs, an offline SMT threshold search, and small consensus simulations. I read arXiv:1412.3136v1, stamped 9 December 2014 (Q1). The local PDF and the official v1 PDF retrieved on 19 October 2026 are byte-identical. Both have 2018/10/9 footers; those footers do not establish a new arXiv version or publication date. The report has 26 pages, six figures, Algorithm 1, Appendices A–B and 40 references, all read. There are no tables. ## Model and assumptions (authored by agents unless marked 🧑) The network is asynchronous and permits all participants to communicate. Resending is assumed to make delivery reliable unless sender or receiver fails. A faulty participant cannot forge a correct participant’s source identity; signatures are suggested (§2.1, Q3). Almost-sure termination adds the assumption that repeatedly sent concurrent messages eventually arrive in every possible order. Section 5 phrases this as random ordering. Appendix B.5 additionally needs a selection function with nonzero probability for each input value (Q36). These assumptions matter: ordinary asynchronous message delivery alone does not establish the termination result. A guru functions correctly and has true trust assumptions. A chump functions correctly but has false trust assumptions. The authors state that “chumps may receive ‘wrong’ results” (§2.2, Q4). Most guarantees concern gurus, rather than every participant that happens to execute correctly. The requirements also exclude some trust configurations: arbitrary mutual distrust is not automatically supportable (Q2). The labels adapt the Decentralized Label Model. Each integrity or availability policy names an owner and a principal trusted to influence content or availability. Principals may be machines, people or compound authorities. Conjunctive principals combine authority; disjunctive principals describe alternative authority. Label ordering and join/meet track how message combinations trade integrity against availability (§§3–4, Appendix A, Q5–Q8, Q32, Q41). “More restrictive” labels correspond to weaker usable assurances. The paper describes static reasoning before execution; it does not report a compiler enforcing these policies or a complete implementation proof. The simple synthesizers make the tradeoff concrete: accepting the first of three messages gives high availability but permits any sender to influence the value; requiring three identical messages increases integrity but makes each sender necessary. Contradiction can produce the detectable unavailable value none (§4.1, Q7, Q42). Survivor sets and failure-prone sets can be represented as labels separately for each principal’s crash and Byzantine expectations. For four participants tolerating any single failure, the system principal is the disjunction of the four triples, while the attacker principal is the disjunction of the six pairs (§4.2, Q8). ## Consensus construction and proofs (authored by agents unless marked 🧑) Algorithm 1 broadcasts a proposal, waits for a sufficiently available received set, and examines sets of identical messages. A high threshold D permits decision; a lower threshold C forces a value into the underlying consensus. Otherwise a selection function chooses from received values. The underlying protocol can recursively be another fast-consensus round. A deciding participant then broadcasts its decision once more so that the remaining participants can proceed consistently (§5, Q10–Q11). A deterministic selector may let an attacker prevent convergence, so randomness is advised (Q12). The stated properties have different scopes (§5, Q9): - Agreement: any two deciding gurus choose the same value, and repeated decisions by a guru agree - Unanimity: if all correct participants initially propose v, a deciding guru chooses v - Validity: if a participant decides and all participants are correct, some participant proposed the value - Progress: gurus eventually decide if the underlying consensus terminates - Termination: recursive fast consensus eventually decides for gurus with probability 1 under the extra random-network assumptions Validity is deliberately weak: it does not guarantee a nonfaulty participant proposed the value in an execution containing Byzantine faults. Probabilistic termination is not a bounded worst-case or expected-round theorem. For homogeneous assumptions, c is the total number permitted to be unavailable and b is the number permitted Byzantine, with c ≥ b. The received-set threshold is |R| ≥ n−c, decision requires |S| > (n+c)/2+b, and change requires |S| > (n−c)/2. The requirement is n > 3c+2b, reducing to n > 3c for crashes only and n > 5b when c=b. Tightness is attributed to earlier Bosco work, not newly proved here (§5.1, Q12). For heterogeneous assumptions, each participant supplies its own availability threshold and change/decision labels. Constraints (1)–(6) ensure that sender failures bound message availability, tolerated failures cannot block a sufficient set, progressing parties can continue without blocked parties, decision thresholds imply change, liar/wrong sets cannot redirect other votes, and one guru’s decision forces other correct parties to enter the underlying consensus with that value (§§5.2–5.3, Q13–Q18). This is an explicit set of conditions to satisfy, rather than a theorem for every label assignment. Appendix B proves agreement separately for decisions in the same round and different rounds. It uses constraints (4)–(6), unanimity/agreement of the underlying protocol, and continued participation by deciding parties. Unanimity propagates the common correct proposal through the underlying protocol. Fault-free validity follows from selecting received values and authentic message sources. Progress uses constraints (1)–(3) to ensure sufficient messages arrive (Q33–Q35). The termination argument deserves a precise limit. Appendix B.5 concludes: “in any pair of consecutive rounds, there is a non-zero probability a guru will decide. Therefore, each guru, with probability 1, eventually decides” (Q36). Nonzero probabilities that can decrease across rounds do not alone justify almost-sure termination. The appendix does not explicitly supply a uniform conditional lower bound, independence, or a complete stochastic fairness argument. Its intended strong network/selection assumptions may provide that missing step. This read flags a proof-detail dependency; it does not supply a counterexample to the protocol. Two notation concerns are visible in the PDF, not extraction artifacts. Equation (3) quantifies R ⊆ P but uses S in its body (p.12, Q16). Figure 3’s A_sys row for Bob/Carol/Dave/Eve prints an integrity-policy superscript I where the text describes an availability threshold (p.13, Q17). The record preserves both; it does not silently repair the formulas or claim a checked encoding. ## Five-party case and measured results (authored by agents unless marked 🧑) Alice tolerates arbitrary failure by Bob and no other failures. Bob, Carol, Dave and Eve tolerate Byzantine Alice plus at most one crash among themselves (§§1, 2.2, 5.4, Q19). The searched thresholds let these five reach consensus. A homogeneous envelope must allow one Byzantine failure and one additional crash, hence b=1, c=2 and n>8: nine participants (Q21). Five versus nine exploits different trust structure; it does not violate a lower bound for an identical failure model. Alice sometimes must listen to Bob despite distrusting him. If Bob is Byzantine, the others’ trust assumptions fail and Alice alone may remain a guru. But when Bob is merely crash-prone, Carol and Dave might change their votes after hearing Bob and Eve. Alice therefore waits for Bob or Eve to preserve agreement in executions where those other participants are gurus (§5.4, Q20). This illustrates why individually “ignoring everyone distrusted” is not sufficient. The authors simulated 1000 instances for homogeneous nine-party Bosco and the corresponding heterogeneous five-party protocol. Each round’s message ordering and the selector’s choice are uniform random. All parties begin with different values. They compute the mean probability of a participant deciding after each round and show standard-error bars (§5.4, Figs.4–5, Q21–Q23). Exact curve ordinates and error magnitudes are not tabulated. The captions say “in each round,” while the prose says “after each round” and the curves increase toward one; this record retains reported round quantiles without reconstructing the raw event distribution. The explicit reported outcomes are (§5.4, Q21, Q24): - no failures: heterogeneous median 3 rounds and 95th percentile 5; homogeneous median 5 and 95th percentile 8 - Alice Byzantine and Bob crashed: heterogeneous 95th percentile 4; homogeneous median 6 and 95th percentile 12 The heterogeneous median in the fault scenario is not explicitly stated in the prose, so none is invented. Byzantine Alice’s behavior is specific: she proposes a fresh never-before-seen value every round. This is a chosen attack, not comprehensive Byzantine exploration. The paper attributes the faster convergence partly to reduced contention among fewer active participants. It evaluates the whole customized configuration, without isolating label adaptation from the participant-count change. It reports no deployed throughput, wall-clock communication latency, hardware, random seed or raw per-run result file in the paper. For threshold synthesis, the requirements are encoded in quantifier-free bitvector logic and Z3 is used offline. Four- to six-party protocols reportedly take “a few minutes for each protocol” (§5.4, Q25). There are no exact timings, hardware or Z3 version. Checking given labels is described as polynomial, placing the search problem in NP; precise hardness remains future work. This is not a claim of NP-completeness or polynomial-time synthesis. Section 5.5 adds a distrusted client as a participant so the best case is client→servers→client, without waiting for inter-server communication. The construction is subject to threshold requirements and explicitly trades bandwidth for latency; there is no implementation timing experiment (Q26). ## OARcast, Nysiad and artifact evidence (authored by agents unless marked 🧑) OARcast has a designated sender and echoers. Messages carry author and relay signatures plus sequence numbers. Echoers rebroadcast unseen sender messages, cease on conflicting sender-signed values for a sequence number, and deliver only after lower sequence numbers and a sufficient identical-echo threshold. Constraint (7) prevents two gurus from delivering different values for the same position (§6.1, Q27–Q28). If the sender is correct, no correct participant (even a chump) can simulate a different ordering. Liveness further requires a correct sender and enough uncompromised echoers. The report says its correctness proof “proceeds exactly as in [13, 14]”; it does not give a separate full OARcast appendix proof (Q28–Q29). Nysiad simulates a crash-tolerant system of deterministic state machines. Each simulated machine gets an OARcast sender. A host accepts a simulated message only when its own simulation independently computes an identical message and the matching OARcast delivers it. Gurus thus simulate the same execution and ordering. A faulty designated sender can block availability without independently changing the derived message value/order; each host’s own integrity and availability still constrain its simulation (§6.2, Q30). Footnote 2 limits OARcast integrity to uniform guaranteed delivery and ordering; application content can have further constraints. A 3f+1 crash-Bosco conversion using a deterministic selection function is described as 3f+1 Byzantine consensus with best-case two sends, compared with Fast Byzantine Paxos “by this very simple metric” (Q30). Nysiad has no empirical evaluation here. The linked Dropbox ZIP was recovered successfully. It contains only pysmt/pylisp2.py (9444 bytes) and pysmt/pysmt.py (40332 bytes). Both were read in full, 1151 LF-delimited lines including terminal empty lines. They are a Lisp parser and Python-2-style SMT converter/solver wrapper. The converter eliminates supported finite datatypes and Boolean interfaces, turns functions into bitvector lookup tables, unrolls quantifiers, emits QF_BV headers, and defaults to invoking z3. It includes local threshold optimization and HTML analysis modes (Q37–Q40). Its help explicitly notes that compactly declared bitvector lengths can entail exponential file expansion (Q37). No README, protocol constraint input, simulator, dependency pin, historical commit identifier or experiment output is present in this particular archive. The source supports the existence of a QF_BV preparation and solver workflow, but cannot alone reproduce the five-party thresholds or plotted simulations. No author code was imported or executed; no solver, prover, verifier or compiler was run. Only reader extraction, rendering, hashing, arithmetic and validation scripts were used. Simulation and synthesis outcomes remain author-reported. ## Relevance to the requested topic (authored by agents unless marked 🧑) This paper adds a useful formal-specification question for distributed systems: whose assumptions must hold for each guarantee? Its concrete contributions are a label-based description of integrity/availability, explicit threshold constraints, conditional consensus proofs, and a worked heterogeneous deployment comparison. It separates agreement from delivery availability and shows how Byzantine behavior can deny progress without corrupting the eventual ordering. There is no Verus, verified Rust, TLA+ or LLM-agent experiment. Transfer to agents writing specifications/proofs is reader inference: state trust and scheduling assumptions per participant, retain the weak validity quantifier, check threshold side conditions, and distinguish prose proof, SMT synthesis, simulation and implementation verification. A useful evaluation would test multiple trust graphs and adversarial schedules while pinning constraint encodings and the simulator. Confidentiality, self-interested behavior and general automatic protocol transformation remain future work (§7, Q31). The quotation identifiers used above are defined in quotes.json and mirrored in the JSONL record; each definition includes its exact source span and section. Reading Figure 3’s vote combinations as distinct participants, its intended change threshold is two matching votes and its decision threshold three among Bob, Carol, Dave and Eve; Alice’s own vote does not contribute to those counts (Q17). This helps explain why she can need Bob’s message despite distrusting him.
  • limits: Asynchronous reliable source-authenticated messages and participant-specific constraints (1)–(6); guarantees mainly for gurus. Recursive almost-sure termination adds random/fair message ordering and full-support selection. Appendix B.5 leaves its stochastic justification terse. Validity applies only when all participants are correct. Nysiad assumes deterministic state machines. No mechanized full protocol or implementation proof is reported.
  • how much was read: most of it read
  • source
  • record id: distributed-protocols-and-heterogeneous-2014
• DL-PA PSPACE correction (2014)
  • title: DL-PA and DCL-PC: model checking and satisfiability problem are indeed in PSPACE
  • what: Corrects prior complexity claims and gives a deterministic polynomial-space model-checking procedure for Dynamic Logic of Propositional Assignments and Coalition Logic of Propositional Control and Delegation. The paper exhibits a concrete PEEK-G5 counterexample to the prior EXPTIME-hardness reduction, and explains why an earlier DCL-PC evaluator was alternating rather than nondeterministic. Its DL-PA algorithm represents valuations and iteration counters as k-bit strings, and uses mutually recursive deterministic Boolean procedures REL, MOD, and ITE. Divide-and-conquer evaluates α* by splitting iteration counts, while a well-founded order and induction establish soundness and completeness. Recursive depth is linear in formula/program size and k, yielding polynomial space. Polynomial reductions transfer the upper bound to DCL-PC; QSAT reductions make both logics PSPACE-complete.
  • number: DL-PA and DCL-PC model checking PSPACE-complete
  • number: satisfiability PSPACE-complete
  • number: recursive calls O(k·(len α+len φ))
  • number: valuation space k bits
  • limits: The algorithm works over the finite set of variables occurring in the input and enumerates valuations using k-bit representations. It proves decision-problem complexity, not protocol correctness or empirical performance. The correction assumes PSPACE differs from EXPTIME when discussing the invalid earlier theorem. The paper’s deterministic procedure may take exponential time while using polynomial space.
  • how much was read: most of it read
  • record id: dl-pa-pspace-correction-2014
• Game Analysis Logic model checking (2014)
  • title: Reasoning about Games via a First-order Modal Model Checking Approach
  • what: Introduces Game Analysis Logic (GAL), a first-order modal logic for representing extensive games and reasoning about solution concepts. A model-checking algorithm and prototype express Nash and subgame-perfect equilibrium, utilities, and player strategies over finite game structures. Defines modal connectives for game histories, first-order quantification over players/actions/utilities, maps extensive games into GAL structures, and demonstrates automatic analysis of equilibria and AI player algorithms. Experiments vary randomly generated two-player payoffs and equilibrium-set sizes.
  • number: Prototype model checker evaluates randomly generated two-player games (§5)
  • number: Running times vary with payoff generation and equilibrium-set size (§5)
  • number: No aggregate benchmark table reported beyond plotted seconds
  • limits: The approach targets finite extensive games and a decidable model-checking fragment; complexity can depend on equilibrium-set size and model representation. The prototype is experimental and does not address stochastic games or large industrial game trees.
  • how much was read: most of it read
  • record id: game-analysis-logic-model-checking-2014
• Ghassabani Azgomi stateless information flow (2014)
  • title: Stateless Code Model Checking of Information Flow Security
  • what: Proposes complete stateless code model checking (CSMC) for observational determinism in concurrent programs. It stores one low-store state-change signature from the first execution and checks subsequent fair-scheduled executions for stutter equivalence, avoiding explicit state-space storage or self-composition. The method formalizes low-equivalent stores, finite traces and stutter equivalence, proves that complete exploration across categories of initial low stores suffices, and gives pseudocode using a DETS disk table and a low-state-change counter. A worked three-thread program demonstrates detection of a leak when traces diverge; Theorem 4 proves signature extraction and mismatch detection by induction. Complexity is linear in observed low-location changes, while execution exploration remains potentially exponential/time-intensive. The report discusses fairness, nontermination bounds, aliasing and distributed stateless checking.
  • number: stateful example estimate 8,000,000 states before a 50-bit array
  • number: algorithm storage linear in number of low-store changes
  • number: fair scheduler required for complete path coverage
  • limits: Threads and categories of low-equivalent initial stores are finite; fair stateless exploration must cover all paths and programs are expected to terminate or use depth bounds. It assumes low variables can be identified at runtime and high initial values are changed between iterations. Concrete execution means large/infinite-state programs may degrade to systematic testing; no experimental implementation results are reported.
  • how much was read: most of it read
  • record id: ghassabani-azgomi-stateless-information-flow-2014
• GPoCTL Model Checking (2014)
  • title: Quantitative Computation Tree Logic Model Checking Based on Generalized Possibility Measures
  • what: Defines generalized possibilistic Kripke structures and GPoCTL formulas, derives possibility/necessity model-checking algorithms and complexity, and illustrates them on a thermostat. The paper proves measure properties and model-checking propositions, compares GPoCTL with PoCTL and reports thermostat verification tables.
  • number: thermostat system
  • number: finite GPKS
  • number: possibility and necessity measures
  • limits: Finite GPKS assumptions and generalized possibility/necessity semantics constrain applicability; quantitative results are illustrative.
  • how much was read: most of it read
  • record id: gpoctl-model-checking-2014
• Graph- versus Vector-Based Analysis of a Consensus Protocol (2014)
  • what: # Whole-paper read: Graph- versus Vector-Based Analysis of a Consensus Protocol (authored by agents unless marked 🧑) Giorgio Delzanno, Arend Rensink and Riccardo Traverso; GRAPHITE2014, EPTCS159, pp44–57, doi10.4204/EPTCS.159.5, arXiv1407.7931. This is a finite-state Paxos safety comparison between graph transformation in GROOVE and a PROMELA model in SPIN. It demonstrates how modeling and symmetry reduction affect reachable state counts and exploration cost. It does not establish a parameterized Paxos theorem or correspondence with a deployed implementation. [Q0,Q1,Q2,Q14] ## Property and model assumptions Definition1 requires every chosen value to have been proposed and all choices, including successive rounds, to agree. The general introduction permits arbitrarily delayed messages and crash/recovery retaining local information. The displayed models contain no explicit crash/recovery transitions. Each proposer sends at most one Prepare, and there is one learner. Authors argue that more proposers can mimic repeated rounds and that multiple learners have the same available information. These are modeling justifications; the paper supplies no formal cutoff theorem reducing arbitrary configurations to the finite instances measured. The one-Prepare restriction also prevents indefinite injection of new proposals; this is not a liveness proof for unrestricted Paxos. [Q1,Q2,Q3] Prepare chooses a fresh round; Promise carries the acceptor’s last accepted round/value; a quorum causes a proposer to reuse the highest previously accepted value, or its own initial value if none exists. Acceptors promise increasing rounds and accept rounds at least as high as their current promise. Learners choose a round/value after a quorum. Figure1 supplies the pseudocode, including fresh-round and maximum-prior-round selection requirements. [Q2,Q3] ## What the two encodings do GROOVE stores a configuration as a typed graph. Process/value nodes have no explicit identities; round numbers and counters remain integer attributes. Broadcasts are persistent message nodes connected to senders, rather than individually ordered channel contents. Isomorphic configurations can therefore merge. Nested quantification counts matching Promise/Learn nodes, negative conditions prevent duplicate Learn emission and select a maximal prior round, and control functions schedule large rule applications. onPromise removes isPrepared so a proposer accepts a quorum only once; changeMyval precedes sendAccept. A learner may choose again. Unsafe patterns test two distinct chosen values, including two choices by one learner, or a chosen value absent from all proposer values. Depth-first search stops at the first unsafe graph, or explores the complete reachable state space for that initial configuration. [Q4,Q5,Q6,Q7] PROMELA represents each role as a process and communications as four bounded channels. Ordered send (!!) and matching receive (??) reduce irrelevant message-order variation. atomic/d_step blocks combine operations; the proposer scans Promise entries with a sentinel round9, restores them, and sends Accept after a quorum. Temporary variables are reset and learner counters saturate at the majority. Figures9–10 give proposer, acceptor, four-recipient broadcast and learner code. Printed MAX=10 bounds channels and the learner’s round-indexed counter array; values use byte/short/int types. The paper does not provide separate complete experiment inputs or a formal GROOVE–PROMELA equivalence proof. The hardcoded four-recipient example is not itself every row’s configuration. Atomicity, graph identity, message persistence, finite channels and representation differ together, so this is not a controlled isolation of one implementation feature. Potential blocking inside atomic blocks and fixed channel capacities are modeling limits, not independently demonstrated bugs. [Q8,Q9,Q10] ## Evaluation and exact result scope Table1 has22GROOVE configurations. Low majority searches all find a safety violation before exhausting the state space; their counts measure search to a counterexample. High majority searches report no violation and enumerate all reachable states of those finite models. Examples: two proposers/twelve acceptors/majority7 produce5,491,406states in14,794,452ms; three/six/majority4 produce12,247,549 in8,771,175ms; four/four/majority3 produce9,337,923 in4,523,411ms; seven/two/majority2 produce4,607,455 in1,154,561ms. Authors state that the next larger configurations exhaust memory. This is reported bounded exploration, not a proof for all process counts. [Q10,Q11] Eight high-majority instances are also explored without graph isomorphism reduction. For two proposers/two acceptors,224states become78 (65.18% reduction); two/five:1,178,114→9,729 (99.17%); five/two:12,743,315→55,420 (99.57%). This within-GROOVE comparison more directly supports the symmetry-reduction claim. Reduction has a cost: the authors report over75% of time spent checking isomorphism for two proposers/eleven acceptors, and generation rates from under400 to over6,000states/s. Figures11–12 visualize growth/comparisons; changing quorum thresholds produces sawtooth growth. [Q11,Q12] Table2 has11SPIN configurations, with ordinary and starred bit-hashing columns. Starred exploration is an underapproximation: finding an unsafe state supplies a witness, while finding none does not exhaustively establish safety. The caption says a hash factor above100 indicates high coverage; it is a heuristic, not a completeness guarantee. Nonempty reported factors are1.9,2.2,2.3,5.1,6.5,26, all below100. Retain distinct counts: for two proposers/five acceptors/low majority, ordinary226,306states versus starred387,982; for three/three/high,4,998,934 versus4,997,226. Larger starred counts must not be read as larger complete reachable state spaces. [Q12,Q13] GROOVE used an i7-2600 3.4GHz, Windows7, Java6 and8GB memory; SPIN used an i7, Windows7,6GB, jSpin/SPIN6.2.5May2013 with default memory management. The paper states no repeated-run count or uncertainty estimate. Different resources and modeling choices limit causal claims about engine superiority. It reports search-state counts and verification time, not executable Paxos throughput/latency. [Q10,Q12,Q13] ## Printed inconsistencies and presentation limits The SPIN prose says ordinary search finds violations only through five acceptors with two proposers, and with three proposers finds violations only through three acceptors and proves safety only through two. Table2 nevertheless prints ordinary low-majority results for two/six (4,374,568states,118,000ms) and three/four (2,712,145,68,400ms), plus an ordinary high-majority result for three/three (4,998,934,71,700ms). I retain the table and flag its disagreement with the prose; I did not reproduce either. [Q12,Q13] Two cells require literal preservation. Table2 two/two/high starred state count appears as “62 0” in layout extraction and as spaced “62 0” in the render; raw extraction yields620, matching the adjacent ordinary620. The normalized table records620 with this ambiguity. More materially, two/four/high ordinary Time is printed “3,5” while starred Time is “3,510”; caption units are milliseconds. The former is retained literally, with numeric normalization left unset, rather than silently interpreting it as3.5ms or3,500ms. [Q13] Figure12’s visible acceptor axis is labeled1–5, while its embedded spreadsheet text contains rows2–6. That text also differs from Tables1–2:234 versus224 for GROOVE/no-isomorphism/two-two;29,532 versus29,352 for SPIN/high/two-three;4,374,578 versus4,374,568 for SPIN/low/two-six. These are presentation/data discrepancies, not evidence of a model-checker defect. The record uses table values and preserves the figure’s text separately. The graph compares early-stopped unsafe searches, complete safe GROOVE explorations and approximate SPIN explorations; its curves are not uniformly complete state-space sizes. [Q11,Q13,Q15] ## Contribution and read scope The paper contributes a concrete distributed-protocol modeling lesson: remove irrelevant process/value identity, message ordering and intermediate steps when that preserves the desired property, and measure the cost and benefit of reductions. For evaluating agents that generate specifications/proofs, my inference is to require an explicit property, finite bounds, preservation argument and completeness status for each reported result before comparing state counts or claiming verification. There is no Verus, Rust, TLA+ or LLM experiment. [Q1,Q7,Q9,Q14] Read all14PDFpages, all14references, all12figures, both result tables, all displayed pseudocode/PROMELA and graph rules; viewed all14page renders. Official arXiv and inventory PDFs are byte-identical. Publisher PDF bytes differ, but its full layout extraction is identical. No separate author artifact URL was identified in the paper’s links; the printed models were inspected without execution. No compiler, model checker, solver or author-code run.
  • limits: onePrepareperproposer;onelearner;boundedchannels/integers;noformalcutofforencodingequivalence;bitstateunderapproximation;printeddiscrepancies
  • how much was read: most of it read
  • source
  • record id: graph-versus-vector-based-2014
• Huang et al. cardiac networks CAV2014, Oxford appendix follow-up (2014)
  • title: Invariant Verification of Nonlinear Hybrid Automata Networks of Cardiac Cells.
  • what: InvVerify states soundness and conditional termination for robust bounded-time safety checking of nonlinear hybrid networks using modular IS-discrepancy witnesses, reduced-order simulations, bloating and hybrid branching. The author-reported evaluation covers3/5/8-cell cardiac rings, threshold invariants and counterexample timings. formal1454 retains formal1413’s complete18-page publisher reading and adds a complete24-page Oxford version with AppendixA definitions, AppendixB proofs of Proposition1/Lemma2 and AppendixC MV-cell/ring equations. The separate Illinois report is still unread and not established as identical to Oxford. Printed proof/notation problems and evaluation inconsistencies remain explicit; complete independent source review of this follow-up and root integration are finished; whole-task acceptance remains pending. Adds actual reading of the two AppendixB proofs and all AppendixA/C prose while retaining all earlier mathematical, case/evaluation and source-error evidence. Separates the paper’s theorem claims from a reader counterexample to Oxford’s unrestricted largest-eigenvalue linear bound, distinguishes the conditional Lemma2 coverage proof from termination, and preserves the unresolved exact technical-report identity.
  • limits: Urgent deterministic transitions, Lipschitz ODE maps, continuous resets, compatible closed networks without transition synchronization, valid IS witnesses and validated simulation enclosures. Relative completeness additionally needs average dwell time and robust safety or robust unsafety (Assumption 1). Guarantees concern the discretized/hybridized model. D1–D17 preserve manual analysis, numerical-certification limits, source inconsistencies and missing external proofs. New Oxford scope: the same kind of validated-enclosure, closed-network and robust-case restrictions apply. Oxford’s AppendixB argument is read, not certified; OD3–OD8 record proof/notation/model-label problems and a reader algebraic counterexample. Only Proposition1/Lemma2 proofs are explicitly supplied in AppendixB; Propositions2/3 retain shared main-text justification and report deferral. Exact technical-report identity and completeness remain unestablished. Appendix A’s printed class-K conditions admit the zero function and other noninvertible functions, whereas Definition 4 uses inverse lower-bound comparison functions. The reduced-model argument needs suitable invertible comparison functions; that stronger condition is not established by the printed appendix definition alone. This is a reader deduction from Oxford p7 and Appendix A p20, OQ4/OQ17; cited reference [27] was not independently checked.
  • how much was read: most of it read
  • source
  • record id: huang-et-al-cardiac-networks-cav2014-oxford-appendix-follow-up-2014
• Incremental BMC Embedded (2014)
  • title: Incremental Bounded Model Checking for Embedded Software (extended version)
  • what: Extends Cbmc with incremental bounded model checking and incremental k-induction so loop unwindings reuse SAT state instead of rebuilding each query. The implementation combines incremental solving with source slicing, SAT preprocessing and bit-vector refinement, integrates Cbmc with BTC EmbeddedTester/EmbeddedValidator, and evaluates industrial automotive programs, FuelSys coverage tasks and SystemC SV-COMP benchmarks.
  • number: Incremental i+s+p is over 5× faster on average than best non-incremental ni+s+p; medium/hard SAT speedups around 10× and most UNSAT above 5×
  • number: Incremental UNSAT peak memory drops 30%, while SAT memory rises 10%
  • number: FuelSys unwinding 20: 152.3→70.4 minutes; unwinding 50: 377.4→108.5 minutes
  • number: SystemC SAT speedups exceed 10× in many cases; overall geometric speedup exceeds 3×
  • limits: Industrial benchmarks are proprietary; primary BMC targets programs with one unbounded loop, while irregular multi-loop results are preliminary. SAT/UNSAT behavior differs for refinement, and memory can increase on SAT instances. Experiments use 3,600-second timeouts and fixed unwindings for UNSAT cases.
  • how much was read: most of it read
  • record id: incremental-bmc-embedded-2014
• Local PCTL checking (2014)
  • title: On-the-fly Probabilistic Model Checking
  • what: Defines a local on-the-fly PCTL checker that recursively explores only states relevant to a queried initial state/formula. It handles bounded and unbounded until through explicit data structures, transient DTMC analysis and BSCC detection, and is parametric over process-language semantics. The algorithm proves correctness by induction on PCTL structure and terminates when the reachable subgraph is finite. It returns quickly for local properties in parallel-process models where global generation is expensive, while preserving exact probabilities for bounded/unbounded until.
  • number: Experiments on Intel Core i7 1.7GHz, 8GB RAM
  • number: On-the-fly checker answers representative dining-philosophers properties within milliseconds
  • number: Compared against PRISM global checker; local exploration avoids full state generation
  • limits: Termination requires finite reachable states from the query state; infinite models may hit memory bounds. Performance depends on property and state locality; global algorithms can be better when many states are queried. Probabilities assume DTMC semantics and measurable path sets.
  • how much was read: most of it read
  • record id: local-pctl-checking-2014
• Nakasho Futa Shidama NORMSP_3 topology quotient 2014 (2014)
  • title: Topological Properties of Real Normed Space
  • what: Nakasho,Futa and Shidama formalize real normed-space closure,density,separability,subspaces and bounded linear maps. They transfer topology through the associated linear topological space,construct inherited normed subspaces and closed spans,establish the closed-subspace/completeness relation,and formalize algebraic quotient-image factorization. For a bounded linear map,the induced bijection from the normed quotient by its closed kernel onto its image is bounded and has the same operator norm as the original map. Records overloaded algebraic versus isometric isomorphism definitions,closure bars lost by extraction,and inherited versus completed spaces. Identifies the closedness guard required to obtain a genuine quotient norm,and separates equal operator norms of the quotient map from isometry or boundedness of its inverse. Covers the concrete coset operations and typed representation bridges supporting factorization.
  • limits: MML NORMSP_3 version8.1.03 5.25.1220 identifies the article. Definition1 transports closure from LinearTopSpaceNormX back to subsets ofX. Results1/2 and registrations give complement duality,empty/full sets and finite unions/intersections. Results3–12 establish closure compatibility,extensiveness,open-neighborhood/sequential characterizations,intersection of all closed supersets,monotonicity,finite union equality,intersection inclusion and fixed-point tests for closed/open sets (pp.210–211). Closure overbars are essential:6characterizes membership in closureY by a convergent sequence inY;9says closure(A∪B)=closureA∪closureB;10onlyclosure(A∩B)⊆closureA∩closureB. Result13 says the closure of a subspace carrier is linearly closed,not merely that its original carrier is linearly closed. Raw extraction suppresses these bars and can turn substantive statements into tautologies (pp.210–211,renderings). Definition2 defines dense by closureA=wholeX. Results14–20 equate density with sequential approximation of every point and meeting each nonempty open set,transfer density to the associated topology,allow supersets,and show closureS=closure(S∩R) for denseR and openS. Intersection density19requires one set dense and open;two arbitrary dense sets need not have dense intersection. Dense subsets are nonempty (pp.211–212). Definition3 transports separability from the associated topological space;21characterizes it by a sequence with dense range. Results22–25 provide an epsilon-bound elimination lemma,constant sequence convergence,closed singletons,and closed-set membership from arbitrarily close approximants. These are metric/normed-space sequential facts;the article does not generalize them to arbitrary nonmetrizable topological spaces (pp.212–213). Results26–32 reconcile imported “subreal normal space” structures with linear subspaces and inherited operations/norm. Definition4 restricts the ambient norm;Definition5 makesNLin(V1) the linear span Lin(V1) with that inherited norm,not the arbitrary input subsetV1. Result31recoversV1 as its span only whenV1 is nonempty and linearly closed;32identifiesNLin of an existing subspace carrier with its normed structure (pp.213–214). Results33–35 show a linear kernel is nonempty and both kernel/image linearly closed. Definitions6–9 package algebraic/normed kernels and images usingLin/NLin. The image functor glyph is garbled as=(f) in raw text;it denotes the range with the corresponding structure,not an equality assertion or closure of the range (pp.214–215). Definition10 for real linear spaces defines isomorphism as injective and onto. Definition11 for real normed spaces adds exact norm preservation ||Lx||=||x||,so it means a surjective linear isometry,not merely a bounded linear bijection or a general normed-space topological isomorphism. Results36/37give inverse operators in the corresponding senses;37’s inverse is Lipschitz and isometric (p.215). Result38 says bounded linear maps preserve sequence convergence and commute with limits;39gives closed singleton preimages for any everywhere continuous function;40applies this to the kernel of a bounded linear map. The scope preceding41–43 assumes the normed isomorphism ofDefinition11,including for the one-way Cauchy statement42. Results41/43reflect convergence/Cauchy behavior;44transfers completeness,and45closedness,through that isometry. The record does not silently weaken these printed premises to all bounded bijections (pp.215–216). Result46 identifies an onto operator’s image structure with the output’s normed structure. Results47/49show a closed inherited subspace of a Banach space is Banach;48shows an inherited complete subspace is closed even when its ambient normed space is not assumed complete. “Linearly closed” means stable under addition/scalar multiplication and is separate from topological closedness;49requires both and nonemptiness (p.217). Definition12 constructs a real-linear quotient by converting to vector spaces over the real field,using an existing quotient,and converting back. Results50–54identify scalar multiplication,cosets and coset sets under those representation changes. Definitions13/14 and55–62 identify the quotient carrier as cosets,the zero coset as the subspace carrier,and addition/scalar multiplication/subtraction through representatives (pp.217–219). Result63/Definition15 construct the onto linear projectionv↦v+W. Result64/Definition16 give the algebraic first isomorphism V/KerL→imageL with[v]↦L(v);65factorsL through this bijection and the projection. This part uses real linear spaces andDefinition10’s algebraic isomorphism,not a claim of norm preservation (pp.219–220). Definitions17/18 assign a coset the infimum of ambient norms of its representatives,and66gives0≤inf≤||v||. Definition19 constructsNVectQuot as a real normed space only when the denominator subspace carrier is topologically closed. Reading explanation:without closedness,a coset represented byv in closureW outsideW has infimum0 while remaining a nonzero coset;the formula is then only a seminorm. Closedness removes that failure (p.220). Result67 applies the normed quotient to a bounded linearL,whose kernel is closed by40. Its induced mapQ fromNVectQuot(V,KerL) ontoimageL is bijective and Lipschitz,and its operator norm equals||L||. The proof reuses64and shows||Q[v]||≤||L||·||[v]||,then the reverse norm inequality. Equality here is between operator norms,not ||Qz||=||z|| for eachz. It does not assertQ is an isometry,thatQ^−1 is bounded,or thatimageL is closed (pp.220–221). Reading counterexample to an unprinted bounded-inverse generalization:the inclusionL:l1→l2 is bounded injective with nonclosed rangel1. Forv_N withN entries1/N,||v_N||_1=1 but||Lv_N||_2=1/sqrt(N),so the inverse on its image is unbounded. This fits a bounded quotient-image bijection with kernel0 and shows why67does not implyDefinition11’s normed isomorphism. Definition20 constructsClNLin(Y) on the closure of the carrier ofLin(Y),with inherited operations/norm. Results68–71/registrations establish its subspace and real normed-space laws. It is a closed span insideX,not a construction of the completion ofX. IfX is Banach,47can yield completeness of this closed subspace;71itself assumes only a normedX and does not state completeness. No Banach-quotient completeness theorem is printed in these71results (pp.221–222). All fifteen pages,ninesections,20definitions,71results/all clauses/supplied sketches,structural registrations,funding footnote,34references/date read;four sheets inspected. Raw-extraction quotes are not visual formula transcriptions;closure bars,images,norms andquotient subscripts are distorted. No MML/checker execution,empirical evaluation,timing,proof-size or automation benchmark,and no direct distributed/Verus/Rust/TLA+/LLM-agent result.
  • how much was read: most of it read
  • source
  • record id: nakasho-futa-shidama-normsp-3-topology-quotient-2014-2014
• One-clock parametric MTL undecidability (2014)
  • title: MTL-Model Checking of One-Clock Parametric Timed Automata is Undecidable
  • what: Proves undecidability of existential-parameter MTL model checking for deterministic parametric timed automata with only one clock and one parameter. The reduction encodes channel-machine computations with insertion errors in MTL and uses a parametric automaton to exclude those errors. The paper defines timed-word pointwise MTL and deterministic parametric automata, constructs L(C,n) formulas for faulty channel-machine computations, and proves via Lemmas 4.2–4.4 that a one-clock automaton AC synchronizes prefix/suffix timing to force error-free computations. Theorem 4.5 establishes the intersection equivalence; Corollary 4.6 and the final reduction yield Theorem 4.1. The discussion isolates parametric equality x=p as the source and notes integer-only parameter valuations would evade this proof.
  • number: undecidability theorem, no empirical evaluation
  • number: reduction from channel-machine control-state reachability
  • limits: Parameters are nonnegative rationals and MTL uses finite timed words with pointwise strict-until semantics. The result is existential over parameter valuations and relies on equality constraints; it does not establish undecidability for L/U automata or integer parameters. The two-parametric-clock emptiness problem remains open in the paper.
  • how much was read: most of it read
  • record id: one-clock-parametric-mtl-undecidability-2014
• Pak BALLOT_1 strict ballot theorem 2014 (2014)
  • title: Bertrand’s Ballot Theorem
  • what: Pąk formalizes the strict-lead ballot theorem for two distinct candidates with fixed vote totals. DominatedElection requires A to have strictly more counted votes than B after every positive prefix. The article proves a count (n−k)/(n+k) binomial(n+k,k) when n>k and presents the corresponding finite-election probability for n≥k. A representation bridge converts weakly dominated zero-indexed binary sequences from a Catalan library into strict-lead elections by prepending a zero. Records exact prefix quantifiers,empty/equal-candidate edge cases,finite-sequence conversion,cardinality-preserving relabelling and leading-zero bridge. Distinguishes strict from weak dominance,cardinality from set equality and fixed-count uniform probability from an unconditional voting process. Flags duplicate printed lemmas and the zero-denominator boundary in the final statement.
  • limits: MML BALLOT_1 version8.1.03 5.23.1210 identifies the article. Preliminaries1–5 relate finite zero-sequences to ordinary finite sequences:prefix conversion,range preservation,injectivity and inverse conversion. Results6–8 count two-valued sequences,preserve occurrence preimages under injective relabelling,and identify sums of0/r-valued sequences with r times the count of r (pp.119–120). Definition1 Election(A,n,B,k) consists of lengthn+k words over{A,B} with exactlyn occurrences ofA. A andB need not be distinct in the definition. Result9 gives the single constant word whenA=B,k=0;10 gives emptiness whenA=B,k>0. Result11 identifies Election with Choose. Distinct candidates are assumed for12(B-countk) and13(cardinality binomial(n+k,n));lost extraction bars must not turn13 into set equality (p.120). Definition2 quantifies every positive naturali without an explicit i≤length guard. Prefix restriction saturates after the word ends. Thus it demands strict lead at all nonempty prefixes and at the final totals;the empty word fails because its positive-index prefixes have zero counts. Results14/15 forceA≠B andn>k. A weak lead allowing ties would define a different event (p.121). Result16 admits the all-A word only forn>0 andA≠B. Result17 appends i ballots forB only ifi<n−k,retaining strict final lead. Result18 concatenates two dominated elections and adds their vote totals. Definition3 packages these into the event subset. Result19 gives emptiness forA=B orn≤k;20 witnesses nonemptiness by putting all A votes before all B votes whenn>k,A≠B (p.121). Result21 states equal cardinalities under distinct-candidate relabellingA→0,B→1,not equality of sets of differently labelled words. Its sketch defines a map through function composition and uses choice and surjectivity;result7 preserves occurrence counts under that injective relabelling (p.121). Result22 characterizes binary dominated elections by lengthn+k,n>0,sum(p)=k and every positivei satisfying2sum(prefix_i)<i. Fori beyondlength,the prefix sum is fixed and n>k makes the inequality continue to hold. Result23 says the first ballot isA. These characterizations are about finite sequences,not independent random variables or an infinite walk (pp.121–122). Result24 states d∈Domin0(n+k,k) iff the ordinary sequence obtained fromd with an initial0 belongs to DominatedElection(0,n+1,1,k). The sketch uses the imported weak condition2sum(prefix_i)≤i. Adding a leading0 changes weak to strict dominance and raises the A count by1. Domin0 and its counting theorem are imported from The Catalan Numbers.PartII [15],not fully defined or reproved in this article (p.122). Results25 and26 print the same cardinality equality between Domin0(n+k,k) and DominatedElection(0,n+1,1,k),with duplicate supplied sketches. They are not two independent counting arguments. Result27 cites21/26 for the strict-ballot count whenA≠B,n>k. The article does not display a complete reflection-principle proof;its Catalan count is an imported dependency (p.122). Result28 prints A≠B,n≥k and probability (n−k)/(n+k). Its cited count13 and event count27 support the uniform distribution over Election(A,n,B,k),that is,all orderings with the fixed totals. The probability operator is not explicitly defined in the article body;this count-ratio interpretation is a reading inference,not an audit of imported probability definitions. It is not a claim about an arbitrary biased voting process (p.122). The printed premises of28 allow n=k=0. In ordinary real arithmetic its ratio is0/0 and therefore undefined,while Definition2/result19 make the event empty. A totalized formal division convention may account for the printed result,but was not independently checked. Preserve the printed scope and require n+k>0 for the ordinary probability-ratio interpretation. For n=k>0 the strict-lead event is empty and its probability is0 (p.122). Reading example,not printed:n=2,k=1 gives fixed-total words AAB,ABA,BAA. Only AAB maintains strict lead at every positive prefix,so its uniform probability is1/3. ABA ties after the second ballot and BAA loses immediately. This checks the strict-versus-weak distinction and the denominator’s sample space. All five pages,three definitions,28results/all clauses/sketches,funding footnote,26references/date read;both sheets and enlarged p.122 inspected. Raw-extraction quotations retain missing cardinality bars,garbled inequality glyphs,fractions and prefix notation;renderings determine the mathematical reading. No MML/checker execution,empirical measurement,timing,proof-size comparison or automation benchmark. No direct distributed/Verus/Rust/TLA+/LLM-agent result.
  • how much was read: most of it read
  • source
  • record id: pak-ballot-1-strict-ballot-theorem-2014-2014
• Petri Games (2014)
  • title: Petri Games: Synthesis of Distributed Systems with Causal Memory
  • what: Models distributed synthesis as Petri-net games whose tokens are system or environment players and whose synchronizations exchange complete causal history. Strategies restrict branches in net unfoldings. Defines deterministic system choices, unrestricted local environment moves and deadlock avoidance. For concurrency-preserving games, global unfolded strategies can be distributed into one-token local controllers. mcut/ecut summaries support a reduction to finite complete-information games. Bounded one-environment-token safety synthesis is EXPTIME-complete; unbounded synthesis is undecidable.
  • number: Theoretical definitions, reductions and complexity results; no performance experiment.
  • limits: Assumes maximal causal-history exchange on synchronization. The decidability result has a single environment token and bounded system tokens; multiple independent environment sources remain open in this paper. Distribution requires concurrency preservation. Several proofs are deferred to a full version; no synthesized artifact was executed.
  • how much was read: most of it read
  • record id: petri-games-2014
• possibility-measure CTL checking (2014)
  • title: Computation Tree Logic Model Checking Based on Possibility Measures
  • what: Introduces PoCTL, a CTL extension interpreted over possibility measures, and develops model-checking algorithms for possibility-based transition systems. It proves relationships with classical CTL, identifies expressiveness for repeated reachability/persistence, and gives a bottom-up checking procedure. Defines possibility structures and PoCTL semantics, proves every CTL formula can be represented while PoCTL is strictly more expressive, derives fixed-point characterizations for until/repeated reachability, and presents an illustrative algorithm over finite possibility models.
  • number: CTL is shown as a proper subclass of PoCTL (§3.2)
  • number: Model checking is presented algorithmically in §4; no runtime benchmark reported
  • number: Expressiveness results include repeated reachability and persistence (§3.3)
  • limits: Possibility measures model uncertainty rather than probability and may not preserve probabilistic calibration. Results assume finite models and the specified possibility semantics. The paper is theoretical/illustrative and does not report implementation benchmarks or empirical case studies.
  • how much was read: most of it read
  • record id: possibility-measure-ctl-checking-2014
• Proving Safety with Trace Automata and Bounded Model Checking. (2014)
  • what: Combines loop acceleration with trace automata to remove redundant accelerated executions before bounded model checking. Trace subsumption preserves reachable states while lowering the transformed program diameter, enabling safety proofs and faster bug finding. Defines under-approximating accelerators, trace subsumption and regular restriction languages. Theorems show every original trace is represented or subsumed and that restricted accelerated traces preserve safety reasoning. A source-to-source implementation instruments CFAs, and experiments compare CBMC, acceleration and acceleration plus trace automata on SV-COMP14 and crafted deep-loop bugs.
  • number: 35 safe SV-COMP14, 21 acceleratable, 14 proved with trace automata
  • number: 32 unsafe SV-COMP14 plus 14 crafted unsafe
  • number: crafted bug time 12.31 s to 1.85 s
  • number: ~15% average binary-size increase
  • limits: Accelerators must under-approximate loops; trace elimination is sound only under the subsumption conditions proved. BMC proves safety only past the transformed reachability diameter. Nested loops and unsupported operations remain incomplete. Results depend on CBMC/Z3 timeouts and selected benchmarks; acceleration may increase binary size.
  • how much was read: most of it read
  • source
  • record id: proving-safety-with-trace-2014
• Regression-Free Synthesis for Concurrency. (2014)
  • what: Defines concurrency repair that preserves sequential behavior and, when initially correct, complete preemption-free behavior, while eliminating assertion errors. Adds constraints learned from good traces to the constraints learned from counterexamples, aiming to prevent a repair from breaking previously good behavior. Names the generic positive-and-counterexample extension to CEGIS PACES. §2 precisely relates traces before and after adjacent within-basic-block instruction swaps or atomic-section insertion. A regression must preserve reads-from relationships into assume/await conditions and must originate from a good trace that could not already become bad by scheduler choices alone. §3 uses trace-analysis graphs with intra-thread, reads-from-conditional/assertion and non-free write-order edges. A cover proves the necessary happens-before edge; additional noninterference edges place other writes before the source write or after the read. Conjoining/disjoining cover constraints yields a polynomial-time sufficient regression-prevention algorithm; when no cover exists, the theoretical fallback fixes every current intra-thread order. Exact sound-and-complete constraints can be computed exponentially. Bad-trace elimination reuses partial-order generalization and cycle constraints from the 2013 predecessor. §4 maintains cumulative constraints and good-trace images as the program changes, formalizing correspondence more carefully than scheduler input reuse. Wait/notify repair is discussed for inputs outside the standard sequential-correctness precondition.
  • number: dv1394.c: 81 LOC; mixed 1 iteration, 13+4 s; ce1 51 iterations/60 s; ce2 5 iterations/9 s with unnecessary atomic section
  • number: iwl3945.c: 66 LOC; mixed 1 iteration/3+2 s versus ce1 and ce2 2 iterations/2 s
  • number: lc-rc.c: 40 LOC; mixed 10 iterations/2+7 s; ce1 179/122 s; ce2 203/134 s
  • number: rtl8169.c: 405 LOC, five concurrency bugs; mixed 7 iterations/10+45 min; ce1 >100 iterations/>6 h; ce2 8/54 min
  • limits: Fixed number of threads in Cwhile; await is the only blocking operation and defines preemption points. All complete sequential traces must be good; preservation of preemption-free traces is conditional on their original correctness. Bugs are assumed data-independent: changing valuations without changing instruction-location sequence cannot change whether the trace is bad. Regressions are a restricted class requiring identical conditional reads-from, so newly enabled conditionals from different writes can evade the definition. Good-trace constraints cover seen traces, not all unobserved behavior; final correctness depends on Verify. The implementation uses CBMC and the evaluated finite/simplified driver models; no full Linux driver proof or weak-memory guarantee. Fair termination refers to choosing bad traces in the synthesis loop, not scheduler fairness for an executing repaired program. An unsound learner can still be followed by verification, but it lacks the stated intermediate-regression theorem.
  • how much was read: most of it read
  • source
  • record id: regression-free-synthesis-for-2014
• SACO (2014)
  • title: SACO: Static Analyzer for Concurrent Objects.
  • what: Presents SACO, a static analyzer for actor/concurrent-object programs that infers termination, resource bounds and deadlock freedom. Points-to and may-happen-in-parallel analyses feed circular termination reasoning, cost bounds and dependency-graph deadlock checks. The monitor/object model permits one active task per object, cooperative await, asynchronous sends and blocking future get. Allocation-site sequences parameterized by k give object-sensitive points-to information; polynomial MHP composition prunes impossible interleavings. Termination assumes shared data is updated finitely often and proves that assumption through termination of updating loops. Resource bounds combine local ranking functions with counts of interfering updates; deadlock graphs are pruned using MHP labels. The vending-machine example derives a coin+·n loop bound and an acyclic dependency graph.
  • number: points-to sequence bound k
  • number: retrieveCoins resource bound coin+ * n
  • number: one active task per object
  • limits: Soundness depends on finite allocation-site abstraction, safe MHP over-approximation, and the circular finiteness assumptions used in termination proofs. get may deadlock; the dependency graph is a sufficient acyclicity test and may report false positives. The paper is a concept/tool report without a broad runtime benchmark table, and analyses apply to the cooperative concurrent-object model rather than arbitrary shared-memory threads.
  • how much was read: most of it read
  • source
  • record id: saco-2014
• SATMC 3.0 (2014)
  • title: SATMC: A SAT-Based Model Checker for Security-Critical Systems
  • what: Describes SATMC 3.0, which combines planning-graph encodings with reactive-system bounded model checking to reduce bounded security-goal violations to SAT. ASLan models rewrite rules, Horn clauses, first-order LTL constraints and goals, with NuSMV generating LTL encodings and MiniSAT solving them. The formal framework defines states as facts closed under Horn clauses, rewrite-rule paths, closed-world semantics and first-order temporal satisfaction. Security systems compose a system model with a Dolev–Yao intruder and optional custom intruder; examples encode SAML messages, RBAC and PKCS#11 operations. SATMC specializes intruder rules, builds a monotone planning graph, grounds first-order LTL using only matching facts, and creates Φk whose satisfying assignments correspond exactly to length-k counterexamples. Iterative deepening is sound for each bound but can be semi-decision when kmax is infinite.
  • number: more than 100 SAP NGSSO/OAuth configurations analyzed
  • number: discovered Google Apps SAML man-in-the-middle flaw rated High by NIST
  • number: SATMC integrated into AVISPA, Tookan, AVANTSSAR, SPaCIoS and SAP NetWeaver BPM Security Validator
  • number: iterative bound k starts at 0 and increments to kmax
  • limits: Bounded model checking only proves absence of attacks up to kmax; setting kmax to infinity may not terminate. Planning graphs over-approximate reachable states and quantifier grounding can be expensive or infeasible for unbounded domains, although SAT encoding avoids false positives. Models rely on symbolic Dolev–Yao cryptography and user-specified constraints; the paper does not establish completeness for arbitrary unbounded security systems.
  • how much was read: most of it read
  • record id: satmc-3-0-2014
• Scilingo scenario SCR model checking (2014)
  • title: Analyzing Behavioural Scenarios over Tabular Specifications Using Model Checking
  • what: Introduces a free tool for specifying and checking families of behavioral scenarios over SCR tabular requirements. Scenario programs combine guarded state changes, tests, sequencing, and iteration; the tool translates SCR tables and scenario programs to Promela and checks an end-state safety assertion with SPIN. A pacemaker specification is the running case. The paper defines the scenario grammar (stateChange, guarded stateChange[f], tests [f], sequencing, and Kleene iteration) and compiles each sentence with a program counter; unrestricted changes rely on SCR table transitions, guards filter traces, and the final property becomes assert(pc==n+1 → PROP). In the pacemaker study, SPIN finds two counterexamples: POR can return to Normal while battery voltage remains low, and magnet release can fail when the bradycardia program is off. Refining transition-table guards fixes S1; narrowing S2 to cases with a configured program makes it hold. Compared with DynAlloy, Spin+ finds counterexamples in 90 ms/780 ms and verifies repaired scenarios in milliseconds, while DynAlloy exceeds 30 minutes for S1 at 20 loop unrolls. The notation supports safety only; liveness is identified as future work.
  • number: S1 counterexample: Spin+ 90 ms vs DynAlloy 9,771 ms
  • number: S2 counterexample: Spin+ 780 ms vs DynAlloy 899 ms
  • number: Spin+ repaired S1 verification 2.450 ms / 18.900 ms vs DynAlloy 42.222 ms / >30 min
  • number: Spin+ repaired S2 verification 1.160 ms / 7.700 ms vs DynAlloy 12.301 ms / 18.154 ms / 167.130 ms
  • limits: SCR tables provide the state-transition semantics; scenario programs describe families of executions rather than single traces. The model checks bounded/unbounded SPIN behavior according to the encoded loop, but the presented notation expresses only safety end-state properties. Results depend on the pacemaker abstraction and guarded table completeness; no independent implementation validation is reported.
  • how much was read: most of it read
  • record id: scilingo-scenario-scr-model-checking-2014
• SMC Biological Applications (2014)
  • title: Statistical Model Checking for Biological Applications
  • what: Survey of statistical model checking for stochastic biochemical, hybrid and ODE models, including verification, rare-event analysis, parameter estimation and synthesis tools. Explains Gillespie stochastic simulation, CTMC/ODE relationships, SPRT, Bayesian and OSM hypothesis tests, importance sampling for rare events, robustness distributions, evolutionary parameter search, and compact-region abstraction/refinement for synthesis. It catalogs COSMOS, PLASMA-Lab, PRISM, UPPAAL-SMC and SBML tooling.
  • number: reported literature scales to a 105-ODE, 39-unknown-parameter pathway model
  • number: Jha/Langmead synthesis applies to six-dimensional models; estimation scales to 11 parameters
  • number: no new benchmark or aggregate runtime table in this survey
  • limits: SMC gives approximate answers controlled by confidence/error parameters. Sample cost grows inversely with squared indifference region; rare-event probabilities require very large samples without importance sampling. Parameter synthesis results are necessarily approximate due to undecidability over real expressions; survey reports literature results rather than a new controlled experiment.
  • how much was read: most of it read
  • record id: smc-biological-applications-2014
• SMT-Based Model Checking for Recursive Programs (2014)
  • what: RecMC verifies recursive program safety by maintaining bounded underapproximating reachability facts and overapproximating summary facts. It analyzes calls modularly without full call-tree inlining, increases stack-depth bound until a witness or inductive proof, and uses model-based projection (MBP) to lazily remove existential variables. Implemented in early Spacer with Z3 and a UFO-based C frontend. Gives logical terminating-execution semantics, fact reuse across bounds, a mixed over-prefix/under-suffix call-query rule with nonoverlap requirement, induction-based unbounded safety and finite-image MBP for bounded termination. Clarifies polynomial state complexity versus exponential Boolean-variable count, and shows empirical solved-count complementarity including weaker SLAM results despite favorable C runtime plots.
  • limits: §§1/3: first-order recursive procedures, no procedures as parameters and no internal/nested procedures. Loops/globals omitted without loss of generality in relational encoding, not a claim that source code cannot contain loops/globals. Calls appear positively in quantifier-free bodies so least-fixpoint semantics exists. Frontend/source abstraction accuracy remains outside this algorithm proof. §3: procedure relation contains terminating input/output executions. Hoare assertion safety is partial correctness; no termination or universal progress/liveness guarantee. A nonterminating computation need not violate a postcondition. Arbitrary execution-prefix assertions require appropriate encoding in program model. §§3–4: reachability fact formula denotes only actual bounded terminating input/output pairs for every theory model, rather than one observed input or a must-transition pair of sets. Summary facts overapproximate bounded relation. Under environment disjoins facts from bounds≤b; over environment conjoins facts from bounds≥b. Swapping these directions breaks proof. §4/Theorems1–2: BndSafety/RecMC sound; bounded algorithm terminates relative to appropriate theory oracle and rule side conditions. Increasing bounds yields guaranteed finite-counterexample discovery for decidable theories. Safe infinite-state models may diverge; theorem is not a complete decision procedure for linear arithmetic safety. §4/Fig.6 Query: no-overlap with existing same-procedure/same-bound queries essential to bounded termination; implemented by selecting smallest b. Prefix overapproximated, suffix underapproximated when selecting unresolved call; this is deliberate mixture, not uniform overapproximation of entire path. §4/Theorem3: O(N²·2^(2k)) applications of inference rules for Boolean program,N procedures,k maximum input/output-variable count. Polynomial in explicit relation/state space, exponential in bit-variable count; does not count SMT/QE cost as constant practical time guarantee. Iterative-deepening procedure dependence quadratic, unlike linear cited BDD method. §4 footnote2: proofs of all theorems deferred to extended version [28]. This proceedings paper states claims and gives arguments/examples, not full theorem derivations or mechanized checker verification. No claim that implementation, C translation or Z3 interpolation is proved correct. §5: arbitrary underapproximations of QE can diverge; MBP must have finite image, cover existential formula as disjunction of projections, and contain the triggering model. Each result implies projected existential formula. Finiteness/coverage are substantive requirements, not satisfied by any model-specific guess. §5: LRA MBP selects an equality virtual substitution if true; else maximum active lower bound+ε with syntactic tie-breaking; else−∞. Linear in formula size for presented one-variable projection, not linear-time whole quantifier elimination or program safety. LIA Cooper-based construction mentioned but deferred to extended version. §5/Theorem5: model used for Reach must also satisfy current target query; Query model must satisfy callee overapproximation. Stronger model constraints prevent redundant/no-progress applications. Finite image then preserves bounded termination and soundness; this does not guarantee short runtime or safe-case convergence of outer loop. §6: implementation based on historical Spacer/Z3 supports propositions,linear arithmetic,bit-vectors via bit-blasting; frontend UFO-based C→Horn-SMT. These results do not characterize current Spacer releases or verified C/Rust memory/integer frontend completeness. §6: 2908 SLAM Boolean programs plus 799 SVCOMP 2014 C programs and two modularized variants of same 799, not 2397 independent source benchmarks. Variants factor code into procedures; details of transformation/semantics validation not provided here. Supports benefit of modular representation on chosen suite, not arbitrary programs. §6/Fig.8: baseline Z3 is its GPDR implementation, not solver-free competitor/all Z3 modes/current release. Spacer uses Z3 internally. SLAM solves 2706 versus 2719 for GPDR, so no universal solved-count improvement. On C variants Spacer solves more but each baseline has exclusive successes. §6/Fig.9a: synthetic Bebop scaling plot reaches~4000 s at 500 procedures although main evaluation says 30-minute budget. Record as a separate plot without inventing undocumented special budget. SLAM runtime similarity “within 2 minutes” is author description, not percent equivalence or repeated-measurement confidence. §6: Ubuntu,2.2GHz AMD Opteron 6174,516 GB RAM,30 min/16 GB limits. No repetitions/variance,precise solver/frontend revisions,total runtime aggregate,numeric per-point C timings or direct MBP ablation. Four plot panels support trend but not isolated causal attribution solely to MBP. §8: EUF/arrays extensions future work because lack of QE. No distributed-network/concurrency verification,Verus/Rust/TLA+ implementation or LLM proof evaluation. Extended proofs/benchmark artifacts not executed/read.
  • how much was read: most of it read
  • record id: smt-based-model-checking-2014
• Spin Paxos (2014)
  • title: Model Checking Paxos in Spin
  • what: Models Paxos in executable Promela with proposer, acceptor and learner roles, then uses Spin plus reduction theorems and code transformations to check finite instances. Counting guards and quorum transitions encode majority voting atomically, reducing interleavings. Formalizes safety as learner agreement, proves finite reductions for proposers/learners, and introduces atomic broadcast and counting-guard transformations. Experiments extrapolate quorum constraints and show ordered channel insertion nearly halves state space versus FIFO sends.
  • number: 2 proposers/2 acceptors: majority 1 violation, majority 2 exhaustive safety
  • number: 3 acceptors: majority 1 violation, majority 2 no violation; channel state stabilizes at size 6
  • number: 4 acceptors: majority 3 correct; ordered-send model at 3 acceptors/channel 6 has 65,091 states versus 172,868 FIFO
  • number: 5 acceptors exhaustive exploration unmanageable; 16GB machine, Intel i7-4700HQ
  • limits: Finite-state bounded channels and process counts; no Byzantine faults; Paxos may diverge if proposers inject proposals indefinitely. Acceptor-bound cutoff remains conjectural. Bitstate hashing estimates large instances rather than exhaustive proof.
  • how much was read: most of it read
  • record id: spin-paxos-2014
• String Constraints for Verification (2014)
  • what: Norn solves word equations/disequalities,regular-language membership and linear length constraints by exhaustive symbolic splitting,automata operations and Princess arithmetic. General-case rules are sound and locally complete but can diverge;ordered elimination terminates on an acyclic fragment. Regular-constraint interpolation plus arithmetic interpolation supports Eldarica predicate-abstraction verification of string-processing programs. Defines precise acyclicity and phased termination condition,explains exact regular-language-to-length elimination guard,constructs concrete SAT witnesses by reversing substitutions,and gives size-bounded counterexample-guided regular interpolants with qualified completeness. Provides five handwritten-program timings and graphical assertions,including not-membership lost in extraction.
  • limits: §§1/3: finite alphabet,unbounded finite strings,word concatenation,(dis)equality,regular membership with complement/intersection and linear integer length expressions. General decidability open as of this2014paper;record does not assert current status. Unbounded lengths do not mean decidable arbitrary string programs. §§1–2: authors call fixed-length-bound solvers unsound;precise reading is that bounded search alone cannot establish the unbounded correctness claimed here. A bounded solver used with explicitly bounded claims is not thereby inherently unsound. §4: tree expanded backward from conclusion to disjunctive premises. Their soundness means satisfiable conclusion has some satisfiable premise;local completeness means satisfiable premise entails satisfiable conclusion. Lemma1 supports both SAT/UNSAT results when exhaustive procedure terminates,not all possible rule schedules terminating. §4.1: finite alphabet enables disequality split into mismatch-after-common-prefix or either strict-prefix case. Branching can be large. §4.2 Eq-Var substitutes matched prefixes or splits overlapping variables;occurrence side conditions prevent ill-defined self-substitutions. Mirrored suffix rules omitted from display. §4.3 Reg-Len guard: after collecting all u-memberships,residual φ may mention u only in length constraints,never other membership/equations. Intersect all u languages before replacing by admissible lengths. Otherwise projection loses correlations and is unsound. Unary-image automaton determinization yields ultimately periodic length set,not per-letter Parikh counts used independently. §5: linear means no variable repeats anywhere within a single(dis)equality,including both sides. Acyclic additionally excludes alternating relation/shared-variable cycles in side-occurrence dependency graph. Merely no variable repeated on one side is insufficient. Theorem1 preservation andTheorem2 ordered termination stated;no full separate formal derivations/proof assistant development here. §5: ordered phases eliminate disequalities,then one equality at a time,then membership,then arithmetic. Termination theorem limited to acyclic input and ordered procedure,not arbitrary scheduling or arbitrary CHC invariant search. General uv=vu can regenerate same shape indefinitely;uu=vv can introduce repeated variables. §6.1: Horn solutions interpreted as mutually inductive assertions in word logic;source encoding correctness assumed. Recursion representable but no termination or distributed liveness theorem follows from safety clauses. Example uses quantified evenness;arithmetic extension/encoding is not a proof of arbitrary quantified strings. §6.2: regular interpolants over serialized tuple s1|…|sn,with distinguished separator,not every formula of full mixed logic. Must contain all A valuations and exclude all B valuations. Inseparable means no candidate within current size bound,not necessarily A∧B satisfiable or no larger/mixed-logic interpolant. §6.2 Lemma2: bound must permit finitely many candidates. Each failed check adds counterexample and excludes current candidate. Termination additionally relies on satisfiability subqueries being answered;general string-solver nontermination remains possible outside acyclic fragment. Increasing bound eventually finds existing regular interpolant,not arbitrary separating formula or any safe program proof. §6.2: global bound scheme references complete predicate-refinement algorithm[16];not implemented/proved complete in all generality here. §7 combines regular interpolation with separate Presburger interpolation for lengths. A regular separator alone cannot express every relation required for mixed arithmetic/string invariants. §7: implementation trusts parser,equality substitutions,dk.brics.automaton,Princess,interpolation and Eldarica frontend. SAT witness concrete values reconstructed from arithmetic lengths and inverse substitutions. Paper does not provide proof certificates or verified implementation/backend;source/artifacts not run. §7: divisibility prose says x div y means x divides y but printed encoding x=y*n expresses y divides x. Preserve mismatch;do not silently infer semantics or claim variable multiplication is Presburger unless divisor constrained appropriately. §7/Table1:five small handwritten programs,allreported fullyautomatic;IntelCorei5/3.2GHz/64bitLinux. No baseline timing table,repeat/variance,solver versions,source line counts,memory/timeout or ablation. Claim all beyond other modelcheckers is qualified authors’ claim,not independently reproduced. 27.1sHamming row qualifies “few seconds” prose. §7/Table1 visualp.15:anbn property begins s∉(a+b)ba(a+b),not s∈ as extracted. StringReplace/ChunkSplit assertions are alphabet-preservation/removal only,not complete functional equivalence;Levenshtein bound/Hamming special case not full distance algorithm correctness. §8: broader string applications,theory integrations/interpolation improvements futurework. No Verus/Rust/TLA+,distributed protocol proof,LLM evaluation or mechanical theorem proof reported. Cited algorithms[16]/backend proofs not independently read.
  • how much was read: most of it read
  • record id: string-constraints-for-verification-2014
• SystemC Statistical Verification (2014)
  • title: Dynamic Verification of SystemC with Statistical Model Checking
  • what: Instruments executable SystemC models with generated BLTL monitors and verifies timed/probabilistic properties using Plasma Lab statistical hypothesis testing. The framework exposes simulation-kernel and user-code state as atomic propositions, lets users choose temporal resolution finer than SystemC cycles, and treats external libraries as black boxes. It combines generated monitors, instrumented executable models and Chernoff/SPRT-style SMC, supporting both probability assertions and reward expectations.
  • number: producer-consumer checks take less than one minute to several minutes
  • number: embedded control analysis verifies 90 properties in almost 2 hours on 4 GB RAM
  • number: large CTMC has about 2^155 states versus about 2^10 in prior model
  • number: table examples: latency probability 0–1 for p1,p2 settings; steady up-state reward about 10^1.063=11.57 days
  • limits: SMC is approximate and requires user-selected error/confidence; experiments use two-sided Chernoff ε=.02 and confidence .98. External-library state is not exposed, and the model has to be executable/instrumentable. Numerical PMC is infeasible for the large case study; no exhaustive guarantee is provided.
  • how much was read: most of it read
  • record id: systemc-statistical-verification-2014
• Temporal-logic runtime observer pairs for SHM (2014)
  • title: Temporal-Logic Based Runtime Observer Pairs for System Health Management of Real-Time Systems
  • what: Defines and proves correct paired runtime observers for mission-time LTL/MTL specifications: an asynchronous observer emits exact verdicts once future information is available, while a synchronous observer emits an immediate three-valued abstraction (true/false/maybe). The rt-R2U2 architecture maps both observers to static FPGA blocks with configurable interconnections and feeds verdicts to Bayesian health reasoning. The paper formalizes discrete-time MTL, execution sequences and mission-time LTL projection, then gives algorithms for negation, bounded invariants/eventuality, conjunction with FIFO synchronization queues, and bounded until with lockstep input. It proves observer space/time bounds and synchronous circuit bounds (11 two-input gates per AST observer; depth 4d). Configuration synthesis parses an AST, allocates paired blocks and computes queue sizes from worst-case delay. A Swift UAS case uses flight-rule and sensor-fusion specifications; FPGA simulation and Bayesian posteriors detect a laser-altimeter outage without instrumenting flight software.
  • number: synchronous circuit bound 11m two-input gates and depth 4d
  • number: timestamp width ceil(log2(n))+2
  • number: Swift example scaled to 24 timestamps; implementation resolution 2^32 timestamps
  • number: laser-altimeter health posterior 70%→8%
  • limits: Time is discrete and event verdicts are sampled from a real-time clock; mission-time bounds make future operators finite. Hardware observers avoid recursion/dynamic memory and use finite-width timestamp registers/queues, so queue sizing depends on worst-case delay and formula depth. Synchronous outputs are an over-approximate three-valued abstraction and may be maybe; exact asynchronous outputs can be delayed. The evaluation is a proof-of-concept on one UAS trace/FPGA design, not a broad statistical flight campaign, and Bayesian model quality is external to observer correctness.
  • how much was read: most of it read
  • record id: temporal-logic-runtime-observer-pairs-for-shm-2014
• The Formalization of Decision-Free Petri Net (2014)
  • what: Reports a Mizar-library formalization of decision-free Petri nets, alternating directed paths and simple circuits, natural-valued markings, enabled transitions and totalized firing. Proves that each circuit’s sum of place tokens is preserved by a transition and by every finite sequence under that firing operation. Separates genuinely firable sequences from total evaluation, where disabled transition attempts leave the marking unchanged. The decision-free condition requires exactly one incoming and one outgoing transition per place, not one input/output per transition. A key structural lemma shows that any transition incident to a circular path’s place must occur on that path. Alternating-position and almost-injective-sequence lemmas support the one-step circuit invariant, which extends to finite sequences through the firing composition law. Firing is explicitly a no-op when disabled, so the final theorem needs no enabled-sequence premise; this strengthens the total-function equality without establishing legal execution or liveness.
  • limits: Markings map places to natural numbers. Arcs are unweighted relations in the displayed definitions: a successful firing subtracts one at input-only places, adds one at output-only places, and leaves both/neither places unchanged. No timed transitions, capacities, inhibitor arcs, arc weights, failure model or scheduling fairness appear in this formalization, despite reference [19] being a timed-Petri-net textbook. Decision-free-like (Definition 7) says every place has exactly one predecessor transition and exactly one successor transition. A transition may have multiple input or output places. The final decision-free-net mode also assumes Petri-like and existence of a directed circuit. Underlying Petri-like/basic-net definitions are imported and not expanded in the article; this reading does not independently audit those MML definitions. Directed paths have odd length at least three, alternate place-to-transition and transition-to-place arcs, and end at a place. Circuits additionally are circular and almost one-to-one: they close at the first place without internal repetitions. The repeated endpoint is not counted twice, since token sums use the finite set of places in the sequence, not the sequence with multiplicities. Preliminaries define an enumeration of marking values on a finite place subset and sum it to obtain the token number. Empty subsets use the empty sequence. The paper also establishes finite-sequence uniqueness facts and a smallest example PN0 with place 0, transition 1 and both connecting arcs. It does not provide a new algorithm for finding every circuit in a large net. Propositions 5–10 locate initial/final arcs and show places occur at odd indices and transitions at even indices, with neighboring arcs around each internal occurrence. Proposition 15 uses unique per-place predecessors/successors to show that a transition incident to any place of a circular path is a transition of that path. Without that closure, a transition outside the circuit could inject or remove a circuit token. A transition is firable exactly when all its input places have positive token counts (Definition 11). Definition 12 makes firing total: if firable, update by incidence; otherwise return the original marking. Input-output self-loops still require a positive token even though their net update is zero. Disabled attempts are stuttering evaluations, not enabled transitions. Definition 13 separately defines a firable finite sequence using a chain of intermediate markings and an enabledness obligation at every position; the empty sequence qualifies. Definition 14 evaluates any finite transition list using the total one-step Firing function and returns the initial marking for an empty list. Its absence of enabledness conditions is deliberate in the displayed definition and determines the scope of Proposition 17. Propositions 11/12 connect a transition with its singleton list and their firability. Proposition 13 gives Firing(Q concatenated Q1,M)=Firing(Q1,Firing(Q,M)) without a firability premise. Proposition 14 derives prefix firability and suffix firability at the prefix result from firability of the concatenation; no converse is stated in the printed proposition. Proposition 16 quantifies over a decision-free net, one circuit, any natural marking and any transition. It preserves the sum over exactly that circuit’s place set. Proposition 17 extends this equality to any finite transition sequence, with no assumption that the sequence is firable. It does not establish global conservation of all places, boundedness of every place in an arbitrary net, liveness, deadlock freedom, fairness, reachability completeness or infinite-trace properties. Reader proof explanation: a disabled transition stutters. A transition disjoint from the circuit changes no circuit place. If it touches the circuit, Proposition 15 puts it on the circuit; almost injectivity and unique place incidence leave one circuit input and one circuit output (possibly the same place). Thus the one-step sum change is zero, and finite-sequence iteration preserves it. The article gives dependency lists rather than a complete displayed Mizar proof script for the final two propositions. The article identifies MML entry PETRI_DF, version 8.1.02 5.22.1199, and supplies formal theorem statements with short proofs/dependency references. This is evidence of a published formalized development, not an independent local check. No MML files, proof checker, executable simulator, benchmark, empirical protocol case study, proof-time measurements or artifact build was run or inspected here. The paper has no Verus, verified Rust, TLA+ or LLM-agent result. Its relevance is reusable transition-system invariants and precise enabledness semantics. Applying its invariant to a distributed protocol would require a proved model relation from protocol states/steps to this restricted net class. A claim that a resource count is preserved in deployed code would need that extra refinement argument.
  • how much was read: most of it read
  • source
  • record id: the-formalization-of-decision-2014
• Vac - Verifier of Administrative Role-Based Access Control Policies (2014)
  • what: Vac reduces administrative RBAC user-role assignment reachability to program verification. It prunes policies while preserving the target-role query, then uses an integer overapproximation for safe answers or an exact bounded-user Boolean encoding for complete analysis and attack finding. It reconstructs attacks in the original policy after pruning. Default execution combines Interproc, CBMC and μZ. Details the k+1-user cutoff, abstraction direction, exact encoding, bounded-search Unknown outcome, original-policy attack reconstruction and backend routing. Reports 20 realistic-case variants and 30 synthetic policies, all heavily reduced by pruning. Large original input size is separated from the difficulty of the tiny residual verification problems.
  • limits: §§1–2: addresses ARBAC-URA role reachability under the chosen administrative rule semantics. Privilege escalation and separation of duties can be encoded as reachability queries. This is a policy-model result, not a proof of permissions enforcement in SQL Server, Active Directory, SELinux or Oracle implementations mentioned as motivation. §2: input declares roles/users, initial assignments, Can-Revoke pairs, Can-Assign rules with conjunctive positive/negative role preconditions, administrators and target role. Supports any-user and specific-user target queries. Detailed model semantics referred to [8]; arbitrary policy languages or arbitrary Boolean precondition syntax are not established here. §2: pruning preserves target-role reachability, not every property or full trace equivalence. Six pruning actions and sufficient conditions remove irrelevant roles/rules/users. A two-step witness in an intermediate policy may terminate pruning early. Correct transfer to original policies depends on recorded pruning information and reconstruction. §2: cutoff theorem tracks at most k+1 selected users, where k counts administrative roles rather than administrators/users or all roles. Boolean encoding uses (k+1)×n role bits and nondeterministically simulates rules. This exact reduction depends on the theorem and ARBAC semantics in [8], not a generally valid cutoff for distributed systems. §2 Abstract Transformer: integer variables count users in subsets of role combinations; Interproc uses the box domain. Unreachable abstract error proves no target reachability. Reachable abstract error may be spurious and cannot establish an attack. §2 Precise Transformer: exact Boolean-model error reachability iff policy target reachable. Supports μZ, HSF, Eldarica, Getafix, Moped and NuSMV. Decidability and a complete theoretical reduction do not guarantee that every run finishes within finite practical resources. §§2–3: CBMC underapproximates executions. Found errors supply witnesses; no error gives Unknown. Default unwind=2 is a cheap bug search, not the k+1-user completeness theorem and not a proof that all attacks have depth two. Default falls back to μZ after failed bounded search. §2/Fig1: precise backends can report Error without the CBMC original-policy attack reconstruction path. Counterexample module specifically consumes CBMC output and pruning metadata. The figure also depicts Unknown for bounded failure and No Error for sound negative analyses; do not treat all backend YES/NO labels as identical query semantics. §3: C implementation depends on ANTLR3.2 for C, ROXML and CCL, plus external verification backends. Translation, pruning, parsing, solver semantics and trace lifting remain trusted. No formally verified implementation, proof certificate or source-to-policy correspondence checker is reported. §4: Table1 has four hospital, four university and twelve bank variants. Last four banks modified by the authors to add users and make two queries safe. These are realistic case-study models, not new audits of deployed organizations or 20 independent real systems. §4: Table2 contains three synthetic suites of ten policies, every target reachable. Residuals have only two to four roles and one to three rules despite up to40000 original roles/200000 rules. Results demonstrate effective pruning on selected structures, not solving equally large irreducible Boolean state spaces or balanced safe/unsafe synthetic cases. §4: Linux64, IntelCorei7-3770,16GB RAM; default pipeline. Table1 Reach time is overall analysis time, including pruning, not an additional duration to sum with the pruning column. Positive times include counterexample generation. Backend-specific counts, repeat variance, time/memory budgets and ablations are absent. §5: priority and performance comparisons with Mohawk, RBAC-PAT and asaspXL are author claims without a head-to-head timing table here. Separate-administration restriction discussed for Mohawk/RBAC-PAT is not an assumption imposed on Vac. Temporal RBAC is cited as prior application, not evaluated in this paper. No new in-paper cutoff/translation proof or mechanized theorem is supplied; core proofs cited in [7,8]. Software, prior proofs and benchmark files were not independently run/read. No Verus, Rust, TLA+ or LLM experiment is reported.
  • how much was read: most of it read
  • record id: vac-verifier-of-administrative-2014
• Vehicular security policy testing (2014)
  • title: Testing Security Policies for Distributed Systems: Vehicular Networks as a Case Study
  • what: Combines an EFSM functional model, XACML security policies, and an implementation to synthesize secure functional specifications and active test sequences with TestGen-IF. The approach integrates policy conditions into the system model, adds transitions/guards for authentication, GPS, premium access, and trust negotiation, then explores accessibility graphs guided by test purposes. The vehicular Dynamic Route Planning service and vehicle-to-infrastructure negotiation illustrate policy conformance testing.
  • number: initial server model has 3 states, 3 transitions, 6 signals
  • number: secure model has 3 states, 5 transitions, 8 signals
  • number: three principal security rules govern login/GPS access and premium routing
  • number: test generation uses partial state-space exploration guided by objectives
  • limits: Testing is model-based and objective-guided rather than exhaustive proof; coverage depends on EFSM abstraction, selected test purposes, and the generated partial state-space exploration. The paper presents an ongoing case study and small state/transition counts, not a broad deployment or security-coverage benchmark.
  • how much was read: most of it read
  • record id: vehicular-security-policy-testing-2014
• Arai Okazaki AESCIP_1 AES Part I 2013 (2013)
  • title: Formalization of the Advanced Encryption Standard. Part I
  • what: Arai and Okazaki formalize a parametric AES-shaped cipher in Mizar and prove decryption after encryption for 128-bit blocks and keys of 128,192 or 256 bits. Byte substitution S and state mixing M are assumed permutations; concrete GF(2^8) definitions and invertibility are explicitly deferred. Work proves array representation and inverse-composition structure plus key expansion, rather than completing all concrete AES transformations or establishing cryptographic security. Records precise state serialization, inverse component proofs, all key-expansion cases and round counts, reverse-key schedule, missing final mixing step and reverse-index induction. Preserves arbitrary byte/state permutation assumptions, exact shift conventions and deferred finite-field semantics, avoiding substitution of generic round-trip validity for standard conformance.
  • limits: Mizar article AESCIP_1, release 8.1.02/5.19.1189; 14 pages,seven sections,24 definitions,39 propositions,19 references. Reuses previous DESCIP_1 sequence shifts/XOR and standard Mizar functions/finite sequences. FIPS197(2001) is specification reference. Paper says GF(2^8) treatment will be future work; does not instantiate standard AES S-box or prove concrete MixColumns matrix invertible. Reader did not build Mizar or inspect later installments (p171, §§1–7). State type is four rows of four 8-bit Boolean sequences, giving 128-bit block. Serialization maps row i,column j to eight bits starting 1+8(i−1)+32(j−1), one-based. Propositions 15–17 prove coverage/disjointness/unique byte interval ; 18–19 prove array map injective and onto,20 its inverse equation. Not merely an assumed representation equivalence; paper supplies short proof arguments. No numerical endian/standard-layout test performed (§2). S is any permutation of Boolean^8, shared by encryption, decryption and key expansion. SubBytes applies S bytewise, inverse applies S^−1. Propositions 21–23 establish both cancellation directions and bijectivity from generic inverse-function lemma 14. State mixer M1/M2 is an arbitrary permutation of entire 128-bit state, not restricted to a columnwise GF matrix. Its inverse assumed through permutation type. This separates generic inverse proof from later instantiation obligations (§3, §7). ShiftRows sends row i through Op-Shift(x_i,5−i); InvShiftRows uses i−1. These shifts sum 4, row length, so cancellation follows from inherited cyclic-shift arithmetic. Under DESCIP_1 definition Op-Shift(s,n)[j]=s[((j−1+n) mod len s)+1], the forward shifts are left 0,3,2,1 modulo 4, inverse 0,1,2,3. Reader derivation preserves printed convention, without claiming FIPS conformance, an observed implementation failure or independently comparing external standard. Propositions 24–26 prove inverses for the written definitions (§4). AddRoundKey XORs corresponding bytes. Key helpers substitute bytes, rotate a four-byte word left and XOR words. Rcon has ten explicit words: first bytes 01,02,04,08,10,20,40,80,1b,36 in hexadecimal, other three bytes zero. These are enumerated bit patterns; finite-field derivation not supplied (§5–6). Key size parameter m∈{4,6,8} counts 32-bit words. Expanded word count 4(7+m) gives 44,52,60 words; group consecutive four words into 11,13,15 state keys (reader arithmetic). Initial m words copied; at index i≥m XOR prior i−m word with transform of previous word. If i mod m=0, transform RotWord then SubWord and XOR Rcon(i/m); for m=8 and i mod 8=4 additionally SubWord; otherwise unchanged. KeyExpansion is deterministic for supplied S, not separately a proved standard-conformance or security theorem (Definitions 7–13). Encryption begins AddRoundKey with first state key. Sequence length N=(7+m)−1=m+6; middle steps apply SubBytes, ShiftRows, M, then XOR next key. Final step omits M and uses last key. Thus 9/11/13 full middle rounds plus one final round:10/12/14 rounds for m=4/6/8. Count derived from index ranges, not empirical performance measurement. Decryption reverses same expanded key sequence, XORs key then applies M^−1 where appropriate, InvShiftRows, InvSubBytes; inverse final output cancels initial key (§7). Propositions 27–34 give mixer inverse, composed component cancellation and equal forward/reversed-key XOR cancellation. Main 35 holds m=4 or 6 or 8: AES-InvCipher(S,M,AES-Cipher(S,M,t,K),K)=t. Printed proof defines encrypt/decrypt state sequences, N=m+6 and invariant ds(i+1)=es(N−i) for i<N. Base cancels encryption final key plus no-mixing final layer; step cancels key/mixer/shifts/substitution; last XOR cancels first key. Full printed derivation includes induction dependency references; reader does not claim independent kernel replay (§7, pp180–181). Raw keys 128/192/256 are sliced into 4/6/8 four-byte words. Wrappers serialize 128-bit message to state, apply generic cipher/inverse with same S,M and parsed key, then deserialize. Propositions 37–39 prove respective DEC(ENC(message,key),key)=message using array inverse and 35. Block size remains 128 for every key length. Identity proves unique recovery of original message for fixed parameters and key; it does not prove resistance to wrong-key recovery or any cryptographic attack (§7). Article body permits natural m syntactically in cipher definitions, but key-expansion defining conditions and main inverse theorem require m=4,6,8; do not extend completed theorem to arbitrary key lengths. The permutation hypotheses are real semantic assumptions, not discharged by merely naming operations SubBytes/MixColumns. No concrete executable implementation, constant-time/side-channel model, security game, block mode/padding/authentication, benchmark or known-answer test reported (§§1–7). Paper is an example of modular inverse proofs over an abstract cipher skeleton. A concrete AES correctness claim additionally needs specified finite-field transformations instantiated as required permutations and agreement of arrays, shifts and key layout with standard. Those obligations are not established by generic round trip. No distributed fault model/protocol, Verus/Rust/TLA+ development or LLM agent experiment.
  • how much was read: most of it read
  • source
  • record id: arai-okazaki-aescip-1-aes-part-i-2013-2013
• Benedikt-Lenhardt-Worrell FO2 versus LTL (2013)
  • title: Two Variable vs. Linear Temporal Logic in Model Checking and Games
  • what: Compares two-variable first-order logic (FO2) and linear temporal logic (LTL), including unary temporal logic UTL, stutter-free fragments, and the combined FO2[LTL]. It gives three formula-to-automata translations and derives tight or near-tight verification bounds for nondeterministic, recursive, probabilistic, and game models. Translation I relates UTL/FO2 to unambiguous limit-deterministic Büchi automata; Translation II exploits polynomially many FO2[<] subformula types under a unary-alphabet restriction; Translation III builds deterministic parity automata for FO2 using small-model representatives. These constructions yield NP for FO2[<] on Kripke/HSM/RSM, NEXP for FO2 on RSM, 2EXPTIME-complete two-player games, #P/PEXP probability bounds on Markov chains, PSPACE for FO2[<] on recursive Markov chains, and 2EXPTIME quantitative MDP bounds. FO2[LTL] inherits the maximum complexity of its components, while Let definitions make FO2[<] exponentially harder.
  • number: FO2[<] model checking NP on Kripke/HSM/RSM
  • number: FO2 model checking NEXPTIME on RSM
  • number: 2EXPTIME-complete FO2 two-player games
  • number: FO2[<] probability on Markov chains in #P
  • limits: Results concern infinite words over monadic predicates and specific machine classes; several translations use unary alphabet restrictions or nondeterministic automata families. Some RMC bounds are marked not known tight. Complexity statements are asymptotic worst-case and do not provide implementations or empirical benchmarks. The paper leaves succinctness questions for Let in FO2[LTL] and extensions from words to trees open.
  • how much was read: most of it read
  • record id: benedikt-lenhardt-worrell-fo2-versus-ltl-2013
• CAVA verified LTL checker (2013)
  • title: A Fully Verified Executable LTL Model Checker
  • what: Presents CAVA, an executable LTL model checker whose complete functional correctness is proved in Isabelle/HOL. The automata-theoretic checker translates Boolean programs and negated LTL to Büchi automata, forms their product, and uses nested DFS; abstract set-based algorithms are refined to red-black trees, lists and arrays before ML code generation. The paper gives the full correctness decomposition: Gerth tableau translation to generalized Büchi, generalized-to-ordinary Büchi conversion with acceptance-index states, product-language intersection, lasso characterization and nested-DFS emptiness. It states the Isabelle refinement workflow and interface lemmas, including the exact NO-LASSO specification. Boolean programs are intentionally small (Boolean guarded commands, no arrays/bounded integers), compiled to an interpreted assembly language with always-infinite runs. The 16,000-line Isabelle development (plus 30,000-line Collections and 10,000-line Refinement frameworks) generates about 4,900 ML lines and is benchmarked against SPIN.
  • number: ~4,900 generated ML lines
  • number: ~16,000 Isabelle development lines
  • number: 30,000-line Collections Framework
  • number: 10,000-line Refinement Framework
  • limits: Input programs are finite-state Boolean guarded-command programs; variables are Booleans and the formal language omits arrays and bounded integers. The model semantics forces every program to have an infinite run, and correctness is for the generated ML code under Isabelle’s trusted kernel/code generator. Functional verification is complete but performance is below optimized C tools: state-space compilation can create extra states, and SPIN uses more mature reductions/simplification. Experiments consider only properties that hold and compare unoptimized SPIN, so timings are reference-implementation evidence rather than broad performance claims.
  • how much was read: most of it read
  • source
  • record id: cava-verified-ltl-checker-2013
• Concurrent data-structure observers and shape analysis (2013)
  • title: An Integrated Specification and Verification Technique for Highly Concurrent Data Structures
  • what: Combines infinite-state observer automata, data-independence reduction and pairwise-thread shape analysis to verify safety and linearizability of concurrent stacks, queues and priority queues with unbounded threads, heap and data values, including explicit memory reclamation.
  • number: M&S queue without GC 550 s, 53,320 constraints
  • number: Treiber stack without GC 2.28 s, 1,535 constraints
  • number: Treiber stack with GC 0.23 s
  • number: M&S queue with GC 3.31 s
  • limits: Programs and properties must satisfy data-independence conditions; values are copied/compared rather than manipulated, and linearization points must be supplied. Current shape analysis assumes singly linked selectors and pairwise thread views; multiple selectors and richer structures are future work. The abstraction can lose precision and state-space grows with joined constraints, especially without garbage collection. Results concern safety/conformance and linearizability, not liveness or implementation-level Rust memory models.
  • how much was read: most of it read
  • record id: concurrent-data-structure-observers-and-shape-analysis-2013
• Dagstuhl distributed verification report (2013)
  • title: Formal Verification of Distributed Algorithms (Dagstuhl Seminar 13141)
  • what: This seminar report surveys a research meeting joining distributed-algorithm, model-checking and semi-automated-proof communities to establish a common base and identify open verification problems.
  • limits: Report summarizes seminar contributions rather than presenting one executable case study.
  • how much was read: most of it read
  • source
  • record id: dagstuhl-distributed-verification-report-2013
• DANSE SoS SMC (2013)
  • title: SoS contract verification using statistical model checking
  • what: DANSE describes a statistical contract-checking toolchain for heterogeneous systems of systems: stochastic UPDM/SysML attributes, OCL/SPEEDS-based GCSL requirements, bounded temporal-logic monitoring in PLASMA, and DESYRE/FMI simulation. It describes integration and configuration, without a translation-correctness theorem or quantitative evaluation.
  • limits: Performance and non-critical structural/temporal constraints; estimates depend on the simulation and stochastic model. PLASMA focuses on discrete time and bounded logic. Open systems with changing variables remain prospective. Contract details are deferred to separate reference [3], not included as a supplement. No measured scalability, correctness of translators, or industrial end-to-end benchmark is established in this source.
  • how much was read: most of it read
  • source
  • record id: danse-sos-smc-2013
• Distributed CTL MapReduce checking (2013)
  • title: Distributed CTL Model Checking in the Cloud
  • what: Builds a Hadoop MapReduce framework for explicit-state CTL model checking, distributing EX, EG and EU fixed-point computations over very large reachability graphs. The approach stores predecessor lists with each partitioned state so EX, EG and EU can run without inter-worker predecessor communication; iterative MapReduce jobs compute least/greatest fixed points until convergence. It requires serial transition relations and adds an error self-loop for deadlocks. AWS experiments cover shared-memory (1.831×10^6 states), Dekker (1.153×10^7) and simple load balancing (4.060×10^8 states, 3.051×10^9 arcs, 120 GB), with speedups increasing with state-space size and super-linear EG speedup in the largest model.
  • number: EX, EG, EU fixed-point operators
  • number: 1.831×10^6, 1.153×10^7 and 4.060×10^8 states
  • number: 3.051×10^9 arcs and 120 GB
  • number: up to 16 machines
  • limits: Finite Kripke structures with total/serial transitions are assumed; state graphs are generated beforehand and partitioned by hashing. MapReduce shuffle/sort and repeated materialization dominate engineering costs, and no comparison with modern distributed checkers or fault-injection study is given. Experiments use AWS m2.2xlarge clusters and three Petri-net benchmarks; speedups depend on partitioning, I/O and cloud configuration. The method handles only CTL operators reduced to EX/EG/EU.
  • how much was read: most of it read
  • record id: distributed-ctl-mapreduce-checking-2013
• DiVinE 3.0 (2013)
  • title: DiVinE 3.0 – An Explicit-State Model Checker for Multithreaded C & C++ Programs
  • what: Presents DiVinE 3.0, a parallel/distributed LTL model checker that directly explores closed multithreaded C/C++ through an LLVM bitcode interpreter, supports untimed LTL over Uppaal timed automata, and exposes the CESMI plug-in interface for external model languages. Core reductions include partial-order/path/heap-symmetry methods, disk queues and optional hash compaction. The paper explains how closed programs substitute unsupported I/O with nondeterministic choices and how DiVinE explores all thread interleavings at individual bitcode instructions. It reports LLVM reduction counts for Peterson under compiler optimization, fair-run LTL for DVE, zone-abstraction timed-automata interpretation and deadlock checks, and CESMI modules for DVE, Murϕ and MATLAB Simulink. It also documents a single shared hash-table experimental mode and its production caveat.
  • number: Peterson -O0: 294,193→212 with all reductions
  • number: Peterson -O1: 33,227→278
  • number: Peterson -O2: 21,122→260
  • number: τ/τ+/all reductions reported for all three builds
  • limits: Direct C/C++ verification requires closed programs: OS/I/O calls need provided substitutes or nondeterministic wrappers, and native execution still depends on the native compiler/runtime after bitcode verification. Hash compaction reduces memory but introduces a small risk of missed counterexamples, so results cannot guarantee correctness. Untimed LTL over timed automata may report spurious counterexamples because zeno and non-zeno behaviors are not distinguished. State-space explosion remains the core scalability limit; the shared hash-table mode is proof-of-concept.
  • how much was read: most of it read
  • source
  • record id: divine-3-0-2013
• Efficient Synthesis for Concurrency by Semantics-Preserving Transformations (2013)
  • what: Synthesizes assertion-safe concurrent libraries from sequentially correct libraries using sequential-semantics-preserving instruction reorderings and atomic sections. Generalizes a failing linear trace into a partial order representing many failing schedules, then eliminates all its linearizations with constraints obtained from a minimal cycle in a weighted elimination graph. §3 models deterministic instructions/CFG methods, arbitrary concurrent method invocations and sequential input/output behavior. §4 computes allowed within-block statement reorderings by commutativity checks, combines ordering and atomicity constraints, and motivates idempotent duplication without formally incorporating it. §5 defines error invariants that overapproximate states reachable along the trace and underapproximate states from which the error is forced. A complete generalization check is expensive; two sufficient rules exploit conditional commutativity or an error-preserving common postcondition, while checking intervening instructions preserve supporting invariants. Previously relaxed edges are rechecked. §6 encodes essential happens-before relations, available reorderings and atomicity additions as weighted graph edges; creating a cycle makes every represented trace infeasible. A large atomicity weight prefers reorderings; shortest paths find an elimination cycle in polynomial time. Constraints monotonically accumulate. The minimality result concerns the constraint eliminating the current partial-order counterexample, not a globally optimal repaired program.
  • number: manual study: 100 defects, 68 drivers; 28 reorder, 17 lock, 10 optimistic, 7 barrier, 6 atomic replacement, 5 synchronization upgrade, 3 unshare, 1 clone, 23 ad hoc
  • number: Table 2 subpatterns list 11 release, 10 lock, 6 delay, 1 read/write and 1 ad hoc reorder case; these sum to 29 although Table 1 reports 28 total reorders; the paper does not explain the discrepancy
  • number: microbenchmarks: each synthesis <15 s and trace analysis <0.5 s; ex5 needs 2 iterations with generalization versus 3 without
  • number: Realtek: 364 LOC, seven threads, five defects; generalization iterations 1,1,1,1,2 and bug-finding times 8,23,93,94,47 s
  • limits: Sequentially correct deterministic methods with reducible CFGs; formal semantics permits an unbounded number of concurrent threads, each making one method execution, but the experiment uses a supplied seven-thread environment model. Reordering is restricted to a straight-line basic block. Safety/assertion specifications are central; deadlocks in experiments are manually translated into assertions because Poirot does not detect them. The prototype handles a restricted C subset excluding pointer arithmetic, aliasing and bitwise arithmetic. It uses bounded model checking, and no benchmark bounds are specified here; therefore experimental verification should not be relabeled an unbounded machine-checked library proof. The implementation does not compute error invariants even though they motivate the generalization theory. Weak memory and required fences remain future work; enforcing a source-level order assumes sequential consistency. Repair may introduce other bugs and further counterexamples; there is no guarantee of intermediate regression freedom.
  • how much was read: most of it read
  • source
  • record id: efficient-synthesis-for-concurrency-2013
• energy-aware dynamic SPL model checking (2013)
  • title: Probabilistic Model Checking for Energy Analysis in Software Product Lines
  • what: Presents a compositional MDP framework for dynamic software product lines with probabilistic and nondeterministic feature changes. Feature modules and a controller translate to PRISM, enabling strategy synthesis for energy, monetary cost, reliability, and SLA objectives across product variants. Separates feature computation from coordination, gives operational MDP semantics for runtime adaptations, translates family models to PRISM’s symbolic engine, and evaluates an eBond networking product line. Family-based analysis compares favorably with checking feature combinations one by one.
  • number: Family-based model: 37 million states, 1.3 h query time, 2,970 MB; one-by-one: 427 million states, 6.9 h, 1,680 MB (Table 1)
  • number: Family-based approach is around six times faster for 27 feature combinations (§4.4)
  • number: At low bandwidth, SLA-avoidance probability is nearly 90% (§4.4)
  • number: Optimal configurations keep expected SLA-violation time between 0.06% and 0.11% (§4.4)
  • limits: Quantitative results depend on the MDP abstraction, selected feature modules, and PRISM/value-iteration approximations. The case study considers 27 combinations and specific energy/network assumptions; scalability beyond the tested family is projected rather than demonstrated. Strategy synthesis optimizes modeled objectives, not implementation-level energy.
  • how much was read: most of it read
  • record id: energy-aware-dynamic-spl-model-checking-2013
• Epistemic-CEGAR access-control checker (2013)
  • title: Model Checking Agent Knowledge in Dynamic Access Control Policies
  • what: Models finite dynamic access-control policies as interpreted multi-agent systems and checks CTLK temporal and epistemic properties, including knowledge gained by inference as well as direct reads. It adds abstraction/refinement for ACTLK safety properties and interactive refinement for useful formulas outside ACTLK.
  • number: 3 papers and 7 agents (Query 1 comparison)
  • number: 2 papers and 4 agents (Query 2 comparison)
  • number: Query 3: 6576.5 s/180 BDD variables concrete versus 148.3 s/80 variables abstraction
  • number: Query 4: 6546.4 s/180 BDD variables concrete versus 174.1 s/98 variables abstraction
  • limits: Grounding uses a finite object set, finite Boolean policy propositions, and finite interpreted systems, so state explosion remains. Automatic CEGAR handles ACTLK safety/tree counterexamples; unbounded paths require unfolding. Formulas with negated knowledge (for example Query 3) use interactive refinement and user-selected local variables. The epistemic relation assumes local states capture observations. Evaluation is a small conference-review study, not an industrial scalability result; model generation and counterexample checking dominate runtime.
  • how much was read: most of it read
  • record id: epistemic-cegar-access-control-checker-2013
• Exploring Parameter Space of Stochastic Biochemical Systems Using Quantitative Model Checking (2013)
  • what: Computes lower/upper approximations of quantitative bounded-time CSL-with-rewards results over boxes of uncertain biochemical reaction rates. Parametrized uniformization propagates componentwise extrema intending to optimize each affine update by rate endpoints, although the printed shared-rate derivation needs repair, and relaxes global fixed-parameter dependence across states/iterations. Recursive parameter subdivision tightens the landscape. Evaluates a one-species bistable reaction model and a mammalian gene-regulation model. Printed derivation/numerical-bound details need qualifications; concrete models also impose unverified finite population cutoffs. Introduces possible/universal satisfaction-set approximations for nested threshold subformulas, distinguishes true variation within a parameter box from overapproximation caused by independently optimized updates, and supplies a discontinuity-aware stopping criterion. Gives all chemical rates, six temporal-property variants, complete iteration/subspace/runtime figures and parameter boxes. Reader checks separate bounded finite-CTMC claims, Poisson-tail accounting, printed algebra, local versus integrated error and raw cumulative rewards versus fractions.
  • limits: Finite-state well-stirred, fixed-volume/fixed-temperature stochastic mass-action system. Each species has a fixed population bound; reactions that would violate species bounds are not enabled. A CTMC rate is sum k_r*C_r,i, with combinatorial propensity C=product binomial(population,stoichiometry). Despite p.110 calling R(i,j) a probability, units and uniformization formulas make it a transition rate. Nonnegative rates vary independently over compact intervals; linear correlations are said to be supported but no complete correlated optimization procedure is supplied. Landscape maps each parameter point and starting state to a probability or expected reward for a bounded-time CSL formula. Supports nested probability/reward thresholds, instantaneous/cumulative reward operators and defines both state/transition reward structures, next/until and derived globally/eventually. Although until bounds are finite, X is not explicitly time-bounded in syntax. This is parameter sensitivity/exploration, not finding one maximum-likelihood parameter or verifying unbounded temporal behavior. Nested threshold tests change satisfaction sets discretely, so landscape can be piecewise continuous with jumps even if rates vary smoothly. Exact max/min notation over compact boxes needs attainment if discontinuities are allowed; supremum/infimum would avoid assuming attainment. The chapter does not prove all such extrema exist. Constant numerical precision at every parameter point cannot generally be obtained by a finite partition straddling a jump. For Boolean subformulas, possible-state set is union over parameter models and universal-state set is intersection. Inductive over/underapproximations use opposite polarity under negation, conjunction componentwise, and upper/lower numerical threshold tests. Possible conjunction can combine witnesses from different parameters, so it is an overapproximation, not exact existential satisfaction. Negation slashes are visible in p.113 but lost in raw text extraction; this is not a printed missing-negation defect. Uniformization uses one q_max dominating every state exit rate for every model in the box, producing nonnegative matrix coefficients. Monotonicity then permits upper inputs for upper propagation and lower inputs for lower. The intended local maximization chooses rate endpoints according to the sign of each shared rate’s total affine coefficient; the printed pair-set rule does not implement that grouping as written, as detailed below. The resulting upper vector need not sum to1 and is not a probability distribution or a realizable fixed-rate CTMC. Global parameter choices are deliberately relaxed: the same reaction rate can take different endpoints in different target states and different uniformization iterations. Result bounds therefore need not be attainable by any one parameter point. This dependency loss is called unification error; splitting boxes reduces both it and the actual landscape range, but does not make every upper vector a valid stochastic trajectory. Reader algebra check, visible p.115: displayed rewrite of sigma(si) into incoming/inout/outgoing sums omits the additive pi(i) present in Equation3. For an absorbing state with pi(i)=1 and no incident reactions, Eq3 gives1 but rewritten sums give0. Also pred/succ are sets of pairs(j,r); for birth X->2X at statei, (i-1,r) and(i+1,r) are distinct pairs despite sharing rate r. Their set difference/intersection need not produce disjoint reaction sets as the prose claims. Correct optimization groups all terms by shared rate r before choosing its endpoint. These are printed derivation issues, not inspected implementation failures. Reader numerical soundness qualification: Equation1 demands upper>=exact probabilities, but the later displayed finite Poisson sum drops positive tail terms without an explicit upper-tail addition. A single absorbing state with fixed q>0 has exact probability1 but any finite unrenormalized Poisson sum below1. Fox–Glynn/truncation epsilon is discussed, but the chapter does not state an outward correction making the printed upper inequality exact; floating-point rounding certification is also absent. Thus exact enclosure requires a stated epsilon qualification or correction, not merely the finite formula as printed. Per-box reported overall error is computed upper minus computed lower, combining true landscape range and dependency relaxation. Section6 also writes a parameter-volume-weighted average of box gaps; that is an integrated average error and is not the same definition as a pointwise maximum gap. A bound for every box implies both bounds, but a small average alone cannot bound every parameter point. No probability distribution over unknown parameters is assumed by the model. Refinement may cancel an ongoing iteration when a component gap exceeds ERR and restart independently in subboxes; retaining a prior overapproximate vector can retain accumulated error. Minimal decomposition is neither computed nor unique in general. Existence at desired accuracy is only guaranteed for continuous landscapes. For discontinuities they add a minimum-subspace-size cutoff to ensure termination even when requested accuracy is unattainable. Termination therefore must not be reported as achievement of ERR on every leaf. Complexity comparison to ordinary uniformization is per update/pass at fixed state graph and Poisson cutoff: endpoint selection adds constant work per relevant reaction coefficient. It excludes potentially many adaptive subregions, long time horizons/high exit rates and larger state spaces. Parallelizable independent boxes are proposed, not measured parallel speedup. No universal end-to-end polynomial or runtime advantage over all sampling methods is established. Finite-population cutoffs are model assumptions, not certified probabilistic truncations of the unbounded biochemical process. Schloegl cap1000 is motivated by an ODE asymptotic steady-state bound, which does not exclude stochastic excursions above1000. Gene A/B cap10 is chosen from stochastic simulations. Disabling boundary-crossing reactions changes the process; no escaped mass/error certificate connects the finite CTMC landscape to the unbounded physical model. Gene model is a simplified stochastic mass-action reformulation of an ODE circuit. Promoter binding/unbinding parameters are added, cooperativity neglected, rates based on timescale orders, gene-copy counts fixed at1. These biological abstractions are separate from finite-CTMC numerical accuracy; no experimental-cell validation, confidence interval or parameter-estimation uncertainty calibration is reported. Property1a/2a/3a measures probability of remaining in B<3/B>5/B>7 throughout[500,1000]; reward1b/2b/3b accumulates indicator occupancy over[0,1000]. Continuous-stay probability can be near0 despite substantial expected occupancy. Printed text calls reward a fraction, but formula and Fig.4 axis0–1000 give expected time in seconds; divide by1000 for fraction. Fig.5 raw error colorbar0–100 accompanies reported ERR=.1, suggesting normalized-fraction versus raw-reward units not explicitly specified; do not silently assert raw error<=.1seconds. Runs on PRISM4.0.3 sparse engine, Linux, AMD PhenomII X4 9403GHz,8GB DDR2 1066MHz. PRISM4.0 is the base-tool description. Case models have1001/1078states and2000/5919transitions; hours-long timings are single reported outcomes with no repeats/error bars, memory consumption, baseline comparison or independent replay. No artifact URL identified in chapter. Poisson epsilon, minimum leaf size, decomposition heuristic chosen and default gamma_B for the one-dimensional gene sweep are not fully specified. Relevance is proof/evaluation discipline for uncertain stochastic specifications: dependent parameters, nested threshold discontinuities, finite-model assumptions, local versus global numerical bounds, specification sensitivity and raw units. No distributed-system proof, Verus/verified Rust,TLA+,LLM specification/proof writing, or machine-checked theorem result. Parallel computation is a proposed acceleration, not distributed correctness verification.
  • how much was read: most of it read
  • record id: exploring-parameter-space-of-2013
• Gaudel et al. approximations model checking (2013)
  • title: Some approximations in Model Checking and Testing
  • what: Surveys approximation methods connecting model checking, black-box checking, model-based testing, and probabilistic model checking, with complexity and quality guarantees. The survey gives formal models and boundaries for five approximation families. It derives the bounded-model-checking completeness bound, a Monte-Carlo Büchi-lasso checker with one-sided guarantees, probabilistic graph abstractions using epsilon-reducibility, sketch-based approximate Büchi equivalence, coverage-biased random testing via a linear program, and additive/multiplicative sampling schemes for the essentially positive LTL fragment. It explicitly separates counterexample finding from proof of absence and explains where assumptions such as density, distance, or ergodicity are needed.
  • number: BMC bound k=O(|M|·2^|φ|)
  • number: Graph Test rejection probability at least 2/3
  • number: MC2 complexity O(M·D) time and O(D) space
  • number: GAA sample count ln(2/δ)/(2ε²)
  • limits: Finite transition systems and specified temporal logics underlie most results. BMC is incomplete until a completeness threshold is reached; Monte-Carlo checking can miss errors when counterexample probability is below epsilon; graph and property testers assume epsilon-reducibility; approximate equivalence is statistical; probabilistic schemes need EPF formulas and nonzero probability and may have exponential expected samples for small probabilities. Testing/black-box guarantees depend on IUT bounds, distributions, and sampling assumptions.
  • how much was read: most of it read
  • record id: gaudel-et-al-approximations-model-checking-2013
• HOL-Light-Taylor (2013)
  • title: Formal Verification of Nonlinear Inequalities with Taylor Interval Approximations
  • what: Presents a HOL Light proof-producing tool that verifies multivariate polynomial and non-polynomial inequalities on rectangular domains using interval arithmetic and Taylor approximations. Uses recursively partitioned domains and certificate trees (monotonicity, subdivision, references and gluing), formalizes Taylor and floating-point bounds, and includes optimizations such as direct interval evaluation and memoized sub-certificates. It was developed for Flyspeck’s Kepler-conjecture inequalities.
  • number: 130 Flyspeck inequalities verified in initial testing; project contains about 1000
  • number: Formal procedure estimated about 3000× slower than C++ (over four years versus nine hours for all inequalities)
  • number: Performance tests report roughly 2000–4000× overhead on selected Flyspeck inequalities
  • number: 683 inequalities informally verify in under 10 seconds and 911 in under 100 seconds
  • limits: Domains are rectangular and the procedure may require many subdivisions; formal checking is thousands of times slower than informal C++ and scales poorly for the full Flyspeck corpus without optimization. The method does not replace general quantifier elimination for all domains/functions.
  • how much was read: most of it read
  • record id: hol-light-taylor-2013
• HyLTL (2013)
  • title: HyLTL: a temporal logic for model checking hybrid systems
  • what: Defines HyLTL for properties combining continuous flow constraints, discrete actions and temporal operators, then translates formulas into equivalent generalized-Büchi hybrid automata so model checking reduces to reachability. The tableau-style construction uses maximally consistent formula sets as locations and generalized Büchi acceptance for until formulas. Composing the system with the automaton for a negated property yields an accepting-run reachability check that can be passed to tools such as PhaVer; a thermostat example demonstrates the workflow.
  • number: Thermostat property verification took almost 0.2 seconds on an Intel Core Duo 2.0 GHz notebook
  • number: Only one feasibility example is evaluated
  • number: The reported example uses a composed system/formula hybrid automaton
  • limits: The approach inherits reachability-tool limitations and is preliminary. PhaVer computes over-approximations, so an apparent accepting loop can be an approximation artifact; the paper notes that hybrid-system model checking is generally undecidable and suggests on-the-fly construction and richer predicates as future work.
  • how much was read: most of it read
  • record id: hyltl-2013
• Isabelle-ALC (2013)
  • title: Formal verification of a proof procedure for the description logic ALC
  • what: Defines a semantic-tableau prover for description logic ALC and formally verifies soundness, completeness and termination in Isabelle/HOL, first over abstract sets and then for an executable list-based implementation. Bridges abstract tableau rules to executable rule functions over list-based Aboxes, proves implementation soundness/completeness and termination using well-founded measures, and extracts an executable Caml prover. The development addresses certification gaps in RACER and FaCT++-style reasoners.
  • number: Three metatheoretic properties proved: soundness, completeness and termination
  • number: Executable prover extracted to Caml
  • number: Implementation extends earlier abstract non-executable procedure
  • limits: The formalized logic is ALC rather than more expressive extensions such as SHOIN; proof-assistant correctness does not itself benchmark practical throughput. The paper reports extraction and formal properties, with no broad empirical performance evaluation.
  • how much was read: most of it read
  • record id: isabelle-alc-2013
• Kornilowicz TOPALG7 fundamental group commutativity 2013 (2013)
  • title: Commutativeness of Fundamental Groups of Topological Groups
  • what: Korniłowicz formalizes the theorem that the fundamental group at the identity of a topological group is commutative. The article constructs pointwise loop/homotopy multiplication, proves compatibility with homotopy and concatenation, and supplies an explicit parameterized conjugation homotopy exchanging f and g. Its MML identifier and library version identify a Mizar development; this PDF presents definitions and theorem statements rather than the complete checker proof scripts. Records typed function construction/equality, algebra versus continuity requirements, homotopy congruence, concatenation identity and the explicit Hopf homotopy including endpoint checks and quotient-level scope.
  • limits: The main theorem uses T a topological group, t its identity (a unital point), and f,g loops based at t. It states pi_1(T,t) is commutative; it does not assume T itself commutative, nor prove a statement about arbitrary topological spaces. A fundamental group consists of based-loop homotopy classes with concatenation (pp.128–130). The formalization is identified as MML TOPALG_7, version8.1.02 5.17.1179. Paper text lists definitions, schemes, propositions and registrations. The underlying Mizar source, checker output and cited26library/textbook sources are not independently inspected or executed here (p.127,references). Definition1 marks g unital iff g=1_G; unit multiplication/inverse reductions and constant-function evaluation are registered. Schemes TopFuncEx/TopFuncEq supply construction and extensional uniqueness for maps on products of nonempty spaces into a nonempty set. These are infrastructure for constructing two-variable homotopies (pp.127–128). Definitions2/3 use pointwise multiplication: (f dot g)(x)=f(x)g(x); bullet denotes the resulting loop operation. Proposition1 derives function-product associativity from target associativity; function products are commutative only under the separate stronger commutative-magma assumption. The main argument cannot assume loop representatives commute pointwise (p.128). Pointwise multiplication preserves identity-based loops under the declared continuous unital topological-group structure. Definition4 composes a loop with group inversion; Propositions2–4 give pointwise inverse/cancellation laws. The inverse-loop continuity registration explicitly assumes inverse-continuity and an identity basepoint. Algebraic inverse laws alone do not supply a continuous inverse loop (pp.128–129). Definitions5/6 restrict continuous real multiplication to I=[0,1]. Propositions5–7 identify the relevant product subspace, show interval multiplication is xy and continuous, and give the corresponding neighborhood control. This supports the ab parameter in the final homotopy (p.129). Definition7 multiplies F,G:I×I→T pointwise. Proposition8 bounds images of an intersected domain by products of images; continuous F,G yield continuous F*G. Propositions9/10 establish that multiplication respects based homotopy and that pointwise products of homotopies connect the products of endpoint loops (p.129). Here + denotes loop concatenation and c is the constant identity loop. Proposition11 states f+g=(f+c) bullet(c+g). Proposition12 makes f bullet g homotopic to that concatenation using homotopy congruence and constant-loop units. These statements identify the quotient product from concatenation with pointwise loop multiplication; literal equality f+g=f bullet g is not asserted (p.129). Definition8 gives H(a,b)=((f(ab)^-1 f(a))g(a))f(ab), with parentheses printed explicitly. At b=0, f(0)=e gives H(a,0)=f(a)g(a); at b=1 cancellation gives H(a,1)=g(a)f(a). At a=0 or a=1, loop endpoints make H=e for every b. These endpoint calculations are this reading’s checks of the displayed formula, not a quoted checker trace (p.130). The paper registers HopfHomotopy as continuous and, after strengthening to a topological group at the identity, as a homotopy from f bullet g to g bullet f. Proposition13 states those loops are homotopic; together with Propositions11/12 this proves commutativity of homotopy classes. The earlier continuity sentence is printed under a semitopological-group declaration; exact inherited Mizar type requirements cannot be audited from this PDF alone. The main theorem explicitly assumes a topological group (p.130). No worked numeric/group instance, experimental evaluation, proof-size/checking-time statistics or checker transcript is supplied. Evaluation is the formalized theorem/dependency presentation, with26references. No distributed protocol, Verus/Rust/TLA+ or LLM-agent writing/evaluation appears. Relevance is proof-library composition and checking explicit homotopy obligations, not a distributed-system verification result. Exact quotations preserve raw-extraction artifacts: in particular U+0016 represents a printed restriction symbol in quote6 and related formulas. Renderings were checked; no readable transcription is labeled verbatim extraction.
  • how much was read: most of it read
  • source
  • record id: kornilowicz-topalg7-fundamental-group-commutativity-2013-2013
• MITL BMC Timed Automata (2013)
  • title: Bounded Model Checking of an MITL Fragment for Timed Automata
  • what: Extends an MITL fragment to super-dense timed traces and translates a timed automaton plus formula into a symbolic transition system for SMT-based bounded model checking. The encoding handles untimed and timing-constrained until/release operators with auxiliary variables, fairness and non-Zeno constraints, and uses region abstraction to make bounded traces finite. Soundness and completeness are proved; an incremental Yices implementation is evaluated on Fischer mutual exclusion.
  • number: Experiments run on Intel Xeon X5650, 4 GB memory and 20-minute CPU limit using Yices 1.0.37
  • number: All plots report minimum, maximum and median over 11 executions
  • number: No timeouts occurred when finding a counterexample to the non-holding property; timed MITL checking was reported feasible
  • limits: The logic is MITL0,∞, a restricted fragment; completeness is for sufficiently large bounds and counterexample search. Experiments use two to 20 Fischer agents, 4 GB memory, 20-minute CPU limits, and 11 runs; untimed properties can favor LTL BMC, and timed-automaton region abstraction remains the scalability basis.
  • how much was read: most of it read
  • record id: mitl-bmc-timed-automata-2013
• modal dependence logic complexity (2013)
  • title: Model Checking for Modal Dependence Logic: An Approach Through Post’s Lattice
  • what: Classifies the model-checking complexity of modal dependence logic fragments with arbitrary classical Boolean connectives using Post’s lattice. The classification covers dependence atoms, box/diamond modalities, and Boolean clones, distinguishing tractable fragments from NP-, PNP[1]-, and PSPACE-complete cases. Defines team semantics for modal dependence logic with classical connective extensions, proves clone-based classifications, and shows a sharp role for modalities and XOR: box-only fragments are efficiently solvable, diamond introduces hardness, and XOR or simulation reaches PSPACE-completeness.
  • number: Polynomial-time fragments exist for box-only language (§1)
  • number: Some fragments are NP-complete or PNP[1]-complete (§1)
  • number: XOR-enabled fragments are PSPACE-complete (§1)
  • number: No empirical runtime benchmark reported
  • limits: The classification excludes non-classical dependence connectives such as splitjunction and intuitionistic implication. Results concern finite Kripke structures and formula fragments, not quantitative or probabilistic model checking. Complexity statements are worst-case and do not predict practical solver performance.
  • how much was read: most of it read
  • record id: modal-dependence-logic-complexity-2013
• Network partial model checking (2013)
  • title: Partial Model Checking Using Networks of Labelled Transition Systems and Boolean Equation Systems
  • what: Generalizes partial model checking from binary CCS-style composition to networks of labelled transition systems, represents quotient formulas as formula graphs, simplifies them with bisimulation/reduction and Boolean-equation solving, and supports an alternation-2 fairness operator. The network model subsumes m-among-n synchronization, synchronization interfaces, hiding, cutting and renaming. Quotienting is implemented as a synchronous product of a formula graph and one process; graph encoding/decoding preserves closed formulas, while simplification rules eliminate disjunction transitions, unguarded variables, double negations, fixpoint transitions and constant subformulas. For Pdl-∆ fairness, marked variables and A4cyc detect modality-free cycles containing marked variables in linear time. A Cadp prototype integrates Exp.Open, Evaluator, Reductor/Bcg Min and a 1,000-line solver extension. Two case studies compare against on-the-fly checking for TFTP/UDP and SCSI-2 bus arbitration, exposing both major memory savings and combinatorial blow-ups.
  • number: TFTP/UDP partial checking used up to 600 times less memory in reported examples
  • number: TFTP product sizes range from 1,963×10³ to 35,024×10³ states across scenarios
  • number: SCSI-2 configuration B with six disks: product LTS 708,174,559 states; partial checking 24,276 seconds and 16,239 MB versus on-the-fly 47,532 seconds and 39,236 MB
  • number: On the SCSI-2 three-disk configuration, on-the-fly took 1.12–1.67 s while partial checking took 19.16 s or 4 minutes depending on property truth
  • limits: The main efficient solver specialization targets alternation-free modal µ-calculus plus ∆R; arbitrary alternation depth would need a corresponding BES solver. Formula quotient order uses a heuristic and reductions can still explode, especially for existential regular-path formulas. Experiments use finite LTS models and Cadp on a 148-GB machine; results are case-study dependent and partial checking complements rather than dominates on-the-fly exploration.
  • how much was read: most of it read
  • record id: network-partial-model-checking-2013
• On the complexity of model checking interval-valued discrete time Markov chains (2013)
  • what: The paper closes or sharpens complexity gaps for model checking finite interval-valued DTMCs under two semantics. UMC chooses one admissible DTMC once and uses it forever; IMDP can choose an admissible probability distribution whenever a state is visited. For reachability, minimum and maximum probabilities coincide across the two semantics and the problem is P-complete. Full PCTL differs: IMDP model checking is P-complete, whereas UMC model checking is shown Square-Root-Sum-hard. For reachability, Proposition 1 maps every fixed admissible DTMC to a simple IMDP scheduler and conversely uses the standard existence of an optimal simple scheduler, proving equality of extrema. For the upper bound, the authors formulate reachability as an LP whose constraints range over vertices of each state’s interval-feasible probability polytope; there may be exponentially many such vertices. They invoke the ellipsoid method and construct a polynomial-time separation oracle: for a candidate vector, solve a compact LP at each state to find the minimizing feasible transition distribution; if a constraint is violated, a rational vertex of polynomial encoding size supplies a separating hyperplane. P-hardness is by reduction from ordinary MDP reachability, replacing an MDP action μ at s with an intermediate state (s,μ). For UMC PCTL, a reduction from Square-Root-Sum builds an IDTMC whose PCTL subformulas force three transition probabilities for each i to equal √x_i/q; a final next-state constraint tests whether Σ√x_i≤y. For IMDP PCTL, bottom-up PCTL labelling reduces until/until-like path formulas to optimal reachability; equality P=p is checked using whether p lies between the infimum and supremum. These are formal reductions/proofs rather than experimental algorithms.
  • number: previous reported bounds: UMC PCTL: NP- and coNP-hard and in PSPACE IMDP PCTL: P-hard and in coNP new bounds: reachability UMC: P-complete reachability IMDP: P-complete PCTL IMDP: P-complete PCTL UMC: Square-Root-Sum-hard square root sum context: paper states the problem is in PSPACE, has unknown membership even in NP, and had been placed in the 4-th level of the Counting Hierarchy reduction parameters: q = y + sum_i x_i; constructed PCTL constraints force selected probabilities to √x_i/q LP structure: polynomially many variables but potentially exponentially many vertex-indexed constraints; feasibility is handled by a polynomial-time separation oracle
  • limits: formal assumption: state spaces are finite and interval endpoints are rational numbers encoded as binary integer quotients semantic assumption: PCTL uses the paper’s traditional existential interpretation; under UMC, some D in the interval family must satisfy the formula, and under IMDP some scheduler must satisfy it author warning: UMC and IMDP agree on reachability but differ for full PCTL author warning: treating MDPs as one-player games with branching-time PCTL objectives would change the problem and, according to the cited work, imply undecidability limitation: Square-Root-Sum-hardness is not a complete complexity classification for UMC PCTL; it does not establish PSPACE-hardness or settle polynomial-time solvability; the introduction separately reports prior NP- and coNP-hardness limitation: polynomiality via the ellipsoid/separation-oracle argument is a worst-case complexity result; the paper reports no implementation or runtime experiment future-work limit: generalization to constraint Markov chains or robust MDPs is stated only as a belief and only at least partially for reachability scope note: supplied text and references were read; no code/artifacts or independent graphics inspection was performed
  • how much was read: most of it read
  • source
  • record id: on-the-complexity-of-2013
• Parametric schedulability of distributed real-time systems (2013)
  • title: Parametric Schedulability Analysis of Fixed Priority Real-Time Distributed Systems
  • what: Compares an analytic parametric schedulability method with model checking of parametric timed automata (PTAs) for fixed-priority distributed real-time pipelines on CPUs and CAN buses. The analytic extension represents schedulability as a disjunction of polyhedra over computation times, deadlines and jitters; the PTA approach uses IMITATOR’s Inverse Method and is necessary-and-sufficient for the modeled periodic system. The analytic method extends Seto/Bini sensitivity tests to preemptive processors, non-preemptive networks, precedence pipelines, unconstrained deadlines and jitters by enumerating scheduling-point vectors and linear inequalities. The PTA model explicitly encodes pipeline activation, preemptive/non-preemptive processors, deadline-failure states and parameter valuations; tiles returned by the Inverse Method have uniform discrete behavior. Two test cases compare RTSCAN, MAST holistic analysis and IMITATOR: PTA regions contain the sufficient regions from analytic/holistic methods because they explore all synchronous periodic traces, while MAST can outperform RTSCAN when offset-based interference reductions apply.
  • number: test case 1 execution: RTSCAN 0.27s, MAST 7.19s, IMITATOR 19m42s
  • number: test case 2a: RTSCAN 0.47s, MAST 40m13s, IMITATOR 4h; IMITATOR explored 257 regions
  • number: test case 2b: RTSCAN 1m47s, MAST 33m19s; current IMITATOR model unavailable
  • number: IMITATOR regions dominated RTSCAN/MAST in both modeled cases; MAST dominated RTSCAN in test case 2 due to offset-based analysis
  • limits: RTSCAN uses integer parameters and polyhedra; its guarantees are sufficient bounds and complexity increases with hyperperiod and unconstrained deadlines. IMITATOR’s current model supports only strictly periodic, zero-offset pipelines with end-to-end deadlines no larger than periods, and exhaustive region exploration is slow. MAST uses sampled parameter searches/slack computation and can miss exact regions or depend on step size. Scheduling support is preemptive fixed priority for CPUs and non-preemptive fixed priority for CAN networks; other protocols and multiprocessors are future work.
  • how much was read: most of it read
  • record id: parametric-schedulability-of-distributed-real-time-systems-2013
• PBD Aircraft EPS (2013)
  • title: Platform-Based Design Methodology and Modeling for Aircraft Electric Power Systems
  • what: Presents a platform-based design flow for aircraft electric power supervisory controllers, linking SysML requirements/state machines to Simulink hybrid models for exploration and verification. Separates function and architecture across refinement layers, supports optimization over library components, and demonstrates a prototype EPS control protocol.
  • number: aircraft electric power system
  • number: SysML requirements and structure diagrams
  • number: state-machine control model
  • number: Simulink hybrid model
  • limits: Prototype methodology and models are domain-specific; physical verification depends on Simulink/hybrid modeling and design-space assumptions.
  • how much was read: most of it read
  • record id: pbd-aircraft-eps-2013
• PIA Byzantine verification (2013)
  • title: Counter Attack on Byzantine Generals: Parameterized Model Checking of Fault-tolerant Distributed Algorithms
  • what: Introduces parametric interval abstraction and a new counter abstraction to reduce parameterized Byzantine distributed algorithms to finite-state model checking. Interval boundaries are arithmetic expressions over process/fault parameters; abstractions preserve enough threshold behavior to check safety and liveness variants of Srikanth–Toueg algorithms. The method is a semi-decision procedure with soundness/refinement techniques and evaluates Byzantine broadcast variants.
  • number: Finite-state reductions verify several algorithm variants
  • number: RBC specification also verified (details in source appendix)
  • number: No aggregate runtime table visible in supplied extraction
  • limits: Abstraction quality depends on a tailored abstract domain; failure to find a proof is inconclusive. Parameterized systems and Byzantine bounds are restricted to threshold-style algorithms; spurious transitions require refinement.
  • how much was read: most of it read
  • record id: pia-byzantine-verification-2013
• PRB-ATL (2013)
  • title: Model checking coalitional games in shortage resource scenarios
  • what: Studies Priced Resource-Bounded Alternating-time Temporal Logic (PRB-ATL), where resource prices and global availability are semantic model components, and proves tight complexity bounds for model checking. Complements an existing EXPTIME upper-bound algorithm with reductions from linearly bounded alternating Turing machines, proving EXPTIME-hardness even when selected parameters are fixed. It also derives EXPTIME-completeness for reachability and compares shortage-resource semantics with resource-producing variants that become undecidable.
  • number: Model checking PRB-ATL is EXPTIME-complete
  • number: EXPTIME-hard even with number of agents and resources constant
  • number: EXPTIME-hard even with number of agents and maximum resource amount constant
  • number: Reachability for PRB-ATL is EXPTIME-complete
  • limits: PRB-ATL preserves decidability by bounding resources and using prices tied to global availability; allowing resource production in related formalisms can make model checking undecidable. Complexity remains exponential under binary resource representations.
  • how much was read: most of it read
  • record id: prb-atl-2013
• PRISM-games SMG model checker (2013)
  • title: PRISM-games: A Model Checker for Stochastic Multi-Player Games
  • what: Introduces PRISM-games, an extension of PRISM for turn-based perfect-information stochastic multi-player games, with a guarded-command modelling language, rPATL probability/reward properties, quantitative and precise operators, and strategy synthesis, export, simulation and post-strategy verification. The paper defines the SMG module/player syntax and futures-market investor example, gives rPATL grammar combining ATL coalitions, PCTL probabilities and reward operators, and explains finite-memory deterministic/stochastic-update strategies plus strategy implementation as a product model. Model checking reduces a coalition query to a two-player stochastic game and solves equations by value iteration; reward type 0 needs a bound because optimal strategies may depend on accumulated reward, while precise operators use sup-inf/inf-sup and finite-memory stochastic updates. The table demonstrates explicit-engine scaling to millions of states across mdsm, cdmsn, investor and team-form models.
  • number: mdsm 7 players: 6,241,312 states and 19,678,246 transitions
  • number: investor vmax=200: 2,931,643 states and 9,688,354 transitions
  • number: team-form 5 players: 2,366,305 states
  • number: 2.8 GHz PC, 32 GB RAM
  • limits: Models are finite-state turn-based games in which exactly one player owns all enabled probabilistic transitions per state; concurrent actions, partial information and general concurrent games are unsupported. Strategies are restricted to memoryless deterministic, finite-memory deterministic or finite-memory stochastic-update forms. Value iteration and explicit Java data structures are used; a BDD engine is only under development. Precise operators apply to stopping games where terminal states are reached almost surely under every strategy pair, and reward semantics require chosen handling of unreached targets (0, infinity or cumulative).
  • how much was read: most of it read
  • record id: prism-games-smg-model-checker-2013
• PSyHCoS: Parameter Synthesis for Hierarchical Concurrent Real-Time Systems (2013)
  • what: Presents a C#/.NET toolkit for timing-parameter synthesis and model checking of hierarchical concurrent systems specified in Parametric Stateful Timed CSP (PSTCSP). The inverse method starts from a reference parameter valuation and synthesizes a convex region with the same time-abstract action behavior. Evaluates full reachability, inverse synthesis and equivalent-state reductions on eight timing examples; Fischer mutual exclusion yields Delta<Epsilon from reference (3,4). The reference-valuation contract preserves time-abstract linear-time behavior, rather than finding all safe valuations or proving all timed properties. PSTCSP creates clocks implicitly as execution proceeds, supports nested processes and shared/programmatic data, and stores states as process/constraint identifiers. The paper exposes nontermination and memory limits, overhead of equivalent-state merging, and confounds in cross-tool comparisons caused by manual translation. Complete table includes negative performance cases as well as a Fischer instance enabled by reduction.
  • limits: PSTCSP is a process algebra with shared variables, data structures, user-defined programs, several choice/concurrency constructs and timing operators Wait[d], timeout[d], within[d], deadline[d]. Parameters are unknown constants representing timing delays, not the number of processes. The displayed Fischer model fixes N=3; benchmark Fischer4/5/6 separately fix those process counts. No theorem quantifies correctness over arbitrary N. Clocks are implicit and dynamically introduced, unlike an explicitly fixed timed-automaton clock set. Footnote 1 identifies PSTCSP with parametric closed timed epsilon-automata; expressiveness is stated incomparable with parametric timed automata. Formal semantics, inverse-method soundness, undecidability and equivalent-state reduction are imported from [3]/[4], not reproved in this six-page tool paper. IM takes a model and reference valuation pi and returns a convex constraint K guaranteeing the same time-abstract sequences of actions as pi. A known correct reference transfers the relevant linear-time properties to all valuations in K. Synthesis itself is not a test that the reference is correct, not necessarily a maximal safe region, and not a guarantee that all safe parameter choices are found. Clock-sensitive or bounded-time specifications require their own semantic encoding; equal untimed action traces alone do not establish identical event times. Parameter synthesis is undecidable; authors deliberately constructed examples where IM fails to terminate. They report termination on their practical cases, not on all models. Full parametric reachability can have an infinite reachable state set even where IM terminates. A finite evaluation timeout or memory-out does not establish mathematical nontermination, and the table itself marks M.O. rather than an infinite-time execution proof. Fischer model uses shared turn (initial Idle=-1) and counter (initial zero), with two parameters Delta and Epsilon. Processes read Idle, update turn within Delta, wait Epsilon, and enter iff turn still equals their ID. Entry increments counter, exit decrements it and resets turn. Reference Delta=3,Epsilon=4 gives Delta<Epsilon, which authors call the weakest known mutual-exclusion constraint. The record preserves that as their model-specific claim, not a proof of necessity for every Fischer variant. The toolkit reports LTL, deadlock and refinement checking, simulation/trace playback and full state graph generation. It also permits C# functions/data in models. The paper supplies no machine-checked implementation proof, proof-producing interface or verified semantics for arbitrary host functions. Correctness of tool implementation, parsing, polyhedral operations, host code and input model remains outside the article’s demonstrated formal guarantees. Implementation uses C#/.NET and Parma Polyhedra Library for constraints. Architecture has separate parser, internal representation, algorithms, simulator and GUI. Each semantic rule and algorithm is a separate class; authors propose reusing algorithms on labeled transition systems. Internal states pair string-coded process and constraint IDs. A string equality test is reported for constraint identity; exact normalization/interning correctness and cost are not specified here. Optimized reachAll+ and IM+ merge equivalent PSTCSP states. The technique can reduce state counts exponentially in the best case but requires costly operations. Both original and optimized variants are exposed to users. The article does not provide a new proof of equivalence preservation or a formal refinement relation to deployed concurrent-system code. Table 1 contains eight fixed examples: Bridge (four persons/17 time units), Fischer4/5/6, Jobshop scheduling, railway control RCS5/6, and TrAHV train. It reports parameters, state/transition counts, maximum clocks and seconds. IM groups omit transition counts. State counts with k are rounded; M.O. denotes memory-out in context, not an unsafe answer. Full numeric rows are stored separately in benchmark_table. Environment is Windows XP 32-bit, Intel Quad Core 2.4 GHz, 4 GB memory. No tool/compiler/PPL versions, run repetitions, variability, CPU utilization, exact memory peaks or common time limit are stated. Model sizes and chosen reference valuations depend on each benchmark; references for non-Fischer cases are standard valuations, and Fischer uses values satisfying known good-behavior constraints. IM+ can help sharply: Fischer5 states 133k→13k and seconds1176→84.5; Fischer6 IM is M.O. while IM+ reaches86k states in1144s. It also costs time: Bridge253→455s with identical2.8k states; RCS5 7.83→16.7s with identical5.6k states. These measured cases do not prove general speedup or guaranteed termination. Reader table check: the prose says state reduction makes IM+ faster whenever it reduces states, yet Jobshop has1112→877 states and17.1→22.8s. Also the stated up-to80% slowdown for Bridge is not the largest table slowdown: RCS5 has about113% overhead. These are discrepancies in the performance summary, not counterexamples to the inverse method’s correctness. The article reports deadlock checking when full reachability terminates and identifies Jobshop’s terminal deadlock as expected because every task runs once. A completed acyclic schedule is a counterexample to a naive deadlock-free requirement, not necessarily a scheduling failure. Exact checked LTL formulas and full per-model verification outputs are not tabulated. Authors say a synthesized True region for railway models allows timing constructs to be removed and claim this for all parameter valuations. The formal abstraction/refinement argument and full parameter-domain restrictions are not presented here. Record this as an author application claim; it does not by itself prove real-world railway safety or eliminate implementation timing requirements. IMITATOR comparison used the same hardware under Ubuntu11.10 64-bit, unlike the Windows32-bit main table. Authors explicitly call comparison inaccurate due to manual PSTCSP/PTA translation: each tool favors native models. IMITATOR Jobshop8.96s andTrAHV0.097s are reported; Fischer translations fail to terminate, Bridge/RCS are too large for manual translation. No fair overall cross-tool ranking follows; automated efficient translation remains future work. Sources, binaries, manual and models were linked at the historical PSyHCoS page http://lipn.univ-paris13.fr/~andre/software/PSyHCoS/. This reading used the saved paper only and did not fetch or run the artifact or import cited proofs. No verified Rust, Verus, TLA+, LLM-agent result or deployment-level distributed implementation is supplied.
  • how much was read: most of it read
  • source
  • record id: psyhcos-parameter-synthesis-for-2013
• quantum Markov chain QCTL checking (2013)
  • title: Model checking quantum Markov chains
  • what: Introduces quantum Markov chains whose transitions carry super-operators while locations remain classical, defines a quantum extension of PCTL (QCTL), and develops a model-checking algorithm using super-operator-valued measures on infinite paths. Uses Kluvanek’s vector-measure extension theorem to define path-event measures, adapts classical PCTL algorithms, proves polynomial dependence on formula size, state count, and Hilbert-space dimension, and demonstrates checks on a quantum loop and BB84 protocol. The model supports quantum operations without enumerating the continuum of quantum states.
  • number: QCTL model checking is linear in formula size and polynomial in n and Hilbert dimension d (§5.1)
  • number: Worked loop and BB84 examples demonstrate correctness (§6)
  • number: No empirical runtime benchmark reported
  • limits: Atomic propositions are classical location predicates; the presented examples reason about event probabilities rather than directly about quantum states. BB84 is checked under an ideal no-noise assumption. State-space finiteness comes from classical locations, while super-operator calculations and dimension affect complexity.
  • how much was read: most of it read
  • record id: quantum-markov-chain-qctl-checking-2013
• Quilbeuf-Igna-Bytschkow-Ruess security policies (2013)
  • title: Security policies for distributed systems
  • what: Models asynchronous message-passing processes as distributed machines, defines intransitive security policies with Boolean local filter functions, and proves global compliance from local unwinding and filter-respect conditions. The implicit policy allows flow along message paths while prohibiting direct unsupported flow; filter functions inspect only source-local histories and define a purge of invisible actions. Proposition 1 proves every distributed machine complies with its implicit policy. Theorem 1 extends unwinding to filtered policies: output consistency, step consistency, local respect, and local filter respect imply compliance. A prosumer smart-grid filter exposes only aggregate excess, and Uppaal CTL checks the trusted SMG automaton.
  • number: 100-prosumer configuration <1 second
  • number: n=2 privacy caveat
  • number: Uppaal 4.1.14
  • number: 8GB MacBook Pro
  • limits: Processes are independent, communicate asynchronously through uniquely-sourced messages and FIFO-like per-process buffers; process observations are local state plus input buffer and messages contain complete sent/received history. Filter functions are Boolean and source-local. Smart-grid model is simplified, static, and excludes cryptographic/timing details; authors note n=2 aggregate can reveal another prosumer and future work on dynamic policies.
  • how much was read: most of it read
  • record id: quilbeuf-igna-bytschkow-ruess-security-policies-2013
• RG/RPG parallel CTL checking (2013)
  • title: An Experiment on Parallel Model Checking of a CTL Fragment
  • what: Designs parallel shared-memory local/on-the-fly model checking for a CTL fragment (EU, AU, leadsto and derived reachability/safety/liveness formulas), built on a lock-free localization-table state-space generator. RG stores reverse transitions; space-efficient RPG stores a reverse parental spanning tree and recomputes successors, reducing space from O(S+R) to O(S) at higher worst-case time.
  • number: Sun Fire x4600 M2, 8 dual-core Opteron processors, 208 GB RAM, Solaris 10. RPG generally uses 2–4× less memory than DiVinE map/owcty for valid formulas; Peg Solitaire 37 uses 15 GB RPG versus 240 GB estimated RG. RPG can lose up to about 5× execution time on complete backward traversals; RG often has best time.
  • limits: Shared-memory systems with atomic compare-and-swap; models expose successor generation and state equality. Logic restricts state subformulas to atomic propositions and disallows nesting. RPG may recompute transitions repeatedly (O(S·(R−S)), worst-case O(S^3)); backward cycle detection means AU/leadsto are not fully on-the-fly.
  • how much was read: most of it read
  • source
  • record id: rg-rpg-parallel-ctl-checking-2013
• Sbaï Escheikh WSN encryption SPIN (2013)
  • title: Model Checking Techniques for Verification of an Encryption Scheme for Wireless Sensor Networks
  • what: Presents a framework that models a hierarchical wireless-sensor-network encryption transmission as a Petri net, translates the net to Promela, and checks LTL correctness properties with SPIN. The example combines elliptic-curve encryption/decryption, LDPC encoding/decoding, modulation, fading/noise, and channel-parameter restoration. The paper gives a concrete Petri-net-to-Promela encoding: place and transition markings are integer arrays, firing macros atomically remove input tokens, add output tokens, and increment transition counts, and a BNF skeleton generates one init process with a do-loop of atomic firings. It explains SPIN never-claim generation from negated LTL, then defines deadlock-freeness as eventual firing of every transition and safeness as always keeping every place at ≤1 token. The communication model has 25 places and 14 transitions, including elliptic-curve/LDPC operations and a noisy fading channel. SPIN reports zero errors for the modeled liveness and safeness checks; the authors identify integrity/security properties as future work.
  • number: 25 Petri-net places (P0–P24)
  • number: 14 transitions (T0–T13)
  • number: deadlock-freeness property ♦live
  • number: safeness property □safe
  • limits: Petri-net behavior is discrete and the Promela process serializes each firing atomically; real-time behavior, probabilistic channel noise, cryptographic semantics, resource limits, and large-scale WSN topology are abstracted. The study verifies one encryption transmission model and two structural properties, not cryptographic confidentiality or integrity. The paper reports no runtime/state-space size or independent implementation comparison, and future security properties are not yet modeled.
  • how much was read: most of it read
  • record id: sbai-escheikh-wsn-encryption-spin-2013
• Towards Modeling and Model Checking Fault-Tolerant Distributed Algorithms. (2013)
  • what: Models threshold-guarded fault-tolerant distributed algorithms in extended Promela, replacing explicit message channels by sent/received message counters for efficient fixed-size SPIN verification. Separates receive/compute/send within one atomic process step. Correct processes broadcast each message type at most once; sender identities are abstracted into counts. Byzantine/symmetric process effects become bounded nondeterministic increments, while omission/crash processes are explicitly modeled with weaker fairness. Status variables encode control flow, parameter constraints encode resilience, and quantified atomic propositions are expanded for fixed process counts. Includes full broadcast encoding and appendix fragments for symmetric, omission, crash, folklore broadcast and condition-based consensus.
  • number: 8 GB encoding comparison; channels exhaust at n=6, counters at n=9
  • number: Byzantine n=7,t=2,f=2 relay: 6.3 s,77 MB,290,000 stored states
  • number: folklore n=6 property F:1690 s,1819 MB
  • number: Paxos-like target would need at least 14 processes to tolerate one fault, remains future work
  • limits: Assumes processes can distinguish senders; Byzantine senders cannot forge others’ messages. Asynchronous fairness requires each correct process to run infinitely and sent messages to eventually arrive. Counter encoding relies on uniform sender treatment, finitely many message types, all-to-all sends and at most one send per type/run. This paper verifies fixed parameter instances; parameterized proofs and Paxos-like algorithms are separate/future work. Small counterexamples check adequacy of the encoding but do not establish full refinement equivalence. Source is the 21-page SPIN 2013 submission including appendices, not the publisher final layout; graphs were not separately inspected.
  • how much was read: most of it read
  • source
  • record id: towards-modeling-and-model-2013
• Complete symmetry reduction in safety verification (2012)
  • title: A Complete Method for Symmetry Reduction in Safety Verification
  • what: Introduces a complete symmetry-reduction method for safety verification of finite, parametrically defined multi-process systems without precomputed global symmetry. It defines weak symmetry relative to the safety property, learns state interpolants backward over the interleaving tree, transforms interpolants by process permutations, and prunes states whose symmetric future is covered. The DFS algorithm handles cycles with fixpoint interpolation. Weak symmetry compares program-counter tuples, safety truth under a permutation, and bijective matching of enabled/scheduled transitions while deliberately ignoring shared-variable values; strong symmetry additionally requires full state equality. The algorithm memoizes interpolants per program point, recursively conjoins weakest-precondition approximations for enabled and disabled transitions, detects cycles and computes path-invariant fixpoints, then prunes if a permuted memoized interpolant holds. Theorem 1 proves pruning sound; Theorem 2 proves completeness with respect to weak symmetry when precondition computation is monotonic and symmetry preserving. Examples show pruning despite differing sums and process IDs.
  • number: 3.2 GHz processor, 2 GB memory, 5-minute timeout
  • number: Dining philosophers 11: 159,738 visited, 137,609 subsumed, 226.86 s
  • number: reader-writer 8 readers/4 writers: CSR 3.23 s vs lazy 81,969 s
  • number: sum-of-ids 100 processes: 5,052 visited, 4,950 subsumed, 22.09 s
  • limits: The core termination argument assumes finite domains for program variables and a fixed finite number of processes; infinite-domain loops require abstraction (the Bakery example uses pairwise inequalities). Correctness requires safety properties symmetric under the chosen permutation, and precondition computation must be both symmetry preserving and monotonic; weakest preconditions are expensive and practical approximations may not always satisfy these properties. The method targets safety, not arbitrary CTL*/liveness, and explores interleavings via DFS with memoized formulas.
  • how much was read: most of it read
  • record id: complete-symmetry-reduction-in-safety-verification-2012
• CSolve: Verifying C with Liquid Types (2012)
  • what: C memory-safety verifier combining physical heap-layout/pointer types with SMT-checked liquid refinement types. Infers predicates from a user/library qualifier vocabulary, generating subtyping constraints and solving them by predicate-abstraction fixed point. Demonstrates bounded string manipulation and recursive list-field invariants. Separates layout inference from bounds inference, explains modular checking of annotated library functions versus caller-driven inference, and tracks potential aliasing through named location parameters. Recursive list type ties each node’s string capacity to its length field using @offset expressions, allowing unbounded list contents to carry dependent bounds without individual-node enumeration.
  • limits: §2: CIL frontend and SSA simplify mutable locals; physical types checked before unknown refinement variables/subtyping constraints are generated. Fixed-point solver uses Z3. This paper describes the architecture, not a new full soundness proof or independently checked compiler/solver implementation. §§1/2/3: refinement candidates are conjunctions of instantiated logical qualifiers from a supplied file plus standard library. Low annotation burden is the authors’ claim, conditional on adequate qualifiers/specifications; not annotation-free arbitrary invariant discovery. No completeness or success guarantee beyond this hypothesis space is shown. §3: CHECK_TYPE checks a function against its declared augmented type rather than inferring contract solely from uses. extern types are assumed for omitted bodies. A verified caller depends on those contracts and trusted malloc/library models; body omission is not proof of an external implementation. §3 pp.748–749: example relies on a malloc type yielding a non-NULL 12-byte allocated region, with no NULL check in printed caller. This is allocation-success/library-specification scope, not demonstrated handling of ISO C malloc failure. 12-byte structure and offsets 0/4/8 assume illustrated four-byte field/pointer layout; not a portable arbitrary-ABI theorem. §3: SAFE(p)=p>0 ∧ BS(p)≤p<BE(p); SIZE_GE(n) requires BE(p)−p≥n. STRINGPTR combines array shape with this pointer safety, not a proved zero-terminated string predicate. strntolower explicitly bounds accesses using n and short-circuit evaluation, so actual zero termination is not needed for the demonstrated bounds reasoning. §3: default nonaliasing assumption for separate function pointer arguments/returns is checked against bodies, and LOC/INST annotations describe may-alias sets. They permit possible aliases, not Rust-style unique ownership or proof that every member is the identical object. An omitted extern body’s stated alias contract remains assumed. §3: demonstration proves described access/type safety under the source model and contracts. It does not establish CSV parser functional correctness, list acyclicity, termination, leak freedom, deallocation/lifetime correctness or all ISO C undefined-behavior obligations. tolower is modeled as returning arbitrary char; text does not verify its standard argument-domain requirement. §3 p.749: full surrounding input routine omitted. The paper explicitly assumes inferred line/len types at call site before demonstrating propagated constraints. Do not claim an independently shown end-to-end verified input-reading implementation. §2: failed type checking may indicate physical/refinement type inability, with unsolved constraints; this is not a guaranteed concrete bug/counterexample. Multi-file makefile/drop-in GCC compatibility is a tool-interface claim, not proof of support for every GCC extension or arbitrary C program. Entire paper: no benchmark collection, timing, annotation counts, failure rates, hardware, solver-version details or comparative evaluation. No source artifact was run here. Detailed low-level liquid type theory is in cited POPL2010 work, not reproduced or counted as read.
  • how much was read: most of it read
  • record id: csolve-verifying-c-with-2012
• Dialog Model Checking Fault-Tolerant Algorithms (2012)
  • title: Starting a Dialog between Model Checking and Fault-tolerant Distributed Algorithms?
  • what: Introduces a parameterized modeling framework for threshold-guarded fault-tolerant message-passing algorithms. Processes are extended control-flow automata with symbolic parameters, threshold guards, asynchronous interleavings, message buffers and faulty-process nondeterminism; instances become Kripke structures checked in LTL without next. The paper makes the formalization problem explicit (pseudocode semantics and hidden environmental assumptions), defines parameterized process skeletons and CFA operational semantics, and translates a family of broadcast algorithms under Byzantine, symmetric, omission and crash faults. Spin/Promela experiments systematically vary resilience and specifications: expected resilience boundaries are recovered, and impossible configurations produce violations.
  • number: Byzantine n>3t; symmetric/omission n>2t; clean crash n>t
  • number: valid cases Spin-verified; n=7,t=3 Byzantine relay specification violates as expected
  • number: n=5 omission with three faulty processes violates C and R
  • number: n=11 experiments exhaust memory
  • limits: Experiments are bounded finite instances and do not establish parameterized correctness; n=11 runs out of memory. The framework initially targets asynchronous threshold algorithms, with partial synchrony and round models left for future work. Correctness depends on explicit resilience, delay, fault and scheduling assumptions.
  • how much was read: most of it read
  • record id: dialog-model-checking-fault-tolerant-algorithms-2012
• ESST (2012)
  • title: Software Model Checking with Explicit Scheduler and Symbolic Threads
  • what: Presents ESST, which models each cooperative thread as a separate symbolic program and executes the scheduler explicitly, preserving scheduler semantics while avoiding inefficient sequentialization. Lazy predicate abstraction checks thread transitions; partial-order reduction (POR) filters scheduler explorations. Correctness theorems relate ESST executions and abstract reachability; persistent-set and sleep-set POR reduce equivalent interleavings. Evaluation compares ESST to SatAbs/CpaChecker and CBMC on FairThreads, gearbox and token-ring benchmarks, including unsafe cases where bounded CBMC misses bugs.
  • number: Linux Intel Xeon 3GHz, 4GB RAM, 1000s/4GB limits
  • number: ESST outperforms sequentialized predicate abstraction; POR enables additional solves
  • number: CBMC loop unwind bound 5; incorrectly reported some unsafe token-ring bugs safe
  • number: POR best with persistent and sleep sets together; abstract states reduced
  • limits: Targets cooperative non-preemptive threads that yield explicitly; scheduler is modeled directly and programs must fit the ESST framework. Predicate abstraction may be expensive; POR can omit scheduler states for unsafe benchmarks and requires careful provisos. CBMC results are bounded by unwind depth.
  • how much was read: most of it read
  • record id: esst-2012
• exact MDP probabilities from schedulers (2012)
  • title: Efficient computation of exact solutions for quantitative model checking
  • what: Presents a method that converts an approximate scheduler from finite-precision MDP model checking into a starting LP basis, then solves the quantitative result exactly with rational arithmetic. If the scheduler is suboptimal, simplex still converges to the exact worst-case probability. Proves scheduler/basis correspondence for undiscounted MDPs after standard preprocessing, implements the method in PRISM with arbitrary-precision GLPK, and evaluates WLAN, consensus, and FireWire models. Exact numerators and denominators are produced while reusing value iteration’s candidate policy.
  • number: Method outperformed naive exact LP in all reported cases; Consensus (3,5) took less than one-sixth of dual-simplex default-basis time (§4)
  • number: Experiments reached models with up to 80,000 states (§4)
  • number: FireWire 400 exact denominator required 65 bits (§4)
  • number: Implementation-specific code was under 300 lines (§4)
  • limits: Input MDP coefficients are rational and the scheduler must satisfy the stated correspondence conditions. Exact simplex complexity is not established and can be expensive; the method relies on preprocessing and LP solver behavior. Experiments use finite models and a specific PRISM/GLPK implementation.
  • how much was read: most of it read
  • record id: exact-mdp-probabilities-from-schedulers-2012
• Hernandez localised security policies (2012)
  • title: Globally reasoning about localised security policies in distributed systems
  • what: Defines AspectKBL, a process-algebra language for distributed networks with security policies attached to locations, Belnap four-valued policy composition, labelled-transition semantics, and ACTL-like global safety obligations. It proposes checking each syntactic action directly instead of constructing the full LTS, yielding a safe over-approximation for finite systems. AspectKBL models parallel locations, tuple data, out/in/read actions, nondeterministic choice, and replicated processes; local aspects have pointcuts, applicability conditions, and four-valued recommendations. Policy-guarded transitions induce a pruned LTS. ACTLv obligations quantify over all paths and transitions matching a cut, checking predicates before/after interactions. The alternative checker unifies each action with an obligation cut, identifies source/target policies, collects recommendations as constraints, and certifies an action if policies deny it or their constraints imply the obligation predicate. It forbids replication to guarantee finite paths and avoid undecidable general model checking. Healthcare role/private-note examples and third-party-cookie models show both unsafe and policy-protected behavior. An Appendix gives a partial Haskell prototype; constraint solving, parser support, and a correctness proof remain incomplete.
  • number: 4 Belnap values: bottom, true, false, top
  • number: 2 extended case studies
  • number: 3 healthcare process variants
  • number: ACTLv safety obligations over all paths
  • limits: Soundness is claimed as a goal but not proved in the report. The finite-network restriction excludes replication; obligation cuts require constant target locations; direct action inspection may over-approximate impossible paths and return inconclusive false. Current tool handles only simple constraints by substitutions, lacks a parser and complete constraint solver, and uses a conservative liberal Belnap combination. The language is Turing-complete without restrictions, global logic covers safety rather than liveness, and examples are small abstractions.
  • how much was read: most of it read
  • record id: hernandez-localised-security-policies-2012
• Interactive verification of Markov chains: Two distributed protocol case studies (2012)
  • what: # Interactive verification of Markov chains: Two distributed protocol case studies (authored by agents unless marked 🧑) Johannes Hölzl and Tobias Nipkow, QFM 2012, EPTCS 103, pp.17–31, DOI 10.4204/EPTCS.103.2; arXiv:1212.3870v1, submitted 17 December 2012. This record covers all 15 PDF pages, §§1–6, acknowledgment, all 23 references and all 4 figures. The local PDF and freshly fetched official PDF are byte-identical. Exact excerpts, source lines, character offsets and PDF/printed pages are in quotes.json; Q-numbers below refer there. The AFP 2012 release and the current AFP source snapshot are distinct supporting artifacts, inspected statically in the ranges recorded in source-scope.json. No Isabelle, author code, model checker or solver was run. ## What is established The contribution is a parameterized mathematical verification of two finite-state discrete-time, time-homogeneous Markov-chain models in Isabelle/HOL. It proves formulas for ZeroConf address-collision probability, almost-sure termination and expected allocation cost, and for Crowds endpoint independence, exposure to collaborators, conditional predecessor identification and an information-leakage upper bound. “It can deal with infinite-state systems, although this paper considers only parameterized finite-state systems” (§1, p.17, Q1) is the scope to retain. Infinite path spaces still require measure theory. This is a proof about abstract global models, with formalization effort reported by the authors; it is not an implementation benchmark. Several discrepancies constrain use of the printed results. The ZeroConf example’s named parameters do not satisfy its printed 10^-13 bound; its displayed cost formula has parentheses inconsistent with the model and retained source. The Crowds §4.2 independence display uses last-ncoll where its heading and definitions concern last-jondo. Finally, the retained information-flow theorem has an additional uniform-initiation hypothesis absent from the paper’s displayed theorem. These are separate issues, documented below rather than silently repaired. ## Probability foundation and proof method (§2, pp.18–20) The chain has a nonempty finite state set S and nonnegative transition weights whose row sums are 1 (Q4). Its path probability is constructed on all infinite state sequences from arbitrary product spaces, avoiding an encoding into infinite boolean choices (Q5). A specified start state precedes the measured sequence: the first measured index represents a transition from that start. Individual sequence elements need not satisfy the transition relation by the definition of path alone; the probability measure provides the operational meaning (Q4). Conditional probability is a quotient; AE means probability 1 (Q3). The reusable tools are one-step equations for event probability, integrals and almost-everywhere predicates (Q6), qualitative reachability over nonzero transition edges and an until operator (Q7), and a theorem that almost every path is state fair (Q8). In the finite chain, if all states reachable before the target remain inside the allowed region or target, and every such non-target state can still reach the target, until holds almost surely (Q8). This is a theorem about the chain’s measure, not an extra fairness assumption on an adversarial scheduler. The model has no nondeterministic scheduler. The hitting-time and accumulated nonnegative-reward definitions support expected termination cost (Q9). LEAST is total but underspecified if no witness exists: “If there is no such n, then the term has some arbitrary (defined!) value” (§2.1, p.18, Q2). Almost-sure termination and reachability lemmas make the meaningful cases explicit. Finiteness of expected hitting time uses the finite-state setting; it should not be generalized to arbitrary infinite chains. Likewise, the §3.4 prose that finiteness almost everywhere suffices for a finite integral is too broad in isolation. Here the finite chain, finite transition rewards and finite expected hitting time supply the needed integrability argument; the historical source explicitly invokes positive_integral_reward_until_finite before solving the cost equations (historical Zeroconf_Analysis.thy:187–196). ## ZeroConf: model, result and concrete case (§3, pp.21–25) The protocol allocates an unused IPv4 link-local address from 169.254.1.0 through 169.254.254.255, a pool of 65024 addresses. A new host chooses uniformly and probes using ARP. The probability q denotes choosing an occupied address; p denotes loss of the request/response exchange (Q10–Q11). This abstracts one allocation against a fixed occupancy/loss environment. Independent repeated choices and constant transition probabilities are encoded in the Markov model; changing occupancy, concurrent allocation races and correlated/history-dependent losses are not additional modeled transitions. Other cited PRISM/timed models contain more protocol features than this selected model (Q10). The explicit assumptions are N∈Nat, 0<p<1, 0<q<1 and nonnegative real r,E (Q13). Thus zero loss, zero occupied addresses and endpoints 1 are outside the stated theorem context, even if limits can be considered separately. There are N+4 valid states: Start, Ok, Error and Probe 0…ProbeN. Ok and Error absorb. From Start, an unused choice reaches Ok with cost r(N+1); an occupied choice reaches Probe 0 with cost r. A successful probe response returns to Start with cost 0. A failed probe advances with probability p and cost r, or at ProbeN reaches Error with cost E (Fig.1, Q12,Q14). E is the repair penalty, not merely packet latency. The graph and formula use N+1 total probes; the prose step 5 says “N requests” (Q11), so N=2 means 3 probes as the numerical example and graph explicitly state. The event is reaching Error, not proving collision impossible: P_err(s)=Pr_s(until S {Error}) (Q15). With p,q strictly positive, its derived Start probability is positive. The proof first establishes P_err(Error)=1 and P_err(Ok)=0, then the one-step recurrence. An unrestricted recurrence is unsuitable as an automatic rewrite because it loops: “using it would result in non-termination of the rewrite engine” (§3.3, p.24, Q16). State-specific rules and induction over the remaining probes yield P_err(Start) = q p^(N+1) / [1−q(1−p^(N+1))]. The printed induction skeleton and theorem are retained in Q17; the historical source gives the same general formula (Q38). Most ZeroConf steps use rewriting, with induction and two rewrite steps for the probe recurrence (Q16–Q17). This is concrete evidence about proof organization rather than an assertion that theorem proving was automatic end to end. The paper names 16 hosts, q=16/65024, p=.01 and N=2, then prints “Perr Start ≤ 1/1013” in extracted text, visually 10^-13 (Q18; PDF8/printed 24). Reader arithmetic with exact rational numbers gives 1/4063000001≈2.46123554×10^-10. It therefore satisfies neither 10^-13 nor 10^-12. This is an arithmetic inconsistency in the stated example, not a protocol execution or a failed prover replay. Both inspected AFP versions instantiate locale arguments in order N,p,q,r,E/e as 2 "16 / 65024 :: real" "0.01" "0.002" "3600" and state a 10^-12 bound (historical Q36,Q40; current Q46,Q48). That assigns p=16/65024 and q=.01, reversing the paper’s named meanings. Under that assignment the same formula gives 1/6645020000257≈1.50488637×10^-13, which does satisfy the retained 10^-12 claim, but exceeds 10^-13. Thus the retained proof text concerns a different concrete parameterization; it does not validate the numerical sentence as printed. The static source inspection establishes these statements and supplied proof scripts, without certifying that a historical checker run used precisely these downloaded bytes. For expected cost, C_fin integrates transition rewards until Error or Ok. The chain reaches one of them almost surely (Q19,Q21). The model-consistent formula, also present in the historical and current source (Q39,Q47), is C_fin(Start) = [q(r+p^(N+1)E+rp(1−p^N)/(1−p)) + (1−q)r(N+1)] / [1−q+qp^(N+1)]. The paper instead prints the successful-allocation term (1−q)*(r*N+1) (Q21, PDF9/printed 25); the model defines r*(N+1) (Q14). With the paper’s named parameters, r=.002 s and E=3600 s, the correct formula gives≈.006001383 s, consistent with the reported≤.007 s; the printed parentheses give≈1.004001383 s. With the retained swapped p,q values, the correct cost is≈.006020208 s and also≤.007 s. The 7 ms result is a symbolic expected rewarded-model bound under selected input parameters, not a measured latency, worst-case deadline or successful-allocation-only expectation. Both Error and Ok terminate the cost accumulation, and the error penalty is included. ## Crowds: model and anonymity claims (§4, pp.25–29) Crowds establishes routes by choosing a uniformly random next participant and deciding whether to forward again with probability p_f. Routes can revisit participants; Fig.2 uses J1−J4−J2−J7−J4−C1−S, while Fig.4 illustrates a different route J1−J4−J3−J5−J4−C1−S (Q20,Q25). Neither is a test trace generated by this reader. Fig.3 is a 3-participant transition-graph illustration, not the size limit for the theorem (Q23). Let J be the number of jondos and H the number of honest/non-collaborating jondos. The set is finite and nonempty, collaborators form a nonempty strict subset, 0<p_f<1, and init is a nonnegative distribution with total 1 and zero mass on collaborators (Q24). The model states are Start, Init i for honest i, Mix j for all j and End: H+J+2 states. From Start the init distribution chooses the initiator. An Init state moves uniformly to a Mix participant; from Mix the next Mix identity has probability p_f/J, or the route ends with probability 1−p_f. End absorbs (Q26). Participants can select themselves, and collaborators follow these transitions: active route manipulation, arbitrary topology, timing observations and multiple correlated runs are outside this model. The paper is explicit about the abstraction boundary: “We could model the individual behaviour of jondos in Isabelle/HOL and show that this induces our Markov chain model, but this is not in the scope of this paper” (§4, p.25, Q22). Hence these results do not constitute refinement from distributed node implementations, or whole-protocol anonymity against all observations. The starting state is excluded from the measured path; Init is at index 0. The displayed len value is the last zero-based Mix index, so a terminating path has len+1 Mix states. The paper’s wording calls len the number of Mix states, but its formula and i≤len lemmas count len+1 (Q27; historical Q42). The intended §4.2 claim is that the final server-contacting participant is independent of the initiator, under the specified uniform routing. The displayed lemma instead contains last-ncoll, defined in the next subsection as the predecessor of the first collaborator, rather than last-jondo (Q28 versus Q27,Q29). Preserve this symbol discrepancy. The current AFP server_view_indep proves factorization of initiating and final-participant sets (Q49); the historical source has a server_view theorem equating the chance that final participant equals initiator to the reciprocal of the participant count; the historical source names that reciprocal J=1/card jondos (Q43; historical Crowds_Protocol.thy:97–98; Q45). The historical notation differs from the paper’s J=count notation. Independence gives no additional identity information from this modeled endpoint observation; it does not remove a nonuniform prior or give the server “no chance” of guessing in an absolute sense. For collaborator exposure, hit-colls means at least one Mix participant is a collaborator, and last-ncoll denotes the participant immediately before the first such collaborator. Conditional identification is meaningful because the nonempty collaborator set makes the hit probability positive. The paper proves (Q29–Q31): - Pr(hit-colls) = (1−H/J)/(1−(H/J)p_f) - Pr(first=i and last-ncoll=l | hit-colls) = init(i)[p_f/J + indicator(i=l)(1−(H/J)p_f)], for honest i,l - Pr(first=last-ncoll | hit-colls) = 1−((H−1)/J)p_f The first expression approaches 0 when the number of collaborators and p_f remain fixed and J tends to infinity. This is not a limit with a fixed attacker fraction. The second and third account for revisiting the initiator; they concern predecessor equality, not a general optimal attacker-classification success rate. The probably-innocent bound≤1/2 requires H>1 and p_f≥J/[2(H−1)]. Since p_f<1, feasibility requires H>J/2+1, stronger than merely an honest majority. The paper gives the precise inequality 1/2<(H−1)/J and then loosely says “more than half” (Q31). Reader-created arithmetic example, separate from the paper’s case: J=10,H=9,p_f=3/4 gives hit probability 4/13 and conditional predecessor-equals-initiator probability 2/5; its threshold is 5/8. For J=10,H=6 the threshold is 1, excluded by p_f<1. These examples clarify the parameter constraints; no simulation, model checking or author code produced them. For information flow, the paper conditions its measure on hitting a collaborator and bounds mutual information between initiating identity and the predecessor of the first collaborator by [1−((H−1)/J)p_f]log2(H) bits (Q32). The formalization uses Radon–Nikodým-based information theory and reduces finite-range variables to the discrete probability/logarithm sum. Both retained historical and current information_flow theorems add init_uniform, requiring equal initiating probability 1/H for each honest participant (Q44,Q50). That hypothesis is absent from the displayed paper theorem and the general §4.1 context. The evidence-backed formal theorem should retain it. This inspection does not show that the numerical inequality is false for arbitrary init; it establishes that the inspected scripts prove the stated bound under an extra hypothesis. The bound covers this pair of identities under the conditional measure, not all data a real collaborator might observe. ## Evaluation, related work and limits (§§5–6, pp.30–31) The evaluation is two worked formal developments, exact parametric formulas and concrete rewrites for a selected ZeroConf instance. The authors report “a couple of days” and approximately 260 Isabelle/HOL lines for ZeroConf; Crowds needs approximately 1060 lines and “one person a couple of weeks,” including finding the information-gain estimate (Q34). These are author-reported effort/size figures with no controlled comparison, replication, distribution or detailed time log. The paper supplies no proof-checking runtimes, hardware measurements, packet experiments, implementation throughput, benchmark suite or user study. The two protocols are case studies, not statistical samples. The related-work discussion matters to the opening comparison with model checking: it explicitly recognizes probabilistic CEGAR for infinite-state systems, parametric transition probabilities for a fixed state count, and quantitative invariants for linear probabilistic programs (Q33). Thus the broad opening PRISM/model-checker contrast should not become a claim that all model checking handles only one fixed numerical instance. This work builds on the authors’ previous pCTL model-checking formalization and measure theory, and compares other HOL/Coq probability frameworks and information-flow analyses. These are discussion-level comparisons, not reproduced comparative experiments. The probabilities here can be written in PCTL, while HOL permits more properties; Markov decision processes, continuous-time models and certification of model-checker runs are future work in this 2012 paper (Q34). Their presence on the modern AFP page is subsequent artifact evolution, not a result reported here. ## What this adds to the requested topic Directly, this is evidence that distributed-protocol questions can require quantitative guarantees over infinite executions: almost-sure termination, finite expected cost, conditional anonymity and information leakage differ from deterministic safety invariants. Isabelle’s reusable probability library supports proofs for arbitrary finite network/probe sizes and symbolic probabilities, with the global model and theorem hypotheses made explicit. The ZeroConf rewrite/induction presentation is useful concrete proof-engineering evidence. It also shows why a local literature database should compare printed statements, parameter meanings and source hypotheses, rather than treat a claimed proof as validation of every nearby prose sentence. There is no Verus, verified Rust, TLA+ or LLM-agent experiment in this paper. Reader inference for those areas: an agent producing a specification/proof should retain the global-model refinement boundary, distinguish probability 1 from every execution, check integrability assumptions, align locale argument order with physical parameter names, and preserve extra theorem hypotheses. Evaluating such an agent should inspect those semantic correspondences as well as checker acceptance. These are lessons drawn by this reader, not results measured by Hölzl and Nipkow.
  • limits: Finite nonempty time-homogeneous DTMCs, normalized nonnegative transitions. ZeroConf:N natural,0<p,q<1,r,E>=0; fixed global occupancy/loss abstraction,N+1 probes. Crowds:finite nonempty participants,nonempty strict collaborator subset,0<p_f<1,honest-only initiation,uniform routing; retained information-flow proof also requires uniform initiation. Global models without node-level refinement. Printed numerical,formula,symbol and source-hypothesis discrepancies retained. No proof replay.
  • how much was read: most of it read
  • source
  • record id: interactive-verification-of-markov-2012
• IOALERGIA DLMDP learning (2012)
  • title: Learning Markov Decision Processes for Model Checking
  • what: Introduces IOALERGIA, an adaptation of Alergia that learns deterministic labeled Markov decision processes from alternating input/output traces. It builds an IO frequency prefix tree, merges states using recursive Hoeffding compatibility including disabled-action errors, chooses epsilon by BIC, and produces a DLMDP suitable for PLTL and scheduler analysis. The paper gives formal LMDP/DLMDP and scheduler semantics, a fair-scheduler observation model with unbounded independent sequence lengths, explicit IOFPTA/merge algorithms, convergence to the true structure up to bisimulation and parameter convergence with probability one, and the limitation that analogous convergence does not carry to PCTL. It evaluates deterministic and nondeterministic slot machines, not just an abstract learner: model sizes, learning time, probability/reward approximation, optimal-action accuracy, and conditional-probability failures are reported.
  • number: deterministic models: 160k-5,000k symbols; learning 9.8-454.4 s; learned state counts 436-1727; IOFPTA up to 1,135,055 nodes
  • number: deterministic learned optimal actions improve with data and remain above 25% random baseline
  • number: nondeterministic hooked models: 160k-5,000k symbols; 9.7-460.3 s; 437-1725 states
  • number: for hooked model, real P(3 bars|C1)=0.30 while learned values range 0.0327-0.0714; C3 real=0.30 while learned 0.0835-0.0940
  • limits: Observed traces alternate outputs and inputs, begin/end in states, and are independent; nondeterministic actions are resolved by a fair scheduler that chooses each input infinitely often. Disabled actions produce an err output and a memoryless scheduler is used in data generation. Epsilon controls type-I compatibility error and BIC balances likelihood and model size. Learned models approximate observed/generating systems; exact conditional probabilities and PCTL guarantees need not transfer, especially for nondeterministic systems. PRISM computes the reported properties.
  • how much was read: most of it read
  • source
  • record id: ioalergia-dlmdp-learning-2012
• Isabelle pCTL checker (2012)
  • title: Verifying pCTL Model Checking
  • what: Formalizes finite discrete-time Markov chains, their probability measure on infinite paths, pCTL syntax/semantics (next, bounded and unbounded until, cumulative/state/unbounded rewards), and the standard model-checking algorithm Sat in Isabelle/HOL. The authors prove Sat sound and complete. The formalization constructs a probability space from infinite products and Carathéodory extension, proves cylinder-measure and iterative integral equations, and formalizes state fairness and finite expected hitting time. Sat computes bounded operators recursively, probability-0/1 reachability by predecessor closure, and unbounded until/rewards through uniquely solvable linear systems and function-indexed Gauss–Jordan elimination. The final theorems connect an Isabelle result to the semantic state set and show termination under the unique-solution theorem; the authors discuss list-based extraction, certificate checking and parameterized protocol case studies.
  • number: Theorems 30, 32 and Corollary 33 establish soundness/completeness
  • number: about 4,480 AFP lines reported
  • number: finite nonempty state spaces
  • number: bounded and unbounded until plus three reward forms
  • limits: The chain has a finite nonempty state space, time-homogeneous transition matrix and nonnegative state/transition rewards; a starting state induces the path measure rather than an initial distribution. The set-based equations are almost executable but not directly handled by Isabelle code generation; arbitrary state indexing, the while-combinator and Gauss–Jordan adaptation require a future list-based SatL. This is foundational formalization without a runtime benchmark against PRISM.
  • how much was read: most of it read
  • source
  • record id: isabelle-pctl-checker-2012
• Lattice Tree Automata (2012)
  • title: Tree Regular Model Checking for Lattice-Based Automata
  • what: Introduces Lattice Tree Automata (LTA), extending tree automata with lattice-valued leaves to represent infinite sets of interpreted terms efficiently. A completion/evaluation algorithm computes finite over-approximations of reachable states for rewriting systems with arithmetic data. LTA Boolean operations, evaluation and completion support interpreted symbols without Peano encodings. Theorems establish sound over-approximation and completeness for left-linear term-rewriting systems under conditions; widening ensures termination of infinite numeric behavior. Examples model counters and Java-like data domains.
  • number: Theorems 1–4 prove solution over-approximation, language inclusion and completeness under left-linear TRS
  • number: Evaluation examples add interval transitions such as [3,4] to q3 and widening of infinite lambda behavior
  • number: No external benchmark runtime table reported
  • limits: Reachability for general TRS is undecidable; LTA completion is an over-approximation and may introduce spurious states. Theorem 4 assumes a left-linear TRS R, a tree automaton A and linear equations E, and requires completion to terminate; its conclusion is language inclusion over all R-reachable terms. Widening can lose precision; evaluation may not terminate without widening.
  • how much was read: most of it read
  • record id: lattice-tree-automata-2012
• LLBMC (2012)
  • title: LLBMC: A Bounded Model Checker for LLVM’s Intermediate Representation - (Competition Contribution).
  • what: Presents LLBMC, a bounded model checker that lowers C through LLVM IR into a bit-vector/array logic with an explicit flat memory and allocation state, simplifies the formula, and sends it to STP.
  • number: 146/269 handled
  • number: 65 timeouts
  • number: 48 restriction failures
  • number: 7 false positives
  • limits: The competition configuration used unwinding bound 7 and did not check bound sufficiency; SAFE therefore means no ERROR label within that bound. Concurrency was unsupported, and memcpy/inline assembly caused restrictions. False negatives came from insufficient unrolling; uninitialized pointers could make global state and ERROR reachability nondeterministic. The wrapper checks ERROR reachability rather than all memory checks.
  • how much was read: most of it read
  • record id: llbmc-2012
• Lock Removal for Concurrent Trace Programs (2012)
  • what: Removes redundant lock statements from concrete concurrent trace programs while preserving shared-memory-access partial orders. This reduces constraints for later SMT-based predictive bug analysis. The method goes beyond removing purely thread-local locks by checking which locks maintain impossible control-state transitions. §2 shows a lock around only local operations can still restrict the order of surrounding shared accesses; naive removal introduces an assertion failure. §3 defines visible successors of global control states and a conservative static successor relation ignoring data. Theorem 1 says equality of these static successor sets before and after removal preserves partial orders of global operations. §4 summarizes each local path between adjacent shared accesses/lock acquisitions (pairs of interest) by a lock access pattern: initial/final held sets, backward/forward acquisition histories, continuously held locks and acquired locks. Inconsistent pattern pairs expose reachability barriers. Retaining at least one blocking lockset per barrier preserves impossible transitions; remaining locks can become nops. Pattern equivalence classes avoid enumerating all program-counter tuples. §5 iterates removal in the running example: B is first removed, then A becomes removable. Other synchronization can be ignored conservatively or incorporated through a universal causality graph.
  • number: 20 table traces, 1–21 threads, 55–45653 total events, up to 41 named locks; acquisition history nesting depths 0 or 1
  • number: BarrierB2: 13 threads, 805 events, 49 initial critical sections and 21 in transformed trace; removal 1.6 s, symbolic check 54.5→7.4 s
  • number: account2: 21 threads, 1747 events, 140→60 critical sections; removal 2.6 s, check 8.7→2.4 s
  • number: Elevator1: 184→174 critical sections; removal 0.1 s, check 29.6→0.7 s
  • limits: Input is a finite trace program with a fixed finite thread/lock set: branch choices already made, calls inlined, loops and recursion unrolled, actual accessed addresses known. Preservation concerns alternative interleavings of those fixed local paths, not all paths or whole-program source optimization. Static reachability overapproximates by ignoring shared-data consistency; extra synchronization can only reduce executions. The decomposition assumes nested locks and is incomplete beyond two threads. Experiments assume sequential consistency and use Yices. No proof for relaxed memory, fences, dynamic whole-program lock sets, general liveness, or arbitrary executions. The claimed linear worst-case local analysis should be read with the fixed-pattern/thread/lock assumptions; the algorithm explicitly compares inconsistent pattern combinations. Most measured acquisition-history depths are zero, some one, so benchmarks do not establish behavior with deep nesting.
  • how much was read: most of it read
  • record id: lock-removal-for-concurrent-2012
• McScM communicating-machines framework (2012)
  • title: McScM: A General Framework for the Verification of Communicating Machines
  • what: Introduces McScM, an OCaml platform for safety verification and controller synthesis of finite-state processes communicating over reliable unbounded FIFO channels. It unifies abstract interpretation, abstract regular model checking, CEGAR and lazy abstraction behind a common verify front end and symbolic queue-content representation. The paper specifies the CM input and bad-state representation, explains verify outputs (safe certificate, counterexample or resource-bounded abort), and details four algorithms sharing FCID/QDD infrastructure and path-invariant generators. It describes compile-time interface guarantees from OCaml modules/functors and on-the-fly validation of path invariants and inductive certificates. The control tool computes a safe restriction using distributed control. Benchmark analysis finds algorithm-dependent strengths: absint terminates but may be inconclusive, cegar is good when precision is local, and armc often handles global refinement better; no method dominates.
  • number: benchmark ran on 3.2 GHz Intel i7-965, 64-bit Linux
  • number: examples range from 5 global control states to about 10^4 for Peterson
  • number: 1-hour timeout denoted by dash in benchmark table
  • number: absint solved safe examples quickly but was inconclusive on unsafe cases; cegar/armc/lart had complementary time/memory results
  • limits: CM have finite local control and reliable asynchronous unbounded FIFO channels; safety is undecidable in general. The algorithms are semi-algorithms or approximations and can abort under user resource/precision limits. absint always terminates without necessarily deciding safety; armc cannot handle a simple non-regular protocol in the benchmark. The release (1.2) is work in progress; future infinite local data (counters/timers) needs new abstractions and region algebras.
  • how much was read: most of it read
  • record id: mcscm-communicating-machines-framework-2012
• Model Checking and the State Explosion Problem (2012)
  • what: Lecture notes develop finite-state temporal model checking and four approaches to state explosion: symbolic BDD representation, partial-order reduction, counterexample-guided abstraction refinement and SAT-based bounded model checking, emphasizing the last. Defines Kripke structures and CTL*/LTL/CTL syntax and semantics, including incomparability of LTL and CTL. Gives explicit-state EU labeling and fixed-point characterizations, reduced ordered BDD operations, and the importance of variable order. States abstraction conditions preserving universal CTL* and explains how spurious abstract traces drive refinement. Derives a bounded safety encoding from initial states, transition unrolling and a bad-state disjunction. Discusses diameter bounds and k-induction for completeness. For general LTL, gives loop-free bounded semantics, lasso encodings and improved linear-size until encodings with loop selectors and auxiliary variables. Ends with equisatisfiable Tseitin CNF, DPLL/unit propagation, conflict learning and watched literals.
  • number: Explicit CTL algorithm O(|f|·(|S|+|R|)); |f| counts distinct subformulas.
  • number: n processes each m states can have m^n global states; n-bit counter has2^n states.
  • number: Original until encoding cubic in unroll depth k (quadratic with cited optimizations), versus cited improved linear encoding.
  • number: Cited example: 9510 latches;9499 inputs;4 million SAT variables;12 million clauses; shortest bug37 transitions;69 seconds.
  • limits: Finite systems or suitable finite abstractions; explicit graph complexity does not avoid exponential global state count. BDD compactness depends on ordering and structure. Abstraction preservation is for the stated universal fragment, not arbitrary temporal formulas; abstract counterexamples can be spurious and refinement need not provide a general termination guarantee. Absence of a bounded counterexample alone is not full verification: a completeness bound or additional induction is required. Claimed BMC speed/memory advantages are qualitative tutorial claims, not a universal empirical result. The concluding circuit timing is attributed to Armin Biere, not measured in this reading. Recovered copy has 31 substantive pages while DOI metadata lists pp.1–30. All extracted text including references was read; selected BMC formula/table pages visually checked. No SAT solver, code or artifact was run.
  • how much was read: most of it read
  • source
  • record id: model-checking-and-the-2012
• MPS minimal modal proofs (2012)
  • title: Minimal Proof Search for Modal Logic K Model Checking
  • what: Defines Minimal Proof Search (MPS), a best-first effort-number algorithm for model checking multi-agent modal logic K over game automata, and proves termination, correctness, minimal-cost proofs/disproofs, and optimality among purely exploratory algorithms. The paper parameterizes proof cost with atomic costs and increasing conjunction/box aggregators, derives admissible proof/disproof heuristics, and gives generic initialization, expansion, backpropagation, and child-selection rules. Structural induction proves finite termination and that infinite minimal proof/disproof numbers exactly characterize solved trees; further propositions establish returned witness/counterexample cost is minimal. The optimality theorem is restricted to algorithms that do not exploit formula reasoning, transpositions, or domain knowledge. A worked framework supports depth, number of atomic queries, and interaction-cost objectives, while the conclusion identifies memory use, variable edge costs, and absent transposition handling as limitations.
  • number: Proposition 3 proves finite termination for every input formula
  • number: Theorem 1: MPS returns a proof or disproof after finitely many steps
  • number: Theorem 2: returned tree contains a minimal-cost proof/disproof
  • number: Theorem 3: purely exploratory algorithm either reproduces MPS subtree or loses all-input minimality guarantee
  • limits: MMLK formulas use atoms, negation, conjunction and box modalities over finite-agent game automata; aggregators must be increasing and map infinite inputs to infinity. MPS is best-first and memory-intensive, with no empirical benchmark section; optimality is a theoretical comparison for purely exploratory algorithms and does not cover algorithms using bisimulation/transposition or domain reasoning.
  • how much was read: most of it read
  • record id: mps-minimal-modal-proofs-2012
• multi-objective Pareto probabilistic checking (2012)
  • title: Pareto Curves for Probabilistic Model Checking
  • what: Introduces value-iteration algorithms that generate successive approximations of Pareto curves for multi-objective probabilistic reachability and expected-reward queries. Weighted-sum optimization avoids LP’s poor time-bounded scalability while exposing trade-offs among conflicting objectives. Develops separating-hyperplane and weight-vector procedures, handles achievability/numerical queries and finite-horizon properties, constructs a randomized adversary from Pareto points, and implements the approach in PRISM. Experiments cover assume-guarantee, consensus, zeroconf, team formation, scheduler, and dynamic-power-management models.
  • number: Runtime improvement up to approximately 150× over LP (§1, §5)
  • number: Largest value-iteration models were about 20× larger than LP-solvable models (§5)
  • number: Team-formation 5-state parameter case reached 907,993 states and Pareto time 141.76 s (§5 Table 1)
  • number: Experiments used ε=10−6 and Pareto εp=10−4 (§5)
  • limits: The method targets convex multi-objective reachability/reward regions induced by MDPs and approximate value iteration; curve precision depends on ε and εp. Reported gains compare against LP-based methods on selected PRISM models, and future work is needed for timed probabilistic models such as CTMDPs/PTAs.
  • how much was read: most of it read
  • record id: multi-objective-pareto-probabilistic-checking-2012
• Okazaki Shidama DESCIP_1 DES 2012 (2012)
  • title: Formalization of the Data Encryption Standard
  • what: Okazaki and Shidama define DES components over fixed-length Boolean sequences in Mizar and prove that decrypting an encrypted block with the same key returns the original block. Main structural theorem is generic Feistel invertibility for arbitrary total round function, initial permutation and finite nonempty subkey sequence. That result does not certify cryptographic security, executable implementation refinement or correspondence of every printed constant/index to the external DES standard. Tracks bit-vector lengths/indexing, explicit 512-entry S-box specification, row/column conversion, permutation inverse, key schedule and generalized Feistel theorem. Flags literal printed NtoSeg overstatement, zero-versus-one schedule indexing, and repeated S8 table value. Explains why a round-trip proof is insensitive to wrong round-function constants or a shared wrong key schedule.
  • limits: Mizar article DESCIP_1, version 7.12.02/4.181.1147; six sections,32 definitions,40 propositions,one four-component recursion scheme,22 references. Core types are finite Boolean sequences with one-based sequence positions; ordinal n means zero-based set{0,…,n−1}. Key and block inputs are arbitrary 64-bit sequences, no parity condition imposed. References include FIPS46-3(1999), sequences/functions/Boolean algebra. No proof scripts or runtime/line-count measurements are printed, and no rebuild performed (§§1–6). Preliminaries prove splitting/reconstruction, length-preserving left/right/cyclic shifts, additive composition of shifts and identity at 0/±length, XOR involution, and fixed-size sequence constructors. QuadChoiceRec gives four sequences with prescribed starts and recurrence when a next quadruple exists for each state/time; it is a general existence scheme, not a randomness or cipher-security statement (§1). Index conversion ntoSeg(i)=i+1 maps ordinal n to one-based Seg n; NtoSeg attribute specifies that unique successor map. Visually printed sentence p131 says every function n→Seg n is bijective and NtoSeg. Literally false for n=2 constant 1 map; reader counterexample. Proposition 34 correctly retains NtoSeg premise. No artifact/source inspection to determine whether generated prose omitted qualifications; do not infer inconsistency of Mizar from this printed sentence (§1). Eight S-box functions map ordinal 64 to ordinal 16, explicitly listing 64 values each,512 total. B6toN64(t)=32t1+16t6+8t2+4t3+2t4+t5 encodes row from outer bits and column from inner bits; N16toB4 enumerates four-bit outputs. Paper reads as row-major tables rather than direct ordinary binary interpretation of six input bits. Reader read all constants but did not compare all 512 entries against external standard (§2, §4). S8 visually prints adjacent indices 25 and 26 both equal 5. In 16-entry row 16–31, this duplicates 5 and omits 6. This is a source-table observation, not an independently verified FIPS mismatch or unchecked-code defect. Round-trip theorem permits arbitrary F, so even a differing S-box would leave generic invertibility true. Official NIST reference fetch returned 403; no external table comparison claimed (Definition 13, §2; Proposition 38). Initial IP and IPINV are explicit 64-entry permutations on Boolean 64; proposition 36 proves DES-PIPINV=(DES-PIP)^−1 and registrations assert each bijective. Round function expands 32 bits to 48 via repeated input positions, XORs 48-bit subkey, divides into eight 6-bit chunks, applies eight S-boxes and four-bit conversion, concatenates 32 bits and applies explicit 32-position P permutation. Proposition 37 reconstructs the 48-bit input from chunks; no claim that expansion or S-boxes individually are invertible (§3–4). Key schedule selects 56 positions from 64 via PC1, splits two 28-bit halves, rotates and compresses via PC2 to sixteen 48-bit subkeys. Defined shift sequence is (1,1,2,2,2,2,2,2,1,2,2,2,2,2,2,1). Definition 28 visually uses bitshiftDES(i) for i=0,…,15 while setting next states/subkey at i+1. Sequence values were defined at1,…,16: first loop step accesses index 0, final index 16 unused. This is a literal printed indexing discrepancy, not proven implementation failure. Paper does not supply an adequacy theorem/test vector resolving it (Definitions 25–28). General DES-like-CoDec has positive n,m,k, block 2n bits, k subkeys of m bits, total F:Boolean^n×Boolean^m→Boolean^n, and arbitrary initial permutation I. Start L0,R0 from I(M); Li+1=Ri and Ri+1=Li XOR F(Ri,Ki+1); final output I^−1(Rk concatenated Lk), explicitly swapping halves. No invertibility or collision-resistance assumption on F; sequence reversal provides decryption (Definition 29). Proposition 38 states CoDec(CoDec(M,F,I,K),F,I,Rev(K))=M for all well-typed choices. Mathematical reason is XOR cancellation and reversed Feistel order with final swap, not security of F. Full proof script not printed; reader explanation is deduction from recurrence. Proposition 39 specializes n=32,m=48,k=16 but still arbitrary F,I,K. Final definitions instantiate F=DES-FFUNC,I=DES-PIP,K=DES-KS(key); decryption uses reversed same schedule. Proposition 40 proves DEC(ENC(m,key),key)=m for all 64-bit m,key (§6). Formal property is functional block round trip. Paper contains no game-based indistinguishability/security reduction, key recovery bound, timing/side-channel property, mode/padding behavior, parity validation, authentication, concurrency or network-protocol theorem. No C/Rust implementation, compiler/assembly/hardware refinement, standard known-answer test, benchmark or independent replay reported. A common wrong schedule or arbitrary wrong F can satisfy same structural round trip, so title alone cannot justify standard conformance or deployed-code correctness (§§1–6). External-reference attempt: https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.46-3.pdf returned HTTP 403 during this read. No sign-in/CAPTCHA page observed. Main paper fully available; support-reference comparison remains unperformed. All substantive record quotations are from the saved primary paper, not this failed fetch.
  • how much was read: most of it read
  • source
  • record id: okazaki-shidama-descip-1-des-2012-2012
• Pak FRIENDS1 friendship graph 2012 (2012)
  • title: The Friendship Theorem
  • what: Pąk formalizes the finite friendship theorem: a nonempty symmetric irreflexive relation in which every distinct pair has exactly one common neighbor has a universal neighbor. The article develops cyclic-sequence counting,a regular-walk count,degree parity and no-hub regularity/vertex-count lemmas. It also characterizes nonhub vertices in a graph with a hub as paired degree-two vertices,explaining the triangle-sharing structure. No complete proof of the final theorem is displayed. Records field-based vertex representation,nonempty-relation guard,symmetry/irreflexivity,cardinality versus neighborhood-set equalities,free rotation scheme,prime-periodicity lemma and consequences for no-hub graphs and paired nonhub vertices.
  • limits: MML FRIENDS1 version7.15.01 4.184.1155 identifies the article. A friendship graph is a finite symmetric irreflexive binary relation with the unique-common-friend property. Vertices are field R=dom R union rng R,so isolated vertices are not separately represented. The final14 explicitly assumes the relation nonempty;the empty relation satisfies the type vacuously but has no vertex to witness a universal friend (pp.235–237). Definitions1/2 make x a universal friend when x∈field R and every different field vertex y has(x,y)∈R;R has one when suchx exists. This is existence of at least one hub,not uniqueness. Definition3 alone asks for R-image(x)∩Coim(R,y) to be a singleton for distinctx,y;without symmetry this is a two-step relation condition. Symmetry makes it the ordinary common-neighbor intersection (p.236). Theorem1 equates the cardinalities of a relation and its converse,not the relations themselves. Theorem2 equates image and inverse neighborhood for symmetric R. Theorems3–5 relate cyclic rotations built from sequence suffix/prefix pieces,including truncated natural subtraction and bounds needed in3/4. Lost cardinality bars make1 appear falsely as universal relation symmetry in raw text (p.235–236). The counting scheme takes a nonempty alphabet A,a positive length B,and a predicate on B-words. If the predicate is invariant under rotating a concatenation p^q to q^p,and no satisfying word is fixed by a nonzero rotation belowB,then the satisfying-word cardinality is B times some cardinalC. For finite alphabets/word sets this is integer divisibility byB. The scheme itself does not require A finite (p.236). Theorem6 counts length(k+1) sequences starting in a finite nonempty subset A of X,where each point has exactlyn permitted next values. Their number is|A| n^k. X need not be finite,but all successor sets have fixed finite cardinality. Theorem7 says a prime-length word fixed by some nonzero proper cyclic rotation must be constant. Together these are combinatorial tools for counting prime-length graph walks;the article supplies no proof trace applying the scheme to14 (p.236). Theorem8 says every neighborhood cardinality is even. In a friendship graph,neighbors ofx pair under their unique common neighbor withx:each neighbor has exactly one other neighbor insideN(x),and irreflexivity excludes self-pairs. This pairing is a reading explanation of the statement,not a printed proof (p.237). Theorem9 equates degrees of nonadjacent vertices,not their actual neighbor sets. If the graph is nonempty and no universal friend exists,10gives every degree>2,11gives equal degree k for all vertices,and12gives |V|=1+k(k−1). Together with8,this hypothetical regular degree is even and at least4. All bars in these counts are visible in the rendering but absent from raw extraction (p.237). Standard explanation of the12 count:relative to x,each other vertex has exactly one common neighbor withx,so it is reached by exactly one two-edge walk fromx;there are k(k−1) such walks without returning tox. The displayed paper states the formula without proof;it does not show the subsequent contradiction that rules out a finite nonempty hubless friendship graph (p.237). Theorem13 says ifx is universal and y≠x,there isz with N(y)={x,z} andN(z)={x,y}. Thus nonhub vertices pair into triangles sharingx,and their degree is exactly2. The statement gives an actual neighborhood-set equality here,unlike the degree-cardinality equalities9/11. The windmill interpretation follows mathematically;the article does not provide a separate graph-isomorphism classification theorem (p.237). Illustrative inference:not a printed example:a triangle satisfies unique-common-neighbor property and all three vertices are universal,so the result cannot assert a unique universal vertex. Two triangles sharing one vertex give a five-vertex example with a unique hub and two disjoint paired peripheral edges. The theorem’s existence conclusion and13match both examples. The final14 states only that a nonempty friendship graph has a universal friend. Finite,symmetric,irreflexive and unique-common-friend premises are inherited from the graph type. No directed,looped,infinite-graph extension or weakening to at-most-one common neighbor is asserted. No search/recognition algorithm,runtime bound or extremal counting formula is supplied beyond the displayed lemmas. The paper says it follows Michael Albert notes linked in reference1;those notes were not separately read for this record. Eighteen references concern cardinal arithmetic,relations,finite sequences and divisibility. There are no proof sketches,explicit final counting contradiction,worked graph examples,proof/check-time statistics,benchmark or independent checker transcript. Reported formalization is not an artifact run. All three pages,three sections,three definitions,14numbered results,counting scheme/both premises,observations,funding footnote,18references/date read. Quote text is exact saved raw extraction,not a visual formula transcription;cardinality bars disappear,composition/rotation signs and pair brackets are distorted. All page renderings and enlarged237checked. No formal-source/checker execution,distributed protocol,Verus/Rust/TLA+ or LLM proof/specification-agent experiment.
  • how much was read: most of it read
  • source
  • record id: pak-friends1-friendship-graph-2012-2012
• PIP probabilistic model checking (2012)
  • title: Model Checking with Probabilistic Tabled Logic Programming
  • what: Recasts probabilistic model checking as query evaluation over probabilistic logic programs. A finite explanation generator represents potentially infinite execution families; an inference algorithm computes their probability directly. XSB implementation encodes PCTL and GPL/PCTL* model checkers. PIP uses tabling, constraints and BDD/FED structures to avoid finite-explanation restrictions. Declarative encodings cover DTMC/MDP-style models, programs and temporal formulas, while experiments compare PIP with native PRISM implementations.
  • number: Implemented in XSB tabled Prolog
  • number: Two experiment sets: probabilistic programs and PRISM models
  • number: PIP model checkers competitive with native implementations despite declarative encoding
  • number: CPU-time plots reported; no aggregate speedup in extracted text
  • limits: Inference correctness depends on explanation-generator finiteness/termination and well-founded semantics. Declarative overhead may be high; probabilistic independence/mutual-exclusion assumptions must hold. Performance is benchmark-dependent.
  • how much was read: most of it read
  • record id: pip-probabilistic-model-checking-2012
• Probabilistic LTL Progress (2012)
  • title: Measuring Progress of Probabilistic LTL Model Checking
  • what: Characterizes a progress measure for a positive LTL fragment and gives exponential-time exact and polynomial-time lower-bound algorithms based on explored probabilistic transitions. The progress is defined as the infimum, over all probabilistic transition-system extensions of a finite search, of the measure of explored-prefix cylinders that cannot contain violations. The paper proves it lower-bounds the true satisfaction probability, relates progress for negated properties to discovered violations, defines LTL+ without negation, and derives recursive progress computation plus a polynomial lower-bound algorithm.
  • number: exact progress algorithm exponential in |φ| and polynomial in checked-system size
  • number: lower-bound algorithm polynomial time; tight for invariants
  • number: no empirical runtime benchmark reported
  • limits: Systems are countable probabilistic transition systems with no final states (self-loops can be added). Exact computation is exponential in formula size and polynomial in explored search size; the polynomial lower bound is tight for invariants but not generally for all LTL+. The reverse relation between finding violations and positive progress is proved only for invariants, not all safety properties.
  • how much was read: most of it read
  • record id: probabilistic-ltl-progress-2012
• PRTS model checker (2012)
  • title: A Model Checker for Hierarchical Probabilistic Real-Time Systems
  • what: Presents a PAT plug-in model checker for Probabilistic Real-time Systems (PRTS), a CSP extension with hierarchical composition, shared data, dense-time constructs, and probabilistic choice. Automatic zone abstraction produces a finite MDP while preserving probabilities for supported reachability and LTL analyses. Defines PRTS constructors Wait, timeout, interrupt, deadline, within, and pcase; supports integer/boolean/array/user-defined data and fully hierarchical processes. The concrete semantics are MDPs with finite reachable data/process valuations but dense-time transitions. A proof sketch establishes time-abstract bisimilarity between scheduler-induced concrete and abstract DTMCs. Verification includes max/min reachability, reward, SE-LTL without next, refinement checking, counter abstraction, and safety-via-refinement detection. The PAT implementation provides Visual Studio editing, simulation, and verification.
  • number: lift=2, floor=2, user=5: 2,175,271 states and 406.29 s random; 740,997 states and 85.29 s nearest
  • number: FA(300K): 726,407 PAT states, 30.74 s; PRISM >1 hour
  • number: ZC(700): 24,058 PAT states, 5.78 s; PRISM 427.70 s
  • number: LTL-X / SE-LTL support
  • limits: Requires finite valuations of variables and reachable process structures; dense time is the only source of infinite states. Probability preservation is claimed for the supported properties under the zone abstraction and scheduler correspondence. LTL is restricted to LTL-X because next is hard to define after abstraction; counter abstraction applies only when process identities are irrelevant. Future work lists zeno checking, digitization, and richer real-time properties; experiments are small case studies rather than exhaustive scalability evidence.
  • how much was read: most of it read
  • source
  • record id: prts-model-checker-2012
• Quantitative µ-calculus on LHS (2012)
  • title: Model Checking the Quantitative µ-Calculus on Linear Hybrid Systems
  • what: Proves decidability of quantitative μ-calculus model checking for initialized linear hybrid systems through quantitative parity games and counter-reset abstractions. Reduces hybrid games to flat unit-rate games by rescaling, rational constants to integer ones, and real strategies to ε-discrete strategies preserving integer intervals and fractional ordering. Geometrically shrinking approximation errors bound drift; counter-reset games then support arbitrary-precision approximation and detection of infinite values.
  • number: Theoretical reductions and upper bounds: fixed-counter parity subroutine4EXPTIME versus general6EXPTIME; overall model-checking upper bound8EXPTIME. No runtime evaluation.
  • limits: Initialization resets variables when their rates change; arbitrary linear hybrid systems are undecidable. Combined8EXPTIME bound is an upper bound, not a tight complexity claim. No implementation or empirical solver study; implementation and exact value/complexity questions remain open. Handwritten proofs read, not independently machine checked.
  • how much was read: most of it read
  • record id: quantitative-calculus-on-lhs-2012
• Sakurai Okazaki Shidama LOPBAN7 closed graph 2012 (2012)
  • title: Banach’s Continuous Inverse Theorem and Closed Graph Theorem
  • what: Sakurai,Okazaki and Shidama formalize bounded inverses of bounded bijective real Banach-space operators and boundedness of everywhere-defined closed linear operators. They construct the graph as a normed subspace of the product,establish its completeness when closed,and provide sequential closedness for general nonempty partial functions. The final theorem requires no surjectivity,despite the Summary’s narrower wording. Records total versus partial operator domains,graph-space completeness,inherited norms,closed inverse graphs and coordinate bounds. Separates the surjectivity-free final registration from the summary and states the standard projection argument only as reading inference because proofs are not displayed.
  • limits: MML LOPBAN_7 version8.0.01 5.3.1162 identifies the article. The inverse7 and final closed-graph registration require real Banach X,Y. Their “linear operator from X into Y” is everywhere-defined on X. Other results explicitly use nonempty partial functions and keep domain conditions;do not apply the final theorem directly to arbitrary proper-domain closed operators (pp.271–273). Theorem1 shows a bijective linear operator has a linear inverse with range the whole X. Theorem2 uses bijectivity and openness between linear topological spaces to get a continuous onto inverse. Theorems3–6 preserve zero,reduce linear continuity to zero and identify continuity with Lipschitz boundedness on all X. Bijective alone does not supply continuity of the inverse (pp.271–272). Theorem7 assumes a Lipschitz linear bijection between real Banach spaces and concludes its inverse is Lipschitz linear. It provides no explicit numerical inverse bound. The paper states the open-map and Banach inverse contracts without showing their proofs;the exact imported dependency graph is not independently audited (p.272). Theorem8 equates componentwise convergence/limits with convergence of the paired sequence in X×Y. Definition1 retypes the set-theoretic function graph T as a subset of that product. Nonempty partial functions have nonempty graphs;linear operator graphs are linearly closed (p.272). Definition2 restricts the product norm to graph(T);Definition3 says T is closed iff this graph is topologically closed;Definition4 packages inherited zero,addition,scalar multiplication and norm as graphNSP(T). The graph structure satisfies the real normed-space axioms and is a subspace of X×Y (9). The article does not display the product norm’s exact closed formula,so no specific sum-versus-Euclidean choice is inferred (pp.272–273). Theorem10 requires a normed subspace X of Banach Y,with carrier a closed subset X0 and norm exactly the ambient restricted norm,then concludes completeness. Theorem11 applies this to the closed graph of a linear operator between Banach spaces. Linearly closed alone is not a substitute for topological closedness in this completeness step (p.273). Theorem12 applies to any nonempty partial function T:X→Y between real normed spaces. For every convergent sequence s in dom T whose image sequence also converges,it requires lim s∈dom T and lim T(s)=T(lim s). This is equivalent to graph closedness. It does not assert image convergence for every convergent input sequence;that stronger claim would be continuity with domain issues handled (p.273). Theorem13 says a partial function equal to a Lipschitz linear operator T0 with closed domain has closed graph. Its printed equality is T=T0,not merely a restriction ofT0. Theorem14 says an injective closed nonempty partial function has closed inverse graph;no onto-all-Y premise is required because the inverse remains partial on rng T (p.273). Theorem15 bounds each coordinate norm by the paired norm. The final unnumbered registration states every closed linear operator X→Y between real Banach spaces is Lipschitz. Unlike the Summary,which says “a surjective closed linear operator”,the actual final statement has no surjectivity premise. It is stronger than that summary but retains total-domain and Banach assumptions (pp.271,273). Standard proof reconstruction,not a displayed proof: if graph(T) is Banach,its first-coordinate projection to X is a bounded linear bijection because T is total and single-valued. Theorem7 makes its inverse bounded;15 bounds the second projection. Their composition isT,hence bounded. This explains the graph-space infrastructure without claiming those are audited source-level proof steps. Illustrative inference about the total-domain requirement:not every closed linear partial operator is bounded in its ambient norm. Differentiation on C1[0,1]⊂C[0,1],with input/output sup norms,is closed (uniform convergence of functions and derivatives preserves the derivative by integration),but u_n(t)=sin(nt) has bounded input norm and derivative norm n. Its proper domain does not meet the final theorem’s total Banach-domain contract. No such example is printed in the paper. The paper supplies definitions,structural-property registrations and statements,with no proof sketches,quantitative operator constants,numerical examples,executable solver,proof/check-time measurements,benchmark or checker transcript. Twenty references include normed-product,linear-operator and sequence libraries plus a functional-analysis text;dependencies not independently read for this record. All four pages,four definitions,15numbered propositions/all clauses,unnumbered registrations,funding footnote,20references/date read. Exact quote text follows raw extraction,not complete visual mathematical transcription;pairing brackets,restriction U+0016,inverse superscripts and sequence-composition typography differ from the PDF. One sheet inspected. No formal source/checker execution,distributed protocol,Verus/Rust/TLA+ or LLM proof/specification-agent evaluation.
  • how much was read: most of it read
  • source
  • record id: sakurai-okazaki-shidama-lopban7-closed-graph-2012-2012
• Stratified CSL (2012)
  • title: Efficient CSL Model Checking Using Stratification
  • what: Develops a polynomial-time approximation algorithm for full Continuous Stochastic Logic by transforming any CTMC into a measure-preserving stratified CTMC. Stratification makes CSL path probabilities computable by transient uniformization analysis and restores decidability for general CTMCs. The transformation adds formula-progress automaton state, preserving path measures while making subformulas ordered; product states include good/bad absorbing states. The paper proves measure preservation and complexity bounds for nested until formulas, extending earlier binary-until algorithms.
  • number: Transformation linear in CTMC size/time and space
  • number: Transient analysis polynomial; complexity includes O(|R|k·λb +( |S|k)^3) in infinite final interval case
  • number: DFA for formula progress linear in formula length
  • number: No empirical benchmark table; theoretical algorithmic evaluation
  • limits: Finite CTMCs and CSL formulas; approximation error depends on uniformization/time bounds. State space grows with formula structure; full CSL decomposition may be exponential. Results address probabilistic model checking, not implementation-level code correctness.
  • how much was read: most of it read
  • record id: stratified-csl-2012
• TLAPS (2012)
  • title: TLA+ Proof System (TLAPS) and its temporal support
  • what: # TLA+ Proofs (authored by agents unless marked 🧑) Denis Cousineau, Damien Doligez, Leslie Lamport, Stephan Merz, Daniel Ricketts and Hernán Vanzetto, 2012. This record reads the 16-page extended article, arXiv:1208.5933v1, dated 29 August 2012. Its first-page footnote says a shorter version appears at FM 2012; reference [7] gives LNCS 7436, pp 147–154. The official TLAPS publications page links both a longer article and a Peterson model (Q1,Q3,Q30,Q37). The shorter proceedings paper was not separately read. The inventory’s cs.LO label is not the PDF’s classification: the PDF says cs.SE (Q1). The article explains how to write, decompose, check and maintain TLA+ proofs through Peterson’s two-process mutual exclusion algorithm. Its central result is an illustrated invariant proof, backed by reported TLC and theorem-prover checks. The most important qualification is explicit: the displayed final temporal QED is “proof omitted” (Figure 6, Q19), because the then-current TLAPS could not check temporal reasoning (Q11). The state-level proof obligations are reported checked; the complete temporal theorem is justified by standard induction rules in the explanation, rather than entirely checked by the presented tool. Liveness is outside the demonstrated verification. ## Reading and evidence scope Read all 16 PDF pages in text and rendered images, including sections 1–6, all six figures, every displayed formula/proof and all 24 bibliography entries on pp 14–16. There is no appendix, checklist, numbered equation, numerical plot or printed table. The six figures contain the PlusCal algorithm, its TLA+ translation, high-level proof, inductive invariant, preservation-proof outline and hierarchical proof. This is one mutual-exclusion theorem target shown at successive levels of detail, not six independently evaluated algorithms. The local inventory PDF and freshly fetched official arXiv PDF have identical bytes. Read the official TLAPS publications page and two complete plaintext Peterson modules from the official tlaplus/tlapm repository, pinned to commit 901ae51ed5224f88d43a1a02969cd9be4ed1b48d, dated 2026-10-16. One module is the publications-page artifact path; its bytes match the separately fetched live official model. The second is under doc/fm2012. These are retained example artifacts, not an audit of the current TLAPS implementation. The repository tree was inventoried to locate them. Other examples, proof-manager/backend implementation, modern tutorials, the shorter article and recursively cited case-study papers were not read. The modern repository pin does not establish the exact executable versions used in 2012. No author code, PlusCal translator, TLC, TLAPS, Isabelle, Zenon or SMT solver was executed or imported. No model, serialized dataset or checkpoint was loaded. The reader checks are symbolic reasoning, file comparisons and metadata/arithmetic checks. quotes.json contains exact passages with section/page, LF lines and character slices; figure-evidence.json preserves every figure listing. numeric_tables.json explicitly records zero tables and the limited quantitative claims. The extracted listings often render □ as 2 and a prime as 0; quotes retain those literal extraction bytes, while the analysis uses the symbols confirmed in the rendered PDF. source-scope.json, source-files.json and hashes.json document the reading boundary and bytes. ## Specification and assumptions TLA+ combines linear-time temporal logic, Zermelo–Fraenkel set theory with choice, and modules. The proof language adds hierarchical natural-deduction structure. The Toolbox is an Eclipse-based interface to both TLC model checking and TLAPS proof checking, so the same formulas can be tested and used in deductive proofs (Q2). These descriptions concern the paper’s 2012 tools; they are not a current feature inventory. The example has exactly two process identifiers, 0 and 1, with Not exchanging them. Shared variables are a Boolean-valued flag function, a turn value initially 0, and the generated program-counter function pc. Initially both flags are false and both counters are at a0. Each process repeatedly sets its flag, gives the other process the turn, checks the other’s flag and turn through two separate labeled tests, executes the critical-section skip, then clears its flag (Q5–Q8). Atomicity is specified by PlusCal labels: an action runs from one label to the next. Figure 2 exposes seven action formulas per process, and Next existentially selects one process’s action. Reads/writes and control changes have exactly the interleaving semantics of these formulas. The example supplies no weak-memory, compiler-reordering, machine-instruction, crash, recovery or network-message model. Correctness of a compiled Rust or C implementation would need a separate correspondence argument. The critical section itself is represented by an atomic skip; the paper’s property is that the two program counters never simultaneously equal cs (Q6–Q9). The full specification is Spec = Init ∧ □[Next]_vars, with vars collecting flag, turn and pc. Brackets admit either a Next transition or a step leaving all listed variables unchanged. A behavior is an infinite state sequence. Stuttering is included to simplify refinement, not to assert progress (Q7,Q8,Q10). There is no fairness clause in the displayed Spec. A reader witness repeats the initial state forever: Init holds, every step satisfies UNCHANGED vars, and neither process ever reaches cs. Thus that exact Spec does not imply eventual entry into a critical section. This is compatible with its mutual-exclusion safety property. The paper says liveness can be expressed and proved in TLA+, but does not give the extra progress assumptions or a liveness proof here (Q4; math-witness.json). It would be wrong to infer starvation freedom merely from the safety theorem. ## What is proved, and the checking boundary The target is Spec ⇒ □MutualExclusion. Its three state-level obligations are Init ⇒ Inv, Inv ∧ [Next]_vars ⇒ Inv′, and Inv ⇒ MutualExclusion. Figure 3 and §3.1 explain how propositional reasoning plus temporal induction and monotonicity yield the temporal theorem from these premises. They then state: “TLAPS does not yet handle temporal reasoning, so we omit the proof of the qed step” (Q11). Figure 6 calls itself the “complete hierarchical proof” while visibly retaining that omission (Q19). This is a disclosed tool limitation, not evidence that the mutual-exclusion theorem is false. Inv is TypeOK ∧ I. TypeOK constrains pc to seven labels per process, turn to {0,1}, and flag to Boolean-valued functions on {0,1}. I says a process from a2 through a4 has its flag set. A process at cs or a4 excludes the other from both cs and a4; if the other is still in either waiting-test location, turn favors the process already in that region (Q12). The stronger control-state conditions explain why the simple target predicate is preserved even across the entry/exit protocol. Two small reader checks clarify the formula. Init satisfies TypeOK, while all control-state antecedents in I are false at a0. If pc[0]=cs, I for process 0 excludes pc[1]=cs; if pc[0]≠cs, MutualExclusion already holds. These checks cover initialization and implication to the target. They do not replace the preservation proof or independently certify the tool. TypeOK describes 7²×2×2²=392 possible valuations; that is a domain-size calculation, not the paper’s reported 58 reachable states (math-witness.json). The paper first reports TLC checking execution errors and MutualExclusion over all 58 reachable states of this particular finite model. It also checks inductiveness by replacing Init with Inv, model checking Inv ∧ □[Next]_vars. Starting from every state satisfying the candidate invariant tests preservation beyond the original reachable-state set. For more complicated or infinite-state specifications, the authors recommend small-instance model checking as a way to find errors, and explicitly limit its ability to establish general inductiveness (Q9,Q12). A successful finite instance is not a universal proof for arbitrary process counts or data domains. The illustrated checks also reveal the human work. A leaf proof citing only Init and Inv fails because TypeOK and I remain uninterpreted. Supplying their definitions lets TLAPS prove initialization. Expanding definitions for the entire preservation obligation still fails with the default provers and produces a 65-line obligation. CVC3 through the SMT backend proves it “in a few seconds” (Q13–Q15). No hardware, precise solver versions, timeout, repeat count or full timing log accompanies that statement. To demonstrate hierarchy rather than rely on this easy SMT success, the authors deliberately decompose the preservation proof using Zenon and Isabelle. The SUFFICES step replaces [Next]_vars with Next only after separately proving the unchanged-variable case. It then splits Inv′ into TypeOK′ and I′. Zenon proves the SUFFICES reduction; Zenon fails on the stated TypeOK′ proof but Isabelle succeeds. Both fail on I′ without further decomposition (Q16–Q17). The next level introduces an arbitrary process j, names its invariant subexpression as I!(j), and picks the process i that performs the Next action. Instead of seven action-by-action cases, two cases, i=j and i≠j, suffice for the displayed example. Explicit facts and definition expansions then discharge the leaves. A case step’s own name denotes its case assumption, so citing that name within its proof is not circular citation of its conclusion. NEW-bound assumptions and the PICK membership fact are automatically available within scope; ordinary facts still need the stated context discipline (Q18–Q19). ## Proof management, reuse and trust The Proof Manager translates proof steps into sequents with a goal and context of symbols, assumptions and previously established facts. It tracks context changes and sends leaf obligations to backends. It records success, failure, cancellation and omission. The interface can check one step, theorem or file, show the exact failing obligation, navigate back to the producing proof, and hide irrelevant portions of the hierarchy (Q21–Q22). “Proof obligations are independent of one another” describes the ability to check conditional obligations in any order (Q21). It does not make a theorem valid while required assumptions or earlier steps remain unproved. The distinction matters in this very example: the state-level work can be developed independently while the final temporal QED is omitted. Global completion requires all needed obligations and the correct bridge to the stated property. Fingerprinting stores an obligation’s status under a canonical representation. Bound variables become de Bruijn indices, so renaming them does not change the representation; unused symbols and hypotheses are removed from the context. This supports reuse after proof reorganization, moving a step or removing and later reinserting it. Status can also be queried without launching proofs (Q23). The paper describes the mechanism but gives no hash-collision theorem, implementation-level soundness proof or controlled cache benchmark. Correct reuse depends on the representation preserving all relevant logical dependencies. This record did not inspect the fingerprint implementation. The backends described are Isabelle/TLA+, Zenon and SMT solvers. Default attempts use Zenon, then Isabelle; the SMT route translates obligations into SMT-LIB for CVC3, with native Yices/Z3 alternatives. Isabelle is the most trusted backend. Zenon can emit Isar proofs that Isabelle checks. The paper says certification of SMT proof traces is future work, so a successful SMT result should not be silently counted as Isabelle-certified evidence in this article (Q3,Q15,Q27). The trusted components also include translations and critical Proof Manager transformations such as distributing prime through addition. Users can disable fingerprints and reprove obligations, which addresses cache reuse concerns without removing the other trust dependencies. The authors further warn that an incorrect target formula can make a proof meaningless and that incorrect assumed mathematical facts can invalidate an apparent result. TLC can test those exact assumed formulas on instances; that supplies error-finding evidence, not a proof of every assumed mathematical statement (Q27–Q28). ## Evaluation and concrete larger cases The evaluation is a worked proof tutorial plus development experience, not a randomized user study or comparative prover benchmark. Its concrete local evidence comprises the 58-state TLC result, the failed/repaired leaf proofs, the 65-line preservation obligation, backend-specific outcomes and the qualitative CVC3 timing. There are no statistical estimates, repeated trials, task success rates, hardware budgets or uniform comparison across proof assistants (Q9,Q13–Q19). Larger uses are named: Byzantine Paxos, the Memoir security architecture, and Pastry lookup/join protocols. These are cited case studies, not complete proofs reproduced in this article (Q20). A cited 1100-line invariance proof has 100 non-leaf steps, illustrating the scale at which the hierarchy acts like nested lemmas (Q22). The claim that 100 conventional linear lemmas would be unreadable is the authors’ judgment, not a measured readability result. The strongest maintenance anecdote concerns Lamport’s Byzantine Paxos proof. He initially spent several weeks over several months on its safety proof while debugging TLAPS. Later he discovered the algorithm lacked the desired liveness property, changed it, repaired small bugs found by TLC, and re-established safety in a day and a half, about 12 hours of actual work. About three quarters of the new proof obligations had already been proved (Q24). This shows reported reuse during a real revision and separately shows why safety does not imply liveness. It does not report a newly checked liveness proof, an exact obligation count, or an isolated speedup attributable solely to fingerprinting. The related-work discussion compares declarative proofs and interface features with Mizar/Isar, reuse with KIV, set-theoretic/refinement approaches with Rodin/Event-B, and high-level specifications with VCC/Why source-code verification. These are architectural comparisons and historical author assessments, not present-day benchmark rankings (Q25). The conclusion also lists proof constructs not exercised in the Peterson example, including existential witnesses, local definitions and facts supplied implicitly to backends. Temporal reasoning and improved sequence support are planned work in the article (Q26,Q29). ## Static artifact findings Both pinned Peterson modules contain the full PlusCal comment, generated actions, candidate invariant, ISpec for inductiveness testing, and two variants of the same safety proof. One variant uses SMT for preservation; the other expands the hierarchy. Both end their top-level theorem with PROOF OMITTED (Q31–Q35). This independently preserves the article’s disclosed checking boundary in a usable example artifact. The source exists; no dynamic proof certificate or successful replay is supplied by this read. The artifact retains ProcSet and uses USE DEF ProcSet, matching the paper’s footnote about a definition inlined in Figure 2. MutualExclusion uses negated conjunction, logically equivalent to the paper’s disjunction. Source leaf proofs often cite Inv, Next and proc(i) directly where Figure 6 cites numbered steps; the explanatory text explicitly permits such fact references (Q7,Q17,Q32–Q35). The FM directory copy differs only by an unused NeverCS predicate and DEF versus DEFS spelling in one leaf proof (Q36 and retained file comparison). Neither difference establishes an algorithm change or runtime failure. The two files remain exact downloaded bytes. ## Contribution to the requested research topics This is directly relevant to formal verification of distributed systems and TLA+: it gives a concrete path from a labeled algorithm to a temporal specification, tested invariant, structured proof obligations, backend checks and maintained proof status. It makes both the specification assumptions and proof-completion boundary visible. Its larger-system anecdotes link those mechanisms to distributed protocols while leaving those cited proofs outside this article’s detailed evidence. It contains no Verus or verified-Rust development, LLM agent, generated-specification benchmark or automatic invariant-synthesis evaluation. Its transferable design ideas are therefore reader proposals: give proof agents explicit sequents and scoped context; use checker feedback to distinguish missing definitions from difficult obligations; split proofs without dropping stuttering or other cases; cache normalized obligations only with valid dependencies; and report omitted steps and certification routes alongside success counts. The article does not measure those proposals with LLMs. Its most useful evaluation lesson is to keep a correct formalization, state-level proof success, temporal completion, liveness, certificate checking and proof-reuse evidence separate.
  • number: Peterson mutual-exclusion example; proof obligations are split among back-end provers
  • limits: Exactly two processes and labeled atomic shared-state interleavings with arbitrary stuttering; no fairness/weakmemory/compiledimplementation correspondence. Reported state-level proof checks leave temporalQED explicitly omitted in2012tools. No liveness proof or fullTLAPSsoundness proof. Larger case studies cited; maintenance/timing evidence is anecdotal.2026modulepin does not identify2012executables.
  • how much was read: most of it read
  • source; notes: T01. Current TLAPS support: distinguish temporal reasoning from automa
  • record id: tlaps-2012
• TRACER symbolic execution verifier (2012)
  • title: TRACER: A Symbolic Execution Tool for Verification
  • what: Presents TRACER, a symbolic-execution verifier for safety assertions in sequential C. It builds a finite overapproximating symbolic tree, learns weak interpolants from infeasible paths to subsume paths, and widens/refines loop invariants for unbounded loops. The paper gives the path-subsumption mechanism based on underapproximated weakest preconditions, unsatisfiable cores and quantifier elimination, then works a guarded increment example where WP reduces an exponential tree to a linear one. For loops it dynamically widens candidate invariants, detects spurious errors, extracts a WP interpolant and restarts; the Windows-driver example shows why the refinement must preserve new != old. The implementation translates CIL programs (including pointers/arrays and alias partitions) to CLP(R), supports SP/WP/CLP interpolation and optional InterProc invariants, and reports proof trees or counterexamples.
  • number: 900-second timeout
  • number: WP s3 client times 61, 115, 338, 80 seconds
  • number: WP s3 server times 33, 120, 37, 27 seconds
  • number: WP reduces symbolic states, e.g. cdaudio 2138 vs SP 4663
  • limits: Targets finite-state safety properties of sequential C and quantifier-free first-order assertions; CLP(R) reasoning is linear arithmetic over reals plus arrays, while WP currently supports only linear real arithmetic. Loop invariant generation is incomplete and may not terminate because candidates come only from propagated constraints, widening is naive and per-candidate (richer subsets would be exponential). If execution does not terminate, safety is not reported; abstraction can yield spurious errors requiring refinement.
  • how much was read: most of it read
  • record id: tracer-symbolic-execution-verifier-2012
• Ufo: A Framework for Abstraction- and Interpolation-Based Software Verification (2012)
  • what: LLVM-based configurable framework for sequential C assertion safety. Computes safe inductive invariant or counterexample using an abstract reachability graph over loop cutpoints. Abstract post, refiner and expansion policy parameterize predicate abstraction, interpolation and combined algorithms. Explains all-inlined SSA preprocessing, explicit repair of uninitialized-variable nondeterminism before compiler optimization, loop-free path encoding delegated to SMT, inductiveness checks and exact differences among three instantiations. Combined method closes an interpolant candidate under abstract transitions, which enlarges its state set rather than merely conjoining stronger predicates.
  • limits: §§1–2: sequential C safety/assertions; formal program model uses transition relation, initial/error formulas and variables. Successful invariant I must include all initial states, be inductive and disjoint from error states. No termination/liveness/concurrency/distributed algorithm proof. §2.1: intraprocedural analysis requires all functions inlined into main and expects SSA via mem2reg. This is not interprocedural verification of unbounded recursion. Other LLVM-source languages C++,Ada,Fortran discussed as potential experimentation, not demonstrated support/semantic coverage or verified Rust frontend. §2: claims preprocessing gives semantically equivalent optimized program; relies on frontend/transforms/SMT and explicit benchmark semantics. No mechanized frontend or end-to-end framework soundness proof here. Certificate is safe inductive invariant for optimized LLVM model, not separately validated proof-carrying binary or certified compiler. §2.1/Fig.2: verification benchmarks interpret uninitialized variables nondeterministically, while LLVM undef optimization may choose values that remove branches. Ufo-specific pass inserts external nondet() initialization before optimizations to preserve intended benchmark choices. Does not establish that every C undefined behavior or memory/integer semantic issue is handled. §2.1: debug information emitted by clang maps optimized counterexamples back to C. Neither reconstructed source traces nor LLVM-source equivalence independently checked here. LLVM native optimizations/compilers are trusted rather than verified in this paper. §2.1–2.2: cutpoint graph summarizes loop-free paths; weak topological ordering schedules inner before outer loops. ARG is a DAG-like unrolling annotated by state overapproximations. SMT compactly encodes potentially exponentially many paths, not a proof of polynomial algorithm complexity or absence of solver blowup. §2.2: abstract post must overapproximate edge successors; refiner removes spurious error paths or reports counterexample; SMT checks invariant certificates. Current interface uses MathSAT5 interpolation and Z3 quantifier elimination. No certificate checker independent of these SMT results or artifact proof replay shown. §3: UD label refers to interpolation-driven exploration of program paths; its abstract post still returns true, the weakest overapproximation. Interpolant annotations are candidate invariants until inductiveness checked; failed guess expands at innermost failing loop. Do not interpret a guessed invariant as certified or UD annotations as concrete-state underapproximations. §3: OD uses Boolean/Cartesian predicate abstraction, uses interpolants to extend predicates rather than directly guessing ARG annotations, and eager expansion recomputes from initial states. Combined uses lazy failure-point expansion with predicate closure from candidate I, obtaining Ip with I⇒Ip, then further interpolation if not safe/inductive. §3: combined method trades fewer refinements against expensive abstract-post computations. Claims it can outperform both OD and UD refer to prior paper [1]; no benchmark table, timings, hardware, solved counts or empirical comparison included in this seven-page tool paper. §§1/3: novelty/first-tool claims and relative power are author assertions. No new formal algorithm theorem/proof, repository execution, scalability study, Verus/Rust/TLA+ implementation or LLM evaluation established here.
  • how much was read: most of it read
  • record id: ufo-a-framework-for-2012
• VDG Slicing Model Checking (2012)
  • title: Model Checking with Program Slicing Based on Variable Dependence Graphs
  • what: Presents a modeling method that slices C source using a variable-dependence graph (VDG), lets engineers choose software/environment boundaries, and converts the slice to Promela for SPIN model checking. A tool automates VDG slicing and C-to-Promela conversion while retaining dependencies across execution paths and interruptions. The case study models diagnosis software and a power IC, injecting an abnormal power-on to power-off transition to represent voltage loss. Slicing the diagnosis-result variable omits a communication driver previously checked independently; model checking finds a timing defect where the IC state changes during power-off and later disagrees with software recognition. The VDG algorithm tracks stack traces and control-flow paths, supports loops and shared variables, and reports successful analysis above 350k logical LOC. The tool exposes concrete limits for pointers and function pointers.
  • number: 35% reduction in total verification time with tools
  • number: slicing 49.2% faster and model conversion 77.4% faster in normalized table
  • number: analysis and slicing under 5 minutes excluding user operations
  • number: one defect confirmed reproducible on the actual controller
  • limits: The method depends on user-selected variables and manually adjusted boundaries; external-environment abstractions can cause false positives/negatives requiring model revision. Input C must be preprocessed; only one variable may be followed through a pointer, loop-controlled pointed variables and function-pointer calls are ignored, conversion is per file, and the tool is not public. Evaluation uses one automotive diagnosis target and two properties.
  • how much was read: most of it read
  • record id: vdg-slicing-model-checking-2012
• Weak Completeness Theorem for Propositional Linear Time Temporal Logic (2012)
  • what: Mizar formalization of finite-premise semantic completeness for propositional linear-time temporal logic with strict future until. Builds finite sets of consistent complete positive-negative formula assignments, a finitely branching infinite successor tree, and a path satisfying every pending until obligation. A model satisfying each consistent pair yields derivability of every valid finite-premise consequence. Records exact strict-until endpoints, finite-premise convention on F, overloaded completion operations and implicit consistent-Q binder, next-state recurrence for positive/negative until, finite label range versus infinite tree, complete-path eventuality requirement and printed theorem/implementation scope. Distinguishes existence theorem catalogue from detailed proof scripts, executable model checker or protocol verification.
  • limits: §1, p.228: A/B/p/q range over LTLB-WFF, M over imported LTL Model, times over naturals. F by global convention is finite set of formulas; theorem33’s unqualified F is therefore not arbitrary infinite set. Semantics/axioms/derivability and closure operators tau/sigma are inherited from earlier Mizar articles16–18 rather than redefined/proved from scratch here. Proposition5, p.228: strict p U q at time i iff exists j>i with q at j and p at all i<k<j. Neither p nor q at current i is required. Immediate successor witness j=i+1 needs no p between. Do not replace with usual nonstrict until requiring p at current time when q occurs later, or allowing q now to discharge obligation. §§1–2, pp.228–230: positive-negative pair P consists of two finite injective formula sequences, first positive and second negative, with rngP combining ranges; associated formula P-hat packages their signed requirements. Exact imported consistency/completeness definitions, closure tau and sigma, and UN syntax not expanded in supplied article. Record uses stated properties without inventing their full formulas. Definition4, p.229: compF enumerates pairs whose combined range equals tauF and whose positive/negative ranges are disjoint; finite/nonempty and complete. Definition5 completionQofP extends both signed ranges and has combined range tau(rngP). Before Definition6 the text resets Q to a consistentPNP; thus compP comprehension ranges over consistent completions. It is not claiming every arbitrary complete extension of a consistent pair remains consistent. compP is finite, and nonempty for consistentP; compX is union of compP over X. §2 propositions15–17, p.230: finite closure admits removable formula induction step; formulas represented by all completions yield derivable disjunction-like negated conjunction of negations. For consistentP, P-hat implies that finite alternatives formula. Source uses enumerations and iterated conjunction notation; no runtime/size bound for completion enumeration supplied. §3, pp.230–231: UN(X) collects imported successor-obligation formula UN(A,B) for each A U B in X. UN(P) packages positive and negative obligations as pairs; for consistentP its members consistent. Next completion compUN(P) is finite/nonempty with consistent complete members. Proposition18 gives derivability of P-hat implies next Q-hat for UN(P) members. This is a logical successor construction, not distributed-process step relation. Propositions21–25, p.231: positive until atP sends positiveUN to successor. For consistent completeP, this entails either Bpositive or both Apositive and untilpositive there. Negative until sends negativeUN; for consistent completeP, this forces Bnegative and at least one of Anegative/untilnegative at successor. Positive eventuality cannot be postponed forever on selected completepath; local recurrence alone insufficient. Definition11/propositions26–29, pp.231–232: tree rootedP, each child enumeration lists all next completions of current label. Consistentroot implies consistentlabels/nonempty successors; complete root implies completelabels. Labels all inside finite sigma-closure of root, so tree has finite nonempty range, but can have infinitely many nodes/depth. Rangeexceptroot finite/nonempty. Proposition29 derives next-invariance of formula representing reachable nonroot label alternatives. §5 propositions30–32/Definition14, pp.232–233: anypath respects negative-until obstruction: at each future targetj Bfalse or an intermediate Afalse. Positive-until eventual witness exists somewhere in nonroot tree; final completepath must arrange all encountered obligations along one path, not merely choose arbitrary successors. Definition14 quantifies every path position and positive until, requiring future B and intermediateA. Existence is registered for consistent complete root. §5, p.233: satisfiability registered for associated formula of every consistentPNP, then theorem33 finiteF semantic entailment=>syntactic derivability. Source summary describes contrapositive satisfiability strategy. Supplied paper omits detailed path selection, model valuation/truth-lemma proof bodies and proof-check trace. No strong arbitrary-premise completeness, decidability/complexity, verified model-checker code or protocol correctness theorem stated. Publication/MML metadata, pp.227–234: MMLLTLAXIO4 version7.14.014.183.1153, author thanks and references establish Mizar development context. Validation reported as formalized theorem publication, not independent artifact replay here. No LOC, checker timings, machine, solver comparison, benchmark suite, extracted executable or LLM evaluation. Other cited formal articles/book not counted as read.
  • how much was read: most of it read
  • source
  • record id: weak-completeness-theorem-for-2012
• AMD-FP-Multiplier (2011)
  • title: Formal Verification of an Iterative Low-Power x86 Floating-Point Multiplier with Redundant Feedback
  • what: Reports production-level formal verification of an iterative low-power x86 floating-point multiplier with redundant carry-save feedback, x87/SSE formats and rounding, using ACL2 theorem proving plus model checking of scheduler properties. Translates Verilog RTL to ACL2, proves behavioral equivalence and bit-level arithmetic invariants, handles clock gating hierarchically, and reuses the proof effort for a second processor generation. The paper details carry tracking, sticky-bit rounding, pipeline constraints, and scheduler verification.
  • number: About 8,500 new custom ACL2 theorems were interactively developed
  • number: Certification took about 11 hours on one machine, or six hours with parallelization
  • number: Verification reused for two instances in a second processor core with little overhead
  • number: Multiplier latency is 2–5 cycles; array is 76 × (27+2) bits
  • limits: The report focuses on multiplication while division/square-root support is only discussed as context. ACL2 proofs require interactive theorem/hint development; model checking covers scheduler properties rather than the full arithmetic datapath. Production details and proprietary tooling constrain reproducibility.
  • how much was read: most of it read
  • record id: amd-fp-multiplier-2011
• conditional model checking (2011)
  • what: Reformulates a failed model-checking run to return a condition Ψ describing the state space verified: the program satisfies the specification as long as it stays within Ψ. Conditions can restrict later runs, preserve partial work after timeout, and combine complementary analyses. Defines condition-aware outcomes, resource/progress monitors, and conditions such as path length, repeating locations, time limits, and assumption automata. Experiments combine CBMC shallow BMC with CPACHECKER explicit-value and predicate analyses, feeding generated assumptions between runs for bug finding, regression checking, and coverage.
  • number: Two pc_sfifo bugs falsified in under 2 s using repeating-location conditions (§IV-A)
  • number: test_locks bugs falsified in under 1 min; transmitter bugs in under 5 s (§IV-A)
  • number: Combined conditional configuration analyzed all programs in 230 s versus 3300 s without the time-limit condition (§IV-B)
  • number: Best pipeline used CBMC, then 10-second explicit analysis, then 15-minute predicate analysis (§V)
  • limits: Software model checking remains undecidable; a condition summarizes verified regions rather than proving the whole program. Effectiveness depends on useful predicates/conditions and tool configurations. Experiments use bounded analyses and benchmark-specific thresholds; conditions can exclude states and leave a residual region requiring another method.
  • how much was read: most of it read
  • record id: conditional-model-checking-2011
• Effectively Nonblocking Consensus Procedures Can Execute Forever - a Constructive Version of FLP (2011)
  • what: # Effectively Nonblocking Consensus Procedures Can Execute Forever: whole paper reading (authored by agents unless marked 🧑) Robert L. Constable’s Effectively Nonblocking Consensus Procedures Can Execute Forever – a Constructive Version of FLP is arXiv:1109.3370v1,15 September 2011. Its frontmatter also gives July 17, 2008, a footnote describing changes through August 2011, and a May 20, 2021 print date. These identify the saved version rather than three independent research results. All 17 pages were read: Sections 1–2, their eight subsections, all lemma/theorem/corollary statements and proofs, Figures 1–7, the One Step Program, acknowledgments and ten references. All five contact sheets and individual4,10,14,16 were inspected. Original, local and official PDFs match. No author code, scientific-result artifact or formal checking tool was executed or loaded. [Evidence: Q0, frontmatter/abstract/dates, PDF pp.1–1; literal spans in quotes.json.] The contribution is a constructive variant of the Fischer–Lynch–Paterson impossibility argument. Instead of only proving that some indecisive run exists, the paper assumes a computable nonblocking witness and explains how to calculate every finite prefix of an infinite indecisive execution. Its distinction is between an existence proof and an effective construction, not a new consensus protocol. Classical nonblocking alone is handled using excluded middle/choice; the stronger effective premise supplies the computational content. Historical claims that earlier proofs lack this construction are Constable’s assessment of the cited work, not a literature-wide priority finding established here. [Evidence: Q1, §1.1, constructive versus classical problem, PDF pp.2–2; Q6, §1.4, full theorem/lemma/corollary summary, PDF pp.5–6; Q12, §2.2, full constructive/classical corollaries, PDF pp.10–11; literal spans in quotes.json.] The model is deterministic binary consensus with crash failures, reliable FIFO message channels and unbounded asynchronous delay. Processes have private state and messages in queues; executions are serialized into individual actions. Fairness requires every message to a nonfailed process eventually be read and every enabled action at such a process eventually be taken. Uniform inputs require the corresponding decision, and all deciding processes agree. The main construction concerns tolerating one failure, although no process actually crashes in its resulting fair run. Randomized termination, known-delay synchrony and Byzantine fault behavior are outside the stated theorem. [Evidence: Q3, §1.2, complete computing/fairness model, PDF pp.3–4; Q4, §1.3, consensus/nonblocking/witness, PDF pp.4–4; Q11, §2.2, CFLP theorem/full proof, PDF pp.10–10; Q12, §2.2, full constructive/classical corollaries, PDF pp.10–11; literal spans in quotes.json.] Constable defines the premise in §1.3: “P is called effectively nonblocking if from any reachable global state s of an execution of P and any subset Q of n − t nonfailed processes, we can find an execution α from s using Q and a process Pα in Q which decides a value v ǫ B.” Effective nonblocking is a total computable function wt(s, Q): for every reachable state s and every chosen set Q of n−t nonfailed processes, it returns a finite execution using Q, its deciding state and a process deciding a bit. This is an existential progress witness, not a promise that every continuation progresses. It is stronger information than an abstract claim that some extension exists. A constructive proof of nonblocking can supply such a witness; the paper cites Nuprl/Coq’s constructive setting and Mark Bickford’s nonblocking formalizations as motivation. It does not present a checked Nuprl or Coq development of this complete CFLP proof. [Evidence: Q4, §1.3, consensus/nonblocking/witness, PDF pp.4–4; Q2, §1.1, Nuprl/Coq and blocking motivation, PDF pp.3–3; literal spans in quotes.json.] The paper’s v-possible predicate asks whether one of finitely many wt(s, Q) results decides v. For one-failure tolerance this can be decided by n witness evaluations, one for each Q_i excluding P_i. That does not decide all possible future decisions. Effective bivalence instead includes explicit finite executions deciding 0 and 1; arbitrary bivalence remains undecidable according to the source. In particular, a witness may choose only 0-valued continuations even when another execution decides 1, so failure to find a 1 in those n selected witnesses does not establish univalence. The construction retains a known opposite-valued path rather than replacing that information by a finite sample of witness answers. [Evidence: Q5, §1.3, v-possible/effective bivalence, PDF pp.5–5; Q8, §2.1, finite witness-decision test, PDF pp.6–6; Q11, §2.2, CFLP theorem/full proof, PDF pp.10–10; Q13, §2.3, initialization/replay and witness independence, PDF pp.11–12; literal spans in quotes.json.] Initialization starts at all-zero inputs and flips one process at a time until all-one inputs. It chooses the first initialization s_k for which some witness decides 1. At s_(k−1), the witness excluding P_k decides 0. Replay that finite execution from s_k: only P_k’s initial state changed and it takes no step, so the other processes still decide0. Together with the 1-witness this constructs a bivalent initial state. With three processes the chain is 000→100→110→111; the first transition revealing 1 supplies the distinguished excluded process. This is ordinary explanatory substitution, not an executed trace. The witness itself need not return identical paths on the two inputs; the proof explicitly uses replay rather than assuming witness extensionality in unseen state. [Evidence: Q9, §2.1, full initialization proof, PDF pp.7–7; Q13, §2.3, initialization/replay and witness independence, PDF pp.11–12; literal spans in quotes.json.] The One Step Lemma takes explicit bivalent paths and a process P_i, and constructs a reachable state b′ with two opposite-valued deciding paths using only Q_i. Its first proof walks backward along a finite 1-path, queries wt at predecessor states and uses agreement to transfer decisions across an isolated P_i action. The commutativity lemma permits executions of disjoint process sets to be replayed in either order while delaying cross-set messages. This depends on the asynchronous message model and on the selected actions remaining executable; it is not a general claim that arbitrary shared-memory operations commute. Figures 1–4 show the two decision branches and commuting diagrams. [Evidence: Q10, §2.1, full One Step proof/Figures 1–4, PDF pp.7–10; Q14, §2.3, both commutativity lemmata/proofs, PDF pp.12–12; literal spans in quotes.json.] David Guaspari’s alternative proof counts P_i actions on one branch of a fork. A fork is a pair of finite paths ending in different decisions; an i-fork has one branch avoiding P_i, and a full i-fork has both branches avoiding it. At the last P_i action, query the witness on Q_i. If its decision matches the branch already avoiding P_i, commutation produces a full i-fork after that action. If it matches the other branch, replace the suffix by the witness path and strictly decrease the number of P_i actions. Finite descent yields the One Step Lemma. The returned path length and witness-running time are unbounded by this paper; the finite descent measures distinguished-process actions, not total execution cost. [Evidence: Q15, §2.3, fork definitions/modification lemma, PDF pp.13–14; Q16, §2.3, alternative One Step proof, PDF pp.15–15; literal spans in quotes.json.] CFLP then cycles through processes and selected enabled actions. Before executing P_i’s action, it obtains a state b′ bivalent via Q_i; replaying the two Q_i decision paths after that action preserves bivalence by commutativity and agreement. If the action was already executed while reaching b′, it is not repeated. Repeating this procedure supplies longer indecisive prefixes while giving each process turns. The source asserts the resulting execution is fair and failure-free. A formal extraction should explicitly enumerate pending messages/enabled actions so process-level round robin also discharges its stronger message/action fairness definition. The printed proof does not give that queue-selection policy or an explicit total function for the n-th output action. This is an extraction/detail obligation, not a counterexample to classical FLP. [Evidence: Q11, §2.2, CFLP theorem/full proof, PDF pp.10–10; Q3, §1.2, complete computing/fairness model, PDF pp.3–4; Q12, §2.2, full constructive/classical corollaries, PDF pp.10–11; literal spans in quotes.json.] The source separates three consequences. A purported deterministic single-failure terminating consensus algorithm supplies the needed nonblocking witness and contradicts the constructed run; §2.2 calls this FLP corollary constructive because its result is a contradiction. Strong FLP instead assumes nonblocking without a computable witness and invokes choice/excluded middle to obtain an infinite run. The Blocking corollary states that a procedure terminating on all failure-free executions must have a reachable state where one process’s failure prevents any decision. That last existence result is explicitly classical; it does not give an automatic algorithm locating the blocking state. Nontermination and a blocked state are different: the constructed run retains deciding continuations throughout. [Evidence: Q12, §2.2, full constructive/classical corollaries, PDF pp.10–11; Q2, §1.1, Nuprl/Coq and blocking motivation, PDF pp.3–3; literal spans in quotes.json.] Printed details need correction before turning this presentation into executable or checked code. The summary’s CFLP statement requires more than two processes, whereas its initialization lemma and FLP corollary use two or more, and the main theorem omits a count restriction; the record preserves that statement mismatch instead of claiming the displayed CFLP statement alone proves the two-process case. The fork proof’s final inequality prints i−len(φ′)<i−len(φ′), a false self-comparison; its preceding lemma correctly compares the new fork with the old one. Figure 7’s One Step Program is informal pseudocode with inconsistent s/S and path/process notation and unstated initialization details. It describes computational content, not a ready-to-run verified adversarial scheduler. [Evidence: Q6, §1.4, full theorem/lemma/corollary summary, PDF pp.5–6; Q11, §2.2, CFLP theorem/full proof, PDF pp.10–10; Q15, §2.3, fork definitions/modification lemma, PDF pp.13–14; Q16, §2.3, alternative One Step proof, PDF pp.15–15; Q17, §2.3/Figure 7, full program/conditions/invariants, PDF pp.15–16; literal spans in quotes.json.] The abstract’s “undefeatable attacker” is an in-principle consequence under the theorem’s premises. The construction needs access to the relevant global state, a correct total witness and control of an asynchronous schedule with arbitrarily long finite delays. The paper reports no network deployment, attack implementation, performance measurement, experimental protocol instance or complexity bound for this suggestion. It does not establish a practical denial-of-service method for protocols whose liveness depends on eventual synchrony or randomness. The full proof is a written mathematical proof; related Nuprl nonblocking work is reported but no complete CFLP proof artifact is provided or audited here. [Evidence: Q0, frontmatter/abstract/dates, PDF pp.1–1; Q2, §1.1, Nuprl/Coq and blocking motivation, PDF pp.3–3; Q11, §2.2, CFLP theorem/full proof, PDF pp.10–10; Q17, §2.3/Figure 7, full program/conditions/invariants, PDF pp.15–16; literal spans in quotes.json.] For this database the paper makes progress assumptions explicit and turns a proof witness into a scheduler construction. Reader follow-ups are a TLA+ statement separating fairness, eventual decision and mere existence of deciding extensions; a constructive Coq/Nuprl realization of the witness and finite-descent transformation; Verus/Rust proofs of finite path replay, FIFO state updates and witness-interface contracts; and LLM proof-agent tests that distinguish selected-witness decidability from bivalence, constructive output from classical existence, and unbounded computation from a measured attack. No Verus, verified Rust, TLA+ model or LLM evaluation is reported in this source. [Evidence: Q4, §1.3, consensus/nonblocking/witness, PDF pp.4–4; Q5, §1.3, v-possible/effective bivalence, PDF pp.5–5; Q11, §2.2, CFLP theorem/full proof, PDF pp.10–10; Q16, §2.3, alternative One Step proof, PDF pp.15–15; Q12, §2.2, full constructive/classical corollaries, PDF pp.10–11; literal spans in quotes.json.]
  • limits: Deterministic Boolean consensus; reliable FIFO asynchronous message passing; one-crash tolerance; total computable progress witness for each reachable state and permitted surviving subset; explicit finite opposite-decision paths. The construction assumes global-state and scheduling access. Fair action/message enumeration and productivity require explicit extraction details; printed process-count and pseudocode discrepancies remain qualified.
  • how much was read: most of it read
  • source
  • record id: effectively-nonblocking-consensus-procedures-2011
• Fully symbolic timed automata model checking (2011)
  • title: Fully Symbolic Model Checking for Timed Automata
  • what: Introduces finite state machines with time (FSMT), a fully symbolic representation combining real-valued clocks and Boolean state variables, and a backward reachability model checker using LinAIGs. It gives translations from timed automata with integer variables into FSMTs under ordinary interleaving and a conflict-aware parallelized interleaving semantics. Defines TA semantics with clock invariants, bounded integers, guards, resets, assignments and synchronization, then FSMT transition/reset/invariant predicates. The symbolic algorithm computes predecessor sets with Boolean/linear constraints and Weispfenning–Loos quantifier elimination. The parallel encoding adds self-loops and read/write-enable inputs so independent component transitions can be taken together while preserving intermediate states; read/write and write/write conflicts on clocks and integers force interleaving. The construction handles synchronization by conjoining partner guards and computes global invariants and state-bit transitions.
  • number: LinAIG representation
  • number: 16-core AMD Opteron 2.3 GHz, 64 GB RAM
  • number: 3 CPU-hour and 2 GB memory limits
  • number: critical-region: 17 processes solved
  • limits: Clocks evolve synchronously at rate one; integer variables are bounded and assignments are restricted in the prototype. The TA system assumes binary synchronization channels and finite components. Prototype verifies safety properties only (although the framework could support TCTL); no symmetry reduction is used. Parallelized interleaving is sound only after conflict analysis, and extra read/write-enable inputs can hurt performance.
  • how much was read: most of it read
  • record id: fully-symbolic-timed-automata-model-checking-2011
• Futa Okazaki Shidama RLVECT_X integer spans 2011 (2011)
  • title: Formalization of Integral Linear Space
  • what: Futa,Okazaki andShidama formalize integer-coefficient spans inside an existing real linear space. They establish additive/integer-scalar closure,small-generator and translated-set characterizations,finite-sequence witnesses,equivalence of set and nonempty-sequence spans,idempotence,and preservation of the enclosing real span. Distinguishes the integer span subset from a real vector subspace or a geometrically discrete lattice. Records finite-support and sequence-length constraints,one-way intersection inclusion,nonempty guards for sequence/set equivalence,and the implication from equal integer spans to equal real spans without reversing it. LLL and cryptography are motivation,not algorithms or security theorems proved here.
  • limits: MML RLVECT_X version7.11.07 4.156.1112. The Summary motivates integer coefficients by lattice problems,LLL basis reduction and cryptography; no LLL algorithm,reduced-basis bound,shortest-vector method orcryptographic security statement appears among the numbered results. The funding footnote names JSPS KAKENHI22300285 (p.61). Results1–3 are real-linear finite-sum identities: add/subtract sequences of equal lengths and commute real scalar multiplication with summation. They support later coefficient constructions; they are not statements restricted to integer coefficients (p.61). Definition1 scales a linear combination pointwise by integer i. Definition2 LinZ A is the set of sums of finitely supported real linear combinations l of A whose entire coefficient range lies in Z. The ambient V is an arbitrary real linear space; A need not be finite,independent,nonempty or a geometric lattice basis. The result is a subset of V,not a new arbitrary abstract Z-module structure (p.62). Results4–7 reconcile scalar-action notation and prove that integer coefficient ranges survive combination addition,integer scaling and the zero combination. Results8–13 put LinZ A inside the real span,close it under addition/integer scaling,include zero and all generators,and establish monotonicity in A (p.62). Result14 gives LinZ(A∪B)=LinZ A+LinZ B,where right-hand addition means all pairwise vector sums. Result15 gives only LinZ(A∩B)⊆LinZ A∩LinZ B. Equality of intersections is not a theorem and fails in general (p.62). Results16–24 give exact membership formulas for one,two andthree generators and their translates v+LinZ{…},plus inclusion of each generator. Integer coefficients are unrestricted and may be negative orzero; no uniqueness or independence of generators is assumed (p.62). Result25 characterizes x∈LinZ A using finite sequences g1,h1 and an integer-valued coefficient sequence a1 of equal lengths,range g1⊆A,and h1_i=a1(i)g1_i,with x=sum h1. Generators may repeat,so this is a finite witness rather than an ordered basis or unique decomposition (p.63). Definition3 overloads LinZ for a finite vector sequence f,requiring coefficient and scaled-vector sequences of exactly len f. Result26 restates membership;27 closes under a x+b y with integer a,b. Results28/29 establish sums of all-zero and single-nonzero-entry sequences. Results30/31 include each indexed generator and the sequence range (p.63). Result32 allows an integer combination of elements already in LinZ f to stay in it,with explicit nonempty f and equal lengths of g,h,s. Result33 identifies LinZ(range f)=LinZ f only for nonempty finite f as printed. Definition3/26 themselves allow an empty sequence; extending33 to that case would be a separate deduction rather than its stated scope (p.63). Result34 gives Lin(LinZ A)=Lin A as real subspaces. Result35 closes integer spans under finite integer combinations with equal-length witnesses;36 gives idempotence LinZ(LinZ A)=LinZ A. Result37 says equality of integer spans implies equality of real spans. No converse is claimed (pp.63–64). Reading examples,not printed: in real line V=R,A={2},B={3},integer spans are2Z and3Z. A∩B is empty,so LinZ(A∩B)={0},while the intersection is6Z;15 can be strict. The union span is Z because3−2=1,agreeing with14. Reading examples,not printed: A={1},B={2} have the same real span R but integer spans Z and2Z,so37 is not reversible. For sequence f=(2,2),Definition3 still gives2Z while coefficients are nonunique; repeated generators do not create an independent basis. For A={e1,e2} in R²,LinZ A=Z² is not closed under multiplication by1/2,so it is not generally a real vector subspace. The definitions contain no topology,norm,finite generation ordiscreteness premise. Thus the title and lattice motivation do not justify claiming every represented subset is a discrete lattice,or that bases,rank,freeness oralgorithmic membership are established. Torsion modules not embedded in a real vector space are outside the construction’s stated ambient scope (pp.61–64). All four pages,three definitions,37results/every clause,17references,funding footnote anddate read; sheet and enlarged p.63 inspected. Exact plaintext quotes and labelled formula transcriptions saved. No proof bodies displayed and no formal artifact executed. Paper reports no quantitative proof/automation benchmark ordistributed/Verus/Rust/TLA+/LLM-agent experiment.
  • how much was read: most of it read
  • source
  • record id: futa-okazaki-shidama-rlvect-x-integer-spans-2011-2011
• Graded CTL HSM testing (2011)
  • title: Graded CTL Model Checking for Test Generation
  • what: Introduces graded-CTL model-checking algorithms for hierarchical finite-state machines (HSM/SHSM) that return multiple counterexamples in one run for test generation. Develops bottom-up algorithms for graded temporal operators on HSMs and reduces SHSM checking to HSMs with formula-dependent expansion; derives complexity bounds and discusses use of counterexamples as test benches.
  • number: HSM complexity O(|M|·2^(|phi|·d))
  • number: SHSM reduction size O(|M|·2^|AP_phi|)
  • number: SHSM graded-CTL time O(|M|·2^(|phi|·d·log kbar+|AP_phi|))
  • limits: The models are sequential hierarchical machines; concurrent/communicating machines are left out and may incur double-exponential blow-up. The method is complexity-oriented and reports no empirical benchmark.
  • how much was read: most of it read
  • record id: graded-ctl-hsm-testing-2011
• HMC: Verifying Functional Programs Using Abstract Interpreters (2011)
  • what: Hindley-Milner-Cousots reduces typed higher-order functional-program safety to first-order imperative safety through refinement constraints. Unknown predicates become relations, encoded by mutually recursive first-order functions whose input/output tuples represent those relations. Uses existing ARMC or Interproc analyses to infer safe constraints without user-supplied refinement predicates. Explains polarity of function subtyping, translation of lower-bound constraints into nondeterministic callee blocks and concrete upper bounds into main assertions, and the distinction between constraint satisfiability equivalence and one-way source safety. Higher-order indexed iterator illustrates three-variable bounds beyond octagons. Context-insensitive template merging gives an explicit safe finite-Boolean example the current frontend cannot verify.
  • limits: §2/footnote1: soundness formalization uses core μML and call-by-value small-step semantics; errors arise when primitives receive out-of-domain values. Safety means no finite reduction reaches Err, not termination or total functional correctness. Arrays have pre-specified get/set bounds contracts; assert requires true. §§2.1/2.2: relation variables range over typed base values (integers, Booleans, uninterpreted encodings for richer values); model maps each variable to an n-ary relation. Complex data structures/higher-order flow handled by refinement typing, numeric correlations by backend invariants. Formal source generator and theorem proofs omitted to reference [11]. No language/compiler/backend implementation mechanization claimed. §2.1/Theorem1: satisfiable generated constraints imply source safety. Converse not established and false for the current context-insensitive frontend. §2 p.474 prose briefly says constraints satisfiable if program safe, reversing Theorem1; follow the theorem and explicit §4 incompleteness. Unsafe/unknown backend result therefore need not be a concrete unsafe source execution. §2.2/Theorem2: equivalence is constraint satisfiability iff translated μC safety. μC has local variables, nondeterministic assignments, assumptions, assertions, choice and recursive first-order functions. This is a verification encoding, not a semantics-preserving compiler intended to reproduce original outputs/control flow. §2.2/Theorem3: overall soundness conditional on a sound μC verifier, source constraint generation and translation. Boolean Safe/Unsafe interface defines only Safe implication; an imprecise abstract interpreter may raise false alarms. No end-to-end completeness or guaranteed analysis termination. §2.1: exposition suppresses some unknown refinements and adds nonnegative list length for brevity. Do not interpret the hand-shown templates as the entire automatic generator. Function subtyping reverses the domain flow in c2/c4; ignoring contravariance changes the proof obligation. §2.2/Fig.3: printed generic get/set rules bind/return x despite pattern variable x0, and arity notation varies between number of relation fields and function arguments. Explanatory prose and Figure4 use one fewer input than relation fields and return the value coordinate. A formal implementation needs consistent names/arity; no artifact defect established. §3: prototype uses OCaml Hindley-Milner inference and Dsolve constraint infrastructure; well-formedness/scope constraints convert pending substitutions into parameters, then simplification/constant propagation/resolution. Backend ARMC CEGAR or Interproc/Polka polyhedra; avoids user qualifier lists in these examples, not external semantic contracts or type-system assumptions. §3/Table1: 14 small examples each with manually inserted buggy variant; times for backend analysis of translated program, not clearly total source translation plus verification. No hardware, LOC, repetitions/variance, memory, or numeric DNF cutoff specified. DNF denotes did-not-finish, not automatically a 900-second timeout. §3/Table1: ARMC finishes 13/14 safe and 13/14 buggy; heapsort neither. Interproc analyzes all 14 variants but false-alarms on three correct programs (heapsort,lock,sum-acm-m), so proves 11/14 safe. Buggy-case times are analysis outcomes, not a documented source-trace reconstruction or false-alarm precision study. §4: single template per monomorphic function merges call contexts and loses information even with finite Boolean values. Refined intersections plus finite-state backend could recover finite-state completeness in a different generation strategy; omitted from implementation because constraints may grow super-exponentially. Not a general complete verifier for infinite-state higher-order programs. §§1/3: “competitive” with DepCEGAR is author comparison, but this table has no DepCEGAR column, common hardware/budget protocol or significance study. Generic applicability to other source systems/mutable-state languages is a proposed constraint-level extension, not a demonstrated verified Rust/C/concurrency frontend.
  • how much was read: most of it read
  • record id: hmc-verifying-functional-programs-2011
• Kartzow dissertation on pushdown model checking (2011)
  • title: First-Order Model Checking on Generalisations of Pushdown Graphs
  • what: Develops decidability and complexity results for first-order (FO) model checking on infinite structures arising from higher-order software models. It proves tree-automatic representations for level-2 collapsible pushdown graphs with regular reachability and L-mu predicates, FO decidability for nested pushdown trees, a new higher-order nested-pushdown-tree hierarchy with a level-2 algorithm, and decidability of FO extended with counting, infinity, and Ramsey quantifiers on automatic structures. The thesis supplies the constructions behind each theorem: encodings of level-2 stacks into trees; regular reachable configurations, stack operations and reachability predicates; product constructions combining automata and L-mu predicates; locality/Ehrenfeucht-Fraisse and pumping arguments for nested pushdown trees; relevant-ancestor equivalences and small-witness algorithms for higher-order nested trees; and tree-comb/Ramsey reductions. It proves a nonelementary lower bound for FO on level-2 collapsible pushdown graphs, gives 2-EXPSPACE bounds for nested trees, and includes an appendix reducing the Turing-machine halting problem to L-mu model checking on a bidirectional half-grid. The work is mathematical proof and automata construction, not an empirical tool evaluation.
  • number: Theorem 3.0.1: the FO theory of level-2 collapsible pushdown graphs expanded by regular reachability and Lµ-definable predicates is decidable; the following paragraph extends the logic to infinity, modular counting and Ramsey quantifiers
  • number: Theorem 3.0.2: FO(REACH) model checking on nested pushdown trees is decidable; plain FO has structure complexity EXPSPACE and expression/combined complexity 2-EXPSPACE
  • number: Theorem 3.0.3: FO model checking on level-2 nested pushdown trees is decidable; the preceding EXPSPACE/2-EXPSPACE bounds do not apply to this theorem
  • number: Theorem 3.0.4: FO(∃∞, ∃mod, (Ram_n)n∈N) theory of tree-automatic structures is decidable
  • limits: Structures are finitely represented transition/configuration graphs or trees of pushdown systems; the main positive automaticity result is for level 2 collapsible pushdown graphs and stated regular/L-mu expansions. Level 3 collapsible pushdown FO model checking is undecidable, so the technique does not extend generally. Nested-tree complexity bounds are upper bounds, and the automatic FO procedure has nonelementary complexity. Ramsey results assume tree-automatic presentations. The appendix explicitly uses deterministic Turing machines and standard undecidability assumptions.
  • how much was read: most of it read
  • record id: kartzow-dissertation-on-pushdown-model-checking-2011
• Kratos (2011)
  • title: Kratos – A Software Model Checker for SystemC
  • what: Kratos verifies SystemC safety assertions through two paths: sequentializing the design into C and applying lazy predicate abstraction, or retaining threaded C and using ESST, which explicitly explores scheduler states while symbolically abstracting threads. The tool integrates NuSMV and MathSAT and offers POR, multiple abstraction/transition encodings, translators, and under-approximate bug hunting. SystemC2C/Pinapa produce sequential or threaded C. Sequential analysis builds an abstract reachability tree; ESST builds an abstract reachability forest (one ART per thread) with an explicit scheduler and primitive executor. CEGAR refines predicates from unsat cores/interpolants. Kratos supports SBE/BBE/LBE CFA encodings, DFS/BFS/topological expansion, cone-of-influence reduction, dead-code elimination, persistent/sleep-set POR, Cartesian/Boolean/hybrid/structural abstraction, SMV translation, and PROMELA/SPIN under-approximation.
  • number: Paper states ESST outperformed all sequential-analysis approaches on considered SystemC benchmarks; sequential analysis was better on most pure-sequential benchmarks, but gives no counts/timings
  • number: Architecture supports multiple CFA encodings and POR; no runtime/memory values are reported in this 7-page tool paper
  • number: Experimental comparison is explicitly deferred: ‘results … can be found in [9]’
  • limits: Safety is expressed as program assertions. Concurrent analysis assumes a cooperative scheduler with exactly one exclusively running thread per schedule, but it is scheduler-agnostic beyond that. Actual primitive-call arguments must be statically known. At publication, data structures, arrays, and pointers are treated as uninterpreted functions and bit-precise operations are unsupported. Detailed comparative benchmark results are deferred to reference [9], so this tool paper reports no numeric table.
  • how much was read: most of it read
  • source
  • record id: kratos-2011
• mDPi contract monitoring (2011)
  • title: Distributed System Contract Monitoring
  • what: Introduces location-aware mDPi process calculus and labelled transition systems for orchestration, choreography and migrating monitors; translates regular-expression contracts into monitors and reasons by weak bisimulation. Formal syntax for located processes/traces/monitors, tagged preLTS with filter functions, monitor equivalence examples, hospital records case and c1/c2 event case, three compilation strategies ψO/ψC/ψM, witness bisimulation claim for arbitrary expressions.
  • number: three monitoring strategies
  • number: equivalences (8)–(10) using weak bisimulation
  • number: 15-page EPTCS paper
  • limits: No global clock; autonomous communicating subsystems with local memory and slower remote communication; traces record discrete outputs with local monotone counters. Monitors in examples sound but incomplete due to distributed timing; migration requires trust infrastructure. Erlang implementation is future work, so no measured evaluation.
  • how much was read: most of it read
  • record id: mdpi-contract-monitoring-2011
• Pąk MATRTOP2 row spans affine coordinates 2011 (2011)
  • title: Linear Transformations of Euclidean Topological Spaces. Part II
  • what: Pąk connects Euclidean-space and algebraic vector-space representations, identifies a matrix map’s range with its row span and its coefficients with ordered-basis coordinates, extends independent rows to an invertible matrix, and proves preservation of linear/affine independence and barycentric coefficients under full-row-rank maps. Records duplicate-row coefficient grouping, the distinction between a row list being a basis and merely having distinct entries, equal cardinality versus equal sets in22, and inverse image versus an inverse function in26/27. Tracks all representation, rank and affine-hull guards rather than claiming a general continuity theorem from the Summary.
  • limits: MML MATRTOP2 version7.11.07 4.156.1112. The Summary describes support for continuity of barycentric coordinates; the numbered statements here establish algebraic/representation facts and coefficient invariance, not an explicit standalone continuity theorem. PartI is cited as reference16 and separately read as formal823 (this article pp.109–112; PartI pp.103–108). The shared convention is n,m,k natural, f an n-element real-valued finite sequence and M an n×m real matrix. Using the imported row-vector map convention, T=Mx2Tran M maps R^n→R^m. Shape/rank criteria are about rows, not the transposed column-vector convention (p.109; PartI). Results1–7 transport linear combinations, supports, scalar-weighted sequences, sums, span carriers and linear independence between E_T^n and the algebraic n-dimensional real vector space when the represented objects are equal. These are representation equalities, not arbitrary isomorphisms of unrelated spaces. Results8/10 restrict combinations to subspaces;11 transfers which objects are combinations across subspaces with equal carriers;12 assumes equal represented combinations L5=L6 and transfers their supports/sums,without an equal-carrier premise (pp.109–110). Result9: combinations supported in the same linearly independent set and having equal sums are equal as combinations. Equality of sums alone does not imply unique coefficients when the support is dependent. The finite-dimensionality registration applies to spans inside an m-dimensional vector space (p.110). Result13 makes the whole row list M an ordered basis of its row span if rank(M)=n. Result14 transports a combination’s sum under a linear map T if T restricted to its indexing set A is one-to-one. The injectivity premise prevents distinct indexed vectors being merged without coefficient handling (p.110). Result15 handles repeated rows: choose S⊆Seg n containing one representative for every distinct row. The combination of distinct rows representing fM assigns each representative the sum of coefficients f(j) over all occurrences of that row. Result16 specializes to no repeated row, giving its individual coefficient f(k). Distinct rows still need not be linearly independent, so16 alone does not give uniqueness (pp.110–111). Result17 recovers f as the ordered-basis coordinate tuple of Tf under the explicit premise that B=M is an ordered basis of the row span. It does not assert arbitrary matrix rows form a basis. Result18 identifies the whole range of T with the carrier of the row span, without requiring full rank (p.111). Result19 extends a one-to-one finite sequence F with independent range in E_T^n to the initial rows of an invertible square n×n matrix. Result20 describes the span of a prefix of the standard basis by zero padding f restricted to k; natural subtraction n dotminus k saturates at0. For k>n the prefix is the whole basis and the equality reduces to f=f. Result21 maps the standard coordinate subspace of dimension len F onto span(range F) using that invertible extension (p.111). Result22 visually has |A|=|B|, shown by double overbars, lost in text extraction as A=B. For two linearly independent subsets of equal cardinality in the same ambient E_T^n, there is an invertible matrix carrying span(A) onto span(B). It neither assumes the sets are equal nor prescribes a particular pointwise matching of their elements (p.111). Results23/24 assume rank(M)=n, so T is injective even when n<m; they preserve linear and affine independence of arbitrary source subsets. Result25 additionally takes affine-independent A and v∈Affin A, sends v into Affin(T[A]) and equates each barycentric coefficient at f with the image coefficient at T(f). The quantified f ranges over all source vectors, not only members of A (p.111). Results26/27 take an independent/affine-independent subset A of the target E_T^m and assert the same for T inverse-image A under rank(M)=n. This is set preimage; no globally defined inverse, surjectivity or requirement A⊆range(T) is present. Points outside the range simply have no preimage (p.111). Reading examples, not printed: M with rows(1,0),(1,0) and f=(2,3) sends f to(5,0);15 assigns coefficient5 to the single distinct row. Distinct rows(1,0),(2,0) remain dependent, illustrating why16 differs from17. For n=2,m=3 with rows(1,0,0),(0,1,0), T(x,y)=(x,y,0) preserves barycentric coordinates while not onto. Reading example, not printed: A={(0,0),(1,0),(0,1)}, v=(1/4,1/2) has barycentric weights(1/4,1/4,1/2); the embedding into z=0 preserves those weights. Target affine-independent points outside that plane can be absent from the preimage in27. Equal-cardinality independent sets A={e1},B={e2} are unequal but22 applies via a coordinate swap. All four pages,27results/every clause,registrations,25references anddate read; contact sheet and enlarged p.111 inspected. No proof bodies or new definitions are displayed. Exact quotations retain extraction typography, with separately labelled formula transcriptions for cardinality and map notation. Formal artifacts were not executed. No proof-size/time or automation benchmark, distributed/Verus/Rust/TLA+/LLM-agent experiment is reported.
  • how much was read: most of it read
  • source
  • record id: pa-k-matrtop2-row-spans-affine-coordinates-2011-2011
• Pak MATRTOP1 real matrix maps 2011 (2011)
  • title: Linear Transformations of Euclidean Topological Spaces
  • what: Pąk defines the continuous Euclidean map represented by a finite real matrix using row-vector multiplication. It preserves vector and matrix arithmetic, translations and block decompositions. Full row rank characterizes injectivity; full column rank characterizes surjectivity. The article supplies upper norm estimates for every map and lower estimates for injective maps, then registers maps of invertible square matrices as homeomorphisms. Records row-vector orientation, explicit zero-dimensional branches and guards, rank versus determinant criteria, and the distinction between rectangular injectivity and invertibility. Captures permutation, selection and block lemmas behind the transformation interface. Flags an apparent missing dimension guard in the printed identity-prefix statement without alleging a failed formal checker.
  • limits: MML MATRTOP1 version 7.11.07 4.156.1112 identifies the article. Matrices in the main construction are over the real field and dimensions are natural numbers, including zero. Earlier rank-completion facts allow an arbitrary field. These finite-dimensional results do not assert continuity of arbitrary linear maps between infinite-dimensional normed spaces (pp.103–107). Definitions 1/2 retype identical finite sequences between real values and elements of the real field. Preliminaries 1–5 handle addition, coordinate square roots, concatenation, absolute values and a square-root sum inequality for nonnegative entries. Result 6 selects an injective restriction of a function with the same range. Registrations preserve sign predicates under restrictions and numeric sequence types under deletion/reindexing (pp.103–104). Results 7–10 relate deletion or restriction followed by sequence enumeration to permutations, preserving complex sums. Results 11–13 distribute selection through shifts/concatenations with explicit index and length conditions. Result 14 counts rows remaining after deletion by truncated subtraction of the number of deleted row occurrences. Result 15 commutes column selection with row reindexing. These imported sequence operations must not be replaced by unordered set selection that loses duplicates (pp.104–105). Result 16 completes a full-row-rank n×m matrix by m−n rows to an m-rank square matrix. Result 17 dually appends n−m columns to a full-column-rank matrix to obtain rank n. The displayed subtraction is truncated natural subtraction; the rank hypotheses imply the necessary dimension inequalities. No algorithm, complexity bound or preferred completion is specified (p.105). Definition 3 maps E^n to E^m for an n×m matrix M by extracting the row of LineVec2Mx(f) times M when n≠0. If n=0 it returns the zero point of E^m. Thus f is a row vector and output coordinate i is its dot product with column i (18). Do not substitute the usual column-vector formula Mf without transposing shapes. Results 19/20 identify the standard ordered-basis representation; 21 permits simultaneous row/input permutation (p.105). Results 22–29 give additivity, real homogeneity, subtraction, pointwise arithmetic under matrix addition/scaling and preservation of zero. Results 30/31 commute image and inverse image with the corresponding translations, without requiring injectivity. Result 32 gives T_B composed with T_A=T_(AB), under the printed shape conditions and the guards n=0⇒m=0 and m=0⇒k=0. These guards address empty-matrix representation conventions and must not be silently removed (pp.105–106). Results 33/34 identify the identity matrix map and prove equality of same-shaped transformation functions implies equality of matrices. Results 35/36 split row blocks, including zero padding or adding the two component outputs. Result 37 turns column concatenation into output concatenation, with n=0⇒k+m=0 explicitly required. Row and column concatenation are different operations, even where extraction gives similar glyphs (p.106). Result 38 prints the identity-prefix formula T_(I_m restricted to n)(f) restricted to n=f, with f an n-entry sequence in the standing convention. No n≤m guard is printed. Its usual zero-extension interpretation requires n≤m; if n>m, an m-coordinate output cannot recover an arbitrary n-coordinate f. This is a dimensional presentation concern requiring source inspection, not a claim that the Mizar source accepted a false typed theorem. The record does not use an unrestricted version of 38 (p.106). Results 39/41 say T_M injective iff rank M=n and onto iff rank M=m. For square A, 40/42 express either property by det A≠0. Result 43 identifies the inverse transformation with the transformation of the inverse matrix, under nonzero determinant; the printed inverse-matrix accent is not a transpose. Rectangular full-row-rank maps need not be onto E^m, and full-column-rank maps need not be injective (p.106). Result 44 bounds ||T_M f|| by (sum of Euclidean norms of M’s columns) times ||f||. This need not be the optimal operator norm. Result 45 supplies some strictly positive upper constant, even for the zero map. Result 46 supplies some strictly positive inverse estimate ||f||≤L||T_M f|| only under full row rank. These existential constants are independent, not claimed equal or computed (pp.106–107). Result 47 states continuity for every T_M. The final registration gives a homeomorphism for an invertible square matrix. Reading deduction: additivity plus the upper estimate gives a Lipschitz bound on differences; for an injective rectangular map, 46 makes its inverse on its image Lipschitz. The latter is an explanatory consequence, not a printed claim that every injection is a homeomorphism onto the whole target (p.107). Reading examples, not printed: rows (1,0,0),(0,1,0) define R²→R³ by (x,y)↦(x,y,0), rank 2 and injective but not onto. Rows (1),(0) define R²→R by (x,y)↦x, onto but not injective. The square diagonal matrix diag(2,3) gives a homeomorphism with inverse diag(1/2,1/3), but is not an isometry. These check orientation and the separate rank criteria. All six pages, three definitions, 47 results with all clauses, registrations, 31 references and date read; both sheets and enlarged p.106 inspected. Quotations are exact plaintext extraction excerpts, not typographic facsimiles; separately labelled rendering transcriptions explain selected formulas. This reading did not execute formal artifacts. The paper reports no proof time/size, empirical or automation benchmark, and no distributed/Verus/Rust/TLA+/LLM-agent experiment.
  • how much was read: most of it read
  • source
  • record id: pak-matrtop1-real-matrix-maps-2011-2011
• PFTL frequency logic (2011)
  • title: A Probabilistic Temporal Logic with Frequency Operators and Its Model Checking
  • what: Introduces Probabilistic Frequency Temporal Logic (PFTL), adding bounded time/state-visit frequency operators to CTL*. Gives exact model checking for a CTL-like fragment on finite Markov chains and approximate checking for bounded LTL-like formulas on countable chains. The logic expresses “property holds for more than q fraction of points” over bounded intervals, which PCTL/CSL cannot directly state. Algorithms count visits to subformula state sets, handle BSCC limits and CTMC uniformization, and define stable/limit frequency semantics.
  • number: Finite-state CTL-like fragment exact via matrix/counting methods
  • number: Bounded LTL-like countable-state checking approximate
  • number: Full PFTL automata/model-checking complexity remains open/intractable
  • limits: Full PFTL is intractable; tractable fragments require finite-state or bounded formulas. Approximation is needed for countable chains and continuous time. Frequency semantics can differ between stable and limit interpretations.
  • how much was read: most of it read
  • record id: pftl-frequency-logic-2011
• Quantitative concurrent synthesis (2011)
  • title: Quantitative Synthesis for Concurrent Programs.
  • what: The paper synthesizes a deterministic finite-state concurrent program by resolving nondeterministic synchronization choices in a partial program. A weighted-automaton performance model assigns architecture-sensitive costs to locking, context switches, memory/cache operations; a possibly probabilistic scheduler induces worst- or average-case limit-average objectives. Correctness is specification-free safety such as race or deadlock freedom. The synthesis problem reduces to imperfect-information stochastic graph games and is Nexp-complete; practical solving uses static strategy pruning, MDP strategy improvement, Gaussian elimination for Markov chains, and value-preserving data abstraction. A prototype handles producer-consumer, optimistic concurrency, and two other finite-state patterns. For two producers/two consumers and four cells, fine-grained locking is 19% better when copying costs 100x locking, while coarse locking is 25% better when costs are equal; measured optimistic-concurrency runtime peaks then declines as batch size n grows.
  • number: Nexp-complete for worst- and average-case synthesis
  • number: producer-consumer: 2 producers, 2 consumers, 4 cells
  • number: fine-grained locking +19% when copy:lock cost is 100:1
  • number: coarse-grained locking +25% when costs equal
  • limits: Programs and variable domains are finite-state; thread creation is unsupported; scheduler and performance model are explicit inputs. Correctness covers race/deadlock freedom rather than arbitrary functional specifications, and interleaving semantics assumes one scheduled thread at a time. Worst/average objectives are limit-average/mean-payoff. Results depend on chosen weighted automata and scheduler, so they do not claim universally optimal synchronization; desktop measurements are a sanity check against synthesis trends.
  • how much was read: most of it read
  • source
  • record id: quantitative-concurrent-synthesis-2011
• SLCO ASF+SDF Semantics (2011)
  • title: Prototyping the Semantics of a DSL using ASF+SDF: Link to Formal Verification of DSL Models
  • what: An executable prototype translates SLCO models of communicating objects into configuration-and-step models, then labeled transition systems, then Dot and existing verification-tool formats. Its worked verification is manual graph inspection following a reported mCRL2 reduction; a formal operational semantics and timing analysis remain future work. The paper spells out the intermediate CS language and selected ASF+SDF rewrite rules, including the non-atomic splitting of SLCO transitions, and uses a running lossy-channel example to show translation, visualization, hiding, and branching-bisimilarity reduction. The benefit argued is reuse of LTS tools and efficient term sharing, not a proved semantics-preserving compiler or a measured performance improvement.
  • number: One running two-object communication example, seven figures, nine printed listings; no benchmark suite, runtime, memory measurements, or correctness proof of the translator
  • number: ltsconvert is reported as used to hide labels and reduce the example by branching bisimilarity; the stated property is then judged by manual graph inspection (§4.2, printed p.77)
  • number: CADP BCG/AUT and mCRL2 checks are described as available routes; no supplied temporal formula, checker transcript, or additional verified case establishes that these routes were exercised for a specific property
  • number: Syntax safety and memory/execution efficiency are attributed to ASF+SDF and ATerms; these are qualitative technology claims without measurements here
  • limits: State-space generation repeatedly explores reachable configurations until none is new, so a finite reachable space and adequate resources are needed for termination in practice. Variables include unbounded-looking integers and channels have buffers; no general finite bound is established here. The relation between prototype rules and an independent formal SLCO semantics is not proved. Time-delay analysis is future work. The “exactly two” reception property is stated by inspection after abstraction, without a temporal formula or fairness assumption; infinite lossy behavior must not be silently turned into eventual-delivery liveness.
  • how much was read: most of it read
  • source
  • record id: slco-asf-sdf-semantics-2011
• SOP and SLAP LTL model checking (2011)
  • title: Combining Explicit and Symbolic Approaches for Better On-the-Fly LTL Model Checking
  • what: Introduces two hybrid products for LTL model checking: Symbolic Observation Product (SOP) and Self-Loop Aggregation Product (SLAP), combining symbolic state aggregates with explicit on-the-fly Büchi emptiness checks. SOP dynamically decreases the observed atomic-proposition alphabet as Büchi states advance, generalizing Symbolic Observation Graphs while preserving stuttering-invariant languages. SLAP aggregates consecutive Kripke states compatible with self-loop labels and therefore handles full LTL, including next-time formulas. SLAP-FST adds a forward-search termination optimization. Definitions establish product construction and language-emptiness preservation; implementations wrap Spot, SDD/ITS and LTSmin.
  • number: 7,377 formulas without X and 4,456 with X after filtering (Table 2 groups 3,229/4,048 and 1,108/3,348)
  • number: 120-second timeout and 1.3 GB garbage-collection threshold
  • number: SLAP-FST fastest in 52% of empty/no-X and 31% of non-empty/no-X cases; 74% of empty-with-X and 55% of non-empty-with-X cases
  • number: SLAP-FST had 2% timeout/fail rate on empty no-X and 1% on non-empty no-X
  • limits: SOP is sound only for stuttering-invariant properties (LTL without X); SLAP is more general but depends on self-loop compatibility and symbolic decision-diagram operations. Worst-case aggregate sizes remain exponential. Experiments use finite Petri-net and BEEM models, random formulas and a 120-second timeout, so results measure tool performance rather than proof scalability on deployed distributed systems.
  • how much was read: most of it read
  • record id: sop-and-slap-ltl-model-checking-2011
• Synthia: Verification and Synthesis for Timed Automata (2011)
  • what: Synthia solves safety-controller realizability games over timed automata using BDDs for discrete locations and DBMs for clock zones. Its abstraction/refinement weakens one player and strengthens the other to underapproximate winning attractors. It supports closed-system safety as a special case and emits controller or environment models. Benchmarks compare Synthia 1.2.0 with UPPAAL-Tiga 0.16. Explains asymmetric game semantics, strong nonzenoness, may/must quantifiers, concurrent attractors with opposite approximation directions, guard and location refinement, assumption-prefix requirement semantics, and symbolic optimizations. Includes all 39 benchmark rows, the unsafe Fischer regression, and the distinction between small final abstractions and low runtime.
  • limits: §2: timed game automata must be strongly nonzeno. Bounded integer expressions and parallel composition are supported. Locations include all bounded discrete valuations. Eve, the environment, has priority when both players can move actively; determinacy depends on this asymmetric semantics. §2: Adam controls implementation choices and Eve controls the environment. Safety realizability means that some controller avoids bad states against every environment. Closed models have only Eve moves, reducing analysis to reachability. A winning model does not prove a separately written implementation. §2: a may edge exists from some concrete location in the source to some location in the target. A must edge is available from every source location to some target location. Eve uses must edges and Adam may edges, underapproximating the bad-state attractor. Abstract safety alone is insufficient; refinement continues until no attractor-extending refinement exists. §§2–3: a concurrent procedure weakens Adam and strengthens Eve to underapproximate the safe-state attractor. Optimizations use discrete reachability and bad-location enlargement; DBMs still handle clocks. Detailed algorithm correctness is deferred to [5]. This paper gives no new mechanized theorem or verified checker. §3: requirements are conjunctions of assumptions and guarantees. A violating trace reaches a failed guarantee while every prefix satisfies the assumptions. The clock guarantee ¬in(goal)⇒y≤timeout encodes bounded progress as safety. It does not establish general liveness outside the timing premises. §3: the C++ implementation trusts Boost, CUDD, the UPPAAL DBM library, parsing, refinement and strategy generation. Generated controller XML is a model, not certified Rust code or an independently checked proof certificate. No software was run for this reading. §4: four benchmark families produce 39 parameter/safety rows, rather than 39 independent algorithms. Fischer and CSMA/CD concern closed systems; Robot and Tank are open games. Tank digitizes continuous flow at a parameterized precision, so its result does not establish exact continuous-plant correctness. §4: historical versions are Synthia 1.2.0 and Tiga 0.16, using the UPPAAL 4.1.4 engine for closed properties. Tiga options shown are its best results per row. Experiments use a 2.6 GHz AMD Opteron, Ubuntu 10.04, four hours and 4 GB. Repetitions, variance and ablations are absent; inclusion of controller-output cost is unspecified. §4/Table1: unsafe Fischer takes Tiga 1–5 seconds versus Synthia 2247–2957 seconds or a timeout. Gains on other listed cases are not universal speed guarantees. Small abstractions can still consume 3808 MB or hours; abstract location counts exclude other symbolic-state and computation costs. §4: quadratic Fischer, linear Robot and constant CSMA/CD/Tank descriptions concern the observed final abstractions, not proved runtime complexity. Safe Tank abstract-location counts vary from 29 to 36. Time and memory need not increase monotonically with the parameter. The prior FORMATS 2010 algorithm, website documentation and benchmark models were not independently read or executed. No Verus, Rust, TLA+ or LLM experiment is reported.
  • how much was read: most of it read
  • record id: synthia-verification-and-synthesis-2011
• T HORS (2011)
  • title: Verifying Liveness Properties of ML Programs
  • what: Extends intersection-type model checking of higher-order recursion schemes from safety to Alternation Free Mu-Calculus/CTL, enabling automated liveness checking of higher-order functional programs. T HORS partially evaluates a HORS abstraction, heuristically proposes candidate intersection types, type-checks them, and solves a weak Buchi/parity game to establish acceptance. The paper explains a two-copy complement strategy for non-deterministic automata (termination on yes instances, possible divergence on no instances otherwise), and uses a CPS/resource-access translation for ML programs.
  • number: intercept example verified in 35 ms, order-4 scheme, 2-state automaton, 31-node parity game
  • number: unbounded file example verified in 1 ms, order-4 scheme, 3-state automaton, 17-node parity game
  • number: implementation is an OCaml web tool
  • limits: HORS are finite abstractions of potentially infinite computation trees and the OCaml-to-HORS translation is manual; the paper explicitly says abstraction techniques are not covered. Fairness is imposed for unbounded file reads by excluding infinite reads. Worst-case complexity remains n-EXPTIME by function order, and no broad benchmark or automated front end is supplied.
  • how much was read: most of it read
  • record id: t-hors-2011
• The ins and outs of the probabilistic model checker MRMC (2011)
  • what: Describes MRMC as an explicit-state numerical and simulation backend for finite Markov chains and reward models. Covers PCTL for DTMCs, CSL for CTMCs, reward extensions, and maximum time-bounded reachability for CTMDPs under time-abstract schedulers. Explains compressed-row sparse matrices with separate diagonals and predecessor pointers, graph preprocessing and numerical solvers, explicit model input and interactive probability/property queries. Uniform CTMDPs admit a history-length-based backward algorithm; non-uniform CTMDPs require entire time-abstract histories and can be expensive even for 24 states. Simulation combines terminating runs, regeneration in bottom SCCs and graph preprocessing rather than a fully on-the-fly state generator. Property-driven bisimulation preserves the subformulas needed for the current query, often yielding smaller quotients than preserving all labels. Precise convergence detection for time-bounded reachability monitors probability mass remaining in transient states after making target/failure states absorbing, preventing premature steady-state detection.
  • number: 15 pages; Performance Evaluation 68 (2011), 90–104
  • number: FTWC: 2,373,650 states; 298.67 MB; 24 min 31 s at 50,000 h
  • number: non-uniform scheduling: 24 states; 1,447.37 MB; 11 min 34 s at t=0.4
  • number: property-driven CPS: reported 40–115× speedup
  • limits: Read publication is Performance Evaluation 68 (2011), pages 90–104, with exact DOI printed on page 90. Its tool status describes v1.5 planned for June 2010; many comparisons use v1.4.1, PRISM v3.2 and other historical versions, not current tool capabilities. CTMDP support is time-bounded reachability under time-abstract schedulers, not a full CTMDP logic or all scheduler classes. Numerical results depend on error/iteration settings; simulation produces statistical confidence rather than an unconditional correctness guarantee and assumes the model graph is already available. Reward-model bisimulation excludes impulse rewards. Minimization and data-structure changes can regress performance; the paper reports such cases. Full algorithm proofs and broader experiments are delegated to cited works. Source inconsistencies remain: the introduction pairs continuous/discrete chains with PCTL/CSL in reversed order, while Section 2.1’s table gives the standard DTMC/PCTL and CTMC/CSL mapping; Figure 4/formula labels use threshold 0.99 but prose calls the bound 0.999. No artifact or result was independently reproduced.
  • how much was read: most of it read
  • source
  • record id: the-ins-and-outs-2011
• Threader: A Constraint-Based Verifier for Multi-threaded Programs. (2011)
  • what: C verification tool automatically discovers state predicates and transition predicates for monolithic, Owicki-Gries and rely-guarantee safety proofs. Iterates abstract reachability and recursion-free Horn-clause refinement, comparing the three proof methods on 15 small concurrent programs. Concrete proof rules distinguish state-based interference closure from binary environment relations; pair-specific transition abstractions constrain environment effects while preserving a thread’s locals. Horn satisfiability supplies refinement predicates; unsatisfiability identifies real counterexample evidence under the encoding. Table shows different rule strengths in practice: Owicki-Gries solves three-process QRCU, rely-guarantee uniquely solves See-Saw/Scull, and four-process QRCU defeats all three within budget.
  • limits: §2: CIL frontend accepts N functions representing N fixed parallel threads sharing variables. Recursive functions unsupported; other calls inlined. No demonstrated dynamically unbounded thread creation or parameterized proof over every N. Unbounded context switching is separate from unbounded process count. §2: constraint transition model P=(V,initial,error,rho1,…,rhoN); globals initialized and assert statements define bad states. Each thread relation changes only globals and its locals. Full relation is disjunction of thread relations, an interleaving abstraction. Paper does not supply weak-memory, detailed C pointer/heap/arithmetic semantics, frontend correctness proof or Rust ownership model. §2/Fig.2: all auxiliary state assertions Ri are stated over V, not restricted by definition to only globals plus thread-i locals. They may be non-thread-modular; predicate search can optionally be restricted to favor thread-modular proofs. Strongest solution is relative to the chosen abstraction, not an exact reachable-state computation or strongest expressible invariant of the full language. §2: abstraction begins with empty predicate sets; spurious abstract error triggers Horn query, whose solution adds predicates. No general termination/completeness bound or guarantee that finite refinement succeeds on every safe input. Referenced POPL algorithm details not reproduced here. §2 opening p.412 literally says “If no error state is unreachable then Threader reports that the program is safe.” This reverses the intended condition; subsequent rule R∧error→false and reachability discussion specify absence of reachable errors. Record follows formal safety rule and flags prose typo, not a tool defect. §2 p.415: termination capability asserted with details delegated to reference [8], then under submission. Table evaluates safety, not termination or fairness-dependent liveness. No termination proof, ranking-relation example or termination benchmark provided in this six-page paper. §3/Table1: all 15 programs safe, 18–451 C lines; fixed 900-second timeout. No unsafe-input detection/false-positive study, new bug discoveries, hardware setup, repetition/variance, memory usage or direct external-verifier timing comparison reported. Authors’ lack-of-other-tools statement is not a measured competitive study. §3: mutual exclusion assertions instrumented; See-Saw uses invariants from StInG as assertions. Automatic auxiliary-predicate discovery does not mean specifications or benchmark transformations were automatically generated. Scull is a modeled driver benchmark, not demonstrated verification of every configuration of a whole Linux driver. §3 p.416: broad prose says monolithic cannot cope “for all benchmarks”, but Table1 shows three successes. Read failure as a tendency for harder examples, not literal universal failure. Owicki-Gries inability wording for final examples describes this abstraction/refinement experiment, not a general logical incompleteness theorem. §3: no symmetry reduction, contributing to QRCU scalability limit. Claims applicability to ad-hoc synchronization and code with data races concern the abstract program analysis, not legal raceful ISO C++/Rust executions or memory safety under a weak-memory model.
  • how much was read: most of it read
  • source
  • record id: threader-a-constraint-based-2011
• TLEBDD symbolic model checking (2011)
  • title: Improving BDD Based Symbolic Model Checking with Isomorphism Exploiting Transition Relations
  • what: Presents Transition Locality Exploiting BDDs (TLEBDDs), which represent component transition relations with a reduced BDD plus a mapping list, implicitly encoding unchanged local variables as identity patterns. A specialized AND algorithm combines TLEBDDs without expanding them, with optional immediate abstraction/shift during image computation. The system model is a finite interleaved asynchronous composition whose component reads/writes only shared variables and its own local state. TLEBDD removes identity patterns for other components and shares isomorphic subgraphs across replicated component relations; the mapping list maps reduced to actual interleaved variables. The paper derives recursive AND handling for identity-pattern levels and explains why immediately shifting target variables to from-state variables avoids large intermediate BDDs. It evaluates forward reachability in an adapted Sviss/CUDD checker and separately measures transition-relation construction, comparing ordinary partitioning, identity reduction, and TLEBDDs.
  • number: MutexLocal 8: peak nodes 41,448,929/31,092,345/25,704,013 and times 7:45h/7:10h/51:37m for ordinary/TLEBDD/TLEBDD+immediate shift
  • number: Peterson 7 times out with ordinary and TLEBDD (>24h), but immediate shift verifies in 10:46h with 89,401,785 nodes
  • number: CCP 10: ordinary and TLEBDD time out; immediate shift completes in 12:32h with 67,822,819 nodes
  • number: Transition construction: MutexLocal 2047 uses 3,414,118 TLEBDD nodes while ordinary and identity-reduced forms run out of memory
  • limits: Requires finite-state systems, interleaved asynchrony and transition locality; experiments use replicated components and concatenated variable ordering, one 2.4-GHz Pentium core with 3 GB RAM, and a 24-hour timeout. Gains vary by benchmark: Dining Philosophers has little memory reduction and slight slowdown at 22 components, and future work identifies other orderings/algorithms. The approach is a data-structure optimization, not a new correctness logic; reachability results inherit the checker/model assumptions.
  • how much was read: most of it read
  • record id: tlebdd-symbolic-model-checking-2011
• uc-klee equivalence cross-checking (2011)
  • title: Practical, Low-Effort Equivalence Verification of Real Code
  • what: Presents uc-klee, which automatically gives two C functions symbolic inputs, lazily creates pointed-to data and cross-checks outputs/errors on explored paths; evaluates libc implementations, revisions, compiler optimizations and self-checks. §2 describes an automatic harness that snapshots memory, executes one function, restores original values while retaining constraints, executes the other, then compares escaping results or error type. User wrappers filter invalid inputs or canonicalize allowed output differences, exemplified by isdigit. §3 tracks referents in symbolic shadow memory so low-level pointer/integer casts and symbolic-index accesses work. Output comparison recursively follows return/argument-reachable memory, comparing data and pointer offsets while allowing allocation addresses to differ; unrelated globals are omitted. Lazy initialization handles unbound pointers through unique symbolic objects, constrained addresses, size-doubling from 8 bytes and nested-allocation depth limits. §4 distinguishes instruction coverage from path exhaustion and uses identical-code cross-checking to expose verifier nondeterminism and pointer-tracking defects. Comparing O0/O3 versions exposes a confirmed LLVM 2.6 memmem optimizer defect.
  • number: cross-library 143 checked: 66 verified, 57 different, 15 timeouts, 4 KLEE-limited, 1 uc-klee-limited; at least 7 actual bugs
  • number: revision comparison 203 checked: 84 verified, 20 different, 30 timeouts, 56 KLEE-limited, 13 uc-klee-limited; 2 new bugs and 5 patched bugs
  • number: optimizer comparison 622 checked: 335 verified, 70 differences, at least 1 confirmed LLVM defect
  • number: self-check 622 checked: 335 verified, 12 differences; median coverage 100%
  • limits: Equivalence holds only for the finite explored paths, bounded object sizes/depth, single invocation in isolation, chosen compiler and architecture. If both functions make the same mistake, cross-checking cannot detect it; matching error types count as equivalent even with different root causes. Lazily allocated objects cannot alias existing objects, missing overlap/circular-buffer behaviors; some address constraints cannot be realized. Unbound function pointers are unsupported. KLEE concretizes symbolic allocation sizes and floating-point operands, potentially missing other values; unresolved externals, symbolic external-call arguments, inline assembly and structure returns can make paths unverifiable. Global state is compared only when reachable through returned/formal-argument pointers. Reference behavior and filtering wrappers replace a formal intended-behavior specification, and differences are not automatically bugs.
  • how much was read: most of it read
  • record id: uc-klee-equivalence-cross-checking-2011
• Uppaal CSTA statistical model checking (2011)
  • title: Time for Statistical Model Checking of Real-Time Systems
  • what: Extends Uppaal with statistical model checking for constant-slope timed automata (CSTA), assigning uniform bounded or exponential unbounded delays and racing components to obtain a pure stochastic semantics. The engine simulates discrete-clock runs, monitors bounded cost/time properties, and supports qualitative Wald tests, quantitative Monte Carlo intervals and direct probability comparisons. The paper details CSTA modelling additions (integer, including negative, clock rates; location exponential rates; weighted branching), the run generator and three query forms. It explains stopping runs by invariant-relative bounds or guard delays, and comparison testing without estimating either probability. FireWire leader election compares fast/slow node probabilities and gives a 164 ms minimum reachability; Bluetooth checks reply probability and energy-bounded delay, reporting confidence intervals and energy distribution plots. The implementation also provides interval visualization and exported plots/data.
  • number: FireWire fastest reachability 164 ms
  • number: Bluetooth reply interval [0.866977,0.966977]
  • number: Bluetooth energy interval [0.949153,1]
  • number: Bluetooth slot 0.3125 ms
  • limits: The semantics assumes stochastic delays: uniform when bounded and exponential otherwise, with a race selecting the smallest delay; this removes nondeterminism so SMC applies but does not model arbitrary nondeterministic timed choices. Runs are bounded by time, cost or discrete steps; current monitoring handles a limited cost-constrained temporal fragment and does not yet support nested probabilistic operators or unbounded cost constraints. Results are estimates with user-chosen statistical precision, not exhaustive proofs; Bayesian extension was future work.
  • how much was read: most of it read
  • record id: uppaal-csta-statistical-model-checking-2011
• A Model Checker for AADL (2010)
  • what: COMPASS integrates requirements checking, functional model checking, fault analysis, diagnosis/recovery and probabilistic performance analysis for SLIM, a restricted/extended AADL language. Generates NuSMV/MRMC models and temporal properties; provides trace/fault-tree visualizers and Sigref minimization. Defines nominal/error model separation and explicit fault-injection links, event rendezvous versus typed-data communication, linear hybrid dynamics, observability for ideal diagnosis, requirements satisfiability versus consequence checks, and backend-specific analysis architecture. This is a four-page tool overview without concrete benchmark or theorem results.
  • limits: §2: input SLIM is a selected AADL subset with hybrid additions, not every feature of standard AADL. Components types declare interface, implementations finite-state interaction automata; hierarchy composes software/hardware. Formal semantics via networks of event-data automata (NEDA) referred to paper 5, not defined/proved here. §2: communication through event ports in rendezvous manner; typed data ports include Boolean/integer/real. Real variables with linear time-dependent dynamics model hybrid behavior. Do not conflate with HybridSynchAADL delayed-round communication, bounded asynchronous network equivalence or nonlinear dynamics. §2: nominal model describes normal behavior; separate probabilistic finite-state error model uses error events/rates and propagations. Rate means expected occurrences per time unit, not fault probability per tick. Fault injection explicitly maps errors to nominal effects; guarantees depend on chosen faults, propagation, rates and injection model. §2/3: user defines observable set. Diagnosability concerns whether an ideal diagnoser can identify causes from observations for a specified fault/property. This differs from verification of a particular implemented FDIR component. Expansion uses Identification in §2 and Isolation in §3; preserve technical role without assuming identical algorithms. §3: requirements analysis before system modeling checks logical consistency, compatibility with possibilities and implication of asserted expectations. These are logical quality checks relative to supplied properties, not evidence requirements capture human intent or physical safety completely. §3: property patterns converted to CSL for probabilistic properties and LTL/CTL for functional properties. NuSMV handles BDD/SAT/SMT routes; MRMC probabilities/performance; Sigref bisimulation reduction; RAT requirements. No verified property translation, backend soundness proof, certificate validation or source/binary code correctness claim here. §3: fault trees concern chains of modeled faults leading to hazard; FMEA starts with fault combinations and evaluates effects on properties. Completeness claims are relative to model and algorithm; paper provides no explicit termination/bound or scaling theorem for all systems. §§1/3: industrial aerospace case studies asserted in progress with external reference 4/project site, no names, sizes, timings, fault counts, measured diagnostic coverage, probability values or hardware provided here. Preliminary BDD/SAT performance observation not a quantitative comparison in this paper. §4: authors say paper only overview due length; detailed formal semantics/journal comparison deferred to reference 9. No concrete case proof or experiments reproduced; no current tool availability/license validation or artifacts executed. §4: claims no other listed tool supports all analyses are authors’ contemporary comparison. AADL2BIP simulation/deadlock, ADeS simulation, Cheddar/Furness schedulability described, but no direct empirical comparison. No Verus/Rust/TLA+ or LLM-agent evaluation.
  • how much was read: most of it read
  • record id: a-model-checker-for-2010
• AOGG distributed graph systems (2010)
  • title: Modeling and Reasoning over Distributed Systems using Aspect-Oriented Graph Grammars
  • what: Defines aspect-oriented graph grammars (AOGGs) for modular system-wide policies over graph-rewriting distributed systems, gives an encoding into a single typed graph grammar, and uses AGG critical-pair analysis to detect conflicts and dependencies in aspect weaving. The base model uses DPO graph rules for a client-server system; aspects are rule-level spans with pointcuts, interfaces and effects. Log and security aspects respectively add execution tracing and read/write permissions. Weaving is non-reentrant and ordered, yielding a concrete graph grammar. Encoding operations R1–R3 represent rule spans as typed nodes/edges, and S1–S3 encode concrete rules/advices; the resulting typed graph lets AGG analyze both execution and weaving. In the case study, ExecuteSET/ExecuteGET conflict on shared data, while log/security advices are conflict-free, implying aspect-order confluence for that model.
  • number: four node kinds in base type graph
  • number: two aspects in encoded example
  • number: R1–R3 and S1–S3 encoding stages
  • number: one ExecuteSET/ExecuteGET conflict pair reported
  • limits: The semantics uses nondeterministic rule/match choice and DPO/SPO graph-transformation conditions; aspect order may matter when advices conflict. The encoding’s behavioral relation to the original base system plus aspects is identified as future work. Results are a small illustrative client-server grammar, not a quantitative distributed-system benchmark or proof of general confluence.
  • how much was read: most of it read
  • record id: aogg-distributed-graph-systems-2010
• Array-Based Backward Reachability SMT (2010)
  • title: Backward Reachability of Array-Based Systems by SMT Solving: Termination and Invariant Synthesis
  • what: Develops a declarative SMT-based backward-reachability framework for infinite-state array systems. First-order formulas over separate index/data theories represent states; preimages, safety and fixpoint checks are mechanized with quantifier instantiation. Model-theoretic embeddings and well-quasi-order conditions yield termination results, while a dual invariant-synthesis method is complete under corresponding hypotheses. The paper separates symbolic and semantic tracks, defines array-based transition systems and theory conditions for closure/decidability, presents a tableaux-like calculus, and proves undecidability outside restricted classes. It integrates resource-bounded invariant guessing (index and signature abstraction) with exact backward search, checking candidate invariants before pruning. mcmt experiments cover mutual exclusion, cache coherence, imperative array programs and miscellaneous protocols, comparing default and tuned settings.
  • number: Tables 1–4 report tableaux depth/nodes, deletions, Yices calls, invariants and seconds
  • number: German pfs: 31m01s default vs 30m27s best; 858,184 vs 784,168 SMT calls
  • number: Alternating bit: timeout default, 44.48s best with one invariant
  • number: Max in Array: timeout default, 0.03s best with five invariants
  • limits: Termination and completeness require theory-specific local-finiteness, quantifier-elimination/instantiation and well-quasi-order hypotheses; unrestricted safety and satisfiability are undecidable. Quantified SMT is difficult, and mcmt uses Yices plus heuristic instantiation. Invariant synthesis is theoretically complete but can have a huge finite search space; experiments are on selected translated benchmarks and old hardware, with tuned settings potentially non-global best.
  • how much was read: most of it read
  • record id: array-based-backward-reachability-smt-2010
• aTAM CTL verification (2010)
  • title: Formal Verification of Self-Assembling Systems
  • what: Interprets bounded Abstract Tile Assembly Model systems in CTL and gives a polynomial algorithm for rectilinear systems: either a counterexample to rectilinearity or verification of unique terminal assembly. Partial-order reduction cuts search from exponential to O(n²) for an n×n surface; SMART Petri-net checking runs O(|T|·n⁴). Defines assembly transition systems and CTL encodings for legal tile additions, studies terminality and unique terminal assemblies, and translates TAS simulator files to SMART Petri nets. The work identifies an unusual bottleneck: model-rule representation memory dominates stored state-space/reachability graphs. It proposes a tailored front-end to exploit tile locality and discusses extension toward larger surfaces.
  • number: Search reduced to O(n²) states from exponential (§Abstract)
  • number: Model-checking runtime O(|T|·n⁴), |T| tile types and n×n surface (§Abstract)
  • number: Experiments found rule-representation memory, not state-space storage, as practical limit
  • limits: Verification requires a finite n×n surface bound and focuses on rectilinear TAS; unbounded/infinite assemblies are outside guarantees. Tile binding is nondeterministic but local and error-free in the aTAM abstraction. Unique terminal assembly does not establish biochemical realization or robustness to kinetic/errors. Memory for model rules, rather than state storage, limits current implementation.
  • how much was read: most of it read
  • record id: atam-ctl-verification-2010
• CoVer static partial-order reduction (2010)
  • title: Efficient Reachability Analysis of Büchi Pushdown Systems for Hardware/Software Co-verification
  • what: Proves a static partial-order reduction preserving reachability when combining a finite hardware Büchi automaton with labeled pushdown software, implements it in CoVer, and checks two original Windows C drivers against manually written device models. §3 defines enabledness, indistinguishability, independence and commutativity for hardware/software transitions. §4 converts the product into a standard pushdown system; its SensitiveSet retains the initial software head and heads reached after dependent transitions. Algorithm 1 removes asynchronous diagonal transitions and allows hardware-only steps only at sensitive heads, while retaining synchronous transitions and software steps. Theorem 1 proves reachability preservation by moving a removed independent hardware step backward to the last sensitive point; the reverse direction follows from transition-set inclusion. §4 analyzes reduction size and warns that a giant symbolic transition rule defeats reduction. §5 translates this to synchronization points after register access and where interrupt effects matter. modelC describes bounded-register, static-memory hardware transactions; CoVer instruments original driver C with hardware execution loops at those points, then uses SLAM abstraction/refinement and SLIC safety rules. §6 reports four PIO-24 and three Ethernet bugs, with examples of inconsistent global I/O status, interrupt storms and a successful-return flag despite device initialization failure.
  • number: PIO-24 driver 1724 lines/model 1232 lines; Ethernet 14406 lines/model 3518 lines
  • number: 7 properties proved and 7 previously undiscovered bugs reported across 14 selected checks
  • number: PIO-24 InvalidRead 589.4s/132MB without vs 91.3s/66MB with reduction
  • number: PIO-24 IsrCallDpc timeout vs 700.5s/218MB
  • limits: Reachability/safety properties only; Büchi acceptance is unused and nondeterministic unbounded delay loops do not establish liveness. Hardware is a manually specified transaction-level model derived from interface documents, not verified RTL. Transactions are atomic to software and terminating; ISRs are atomic relative to lower-priority routines, with interrupts suppressed while one ISR runs. Driver statements are assumed preprocessed to be atomic from hardware’s view. Hardware integers are bounded and its global state has no dynamic allocation. Correct dependency/synchronization-point identification and faithful device/interface/harness models are required. Original driver code is analyzed, but claims are conditional on these abstractions and SLAM/tool correctness. Two sample drivers and selected rules do not establish complete driver correctness.
  • how much was read: most of it read
  • record id: cover-static-partial-order-reduction-2010
• Directed Proof Generation for Machine Code (2010)
  • what: MCVETO combines concrete traces and symbolic overapproximations to find a target-reaching input, prove target unreachable, or fail to terminate. Builds instruction-level disassembly and nested-word automaton abstraction on demand, supports pointer/byte-memory/bit-vector effects, refines with folded traces and speculative invariants, and explicitly detects executions that violate matched return-address discipline. Explains how feasible traces can refine an overapproximation without SMT/complementation, why guessed invariants require both positive and negative branches, how whole-program nested-word abstractions share interprocedural refinement, and how unvalidated return discipline would make the analysis unsound. Gives concrete language-independent alias-precondition construction and a three-outcome soundness theorem distinguishing acceptable-execution violations from target bugs.
  • limits: §§1–2: safety goal is reachability of a designated target control location. No assumption of precomputed CFG/call graph, source types, fixed alias analysis or protected return/local memory; input is object/machine code without symbol metadata. This is neither arbitrary temporal/liveness verification nor proof of source-to-binary compiler correctness. §2: traces T underapproximate states, abstract graph G overapproximates. Symbolic execution of witnessed prefix plus frontier instruction either generates new feasible input or yields refinement. If no abstract path remains, G is proof; search can fail to terminate. No general termination/completeness guarantee. §§3/3.1: infinite call/return context graph represented finitely by nested-word automata (NWA), closed under intersection. Initial two abstract states classify PC=target versus not; PC is modeled data. Instructions decoded from current memory bytes one at a time during concrete traces, handling instruction aliasing and self-modification rather than assuming static code/data split. §3.1/Fig.5: folding groups equal-PC positions; target surrogate TS covers all unexplored non-target locations and target, with wildcard transitions, alternate unseen branch outcomes, indirect jumps/calls and unfinished traces. Halt goes distinguished rejecting Exit. Omitting these conservative exits would turn tested traces into unsound universal claims. Precise SMC extension deferred to report25. §3.1: trace generalization itself requires no SMT calls or automaton complementation. Overall DPG still calls SMT for path feasibility, refinement and symbolic alias tests; claim is not solver-free verification. §3.2: affine relations from frequently accessed inferred memory locations and strided intervals provide candidate equalities/ranges/congruences. They may miss indirect-write effects. Sound incorporation splits on φ and ¬φ, retains both, and later DPG proves unwanted branches unreachable; candidates are not trusted invariants from observed traces. §3.3: interprocedural refinement shared through whole-program automata; no assumed source local/global split or explicit procedure summaries. Ability to select frontier across procedures depends on policy; closest-target example is a strategy illustration, not dominance or guaranteed avoidance of hard procedures. Detailed automata/transducer/pushdown algorithms deferred to report25. §3.4: instruction semantics supplies symbolic store S′ from identity state; substitute into desired postcondition to compute Pre. Array update/access yields ite conditions; determine definite cases under symbolic state, record alias guard α, simplify ψ′, use α⇒ψ′ as weaker refinement. Concrete-witness variant cheaper but covers fewer states; no claim that all aliasing is statically resolved. §3.4: simplified exposition INT→INT memory/register maps; actual byte memory INT32→INT8 and four accesses per 32-bit word. Byte-precise worked derivation deferred to report25. Requires correct instruction decoder/operational semantics, solver and analyzer implementation; no mechanized verification or proof-certificate validation of MCVETO reported. §3.5: call instructions treated as call positions, ret as returns. Arbitrary machine code can violate this discipline. Auxiliary stack records intended return addresses; acceptable execution (AE) requires nonempty stack and matching processor/auxiliary return address at each ret. Violation is reported as such, not silently excluded or necessarily a target bug. §3.5/Theorem 1: AE violation output supplies actual non-AE input; bug-found supplies AE reaching target; OK implies all program executions AE and target absent during every AE, hence target unreachable. Non-returning jumps into another function not classified solely by source procedure names. This guarantee does not promise a complete target verdict for legitimate nonlocal-return/longjmp code. §3.5 proof: initial accepting PC=target∨V and new internal transition to TS for each ret preserve overapproximation of shortest malformed-return prefixes, of form NWPrefix ret. Without this modification naive matched-return filtering may incorrectly prove safety. Proof sketch rather than mechanized theorem here. §4: TSL instruction semantics and ISAL binary-to-AST definitions generate concrete/symbolic primitives; instantiated x86 and PowerPC. Experiments table is x86 only. Retargetability still depends on accurate supplied instruction semantics, decoder and runtime/environment modeling. §5/Fig.9: 29 small cases,20-minute budget,Windows XP,single core 3.0GHz Xeon,4 GB user process,Visual Studio 8.0 object files. No repetitions/variance, optimization flags, real-world binary scale, concurrency or head-to-head runtime baseline table. Examples selected for low-level complications, not representative corpus. §5/Fig.9: verisec-gxine/simp_ok row outcome says proof but CE/SE/Ref/time all “**”, whose legend means exceeded 20-minute limit. Preserve contradiction; do not count as timed successful proof or silently relabel definitive timeout. Instruction-alias example static instruction count explicitly approximate. §§5–7: large-scale sound binary verification remains future research. Claims of first SMC model checker are author assertions not independently checked. No technical-report appendices, tool execution or reproductions read/performed.
  • how much was read: most of it read
  • record id: directed-proof-generation-for-2010
• Dsolve (2010)
  • title: Dsolve: Safety Verification via Liquid Types
  • what: Introduces Dsolve, which infers Liquid refinement types for OCaml by generating subtyping constraints and solving predicate abstractions with Z3. It verifies array bounds, arithmetic safety, sorting and tree invariants with low annotation overhead and reports inferred types useful for debugging. The weighted_avg example shows higher-order foldn inference: Dsolve infers index bounds for callback f, proves equal positive array lengths, discharges an unreachable assertion and proves nonzero division. The implementation parses a typed OCaml AST, generates template subtyping constraints, and searches conjunctions of user-provided qualifiers; interfaces (.mlq) support modular checking and abstract modules with axioms/uninterpreted functions. Errors are mapped to source lines. The tool found and guided repair of a real vec balancing bug by inferring a balance-factor bound of 4 before the fix.
  • number: array-bound annotation overhead reduced from 17% LOC (DML) to under 1%
  • number: array benchmarks run 1–64 s; bitv is 426 LOC
  • number: data-structure benchmarks run 1–103 s; vec is 343 LOC
  • number: inferred original vec balance factor ≤4 exposed faulty paths and test inputs
  • limits: Inference is restricted to conjunctions of predicates from a finite, user-provided qualifier set, so failure may mean an unsafe program, missing qualifiers or an inexpressible invariant. Dsolve verifies OCaml modules and relies on Z3; whole-program checking uses driver calls unless contracts are supplied. Experiments report runtimes and annotation reductions but no error bars or soundness proof in this short tool paper; abstract modules require user-supplied axioms.
  • how much was read: most of it read
  • record id: dsolve-2010
• Dynamic symmetry reduction (2010)
  • title: Efficient Symmetry Reduction and the Use of State Symmetries for Symbolic Model Checking
  • what: Introduces dynamic symmetry reduction that computes representatives during symbolic exploration, avoiding an exponential BDD orbit relation. Also combines state symmetries with BDD-based reduction and evaluates Sviss on mutual exclusion, locks and readers-writers protocols. The algorithm partitions transition relations by component symmetry, detects orbit representatives dynamically, and optionally computes state symmetries when successor states share labels. Soundness follows bisimulation of quotient structures; experiments show memory/runtime gains over static orbit encoding and CCP cache.
  • number: Sviss with CUDD BDDs on Debian 4.0; memory measured by largest live BDD nodes
  • number: Dynamic reduction gives considerable runtime/memory improvements in mutual exclusion and MCSLock tables
  • number: Peterson dynamic verification finished only through 6 components
  • number: State symmetries computed on-the-fly with negligible runtime overhead in tested cases
  • limits: Requires a known symmetry group preserving transition and labeling; state-symmetry detection adds computation and may fail when labels differ. BDD performance remains instance-dependent; Peterson scales only to six components in reported runs.
  • how much was read: most of it read
  • record id: dynamic-symmetry-reduction-2010
• Linear interfaces for parameterized model checking (2010)
  • title: Model-Checking Parameterized Concurrent Programs Using Linear Interfaces.
  • what: The paper introduces linear interfaces that summarize the effect of an arbitrary block of threads during k-round schedules of Boolean parameterized programs. A compositional fixed-point algorithm computes k-round reachability without enumerating all threads, and a two-player adequacy game checks whether states reachable at k+1 rounds are already reachable at k; if Adam wins, the program is proved correct for any thread count and schedule. The implementation uses symbolic BDDs/Getafix and evaluates predicate abstractions of Linux device drivers interacting with an OS kernel.
  • limits: Programs have Boolean data, finitely many process templates, shared variables, arbitrary finite thread counts, interleaving semantics, and no true dynamic thread creation (dormant threads can model it but creation incurs a context switch). General reachability is undecidable; k-round exploration is an under-approximation. The adequacy game is sound but incomplete because Eve’s one-thread-at-a-time declaration can give her spurious power. Detailed proofs are omitted from the conference paper and supplied in a cited full version.
  • how much was read: most of it read
  • source
  • record id: linear-interfaces-for-parameterized-model-checking-2010
• Metric LTL Real-Time Maude (2010)
  • title: Model Checking Classes of Metric LTL Properties of Object-Oriented Real-Time Maude Specifications
  • what: Gives transformational model-checking procedures for bounded-response and minimum-separation metric temporal properties of flat object-oriented Real-Time Maude models. The transformations add clock-like state and reduce metric checking to invariant/LTL checking through Real-Time Maude search. The paper proves correctness under tick-invariance and time-divergence assumptions, integrates the commands into Real-Time Maude, and applies them to medical-device interoperation and a traffic-light controller.
  • number: Two case studies are reported
  • number: Interlock example uses one time unit as one millisecond and produces counterexample traces
  • number: Traffic example uses 15-second time units; a 15-unit property holds while a 14-unit variant returns a counterexample
  • limits: Termination requires finite reachable state space under reasonable non-Zeno/time-divergence assumptions. Dense-time analyses use a selected time-sampling strategy and therefore inspect only a subset of behaviors; general analyses are not both sound and complete. The method handles only flat object-oriented models and two metric-property classes.
  • how much was read: most of it read
  • record id: metric-ltl-real-time-maude-2010
• MFOTL policy monitor (2010)
  • title: Policy Monitoring in First-Order Temporal Logic.
  • what: Defines an effectively monitorable safety fragment of metric first-order temporal logic (MFOTL): formulas Ψ = □Ψ′ with bounded future temporal operators, arbitrary nesting of metric past and bounded future operators, quantifier alternation, and finite or automatic structures. An incremental monitor rewrites violations into a finite-relation fragment, maintains auxiliary relations for temporal subformulas, queues future obligations, and emits violating assignments online. The algorithm handles events and duration-like states by encoding starts/finishes, supports point-based metric timestamps, and incrementally updates past-since and bounded-future relations rather than recomputing windows. Four concrete policies formalize report approval and anti-money-laundering requirements (threshold reporting, authorization windows, and repeat-suspicious customers). The implementation’s steady-state analysis separates incremental time, mean/max auxiliary-relation space, and relevant active-domain size, exposing formula-structure effects (future operators can delay checks and inflate max space). Automatic structures are available in the broader work, while this paper evaluates finite relations.
  • number: Synthetic event frequencies 110, 220, 330, 440, 550; sample spaces Ω20×20×2000 (P1), Ω1000×25000×2 (P2/P4), Ω1000×25000×2×200 (P3)
  • number: Incremental processing time at frequency 550: P1 39.4 ms, P2 29.6 ms, P3 10.4 ms, P4 7.6 ms
  • number: Steady-state mean space at frequency 550: P1 3,024±331.2, P2 1,725±20.7, P3 579±5.6, P4 1,994±47.8 relation tuples
  • number: Max observed space at frequency 550: P1 4,884; P2 8,714; P3 659; P4 4,360
  • limits: This paper restricts experiments to finite relations and formulas whose negated violation can be rewritten into a syntactic finite-intermediate-relation fragment; domain independence is required for unrestricted infinite domains. Temporal structures use constant domains, rigid constants and monotonically increasing timestamps. It monitors safety properties, not arbitrary liveness; aggregation such as summing a trader’s transactions is outside MFOTL fragment. Synthetic singleton-relations streams and a 1.4 GHz dual-core/3 GB machine limit ecological validity. Formula syntax strongly affects memory/time, and policy enforcement/distributed control are future work.
  • how much was read: most of it read
  • source
  • record id: mfotl-policy-monitor-2010
• Model checking lots of systems: efficient verification of temporal properties in software product lines. (2010)
  • what: Introduces featured transition systems (FTS) to describe software product families and checks regular safety and omega-regular temporal properties for multiple products together. Labels transitions with features and priorities; defines product projection and semantics as the union of valid-product behaviors. Symbolic reachability triples track a state, required features and excluded features. Antichains discard subsumed product sets. Automata-based DFS finds a violating trace and its products; exhaustive search classifies all products. Discusses a SAT-based check for feature-diagram validity and provides theoretical complexity arguments.
  • number: 4 features/4 products; 9 features/64 products
  • number: 457 states; 1306 transitions in shared FTS
  • number: 64-product property (1.1): 57.706 s separately versus 8.162 s together
  • number: MacBook Pro 2.4 GHz Core 2 Duo, 4 GB RAM; average of 3 executions
  • limits: Requires a supplied FTS or parallel FTS model; high-level-language translation and Boolean feature guards remain future work. Ignoring feature constraints may explore invalid products, so validity filtering is required to avoid spurious violations. Evaluation uses one mine-pump model with two variability configurations and naive implementations; it does not establish industrial scalability. Source is explicitly labeled Technical Report and contains the input DOI on its HAL cover.
  • how much was read: most of it read
  • source
  • record id: model-checking-lots-of-2010
• PARAM: A Model Checker for Parametric Markov Models (2010)
  • what: PARAM 1.0 computes rational functions for bounded/unbounded reachability in parametric discrete-time Markov chains, with reward and nondeterministic extensions. Builds an explicit graph, uses property-preserving bisimulation lumping and on-the-fly rational-function state elimination, compiles PRISM-like models to C++ for exploration, shares rational functions globally and caches arithmetic during lumping. Nondeterminism is encoded as extra parameters before Markov-chain analysis; polynomial cancellation delegates to CoCoALib.
  • number: 5,000 C++ lines
  • number: 50×60 = 3,000 parameter instantiations
  • number: about 2.5 million states
  • limits: PMDP analysis is exponential in the number of nondeterministic states. Lumping for PMDPs preserves only maximal reachability. Reported speed/scalability examples are not a broad controlled benchmark; source availability and case studies are author reports.
  • how much was read: most of it read
  • source
  • record id: param-a-model-checker-2010
• PASS probabilistic abstraction refinement (2010)
  • title: PASS: Abstraction Refinement for Infinite Probabilistic Models
  • what: Presents PASS, a tool for concurrent probabilistic guarded-command programs whose semantics may be infinite MDPs. It maintains finite predicate abstractions as stochastic games, computes sound probability intervals, and iteratively refines predicates using probabilistic counterexamples, interpolation or game-strategy diagnostics. The input language extends PRISM with unbounded-range variables, guarded commands and probabilistic updates. SMT enumeration builds BDD-encoded abstractions; reachability and goal pruning use forward/backward BDD analyses; sparse-matrix value iteration yields lower/upper probabilities and witness strategies. Parallel abstraction distinguishes program nondeterminism from abstraction nondeterminism and can tighten intervals. New features include reversed-DFS value-iteration order, interpolation bindings for MathSAT/CSIsat/FOCI, and on-the-fly layer-wise abstraction with incremental SMT solving.
  • number: about 18,000 lines of C++
  • number: SMT + BDD + sparse-matrix value iteration
  • number: MathSAT, CSIsat and FOCI interpolation bindings
  • limits: Results are probability bounds for the abstraction and become useful only as refinement narrows the interval; abstraction quality depends on predicates and interpolation. Value iteration is approximate and repeated after refinement. The paper is a short tool description without quantitative benchmark tables, completeness or runtime guarantees; supported properties are probabilistic reachability and the language/tool implementation is C++/Linux.
  • how much was read: most of it read
  • record id: pass-probabilistic-abstraction-refinement-2010
• POEM timed multistep BMC (2010)
  • title: SAT Based Bounded Model Checking with Partial Order Semantics for Timed Automata
  • what: Extends SAT-based bounded reachability checking for timed automata with multisteps that execute pairwise-independent transitions together. It defines synchronous, semi-synchronous and relaxed time-progress semantics, proves all are equivalent to ordinary timed runs, and implements the encodings in POEM with PicoSAT. The paper formalizes read/write independence, Mazurkiewicz equivalence and timed multisteps, proving via bubble-sort and extraction arguments that relaxed sequences can be reordered to normal-time runs and that all three multistep semantics preserve reachability. It gives SAT clauses for transition effects, dependency conflicts, value maintenance and timestamps, and explains how state invariants require local, reset-induced global and final-state checks. Experiments quantify clause/path-length tradeoffs: synchronous is compact, semi-synchronous often shortens paths, and relaxed can shorten paths further at encoding cost.
  • number: 200-gate NOT circuit: synchronous 4.3s/608K clauses, semi 6.1s/1.5M, relaxed 11.1s/3.8M
  • number: 200-node broadcast: semi 3m09/2.7M/18, relaxed 2m15/4.6M/16
  • number: 20-minute cutoff
  • number: single-core 2.66 GHz Mac Pro with 16 GB
  • limits: Threads use shared/local variables and real-valued clocks initially zero; clocks only reset to zero and guards compare to integer constants. Independence is syntactic reader-writer nonconflict, so hidden semantic dependencies are outside the model. The method is bounded reachability SAT, not unbounded verification; relaxed invariant coding is complex. POEM experiments use one CPU core and small synthetic protocols; the authors report no observed runtime advantage for relaxed semantics and leave SMT and realistic case studies for future work.
  • how much was read: most of it read
  • record id: poem-timed-multistep-bmc-2010
• PPTL probabilistic model checking (2010)
  • title: Probabilistic Model Checking on Propositional Projection Temporal Logic
  • what: Defines a probabilistic model-checking procedure for infinite linear-time Propositional Projection Temporal Logic (PPTL) over discrete-time Markov chains by constructing an infinite-path normal-form graph, adding Rabin acceptance, determinizing it, and taking a product with the chain. The paper gives PPTL syntax and interval semantics, distinguishes finite and infinite normal-form paths, and removes finite paths to form NFG_inf. Its construction algorithm records self-loops and paired Rabin sets to exclude infinite repetition of strong chop; a Safra-style tree algorithm determinizes NFG_inf while merging equivalent PPTL formulas. The product construction labels accepting bottom strongly connected components and reduces formula probability to reachability of accepting BSCCs. A worked p;q chain yields an almost-sure result, illustrating the complete pipeline.
  • number: finite NFG for every PPTL formula
  • number: Rabin acceptance pairs
  • number: product state space S × V_inf(Q)
  • number: worked p;q probability 1
  • limits: Models are discrete-time Markov chains with a finite formula-generated graph and (for the stated theorem) a finite chain with a unique initial state. The paper relies on prior PPTL normal-form and equivalence decision procedures and sketches algorithms rather than reporting an implementation or complexity measurements. Determinization inherits Safra-style state blow-up; only infinite/omega-regular properties are handled in NFG_inf, while finite PPTL paths are discarded for this analysis. The conclusion says an actual probabilistic PPTL model checker is future work.
  • how much was read: most of it read
  • record id: pptl-probabilistic-model-checking-2010
• Replication and Abstraction: Symmetry in Automated Formal Verification (2010)
  • what: Explains how process permutations identify equivalent states, and surveys explicit-state, BDD, SAT and probabilistic implementations, symmetry detection, counter abstraction and partially symmetric systems. Bisimilar symmetry quotients preserve CTL* over symmetric atomic propositions [Q1]. Defines group actions on shared and local variables, including process-identity references [Q3], and conditions on transitions, labels and initial states. Explains representative computation and its graph-isomorphism difficulty [Q2]; multiple representatives preserve information while reducing less [Q4]. Develops symbolic orbit-relation difficulties, on-the-fly selection and dynamic reduction [Q5–Q7]. Reviews Murphi, SymmSpin, TopSpin, SMC, ProB, RuleBase, PRISM, GRIP and BOOM. Separates conservative source-level symmetry detection from semantic checking, and compares ordinary quotients with annotated methods for partial symmetry [Q11–Q12].
  • number: Orbit size can reach n! under full symmetry with pairwise-distinct local states; a fully equal local-state tuple has orbit size one (§3.1).
  • number: No shared variables, full symmetry: number of orbits is binomial(n+l-1,n), where n is processes and l local states (Property 6, visually checked).
  • number: Counter state-space bound (n+1)^l is polynomial in n only with l fixed; local variables can make l exponential (§6).
  • number: 22 concrete versus nine annotated abstract states in one partial-symmetry example [Q11]
  • limits: Correctness requires a valid symmetry action and invariance of relevant transitions, initial states and atomic propositions. Identity-sensitive variables require moving process slots and renaming referenced identities [Q3]. General representative computation can be expensive [Q2]. Fixed underapproximation in one symbolic method may miss reachable states [Q5]; dynamic canonization guarantees require suitable groups [Q7]. PRISM symmetry declarations were user obligations in the surveyed version [Q8]. Counter abstraction needs a program translation and may suffer local-state explosion [Q9–Q10]. Tool status is historical (2010); no artifacts executed. Symmetry for a fixed instance does not alone prove all process counts [Q14].
  • how much was read: most of it read
  • source
  • record id: replication-and-abstraction-symmetry-2010
• Robust GR(1) liveness robustness (2010)
  • title: Robustness in the Presence of Liveness
  • what: Defines robustness for liveness specifications by requiring a minimum number of system guarantees to remain true as environment assumptions fail. It reduces single and multiple counting requirements to Generalized Reactivity (GR) objectives and gives verification and synthesis algorithms for robust systems. The paper develops concrete robustness measures using dining philosophers, formalizes them as ordered sets of GR(1)-like implications, and shows that disjunctions of conjunctions of Büchi objectives can be exponentially simplified to generalized Büchi objectives. It proves DCB game solving co-NP-complete via a 3SAT reduction, then gives a counter-based construction reducing GR(1) games to one-pair Streett games. The construction preserves winning strategies, extends to GR(k), and yields verification and synthesis complexity bounds; synthesized strategies trade lower runtime for larger memory than Zielonka’s method.
  • number: GR(1) verification O(mn|Q|^2|δ|)
  • number: GR(1) synthesis O(|S||E|(mn)^2)
  • number: GR(k) synthesis O(|S|^k|E|(mn)^{k(k+1)}k!)
  • number: DCB game winning strategy problem co-NP-complete
  • limits: Specifications are finite products of deterministic Büchi automata over input/output signals and robustness is measured by counts of assumptions and guarantees, with a user-supplied total order. The model is reactive infinite-play games; liveness violations cannot be detected finitely, so safety guarantees cannot generally be sacrificed in response to a fairness-assumption violation. DCB-to-generalized-Büchi simplification is exponential and DCB game solving is co-NP-complete. The proposed GR(1) algorithm uses O(|S||E|(mn)^2) time but stores (m+1)(n+1) memory states (or n with an extra strategy computation); GR(k) incurs factorial/exponential factors. No implementation benchmark is reported beyond the worked examples and asymptotic analysis.
  • how much was read: most of it read
  • record id: robust-gr-1-liveness-robustness-2010
• Symbolic Model Checking Data Structures (2010)
  • title: On the size of data structures used in symbolic model checking
  • what: Analyzes whether preprocessing the model or temporal formula can make model checking tractable and proves conditional lower bounds on symbolic state representations. The paper models systems as synchronous or interleaved compositions of finite transition systems, reduces from planning, and uses compilability theory. The reductions establish k-arrow-PSPACE hardness/completeness even when one input part is preprocessed into polynomial space: interleaved model checking remains complete for full LTL and hard for the F fragment, while synchronous variants are hard. A separate state-membership problem shows that a polynomial-size BDD for legal initial states would collapse compilability classes; the argument extends to arbitrary decision diagrams whose evaluation lies in a polynomial-hierarchy level. Thus the worst-case blow-up is representation-independent under standard separation assumptions.
  • number: model checking remains k-arrow-PSPACE-hard after polynomial-size preprocessing
  • number: interleaved LTL model checking is k-arrow-PSPACE-complete and remains hard for L(F)
  • number: Theorem 6 rules out always-polynomial BDDs under PSPACE not subset of Pi_2^p intersect Sigma_2^p
  • limits: Results are worst-case and conditional: Theorem 6 assumes PSPACE is not contained in Pi_2^p intersect Sigma_2^p, and Theorem 7 assumes a polynomial-hierarchy separation. The preprocessing output is restricted to polynomial size but preprocessing time is unrestricted. The reduction uses finite Boolean transition systems and LTL (with CTL/CTL* mentioned for representation bounds), so it does not measure a concrete verifier implementation.
  • how much was read: most of it read
  • record id: symbolic-model-checking-data-structures-2010
• Termination Analysis with Compositional Transition Invariants (2010)
  • what: Introduces Compositional Termination Analysis (CTA), replacing repeated expensive whole-program safety checks in Binary Reachability Analysis with ranking of loop-free unwindings and a transitivity check on a disjunctively well-founded candidate transition invariant. Increasing unwinding depth and removing already-ranked transitions permits short terminating fragments to yield a global termination argument. §2 defines transition invariants as supersets of transitive reachable transition closure, and disjunctive well-foundedness as finite unions of well-founded relations. §3 observes a transitive disjunctively well-founded relation is well-founded. Lemmas 1/2 accumulate rankings of increasingly deep, not-yet-covered unwindings and allow skipped intermediate depths; the implementation uses powers of two. Algorithm 1 tracks an overapproximation X of reachable states. A failed ranking produces a candidate nontermination precondition C: reachable C establishes nontermination; unreachable C is removed from X. Thus reachability checking remains where ranking fails rather than in every refinement. §4 slices each loop independently, havocs other loops and assignments depending on five or more variables, and uses CBMC symbolic execution to discover paths in loop-free fragments instead of enumerating all of them.
  • number: 87 drivers ×2 configurations =174 driver benchmarks
  • number: matched nontrivial successful BRA baseline: 99 terminating and 45 nonterminating cases
  • number: 3 GHz Xeon; 2 GB memory limit; 2 h per driver
  • number: precise CTA: average speedup 52; up to 3 orders of magnitude; more than 3× analyzed benchmarks at equal precision under the limit
  • limits: Soundness depends on the rank subprocedure returning a disjunctively well-founded superset or a genuine nontermination precondition, and on valid reachability checks. Finite-state nontermination completeness requires a complete rank procedure, unlike the implemented incomplete engine. Per-loop slicing/havoc overapproximates behavior and can lose termination proofs; practical heuristics replace assignments depending on at least five variables. Evaluations compare identical abstracted slices, not untouched drivers. Baseline is selected from BRA-successfully-analyzed, nontrivial loops, so speedup figures are conditional on that subset. Fast variants skip path-precondition checking or all reachability checking, potentially reporting false nontermination outside these benchmarks; the paper reports no precision loss on its measured examples. No scheduler fairness or busy-waiting progress argument is supplied for concurrent programs.
  • how much was read: most of it read
  • record id: termination-analysis-with-compositional-2010
• Termination Cores (2010)
  • title: Interactive Termination Proofs using Termination Cores
  • what: After a failed ACL2s termination proof, this work generates a core. A core is one unresolved recursive loop, with the solved work preserved. It guides a human repair.
  • number: one example: automatic proof in under 2 seconds after repair
  • number: expert’s earlier measure search 4-6 hours, unsuccessful
  • number: manual measure after repair about 20 minutes
  • number: core generation PSPACE-complete worst case
  • limits: It has one motivating example, not a controlled study.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: Termination Cores
  • record id: termination-cores-2010
• Verifying Safety Properties With the TLA+ Proof System (2010)
  • what: FirstpublicTLAPSrelease:hierarchical safety-proof management,backendtranslation/trust and Peterson/Bakery/incompletePaxoscases. # Verifying Safety Properties With the TLA+ Proof System (authored by agents unless marked 🧑) Kaustuv Chaudhuri, Damien Doligez, Leslie Lamport, and Stephan Merz, IJCAR 2010, LNCS 6173, pp142–148; arXiv:1011.2560v1, 11 November 2010. The venue/pages are confirmed by Stephan Merz’s author bibliography: “booktitle = {5th Intl. Joint Conf. Automated Reasoning (IJCAR 2010)}” and “{142-148}” (Q17; complete bibliography block in quotes.json). Read all seven PDF pages, §§1–5.1, acknowledgements and all 15 references; all seven page renders were inspected individually. The paper has no figures, tables, numbered theorems, benchmark suite, or appendix. This is the saved outside-index arxiv_all PDF, whose hash matches the reconstructed 352-path inventory. No author implementation or proof files were executed/imported, and no checkpoint or serialized data was loaded. Consultation and independent review are complete; the IJCAR bibliographic correction was applied. REVIEW.md records scope and root-only checks. The fetched author-hosted PDF has the same extracted body after removing the arXiv margin and declared glyph/spacing differences; author-copy-comparison.json records the comparison. No additional scientific content was inferred from that normalization. The paper describes the first public TLAPS release, its proof-obligation processing, and three example developments. It directly concerns TLA+ verification of concurrent and distributed systems. Its reported support covers invariance and step simulation but excludes liveness proofs. TLA+ the language can specify liveness; this release’s prover cannot establish those properties. These are historical 2010 capabilities, not a statement about today’s TLAPS. The authors state: “It handles almost all the non-temporal part of TLA+ as well as the temporal reasoning needed to prove standard safety properties, in particular invariance and step simulation, but not liveness properties” (§1 p1, Q1). ## Proof representation and what must be trusted Specifications and proofs share the TLA+ language. A hierarchical proof decomposes a theorem into steps and ultimately leaf obligations, each citing facts and definitions. TLAPM flattens imported/instantiated modules and sends processed leaves to backends. A user can work with incomplete proofs and choose which steps to check; the release uses pragmas to exclude proofs from checking. Thus a successful check of selected leaves does not itself establish completion of every claimed theorem. This completion check is a practical evaluation requirement inferred from the workflow. Q2–Q4 preserve the architecture and selection semantics. The backend called Isabelle/TLA+ implements the constant fragment as a dedicated Isabelle object logic. The paper explains that embedding into existing HOL/ZF logics was inconvenient because TLA+ is untyped, with no proposition/term distinction. Its single value type, classical first-order logic, equality, conditionals, Hilbert choice, Zermelo–Fränkel set axioms, and primitive function objects supply the mathematical basis. Natural numbers are introduced using a Peano structure whose existence follows from ZF; arithmetic is developed recursively. Tuples/sequences and records are functions, strings are character sequences. Ordinary “typing” facts become proof hypotheses: the paper’s n+0=n example needs a numeric n. Boolean conjunction is described as Boolean-valued even on arbitrary arguments. These are semantics/proof-library facts reported by the authors, not a reader audit of the object logic. Q9/Q10 give the details. Zenon searches for first-order proofs and emits Isabelle/Isar scripts checked against Isabelle/TLA+. The paper explicitly says “Zenon is therefore not part of the trusted code base of TLAPS” (§4.2 p5, Q11). That exclusion applies to this certificate-checking route; it does not make the entire TLAPS pipeline untrusted. TLAPM’s priming rewrite engine is expressly trusted. The generic SMT-LIB backend and Cooper Presburger arithmetic backend are expressly non-certifying in this release. “Certifying veriT” is a planned integration even though veriT is already among solvers tried through the generic non-certifying interface. Distinguishing solver brand from integration mode prevents a false claim that all SMT results were certified. Q3/Q5/Q11/Q12 preserve these boundaries. Backends reason over constant expressions. TLAPM moves primes through ordinary mathematical operators and leaves constants unchanged: (u=v+2c)’ becomes u’=v’+2c when u,v are state variables and c is constant. Double priming is rejected by the syntactic analyzer. Defined operators are hidden by default and expand when made usable. Modal operators may fail substitution of equals: knowing u=42 now does not imply u’=42. Reader illustration: a transition from u=42 to u’=43 satisfies the former but violates the latter. Usable non-substitutive definitions are expanded; hidden applications become opaque hashes, conservatively losing some valid equivalences such as O(e∧f)=O(f∧e). This is a stated completeness tradeoff, not a collision/security guarantee or a proof of implementation soundness. Q5/Q6 give the transformation and example. Positional and labelled references resolve subexpressions before later processing. In O(x,y)=x=20y+2, O(3,4)!2!1 selects 20·4. A label l on y·20 can keep referring to that term after unrelated surrounding syntax changes. The feature supports concise proof reuse, but the paper supplies no maintenance experiment. Default discharge tries Zenon, then Isabelle automation; pragmas can request tactics or other backends, often indirectly via a named standard theorem such as SimpleArithmetic. Q7/Q8 give these cases. The generic arithmetic route rewrites obligations into SMT-LIB AUFLIRA, often dropping assumptions outside that theory, with conservative sort detection for bound variables. Reader inference: proving a conclusion from fewer assumptions is logically stronger, so omission alone is not a soundness defect; translation and sort handling must still preserve meanings. The paper reports successful use of Yices, CVC3, Z3, veriT, and Alt-Ergo, without solver-specific counts, timings or comparative accuracy. It does not prove the soundness/completeness of these translations in this note. Q12 records the exact scope. ## Development practice and concrete evidence The authors first check finite instances with TLC and then attempt proofs. On leaf failure, TLAPM prints usable hypotheses and the goal, expanding usable definitions. Their reported common failure is omission of a needed fact/definition. They split difficult obligations into lower-level assertions, verify the local qed, then prove those assertions in any order. The example case split proves (P1∨…∨Pn)⇒Q by each Pi⇒Q. This is a concrete incremental authoring/debugging workflow, not evidence that partial obligations are sufficient. The Toolbox then only hid proof portions; broader integration was future work, while an Emacs mode provided hierarchical viewing and proof selection. Q13/Q14 preserve this historical distinction. The authors warn that unchecked “obviously true” assumptions can be wrong and recommend checking such data-structure facts with TLC. Finite model checking can expose counterexamples; it does not universally prove an unbounded assumption. That latter qualification is a reader inference, not a claim that the authors measured assumption-error rates. The claim that specification errors are likelier than TLAPS soundness bugs is also the authors’ engineering judgment, with no quantified comparison in this paper. Q3/Q14 carry both source statements. Section 5.1 gives these author-reported developments, without the actual full proof scripts: - two-process Peterson mutual exclusion: about 12 PlusCal lines and a proof of about 130 lines - N-process Bakery with atomic reads/writes: an 800-line proof - high-level Paxos: 100 TLA+ specification lines covering a consensus abstraction and two refinements; first refinement completed with a 550-line proof, second mostly proved and estimated to exceed 1,000 lines The Paxos case is explicitly incomplete, including the acknowledgement to Jean-Baptiste Tristan. The estimated second-proof length is not a measured completed artifact. Neither case length establishes checking time, human time, bug counts, proof coverage across implementations, liveness, or executable-code correctness. The N-process claim concerns the mathematical example as reported, not a finite-N experiment independently rerun here. Q15/Q16 preserve the complete cases. The library is reported to contain more than 1,400 lemmas/theorems, about 200 pages of pretty-printed Isar. These size measures and the three case descriptions support feasibility of the release; no theorem about the verifier itself, controlled user study, performance comparison, memory result, automated success rate or systematic experiment is supplied. The full development files and checker outputs were not inspected/reproduced in this reading. “It has not turned out to be difficult once the proof idea has been understood” is an author experience report, rather than a measured proof-automation guarantee (§5.1 p7, Q16). For the database, this is direct foundational evidence for high-level safety proofs and TLA+ proof tooling. It contributes explicit trust distinctions, partial-proof management, priming/substitution pitfalls, finite-model-checking practice, and a deliberately incomplete Paxos case. It has no Verus, verified Rust, or LLM experiment. A proposed use as an evaluation reference for proof agents is reader inference: record the precise theorem and unchecked assumptions, require every obligation, distinguish certificate-checked from trusted solver routes, and report whether the intended specification captures the requirement.
  • limits: Historical2010safetyfragment;Isabelleobjectlogic,TLAPMtrustedrewrites and noncertifyingarithmeticpaths. Selected/incompleteproofspossible;uncheckedassumptionsandspecificationvalidityremainhumanresponsibilities. Fullproofscripts/checkerresultsnotread/rerun;noquantitativetime/memory/successbenchmark.
  • how much was read: most of it read
  • source
  • record id: verifying-safety-properties-with-2010
• Teaching Concurrency (2009)
  • what: It argues that invariance, meaning a fact that holds in every state, is the key to understanding concurrent systems. It also argues that the spec matters more than the algorithm.
  • how much was read: most of it read
  • record id: teaching-concurrency-2009
• Woodcock survey (2009)
  • title: Formal Methods: Practice and Experience
  • what: Survey of industrial formal-methods practice combining a new questionnaire covering 62 projects, earlier surveys, eight highlighted industrial project families, and proposals for reusable verification experiments in the Verified Software Repository. Explains formal methods across requirements, specification, architecture, design, implementation, testing and maintenance. The new survey collected structured questionnaires November 2007–December 2008; 56 project reports came from involved individuals and six from literature. Reports application areas, size bands, techniques, expertise/training, perceived time/cost/quality effects and intentions to reuse. Compares model-checking uptake across decades using Fisher exact tests. Eight highlighted families cover Transputer floating-point microcode, railway control, Mondex, AAMP processors, Airbus SCADE, the Maeslant barrier, Tokeneer and Mobile FeliCa. They expose learning/reuse costs, translation and optimization bugs outside proof boundaries, requirements clarification, selective formalization, and tool limitations. Discussion favors choosing rigor by component/property, robust supported tools, familiar design-language interfaces, and integration with existing development processes. Repository proposal requires explicit proof assumptions and limits and reusable theory/artifacts; pilots include file stores, FreeRTOS, auctions, pacemakers and hypervisors alongside Mondex/Tokeneer.
  • number: Model checking in surveyed projects: 13% in the 1990s versus 51% in the 2000s; two-tailed Fisher p=0.003.
  • number: Survey: 62 projects; 56 participant reports and six literature reports; about half supplied code size.
  • number: Figure 6 quality improvement: 92% of cases reported an increase, none a decrease; this is a perception measure.
  • number: Tokeneer: 9,939 core Ada lines plus 16,564 SPARK annotation/comment lines; 260 reported person-days, excluding independent testing contribution.
  • limits: Historical 2009 synthesis, not a current adoption census or controlled causal evaluation. Open-invitation sampling favors the authors’ contacts, includes few model-checking contributions and underrepresents disappointed stakeholders; Europe dominates. Outcomes mostly report participant beliefs, with no comparison population or reliable universal cost model. Most projects lack relative time/cost evidence; reported quality improvement is not a measured 92% defect reduction. Significance tests concern this selected sample and do not remove selection/confounding bias. Industrial project claims summarize cited reports and were not independently reproduced. Some formal work covers models, selected code, selected properties, or parts of certification rather than a complete implemented system. Tokeneer’s tabulated 4% system-testing effort excludes independent SPRE testing; the text estimates 25% as more representative. The new survey’s individual responses and underlying dataset were not inspected. Recovered STFC author copy is 40 substantive pages with placeholder journal metadata, versus DOI/Crossref 36 pages; repository record explicitly links this title/file to DOI 10.1145/1592434.1592436, whose short metadata title is Formal methods. Database keyword/researcher estimates are explicitly rough historical estimates, not reliable counts of the field.
  • how much was read: most of it read
  • source; notes: S28
  • record id: woodcock-survey-2009
• A Survey of Automated Techniques for Formal Software Verification. (2008)
  • what: Tutorial survey of automated static analysis, software model checking and bounded model checking, emphasizing abstraction and decision procedures. Explains abstract-interpretation fixed points, widening/narrowing, numerical domains and alias/shape analysis; explicit/symbolic exploration and partial-order reduction; predicate abstraction, Boolean programs, counterexample-guided refinement, weakest/strongest preconditions, interpolation and lazy abstraction; and SAT/SMT encodings with whole-transition versus per-loop unwinding. Distinguishes sequential recursive reachability from undecidable asynchronous Boolean programs. Table I compares 16 contemporary tools by language and supported features.
  • number: 16 tools in Table I
  • number: predicate-abstraction applications reported up to 50 kLOCs; historical author summary
  • number: SLAM reported to check about 30 specific rules; historical author summary
  • limits: Historical 2008 survey, not evidence about present tool capabilities. Selection excludes testing and annotation-heavy interactive verification. Abstract analyses may lose precision; refinement may fail to terminate; bounded search misses deeper bugs without completeness arguments or sufficient unwinding. Shared-memory concurrency, heap structures and environment models remain difficult. Bitstate hashing may miss reachable states. Verification applies to modeled properties and environment assumptions.
  • how much was read: most of it read
  • source
  • record id: a-survey-of-automated-2008
• Automated Refinement Checking of Concurrent Systems (2007)
  • what: ARCCoS checks trace containment between CSP programs by exploring finite control flow and using an automated theorem prover for unbounded, data-dependent values. It infers cross-program simulation predicates rather than enumerating every numeric state. A forward pass matches visible communications and seeds value/index equalities; environment input streams are represented by unbounded arrays and read indices. Strongest postconditions prune infeasible trace pairs; an iteration cap weakens repeated forward states to true. A backward weakest-precondition pass strengthens predicates to a fixed point, combining inference with checking. Partial-order reduction keeps one order for independent hidden communications. An acknowledgment path is essential in a multiplexing example because extra buffering otherwise changes traces.
  • number: 13 examples
  • number: 2 links: 4 s with PO versus 88 s without
  • number: 3 links: 21 s with PO versus 514 min 52 s without
  • number: 7 links: 47 processes, 53 threads, 312 instructions; 37 min 28 s
  • limits: Goal is trace refinement, which preserves suitable trace safety properties; it is not a supplied deadlock/failures-divergence/liveness check. Infinite-state automatic checking is incomplete: backward fixed-point computation may not terminate, and the authors motivate success by similar control flow and simple linear relations. Results rely on the CSP/environment encoding and Simplify theorem prover. The conference paper defers fuller algorithms/details to an unread technical report. Example suite is small and largely adapted from FDR examples; the EP2 result concerns its data portion. No source or proof artifact was executed.
  • how much was read: most of it read
  • source
  • record id: automated-refinement-checking-of-2007
• Stochastic Model Checking (2007)
  • what: Tutorial on finite discrete-time and continuous-time Markov-chain model checking. Defines path probability measures, probabilistic temporal logics PCTL/CSL and expected rewards; explains graph preprocessing, linear-equation solving and CTMC uniformisation, then presents PRISM and three cited applications. Distinguishes probability-one eventuality from truth on every path using repeated coin tossing. For DTMC until properties, computes exact probability-zero/one regions before solving the remaining linear system; bounded until uses matrix-vector iteration. Rewards cover cumulative, instantaneous and expected cost to a target. CTMC exponential races induce an embedded DTMC; uniformisation computes real-time transient probabilities with truncated Poisson sums. General time-bounded until is split into phases, and reducible-chain long-run analysis combines BSCC-local distributions with reachability probabilities. Describes MTBDD, sparse and hybrid PRISM engines, module guards/updates, synchronization and reward items. Applications measure fairness of EGL contract signing, queue/power/loss tradeoffs of disk policies, and signaling/degradation in a biological pathway.
  • number: DTMC PCTL complexity: linear in formula size, polynomial in state count, additionally linear in maximum bounded horizon k.
  • number: CTMC CSL complexity: linear in formula size and q·t_max, polynomial in state count; direct dense linear-system solution cubic.
  • number: DPM queue capacity 20; N examples 0,5,10,15,20; exponential request rate 100/72.
  • number: FGF full model Table 2: cause probabilities 0.602356,0.229107,0.168536; expected degradation/relocation time 14.0258 minutes.
  • limits: The detailed theory is finite DTMCs and homogeneous finite CTMCs. CTMC residence times are exponential; the conclusion explicitly warns this may be too simple for some applications. MDP nondeterministic scheduling is mentioned but not developed. Quantitative numerical solutions are approximations subject to round-off and truncation, unlike exact graph-derived zero/one regions. These methods are numerical stochastic model checking; statistical simulation is only related work. The case studies summarize cited investigations, not a new common performance benchmark or independently reproduced experiment. PRISM capabilities are historical. Recovered author copy has 50 substantive pages, whereas Crossref lists pp.220–270; title/authors match. Publication year 2007 is bibliographic context; this PDF does not print it and the supplied Crossref message has a null issued year. Table 2 no-Shp2 cause probabilities sum to 1.005537 (visually checked), so the printed row should not be treated as a consistent distribution without checking its original source. Figure 10(d) legends show expected lost requests decreasing with N, whereas the prose and Figure 10(b) indicate the opposite direction; this reading does not resolve that inconsistency.
  • how much was read: most of it read
  • source
  • record id: stochastic-model-checking-2007
• Calling Context Graphs (2006)
  • title: Termination Analysis with Calling Context Graphs
  • what: It proves termination in ACL2s using graphs of calling contexts and well-founded measures (quantities that cannot decrease forever). It needs no user interaction on first-order functional code.
  • number: Table 1: 10,442 functions, 10,308 proved (98.7%)
  • number: difficult subset with explicit guidance: 421 attempted, 287 proved (68.2%)
  • limits: It kept existing auxiliary lemmas, so it is not fully free of annotations.
  • how much was read: most of it read
  • source; notes: Related work absent from the first pass: Calling Context Graphs
  • record id: calling-context-graphs-2006
• TLA+ chapter in Software Specification Methods: An Overview Using a Case Study (2006)
  • what: With an invoicing problem, it shows that the right abstraction depends on the question the spec should answer. It suggests writing a single correct behavior first, to decide what counts as one atomic step.
  • how much was read: most of it read
  • source; notes: Choosing top-level distributed guarantees and trusted boundaries
  • record id: tla-chapter-in-software-2006
• A Markov reward model checker (2005)
  • what: Introduces MRMC, a command-line checker for discrete- and continuous-time Markov reward models with PRCTL/CSRL properties. Checks state and impulse rewards, time-and-reward-bounded until, and expected instantaneous, cumulative, and long-run rewards. Numerical methods include discretization and uniformization/path truncation. C implementation uses compressed sparse storage, bottom-SCC search, and improved steady-state detection. Four flat input files specify transitions, labels, state rewards, and impulse rewards.
  • number: approximately one order of magnitude versus ETMCC; author claim
  • number: 4 input files
  • limits: Performance statement is a qualitative tool-paper claim about unspecified examples; no benchmark table, uncertainty analysis, model-size distribution, or artifact replay is supplied in this two-page source. Input is an already generated Markov chain rather than a high-level verified distributed implementation.
  • how much was read: most of it read
  • source
  • record id: a-markov-reward-model-2005
• Symbolic and Parametric Model Checking of Discrete-Time Markov Chains (2005)
  • what: Represents the probability measure of PCTL path-satisfaction sets as regular expressions over transition probabilities. Evaluating union, concatenation and Kleene star as rational operations yields exact rational probabilities or parameterized rational functions. Derives finite automata for next/until formulas, states propositions connecting accepted paths to probability measures, and distinguishes inductive regex construction for nested nonparametric formulas from state elimination for simple formulas. Multiplicities must be preserved: simplifying a|a to a is invalid for weighted probabilities. Parametric valuations preserve stochastic row sums and positivity. JFLAP-generated expressions and a script analyze coin-based die simulation and IPv4 Zeroconf reliability.
  • number: die outcome probabilities 1/6; termination probability 1
  • number: Zeroconf address space K=65024
  • number: example reliability threshold 0.999
  • number: publication 2005; conference ICTAC 2004
  • limits: Read copy is the author’s preprint deposited at Nijmegen; repository cover identifies the requested DOI and 2005 publication of ICTAC 2004 papers. Models are finite rational DTMCs. Parametric results apply to formulas without nested probabilistic operators; valid valuations must preserve required positive edges, row sums, and defined rational denominators. Full implementation, performance comparison and MDP extension are future work. The paper explicitly acknowledges that this symbolic approach cannot compete with advanced numeric methods in efficiency. Propositions are stated; no foundational proof artifact is inspected here.
  • how much was read: most of it read
  • source
  • record id: symbolic-and-parametric-model-2005
• Probabilistic symbolic model checking with PRISM: a hybrid approach (2004)
  • what: The authors address the main weakness of pure MTBDD probabilistic model checking: transition matrices can remain compact while iterative solution vectors lose regularity, gain many distinct values, and become large and slow. Their hybrid PRISM engine keeps the probabilistic transition structure symbolic but stores the numerical iteration vector explicitly in an array, aiming for sparse-matrix-like numerical speed without sparse-matrix model-storage cost. The paper gives the implementation mechanism. Matrix-vector multiplication is performed by recursively traversing the MTBDD and extracting each nonzero matrix entry once. To avoid array slots for unreachable encoded states, it introduces offset-labelled MTBDDs: nodes carry row/column offsets counting reachable states; redundant-level removal is restricted so offsets remain available; node merging is optional where different reachability patterns require different offsets. The structure is constructed from an ordinary MTBDD before numerical solution by restoring skipped levels and computing offsets from a BDD for reachable states. An optimization replaces all nodes at a chosen MTBDD level by cached explicit sparse submatrices; the highest level fitting a 1024 KB storage cap is chosen. The same idea extends to MDPs through several matrix-vector products per iteration. The authors also identify a method restriction: ordinary Gauss-Seidel needs row/column access not provided by one recursive traversal; they point to a block Gauss-Seidel variant. No new general formal correctness theorem is proved in the supplied text; the main evidence is algorithmic explanation plus experiments.
  • number: optimization explicit submatrix cap KB: 1024 kanban N5: states: 2546432 transitions: 24460016 matrix storage KB: MTBDD: 123 sparse: 296588 hybrid optimized: 671 seconds per iteration: sparse: 2.85 hybrid optimized: 3.09 kanban N7: states: 41644800 transitions: 450455040 hybrid optimized matrix KB: 1033 hybrid optimized seconds per iteration: 61.9 sparse matrix KB estimate: 5441445 sparse not constructed due to memory: True herman N23: states: 8388608 transitions: 125524238436 hybrid optimized matrix KB: 577 hybrid optimized seconds per iteration: 7161 sparse matrix KB estimate: 1471019937 coin N10: states: 5179854848 transitions: 60364590080 MTBDD matrix KB: 291 MTBDD seconds per iteration: 8.38 hybrid result: not feasible because even the explicit solution vector cannot be stored illustrative speedup: kanban N3 MTBDD seconds per iteration: 45.5 kanban N3 sparse: 0.04 kanban N3 hybrid optimized: 0.04 matrix diagram comparison: kanban N6 seconds per iteration: hybrid: 2.28 matrix diagram: 2.0 kanban N6 matrix KB: hybrid: 185 matrix diagram: 12.9 cyclic N18 seconds per iteration: hybrid: 1.16 matrix diagram: 1.66 cyclic N18 matrix KB: hybrid: 65.5 matrix diagram: 2.6
  • limits: author assumption: finite probabilistic models are generated from structured high-level descriptions whose regularity yields compact MTBDDs author assumption: numerical tasks can largely be reduced to iterative methods dominated by matrix-vector multiplication; direct Gaussian elimination/Simplex are rejected as unscalable and symbolically unsuitable limitation: the hybrid method explicitly stores at least one value per reachable state, so the solution vector becomes the scalability bottleneck limitation: MTBDD size remains highly variable-order dependent; optimal ordering is NP-hard and worst-case representation is exponential limitation: standard Gauss-Seidel is not directly supported by the presented traversal scheme evaluation threat: reported main timings are average time per numerical iteration, not end-to-end convergence time; convergence rates can differ by numerical method evaluation threat: case studies and hardware are limited, and the later SMART comparison uses different tools and a different machine scope note: supplied text, references, and described appendices were read; no code/artifacts or independent graphics inspection was performed
  • how much was read: most of it read
  • source
  • record id: probabilistic-symbolic-model-checking-2004
• Goal-Oriented Requirements Engineering: A Guided Tour (2001)
  • what: The paper breaks goals into smaller obligations assigned to software or environment actors. Obstacles and conflicts help find missing requirements. A spec is complete with respect to a set of goals when the goals follow from the spec plus domain properties.
  • how much was read: most of it read
  • source; notes: Requirements methods predating LLMs
  • record id: goal-oriented-requirements-engineering-2001
• Scalable Distributed On-the-Fly Symbolic Model Checking (2000)
  • what: Combines BDD-based, breadth-first on-the-fly checking of RCTL safety properties with distributed reachability and memory balancing. Saves each breadth-first frontier in slices across processes, then cooperatively reconstructs a counterexample without gathering an entire frontier on one process. Starts sequentially until a memory threshold, partitions ownership, exchanges newly reached states with their owners and detects distributed termination or an error. Rebalancing can change each process’s slice between iterations; correctness relies on the slices jointly covering the sequential frontier. During counterexample generation, processes extend a suffix backward locally, then broadcast a longest suffix and resume. Section 3.3 derives ways to reduce intermediate BDD memory: restrict transition partitions to the current frontier slice or once to the union of a process’s saved slices, use simplify-assuming, and substitute a singleton target directly for next-state variables. Appendix A explains regular expressions describing finite bad computations and their reduction to reachability of a monitoring automaton.
  • number: 4 circuits; 6 properties
  • number: 32 × 512 MB; 225 MHz; 16 Mbit/s token ring
  • number: BIQ spec1: single-machine overflow at 15; distributed error at 17; 1,957 s total
  • number: s1423 spec1: error at 14; 16,032 s total
  • limits: The checking method targets a large safety class including RCTL, not arbitrary temporal liveness. Symbolic state-space and intermediate-BDD growth still limit completion. Crucially, the paper says the Section 3.3 memory optimization was not implemented by submission: GXI counterexample reconstruction shows an imbalance and peak-memory increase. Do not present the proposed optimization as experimentally established. Evaluation is initial, covers only four hardware circuits/six properties on a fixed 32-workstation setup, and does not measure broad node-count scaling or modern platforms. The cited earlier reachability result of average memory scale-up 55 on 130 processes belongs to prior work, not this evaluation. Download used disabled TLS certificate verification following a certificate-chain failure (reported by leads2); exact title and four authors match the saved Crossref response, but the PDF does not establish publisher-version identity by a printed DOI.
  • how much was read: most of it read
  • source
  • record id: scalable-distributed-on-the-2000
• Semantic Issues in the Verification of Agent Communication Languages. (2000)
  • what: Defines what it means for an agent implementation to conform to an agent-communication language, separating logical message semantics, program semantics, and decidable conformance checking. Formalizes message semantics as a constraint on the sender and program/state semantics in the same semantic language; conformance means the program theory entails the message sincerity condition. Distinguishes decidability from polynomial-time practical verification. Provides propositional and state-grounded knowledge examples, discusses co-NP-completeness, and explains why ungrounded mental-state semantics and quantified logics obstruct FIPA-97 conformance checking. Compares proof-based verification with finite-state model checking.
  • number: Defines decidable and polynomial-time verifiability; reports co-NP-completeness for example propositional frameworks and undecidability/ungroundedness for FIPA-97 semantics. No empirical benchmark or implementation evaluation.
  • limits: Recovered author manuscript is dated 1 September 1999; the DOI bibliographic publication year is 2000. Claims concern the historical FIPA-97 semantics and should not be read as claims about current standards. Sender sincerity is distinct from guaranteed receipt or effect on an autonomous recipient. Results assume supplied semantics and, for the grounded example/model checking, finite state sets. Complexity classifications are the author’s stated results, not independently re-proved. Text extraction drops letters/ligatures; selected quotations were separately transcribed and visually checked from page renders.
  • how much was read: most of it read
  • source
  • record id: semantic-issues-in-the-2000
• Symbolic Model Checking without BDDs. (1999)
  • what: Introduces bounded model checking for LTL by reducing bounded counterexample existence to propositional satisfiability without a tableau construction. Defines distinct bounded semantics for finite prefixes with and without back loops, proves soundness and eventual completeness across increasing bounds, and gives a SAT translation polynomial in the temporal formula with shared subformulas and quadratic in the bound. Develops state-count, diameter, recurrence-diameter and lasso-shape bounds. BMC translates a subset of SMV to DIMACS/SATO or PROVE; benchmarks include arithmetic circuits, a barrel shifter and asynchronous distributed mutual exclusion.
  • number: 16x16-bit multiplier with 16 output bits plus overflow
  • number: 1066 seconds PROVE multiplier sum
  • number: DME bounds k=5 and k=10
  • number: 18 gate fairness constraints per cell
  • limits: Finite state, Boolean-encoded Kripke structures with total transitions are assumed. Unsatisfiability at one bound does not prove an unbounded LTL property without a sufficient completeness bound. Benchmarks deliberately target examples where BDDs behave badly. Distributed mutual-exclusion liveness was checked only at k=5 and k=10, since no adequate global bound was available; fairness per asynchronous gate is needed. This source references a separate full version for ECTL semantics/translation; that version was not fetched or read.
  • how much was read: most of it read
  • source
  • record id: symbolic-model-checking-without-1999
• Property Specification Patterns (1998)
  • title: Property Specification Patterns for Finite-State Verification
  • what: The paper gives reusable patterns and scopes for properties, such as absence, response and precedence. It maps them to formal languages.
  • limits: A pattern cannot tell the agent which guarantee the human left out. Users must still know enough to express the requirement.
  • how much was read: most of it read
  • source; notes: Requirements methods predating LLMs; notes: papers
  • record id: property-specification-patterns-1998
• user-driven process abstraction (1998)
  • title: User-Driven Abstraction for Model Checking
  • what: Presents a technique for simplifying process-algebra system descriptions with user-applied abstraction rules before model checking. Rules are sound for a class of temporal properties: if the abstract process satisfies the property, the original does too, while the abstract state space may be much smaller. Defines abstraction through process preorders and weak simulation, gives compositional rules for removing shared variables, actions, and components, and explains how abstract counterexamples reveal flawed simplifications. Examples include Dekker’s mutual exclusion and safety properties, with discussion of deadlock/liveness limits.
  • number: No quantitative runtime benchmark reported
  • number: Examples show substantial state-space reduction qualitatively (§6)
  • number: Rules are compositional under all process operators (§2)
  • limits: Soundness depends on the chosen preorder and property fragment; abstraction may add behaviors and can produce false negatives when a simplified model violates a property that the original satisfies. The approach is user-driven and offers no automatic rule-selection or performance benchmark. CCS/process-algebra modeling is assumed.
  • how much was read: most of it read
  • record id: user-driven-process-abstraction-1998
• Four Dark Corners of Requirements Engineering (1997)
  • what: The paper separates three things: facts about the environment that are wanted, facts about it that are assumed, and behavior the machine can enforce at its interface. The spec plus domain knowledge must imply the requirements.
  • how much was read: most of it read
  • source; notes: Requirements methods predating LLMs
  • record id: four-dark-corners-of-1997
• Formal Methods: State of the Art and Future Directions (1996)
  • what: Surveys formal specification, finite-state model checking and machine-assisted theorem proving, using industrial case reports to explain their benefits and limits. It then proposes research, tool, education and transfer priorities. Formal methods alone do not guarantee correctness [Q1]. Contrasts rich sequential specification languages (Z, VDM, Larch) with concurrent notations; explains exhaustive checking and counterexamples versus proof by axioms and inference [Q4,Q7]. Discusses composition, decomposition, abstraction, reuse, hybrid systems and integration of methods. Tool criteria include early benefits, incremental gains, reuse, integration, ease of use and focused analysis [Q8–Q10]. Industrial examples include CICS, CDIS, C130J, TCAS II, SCI, NewCoRe/ISDN, HDLC, arithmetic circuits, processor instructions and microcode.
  • number: CICS: estimated 9% development-cost reduction [Q2]
  • number: CDIS: about 0.75 faults per thousand lines, described as two to ten times better than selected comparison projects [Q3]
  • number: NewCoRe: 145 requirements, about 7,500 SDL lines, 112 errors; approximately 55% inconsistent requirements [Q6]
  • limits: A 1996 survey and research agenda, not a new controlled comparative experiment. Industrial costs, fault rates and successes are cited case reports; they do not establish a general causal effect. Model checking faces state explosion [Q5]; theorem proving can cover infinite domains but may require substantial human guidance. Tool strengths and modeling assumptions must be stated [Q9]. No modern Verus, TLA+ or LLM evaluation.
  • how much was read: most of it read
  • source
  • record id: formal-methods-state-of-1996
• Tale of Two Clocks (1996)
  • title: Refinement in State-Based Formalisms
  • what: A seven-page note that uses a clock to explain hidden state, stuttering internal steps (steps that change nothing visible), and refinement.
  • limits: It is a teaching note. It has no runnable artifact.
  • how much was read: most of it read
  • source; notes: connecting different descriptions of the same behavior
  • record id: tale-of-two-clocks-1996
• The Semantics of TLA on the PVS Theorem Prover (1996)
  • what: Defines Lamport’s Temporal Logic of Actions (TLA, a logic where a system is a set of allowed state changes and properties are ‘always’ and ‘eventually’ statements) inside the PVS proof assistant. The hard part is hiding a variable (the existential quantifier over program variables), which needs a choice operator.
  • number: 17 pages
  • number: one worked example: two counters x, y with weak fairness on both increment actions
  • limits: Definitions only. It proves one lemma (stut equals the stuttering-removal function, Theorem 1) and gives no verified system, proof rules, or tooling. Report is marked unpublished and not peer reviewed.
  • how much was read: most of it read
  • source; notes: ## The semantics of TLA on the PVS theorem prover (1996)
  • record id: the-semantics-of-tla-1996
• Verification Tools for Finite-State Concurrent Systems (1994)
  • what: Detailed account of BDD-based symbolic verification of finite concurrent systems, covering Boolean/relational representation, CTL fixed points and fairness, witness generation, LTL tableau checking, deterministic-specification language containment, SMV and a Futurebus+ cache-coherence case study. Explains reduced ordered BDD canonicity, variable ordering, memoized Apply and fused relational product that avoids a large intermediate conjunction. Proves fixed-point properties and CTL EG/EU characterizations, then gives symbolic predecessor/fixed-point procedures. Fairness constrains every path quantifier to paths visiting each designated set infinitely often. Witnesses are constructed from stored fixed-point approximations, without guaranteeing the shortest cycle. LTL is reduced to a tableau/model product plus fairness for until obligations. Complete Büchi automata with deterministic specification admit language-inclusion checking via fair CTL. Explains SMV modules, interleaving versus synchronous composition, nondeterminism, parallel assignments and printed mutual-exclusion example. Futurebus+ analysis details abstractions, properties, inconsistency and hierarchical deadlock scenarios and proposed fixes. Research directions include assume/guarantee composition, data abstraction, symmetry, parameterized induction, partial orders, real time and interfaces.
  • number: Futurebus+:2300 noncomment SMV lines;three bus segments;eight processors;over10^30 model states.
  • number: Mutex printed example:1.15s user,0.3s system;2405 BDD nodes allocated;56+1 for transition relation.
  • number: Comparator OBDD:3n+2 vertices for interleaving bit order versus3·2^n−1 for grouped order.
  • limits: A historical 1994 account. Finite Kripke structures and symbolic representations remain subject to state explosion; some Boolean functions have exponential OBDD size for every order. Worst-case relational product may be exponential. Large state counts refer to structured symbolic models, not explicit enumeration or general scalability. Fairness/environment assumptions restrict liveness claims. The language-containment construction assumes complete automata and deterministic specification. Futurebus+ uses atomic whole-bus transactions, nondeterministic arbitration, a single cache line with one data bit, no exceptional/parity conditions and omitted read-invalid/write-invalid commands; it is not verification of every implementation detail or arbitrary processor count. Printed SMV code/output was read but external code was not inspected or run. Extracted formulas contain OCR damage; selected source pages visually checked. The paper’s broad suggestion of single-path counterexamples for universally quantified formulas needs qualification for general branching formulas; this record only attributes the concrete examples and algorithms shown.
  • how much was read: most of it read
  • source
  • record id: verification-tools-for-finite-1994
• Linearizability (1990)
  • title: Linearizability: A Correctness Condition for Concurrent Objects
  • what: Defines linearizability: each operation takes effect at a single instant between its call and its reply, and the history must match some allowed sequential history.
  • limits: By itself it does not promise that requests finish, that data survives crashes, or that two retries count as one operation. That is the notes’ inference.
  • how much was read: most of it read
  • source; notes: Choosing top-level distributed guarantees and trusted boundaries; notes: S4
  • record id: linearizability-1990
• Automatic Verification of Finite-State Concurrent Systems Using Temporal Logic Specifications (1986)
  • what: Presents a state-labeling algorithm to check branching-time CTL formulas on an explicit finite global state graph in time proportional to formula length times graph size. Extends path semantics to selected fair executions using strongly connected components and demonstrates the EMC implementation on the Alternating Bit Protocol. Builds truth labels bottom-up over numbered subformulas; universal-until uses DFS with cycle detection and existential-until uses backward reachability. A fair path must visit each supplied predicate set infinitely often; reachable fair strongly connected components identify where such a path exists. This supports impartiality and justice; a stronger infinitely-often-enabled implies infinitely-often-executed condition is only sketched as an extension. EMC translates a boolean/signal subset of CSP, generates the interleaved global graph with minimization, and can recompute successors to save explicit storage. ABP models lost/garbled transmissions nondeterministically and checks alternation plus preservation of the data bit. The paper contrasts CTL with PSPACE-complete CTL* checking and gives NP-hard/co-NP-hard bounds for BT* and CTL+.
  • number: CTL time O(length(f) × (|S|+|R|))
  • number: fair CTL analysis O(n × m × p) for graph size n, formula length m and p fairness predicates
  • number: ABP: 251 states; 3 specification formulas
  • number: EMC operational since January 1982 (author report)
  • limits: The algorithm is for finite models with a total transition relation; its linear graph dependence does not remove the product growth of concurrent global states. Guarantees are relative to the chosen model, specification and fairness predicates, not automatically a proof of implementation code or of an unbounded protocol. Implemented fairness is recurrence of supplied state predicates; the stronger paired-predicate fairness extension is not implemented. The paper’s ABP prose describes restricting paths to infinitely many initial-state visits, while Appendix 3 actually prints SndMsg and RcvMsg constraints; these descriptions are preserved without assuming their equivalence. Appendix 1 supplies correctness invariants but leaves their inductive proof to the reader; existential-until correctness is also left to the reader. OCR corrupts formulas/code/transcript values; quoted spans preserve exact extracted source text and visual reading supplies only explicitly identified clarifications. Printed title/authors, TOPLAS 8(2), April 1986, pages 244–263 match saved Crossref metadata for the requested DOI.
  • how much was read: most of it read
  • source
  • record id: automatic-verification-of-finite-1986
• Alpern-Schneider liveness (1985)
  • title: Defining Liveness
  • what: The paper defines safety and liveness as properties of sets of infinite executions. It proves that every property is the intersection of a safety property and a liveness property.
  • limits: It covers properties of a single trace, not policies over several traces. Deadlock freedom is a safety property. Starvation freedom is a liveness property.
  • how much was read: most of it read
  • source; notes: What matters for turning a vague request into a proof; notes: separating forbidden events from required progress
  • record id: alpern-schneider-liveness-1985
• Automatic Verification of Probabilistic Concurrent Finite-State Programs (1985)
  • what: Gives an automata-theoretic decision procedure for qualitative, probability-one satisfaction of linear temporal specifications by finite probabilistic concurrent programs. Converts formulas to omega automata and reduces probabilistic emptiness/universality to ordinary automata emptiness through fair-run reasoning. For deterministic Streett automata, constructs product automata whose acceptance enforces probabilistic fairness. Develops a generalized-subset determinization based on labeled state-set tuples; a singly exponential partial construction avoids full doubly exponential determinization for probabilistic Büchi checks. Extends pure Markov chains to concurrent Markov chains with probabilistic versus nondeterministic states and a designated fair-state set. A history-dependent scheduler induces a probability measure; correctness quantifies over every fair scheduler.
  • number: probability-one qualitative correctness
  • number: 12 scanned pages, printed 327–338
  • number: PSPACE-complete nondeterministic Büchi probabilistic emptiness/universality
  • number: Theorem 4.5: polynomial program-size, doubly exponential specification-size time
  • limits: Finite state space and fixed process count are essential; the method does not establish a parameterized result for arbitrary process counts. Only qualitative almost-sure satisfaction is checked, not numerical probability thresholds, bounded waiting or real-time response. Algorithms depend on nonzero transition support rather than exact positive probabilities. Fairness is state-based: repeatedly visited fair states must take every enabled outgoing choice infinitely often; a fair scheduler assigns fair runs probability one. Source includes proof sketches rather than mechanized proofs or implementation evidence. Abstract/Theorem 4.5 give polynomial program-size time and doubly exponential specification-size time; introduction/conclusion call the program dependence linear. This internal bound wording difference is preserved. Author-hosted scan matches title/author and FOCS 1985 printed pages/metadata; no DOI is printed in the scan.
  • how much was read: most of it read
  • source
  • record id: automatic-verification-of-probabilistic-1985
• End-To-End Arguments in System Design (1984)
  • what: It argues that functions such as reliable delivery and duplicate suppression can be done completely only with knowledge held by the application at the endpoints. Lower layers can only help.
  • how much was read: most of it read
  • source; notes: Choosing top-level distributed guarantees and trusted boundaries
  • record id: end-to-end-arguments-1984
• Verifying Concurrent System Specifications in COSY (1980)
  • what: Defines concurrent behavior for COSY path-expression specifications using vectors of strings, one coordinate for each local ordering constraint. Demonstrates the semantics on a parameterized resource-release mechanism and derives its behavioral characterization, resource-use correctness and adequacy. An operation appends its name to every path coordinate mentioning it. A legal history respects every component path’s firing sequences; operations not sharing a path commute, preserving concurrency rather than imposing one total order. Defines prefix and occurrence-count operations over these vectors, then separates general properties such as deadlock freedom/adequacy from predicates expressing a mechanism’s intended meaning. Constructs RRM(N) from configuration-selection, per-resource parallel acquisition/skip and resource-pool paths, with replicators providing concise families. Characterizes histories as prefixes of complete activity blocks, derives the next free-resource configuration from acquisitions and returns, and relates the CONF test to the actual pool state. The final result states adequacy for every N>0.
  • number: TR152, May 1980; 16 scanned pages including covers/blank versos
  • number: 11 printed body pages, numbered 1–11
  • number: 2^N resource-pool configurations
  • number: 6 lemmas; 3 propositions; adequacy stated for all N>0
  • limits: Primary source is Newcastle TR152, not the published MFCS chapter. Cover/title/authors/year and intended conference match the saved Crossref record for the requested DOI; the input’s singular ‘Specification’ is a title alias, whereas both source and Crossref use plural ‘Specifications’. Published-version identity beyond that match was not checked. The paper explicitly omits proofs for space and points to [SL80], so this reading verifies stated definitions/propositions and a sketch, not a complete checked proof. RRM(N) is only the kernel of the larger COSY banker; customer access/allocation, fairness and starvation devices belong to that larger cited program. Adequacy means every operation remains possible after some continuation, according to the existential continuation in its definition; it does not assert that every arbitrary infinite schedule serves every request. No fault, network-loss or implementation-memory model is supplied. Full COSY processes/distributors/nested distributors are omitted. No measured runtime, memory, implementation throughput or automated proof experiment appears in the read report.
  • how much was read: most of it read
  • source
  • record id: verifying-concurrent-system-specifications-1980
• Asynchronous Fault-Tolerant Language Decidability for Runtime Verification of Distributed Systems
  • what: Defines strong/weak and predictive decidability for distributed runtime verification under asynchronous adversaries, proves that asynchronous fault-tolerant monitors can decide only real-time-oblivious properties, and introduces timed-adversary predictive models that recover limited real-time verification.
  • number: Theorem 5.2: every decidable language under the asynchronous adversary is real-time oblivious
  • number: Theorem 6.3 establishes predictive strong decidability strictly below predictive weak decidability
  • number: Table 1 summarizes SD/WD/PSD/PWD results for registers, counters and ledgers
  • limits: Processes see only input fragments and operate wait-free under full asynchrony and crash faults. Characterization rules out real-time-sensitive properties under the base adversary; predictive notions allow justified false negatives and still leave some objects such as eventual ledgers undecidable.
  • how much was read: most of it read
  • record id: asynchronous-fault-tolerant-language
• Cloud Elasticity Using Probabilistic Model Checking
  • what: Builds dynamically instantiated PRISM MDP models and policies for horizontal VM scaling, including reactive, reinforcement-learning and several MDP variants. Policies are evaluated on real OKEANOS/YCSB traces and synthetic workloads using utility, latency-threshold violations and decision overhead.
  • number: Real dataset: 10 million rows, 1,000–46,000 requests/sec, 315 measurements per sine period, up to 16 server VMs
  • number: MDP-based policies produced 37% fewer latency violations on average than RL-MB; MDP3 reached 45% fewer for r1
  • number: Synthetic/real policy decisions: RL-MB about 0.07 s, PRISM MDP policies about 1.5 s; actions typically every 5 or 10 minutes
  • limits: The approach assumes utility functions capture elasticity objectives, bounded VM changes per action, model training from workload logs, and PRISM-compatible MDP abstractions. Results depend on YCSB/HBase workloads, thresholds, utility definitions and emulation; the paper does not establish universal cloud correctness and leaves richer MDP features and vertical resizing for future work.
  • how much was read: most of it read
  • record id: cloud-elasticity-using-probabilistic
• Liveness Manifestos
  • title: Liveness Manifestos (NYU ACSys ‘Beyond Safety’ workshop page)
  • what: Workshop participants state whether proving liveness is worth it. Lamport lists four problems. McMillan, Vardi, Boigelot and Sistla add views on when liveness helps, and when bounded safety can replace it.
  • limits: This is not a paper. The workshop year is not stated.
  • how much was read: most of it read
  • source
  • record id: liveness-manifestos
• MightyPPL: Towards Model Checking MTL
  • what: Upgrades MightyPPL to model-check one-sided punctual MTL with past and Pnueli modalities, interchangeable Uppaal/LTSmin/TChecker and symbolic backends, and reachability-driven product flattening. Evaluates satisfiability and model checking against Tempora.
  • number: Tempora uses a 600-second timeout
  • number: MightyPPL is sub-second on many simple formulas while Tempora times out; some larger flat cases take hundreds of seconds
  • number: Tool reports correct answers on all tested instances while Tempora has several incorrect results
  • limits: Supported MTL is a restricted decidable fragment; execution depends on timed-automata backends and benchmark structure. Tempora comparisons include timeouts and incorrect outputs, so broad conclusions beyond the tested fragment are limited.
  • how much was read: most of it read
  • record id: mightyppl-towards-model-checking
• Model Checking the Logic of Allen’s Relations Meets and Started-by is PNP-Complete
  • what: Provides a P^NP model-checking algorithm for the AAB/AAE fragments of Halpern-Shoham interval logic, proves soundness and completeness through a bounded-track oracle, and reduces SNSAT to establish hardness for AB/AE. It derives P^NP-completeness and tighter logarithmic-query bounds for selected fragments.
  • number: AAB, AAE, AB and AE model checking are proved P^NP-complete
  • number: Oracle nondeterministic complexity is O(|ψ|^3·|K|); track generation/checking uses O(|ψ|^2·|K|) steps
  • number: AB/AE are in and hard for P^NP[O(log n)^2]
  • limits: Results concern finite Kripke structures under the homogeneity assumption and the paper’s strict interval semantics (with stated symmetric fragments). Complexity classifications are worst-case decision bounds, not implementation benchmarks; full HS model checking remains EXPSPACE-hard with only a nonelementary decision procedure known.
  • how much was read: most of it read
  • record id: model-checking-the-logic
• Software Performability Analysis Using Fast Parametric Model Checking
  • what: Introduces fPMC, which fragments parametric DTMCs, analyzes fragments independently, restructures the model, and combines subexpressions with an abstract-model result. A heuristic chooses whether to fragment and otherwise invokes Storm; the evaluation compares formula size, checker time, and MATLAB evaluation time against Storm and PRISM.
  • number: 28 PCTL properties over 62 pDTMC variants and three software-system types
  • number: Existing methods often could not complete analyses within 60 minutes; fPMC handled models with over 10–20 parameters
  • number: fPMC formula evaluation reached at most 165 seconds for the PL cases and 42 seconds for COM, while some Storm formulas timed out after seven hours
  • number: For an FX case, α from 1 to 32 completed within 60 minutes; α ≥ 32 failed on the first fragment
  • limits: Results concern finite pDTMC software-performability models and PCTL properties. Fragment size depends on threshold α: too-small values enlarge the abstract model, while too-large values can make a fragment exceed the 60-minute checker timeout. The study covers three application types and notes that broader model classes and domains need further experiments.
  • how much was read: most of it read
  • record id: software-performability-analysis-using
• Verdi repository
  • title: Verdi
  • what: Verdi is a Coq framework for implementing and verifying distributed systems across fault models. Verified system transformers let a proof in an idealized model transfer to an analogous adversarial environment.
  • limits: The README points to related Raft papers; this record is repository documentation, not a new paper reading.
  • how much was read: most of it read
  • source
  • record id: verdi-repository
• Verus repository
  • title: Verus repository documentation
  • what: The official Verus repository describes executable Rust verification against specifications, documents active-development limits, and links to tutorials, concurrent-code guides, examples, tests, videos and exercises.
  • limits: The README warns that features may be broken or missing and documentation is incomplete.
  • how much was read: most of it read
  • source
  • record id: verus-repository
• Aria (2026)
  • title: Harnessing Code Agents for Automatic Software Verification
  • what: Claude Code (Opus 4.7) proves one Coq lemma at a time inside a sandbox, and the Coq kernel checks each proof. There is no search over proof steps and no retrieval of related facts. The lemma statements are given. The agent writes the proofs.
  • number: Proves all 4,257 lemmas of four Iris core modules and 217 lemmas for Rust standard-library verification
  • number: 79.2% of Iris core lemmas proved on the first try; mean 0.51 retries; maximum 28
  • number: Total model time 379.7 hours; mean 321.1 s per lemma
  • number: Open model Kimi K2.6: 55% first-try vs 72.5% for Opus 4.7, about seven times as long
  • limits: The statements were given, not written. Iris is public and probably in the training data. The paper argues that its proofs differ from the upstream ones. That does not test for contamination (the notes’ caveat).
  • how much was read: parts read
  • source
  • record id: aria-2026
• Civl reduction ESOP 2026 (2026)
  • title: Reduction for Structured Concurrent Programs
  • what: The paper extends reduction to procedures and parallel composition in Civl. Reduction treats a group of small concurrent steps as one atomic step.
  • number: Cases: Snapshot 119 total / 82 impl+spec lines 0.4 s; ABD register 389/206 1.4 s; FLASH coherence 608/401 5 s; 2PC 146/111 1.8 s
  • number: About 50 further examples
  • limits: Some side conditions were checked by hand (Section 7). They are that left-mover procedures terminate and that right-mover statements cannot fail.
  • how much was read: parts read
  • source; notes: Civl and inductive sequentialization; notes: S17
  • record id: civl-reduction-esop-2026-2026
• Corten (2026)
  • title: Corten - Foundational Verification of Rust Programs
  • what: A framework in the Rocq proof assistant for proving Rust programs correct with separation logic (a logic for reasoning about who owns which memory). It defines Rust’s behavior on the compiler’s typed high-level IR so proof goals look like Rust source, and adds tactics that follow the code’s shape.
  • number: Automated proofs are about 2x to 4x shorter than proofs done directly against the semantics, on a synthetic test suite
  • number: Buddy allocator case study: about 300 lines of Rust, about 2800 lines of Rocq (about 250 spec, about 800 general Rust reasoning, about 1400 free-list lemmas)
  • number: Specifications about 2x the size of the code; automated proofs 2x to 4x the Rust size
  • limits: Soundness of the semantic axioms is proved only for the pure and heap-statement fragments so far; the rest is itemized in an appendix. Specs of Rust core functions used by the case study are not proved. Single-threaded in practice (concurrency inherited from Iris but not yet exercised), traits only partly handled, no labeled break/continue. Allocator spec covers memory safety, not allocation quality.
  • how much was read: parts read
  • source; notes: Corten (2026)
  • record id: corten-2026
• Isabelle tutorial (2026)
  • title: Programming and Proving in Isabelle/HOL
  • what: A tutorial on inductive definitions, recursive functions, automation and structured proofs in Isabelle/HOL.
  • how much was read: parts read
  • source; notes: C2
  • record id: isabelle-tutorial-2026
• Munkres’ General Topology Autoformalized in Isabelle/HOL (2026)
  • what: LLM coding agents (ChatGPT 5.2, then Claude Opus 4.6) wrote an Isabelle/HOL formalization of all 39 sections of Munkres’ Topology. They used a workflow that writes sorry first, plus sledgehammer.
  • number: over 85,000 lines, 806 formal results, zero sorry, 24 active days
  • number: 2.66 M output tokens, 17.2 billion cache-read tokens, estimated API cost $8,895;effectivecostabout$160 on a 200/month subscription - number: about 83% automated - limits: The agent defined its own notions in parallel to Isabelle's library. It also added "safe" extra hypotheses. There is no layer to reconcile them. The context for the 83% figure was not fully read. - how much was read: parts read - source - record id: `munkres-general-topology-autoformalized-2026` - On the Power of Temporal Prophecy (2026) - what: It uses prophecy terms (guesses about the future) to prove termination of the Ackermann function in Ivy, a first-order model checker. The notes read only the open Ivy proof file, not the paper. - number: no paper runtime or human-effort figures available - limits: The paper PDF was not found. The Ivy file is outside EPR, a fragment where checking is decidable. It has cyclic alternations of quantifiers. It needs a fairness assumption that protocol steps are taken infinitely often, because Ivy adds an idle action. - how much was read: parts read - source; notes: On the Power of Temporal Prophecy (2026): paper inaccessible; proof ar - record id: `on-the-power-of-2026` - Verifying Wait-Freedom for Concurrent Higher-Order Programs (2026) - what: The paper gives a mechanized framework in Rocq and Iris. It proves that every call to an operation on a concurrent data structure finishes, whatever other threads do. It works for higher-order clients. It builds on Lawyer. - limits: The examples are a higher-order list map and a single-producer single-consumer queue, which is wait-free only with one enqueuer and one dequeuer. The review notes did not extract the numbers. - how much was read: parts read - source - record id: `verifying-wait-freedom-for-2026` - Vermilion (2026) - what: An experimental Lean 4 backend for the Verus verifier (September 2026). - limits: The README lists concurrency (atomics, tokenized state machines) as missing, which limits its relevance to distributed code. It goes from Verus obligations to Lean. It does not go from TLA+ to verified Rust. - how much was read: parts read - source; notes: R02. Verus temporal libraries, 2025–2026 repository leads - record id: `vermilion-2026` - Verus guide (2026) - title: Verus Tutorial and Reference - what: Official Verus guide with advice on failing proofs. - limits: Guide content can change with the tool; no command was rerun here. - how much was read: parts read - source - record id: `verus-guide-2026` - verus-tla-lib (2026) - what: A crate for reasoning about TLA+ in Verus, containing temporal definitions derived from Anvil. - limits: No independent evaluation of a full translator exists. - how much was read: parts read - source; notes: R02. Verus temporal libraries, 2025–2026 repository leads - record id: `verus-tla-lib-2026` - VerusBelt (2026) - title: VerusBelt: A Semantic Foundation for Verus’s Proof-Oriented Extensions to the Rust Type System - what: A machine-checked Iris/Rocq justification of the semantics of many Verus permission types, borrows, lifetimes and concurrency. - number: 25 pages - limits: Excludes Vec/HashMap specs, full Rust details, the verifier's translation, external solvers and ghost erasure. No Send result for non-static mutable borrows. No distributed benchmark. - how much was read: parts read - source - record id: `verusbelt-2026` - DeepSeek-Prover-V2 (2025) - title: DeepSeek-Prover-V2: Advancing Formal Mathematical Reasoning via Reinforcement Learning for Subgoal Decomposition - what: It breaks Lean math problems into subgoals and proves them with a smaller model. It then trains on the assembled solutions. - number: miniF2F 88.9% (217/244) at pass@8192 - number: ProverBench 325 problems - number: PutnamBench: PDF says 47 accepted of 658; README says 49; only 649 evaluated - limits: Success on mathematics does not show skill at writing specs for systems. The 47 vs 49 discrepancy comes from two benchmark statements that were misformulated. - how much was read: parts read - source - record id: `deepseek-prover-v2-2025` - EVMYulLean (2025) - what: A formal model of the EVM and Yul in Lean 4, with Ethereum conformance tests. It is used as the semantics underneath EqiVM. - limits: The README documents limits in its Yul semantics, including omitted gas and contract creation. No standalone paper was found. It is not an agent benchmark. - how much was read: parts read - source; notes: Bytecode-semantics prerequisites: repository evidence and retrieval ga; notes: Bytecode-semantics prerequisites: repository evidence and retrieval ga - record id: `evmyullean-2025` - Korg thesis (2025) - title: Verification and Attack Synthesis for Network Protocols - what: Proves properties of three network-protocol pieces with theorem provers (Karn's RTT algorithm and TCP's timeout rule in Ivy and ACL2s, and Go-Back-N efficiency in ACL2s), model-checks TCP, DCCP and SCTP handshakes in SPIN, then builds Korg, a tool that searches for attacker behaviour that breaks a given property. - number: Handshake properties: TCP 4 (phi1-phi4), SCTP 10 (gamma1-gamma10), DCCP has its own set - number: Korg asked for at most 10 attacks per property; default search depth 600,000, maximum 2,400,000 - number: TCP phi3 (peers do not get stuck) took 72 min to 223 min per attacker model; other TCP properties took seconds - number: SCTP: one patched-vs-unpatched check; with the CVE-2021-3772 patch, Korg finds no off-path attack, which proves the patch closes it for the model - limits: Models are small by design to avoid state-space explosion; the handshake models are not linked to the Ivy/ACL2s models. Korg handles one centralized attacker, not coordinated multi-process attackers, and is exact only for the model, not the real code. Models took long to write by hand. - how much was read: parts read - source; notes: ## Von Hippel thesis on protocol verification and attack synthesis (20 - record id: `korg-thesis-2025` - Lean-auto (2025) - title: Lean-auto: An Interface between Lean 4 and Automated Theorem Provers - what: A Lean 4 tool that translates a Lean proof goal and its premises into the simpler logic that automated provers (SMT solvers like Z3 and CVC5, the Zipperposition prover, and Lean's own Duper) accept, so those provers can try to close the goal; the translation is proven sound. - number: Benchmark: 149,142 user-declared Mathlib4 theorems, 10 s limit each, premises taken from the human proof - number: Lean-auto + Duper (with proof reconstruction) solves 36.6%, 5.0 points more than the best earlier tool, Aesop - number: Solved: Lean-auto best-of-all 61,906 vs Aesop best-of-all 48,413 vs simp_all 28,204; 22,020 solved only by Lean-auto - number: All tools together solve 79,396 (53.2%) - limits: Premise selection is not included: the evaluation hands the tool the exact theorems the human proof used. Proof reconstruction exists only for the native Duper prover; with SMT solvers the output is trusted. Sections 2-3 and the appendices (E, I-L) were not read closely. - how much was read: parts read - source; notes: ## Lean-auto (2025) - record id: `lean-auto-2025` - PolySemist (2025) - title: Accelerating Protocol Synthesis and Detecting Unrealizability with Interpretation Reduction. - what: A tool that fills in the missing guards and updates of a half-written TLA+ distributed protocol (a sketch) so the protocol meets a safety or liveness property. It loops: the TLC model checker finds a counterexample, the tool rules out every candidate that shares it, and it skips candidates that behave the same on the states seen so far. - number: 7 benchmark protocols: 2PC, consensus, decentralized lock, lock server, sharded KV store, two reconfigurable Raft variants - number: faster than the previous tool Scythe in 160 of 171 realizable problems; total time about 9,000 s vs 32,000 s on those both solve - number: whole distributed-lock protocol (6 expressions over 2 actions) synthesized in 125 s; Scythe timed out at 1 hour - number: detected 'no protocol exists' in 80 of 123 unrealizable problems vs 16 for Scythe (easy 46/50, medium 21/35, hard 13/38) - limits: A human supplies the sketch (state variables, actions, hole grammars) and the property; results hold only for the chosen finite parameters (e.g. number of nodes), and the all-parameters step is left to TLAPS proofs from prior work. Termination is guaranteed only when each hole grammar has finitely many expressions up to interpretation equivalence. - how much was read: parts read - source; notes: ## PolySemist: protocol synthesis by sketching (2025) - record id: `polysemist-2025` - Ticl (2025) - title: Structural Temporal Logic for Mechanized Program Verification - what: A temporal logic over program structure, in Rocq. Liveness proofs follow loops and sequencing the way Hoare logic does, using invariants and well-founded variants (quantities that cannot decrease forever). - number: Leader election: 123 lines definitions and 115 lines proofs - number: Scheduler queue: 137 lines definitions and 362 lines proofs - limits: It is shown only on ring leader election with no failures. - how much was read: parts read - source - record id: `ticl-2025` - Caliper (2024) - title: Almost-Sure Termination by Guarded Refinement - what: Caliper moves a proof of almost-sure termination (termination with probability one) from a simple probabilistic model to higher-order code. It does this through refinement. - limits: The examples are sequential and probabilistic: loops, a list generator, treaps and a Galton-Watson sampler. It has no randomized network consensus. The notes extracted no effort totals. - how much was read: parts read - source - record id: `caliper-2024` - Hybrid-CAR assumption ordering (2024) - title: Revisiting Assumptions Ordering in CAR-Based Model Checking - what: Improves CAR bug-finding by reordering SAT assumptions using multiple recent unsatisfiable cores and periodically switching configurations. CoreLocality intersects the current state with a sequence of recent cores, putting newer intersections first, and prioritizes the core's conflict literal. Hybrid-CAR retains only the lowest U-sequence level on restart, clears other levels and changes the ordering configuration. It optionally increases the restart limit to preserve completeness. - number: Per-instance memory 8GB and default timeout one hour. Reported solved-unsafe counts: Hybrid-CAR 166, BAC 161, ABC-BMC 159, BICAR 155, KCAR 151, original CAR 146. Hybrid-CAR solves six instances uniquely among the compared tools; its two-tool portfolio with ABC-BMC solves 178 versus virtual best 184. - limits: Evaluation concerns unsafe/unknown AIGER hardware instances and bug-finding rather than a general safety-proving improvement. Core locality is an empirical hypothesis about solver behavior. Restart time, core history and SAT implementation affect performance. This reading covers the new methods and reported comparisons; baseline proofs and code were not rerun. - how much was read: parts read - - record id: `hybrid-car-assumption-ordering-2024` - LinearActris (2024) - title: Deadlock-Free Separation Logic: Linearity Yields Progress for Dependent Higher-Order Message Passing - what: A linear separation logic (a logic where resources are used exactly once), mechanized in Coq. For message-passing programs, deadlock freedom and leak freedom follow from the logic itself. - limits: It covers message passing only, with no locks, semaphores or monitors. Deadlock freedom is weaker than every request being answered (the notes' inference). - how much was read: parts read - source - record id: `linearactris-2024` - RefinedRust (2024) - title: RefinedRust: A Type System for High-Assurance Verification of Rust Programs - what: A tool that checks Rust code, including unsafe code that uses raw pointers, against hand-written specs and emits a proof that the Coq proof assistant checks, so the tool itself need not be trusted. Demonstrated on a simplified Vec (growable array). - number: Vec and RawVec APIs: 120 lines of code, 76 lines of annotations, about 1200 lines of generated Coq - number: verification takes about 6 minutes wall time (22 minutes CPU) on an Apple M1 Max - number: for Vec::pop: about 3,000 automatic steps, 100 side conditions, all but five solved automatically, about 20 lines of manual Coq - number: type system formalization: about 21k lines of specification and 14k lines of proof; about 80 lines of manual Coq for Vec's invariant - limits: Only sequential code: no concurrency, traits, closures, recursive types or unsized types. Trusts the Rust model (Radium) and the Rust-to-Coq frontend. The Vec code is simplified from the standard library. - how much was read: parts read - source; notes: RefinedRust (2024) - record id: `refinedrust-2024` - Trillium / Fairis (2024) - title: Trillium and Fairis - what: A program-logic framework in Coq and Iris. Fairis proves liveness of concurrent programs under fair scheduling, by refinement of a model. The Aneris instantiation proves that distributed implementations refine TLA+ models (two-phase commit, single-decree Paxos and a CRDT). - number: about 1100 lines of proof scripts for Paxos - limits: The step from TLA+ to the Coq model was done manually. The distributed refinements give trace safety only. Distributed liveness is in a later manuscript. The notes' author read about 40%. - how much was read: parts read - source - record id: `trillium-fairis-2024` - Updria / Lambda (2024) - title: Invariant Checking for SMT-Based Systems with Quantifiers - what: Two algorithms that automatically find invariants of the form 'for all processes i, j: …' for protocols with an unbounded number of nodes and numeric data. One refines an abstraction step by step (Updria); the other generalizes from small instances and then checks the guess (Lambda). - number: benchmarks: 238 MCMT-format systems, 52 VMT/MyPyvy systems, 25 train-control systems - number: MCMT family: Lambda solves 214, Updria 208, MCMT 172 of 238 (Table 3) - number: VMT family: Lambda 29, Updria 29, Ic3po 36, MyPyvy 27 of 52 - number: trains family: Lambda 25, Updria 24 of 25 - limits: Finds only universally quantified invariants, so it fails where an existential quantifier is needed (7 more instances solved by Ic3po). The problem is undecidable, so both algorithms may not terminate; Lambda comes with no guarantee that its guess works. Safety only; no liveness. - how much was read: parts read - source; notes: ## Invariant Checking for SMT-based Systems with Quantifiers (2024) - record id: `updria-lambda-2024` - Verification and synthesis of distributed systems with weak synchronisation (2024) - what: A theory thesis on deciding, for processes that talk only by broadcast or only by taking and releasing locks, whether a system meets a property, and whether processes can be given local strategies that guarantee it. The trick is to pick a small description of what each process may do alone (an invariant or a set of patterns) and check whether any combination of such local runs can go wrong. - number: 254 pages, three models: broadcast networks of register automata, lock-sharing systems, dynamic lock-sharing systems - number: coverability for broadcast networks with data is complete for the class F_omega^omega, so needs non-primitive-recursive time - number: verification of lock-sharing systems with 2 locks per process or nested locks is NP-complete; synthesis is Sigma_2^P-complete - number: synthesis of local controllers is undecidable for general lock-sharing systems - limits: Pure decidability and complexity results with no tool or benchmark; the models are heavily restricted (only broadcast or only locks), and the author notes adding a shared variable makes the lock model undecidable. Read from the introduction, summaries and conclusions only, not the proofs. - how much was read: parts read - source; notes: ## Mascle thesis: weak synchronisation (2024) - record id: `verification-and-synthesis-of-2024` - Width-Based ATP (2024) - title: From Width-Based Model Checking to Width-Based Automated Theorem Proving - what: Turns finite coherent dynamic-programming descriptions of graph properties into bounded-width conjecture tests and counterexample construction procedures. Treelike decomposition classes separate width representations from DP-cores. Coherence requires graph-level answers to be independent of the chosen decomposition. Lemma 15 reduces graph-class inclusion to acceptance of all bounded-width decomposition terms. Theorem 23 combines finite internally polynomial coherent cores through a polynomial combinator; refutation terms produce bounded-height counterexamples. - number: Typical stated running time is 2^O(β(k)μ(k)), bounded by a double exponential in core bitlength; other decomposition and arity parameters appear in Theorem 23. Applications include bounded-treewidth forms of Hadwiger, Tutte-flow and Barnette conjectures. - limits: The theorem depends on finite cores, coherent encodings, bounded width and effective decomposition automation. Testing all graphs up to a fixed width is not a proof of an unrestricted graph conjecture. Full core constructions and all application proofs were not reread; no implementation or experimental runtime is claimed. - how much was read: parts read - - record id: `width-based-atp-2024` - IronSync (2023) - title: Sharding the State Machine: Automated Modular Reasoning for Complex Concurrent Systems - what: It connects ownership reasoning (who may access what) for thread-local code to a global transition model. Cases: a NUMA node-replication library, and SplinterCache, a concurrent page cache. - number: 2747 lines of non-ghost implementation plus 316 of shared library, for all four concurrent examples (§7.1, PDF p.12) - limits: It covers shared-memory systems, not networking. It does not verify liveness, termination or freedom from deadlock. It trusts the framework's axioms and the memory model. - how much was read: parts read - source; notes: papers; notes: Sharding the State Machine: Automated Modular Reasoning for Complex Co - record id: `ironsync-2023` - Modular termination verification with a higher-order concurrent separation logic - intermediate report (2022) - what: Builds on Iris without modifying it. Reasons about termination of non-blocking concurrent algorithms one module at a time. Turns termination into a safety property by using call permissions. Applied to a lock-free stack with helping. - limits: Blocking concurrency under fair scheduling is only sketched. - how much was read: parts read - source - record id: `modular-termination-verification-with-2022` - Civl FMCAD 2021 (2021) - title: The Civl Verifier - what: Describes a static verifier for concurrent programs. It proves a program in layers, where each layer is shown to match the one above. It uses checks for interference between threads, a step-merging technique called reduction, and permissions. Case studies include garbage collection, Paxos and locks. - limits: The test suite is a repository that keeps changing. It is not a fixed protocol benchmark. Pin a commit. - how much was read: parts read - source; notes: Civl and inductive sequentialization; notes: S16 - record id: `civl-fmcad-2021-2021` - CoMuS hierarchical modular verification (2021) - title: Modular Verification of Concurrent Programs via Sequential Model Checking - what: CoMuS checks concurrent safety by iteratively generating sequential verification tasks for individual threads and their abstract environments. The main thread calls an initially havocing env_move function. A counterexample triggers an environment reachability query: infeasible interference refines env_move; feasible suffixes produce earlier promises of error as assertions. The environment uses try_start to represent reachable noninitial computations. Multiple threads are handled recursively in a chosen hierarchy. Termination is proved for finite variable domains, while progress alone is claimed for infinite domains. - number: Implementation uses Python 3.5, pycparser, SeaHorn and Z3. Dynamic-programming tests use a 3,600s timeout; chain/ring tests use 1,200s. Reordering the last two threads in long_th3_safe raises reported time from 10 to 25 seconds. Numeric figure cells not recoverable from extracted text were not inferred. - limits: Sequentially consistent shared memory, fixed thread count and a restricted C subset. The prototype lacks dynamic thread creation and alias analysis. Performance depends on an order matching the program's dependency hierarchy; the authors report other tools usually outperform it on their supported general SV-COMP subset. Full proofs are linked separately rather than supplied here. - how much was read: parts read - - record id: `comus-hierarchical-modular-verification-2021` - HyperVis (2021) - title: Visual Analysis of Hyperproperties for Understanding Model Checking Results - what: HYPERVIS presents coordinated visual views of a system, HyperLTL formula, multiple execution traces and explanations of a counterexample. Five linked views show formula structure, a Moore transition graph, trace values, time and explanation statements. Causal analysis marks atomic propositions relevant to violation; highlighting/filtering and debugger-style stepping connect these components. The user study asks participants to diagnose system errors, edit a formula and find a violation in a larger trace pair. - number: Five views; six participants with average age 27.5 years; self-rated model-checking expertise 4.5/5 and hyperproperty expertise 4.0/5. The larger task uses 29 time steps and 50 atomic propositions. - limits: The feedback study has six knowledgeable participants, supplied examples and approximately hour-long sessions; it is not a controlled claim of universal productivity improvement. The larger study case omits graph view because of system size. Causal explanation supports understanding of a returned counterexample, rather than proving the visual interface or every system correct. Tool execution and figures were not independently inspected. - how much was read: parts read - - record id: `hypervis-2021` - Temporal prophecy (2021) - title: Temporal prophecy for proving temporal properties of infinite-state systems - what: Adds prophecy variables (recorded predictions about future execution) to the earlier abstraction method. This lets it keep distinctions that the abstraction lost, without strengthening the contract with the environment. - number: four cases: ticket protocol, alternating bit, hybrid reliable broadcast, TLB shootdown - number: user invariant conjectures 60, 70, 58, 102 - number: checking takes 7, 25, 25, 240 seconds - number: Figure 3 (model lines; conjectures; checker seconds): ticket with task queues 90; 60; 7; alternating bit 143; 70; 25; hybrid reliable broadcast 166; 58; 25; TLB shootdown 468; 102; 240 (checking time, not authoring time) - limits: Prophecy formulas are extracted automatically only from an invariant the user supplies. Choosing the witness is manual. No claim of completeness. - how much was read: parts read - source; notes: Ivy: dynamic abstraction and temporal prophecy; notes: additional temporal methods - record id: `temporal-prophecy-2021` - Civl refinement CAV 2020 (2020) - title: Refinement for Structured Concurrent Programs - what: This paper moves refinement reasoning (showing that a detailed program implements a simpler one) into structured concurrent programs. It uses yield invariants and permissions. - limits: The paper has no fixed, complete list of protocol benchmarks. - how much was read: parts read - source; notes: Civl and inductive sequentialization; notes: S15 - record id: `civl-refinement-cav-2020-2020` - Inductive sequentialization (2020) - title: Inductive Sequentialization of Asynchronous Programs - what: The user supplies a simpler sequential ordering of the steps of an asynchronous program, plus evidence that steps can be swapped (commute). A checked induction then shows the simplification is sound. - number: Table 1 (7 problems): Broadcast consensus 396/108/121 LOC 1.0s; Ping-Pong 281/91/106; Producer-Consumer 225/65/93; N-Buyer 681/251/256; Chang-Roberts 377/117/135; 2PC 553/181/222; Paxos 1168/534/302, 4.2s - number: IS applications: 2,1,1,4,2,4,1 - limits: It asserts no liveness result. The review notes found no measurement of human hours. The line counts include boilerplate. - how much was read: parts read - source; notes: Civl and inductive sequentialization - record id: `inductive-sequentialization-2020` - Apalache (2019) - title: Apalache: temporal properties tutorial, feature table and TLA+ model checking made symbolic - what: Apalache is a model checker for TLA+ that works on symbols instead of listing states, using an SMT solver. It checks state, action and trace invariants, inductive invariants (a property that holds at the start and is preserved by every step) and temporal properties. - limits: Apalache parses ASSUME but does not pass it to the solver. It does not use THEOREM. Its bounded checks do not prove properties for unbounded runs. The authors did not read the original paper. - how much was read: parts read - source; notes: tools; notes: Model checking: what a successful run means - record id: `apalache-2019` - Equilibria-based probabilistic model checking (2019) - title: Equilibria-Based Probabilistic Model Checking for Concurrent Stochastic Games. - what: Extends rPATL and PRISM-games to synthesize subgame-perfect social-welfare-optimal Nash equilibria for two coalitions with distinct probabilistic or reward objectives. Finite-horizon objectives use recursive game solution; infinite-horizon objectives use approximate epsilon-equilibria and value iteration. Bimatrix equilibria are encoded through labelled polytopes and enumerated with Z3, with dominated-strategy filtering. The modeling language permits joint action-dependent updates and rewards. - number: Table 1 includes an Aloha model with 2,308,349 states and 10,362,711 transitions, and a robot model with 389,377 states and 27,267,419 transitions. Authors report under-two-hour solutions for their examples, while choice-dense models are limited to tens of thousands of states. Experiments use a 2.10GHz Xeon and 16GB RAM. - limits: Infinite-horizon probability queries exclude nonterminal end components; reward targets must be reached almost surely under every strategy profile. Without these conditions the presented value iteration need not converge. The coalition-based result is not an unrestricted multi-player Nash solver. Model size alone does not determine runtime: many per-state choices make local equilibrium solving expensive. Appendix convergence proofs and code were not reread. - how much was read: parts read - source - record id: `equilibria-based-probabilistic-model-checking-2019` - HotStuff (2019) - title: HotStuff: BFT Consensus in the Lens of Blockchain - what: HotStuff is BFT consensus (it tolerates arbitrarily faulty replicas) with n=3f+1 replicas, a known delay bound Δ and an unknown GST. If a correct leader stays in one view long enough after GST, Basic HotStuff decides. A Pacemaker keeps replicas and leaders in step. - limits: The argument is handwritten. The deployed Pacemaker is not machine-checked. The chained variant needs two consecutive correct leaders, and its liveness argument is omitted for brevity. Completing in a single view does not establish that this view is eventually selected (an inference). - how much was read: parts read - source; notes: HotStuff; notes: Consensus: where the assumptions enter the proof - record id: `hotstuff-2019` - Incremental BMC of CUDA ANNs (2019) - title: Incremental Bounded Model Checking of Artificial Neural Networks in CUDA - what: Extends ESBMC-GPU with CUDA neural-library operational models and incremental bounded model checking for neuron-coverage conditions and adversarial inputs. Operational models approximate cuBLAS/cuDNN behavior for symbolic verification. Coverage assertions encode sign/value changes across neurons and input pairs; a nondeterministic image constrained by a distance bound searches for changed classifications. The experiments distinguish fast coverage checks from expensive bit-accurate adversarial search. - number: Coverage threshold P=80%; an illustrative pair covers only three of 14 neurons (21%). The authors report 14 adversarial-case experiments with average verification time approximately 19 hours. Code and benchmark links are given but not executed here. - limits: The models' equivalence is supported by the authors' manual checking and conformance testing, not a supplied mechanized equivalence proof. BMC conclusions depend on assertions, model fidelity and unwinding coverage. The displayed experiment command disables division-by-zero, pointer and bounds checks, so these runs cannot establish general CUDA memory safety. Direct tool comparison was limited by compatibility issues. - how much was read: parts read - - record id: `incremental-bmc-of-cuda-anns-2019` - QED at Large (2019) - title: QED at Large: A Survey of Engineering of Formally Verified Software - what: A survey of proof engineering (building and maintaining machine-checked proofs). - how much was read: parts read - source; notes: S12 - record id: `qed-at-large-2019` - Iris (2018) - title: Iris from the ground up: A modular foundation for higher-order concurrent separation logic - what: This paper explains a checked framework for reasoning about concurrent programs. Ghost resources (resources that exist only in the proof) are tied to program state through invariants. - limits: The paper covers Iris 3.1. The current project has newer references. - how much was read: parts read - source; notes: S7 - record id: `iris-2018` - Tendermint (2018) - title: The latest gossip on BFT consensus - what: The paper presents the Tendermint algorithm. It proves that, after GST, a favorable round arises from the proposer rotation, the growing timeouts and the gossip. Then all correct participants decide. - number: faulty voting power below one third of total - limits: The proof is handwritten. It says nothing about verifying current Tendermint successors. The fault unit is voting power, not replica count. The page reference for lemma 7 in the inherited review was wrong for the v3 the review notes inspected. - how much was read: parts read - source; notes: Tendermint; notes: Consensus: where the assumptions enter the proof - record id: `tendermint-2018` - Bounded quantifier instantiation (2017) - title: Bounded Quantifier Instantiation for Checking Inductive Invariants - what: This work limits how deeply quantifiers are instantiated, not the number of participants. That makes checking an inductive invariant decidable (a procedure always gives an answer). - number: Journal Table 1: 9 rows; conference Table 1 has 7 (no trusted-chain rows) - number: Bound 1 proves the invariant inductive in all correct examples - limits: No artifact is available. The ring case checks an invariant related to termination, not a full liveness proof. - how much was read: parts read - source; notes: Cutoff and bounded instantiation leads - record id: `bounded-quantifier-instantiation-2017` - ConsL cutoff (2017) - title: Cutoff Bounds for Consensus Algorithms - what: It describes round-based consensus algorithms in a small language, ConsL. It proves bounds on how many processes are enough to check. It translates the algorithms to Promela/LTL for the Spin model checker. - number: Table 2: 9 cases (Paxos, Paxos 3 rounds, Chandra-Toueg, an algorithm from Consensus Refined, 1/3-rule, coordinated uniform voting, simplified version, uniform voting variant, Ben-Or) - number: Cutoffs: 5 processes, except 1/3-rule at 7 - number: Pages 217-237 - limits: Progress claims keep the communication assumptions. Failed processes keep receiving, but their messages are suppressed. Ben-Or termination here is not termination with probability one against arbitrary adversaries. The notes did not recover the generated model download. - how much was read: parts read - source; notes: Cutoff and bounded instantiation leads - record id: `consl-cutoff-2017` - F* (2016) - title: Dependent Types and Multi-monadic Effects in F* - what: F* is a language that mixes effectful programming, contracts, dependent types and solver automation. - how much was read: parts read - source; notes: S20 - record id: `f-2016` - Viotti-Vukolić survey (2016) - title: Consistency in Non-Transactional Distributed Storage Systems - what: A map of definitions of consistency models (causal, eventual and others) for non-transactional storage. - limits: It excludes transactional semantics. It is not the primary source for each model. - how much was read: parts read - source; notes: S24 - record id: `viotti-vukolic-survey-2016` - CPDT (2013) - title: Certified Programming with Dependent Types - what: A book on proof automation in Coq, on abstraction, and on certified programs (programs proved correct) that can run. - how much was read: parts read - source; notes: C4 - record id: `cpdt-2013` - Formal Verification of Distributed Algorithms: From Pseudo Code to Checked Proofs (2012) - what: Isabelle/HOL proofs of safety and liveness for consensus algorithms. They use a transition system with explicit runs. The examples are a Rotating Coordinator, Chandra-Toueg consensus and Paxos. - number: approximately 10k lines of Isabelle/HOL per algorithm - limits: The work is old and manual. The review notes read about 50% of it. - how much was read: parts read - source - record id: `formal-verification-of-distributed-2012` - Heard-Of (AFP) (2012) - title: Verifying Fault-Tolerant Distributed Algorithms in the Heard-Of Model - what: Isabelle proofs of six consensus algorithms in the Heard-Of model. Two ways of defining runs are linked by a reduction theorem. Termination of LastVoting is proved under a "communication predicate" (a condition on which messages arrive) instead of weak or strong fairness. - number: six consensus algorithms (OneThirdRule, Uv, LastVoting, Ute, Ate, Eigbyz) - limits: The communication predicate is a strong assumption about the environment: a good phase in which a coordinator hears a majority and everyone hears the coordinator. The user must argue that it is realistic (the notes' inference). - how much was read: parts read - source - record id: `heard-of-afp-2012` - Towards a Notion of Unsatisfiable and Unrealizable Cores for LTL (2012) - what: The paper defines cores. A core isolates the part of a requirement set that is unsatisfiable or unrealizable (no implementation could meet it). The paper defines cores at several granularities, from whole requirements to proof structures. It also discusses vacuity (a requirement that passes for no real reason). - number: lift example: 6 of 49 conjuncts isolate an inconsistency (§8.1) - limits: A core explains a failure, but not necessarily every failure. It does not tell which restrictions on the environment the customer intended. The normal-form proofs were not checked. - how much was read: parts read - source - record id: `towards-a-notion-of-2012` - CRDT study (2011) - title: A comprehensive study of Convergent and Commutative Replicated Data Types - what: It gives sufficient conditions for replicated objects to converge, both state-based and operation-based. The conditions are merge and commutation laws plus assumptions about message delivery. - how much was read: parts read - source; notes: S25 - record id: `crdt-study-2011` - Why3 (2011) - title: Why3: Shepherd Your Herd of Provers - what: Logical models, and transformations of proof tasks, that target several provers. - how much was read: parts read - source; notes: S22 - record id: `why3-2011` - Dafny (2010) - title: Dafny: An Automatic Program Verifier for Functional Correctness - what: The paper presents the Dafny language and verifier: contracts, how the heap is modeled, and how programs are encoded for the solver. - how much was read: parts read - source; notes: S21 - record id: `dafny-2010` - Hyperproperties (2010) - what: Defines hyperproperties, which are specifications over sets of executions. Shows that refinement can break them, for example by leaking a secret. Shows that k-safety hyperproperties reduce to safety on k copies of the system. - limits: A mathematical classification only. No runnable artifact. k-safety does not cover all hypersafety, and the paper does not solve hyperliveness (the progress counterpart). - how much was read: parts read - source; notes: wishes comparing several executions - record id: `hyperproperties-2010` - CompCert (2009) - title: Formal verification of a realistic compiler - what: CompCert, a verified C compiler written in Coq. Gives the classic ratio of effort for a verified system. - number: 42000 lines of Coq, approximately 3 person-years - number: 14% compilation algorithms, 10% semantics, 76% correctness proof - number: each compilation pass takes 1500 to 3000 lines for spec and proof - number: 42000 lines of Coq and approximately 3 person-years (that historical version) - limits: Only the paragraph on effort was read. - how much was read: parts read - source; notes: S14 - record id: `compcert-2009` - Environment Assumptions for Synthesis (2008) - what: This work computes environment assumptions from a spec alone, so that a conditional spec becomes implementable. It first forbids unsafe environment moves. It then adds strong fairness (an action that is enabled infinitely often must eventually run) to some of the remaining moves. - number: smallest set of fair edges is NP-hard (Theorem 11) - number: safety sufficiency check polynomial; fairness minimization yields a set with no removable subset, not the smallest (Theorem 12) - limits: No unique maximal sufficient assumption exists. The results are for finite reactive games, and there is no distributed benchmark. It does not certify an implementation that was already chosen. - how much was read: parts read - source - record id: `environment-assumptions-for-synthesis-2008` - Separation logic (2002) - title: Separation Logic: A Logic for Shared Mutable Data Structures - what: Adds a separating conjunction P * Q for assertions about disjoint parts of memory. Adds a frame rule, so the proof of a small component can be reused inside a larger heap. - how much was read: parts read - source; notes: S6 - record id: `separation-logic-2002` - Specifying Systems (2002) - what: This book builds TLA+ specifications from state, initial conditions and allowed steps. It then adds requirements that something eventually happens, and fairness (an action that stays possible eventually runs). - limits: The notes read only chapter 8 and the passages on refinement. A spec that covers only safety permits a system to do nothing. Fairness on a combined action can miss the starvation of one request. - how much was read: parts read - source - record id: `specifying-systems-2002` - Specifying Systems (2002) - title: Specifying Systems: The TLA+ Language and Tools for Hardware and Software Engineers - what: A book on TLA+. Chapters 2-5 develop initial states and allowed next steps. Chapters 8 and 14 cover progress conditions and model checking. - limits: Translation does not decide which failures or observations the human cares about (the notes' inference). - how much was read: parts read - source; notes: human specification practice; notes: P03. Specifying Systems - record id: `specifying-systems-2002-2` - PBFT (1999) - title: Practical Byzantine Fault Tolerance - what: Clients eventually get replies if at most (n-1)/3 replicas are faulty and message delays do not grow faster than the timeout forever. The proof raises view timeouts, gets correct replicas into the same view, and rotates primaries until a correct one has enough time. - limits: Read in the official HTML because the PDFs failed. The delay condition is specific to this paper. It is not the modern GST contract. - how much was read: parts read - source; notes: Consensus: where the assumptions enter the proof; notes: PBFT - record id: `pbft-1999` - Forward/backward simulations (1995) - title: Forward and Backward Simulations, Part I: Untimed Systems - what: It defines relations between steps of two systems (forward and backward simulations). They prove that one system's visible behaviors are included in the other's. They are for cases where a plain abstraction function cannot match the choices the systems make. - how much was read: parts read - source; notes: S3 - record id: `forward-backward-simulations-1995` - TLA (1994) - title: The Temporal Logic of Actions - what: The paper describes a system as states and allowed steps (behaviors). It gives a logic for safety and for temporal properties such as progress that rests on fairness. - limits: The hard work sits in the invariants for the premises of WF1 (the proof rule for weak fairness). Page numbers refer to the manuscript on the author's site. - how much was read: parts read - source; notes: S1; notes: P02. The Temporal Logic of Actions; notes: connecting different descriptions of the same behavior - record id: `tla-1994` - Refinement mappings (1991) - title: The Existence of Refinement Mappings - what: It shows that suitable refinement mappings (functions from implementation states to spec states) exist once auxiliary variables are added under stated hypotheses. It covers three obstacles: history, prophecy (needing to know the future) and step granularity. - limits: It is a completeness result. It is not an algorithm that finds the variables or the mapping. The notes' author did not fully read the proofs. - how much was read: parts read - source; notes: S2; notes: connecting different descriptions of the same behavior - record id: `refinement-mappings-1991` - DLS partial synchrony (1988) - title: Consensus in the Presence of Partial Synchrony - what: It defines two ways to weaken synchrony. In one, the timing bounds are fixed but unknown. In the other, the bounds are known but hold only after an unknown global stabilization time. It gives consensus algorithms whose agreement always holds and whose termination holds after stabilization. - number: crash/omission consensus needs N >= 2t+1 and Byzantine needs N >= 3t+1 in the partially synchronous columns of Table I - number: Algorithm 1: all correct processors decide by round GST + 4(N+1) in the basic round model - number: Theorem 4.1(b): N >= 3t+1 - limits: The proofs are on paper, with no machine-checked artifact. The bound is counted in rounds of the basic round model, not in seconds. A timeout is not evidence of a crash. - how much was read: parts read - source; notes: Dwork–Lynch–Stockmeyer partial synchrony; notes: Consensus: where the assumptions enter the proof - record id: `dls-partial-synchrony-1988` - FLP (1985) - title: Impossibility of Distributed Consensus with One Faulty Process - what: Shows that no deterministic asynchronous consensus protocol can guarantee a decision on every allowed execution if one process may stop, even when messages are always eventually delivered. - limits: This is an impossibility result under its stated assumptions only. Randomization or eventual synchrony changes the problem. - how much was read: parts read - source; notes: S26; notes: Consensus: where the assumptions enter the proof - record id: `flp-1985` - Byzantine Generals (1982) - title: The Byzantine Generals Problem - what: The paper defines faulty participants that may act arbitrarily and give different information to different peers. It also separates different assumptions about messages. - limits: The claimed thresholds depend on the paper's assumptions about messages and synchrony. - how much was read: parts read - source; notes: S27 - record id: `byzantine-generals-1982` - A formal semantics for concurrent systems (1979) - what: Formalizes extended semaphore primitives using vector firing sequences and sketches a concurrency-preserving translation from bounded semaphore programs into COSY, a path/process notation for concurrent-system behavior. Available body pages introduce cyclic COSY paths/processes with sequencing, exclusive choice and iteration; distinguish identically named operations in separate processes; and represent histories using component sequences. Defines atomic pe operations requiring specified semaphores positive and other specified semaphores zero before simultaneous decrements, and ve operations incrementing selected semaphores. ESP programs are cyclic sequential processes without jumps or conditionals and use ESPs as their only synchronization. An inductive semantics tracks process histories, semaphore histories and integer valuations. Bounded semaphore behavior is encoded by finite COSY paths, with a replicator macro for repeated structure; semaphore tests/increments/decrements are replaced by corresponding program-operation choices. A second reader-writer example is translated, with maximum semaphore values w, r and 1 for w writers/r readers. A theorem states equality of vector-firing-sequence sets and valuation functions, with an induction proof sketch. An unbounded extension discusses infinite counters, directed limits and possible domain/fixed-point constructions rather than giving a completed construction. - number: Newcastle Technical Report132, April1979;16 physical scan pages. - number: Available body printed pages1–3 and6–14; printed4–5 absent. - number: Reader-writer example maximum A,R,M semaphore values: w,r,1. - limits: Recovered source is Newcastle University Technical Report 132, April 1979, with a cover saying to appear in Kyoto proceedings August 1978. DOI metadata identifies the same title/authors as a 1979 LNCS chapter pp.571–584; this scan is a report version, not demonstrated identical to the published chapter. All 16 supplied PDF images were viewed, but the scan skips printed pages 4–5: physical page7 is printed3 and physical8 is printed6. Missing pages include part of the COSY/VFS definitions. Thus this is a reading of the complete available scan, not a complete-paper reading. PDF text extraction supplies no usable body text; quotations are manual selected-passage transcriptions. Mathematical syntax/proof details were visually read where available, but not independently checked, mechanized or executed. The bounded translation is for a restricted semaphore-only coordination language, not arbitrary concurrent programs; its proof is explicitly a sketch. Unbounded completion is speculative in this report. No performance, industrial-scale validation or automatic verification tool is supplied. - how much was read: parts read - source - record id: `a-formal-semantics-for-1979` - Sequential consistency (1979) - title: How to Make a Multiprocessor Computer That Correctly Executes Multiprocess Programs - what: This is the original definition of sequential consistency: there is one sequential order that preserves each processor's program order. It has no real-time constraint. - how much was read: parts read - source; notes: S23 - record id: `sequential-consistency-1979` - Hoare logic (1969) - title: An Axiomatic Basis for Computer Programming - what: Introduces reasoning about programs with assertions: if P holds before the program runs and the program finishes, then Q holds after. - limits: A historical source. The notes spell out the modern distinction between partial correctness (right if the program ends) and total correctness (right, and it ends). - how much was read: parts read - source; notes: S5 - record id: `hoare-logic-1969` - Alloy - what: A modelling tool that describes a system with relations. It checks models only up to a chosen size limit (the scope). Alloy 6 adds mutable state, a temporal logic and solvers. - limits: The size limit is part of what a result means. A passing check is not a proof about an implementation the model is not tied to. - how much was read: parts read - source; notes: Alloy and Event-B - record id: `alloy` - coq-tla - what: An embedding of TLA in Coq, built to help people understand progress proofs through small examples. - limits: The README says: 'not suitable for large systems or complex temporal reasoning'. - how much was read: parts read - source; notes: R03. Embeddings in Dafny, Coq, Lean, and Isabelle - record id: `coq-tla` - Dafny termination tutorial - title: Dafny Documentation: Termination - what: Dafny uses decreases annotations to show that loops and recursion end. It guesses common ones, for example B-A. It supports integers, sequence length, strict set inclusion and lexicographic tuples (Ackermann uses decreases m, n). Writing 'decreases *' opts out. - limits: It proves that a computation ends. It does not prove that messages are eventually delivered or that the scheduler is fair. - how much was read: parts read - source; notes: Native termination support: Verus, Dafny, Lean - record id: `dafny-termination-tutorial` - Event-B - title: Event-B / Rodin - what: Event-B builds models from sets, with proof obligations and refinement between levels of the model. The code-generation page discusses Tasking Event-B, which aims at executable implementations. - limits: There are several generation approaches, each with different restrictions. Nothing proves in general that Event-B refinements give verified distributed Rust. - how much was read: parts read - source; notes: Alloy and Event-B - record id: `event-b` - impy - what: Tool support for brainstorming about Dafny-TLA. - limits: It is exploratory and not a finished translator. - how much was read: parts read - source; notes: R03. Embeddings in Dafny, Coq, Lean, and Isabelle - record id: `impy` - Lean 4 book - title: Theorem Proving in Lean 4 - what: A book on propositions, inductive types, tactics and checked proofs in Lean 4. - limits: It is not a ready-made method for verifying distributed systems. - how much was read: parts read - source; notes: C3 - record id: `lean-4-book` - lean_concurrency - what: An exploratory Lean repository on concurrency. - limits: The material the notes inspected was too sparse to show what it translates or to establish any refinement guarantee. - how much was read: parts read - source; notes: R03. Embeddings in Dafny, Coq, Lean, and Isabelle - record id: `lean-concurrency` - Lean recursion reference - title: Lean Language Reference: Recursive Definitions (§7.6) - what: Lean provides termination_by, well-founded relations (orderings with no infinite descent) and tactics that prove a decrease. When the decreasing measure is not an argument (the array-index case), a separate measure is needed. Also describes partial fixpoints and partial definitions. - limits: Recursive Lean code alone does not show termination. Check the definition mode and the theorem statement. - how much was read: parts read - source; notes: Native termination support: Verus, Dafny, Lean - record id: `lean-recursion-reference` - nuXmv - title: nuXmv model checker - what: A model checker for finite-state systems (using SAT) and infinite-state systems (using SMT). Its features page lists K-liveness alongside IC3, bounded model checking, and abstraction/refinement. - limits: Record which algorithm ran and whether it returned a proof, a counterexample, unknown, or success within a bound. There is no effort statistic for any specific case. - how much was read: parts read - source; notes: Model checking: what a successful run means - record id: `nuxmv` - Software Foundations Hoare - title: Software Foundations, Programming Language Foundations: Hoare Logic - what: This is a course chapter with executable Coq exercises on Hoare triples and partial correctness (the result is right if the program finishes). - how much was read: parts read - source; notes: C1 - record id: `software-foundations-hoare` - Spin - title: Spin model checker (manual: ltl and Pan options) - what: Spin takes inline LTL (a logic for statements about time) with always, eventually and until. It negates a positive requirement and searches for a counterexample: a cycle that loops through an accepting state. Pan's -a searches for such cycles, -l searches for non-progress cycles, and weak fairness (a step that stays enabled eventually happens) is an explicit option. - limits: Exhaustive checking covers only the finite Promela model. Bounded-depth and bitstate modes cover less. The link from model to implementation needs separate justification. - how much was read: parts read - source; notes: Model checking: what a successful run means - record id: `spin` - tla-dafny - what: An embedding of TLA+ in Dafny, with explicit state parameters and temporal formulas. - limits: It is infrastructure. It is not a translator from arbitrary source. - how much was read: parts read - source; notes: R03. Embeddings in Dafny, Coq, Lean, and Isabelle - record id: `tla-dafny` - TLAPS liveness examples - title: tlapm examples (SimpleEventually, Dekker, Allocator) - what: These are example TLA+ proofs. SimpleEventually is a 73-line proof that a toy spec eventually sets x to TRUE. Dekker (978 lines) proves mutual exclusion, no-stuck and starvation freedom. Allocator states liveness properties but proves only safety theorems. - number: SimpleEventually: 73 lines, four proof steps - number: Dekker: 978 lines, two steps left OMITTED - number: Allocator: 297 lines, no THEOREM for its three liveness properties - limits: By the notes' inference, there is exactly one fully proved non-toy liveness example, Dekker, with two omitted steps. The other proofs listed (Paxos, Bakery, Peterson, EWD840) are about safety. - how much was read: parts read - source - record id: `tlaps-liveness-examples` - TLC - title: TLC model checker (LiveCheck implementation and Toolbox docs) - what: The explicit-state model checker for TLA+. Its LiveCheck source builds a liveness graph with workers. On a violation it returns TLC_TEMPORAL_PROPERTY_VIOLATED. - limits: A run that fails, for example by running out of memory, is not a liveness proof. The notes' author did not inspect TLC's formal correctness proof or its support for fairness fragments. Bounds and config determine the state space. A checked finite instance is not a proof for arbitrary node counts. - how much was read: parts read - source; notes: Model checking: what a successful run means; notes: TLA+, PlusCal, TLC, TLAPS - record id: `tlc` - Verus termination guide - title: Verus guide: Lightweight termination checking - what: Verus requires recursive spec and proof functions to terminate. Exec functions need not terminate. An exec decreases clause checks only local progress, and assumes the callees terminate. It can be disabled with exec_allows_no_decreases_clause. Related pages explain this through lemmas, for example proving n >> 1 < n for floor_log2. - limits: A current exec decreases clause alone is not a theorem that the whole program terminates with the right result. - how much was read: parts read - source; notes: Native termination support: Verus, Dafny, Lean - record id: `verus-termination-guide` - Apalache (2026) - title: The TLA+ Model Checker Apalache - what: Describes Apalache, a symbolic TLA+ model checker using SMT, with bounded verification, randomized symbolic execution, and inductiveness checking. A Byzantine consensus case study shows safety and liveness-to-safety workflows and their cost. - number: Consensus instance n=6, t=1, f=1: bound 10 took 26 min 43 s before abstraction and 1 min 24 s after - number: Bound 15 took about 47 h; 100 symbolic simulations took about 17 min - number: 13 lemmas took about 15 h of experienced-author work to discover - number: 40 experiments over 10 protocols; Apalache answered 8 cases TLC could not - limits: Inductiveness checking requires a user-provided invariant; unboundedness is only in rounds while node counts remain bounded. Clever abstractions and lemmas are human supplied. - how much was read: only abstract or first pages read - source - record id: `apalache-2026` - Exponential Sample Complexity Separation between Flat and Hierarchical Agentic Theorem Provers (2026) - what: Theory. It proves that hierarchical provers, which predict a reusable proof DAG (a graph of lemmas and their dependencies), can need exponentially fewer samples than flat provers that learn from fully inlined proof traces. - limits: The result is theoretical. Only the abstract was read. - how much was read: only abstract or first pages read - source - record id: `exponential-sample-complexity-separation-2026` - Liveness to Safety for Distributed Systems (2026) - what: It replaces a progress proof with a monitor over a sequence of weakly fair states (states where an action that stays enabled is eventually taken). Examples: spanning tree construction, leader selection in each tree of a forest, and maximal independent set. - limits: The full text was unavailable (Springer subscription preview). Only the abstract was seen, so the human inputs, sizes and times are unknown. - how much was read: only abstract or first pages read - source; notes: Liveness to Safety for Distributed Systems (2026): found; full text un - record id: `liveness-to-safety-for-2026` - On the Notions of Bounded Bypass, and How to Make any Deadlock-Free Mutex Protocol Satisfy One of Them (2026) - what: Defines bounded bypass (a limit on how often others can overtake a waiting process) as a liveness property between starvation-freedom and fairness. Model checking found mistakes in the definitions and proofs. - limits: The review notes read the abstract only. - how much was read: only abstract or first pages read - source - record id: `on-the-notions-of-2026` - Towards Proving Liveness on Weak Memory (Extended Version) (2026) - what: The paper gives proof rules for liveness on weak memory. They are response rules under weak fairness plus memory fairness, and ranking functions over weak-memory state. It proves that a ticket lock avoids starvation under Release-Acquire. - limits: The review notes read only the abstract and introduction. - how much was read: only abstract or first pages read - source - record id: `towards-proving-liveness-on-2026` - Towards Quantifier-Free Interpolation in Array Languages with Unbounded Data Specifications (2026) - what: The paper proves quantifier-free interpolation for combinatory array logic with iterated diffs. It also proves uniform interpolation for a flat array fragment. - limits: It has no distributed case study and no LLM component. - how much was read: only abstract or first pages read - source - record id: `towards-quantifier-free-interpolation-2026` - Crash-stop MPST (2025) - title: Crash-Stop Failures in Asynchronous Multiparty Session Types - what: Extends asynchronous multiparty session types with crash-stop failures, crash handling branches, and optional reliability assumptions. It proves sound and complete correspondence between global/local semantics and derives deadlock freedom, protocol conformance, and liveness for well-typed processes under crashes. - number: Covers reliability from no failures to arbitrary process crashes - number: Theorems establish subject reduction, session fidelity, deadlock freedom, and liveness - number: Formal development spans 71-page LMCS article - limits: Processes crash permanently; link failures and crash-recovery are future work. Results concern typed session calculus rather than implementation-level consensus protocols. - how much was read: only abstract or first pages read - source - record id: `crash-stop-mpst-2025` - Gillian-Rust (2025) - title: A Hybrid Approach to Semi-automated Rust Verification - what: Gillian-Rust verifies safe Rust automatically and unsafe Rust semi-automatically, on the Gillian platform. It is linked with Creusot. It verifies real Rust standard library code with minor annotations. - limits: It is a proof-of-concept tool. Only the abstract was read. - how much was read: only abstract or first pages read - source - record id: `gillian-rust-2025` - Raven (2025) - title: Raven: An SMT-Based Concurrency Verifier - what: Introduces Raven, an SMT-based intermediate verification language with built-in concurrency reasoning based on a first-order fragment of Iris. It evaluates linearizability and memory-safety proofs on concurrent data structures and a larger case study. - number: Raven implementation: about 16K lines of OCaml - number: Benchmark suite: over 9K lines of Raven code - number: 23 examples: 19 concurrent data structures and four clients - number: Raven runtimes averaged 0.54 s versus Diaframe 26.96 s on the benchmark suite - limits: Raven restricts Iris to first order and uses SMT automation; foundational Rocq proofs have a smaller trusted base. Specifications may be less general than Iris versions. - how much was read: only abstract or first pages read - source - record id: `raven-2025` - Watase STIRLIN1 Stirling formula 2025 (2025) - title: A Formal Proof of Stirling s Formula. - what: FORMALIZED MATHEMATICS Vol. 33, No. 1, pp. - limits: MML STIRLIN1 version8.1.15 5.95.1495 identifies the Mizar formalization. Target is the limit of n! divided by n^(n+1/2)e^-n, namely sqrt(2pi), not a numeric finite-n error bound or complexity result (pp.95,101). Definition2 calls f class C1 on a nonempty closed interval A only if f is differentiable throughout(-1,infinity), its derivative restricted there is continuous, and A is contained in that half-line which is contained in dom f. This is stronger than the ordinary statement f continuously differentiable just on[0,1]. Introduction’s prose references Def3 for C1, but actual predicate is Def2; Def3 is the restricted derivative (pp.96–97). D01=EqDiv([0,1],n+1) avoids a zero denominator at natural index0. Theorem1 identifies each cell[(k-1)/(n+1),k/(n+1)] for k in Seg(n+1); Theorems2/3 give mesh1/(n+1), nonzero and tending0. Truncated subtraction appears in formal natural-number indexing (pp.96–97). Definitions5/6 form upper/lower derivative values on each closed cell, and Definitions7/8 average them. Under C1, derivative continuity on compact cells supplies finite extrema and Riemann integrability. Theorem4 applies the fundamental theorem of calculus to f(b)-f(x0); Theorems5–8 sandwich that difference between cell derivative infimum/supremum times(b-x0) (pp.97–98). Definitions9/10 separately integrate a constant right-endpoint value and -f on each cell. Step(f,n) lists f(i/(n+1)); SumStep sums these; nIntegral(n)=(n+1) integral(-f); WSeq is their sum. Thus WSeq(n)=sum_i f(i/(n+1))-(n+1) integral f, with the integral subtraction occurring once (pp.98–99). Theorem10 states lim WSeq=one-half integral_0^1 f_prime. Intended squeeze: integrating each cell’s derivative bounds gives a factor one-half of cellwidth², summing and multiplying by n+1 bounds WSeq between one-half the lower/upper Riemann sums for f_prime; both approach the same integral. This derivation explains the displayed infrastructure, but the full Theorem10 proof is not printed (pp.97–99). For log(1+x),(-1,infinity) guarantees1+x>0; Theorems11–13 establish differentiability and derivative1/(1+x). Theorem14 differentiates(1+x)ln(1+x)-x; Theorem15 gives integral_0^1 ln(1+x)=ln(4/e)=2ln2-1. Theorems16/17 give integral of its derivative ln2 and WSeq limit(ln2)/2 (pp.99–100). Definition15 Step(f,m) is a zero-indexed sequence f(i/m) for m nonzero. Theorems18/19 convert its finite restriction to the leading f(0) followed by step(f,m-1); log(1+0)=0 removes that term in Theorem20. This connects library finite sums and sequences without silently changing the number of samples (pp.100–101). Theorems21/22 express WSeq for log(1+x) as ln A_m, A_m=(2m)!/m! times(e/(4m))^m for m=n+1. Factorials and e are positive, so continuity of exp converts limit ln A_m=(ln2)/2 into A_m→sqrt2, stated as convergent WStirl in Theorem23. No gamma-function construction is required (pp.100–101). Stirling ratio B_m=A_m/C_m with C_m=sqrt(m)(2m)!/(4^m(m!)²). Introduction identifies C_m as the square root of a Wallis product sequence and imports C_m→1/sqrt(pi) from Theorem51 of[12]. Nonzero limit justifies division to obtain sqrt(2pi). Theorem24 is labeled a consequence of23, but the Wallis dependency is essential and explained in the introduction, not re-proved here (pp.96,101). One erroneous summation and one potentially confusing notation occur on p.96: the displayed log application puts -n integral inside summation braces (subtracting it n times), while Lemma1/WSeq correctly subtract it once. The ratio denominator sqrt(n)(2n)!/(4^n(n!)²) is algebraically correct. Its identification as the square root of a Wallis-product sequence depends on that cited sequence’s definition; no second error is established. The intended factorial identity and Theorems21–24 are recorded, not the repeated-integral expression. Definition17 defines StirlSeq on natural indices including0; the classical ratio description is for positive n. A finite initial-index convention does not affect its limit, but the PDF does not discuss evaluation of0^(1/2) or division at0. No finite-n numerical approximation guarantee follows just from the limiting theorem (p.101). Introduction mentions HOL Light, Rocq, Isabelle, Metamath and Lean versions; these are related-work claims, not a measured comparison here. References include an explicit HOL Light source link and Isabelle AFP entry; those developments and Wallis source are not independently read in this record. PDF has no proof-size/check-time statistics, experiments, checker transcript or artifact run (pp.95,101–102). Exact quotations preserve raw PDF extraction including broken fraction/exponent ordering, the U+0016 restriction glyph and extracted inequality symbols. Renderings govern formula interpretations. Eight pages,17definitions,24numberedtheorems,14references and all supplied sketches read. No distributed protocol, Verus/Rust/TLA+ or LLM proof/specification-agent evaluation. - how much was read: only abstract or first pages read - source - record id: `watase-stirlin1-stirling-formula-2025-2025` - Watase WALLIS01 integral and product 2025 (2025) - title: Formalization of Wallis Infinite Product Formula for π and the Wallis Integral - what: FORMALIZED MATHEMATICS Vol. 33, No. 1, pp. - limits: MML WALLIS01 version8.1.15 5.95.1495. The Introduction describes an elementary-calculus route toward Stirling, citing other proof assistants without proof-size, speed or automation comparisons. Stirling’s full formula is motivation rather than a theorem established in this paper (pp.85–86). Result1 gives 0<sin x<1 for 0<x<π/2; result2 gives x^m<x^n for natural n<m and 0<x<1, allowing n=0; result3 requires n≥1 and 0<x<π/2 for adjacent sine-power inequalities. Results42–43 later separate strict inequalities inside the interval from weak integral inequalities over the closed interval; endpoints are not silently covered by the strict premise (pp.87,92–93). Definition1 even-seq(m) permits m=0; Definition2 odd-seq(m) and subsequent product recurrences/formulas require positive m. Results4–13 track domains Seg n, lengths, positivity, monotonicity, restrictions and append operations. Results7 and12 duplicate the even-product recurrence as printed. Results8/11 explicitly give the first three even/odd lists (pp.87–88). Results14/15 prove product even-seq(k)=2^k k! and product odd-seq(k)=(2k)!/(2^k k!) for k≥1 by induction. No empty odd-sequence convention is used for these statements (p.88). Definitions3/4 use the same @ notation in both directions between a real-valued function on A and an element of RAlgebra A; @@ reduces back to the original object. Results16–22 reconcile pointwise multiplication, scalar action, addition, negation and subtraction. This is representation infrastructure, not approximation of functions (p.89). Result23 is the power successor law in a unital associative nonempty multiplicative magma. Result24 proves continuity of natural powers of a continuous total real function. Result25 identifies pointwise powers at positive values;26 covers a zero value for positive exponent. These printed pointwise statements do not claim the same arbitrary-real evaluation lemma for negative base values (pp.89–90). Result27 requires an open Z and a differentiable total real function, with positive exponent. Results28/29 obtain continuity of restrictions, integrability and boundedness on a nonempty closed interval, also after multiplication by an arbitrary real scalar. Result30 handles sin-power endpoints0 andπ/2 for positive exponent; zero exponent has its separate integral base case35 (pp.90–91). Result31 gives derivative of sin^(n+1) for n≥1. Results32/33 establish differentiability of the derivative for exponents1 and≥2 separately;34 identifies an antiderivative for n≥2. Results35/36 give I(0)=π/2 and I(1)=1. Results37/38 move sin²+cos²=1 through algebra/function representations, with all five clauses of38 read (pp.91–92). Definition5 I(m)=integral from0 toπ/2 of sin^m x for all natural m. Result39 has explicit n≥2 and I(n)=(n−1)I(n−2)/n. Truncated natural subtraction causes no ambiguity under that guard. Results40/41 give odd/even double-factorial ratios for n≥1, using separate bases for missing small cases (p.92). For n≥1 and q_n=(product odd-seq(n))/(product even-seq(n)), results43–47 prove 1≤I(2n)/I(2n+1)≤1+1/(2n), ratio=n q_n²(1+1/(2n))π, and 1/((1+1/(2n))π)≤n q_n²≤1/π. The formal statements use weak bounds; the Introduction writes strict ones (pp.92–93). Definition6 uses WallisSeq(k)=(k+1)q_(k+1)², k≥0, so no positive-index product is applied to zero. Definition7 supplies the lower comparison sequence WSeq(k)=1/((1+1/(2(k+1)))π). Result48 proves convergence and limit1/π;49 gives positivity. Results50/51 pass to square roots and limit1/sqrt(π). Result52 rewrites sqrt(WallisSeq(n−1))=sqrt(n)(2n)!/(4^n(n!)²), n≥1 (pp.93–94). Publication concern, visually checked p.86: the Introduction’s ratio and squeeze use q_n²(n−1/2)π, whereas result44 gives q_n²(n+1/2)π. At n=1 the former isπ/8<1, contradicting its displayed >1; I(2)/I(3)=3π/8 matches44. It also calls that middle term Wallis_Seq.n, whereas Definition6 defines the shifted normalized n q_n² with limit1/π. These printed exposition discrepancies do not establish an error in checked MML code, which was not audited. Reading deduction, not displayed as a final theorem: the conventional P_n=product from j=1 to n of 4j²/(4j²−1) equals1/((2n+1)q_n²), so48 implies P_n→π/2. The numbered final result is the normalized square-root/factorial limit, not an explicit new Stirling asymptotic theorem. Reading examples, not printed: I(2)=π/4, I(3)=2/3, I(4)=3π/16. WallisSeq(0)=1/4 lies between2/(3π) and1/π; WallisSeq(1)=9/32. These check parity, bounds and indexing. From the squeeze one can infer 0≤1/π−WallisSeq(k)≤1/(π(2k+3)); this explicit error bound is a deduction, not a separately numbered claim. All ten pages, seven definitions, 52 results with every clause and supplied sketches, registrations,14references anddates read. Three sheets and enlarged pp.86,93,94 inspected. Quotations are exact plaintext excerpts; labelled visual transcriptions disambiguate selected damaged formulas. Formal artifacts/dependencies were not executed. No quantitative proof/automation benchmark or distributed/Verus/Rust/TLA+/LLM-agent experiment is reported. - how much was read: only abstract or first pages read - source - record id: `watase-wallis01-integral-and-product-2025-2025` - Cinnabar (2023) - title: Synthesis of Distributed Agreement-Based Systems with Efficiently-Decidable Verification - what: Introduces Cinnabar, a counterexample-guided synthesis tool that completes sketches of distributed agreement-based systems so they fall in efficiently decidable verification classes. - number: Targets leader election and consensus based DAB systems - number: Counterexample-guided sketch completion - limits: Automated verification is undecidable outside the characterized class; synthesis starts from a designer sketch. - how much was read: only abstract or first pages read - source - record id: `cinnabar-2023` - LTLf strategy checking (2023) - title: Model Checking Strategies from Synthesis Over Finite Traces - what: Analyzes model checking for strategies synthesized from LTL over finite traces. It proves EXPSPACE-completeness for non-terminating transducers and PSPACE-completeness for terminating transducers, showing a major verification-complexity difference. - number: Non-terminating LTLf model checking is EXPSPACE-complete - number: Terminating LTLf model checking is PSPACE-complete - number: Results recommend terminating transducers for verifiable synthesis outputs - limits: The work concerns finite-trace reactive synthesis strategies, not distributed implementations; complexity results guide evaluation feasibility rather than provide a distributed case study. - how much was read: only abstract or first pages read - source - record id: `ltlf-strategy-checking-2023` - Justness and lock-freedom (2021) - title: Assuming Just Enough Fairness to make Session Types Complete for Lock-freedom - what: Classifies fairness assumptions for lock-freedom in a minimal session calculus, identifying three semantically distinct notions with sound session type systems. A general merge operator yields completeness for the strongest notion based only on justness. - number: Three distinct lock-freedom notions are identified - number: Completeness holds for flexible-choice networks under justness - number: Strong fairness can prevent completeness - limits: The results fix a synchronous session calculus and depend on the chosen process and fairness semantics; they are theoretical rather than implementation benchmarks. - how much was read: only abstract or first pages read - source - record id: `justness-and-lock-freedom-2021` - Making Weak Memory Models Fair (2021) - what: It shows that the standard fairness for threads is not enough under weak memory, and adds fairness for memory. - limits: Only the abstract was read. - how much was read: only abstract or first pages read - source - record id: `making-weak-memory-models-2021` - Randomized threshold consensus (2021) - title: Verification of randomized consensus algorithms under round-rigid adversaries - what: Extends threshold automata for randomized consensus with unbounded asynchronous rounds; round-rigid adversaries reduce verification to one-round model checking and support almost-sure termination reasoning. - number: Automatically verifies Ben-Or, Bracha, 2-set agreement and RS-Bosco - number: Handles crashes and Byzantine faults - limits: Round-rigid schedules/adversaries are the fairness abstraction; probabilistic claims are model-specific. - how much was read: only abstract or first pages read - source - record id: `randomized-threshold-consensus-2021` - Scalable Polyhedral Verification of Recurrent Neural Networks. (2021) - what: . We present a scalable and precise verifier for recurrent neu- ral networks, called Prover based on two novel ideas: (i) a method to compute a set of polyhedral abstractions for the non-convex and non- linear recurrent update functions by combining sampling, optimization, and Fermat’s theorem, and (ii) a gradient descent based algorithm for abstraction refinement guided by the certification problem that combines multiple abstractions for each neuron. Using Prover, we present the first study of certifying a non-trivial use case of recurrent neural networks, namely speech classification. - limits: Threat is a fixed correctly classified finite vector/sequence s and independent elementwise L-infinity perturbations. For speech, peak-amplitude dB ratio is20log10(max|delta|/max|s|), so a negative dB budget corresponds to epsilon=max|s|*10^(budget/20). This is not an arbitrary perceptual noise, speaker/voice transformation, variable-length sequence or real acoustic channel guarantee. The motivating stop/go traffic story is illustrative, not a verified deployed controller. LSTM real-arithmetic equations combine affine preactivations, sigmoid/tanh and elementwise products, propagating cell/hidden states across a finite given sequence. Generalization to GRU/transformer/capsule architectures is proposed, not evaluated here. No inductive invariant proves arbitrary unbounded sequence length. Weights, initial hidden/cell states, preprocessing and labels must match the certified model. DeepPoly stores one affine upper/lower relation plus intervals per neuron with dependencies only on preceding neurons. Affine updates are exact in that mathematical domain; backsubstitution is an approximate LP optimizer. Nonlinear enclosures and sequential dependencies can accumulate precision loss. A positive lower bound for every correct-minus-incorrect output proves strict classification; nonpositive bound can be spurious. Sampling100points alone only imposes finitely many plane inequalities and is explicitly potentially unsound. Offset correction must minimize F=h−plane over the entire input rectangle and add that minimum to the lower intercept. Then F_new>=0 globally; analogous upper correction. Randomness is for finding tighter planes, not a probabilistic relaxation of certificate soundness once every global correction is correct. For sigmoid*tanh, extrema candidates comprise box corners, stationary points on each edge and interior points satisfying a quartic in sigmoid(x). Reader algebra confirms s^4+(−2−B)*s^3+(1+2B)*s²−B*s−A²=0. Reconstructing coordinates, filtering domain/extraneous roots, zero denominators, degenerate intervals and reliable numerical extrema remain implementation obligations. No interval-arithmetic/outward-rounding proof of PyTorch/Gurobi/root arithmetic is supplied. For sigmoid(x)*y the Hessian determinant is strictly negative at finite x, correctly ruling out interior extrema. Text says a local-extremum Hessian must be positive/negative definite, whereas semidefinite is the necessary general condition; the negative determinant still suffices here. The summary says only Eq10 roots need consideration, omitting box corners/endpoints required by preceding monotone-edge case. Reader A=B=C=0 on[0,1]×[1,2] gives minimum.5 at(0,1), with no finite Eq10 root. This is a prose completeness defect, not an inspected implementation bug. Theorem1 restates asymptotic high-probability convergence of sampled-plane objective toward the true area optimum from[4]. No explicit finite-N/confidence rate is supplied, and the original proof was not read. It is a local bound-quality statement, not a completeness guarantee for whole-network robustness or global convergence of Adam refinement. Five candidate planes are formed by sampling whole box and four triangles obtained from the two diagonal splits. Each candidate is corrected/enforced on the whole box, not trusted only on its sampled triangle. Softmax ensures nonnegative weights summing to1; convex combinations preserve lower/upper validity. Formulas omit candidate index on lambda, but prose/Algorithm1 supplies the per-neuron five-vector. Mere sum-to-one without nonnegativity would be insufficient. Optimization is per incorrect label, initializes pre-softmax weights uniformly[−1,1], backpropagates through label-margin backsubstitution and stops when loss<0 or max epochs. Different labels may use different valid bounds. Gradient failure/max epochs returns not certified, not an unsafe result; no guarantee finds the best convex combination. LP has fewer computations; OPT trades extra runtime for more certified examples. Visible worked-example inconsistency:p.232 specifies o2∈[.4,1.6],c2∈[−.79,.62] and claims corrected plane .04*o2+.46*c2+.01 is a lower bound on that box. Reader corner(.4,−.79) gives plane−.3374 while sigmoid(.4)*tanh(−.79)≈−.394181, violating it by.05678. This is too large to assume harmless rounding. The corner may be unreachable in the original correlated example, but the stated rectangle-based plane claim fails as printed; no code behavior inferred. Other worked-example presentation limits:p.233 candidate bounds for h2 print o1,c1, whereas preceding/final bounds use o2,c2. Some following bounds are rounded. The printed intermediate affine expression .20*(.5*x+1)−.13*x−.10 simplifies to−.03*x+.10, so its subsequent ≥−.03*x−.08 step is a valid looser inequality, not an equality error. Final positive margin.01 is author-reported, not independently reproduced from all exact coefficients. Speech preprocessing merges pre-emphasis/window/real-imaginary DFT matrices into affine M1, then square,affine Mel/power M2,log. Correlations are retained through affine/square/log bounds. Positive log input is required; nonnegative including zero is insufficient. A square lower bound of0 and thresholddelta alone do not prove every filtered energy strictly positive; handling zero energy/flooring is not specified in the paper. Visible square piecewise rule uses delta1e−5 and negative-branch condition ux<=−delta, while its square root is sqrt(ux²−delta). Reader lx−.01,ux−.001 meets the printed negative-branch inequality and ux condition but ux²−delta<0, so formula is undefined over real numbers. A−sqrt(delta) condition would avoid that example, but is only inferred repair. Cases can overlap; code/precedence uninspected. Log lower bound is endpoint chord and displayed upper bound is the tangent at arithmetic midpoint, valid for0<lx<ux. Prose calls it parallel to the chord, which is generally false; for lx1,ux4,chord slope ln4/3≈.4621 versus tangent.4. Displayed tangent and chord remain sound; equal-endpoint limit and nonpositive inputs require special handling. Evaluation uses PyTorch,Gurobi9.0,100sample points,Adam100epochs,initial learning rate100 multiplied.98/epoch. GSC uses RTX2080; rest TeslaV100. CPU/RAM/OS, root tolerances, random seeds, certificate replay and complete per-example data absent. Only MNIST model-size experiment explicitly states3repetitions; no error bars/variance shown. Artifact https://github.com/eth-sri/prover uninspected/unrun. All evaluated certificates condition on originally correct predictions. FSDD accuracy83.6percent,GSC80percent,HAPT88percent are nominal accuracy, not certified fractions on all test inputs. FSDD first100correct examples; GSC count not stated explicitly beyond general correct-input restriction. HAPT first100correct. Do not infer all four datasets use an identical random100example selection. FSDD:8kHz,digits/six speakers,256sample windows,stride200,10Mel frequencies,40ReLU preceding2LSTMlayers32units,average14.7frames. LP vs OPT speech plots cover−90/−80/−70dB. LP preprocessing ablation drops86→61percent at−90dB and70→20percent at−80dB with intervals. These are model-specific measured certified fractions, not acoustic robustness for every possible utterance. GSC:35single-word labels,16kHzdownsampled8kHz,1024sample slices,10Mel,50ReLU,2layers50units. OPT75percent at−110dB and46percent at−100dB;34class margins versus9for digits increases cost. HAPT restricted tosixactivities,50Hzsensors,0.5s sliding windows,4layers256units; printed trimming mentions angular velocities at most6s after prediction. No complete invariant or unrestricted human-motion safety established. POPQORN comparison uses only10randomcorrect MNISTimages,F7,H32,L1,nominal96.5percent. Binary search perturbs one frame at a time. First-frame mean runtimes are65sLP,348sOPT,2160sPOPQORN,reported33.2x/6.21x. These do not measure identical epsilon tasks to Table1, which perturbs allframes at epsilon.01 over first100correct and3repetitions. Table1sixdifferenttrained models have accuracies95.8–97.3percent. OPT improves LP most for added layers; authors hypothesize more adjustable parameters explain this, not controlled causal proof. Larger frames/layers/hidden units can change cost and bound precision, but no universal monotonic law follows across different modelweights. OnF4H32L2,epsilon.013LP39percent versusOPT89percent. Plots support trends without full underlying numeric tables; visual estimates are marked approximate. No adversarial attack success table, checked negative certificates, machine-checked verifier proof or physical-system deployment validation is provided. Relevance is learned abstraction choice with globally sound constraints and evaluation boundaries; no LLM writes proofs/specs, no Verus/Rust/TLA+or distributed protocol result. - how much was read: only abstract or first pages read - source - record id: `scalable-polyhedral-verification-of-2021` - TLA+ video course (2021) - what: Lamport’s official course page lists a sequence of TLA+ lessons covering behaviors, safety, liveness, fairness, invariants and proofs, with downloadable video material. - limits: Course page is instructional material, not an evaluation or a new result. - how much was read: only abstract or first pages read - source - record id: `tla-video-course-2021` - Ensuring Liveness Properties of Distributed Systems: Open Problems (2020) - what: The paper argues that fairness assumptions can lead to false conclusions. It proposes justness instead. - limits: The review notes read only the abstract and introduction. - how much was read: only abstract or first pages read - source - record id: `ensuring-liveness-properties-of-2020` - Agda session semantics (2019) - title: Intrinsically-Typed Mechanized Semantics for Session Types - what: Defines an executable intrinsically typed small-step semantics for a functional session calculus with linearity, recursion, recursive sessions and subtyping. An Agda interruptible CEK machine proves type preservation, session fidelity, and a progress property by construction. - number: Mechanized semantics covers linear typing, forking, channels, higher-order values, choices, recursive sessions and subtyping - number: Agda termination ensures no loophole in the type-preservation development - limits: The calculus is functional and session-typed; asynchronous communication is encoded. Progress is a relative progress property of the modeled machine. - how much was read: only abstract or first pages read - source - record id: `agda-session-semantics-2019` - Global synchronization guards (2019) - title: Parameterized Verification of Systems with Global Synchronization and Guards. - what: Defines a parameterized-system model with global synchronization and transition guards, proves decidability conditions for reachability and investigates cutoff bounds. - number: Reachability decidable without guards under the model - number: Sufficient conditions yield small cutoffs - limits: Results are decidability/cutoff theorems for the model, not an implementation verification. - how much was read: only abstract or first pages read - source - record id: `global-synchronization-guards-2019` - Threshold decomposition (2019) - title: Verification of Threshold-Based Distributed Algorithms by Decomposition to Decidable Logics - what: Decomposes verification of threshold-based fault-tolerant distributed protocols into EPR and BAPA. An automatic inference algorithm generates threshold-intersection properties; EPR verifies protocol transition systems and BAPA checks property soundness. - number: Evaluates Bosco safety, Hybrid Reliable Broadcast safety/liveness, and Byzantine Fast Paxos safety - number: Ten repetitions per experiment on a 2.2 GHz Core i5 laptop - number: Aip generated all valid formulas in under one minute; minimized sets contain 3–5 formulas versus 39–79 before minimization - number: Verified protocols include fast-learning Byzantine consensus; threshold inference takes minutes - limits: The user supplies an inductive invariant and models the protocol in EPR; the method targets restricted threshold use and relies on liveness-to-safety reduction where needed. - how much was read: only abstract or first pages read - source - record id: `threshold-decomposition-2019` - MΦRF (2017) - title: On Multiphase-Linear Ranking Functions - what: Analyzes multiphase-linear ranking functions for single-path loops, giving complete detection and synthesis results for bounded depth and complexity bounds for rational, real, and integer variables. - number: Polynomial-time solution for rational/real variables at bounded depth - number: Integer-variable existence and synthesis is coNP-complete - number: Iteration bound is linear even when variables change non-linearly - limits: The results target loops described by conjunctions of linear constraints, not distributed implementations. - how much was read: only abstract or first pages read - source - record id: `m-rf-2017` - ABS-to-Haskell (2016) - title: A Formal, Resource Consumption-Preserving Translation of Actors to Haskell - what: Defines a formal translation of a cooperative-scheduling actor-language subset (ABS) to a continuation-based Haskell representation. A simulation theorem establishes trace soundness and a corollary establishes resource-consumption preservation; experiments compare runtime and executed steps on ABS benchmarks. - number: Experimental inputs n=500–5000 with 20 runs per value - number: Benchmarks include O(n), O(n log n), and O(n²) programs - number: The authors report matching growth of runtime and executed steps and no compilation overhead under their cost model - limits: The translation fixes a round-robin object/process order and therefore proves soundness but not trace completeness. The model omits full ABS features and nondeterministic scheduling; low-level Haskell garbage-collection costs are future work. - how much was read: only abstract or first pages read - source - record id: `abs-to-haskell-2016` - LiLi (2016) - title: A Program Logic for Concurrent Objects under Fair Scheduling - what: A program logic based on rely-guarantee reasoning (each thread assumes what others do and promises what it does). It verifies linearizability (operations appear to take effect at one instant) and progress together, under fair scheduling. Applied to ticket locks, queue locks, lock-coupling lists, optimistic lists and lazy lists. - limits: Abstract only. No effort numbers. - how much was read: only abstract or first pages read - source - record id: `lili-2016` - Parameterized liveness proof spaces (2016) - title: Proving Liveness of Parameterized Programs - what: Introduces well-founded proof spaces and quantified predicate automata to prove liveness for programs running with any number of threads, reducing infinite-trace inclusion to a safety-style finite-trace problem. - number: Ticket mutual-exclusion protocol is the worked case - number: Method targets arbitrary unbounded thread counts - limits: The ticket example's non-starvation claim assumes every thread is scheduled infinitely often. The paper provides a theoretical foundation rather than a deployed distributed implementation. - how much was read: only abstract or first pages read - source - record id: `parameterized-liveness-proof-spaces-2016` - Total-TaDA (2016) - title: Modular Termination Verification for Non-blocking Concurrency - what: A program logic for total correctness (the program terminates and gives the right result) of concurrent programs. Its specs constrain the thread's concurrent environment. It expresses lock-freedom, wait-freedom and a new property, non-impedance. - limits: As far as the review notes read, it is a pen-and-paper logic, and they did not check whether it is mechanized. The review notes read the abstract and intro only. - how much was read: only abstract or first pages read - source - record id: `total-tada-2016` - FCSL (2015) - title: Mechanized Verification of Fine-grained Concurrent Programs - what: Presents FCSL, a mechanized higher-order concurrent separation logic and framework for verifying fine-grained concurrent programs and data structures. The paper reports mechanized proofs across benchmark libraries and explains recurring invariant patterns. - number: Mechanized verification covers a benchmark suite of concurrent programs and data structures - number: Framework uses higher-order separation logic and mechanized metatheory - limits: The focus is shared-memory concurrency and data-structure verification rather than distributed protocols; proof effort depends on user-supplied invariants and specifications. - how much was read: only abstract or first pages read - source - record id: `fcsl-2015` - Ranking templates (2015) - title: Ranking Templates for Linear Loops - what: Synthesizes termination arguments for linear loops from parameterized ranking templates, including multiphase, nested, piecewise, parallel and lexicographic forms. - number: Templates are reduced to existential constraints using Motzkin's transposition theorem - limits: The method targets linear loop programs and termination arguments; it is not a distributed-system implementation proof. - how much was read: only abstract or first pages read - source - record id: `ranking-templates-2015` - Termite (2015) - title: Synthesis of Ranking Functions Using Extremal Counterexamples - what: Presents a complete method for synthesizing lexicographic linear ranking functions supported by inductive invariants, refining constraints using extremal counterexamples. The Termite prototype is compared with termination analyzers. - number: Termite implementation: 3,000 lines of OCaml - number: Benchmark suites: PolyBench 30 (22 solved), Sorts 6 (5), TermComp 129 (119), WTC 58 (46) - number: Termite solved 33% more examples than Loopus, in twice the time - limits: The method targets termination of programs whose transition relations include disjunctions and existential conditions; benchmark comparisons include front-end and invariant-generator limitations. - how much was read: only abstract or first pages read - source - record id: `termite-2015` - LiLi tech report (2013) - title: Characterizing Progress Properties of Concurrent Objects via Contextual Refinements - what: The report gives formal operational definitions of all the common progress properties. It proves that, for linearizable objects, each one is equivalent to a kind of contextual refinement that preserves termination. - limits: The review notes read only the abstract. It has no effort numbers. - how much was read: only abstract or first pages read - source - record id: `lili-tech-report-2013` - PRALINE: A Tool for Computing Nash Equilibria in Concurrent Games. (2013) - what: . We present PRALINE, which is the first tool to compute Nash equilibria in games played over graphs. We consider concurrent games: at each step, players choose their actions independently. - limits: Finite concurrent arena: at each step each player independently chooses a legal action and the joint move deterministically selects a successor. Players observe the complete sequence of states, not other players’ actions. Strategies can depend on observed history; no memoryless-only restriction is stated. Any number of players is allowed by the model, but explicit graph size may already encode exponentially many joint actions. Each player has an integer payoff per state and maximizes limsup along an infinite play. On a finite arena this is the largest payoff recurring infinitely often; finite transient rewards do not determine the outcome. Boolean0/1 state payoffs recover Buchi objectives. This is not general mean-payoff, discounted reward, stochastic game synthesis or a fairness/service guarantee. Synthesizes pure strategies. Nash equilibrium excludes profitable unilateral deviations while all other complete strategies stay fixed, including their reactions after a changed history. It does not ensure coalition resistance, subgame perfection or credible punishments at every off-path history. Paper states resistance to randomized deviations, but construction does not synthesize randomized equilibrium profiles. Paper states that randomized-equilibrium existence with a specified payoff is undecidable and cites[12], titled The complexity of Nash equilibria in limit-average games. The chapter does not supply the reduction or precise scope needed to transfer that statement to its integer-limsup setting; cited work was not read here. Preserve this as an attributed statement, not an independently verified limsup theorem. Guarantee stated: for every attainable pure-equilibrium payoff vector v, at least one returned equilibrium has componentwise payoff>=v. This does not mean every strategy profile is enumerated, every exact payoff vector is returned, or all returned profiles are Pareto-undominated. The meaning of Solutions in Table1 is reported tool outputs, not a count of all mathematical equilibria. Suspect game positions track original state and remaining possible unilateral deviators. Eve recommends a legal joint move; Adam chooses a successor. If the prescribed successor occurs, suspects remain; otherwise retain only players able to induce it by changing their own action alone. Ultimately suspected players must obtain at most their target payoffs. Empty suspects make unilateral-deviation checking vacuous; arbitrary coalition deviations are not checked. For target vector v, cited equivalence requires both an Eve winning strategy preventing any ultimate suspect improving and an obedient outcome with exactly v. Prevention alone does not establish that a chosen target is realized. The chapter gives no formal pseudocode, full correctness proof, payoff search procedure, or transformation-size bound; those are imported from[2,3]. Polynomial-time result is explicitly attributed to the specialized algorithm for these preferences and a co-Buchi game. Generic suspect subsets suggest a potentially exponential construction in player count; the chapter does not explain the specialization resolving this. Do not infer polynomiality in a succinct source program, arbitrary objective, or unbounded numerical state domain. Benchmark discussion says up to quadratically many subgames with quadratic winning-region computation, but gives no precise overall asymptotic formula including all representation parameters. Input programs generate explicit arenas from variable valuations, legal-action clauses and updates. Fig.1 is only part of medium_access.game: declarations, initial values, payoff clauses and general multiuser model are not supplied in full. Finite state bounds are essential to finite graph solving; arbitrary programs with unbounded variables are outside the described finite implementation. Power-control payoff R/pow_i * (1-exp(-0.5*gamma_i))^L is real-valued, while tool model requires integer state payoffs. The paper does not state numerical R,L, the precise interference/noise model for gamma_i, integer rounding, or the convention at pow_i=0 where the displayed expression divides by zero. Numerical payoffs110/131/94 illustrate a supplied instance rather than a reproducible model derived solely from chapter parameters. Interactive playing against Eve can explain a deterrent, but finite sampled interactions do not independently prove all-history equilibrium. Full returned automata contain off-path actions absent from the equilibrium shape. No verified compiler, machine-checked correctness certificate, independent equilibrium checker, or artifact replay is reported in the chapter. Timing machine is Intel Core2 Duo2.8GHz with4GB RAM. Seven rows vary players, emission levels or initial energy; no repetitions/error bars, timeouts, software versions, operating system, memory profile, baseline, or end-to-end wireless implementation measurement. Prototype is described as effective to about100states, but table contains completed216/729/1360state instances at much larger runtimes. That prose is not a hard supported-size limit. 2013 novelty and comparison claims are historical author claims: PRISM-games is said to check a given equilibrium and handle random games but not generate equilibria. Current PRISM-games capabilities were not checked. Original artifact URL http://www.lsv.ens-cachan.fr/Software/praline/ is supplied but not fetched or run. Relevance is rational-agent distributed protocol modeling and verifying synthesized history-dependent strategies against unilateral deviations. Wireless/network cases are finite abstractions, not verified distributed implementations. No Verus/verified Rust, TLA+, LLM specification/proof agents, or automated proof-agent evaluation. Symbolic implementation is proposed future work. - how much was read: only abstract or first pages read - source - record id: `praline-a-tool-for-2013` - A Theory of Mutations with Applications to Vacuity, Coverage, and Fault Tolerance (2008) - what: Treats vacuity (a spec that holds for no useful reason) and coverage (how much of the system the spec checks) as the same thing: small deliberate changes, called mutations, made to either the specification or the implementation. - limits: The notes read only the abstract. The applications are in hardware, which by themselves do not cover fault histories of distributed systems. That last point is the notes' inference. - how much was read: only abstract or first pages read - source; notes: Testing strength, mutations, and vacuity - record id: `a-theory-of-mutations-2008` - Coverage Metrics for Formal Verification (2006) - what: It adapts several coverage notions from simulation to formal verification. It links successful checks, vacuity (a spec that holds trivially, so it says nothing) and incomplete specs. - limits: The notes' author read only the abstract and introduction. - how much was read: only abstract or first pages read - source; notes: Coverage Metrics for Formal Verification - record id: `coverage-metrics-for-formal-2006` - Dynamic frames and permissions (2006) - title: A Basis for Verifying Multi-threaded Programs - what: Presents a sound modular verification methodology using implicit dynamic frames and fractional permissions for fine-grained locking, monitor invariants and deadlock prevention. - number: Examples include hand-over-hand linked-list locking and lock reordering - limits: Targets object-based multithreaded programs rather than distributed communication. - how much was read: only abstract or first pages read - source - record id: `dynamic-frames-and-permissions-2006` - Sanity Checks in Formal Verification (2006) - what: Surveys vacuity checks (does the spec actually matter?) and coverage checks (does the system part matter?), run after model checking succeeds. - limits: The notes read the abstract only. - how much was read: only abstract or first pages read - source; notes: Testing strength, mutations, and vacuity - record id: `sanity-checks-in-formal-2006` - Colón-Sipma termination (2002) - title: Practical Methods for Proving Program Termination - what: Presents two algorithms that synthesize linear ranking functions from generated invariants: one based on widening and polyhedral cones, and a heuristic for structured programs with single-variable rankings. - number: One example's invariant generation and termination proof took 2.5 seconds - number: The first method handles subtle linear combinations but is limited to few variables - limits: The algorithms target imperative programs and loop termination; the second method is heuristic and assumes structured programs. - how much was read: only abstract or first pages read - source - record id: `colo-n-sipma-termination-2002` - A Practical Approach to Coverage in Model Checking (2001) - what: It measures how well a spec covers a model. Change one part of the model and see whether the spec still holds. If it does, that part is not covered. The paper gives algorithms for specs written in LTL (a logic for statements about sequences of events). - limits: The notes' author read only the abstract and introduction. The result depends on which changes and which properties you pick. - how much was read: only abstract or first pages read - source; notes: A Practical Approach to Coverage in Model Checking - record id: `a-practical-approach-to-2001` - Vacuity Detection in Temporal Model Checking (1999) - what: Checks whether every part of a temporal property actually affects whether it holds. Example: a property saying a request is eventually answered passes trivially if no request can ever occur. - limits: A witness showing the property is not vacuous does not prove that all intended clauses were specified. The notes had only the abstract and introduction (the extraction was damaged). - how much was read: only abstract or first pages read - source; notes: Testing strength, mutations, and vacuity; notes: Vacuity Detection in Temporal Model Checking - record id: `vacuity-detection-in-temporal-1999` - Unreliable Failure Detectors for Reliable Distributed Systems (1996) - what: It characterizes unreliable failure detectors by completeness and accuracy. It shows that consensus can be solved in asynchronous crash systems even when detectors make infinitely many mistakes. - limits: Only the abstract was checked. The result on the weakest detector belongs to a companion paper. - how much was read: only abstract or first pages read - source - record id: `unreliable-failure-detectors-for-1996` - 2LS: Heap Analysis and Memory Safety - (Competition Contribution). - what: 2LS: Heap Analysis and Memory Safety (Competition Contribution)⋆ TACAS Viktor Malı́k ⋆⋆3 , Peter Schrammel1,2 , and Artifact SV-COMP Tomáš Vojnar3 2020 1 Accepted Diffblue Ltd, Oxford, UK 2 University of Sussex, Brighton, UK 3 FIT, Brno University of Technology, Brno, CZ Abstract 2LS is a framework for analysis of sequential C programs based on the CPROVER infrastructure and template-based synthesis techniques for checking both safety and termination. The paper presents the main improvements done in 2LS since 2018, which concern mainly the way 2LS handles dynamically alloc- ated objects and structures as well as combinations of abstract domains. 1 Overview 2LS is a static analysis and verification tool for sequential C programs. - how much was read: only abstract or first pages read - source - record id: `2ls-heap-analysis-and` - A Coq formal proof of the LaxMilgram theorem. - what: To vouch the Finite Element Method, the Lax–Milgram The Finite Element Method is a widely-used method to solve theorem is one of the main results: it is a way to establish numerical problems coming for instance from physics or existence and uniqueness of the solution to the continuous biology. To obtain the highest confidence on the correc- problem (i.e. defined on an infinite dimensional functional tion of numerical simulation programs implementing the Fi- space) and of its discrete approximation (defined on a finite nite Element Method, one has to formalize the mathemat- dimensional space); it is valid for coercive bilinear mappings ical notions and results that allow to establish the sound- defined on Hilbert spaces (complete normed vector spaces ness of the method. - how much was read: only abstract or first pages read - source - record id: `a-coq-formal-proof` - A Coq Formalization of Lebesgue Induction Principle and Tonelli's Theorem. - what: . Lebesgue integration is a well-known mathematical tool, used for instance in probability theory, real analysis, and numerical mathemat- ics. Thus, its formalization in a proof assistant is to be designed to fit dif- ferent goals and projects. - how much was read: only abstract or first pages read - source - record id: `a-coq-formalization-of` - A dynamic game approach to distributionally robust safety specifications for stochastic systems. - what: This paper presents a new safety specification method that is robust against errors in the probability distribution of disturbances. Our proposed distributionally robust safe policy max- imizes the probability of a system remaining in a desired set for all times, subject to the worst possible disturbance distribution in an ambiguity set. We propose a dynamic game formulation of constructing such policies and identify conditions under which a non-randomized Markov policy is optimal. - how much was read: only abstract or first pages read - source - record id: `a-dynamic-game-approach` - A Formal CHERI-C Semantics for Verification. - what: . CHERI-C extends the C programming language by adding hardware capabilities, ensuring a certain degree of memory safety while remaining efficient. Capabilities can also be employed for higher-level se- curity measures, such as software compartmentalization, that have to be used correctly to achieve the desired security guarantees. - how much was read: only abstract or first pages read - source - record id: `a-formal-cheri-c` - A formal proof in Coq of a control function for the inverted pendulum. - what: systems, they are controlled by programs whose flaws (e.g. Control theory provides techniques to design controllers, bugs, approximations through floating-point arithmetic. . - how much was read: only abstract or first pages read - source - record id: `a-formal-proof-in` - A formal proof of hensel's lemma over the p-adic integers. - what: the target theorems. Research-level theorems have been for- arXiv:1909.11342v1 [cs.LO] 25 Sep 2019 The field of p-adic numbers Qp and the ring of p-adic inte- malized, but research-level theories remain largely untouched. gers Zp are essential constructions of modern number the- A recent project begun at the Vrije Universiteit Amster- ory. - how much was read: only abstract or first pages read - source - record id: `a-formal-proof-of` - A FORMAL PROOF OF THE KEPLER CONJECTURE - what: This article describes a formal proof of the Kepler conjecture on dense sphere packings in a combination of the HOL Light and Isabelle proof assistants. This paper constitutes the official published account of the now completed Flyspeck project. 2010 Mathematics Subject Classification: 52C17 1. - how much was read: only abstract or first pages read - source - record id: `a-formal-proof-of-2` - A formal verification technique for behavioural model-to-model transformations - what: . In Model Driven Software Engineering, models and model transformations are the primary artifacts when developing a software system. In such a workflow, model transformations are used to incrementally trans- form initial abstract models into concrete models containing all relevant system details. - how much was read: only abstract or first pages read - source - record id: `a-formal-verification-technique` - A Formalization of Complete Discrete Valuation Rings and Local Fields. - how much was read: only abstract or first pages read - source - record id: `a-formalization-of-complete` - A Formalization of Polytime Functions. - what: . We present a deep embedding of Bellantoni and Cook’s syntactic characterization of poly- arXiv:1102.5495v2 [cs.CC] 31 May 2011 time functions. We prove formally that it is correct and complete with respect to the original char- acterization by Cobham that required a bound to be proved manually. - how much was read: only abstract or first pages read - source - record id: `a-formalization-of-polytime` - A Formally-Verified C Static Analyzer. - what: properties are essential both for safety and security. Among the var- This paper reports on the design and soundness proof, using the ious verification techniques, static analysis is perhaps the one that Coq proof assistant, of Verasco, a static analyzer based on abstract scales best to large existing code bases, with minimal intervention interpretation for most of the ISO C 1999 language (excluding re- from the programmer. cursion and dynamic allocation). - how much was read: only abstract or first pages read - source - record id: `a-formally-verified-c` - A Formally Verified Compiler Back-end - what: This article describes the development and formal verification (proof of semantic preservation) of a compiler back-end from Cminor (a simple imperative inter- mediate language) to PowerPC assembly code, using the Coq proof assistant both for programming the compiler and for proving its soundness. Such a verified compiler is useful in the context of formal methods applied to the certification of critical software: the verification of the compiler guarantees that the safety properties proved on the source code hold for the executable compiled code as well. - limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review. - how much was read: only abstract or first pages read - source - record id: `a-formally-verified-compiler` - A Formally Verified Validator for Classical Planning Problems and Solutions - what: The University of Manchester Research A Formally Verified Validator for Classical Planning Problems and Solutions DOI: 10.1109/ICTAI.2018.00079 Document Version Accepted author manuscript Link to publication record in Manchester Research Explorer Citation for published version (APA): Abdulaziz, M., & Lammich, P. (2018). A Formally Verified Validator for Classical Planning Problems and Solutions. - how much was read: only abstract or first pages read - source - record id: `a-formally-verified-validator` - A Framework for Debugging Automated Program Verification Proofs via Proof Actions. - what: . Many program verification tools provide automation via SMT solvers, allowing them to automatically discharge many proofs. However, when a proof fails, it can be hard to understand why it failed or how to fix it. - how much was read: only abstract or first pages read - source - record id: `a-framework-for-debugging` - A Framework for Worst-Case and Stochastic Safety Verification Using Barrier Certificates. - what: —This paper presents a methodology for safety veri- For safety verification of continuous and hybrid systems in fication of continuous and hybrid systems in the worst-case and the worst-case setting, various methods have been proposed. stochastic settings. In the worst-case setting, a function of state Explicit computation of either exact or approximate reachable termed barrier certificate is used to certify that all trajectories of the system starting from a given initial set do not enter an un- sets corresponding to the continuous dynamics is crucial for safe region. - how much was read: only abstract or first pages read - source - record id: `a-framework-for-worst` - A Learner-Verifier Framework for Neural Network Controllers and Certificates of Stochastic Systems. - what: . Reinforcement learning has received much attention for learn- ing controllers of deterministic systems. We consider a learner-verifier framework for stochastic control systems and survey recent methods that formally guarantee a conjunction of reachability and safety properties. - how much was read: only abstract or first pages read - source - record id: `a-learner-verifier-framework` - A Light-Weight Approach for Verifying Multi-Threaded Programs with CPAchecker - what: domain of the data-flow analysis, and thus, can be combined with several existing analyses in CPACHECKER, like value analysis, interval analysis, and BDD analysis. The new analysis is modular and can be used, for example, to verify reachability properties as well as to detect deadlocks in the program. This paper includes an evalu- ation of the benefit of some optimization steps (e.g., changing the iteration order of the reachability algorithm or applying partial-order reduction) as well as the comparison with other state-of-the-art tools for verifying multi-threaded programs. - how much was read: only abstract or first pages read - source - record id: `a-light-weight-approach` - A Logical Account of Subtyping for Session Types - what: A Logical Account of Subtyping for Session Types Ross Horne Luca Padovani University of Luxembourg University of Camerino We study the notion of subtyping for session types in a logical setting, where session types are propositions of multiplicative/additive linear logic extended with least and greatest fixed points. The resulting subtyping relation admits a simple characterization that can be roughly spelled out as the following lapalissade: every session type is larger than the smallest session type and smaller than the largest session type. At the same time, we observe that this subtyping, unlike traditional ones, preserves termination in addition to the usual safety properties of sessions. - how much was read: only abstract or first pages read - source - record id: `a-logical-account-of` - A Mobile Application for Self-Guided Study of Formal Reasoning - what: form, by the few, to a subject pervasive in the modern world. This pervasiveness is mostly due to the ubiquity of computing technology within modern society, the foundations of which rest in the realm of mathe- matical logic. With this in mind, one would expect formal logic to encompass a significant portion of undergraduate computer science education, however, this is unfortunately not the case [26]. - how much was read: only abstract or first pages read - source - record id: `a-mobile-application-for` - A monadic framework for relational verification: applied to information security, program equivalence, and optimizations - what: (2009); Küsters et al. (2015); Yang (2007); Zaks and Pnueli Relational properties describe multiple runs of one or more (2008); Murray et al. (2013); Fehrenbach and Cheney (2016); programs. - limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review. - how much was read: only abstract or first pages read - source - record id: `a-monadic-framework-for` - A Natural Formalized Proof Language - what: . Artificial intelligence assisted mathematical proof has become a highly focused area nowa- days. One key problem in this field is to generate formal mathematical proofs from natural language proofs. - how much was read: only abstract or first pages read - source - record id: `a-natural-formalized-proof` - A Polymorphic Intermediate Verification Language: Design and Logical Encoding. - what: . Intermediate languages are a paradigm to separate concerns in soft- ware verification systems when bridging the gap between programming languages and the logics understood by theorem provers. While such intermediate languages traditionally only offer rather simple type systems, this paper argues that it is both advantageous and feasible to integrate richer type systems with features like (higher-ranked) polymorphism and quantification over types. - how much was read: only abstract or first pages read - source - record id: `a-polymorphic-intermediate-verification` - A practical formalization of monadic equational reasoning in dependent-type theory - what: One can perform equational reasoning about computational effects with a purely functional pro- gramming language thanks to monads. Even though equational reasoning for effectful programs is desirable, it is not yet mainstream. This is partly because it is difficult to maintain pencil-and-paper proofs of large examples. - how much was read: only abstract or first pages read - source - record id: `a-practical-formalization-of` - A Pyramid Of (Formal) Software Verification. - what: . Over the past few years there has been significant progress in the various fields of software verification resulting in many useful tools and successful deployments, both academic and commercial. However much of the work describing these tools and ideas is written by and for the research community. - how much was read: only abstract or first pages read - source - record id: `a-pyramid-of-formal` - A Quick Tour of the VeriFast Program Verifier - what: . This paper describes the main features of VeriFast, a sound and modular program verifier for C and Java. VeriFast takes as input a number of source files annotated with method contracts written in sep- aration logic, inductive data type and fixpoint definitions, lemma func- tions and proof steps. - how much was read: only abstract or first pages read - source - record id: `a-quick-tour-of` - A Semialgebraic Framework for Verification and Synthesis of Control Barrier Functions. - what: GENERIC COLORIZED JOURNAL, VOL. XX, NO. XX, XXXX 2017 1 A Semi-Algebraic Framework for Verification and Synthesis of Control Barrier Functions Andrew Clark Senior Member, IEEE arXiv:2209.00081v3 [eess.SY] 11 Nov 2024 Abstract— Safety is a critical property for control sys- readily generalize to verifying more complicated safe sets tems in medicine, transportation, manufacturing, and other (e.g., intersections and unions of super-level sets) as well as applications, and can be defined as ensuring - how much was read: only abstract or first pages read - source - record id: `a-semialgebraic-framework-for` - A Session Subtyping Tool - what: . Session types are becoming popular and have been integrated in several mainstream programming languages. Nevertheless, while many programming languages consider asynchronous fifo channel communica- tion, the notion of subtyping used in session type implementations is the one defined by Gay and Hole for synchronous communication. - how much was read: only abstract or first pages read - source - record id: `a-session-subtyping-tool` - A simple library implementation of binary sessions - what: Inspired by the continuation-passing encoding of binary sessions, we describe a simple approach to embed a hybrid form of session type checking into any programming language that supports parametric polymorphism. The approach combines static protocol analysis with dynamic linearity checks. To demonstrate the effectiveness of the technique, we implement a well-integrated OCaml module for session communications. - how much was read: only abstract or first pages read - source - record id: `a-simple-library-implementation` - A simple, verified validator for software pipelining. - what: unrolling the loop then performing acyclic scheduling. Software Software pipelining is a loop optimization that overlaps the execu- pipelining is implemented in many production compilers and de- tion of several iterations of a loop to expose more instruction-level scribed in several compiler textbooks [1, section 10.5] [2, chapter parallelism. It can result in first-class performance characteristics, 20] [16, section 17.4]. - how much was read: only abstract or first pages read - source - record id: `a-simple-verified-validator` - A Sound Algorithm for Asynchronous Session Subtyping and its Implementation - what: . Session types, types for structuring communication between endpoints in concurrent systems, are recently being integrated into mainstream programming languages. In practice, a very important notion for dealing with such types is that of subtyping, since it allows for typing larger classes of systems, where a program has not precisely the expected behavior but a similar one. - how much was read: only abstract or first pages read - source - record id: `a-sound-algorithm-for` - A Synthesis of the Procedural and Declarative Styles of Interactive Theorem Proving - what: . We propose a synthesis of the two proof styles of interactive theorem proving: the procedural style (where proofs are scripts of commands, like in Coq) and the declarative style (where proofs are texts in a controlled natural language, like in Isabelle/Isar). Our approach combines the advantages of the declarative style – the possibility to write formal proofs like normal mathematical text – and the procedural style – strong automation and help with shaping the proofs, including determining the statements of intermediate steps. - how much was read: only abstract or first pages read - source - record id: `a-synthesis-of-the` - A Temporal Logic for Asynchronous Hyperproperties. - what: . Hyperproperties are properties of computational systems that require more than one trace to evaluate, e.g., many information-flow security and concurrency requirements. Where a trace property defines a set of traces, a hyperproperty defines a set of sets of traces. - how much was read: only abstract or first pages read - source - record id: `a-temporal-logic-for` - A toolchain for strategy synthesis with spatial properties - what: We present an application of strategy synthesis to enforce spatial properties. This is achieved by implementing a toolchain that enables the tools CATLib and VoxLogicA to interact in a fully automated way. The Contract Automata Library (CATLib) is aimed at both composition and strategy synthesis of games modelled in a dialect of finite state automata. - how much was read: only abstract or first pages read - source - record id: `a-toolchain-for-strategy` - A trustful monad for axiomatic reasoning with probability and nondeterminism - what: The algebraic properties of the combination of probabilistic choice and nondeterministic choice have long been a research topic in program semantics. This paper explains a formalization in the Coq proof assistant of a monad equipped with both choices: the geometrically convex monad. This formaliza- tion has an immediate application: it provides a model for a monad that implements a nontrivial interface, which allows for proofs by equational reasoning using probabilistic and nondeterminis- tic effects. - limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review. - how much was read: only abstract or first pages read - source - record id: `a-trustful-monad-for` - A Unifying Perspective for Safety of Stochastic Systems: From Barrier Functions to Finite Abstractions. - what: GENERIC COLORIZED JOURNAL, VOL. XX, NO. XX, XXXX 2023 1 A Unifying Perspective for Safety of Stochastic Systems: From Barrier Functions to Finite Abstractions Luca Laurenti* and Morteza Lahijanian* arXiv:2310.01802v3 [eess.SY] 24 May 2025 Abstract— Providing safety guarantees for stochastic stochastic linear systems. - how much was read: only abstract or first pages read - source - record id: `a-unifying-perspective-for` - A Verified Certificate Checker for Finite-Precision Error Bounds in Coq and HOL4. - what: A Verified Certificate Checker for Finite-Precision Error Bounds in Coq and HOL4 Heiko Becker∗ , Nikita Zyuzin∗ , Raphaël Monat† , Eva Darulova∗ , Magnus O. Myreen‡ and Anthony Fox§ ∗ MPI-SWS, † ENS Lyon, ‡ Chalmers University of Technology, § University of Cambridge ∗ {hbecker,zyuzin,eva}@mpi-sws.org, † raphael.monat@ens-lyon.org, ‡ myreen@chalmers.se, § anthony.fox@arm.com Abstract—Being able to soundly estimate roundoff errors of roundoff error bounds generated by static analysis tools. finite-precision computations is important for many applications Certificates checked by FloVer encode only the minimal static in embedded systems and scientific computing. - how much was read: only abstract or first pages read - source - record id: `a-verified-certificate-checker` - A Wide-Spectrum Language for Verification of Programs on Weak Memory Models. - what: Modern processors deploy a variety of weak memory models, which for efficiency reasons may (appear to) execute instructions in an order different to that specified by the program text. The consequences of instruction reordering can be complex and subtle, and can impact on ensuring correctness. Previous work on the semantics of weak mem- ory models has focussed on the behaviour of assembler-level programs. - how much was read: only abstract or first pages read - source - record id: `a-wide-spectrum-language` - A Zonotopic Dempster-Shafer Approach to the Quantitative Verification of Neural Networks. - what: . The reliability and usefulness of verification depend on the ability to represent appropriately the uncertainty. Most existing work on neural network verification relies on the hypothesis of either set-based or probabilistic information on the inputs. - how much was read: only abstract or first pages read - source - record id: `a-zonotopic-dempster-shafer` - ABC: An Academic Industrial-Strength Verification Tool. - what: . ABC is a public-domain system for logic synthesis and formal verification of binary logic circuits appearing in synchronous hardware designs. ABC combines scalable logic transformations based on And-Inverter Graphs (AIGs), with a variety of innovative algorithms. - how much was read: only abstract or first pages read - source - record id: `abc-an-academic-industrial` - Accelerated Model Checking of Parametric Markov Chains - what: Parametric Markov chains occur quite naturally in various applications: they can be used for a conservative analysis of probabilistic systems (no matter how the parameter is chosen, the system works to specification); they can be used to find optimal settings for a parameter; they can be used to visualise the influence of system parameters; and they can be used to make it easy to adjust the analysis for the case that parameters change. Unfortunately, these advancements come at a cost: parametric model checking is—or rather was—often slow. To make the analysis of parametric Markov models scale, we need three ingredients: clever algorithms, the right data structure, and good engineering. - how much was read: only abstract or first pages read - source - record id: `accelerated-model-checking-of` - Accelerating Automated Program Verifiers by Automatic Proof Localization. - what: . Automated program verifiers such as Dafny, F , Verus, and Viper are now routinely used to verify real-world software. Unfortunately, the performance of the SMT solvers employed by these tools is not always able to keep up with the increasing size and complexity of verification problems, resulting in long verification times and verification failures due to time-outs. - how much was read: only abstract or first pages read - source - record id: `accelerating-automated-program-verifiers` - AgentGuard: Runtime Verification of AI Agents. - what: —The rapid evolution to autonomous, agentic AI from mathematics and formal methods with the existing theory systems introduces significant risks due to their inherent unpre- of these agentic systems [6]. dictability and emergent behaviors; this also renders traditional In this work, we present AgentGuard, a framework for verification methods inadequate and necessitates a shift towards probabilistic guarantees where the question is no longer if a system runtime verfication of Agentic AI systems. - how much was read: only abstract or first pages read - source - record id: `agentguard-runtime-verification-of` - AISE: A Symbolic Verifier by Synergizing Abstract Interpretation and Symbolic Execution (Competition Contribution). - what: Interpretation and Symbolic Execution (Competition Contribution) and Zhenbang Chen1,2(B) ⋆ Zhen Wang1,2 1 College of Computer, National University of Defense Technology, Changsha, China 2 State Key Laboratory of Complex & Critical Software Environment, National University of Defense Technology, Changsha, China {wz,zbchen}@nudt.edu.cn Abstract. AISE is a static verifier that can verify the safety properties of C programs. The core of AISE is a program verification framework that synergizes abstract interpretation and symbolic execution in a novel manner. - how much was read: only abstract or first pages read - source - record id: `aise-a-symbolic-verifier` - AMulet 2.0 for Verifying Multiplier Circuits. - what: . AMulet 2.0 is a fully automatic tool for the verification of integer multipliers using computer algebra. Our tool models multiplier circuits given as and-inverter graphs as a set of polynomials and applies preprocessing techniques based on elimination theory of Gröbner bases. - how much was read: only abstract or first pages read - source - record id: `amulet-2-0-for` - An Abstraction-Based Framework for Neural Network Verification. - what: . Deep neural networks are increasingly being used as con- trollers for safety-critical systems. Because neural networks are opaque, certifying their correctness is a significant challenge. - how much was read: only abstract or first pages read - source - record id: `an-abstraction-based-framework` - An Algebraic Framework for Runtime Verification. - what: . Runtime verification (RV) is a pragmatic and scalable, yet rigorous technique, to assess the correctness of complex systems, including cyber-physical systems (CPS). By measuring how robustly a CPS run satisfies a specification, RV allows in addition, to quantify the resiliency of a CPS to perturbations. - how much was read: only abstract or first pages read - source - record id: `an-algebraic-framework-for` - An Automated Deductive Verification Framework for Circuit-building Quantum Programs - what: . While recent progress in quantum hardware open the door for significant speedup in certain key areas, quantum algorithms are still hard to implement right, and the validation of such quantum programs is a challenge. In this paper we propose Qbricks, a formal verification environment for circuit-building quantum programs, featuring both para- metric specifications and a high degree of proof automation. - how much was read: only abstract or first pages read - source - record id: `an-automated-deductive-verification` - An Efficient Floating-Point Bit-Blasting API for Verifying C Programs - what: . We describe a new SMT bit-blasting API for floating-points and evaluate it using different out-of-the-shelf SMT solvers during the verification of several C programs. The new floating-point API is part of the SMT backend in ESBMC, a state-of-the-art bounded model checker for C and C++. - how much was read: only abstract or first pages read - source - record id: `an-efficient-floating-point` - An SMT-Based Approach for Verifying Binarized Neural Networks. - what: . Deep learning has emerged as an effective approach for cre- ating modern software systems, with neural networks often surpassing hand-crafted systems. Unfortunately, neural networks are known to suffer from various safety and security issues. - how much was read: only abstract or first pages read - source - record id: `an-smt-based-approach` - Analyzing Unsynthesizable Specifications for High-Level Robot Behavior Using LTLMoP. - what: . Recent work in robotics has applied formal verification tools to au- tomatically generate correct-by-construction controllers for autonomous robots. However, when it is not possible to create such a controller, these approaches do not provide the user with feedback on the source of failure, making the experience of debugging a specification somewhat ad hoc and unstructured, and a source of frustration for the user. - how much was read: only abstract or first pages read - source - record id: `analyzing-unsynthesizable-specifications-for` - ANITA: Analytic Tableau Proof Assistant - what: ANITA: Analytic Tableau Proof Assistant Davi Romero Vasconcelos UFC Quixadá, Brazil School of Computer Science Federal University of Ceará Quixadá, Brazil daviromero@ufc.br This work presents the system ANITA (Analytic Tableau Proof Assistant) developed for teaching analytic tableaux to computer science students. The tool is written in Python and can be used as a desktop application, or in a web platform. This paper describes the logical system of the tool, explains how the tool is used and compares it to several similar tools. - how much was read: only abstract or first pages read - source - record id: `anita-analytic-tableau-proof` - Applying Formal Methods to Networking: Theory, Techniques, and Applications - what: “algebraic path problem” traction from code in sections IV-A1, IV-A2, IV-A3, and (e.g., a classical example of an abstract algebraic path problem IV-A4, respectively. is shortest path routing) [74]. Routing algebra meta-language 9 1) Finite State Machines: The mathematical formalism of that has been used in the study of computability and languages finite state machine (FSM), or finite state automaton, is com- [81]. - how much was read: only abstract or first pages read - source - record id: `applying-formal-methods-to` - AProVE: Termination and Memory Safety of C Programs - (Competition Contribution). - what: AProVE: Termination and Memory Safety of C Programs (Competition Contribution) Thomas Ströder, Cornelius Aschermann, Florian Frohn, Jera Hensel, and Jürgen Giesl RWTH Aachen University, Germany Abstract. AProVE is a system for automatic termination and complex- ity proofs of C, Java, Haskell, Prolog, and term rewrite systems. The particular strength of AProVE when analyzing C is its capability to rea- son about pointer arithmetic combined with direct memory accesses (as, e.g., in standard implementations of string algorithms). - how much was read: only abstract or first pages read - source - record id: `aprove-termination-and-memory` - Assume-Guarantee Synthesis for Concurrent Reactive Programs with Partial Information. - what: . Synthesis of program parts is particularly useful for concurrent sys- tems. However, most approaches do not support common design tasks, like mod- ifying a single process without having to re-synthesize or verify the whole system. - how much was read: only abstract or first pages read - source - record id: `assume-guarantee-synthesis-for` - Asynchronous Session-Based Concurrency: Deadlock-freedom in Cyclic Process Networks - what: . We tackle the challenge of ensuring the deadlock-freedom property for message- passing processes that communicate asynchronously in cyclic process networks. Our con- tributions are twofold. - how much was read: only abstract or first pages read - source - record id: `asynchronous-session-based-concurrency` - Asynchronous Timed Session Types - what: . We present a behavioural typing system for a higher-order timed calculus using session types to model timed protocols. Behavioural typing ensures that processes in the calculus perform actions in the time- windows prescribed by their protocols. - how much was read: only abstract or first pages read - source - record id: `asynchronous-timed-session-types` - Automata Theory Meets Barrier Certificates: Temporal Logic Verification of Nonlinear Systems - what: Automata Theory Meets Barrier Certificates: Temporal Logic Verification of Nonlinear Systems Tichakorn Wongpiromsarn? Ufuk Topcu† Andrew Lamperski‡ Abstract— We consider temporal logic verification of (pos- established through simulation and bi-simulation relations sibly nonlinear) dynamical systems evolving over continuous [5] or approximately through approximate bi-simulation re- state spaces. Our approach combines automata-based verifica- lations [6]. - limits: Read from the saved open PDF at abstract/opening-section depth; quote is copied from extracted PDF text. - how much was read: only abstract or first pages read - source - record id: `automata-theory-meets-barrier` - Automata with Generalized Rabin Pairs for Probabilistic Model Checking and LTL Synthesis. - what: . The model-checking problem for probabilistic systems cru- cially relies on the translation of LTL to deterministic Rabin automata (DRW). Our recent Safraless translation [KE12, GKE12] for the LTL(F,G) fragment produces smaller automata as compared to the traditional ap- proach. - how much was read: only abstract or first pages read - source - record id: `automata-with-generalized-rabin` - Automate where Automation Fails: Proof Strategies for Frama-C/WP. - what: . Modern deductive verification tools succeed in automatically proving the great majority of program annotations thanks in particular to constantly evolving SMT solvers they rely on. The remaining proof goals still require interactively created proof scripts. - how much was read: only abstract or first pages read - source - record id: `automate-where-automation-fails` - Automated and Sound Synthesis of Lyapunov Functions with SMT Solvers. - what: . In this paper we employ SMT solvers to soundly synthesise Lyapunov functions that assert the stability of a given dynamical model. The search for a Lyapunov function is framed as the satisfiability of a second-order logical formula, asking whether there exists a function sat- isfying a desired specification (stability) for all possible initial conditions of the model. - how much was read: only abstract or first pages read - source - record id: `automated-and-sound-synthesis` - Automated Mutual Explicit Induction Proof in Separation Logic. - what: . We present a sequent-based deductive system for automati- cally proving entailments in separation logic by using mathematical in- duction. Our technique, called mutual explicit induction proof, is an in- stance of Noetherian induction. - how much was read: only abstract or first pages read - source - record id: `automated-mutual-explicit-induction` - Automated Parameterized Verification of CRDTs. - what: . Maintaining multiple replicas of data is crucial to achiev- ing scalability, availability and low latency in distributed applications. Conflict-free Replicated Data Types (CRDTs) are important building blocks in this domain because they are designed to operate correctly under the myriad behaviors possible in a weakly-consistent distributed setting. - how much was read: only abstract or first pages read - source - record id: `automated-parameterized-verification-of` - Automated Safety Verification of Programs Invoking Neural Networks. - what: . State-of-the-art program-analysis techniques are not yet able to effectively verify safety properties of heterogeneous systems, that is, systems with components implemented using diverse technologies. This shortcoming is pinpointed by programs invoking neural networks despite their acclaimed role as innovation drivers across many application areas. - how much was read: only abstract or first pages read - source - record id: `automated-safety-verification-of` - Automated Synthesis of Secure Platform Mappings. - what: . System development often involves decisions about how a high-level design is to be implemented using primitives from a low-level platform. Certain decisions, however, may introduce undesirable behavior into the resulting imple- mentation, possibly leading to a violation of a desired property that has already been established at the design level. - how much was read: only abstract or first pages read - source - record id: `automated-synthesis-of-secure` - Automated Verification of Correctness for Masked Arithmetic Programs. - what: . Masking is a widely-used effective countermeasure against power side-channel attacks for implementing cryptographic algorithms. Surprisingly, few formal verification techniques have addressed a fun- damental question, i.e., whether the masked program and the original (unmasked) cryptographic algorithm are functional equivalent. - how much was read: only abstract or first pages read - source - record id: `automated-verification-of-correctness` - Automated Verification of Equivalence Properties of Cryptographic Protocols - what: modelling of the traces of a bounded number of sessions of the protocols into first-order Horn clauses on which a dedicated resolution procedure is used to decide equivalence properties. We have shown that our procedure terminates for the class of subterm convergent equational theories. Moreover, the procedure has been implemented in a prototype tool A-KiSs (Active Knowledge in Security Protocols) and has been effec- tively tested on examples. - how much was read: only abstract or first pages read - source - record id: `automated-verification-of-equivalence` - Automated Verification of Monotonic Data Structure Traversals in C. - what: . Bespoke data structure operations are common in real-world C code. We identify one common subclass, monotonic data structure traversals (MDSTs), that iterate monotonically through the structure. - how much was read: only abstract or first pages read - source - record id: `automated-verification-of-monotonic` - Automated Verification of Parallel Nested DFS. - what: . Model checking algorithms are typically complex graph algo- rithms, whose correctness is crucial for the usability of a model checker. However, establishing the correctness of such algorithms can be challeng- ing and is often done manually. - how much was read: only abstract or first pages read - source - record id: `automated-verification-of-parallel` - Automatic Program Instrumentation for Automatic Verification. - what: . In deductive verification and software model checking, deal- ing with certain specification language constructs can be problematic when the back-end solver is not sufficiently powerful or lacks the required theories. One way to deal with this is to transform, for verification pur- poses, the program to an equivalent one not using the problematic con- structs, and to reason about its correctness instead. - how much was read: only abstract or first pages read - source - record id: `automatic-program-instrumentation-for` - Automatic Verification of Competitive Stochastic Systems. - what: . We present automatic verification techniques for the mod- elling and analysis of probabilistic systems that incorporate competitive behaviour. These systems are modelled as turn-based stochastic multi- player games, in which the players can either collaborate or compete in order to achieve a particular goal. - how much was read: only abstract or first pages read - source - record id: `automatic-verification-of-competitive` - Automatic Verification of Iterated Separating Conjunctions Using Symbolic Execution. - what: . In permission logics such as separation logic, the iterated separating conjunction is a quantifier denoting access permission to an unbounded set of heap locations. In contrast to recursive predicates, iter- ated separating conjunctions do not prescribe a structure on the locations they range over, and so do not restrict how to traverse and modify these locations. - how much was read: only abstract or first pages read - source - record id: `automatic-verification-of-iterated` - Automating Change of Representation for Proofs in Discrete Mathematics (Extended Version) - what: Representation determines how we can reason about a specific problem. Sometimes one representation helps us to find a proof more easily than others. Most current automated reasoning tools focus on reasoning within one representation. - how much was read: only abstract or first pages read - source - record id: `automating-change-of-representation` - AutoProof: Auto-Active Functional Verification of Object-Oriented Programs - what: AutoProof: Auto-active Functional Verification of Object-oriented Programs Julian Tschannen, Carlo A. Furia, Martin Nordio, and Nadia Polikarpova Chair of Software Engineering, Department of Computer Science, ETH Zurich, Switzerland firstname.lastname@inf.ethz.ch Abstract. Auto-active verifiers provide a level of automation intermediate be- tween fully automatic and interactive: users supply code with annotations as in- arXiv:1501.03063v2 [cs.LO] 15 Jan 2015 put while benefiting from a high level of automation in the back-end. - how much was read: only abstract or first pages read - source - record id: `autoproof-auto-active-functional` - AutoQ 2.0: From Verification of Quantum Circuits to Verification of Quantum Programs. - what: . We present a verifier of quantum programs called AutoQ 2.0. Quan- tum programs extend quantum circuits (the domain of AutoQ 1.0) by classical control flow constructs, which enable users to describe advanced quantum algo- rithms in a formal and precise manner. - how much was read: only abstract or first pages read - source - record id: `autoq-2-0-from` - AutoSVA: Democratizing Formal Verification of RTL Module Interactions - what: To Appear in Proceedings of the 58th ACM/IEEE Design Automation Conference (DAC’21) AutoSVA: Democratizing Formal Verification of RTL Module Interactions Marcelo Orenes-Vera, Aninda Manocha, David Wentzlaff and Margaret Martonosi Department of Computer Science and Electrical Engineering, Princeton University Princeton, New Jersey, USA Email: {movera, amanocha, wentzlaf, mrm}@princeton.edu Abstract—Modern SoC design relies on the ability to separately Ariane Core OpenPiton Tile verify IP blocks relative to their own specifications. Formal LSU L1-I Issue lsu_load L2$NoCL1.5$ arXiv:2104.04003v1 [cs.AR] 8 Apr 2021 verification (FV) using SystemVerilog Assertions (SVA) is an stage L1-D slice effective method to exhaustively verify blocks at unit-level. Unfor- lsu_store MMU tunately, FV has a steep learning curve and requires engineering effort that discourages hardware designers from usin - how much was read: only abstract or first pages read - source - record id: `autosva-democratizing-formal-verification` - Balancing Automation and Control for Formal Verification of Microprocessors. - what: . Formal methods are becoming an indispensable part of the design process in software and hardware industry. It takes robust tools and proofs to make formal validation of large scale projects reliable. - how much was read: only abstract or first pages read - source - record id: `balancing-automation-and-control` - Bayesian Formal Synthesis of Unknown Systems via Robust Simulation Relations. - what: — This paper addresses the problem of data- approaches, giving formal guarantees on the absence of any driven computation of controllers that are correct by design undesired behavior of the controlled system. arXiv:2304.07428v2 [eess.SY] 12 Feb 2024 for safety-critical systems and can provably satisfy (com- However, designing control software with robust satisfaction plex) functional requirements. With a focus on continuous- space stochastic systems with parametric uncertainty, we guarantees pro - how much was read: only abstract or first pages read - source - record id: `bayesian-formal-synthesis-of` - Bayesian Statistical Parameter Synthesis for Linear Temporal Properties of Stochastic Models. - what: . Parameterized verification of temporal properties is an active research area, being extremely relevant for model-based design of com- plex systems. In this paper, we focus on parameter synthesis for stochas- tic models, looking for regions of the parameter space where the model satisfies a linear time specification with probability greater (or less) than a given threshold. - how much was read: only abstract or first pages read - source - record id: `bayesian-statistical-parameter-synthesis` - Bayesian Verification of Chemical Reaction Networks. - what: . We present a data-driven verification approach that deter- mines whether or not a given chemical reaction network (CRN) satisfies arXiv:2004.11321v1 [cs.CE] 23 Apr 2020 a given property, expressed as a formula in a modal logic. Our approach consists of three phases, integrating formal verification over models with learning from data. - how much was read: only abstract or first pages read - source - record id: `bayesian-verification-of-chemical` - Behavioural Types for Memory and Method Safety in a Core Object-Oriented Language - what: Behavioural Types for Memory and Method Safety in a Core Object-Oriented Language arXiv:2002.12793v1 [cs.PL] 28 Feb 2020 ADRIAN FRANCALANZA, University of Malta ANTÓNIO RAVARA, Universidade Nova de Lisboa HANS HÜTTEL, Aalborg University IAROSLAV GOLOVANOV, Aalborg University MARIO BRAVETTI, Universitá di Bologna MATHIAS STEEN JAKOBSEN, Aalborg University MIKKEL KLINKE KETTUNEN, Aalborg University We present a type-based analysis ensuring memory safety and object protocol completion in the Java-like lan- guage Mungo. Objects are annotated with usages, typestates-like specifications of the admissible sequences of method calls. The analysis entwines usage checking, controlling the order in which methods are called, with a static check determining whether references may contain null values. - how much was read: only abstract or first pages read - source - record id: `behavioural-types-for-memory` - Bounded Cycle Synthesis. - what: . We introduce a new approach for the synthesis of Mealy ma- chines from specifications in linear-time temporal logic (LTL), where the number of cycles in the state graph of the implementation is limited by a given bound. Bounding the number of cycles leads to implementations that are structurally simpler and easier to understand. - how much was read: only abstract or first pages read - source - record id: `bounded-cycle-synthesis` - Bounded Verification for Finite-Field-Blasting - In a Compiler for Zero Knowledge Proofs. - what: . Zero Knowledge Proofs (ZKPs) are cryptographic protocols by which a prover convinces a verifier of the truth of a statement without revealing any other information. Typically, statements are expressed in a high-level language and then compiled to a low-level representation on which the ZKP operates. - how much was read: only abstract or first pages read - source - record id: `bounded-verification-for-finite` - Bounds2: A Tool for Compositional Multi-parametrised Verification. - what: . Bounds2 is a two-part tool for parametrised verification. The instance generator inputs a parametrised system implementation and specification, computes cut-offs for the values of the parameters and outputs the specification and implementation instances up to the cut- offs. - how much was read: only abstract or first pages read - source - record id: `bounds2-a-tool-for` - Brack: A Verified Compiler for Scheme via CakeML. - what: can only explore a tiny fraction of the space. In contrast, for- This paper describes BRacK, which is a new verified com- mal proof can guarantee that programs are never compiled piler for Scheme. BRacK compiles a substantial subset of incorrectly [27]. - how much was read: only abstract or first pages read - source - record id: `brack-a-verified-compiler` - Btor2-Cert: A Certifying Hardware-Verification Framework Using Software Analyzers. - what: . Formal verification is essential but challenging: Even the best verifiers may produce wrong verification verdicts. Certifying verifiers en- hance the confidence in verification results by generating a witness for other tools to validate the verdict independently. - how much was read: only abstract or first pages read - source - record id: `btor2-cert-a-certifying` - BUBAAK: Dynamic Cooperative Verification - (Competition Contribution). - what: Bubaak: Dynamic Cooperative Verification (Competition Contribution) Marek Chalupa1(B) and Cedric Richter2 1 Institute of Science and Technology Austria (ISTA), Klosterneuburg, Austria mchalupa@ist.ac.at 2 Carl von Ossietzky Universität Oldenburg, Oldenburg, Germany cedric.richter@uol.de Abstract. Cooperative verification is gaining momentum in recent years. The usual setup in cooperative verification is that a verifier A is run with some pre-defined resources, and if it is not able to verify the program, the verification task is passed to a verifier B together with information learned about the program by verifier A, then the chain can continue to a verifier C, and so on. - how much was read: only abstract or first pages read - source - record id: `bubaak-dynamic-cooperative-verification` - Bubaak: Runtime Monitoring of Program Verifiers - (Competition Contribution). - what: . The main idea behind Bubaak is to run multiple program analyses in parallel and use runtime monitoring and enforcement to ob- serve and control their progress in real time. The analyses send informa- tion about (un)explored states of the program and discovered invariants to a monitor. - how much was read: only abstract or first pages read - source - record id: `bubaak-runtime-monitoring-of` - Bubaak-SpLit: Split what you cannot verify (Competition contribution). - what: . Bubaak-SpLit is a tool for dynamically splitting verifica- tion tasks into parts that can then be analyzed in parallel. It is built on top of Bubaak, a tool designed for running combinations of veri- fiers in parallel. - how much was read: only abstract or first pages read - source - record id: `bubaak-split-split-what` - Bug-Assist: Assisting Fault Localization in ANSI-C Programs. - what: . Several verification tools exist for checking safety properties of programs and reporting errors. However, a large part of the program development cycle is spend in analyzing the error trace to isolate loca- tions in the code that are potential causes of the bug. - how much was read: only abstract or first pages read - source - record id: `bug-assist-assisting-fault` - CADP 2010: A Toolbox for the Construction and Analysis of Distributed Processes - what: . Cadp (Construction and Analysis of Distributed Processes) is a comprehensive software toolbox that implements the results of con- currency theory. Started in the mid 80s, Cadp has been continuously de- veloped by adding new tools and enhancing existing ones. - how much was read: only abstract or first pages read - source - record id: `cadp-2010-a-toolbox` - cake_lpr: Verified Propagation Redundancy Checking in CakeML. - what: . Modern SAT solvers can emit independently checkable proof certificates to validate their results. The state-of-the-art proof system that allows for compact proof certificates is propagation redundancy (PR). - how much was read: only abstract or first pages read - source - record id: `cake-lpr-verified-propagation` - Candle: A Verified Implementation of HOL Light (Extended Version) - what: This paper presents a fully verified interactive theorem prover for higher-order logic, more specifically: a fully verified clone of HOL Light. Our verification proof of this new system results in an end-to-end correctness theorem that guarantees the soundness of the entire system down to the machine code that executes at runtime. Our theorem states that every exported fact produced by this machine-code program is valid in higher-order logic. - how much was read: only abstract or first pages read - source - record id: `candle-a-verified-implementation` - Carcara: An Efficient Proof Checker and Elaborator for SMT Proofs in the Alethe Format. - what: . Proofs from SMT solvers ensure correctness independently from implementation, which is often a requirement when solvers are used in safety-critical applications or proof assistants. Alethe is an established SMT proof format generated by the solvers veriT and cvc5, with recon- struction support in the proof assistants Isabelle/HOL and Coq. - how much was read: only abstract or first pages read - source - record id: `carcara-an-efficient-proof` - Carnap: An Open Framework for Formal Reasoning in the Browser - what: syntax, henceforth Carnap’s syntax; (b) functions applicable to realizations of Carnap’s syntax that allow for the semantic interpretation, parsing, display, and manipulation of all languages based on this syntax; (c) generic unification algorithms based on the manipulations provided by the functions above; (d) data types for a number of particular languages—in particular, languages for propositional logic, propositional modal logic, first-order logic, quantified modal logic, monadic second-order logic, and polyadic second-order logic—all implemented as realizations of Carnap’s abstract syntax; (e) data types for a number of logics for these languages;3 and (f) generic proof-checking methods applicable with these logics. The second main component of the Carnap framework is Carnap-GHCJS, a set of browser-based edu- cational applications, trans-compiled from Haskell to JavaScript via the G - how much was read: only abstract or first pages read - source - record id: `carnap-an-open-framework` - Case Study: Neural Network Malware Detection Verification for Feature and Image Datasets. - what: the creation of a ‘botnet’ (Distributed Denial of Service (DDoS)), us- Malware, or software designed with harmful intent, is an ever- ing someone else’s system to mine cryptocurrency (cryptojacking), evolving threat that can have drastic effects on both individuals monitoring activity and passwords (espionage), and distributing and institutions. Neural network malware classification systems spam. Not only do malware attacks pose a significant threat to indi- are key tools for combating these threats but are vulnerable to viduals, but they also frequently target a wide array of institutions. - how much was read: only abstract or first pages read - source - record id: `case-study-neural-network` - Case Study: Runtime Safety Verification of Neural Network Controlled System. - what: . Neural networks are increasingly used in safety-critical ap- plications such as robotics and autonomous vehicles. However, the de- ployment of neural-network-controlled systems (NNCSs) raises signifi- cant safety concerns. - how much was read: only abstract or first pages read - source - record id: `case-study-runtime-safety` - Causality Analysis for Concurrent Reactive Systems (Extended Abstract) - what: Causality Analysis for Concurrent Reactive Systems (Extended Abstract) Rayna Dimitrova Rupak Majumdar Vinayak S. Prabhu University of Leicester MPI-SWS Colorado State University Leicester, UK Keiserslautern and Saarbrücken, Germany Fort Collins, Colorado, United States rd307@leicester.ac.uk rupak@mpi-sws.org vinayak@mpi-sws.org We present a comprehensive language theoretic causality analysis framework for explaining safety property violations in the setting of concurrent reactive systems. Our framework allows us to uni- formly express a number of causality notions studied in the areas of artificial intelligence and formal methods, as well as define new ones that are of potential interest in these areas. - how much was read: only abstract or first pages read - source - record id: `causality-analysis-for-concurrent` - 'Cause I'm strong enough: reasoning about consistency choices in distributed systems. - what: use. Ideally, we would like replicated databases to provide strong Large-scale distributed systems often rely on replicated databases consistency, i.e., to behave as if a single centralised node handles that allow a programmer to request different data consistency guar- all operations. However, achieving this ideal usually requires syn- antees for different operations, and thereby control their perfor- chronisation among replicas, which slows down the database and mance. - how much was read: only abstract or first pages read - source - record id: `cause-i-m-strong` - Certified Quantization Strategy Synthesis for Neural Networks. - what: . Quantization plays an important role in deploying neural networks on embedded, real-time systems with limited computing and storage resources (e.g., edge devices). It significantly reduces the model storage cost and improves inference efficiency by using fewer bits to repre- sent the parameters. - how much was read: only abstract or first pages read - source - record id: `certified-quantization-strategy-synthesis` - Certifying Proofs for LTL Model Checking - what: Certifying Proofs for LTL Model Checking Alberto Griggio, Marco Roveri and Stefano Tonetta FBK-irst, Trento, Italy Email: {griggio,roveri,tonettas}@fbk.eu Abstract—In the context of formal verification, certifying from such encoding are reduced to one; liveness is reduced proofs are proofs of the correctness of a model in a deduction typically to safety. system produced automatically as outcome of the verification. We propose a sound and complete approach, where the They are quite appealing for high-assurance systems because they can be verified independently by proof checkers, which are proof is generated from the inductive invariant obtained with usually simpler to certify than the proof-generating tools. - limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review. - how much was read: only abstract or first pages read - source - record id: `certifying-proofs-for-ltl` - CertRL: formalizing convergence proofs for value and policy iteration in Coq. - what: CertRL: Formalizing Convergence Proofs for Value and Policy Iteration in Coq KOUNDINYA VAJJHA, University of Pittsburgh , USA AVRAHAM SHINNAR, IBM Research , USA BARRY TRAGER, IBM Research , USA VASILY PESTUN, IBM Research , USA& IHES NATHAN FULTON, IBM Research , USA arXiv:2009.11403v2 [cs.AI] 15 Dec 2020 Reinforcement learning algorithms solve sequential decision-making problems in probabilistic environments by optimizing for long-term reward. The desire to use reinforcement learning in safety-critical settings inspires a recent line of work on formally constrained reinforcement learning; however, these methods place the implementation of the learning algorithm in their Trusted Computing Base. The crucial correctness property of these implementations is a guarantee that the learning algo - how much was read: only abstract or first pages read - source - record id: `certrl-formalizing-convergence-proofs` - CESAR: Control Envelope Synthesis via Angelic Refinements. - what: . This paper presents an approach for synthesizing provably correct control envelopes for hybrid systems. Control envelopes charac- terize families of safe controllers and are used to monitor untrusted con- trollers at runtime. - how much was read: only abstract or first pages read - source - record id: `cesar-control-envelope-synthesis` - CHCVerif: A Portfolio-Based Solver for Constrained Horn Clauses - what: CHCV ERIF: A Portfolio-Based Solver for Constrained Horn Clauses Mihály Dobos-Kovács Levente Bajczi András Vörös Department of Artificial Intelligence and Systems Engineering Budapest University of Technology and Economics, Hungary {mdobosko,bajczi,vori}@mit.bme.hu Constrained Horn Clauses (CHCs) are widely adopted as intermediate representations for a variety of verification tasks, including safety checking, invariant synthesis, and interprocedural analysis. This paper introduces CHCV ERIF, a portfolio-based CHC solver that adopts a software verification approach for solving CHCs. This approach enables us to reuse mature software verification tools to tackle CHC benchmarks, particularly those involving bitvectors and low-level semantics. - how much was read: only abstract or first pages read - source - record id: `chcverif-a-portfolio-based` - Circular Proofs as Session-Typed Processes: A Local Validity Condition - what: . Proof theory provides a foundation for studying and reasoning about program- ming languages, most directly based on the well-known Curry-Howard isomorphism between intuitionistic logic and the typed lambda-calculus. More recently, a correspondence between intuitionistic linear logic and the session-typed pi-calculus has been discovered. - how much was read: only abstract or first pages read - source - record id: `circular-proofs-as-session` - Clausal Proofs for Pseudo-Boolean Reasoning. - what: . When augmented with a Pseudo-Boolean (PB) solver, a Boolean sat- isfiability (SAT) solver can apply apply powerful reasoning methods to determine when a set of parity or cardinality constraints, extracted from the clauses of the input formula, has no solution. By converting the intermediate constraints gen- erated by the PB solver into ordered binary decision diagrams (BDDs), a proof- generating, BDD-based SAT solver can then produce a clausal proof that the input formula is unsatisfiable. - how much was read: only abstract or first pages read - source - record id: `clausal-proofs-for-pseudo` - Collaborative Verification and Testing with Explicit Assumptions. - what: . Many mainstream static code checkers make a number of compromises to improve automation, performance, and accuracy. These compromises include not checking certain program properties as well as making implicit, unsound assumptions. - how much was read: only abstract or first pages read - source - record id: `collaborative-verification-and-testing` - Commutativity for Concurrent Program Termination Proofs. - what: . This paper explores how using commutativity can improve the efficiency and efficacy of algorithmic termination checking for concur- rent programs. If a program run is terminating, one can conclude that all other runs equivalent to it up-to-commutativity are also terminat- ing. - how much was read: only abstract or first pages read - source - record id: `commutativity-for-concurrent-program` - Comparing Channel Restrictions of Communicating State Machines, High-level Message Sequence Charts, and Multiparty Session Types - what: Comparing Channel Restrictions of Communicating State Machines, High-level Message Sequence Charts, and Multiparty Session Types Felix Stutz Damien Zufferey MPI-SWS, Kaiserslautern, Germany {fstutz,zufferey}@mpi-sws.org Communicating state machines provide a formal foundation for distributed computation. Unfor- tunately, they are Turing-complete and, thus, challenging to analyse. In this paper, we classify restrictions on channels which have been proposed to work around the undecidability of verification questions. - how much was read: only abstract or first pages read - source - record id: `comparing-channel-restrictions-of` - Compiler verification for fun and profit. - what: Compiler verification for fun and profit Xavier Leroy Inria Paris–Rocquencourt, Domaine de Voluceau, BP 105, 78153 Le Chesnay, France Email: xavier.leroy@inria.fr A BSTRACT OF INVITED TALK Formal verification of software or hardware systems — be it by model checking, deductive verification, abstract interpretation, type checking, or any other kind of static analysis — is generally conducted over high-level programming or description languages, quite remote from the actual machine code and circuits that execute in the system. To bridge this particular gap, we all rely on compilers and other code generators to automatically produce the executable artifact. Compilers are, however, vulnerable to - how much was read: only abstract or first pages read - source - record id: `compiler-verification-for-fun` - Compiling CAO: From Cryptographic Specifications to C Implementations - what: . We present a compiler for CAO, an imperative DSL for the cryptographic domain. The tool takes high-level cryptographic algorithm specifications and translates them into C implementations through a series of security-aware transformations and optimizations. - how much was read: only abstract or first pages read - source - record id: `compiling-cao-from-cryptographic` - Complete Multiparty Session Type Projection with Automata. - what: . Multiparty session types (MSTs) are a type-based approach to verifying communication protocols. Central to MSTs is a projection operator : a partial function that maps protocols represented as global types to correct-by-construction implementations for each participant, represented as a communicating state machine. - how much was read: only abstract or first pages read - source - record id: `complete-multiparty-session-type` - Compositional abstraction refinement for control synthesis - what: This paper presents a compositional approach to specification-guided abstrac- tion refinement for control synthesis of a nonlinear system associated with a method to over-approximate its reachable sets. Given an initial coarse partition of the state space, the control specification is given as a sequence of the cells of this partition to visit at each sampling time. The dynamics are decomposed into subsystems where some states and inputs are not observed, some states are observed but not controlled and where assume-guarantee obligations are used on the uncontrolled states of each subsystem. - how much was read: only abstract or first pages read - source - record id: `compositional-abstraction-refinement-for` - Compositional Non-Interference for Fine-Grained Concurrent Programs - what: —Non-interference is a program property that ensures [10]. Such systems provide strong automation (by means of the absence of information leaks. In the context of programming arXiv:1910.00905v2 [cs.LO] 6 Mar 2020 type checking), but lack capabilities to reason about functional languages, there exist two common approaches for establishing correctness, and are thus inherently restrictive in the kind of non-interference: type systems and program logics. - how much was read: only abstract or first pages read - source - record id: `compositional-non-interference-for` - Compositional Termination Proofs for Multi-threaded Programs. - what: . Automated verification of multi-threaded programs is diffi- cult. Direct treatment of all possible thread interleavings by reasoning about the program globally is a prohibitively expensive task, even for small programs. - how much was read: only abstract or first pages read - source - record id: `compositional-termination-proofs-for` - Compositional Verification of Procedural Programs using Horn Clauses over Integers and Arrays. - what: —We present a compositional SMT-based algorithm memory into registers (e.g., [2], [15]). However, the inlining for safety of procedural C programs that takes the heap into approach has many drawbacks. It can expand the program size consideration as well. - how much was read: only abstract or first pages read - source - record id: `compositional-verification-of-procedural` - Computing Adequately Permissive Assumptions for Synthesis. - what: . We automatically compute a new class of environment as- sumptions in two-player turn-based finite graph games which character- ize an “adequate cooperation” needed from the environment to allow the system player to win. Given an ω-regular winning condition Φ for the system player, we compute an ω-regular assumption Ψ for the environ- ment player, such that (i) every environment strategy compliant with Ψ allows the system to fulfill Φ (sufficiency), (ii) Ψ can be fulfilled by the environment for every strategy of the system (implementability), and (iii) Ψ does not prevent any cooperative strategy choice (permissiveness). - how much was read: only abstract or first pages read - source - record id: `computing-adequately-permissive-assumptions` - ConcurrentWitness2Test: Test-Harnessing the Power of Concurrency (Competition Contribution). - what: ConcurrentWitness2Test: Test-Harnessing the Power of Concurrency (Competition Contribution) Levente Bajczi(B) ⋆ , Zsófia Ádám , and Zoltán Micskei Department of Measurement and Information Systems, Budapest University of Technology and Economics, Budapest, Hungary bajczi@mit.bme.hu Abstract. ConcurrentWitness2Test is a violation witness valida- tor for concurrent software. Taking both nondeterminism of data and interleaving-based nondeterminism into account, the tool aims to use the metadata described in the violation witnesses to synthesize an ex- ecutable test harness. - how much was read: only abstract or first pages read - source - record id: `concurrentwitness2test-test-harnessing-the` - Conditional model checking: a technique to pass information between verifiers. - what: Conditional Model Checking Dirk Beyer 1,2 , Thomas A. Henzinger 3 , M. Erkan Keremoglu 2 , Philipp Wendler 1 1 University of Passau, Germany 2 Simon Fraser University, B.C., Canada 3 IST Austria, Austria arXiv:1109.6926v1 [cs.SE] 30 Sep 2011 Technical Report, Number MIP-1107 Department of Computer Science and Mathematics University of Passau, Germany September 2011 Conditional Model Checking Dirk Beyer 1,2 , Thomas A. - how much was read: only abstract or first pages read - source - record id: `conditional-model-checking-a` - Connecting Program Synthesis and Reachability: Automatic Program Repair Using Test-Input Generation. - what: . We prove that certain formulations of program synthesis and reachability are equivalent. Specifically, our constructive proof shows the reductions between the template-based synthesis problem, which gener- ates a program in a pre-specified form, and the reachability problem, which decides the reachability of a program location. - how much was read: only abstract or first pages read - source - record id: `connecting-program-synthesis-and` - Constraint-Based Relational Verification. - what: . In recent years they have been numerous works that aim to automate relational verification. Meanwhile, although Constrained Horn Clauses (CHCs) empower a wide range of verification techniques and tools, they lack the ability to express hyperproperties beyond k-safety such as generalized non-interference and co-termination. - how much was read: only abstract or first pages read - source - record id: `constraint-based-relational-verification` - Constraint-Based Synthesis of Coupling Proofs. - what: Proof by coupling is a classical technique for proving prop- erties about pairs of randomized algorithms by carefully relating (or coupling) two probabilistic executions. In this paper, we show how to automatically construct such proofs for probabilistic programs. First, we present f -coupled postconditions, an abstraction describing two corre- lated program executions. - limits: Read from the saved open PDF; this record uses the abstract/opening section and preserves the exact extracted quote below. - how much was read: only abstract or first pages read - source - record id: `constraint-based-synthesis-of` - Control Barrier Functions with Actuation Constraints under Signal Temporal Logic Specifications - what: Control Barrier Functions with Actuation Constraints under Signal Temporal Logic Specifications Ali Tevfik Buyukkocak, Derya Aksaray, and Yasin Yazıcıoğlu Abstract— We propose control barrier functions (CBFs) for form the an overall specification. For example, in [16], an a family of dynamical systems to satisfy a broad fragment LTL fragment is considered and a CBF is defined for each of Signal Temporal Logic (STL) specifications, which may arXiv:2204.03631v1 [eess.SY] 7 Apr 2022 subtask while the order of the subtasks is assigned randomly. include subtasks with nested temporal operators or conflicting requirements (e.g., achieving multiple subtasks within the same In [17], arbitrary time windows are assigned for each LTL time interval). - limits: Read from the saved open PDF at abstract/opening-section depth; quote is copied from extracted PDF text. - how much was read: only abstract or first pages read - source - record id: `control-barrier-functions-with` - Control of probabilistic systems under dynamic, partially known environments with temporal logic specifications - what: Control of Probabilistic Systems under Dynamic, Partially Known Environments with Temporal Logic Specifications Tichakorn Wongpiromsarn and Emilio Frazzoli Abstract— We consider the synthesis of control policies for specification while the system attempts to satisfy it [11]. In probabilistic systems, modeled by Markov decision processes, these works, the system is assumed to be deterministic, i.e., operating in partially known environments with temporal logic an available control action in each state enables exactly one specifications. The environment is modeled by a set of Markov chains. - limits: Read from the saved open PDF at abstract/opening-section depth; quote is copied from extracted PDF text. - how much was read: only abstract or first pages read - source - record id: `control-of-probabilistic-systems` - Controller Synthesis for Multi-Agent Systems With Intermittent Communication. A Metric Temporal Logic Approach - what: Controller Synthesis for Multi-Agent Systems With Intermittent Communication: A Metric Temporal Logic Approach Zhe Xu, Federico M. Zegers, Bo Wu, Warren Dixon and Ufuk Topcu Abstract— This paper develops a controller synthesis ap- methods can also be used to coordinate the agents that com- proach for a multi-agent system (MAS) with intermittent municate with a central base station or cloud intermittently communication. We adopt a leader-follower scheme, where a as in [9], where submarines intermittently surface to obtain mobile leader with absolute position sensors switches among a state information about themselves and their neighbors from arXiv:1909.09939v1 [eess.SY] 22 Sep 2019 set of followers without absolute position sensors to provide each follower with intermittent state information. - how much was read: only abstract or first pages read - source - record id: `controller-synthesis-for-multi` - COOL-MC: A Comprehensive Tool for Reinforcement Learning and Model Checking - what: This paper presents COOL-MC, a tool that integrates state- of-the-art reinforcement learning (RL) and model checking. Specifically, the tool builds upon the OpenAI gym and the probabilistic model checker Storm. COOL-MC provides the following features: (1) a simulator to train RL policies in the OpenAI gym for Markov decision processes (MDPs) that are defined as input for Storm, (2) a new model builder for Storm, which uses callback functions to verify (neural network) RL policies, (3) formal abstractions that relate models and policies specified in OpenAI gym or Storm, and (4) algorithms to obtain bounds on the performance of so-called permissive policies. - limits: Read from the saved open PDF at abstract/opening-section depth; quote is copied from extracted PDF text. - how much was read: only abstract or first pages read - source - record id: `cool-mc-a-comprehensive` - Cooperative verifier-based testing with CoVeriTest - what: Testing is a widely applied technique to evaluate software quality, and coverage criteria are often used to assess the adequacy of a generated test suite. However, manually constructing an adequate test suite is typically too expensive, and numerous techniques for automatic test-suite generation were proposed. All of them come with different strengths. - how much was read: only abstract or first pages read - source - record id: `cooperative-verifier-based-testing` - Correctness of Concurrent Objects under Weak Memory Models - what: Correctness of Concurrent Objects under Weak Memory Models Graeme Smith Kirsten Winter Robert J. Colvin School of Information Technology and Electrical Engineering, The University of Queensland, Australia smith@itee.uq.edu.au kirsten@itee.uq.edu.au r.colvin@uq.edu.au In this paper we develop a theory for correctness of concurrent objects under weak memory models. Central to our definitions is the concept of observations which determine when effects of operations become visible, and hence determine the semantics of objects, under a given memory model. - how much was read: only abstract or first pages read - source - record id: `correctness-of-concurrent-objects` - Correlated Equilibria and Fairness in Concurrent Stochastic Games. - what: . Game-theoretic techniques and equilibria analysis facilitate the design and verification of competitive systems. While algorithmic complexity of equilibria computation has been extensively studied, prac- tical implementation and application of game-theoretic methods is more recent. - how much was read: only abstract or first pages read - source - record id: `correlated-equilibria-and-fairness` - Correspondence assertions for process synchronization in concurrent communications - what: High-level specification of patterns of communications such as protocols can be modeled elegantly by means of session types (Honda et al., 1998). However, a number of examples suggest that session types fall short when finer precision on protocol specification is required. In order to increase the expressiveness of session types we appeal to the theory of correspondence assertions (Clarke & Marrero, 1998; Gordon & Jeffrey, 2003b). - how much was read: only abstract or first pages read - source - record id: `correspondence-assertions-for-process` - Counter-example complete verification for higher-order functions. - what: closure may need to take into account closures that have po- We present a verification procedure for pure higher-order tentially not been discovered yet. functional Scala programs with parametric types. We show Our solution adds support for higher-order constructs by that our procedure is sound for proofs, as well as sound and encoding them in a sequence of first order quantifier-free for- complete for counter-examples. - how much was read: only abstract or first pages read - source - record id: `counter-example-complete-verification` - Counter Example Guided Reactive Synthesis for LTL Modulo Theories - what: . Reactive synthesis is the process of automatically generat- ing a correct system from a given temporal specification. In this paper, we address the problem of reactive synthesis for LTL modulo theories (LTLT ), which extends LTL with literals from a first-order theory and allows relating the values of data across time. - how much was read: only abstract or first pages read - source - record id: `counter-example-guided-reactive` - Counter-strategy guided refinement of GR(1) temporal logic specifications - what: Counter-Strategy Guided Refinement of GR(1) Temporal Logic Specifications Rajeev Alur, Salar Moarref, and Ufuk Topcu University of Pennsylvania, Philadelphia, USA. {alur,moarref,utopcu}@seas.upenn.edu Abstract—The reactive synthesis problem is to find a finite- to give the user insight into the specification. They also state controller that satisfies a given temporal-logic specification provide ways to correct the specification. - how much was read: only abstract or first pages read - source - record id: `counter-strategy-guided-refinement` - Counterexample-Driven Synthesis for Probabilistic Program Sketches. - what: . Probabilistic programs are key to deal with uncertainty in e.g. controller synthesis. - how much was read: only abstract or first pages read - source - record id: `counterexample-driven-synthesis-for` - Counterexample Guided Inductive Synthesis Modulo Theories. - what: . Program synthesis is the mechanised construction of soft- ware. One of the main difficulties is the efficient exploration of the very large solution space, and tools often require a user-provided syntactic restriction of the search space. - how much was read: only abstract or first pages read - source - record id: `counterexample-guided-inductive-synthesis` - CoVeriTeam: On-Demand Composition of Cooperative Verification Systems. - what: . There is no silver bullet for software verification: Different techniques have different strengths. Thus, it is imperative to combine the strengths of verification tools via combinations and cooperation. - how much was read: only abstract or first pages read - source - record id: `coveriteam-on-demand-composition` - CPAchecker: A Tool for Configurable Software Verification - what: CPAchecker: arXiv:0902.0019v1 [cs.PL] 30 Jan 2009 A Tool for Configurable Software Verification Dirk Beyer M. Erkan Keremoglu Technical Report No. SFU-CS-2009-02 January 30, 2009 School of Computing Science Simon Fraser University 8888 University Drive Burnaby, B.C., Canada, V5A 1S6 CPAchecker: A Tool for Configurable Software Verification ⋆ (Tool Paper) Dirk Beyer and M. - limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review. - how much was read: only abstract or first pages read - source - record id: `cpachecker-a-tool-for` - CPV: A Circuit-Based Program Verifier. - what: . We submit to SV-COMP 2024 CPV, a circuit-based software verifier for C programs. CPV utilizes sequential circuits as its intermedi- ate representation and invokes hardware model checkers to analyze the reachability safety of C programs. - how much was read: only abstract or first pages read - source - record id: `cpv-a-circuit-based` - Cross-Entropy Optimisation of Importance Sampling Parameters for Statistical Model Checking - what: Statistical model checking avoids the exponential growth of states associated with probabilistic model checking by estimating prop- erties from multiple executions of a system and by giving results within confidence bounds. Rare properties are often very important but pose a particular challenge for simulation-based approaches, hence a key ob- jective under these circumstances is to reduce the number and length of simulations necessary to produce a given level of confidence. Impor- tance sampling is a well-established technique that achieves this, however to maintain the advantages of statistical model checking it is necessary to find good importance sampling distributions without considering the entire state space. - limits: Read from the saved open PDF at abstract/opening-section depth; quote is copied from extracted PDF text. - how much was read: only abstract or first pages read - source - record id: `cross-entropy-optimisation-of` - CTL* Verification and Synthesis Using Existential Horn Clauses. - what: . This work proposes a novel approach for automatic verifi- cation and synthesis of infinite-state reactive programs with respect to CT L∗ specifications, based on translation to Existential Horn Clauses (EHCs). CT L∗ is a powerful temporal logic, which subsumes the temporal log- ics LTL and CTL, both widely used in specification, verification, and synthesis of complex systems. - how much was read: only abstract or first pages read - source - record id: `ctl-verification-and-synthesis` - cvc4sy: Smart and Fast Term Enumeration for Syntax-Guided Synthesis. - what: . We present CVC4SY, a syntax-guided synthesis (SyGuS) solver based on three bounded term enumeration strategies. The first encodes term enumer- ation as an extension of the quantifier-free theory of algebraic datatypes. - how much was read: only abstract or first pages read - source - record id: `cvc4sy-smart-and-fast` - Data-Driven Safety Verification using Barrier Certificates and Matrix Zonotopes. - what: . Ensuring safety in cyber-physical systems (CPSs) is a critical challenge, especially when system models are difficult to obtain or cannot be fully trusted due to uncertainty, modeling errors, or environmental disturbances. Traditional model-based approaches rely on precise system dynamics, which may not be available in real-world scenarios. - how much was read: only abstract or first pages read - source - record id: `data-driven-safety-verification` - Data-Driven Synthesis of Provably Sound Side Channel Analyses. - what: Data-Driven Synthesis of Provably Sound Side Channel Analyses Jingbo Wang, Chungha Sung, Mukund Raghothaman and Chao Wang University of Southern California Abstract—We propose a data-driven method for synthesiz- Feature Query ing static analyses to detect side-channel information leaks in Training Synthesis Containment ed erifi Analyzer Programs (SyGuS) R Checking RV cryptographic software. Compared to the conventional way of arXiv:2102.06753v1 [cs.SE] 12 Feb 2021 manually crafting such static analyzers, which can be tedious, Decision Knowledge R R ej Tree Base ecte Counter- error prone and suboptimal, our learning-based technique is not Learning (KB) d example Type only automated but also p - how much was read: only abstract or first pages read - source - record id: `data-driven-synthesis-of` - Deadlock-free session types in linear Haskell - what: Moreover, these implementations only focus on the most Priority Sesh is a library for session-typed communication in basic features of session types and often ignore more ad- Linear Haskell which offers strong compile-time correctness vanced ones, such as channel delegation or deadlock freedom: guarantees. Priority Sesh offers two deadlock-free APIs for Neubauer and Thiemann [44] only provide single session session-typed communication. The first guarantees deadlock channels; Pucella and Tov [56] provide multiple channels, freedom by restricting the process structure to trees and but only the building blocks for channel delegation; Imai et al. - limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review. - how much was read: only abstract or first pages read - source - record id: `deadlock-free-session-types` - Deagle: An SMT-based Verifier for Multi-threaded Programs (Competition Contribution). - what: . Deagle is an SMT-based multi-threaded program verification tool. It is built on top of CBMC (front-end) and MiniSAT (back-end). - how much was read: only abstract or first pages read - source - record id: `deagle-an-smt-based` - Decidable Synthesis of Programs with Uninterpreted Functions. - what: . We identify a decidable synthesis problem for a class of pro- grams of unbounded size with conditionals and iteration that work over infinite data domains. The programs in our class use uninterpreted func- tions and relations, and abide by a restriction called coherence that was recently identified to yield decidable verification. - how much was read: only abstract or first pages read - source - record id: `decidable-synthesis-of-programs` - Deciding the Bisimilarity of Context-Free Session Types. - what: . We present an algorithm to decide the equivalence of context- free session types, practical to the point of being incorporated in a com- piler. We prove its soundness and completeness. - how much was read: only abstract or first pages read - source - record id: `deciding-the-bisimilarity-of` - Deductive Synthesis of Programs with Pointers: Techniques, Challenges, Opportunities - (Invited Paper). - what: . This paper presents the main ideas behind deductive synthe- sis of heap-manipulating program and outlines present challenges faced by this approach as well as future opportunities for its applications. - how much was read: only abstract or first pages read - source - record id: `deductive-synthesis-of-programs` - Deductive Synthesis of Reinforcement Learning Agents for Infinite Horizon Tasks. - what: . We propose a deductive synthesis framework for construct- ing reinforcement learning (RL) agents that provably satisfy temporal reach-avoid specifications over infinite horizons. Our approach decom- poses these temporal specifications into a sequence of finite-horizon sub- tasks, for which we synthesize individual RL policies. - how much was read: only abstract or first pages read - source - record id: `deductive-synthesis-of-reinforcement` - Deductive Verification of Floating-Point Java Programs in KeY. - what: . Deductive verification has been successful in verifying inter- esting properties of real-world programs. One notable gap is the limited support for floating-point reasoning. - how much was read: only abstract or first pages read - source - record id: `deductive-verification-of-floating` - Deductive Verification via the Debug Adapter Protocol - what: Deductive Verification via the Debug Adapter Protocol Gidon Ernst Johannes Blau Toby Murray Ludwig-Maximilians-Universität University of Melbourne Munich, Germany Melbourne, Australia gidon.ernst@lmu.de toby.murray@unimelb.edu.au We propose a conceptual integration of deductive program verification into existing user interfaces for software debugging. This integration is well-represented in the “Debug Adapter Protocol”, a widely-used and generic technology to integrate debugging of programs into development environ- ments. Commands like step-forward and step-in are backed by steps of a symbolic structural op- erational semantics, and the different paths through a program are readily represented by multiple running threads of the debug target inside the user interface. - how much was read: only abstract or first pages read - source - record id: `deductive-verification-via-the` - Detecting Unrealizability of Distributed Fault-tolerant Systems - what: Logical Methods in Computer Science Vol. 11(3:10)2015, pp. 1–31 Submitted Nov. - limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review. - how much was read: only abstract or first pages read - source - record id: `detecting-unrealizability-of-distributed` - Developing Verified Programs with Dafny - what: Developing Verified Programs with Dafny K. Rustan M. Leino Microsoft Research, Redmond, WA, USA leino@microsoft.com Abstract. - how much was read: only abstract or first pages read - source - record id: `developing-verified-programs-with` - Diagnosis via Proofs of Unsatisfiability for First-Order Logic with Relational Objects. - how much was read: only abstract or first pages read - source - record id: `diagnosis-via-proofs-of` - Difference Verification with Conditions - what: . Modern software-verification tools need to support develop- ment processes that involve frequent changes. Existing approaches for incremental verification hard-code specific verification techniques. - how much was read: only abstract or first pages read - source - record id: `difference-verification-with-conditions` - Differentiable Logics for Neural Network Training and Verification. - what: Differentiable Logics for Neural Network Training and Verification Natalia Slusarz, Ekaterina Komendantskaya, Matthew L. Daggitt, and Robert Stewart arXiv:2207.06741v1 [cs.AI] 14 Jul 2022 Heriot-Watt University, Edinburgh, United Kingdom {nds1, ek19, md2006, rs46}@hw.ac.uk 1 Introduction The rising popularity of neural networks (NNs) in recent years and their increas- ing prevalence in real-world applications have drawn attention to the importance of their verification. While verification is known to be computationally difficult theoretically [6], many techniques have been proposed for solving it in prac- tice [1]. - how much was read: only abstract or first pages read - source - record id: `differentiable-logics-for-neural` - Discourje: Run-Time Verification of Communication Protocols in Clojure - Live at Last. - what: . Multiparty session typing (MPST) is a formal method to make concurrent programming simpler. The idea is to use type checking to automatically prove safety (protocol compliance) and liveness (com- munication deadlock freedom) of implementations relative to specifica- tions. - how much was read: only abstract or first pages read - source - record id: `discourje-run-time-verification` - Discourje: Runtime Verification of Communication Protocols in Clojure. - what: . This paper presents Discourje: a runtime verification frame- work for communication protocols in Clojure. Discourje guarantees safety of protocol implementations relative to specifications, based on an ex- pressive new version of multiparty session types. - how much was read: only abstract or first pages read - source - record id: `discourje-runtime-verification-of` - Divide et Impera: Efficient Synthesis of Cyber-Physical System Architectures from Formal Contracts. - what: . Generative Engineering is a new paradigm for the development of cyber-physical systems. Rather than developing a single, increasingly more de- tailed model of a system, multiple architectural variants are computationally generated and evaluated, which would be prohibitively expensive to do by hand. - how much was read: only abstract or first pages read - source - record id: `divide-et-impera-efficient` - DNNV: A Framework for Deep Neural Network Verification. - what: . Despite the large number of sophisticated deep neural net- work (DNN) verification algorithms, DNN verifier developers, users, and researchers still face several challenges. First, verifier developers must contend with the rapidly changing DNN field to support new DNN opera- tions and property types. - how much was read: only abstract or first pages read - source - record id: `dnnv-a-framework-for` - Does a Program Yield the Right Distribution? - Verifying Probabilistic Programs via Generating Functions. - what: . We study discrete probabilistic programs with potentially unbounded looping behaviors over an infinite state space. We present, to the best of our knowledge, the first decidability result for the prob- lem of determining whether such a program generates exactly a specified distribution over its outputs (provided the program terminates almost- surely). - how much was read: only abstract or first pages read - source - record id: `does-a-program-yield` - DRAT Proofs of Unsatisfiability for SAT Modulo Monotonic Theories. - what: . Generating proofs of unsatisfiability is a valuable capability of most SAT solvers, and is an active area of research for SMT solvers. This paper introduces the first method to efficiently generate proofs of unsatisfiability specifically for an important subset of SMT: SAT Mod- ulo Monotonic Theories (SMMT), which includes many useful finite- domain theories (e.g., bit vectors and many graph-theoretic properties) and is used in production at Amazon Web Services. - how much was read: only abstract or first pages read - source - record id: `drat-proofs-of-unsatisfiability` - Dynamic Verification of OCaml Software with Gospel and Ortac/QCheck-STM. - what: This paper introduces the QCheck-STM plugin for Ortac, a framework for dynamic verification of OCaml code. Ortac/QCheck-STM consumes OCaml module signatures annotated with behavioural specific- ation contracts expressed in the Gospel language, extracts a functional model of a mutable data structure from it, and generates code for auto- mated runtime assertion checking. We report on the implementation of the tool, the structure of the generated code, and on errors found in established OCaml libraries. - how much was read: only abstract or first pages read - source - record id: `dynamic-verification-of-ocaml` - Early Verification of Legal Compliance via Bounded Satisfiability Checking. - what: . Legal properties involve reasoning about data values and time. Metric first-order temporal logic (MFOTL) provides a rich formal- ism for specifying legal properties. - how much was read: only abstract or first pages read - source - record id: `early-verification-of-legal` - EBF 4.2: Black-Box Cooperative Verification for Concurrent Programs - what: EBF 4.2: Black-Box Cooperative Verification for Concurrent Programs (Competition Contribution) Fatimah Aljaafari 1,2( ) , Fedor Shmarov 1 , Edoardo Manino 1 , Rafael Menezes 1 , and Lucas C. Cordeiro 1 1 Department of Computer Science, The University of Manchester, Manchester M13 9PL, UK fatimahaljaafari@gmail.com 2 Department of Computer Networks & Communications, CCSIT, King Faisal University, Al Hassa 31982, SA Abstract. Combining different verification and testing techniques together could, at least in theory, achieve better results than each individual one on its own. - how much was read: only abstract or first pages read - source - record id: `ebf-4-2-black` - Efficient Certified Resolution Proof Checking. - what: . We present a novel propositional proof tracing format that arXiv:1610.06984v2 [cs.LO] 29 Oct 2016 eliminates complex processing, thus enabling efficient (formal) proof check- ing. The benefits of this format are demonstrated by implementing a proof checker in C, which outperforms a state-of-the-art checker by two orders of magnitude. - how much was read: only abstract or first pages read - source - record id: `efficient-certified-resolution-proof` - Efficient Controller Synthesis for Consumption Games with Multiple Resource Types. - what: . We introduce consumption games, a model for discrete interactive system with multiple resources that are consumed or reloaded independently. More precisely, a consumption game is a finite-state graph where each transition is labeled by a vector of resource updates, where every update is a non-positive number or ω. - how much was read: only abstract or first pages read - source - record id: `efficient-controller-synthesis-for` - Efficient Dynamic Shielding for Parametric Safety Specifications - what: . Shielding has emerged as a promising approach for ensuring safety of AI-controlled autonomous systems. The algorithmic goal is to compute a shield, which is a runtime safety enforcement tool that needs to monitor and intervene the AI controller’s actions if safety could be compromised otherwise. - how much was read: only abstract or first pages read - source - record id: `efficient-dynamic-shielding-for` - Efficient static analysis and verification of featured transition systems - what: A Featured Transition System (FTS) models the behaviour of all products of a Software Product Line (SPL) in a single compact structure, by associating action-labelled transitions with features that condition their presence in product behaviour. It may however be the case that the resulting featured transitions of an FTS cannot be executed in any product (so called dead transitions) or, on the contrary, can be executed in all products (so called false optional transitions). Moreover, an FTS may contain states from which a transition can be executed only in some products (so called hidden deadlock states). - how much was read: only abstract or first pages read - source - record id: `efficient-static-analysis-and` - Efficient Synthesis with Probabilistic Constraints. - what: . We consider the problem of synthesizing a program given a probabilistic specification of its desired behavior. Specifically, we study the recent paradigm of distribution-guided inductive synthesis (digits), which iteratively calls a synthesizer on finite sample sets from a given distribution. - how much was read: only abstract or first pages read - source - record id: `efficient-synthesis-with-probabilistic` - Efficient Verification of Imperative Programs Using Auto2. - what: . Auto2 is a recently introduced prover for the proof assistant arXiv:1610.06996v3 [cs.LO] 24 Feb 2018 Isabelle. It is designed to be both highly customizable from within Is- abelle, and also have a powerful proof search mechanism. - how much was read: only abstract or first pages read - source - record id: `efficient-verification-of-imperative` - Efficient Verified (UN)SAT Certificate Checking - what: SAT solvers decide the satisfiability of Boolean formulas in conjunctive normal form. They are commonly used for software and hardware verification. Modern SAT solvers are highly complex and optimized programs. - how much was read: only abstract or first pages read - source - record id: `efficient-verified-un-sat` - EMTST: Engineering the Meta-theory of Session Types. - what: Session types provide a principled programming discipline for structured interactions. They represent a wide spectrum of type-systems for concurrency. Their type safety is thus extremely important. - how much was read: only abstract or first pages read - source - record id: `emtst-engineering-the-meta` - Environmentally-Friendly GR(1) Synthesis. - what: . Many problems in reactive synthesis are stated using two formulas—an environment assumption and a system guarantee—and ask for an implementation that satisfies the guarantee in environments that satisfy their assumption. Reactive synthesis tools often produce strategies that formally satisfy such specifications by actively preventing an environment assumption from holding. - how much was read: only abstract or first pages read - source - record id: `environmentally-friendly-gr-1` - ESBMC v6.0: Verifying C Programs Using k-Induction and Invariant Inference - what: ESBMC v6.0: Verifying C Programs Using k -Induction and Invariant Inference (Competition Contribution) Mikhail R. Gadelha1(B) , Felipe Monteiro2 , Lucas Cordeiro3 , and Denis Nicole4 1 SIDIA Instituto de Ciência e Tecnologia, Manaus, Brazil m.gadelha@samsung.com 2 Federal University of Amazonas, Manaus, Brazil felipemonteiro@ufam.edu.br 3 University of Manchester, Manchester, UK lucas.cordeiro@manchester.ac.uk 4 University of Southampton, Southampton, UK dan@ecs.soton.ac.uk Abstract. ESBMC v6.0 employs a k-induction algorithm to both fal- sify and prove safety properties in C programs. - how much was read: only abstract or first pages read - source - record id: `esbmc-v6-0-verifying` - ESBMC v7.7: Efficient Concurrent Software Verification with Scheduling, Incremental SMT and Partial Order Reduction - (Competition Contribution). - what: ESBMC v7.7: Efficient Concurrent Software Verification with Scheduling, Incremental SMT and Partial Order Reduction (Competition Contribution) Tong Wu1(B) , Xianzhiyu Li1 , Edoardo Manino1 , Rafael Sá Menezes1,2 , Mikhail R. Gadelha3 , Shale Xiong5 , Norbert Tihanyi4 , Pavlos Petoumenos1 , and Lucas C. Cordeiro1,2 1 The University of Manchester, Manchester, UK tong.wu-11@postgrad.manchester.ac.uk 2 Federal University of Amazonas, Manaus, Brazil 3 Igalia, A Coruña, Spain 4 Eötvös Loránd University, Budapest, Hungary 5 Arm® , Cambridge, UK Abstract. - how much was read: only abstract or first pages read - source - record id: `esbmc-v7-7-efficient` - Event-Based Signal Temporal Logic Synthesis for Single and Multi-Robot Tasks - what: — We propose a new specification language and The authors of [13] create control barrier functions (CBFs) control synthesis technique for single and multi-robot high-level and provide feedback control laws for a robot navigating tasks; these tasks include timing constraints and reaction to in an environment with obstacles. These CBFs ensure that environmental events. Specifically, we define Event-based Signal Temporal Logic (STL) and use it to encode tasks that are reac- a system remains inside of a pre-defined set of allowable arXiv:2011.00370v2 [cs.RO] 18 Jan 2021 tive to uncontrolled environment events. - limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review. - how much was read: only abstract or first pages read - source - record id: `event-based-signal-temporal` - Evolutionary-Guided Synthesis of Verified Pareto-Optimal MDP Policies. - what: eprints@whiterose.ac.uk https://eprints.whiterose.ac.uk Universities of Leeds, Sheffield and York Deposited via The University of York. White Rose Research Online URL for this paper: https://eprints.whiterose.ac.uk/id/eprint/178508/ Version: Accepted Version Proceedings Paper: Gerasimou, Simos, Camara Moreno, Javier, Calinescu, Radu et al. (2022) Evolutionary- Guided Synthesis of Verified Pareto-Optimal MDP Policies. - how much was read: only abstract or first pages read - source - record id: `evolutionary-guided-synthesis-of` - Example Guided Synthesis of Linear Approximations for Neural Network Verification. - what: . Linear approximations of nonlinear functions have a wide range of applications such as rigorous global optimization and, recently, verification problems involving neural networks. In the latter case, a lin- ear approximation must be hand-crafted for the neural network’s activa- tion functions. - how much was read: only abstract or first pages read - source - record id: `example-guided-synthesis-of` - Expediting Neural Network Verification via Network Reduction. - what: —A wide range of verification methods have been such as branch-and-bound based (bab) or abstract refinement proposed to verify the safety properties of deep neural networks based methods. For example, branch-and-bound based meth- ensuring that the networks function correctly in critical applica- ods [6], [7], [10], [11] generate a set of sub-problems to tions. However, many well-known verification tools still struggle with complicated network architectures and large network sizes. - how much was read: only abstract or first pages read - source - record id: `expediting-neural-network-verification` - Explainable Human-Machine Teaming using Model Checking and Interpretable Machine Learning - what: —The human-machine teaming paradigm promotes verification, such as model checking, remains essential, yet tight teamwork between humans and autonomous machines not conclusive. Humans not only require knowing whether that collaborate in the same physical space. This paradigm is the teaming is going to succeed and certain dependability increasingly widespread in critical domains, such as healthcare and domestic assistance. - limits: Read from the saved open PDF at abstract/opening-section depth; quote is copied from extracted PDF text. - how much was read: only abstract or first pages read - source - record id: `explainable-human-machine-teaming` - Explainable Online Monitoring of Metric First-Order Temporal Logic. - what: . Metric first-order temporal logic (MFOTL) is an expressive formal- ism for specifying temporal and data-dependent constraints on streams of time- stamped, data-carrying events. It serves as the specification language of several runtime monitors. - how much was read: only abstract or first pages read - source - record id: `explainable-online-monitoring-of` - Explainable Online Monitoring of Metric Temporal Logic. - what: . Runtime monitors analyze system execution traces for policy compli- ance. Monitors for propositional specification languages, such as metric temporal logic (MTL), produce Boolean verdicts denoting whether the policy is satisfied or violated at a given point in the trace. - how much was read: only abstract or first pages read - source - record id: `explainable-online-monitoring-of-2` - Explainable Reactive Synthesis - what: . Reactive synthesis transforms a specification of a reactive system, given in a temporal logic, into an implementation. The main advantage of synthesis is that it is automatic. - how much was read: only abstract or first pages read - source - record id: `explainable-reactive-synthesis` - Exploiting Synchrony and Symmetry in Relational Verification. - what: . Relational safety specifications describe multiple runs of the same program or relate the behaviors of multiple programs. Approaches to automatic relational verification often compose the programs and ana- lyze the result for safety, but a naively composed program can lead to difficult verification problems. - how much was read: only abstract or first pages read - source - record id: `exploiting-synchrony-and-symmetry` - Exploring Formal Math on the Blockchain: An Explorer for Proofgold. - what: . Proofgold is a blockchain that supports formalized mathe- matics alongside standard cryptocurrency functionality. It incorporates logical constructs into the blockchain, including declarations of formal theories, definitions, propositions and proofs. - how much was read: only abstract or first pages read - source - record id: `exploring-formal-math-on` - Exploring Type-Level Bisimilarity towards More Expressive Multiparty Session Types - what: . A key open problem with multiparty session types (MPST) concerns their expressiveness: current MPST have inflexible choice, no existential quantification over participants, and limited parallel compo- sition. This precludes many real protocols to be represented by MPST. - how much was read: only abstract or first pages read - source - record id: `exploring-type-level-bisimilarity` - Exponential-Condition-Based Barrier Certificate Generation for Safety Verification of Hybrid Systems. - what: . A barrier certificate is an inductive invariant function which can be used for the safety verification of a hybrid system. Safety veri- fication based on barrier certificate has the benefit of avoiding explicit computation of the exact reachable set which is usually intractable for nonlinear hybrid systems. - how much was read: only abstract or first pages read - source - record id: `exponential-condition-based-barrier` - EXPRESSing Session Types - what: EXPRESSing Session Types Ilaria Castellani Ornela Dardha INRIA, Université Côte d’Azur University of Glasgow Luca Padovani Davide Sangiorgi University of Camerino University of Bologna, INRIA To celebrate the 30th edition of EXPRESS and the 20th edition of SOS we overview how session types can be expressed in a type theory for the standard π -calculus by means of a suitable encod- ing. The encoding allows one to reuse results about the π -calculus in the context of session-based communications, thus deepening the understanding of sessions and reducing redundancies in their theoretical foundations. Perhaps surprisingly, the encoding has practical implications as well, by enabling refined forms of deadlock analysis as well as allowing session type inference by means of a conventional type inference algorithm. - how much was read: only abstract or first pages read - source - record id: `expressing-session-types` - Extending DIVINE with Symbolic Verification Using SMT - (Competition Contribution). - what: Extending DIVINE with Symbolic Verification Using SMT (Competition Contribution) Henrich Lauko(B) , Vladimı́r Štill, Petr Ročkai, and Jiřı́ Barnat Faculty of Informatics, Masaryk University, Brno, Czech Republic xlauko@mail.muni.cz, divine@fi.muni.cz Abstract. DIVINE is an LLVM-based verification tool focusing on anal- ysis of real-world C and C++ programs. Such programs often interact with their environment, for example via inputs from users or network. - how much was read: only abstract or first pages read - source - record id: `extending-divine-with-symbolic` - Extending nuXmv with Timed Transition Systems and Timed Temporal Properties. - what: . NU X MV is a well-known symbolic model checker, which implements various state-of-the-art algorithms for the analysis of finite- and infinite-state tran- sition systems and temporal logics. In this paper, we present a new version that supports timed systems and logics over continuous super-dense semantics. - how much was read: only abstract or first pages read - source - record id: `extending-nuxmv-with-timed` - Extract, model, refine: improved modelling of program verification tools through data enrichment - what: In software engineering, models are used for many different things. In this paper, we focus on program verification, where we use models to reason about the correctness of systems. There are many different types of program verification techniques which provide different correctness guarantees. - how much was read: only abstract or first pages read - source - record id: `extract-model-refine-improved` - Extracting Linear Relations from Gr bner Bases for Formal Verification of And-Inverter Graphs. - what: . Formal verification techniques based on computer algebra have proven highly effective for circuit verification. The circuit, given as an and-inverter graph, is encoded using polynomials that automatically generate a Gröbner basis with respect to a lexicographic term order- ing. - how much was read: only abstract or first pages read - source - record id: `extracting-linear-relations-from` - Fairify: Fairness Verification of Neural Networks. - what: —Fairness of machine learning (ML) software has individuals who differ only in their protected attribute get become a major concern in the recent past. Although recent similar treatment [21, 23]. Galhotra et al. - how much was read: only abstract or first pages read - source - record id: `fairify-fairness-verification-of` - Fast and Guaranteed Safe Controller Synthesis for Nonlinear Vehicle Models. - what: . We address the problem of synthesizing a controller for non- linear systems with reach-avoid requirements. Our controller consists of a reference controller and a tracking controller which drives the actual trajectory to follow the reference trajectory. - how much was read: only abstract or first pages read - source - record id: `fast-and-guaranteed-safe` - Fast and Reliable Formal Verification of Smart Contracts with the Move Prover. - what: . The Move Prover (MVP) is a formal verifier for smart contracts written in the Move programming language. MVP has an expressive specifi- cation language, and is fast and reliable enough that it can be run routinely by developers and in integration testing. - how much was read: only abstract or first pages read - source - record id: `fast-and-reliable-formal` - Fast Decomposition of Temporal Logic Specifications for Heterogeneous Teams - what: in this area include coordination of very large groups of ho- mogeneous agents as a swarm (Haghighi, Sadraddini, and In this work, we focus on decomposing large multi-agent path Belta 2016; Chen, Moarref, and Kress-Gazit 2018) or us- planning problems with global temporal logic goals (common ing sampling (Kantaros and Zavlanos 2020). The current to all agents) into smaller sub-problems that can be solved and executed independently. Crucially, the sub-problems’ so- work is designed to enable planning for very large groups lutions must jointly satisfy the common global mission spec- of heterogeneous agents. - how much was read: only abstract or first pages read - source - record id: `fast-decomposition-of-temporal` - Fast Parametric Model Checking through Model Fragmentation - what: —Parametric model checking (PMC) computes alge- At design time, the PMC formulae can be evaluated very braic formulae that express key non-functional properties of a efficiently to compare architectures associated with different system (reliability, performance, etc.) as rational functions of the parameter values, e.g., in software product lines [5], [6]. At system and environment parameters. In software engineering, PMC formulae can be used during design, e.g., to analyse runtime, they can be used to efficiently re-verify the sat- the sensitivity of different system architectures to parametric isfaction of non-functional requirements after environmental variability, or to find optimal system configurations. - limits: Read from the saved open PDF at abstract/opening-section depth; quote is copied from extracted PDF text. - how much was read: only abstract or first pages read - source - record id: `fast-parametric-model-checking` - Fast Parametric Model Checking With Applications to Software Performability Analysis - what: —We present an efficient parametric model checking technique for the analysis of software performability, i.e., of the performance and dependability properties of software systems. The new parametric model checking (pMC) technique works by using a heuristic to automatically decompose a parametric discrete-time Markov chain (pDTMC) model of the software system under verification into fragments that can be analysed independently, yielding results that are then combined to establish the required software performability properties. Our fast parametric model checking (fPMC) technique enables the formal analysis of software systems modelled by pDTMCs that are too complex to be handled by existing pMC methods. - how much was read: only abstract or first pages read - source - record id: `fast-parametric-model-checking-2` - Fast, Verified Computation for HOL ITPs - what: We add an efficient function for computation to the kernels of higher-order logic interactive theorem provers. First, we develop and prove sound our approach for Candle. Candle is a port of HOL Light which has been proved sound with respect to the inference rules of its higher-order logic; we extend its implementation and soundness proof. - how much was read: only abstract or first pages read - source - record id: `fast-verified-computation-for` - Finding Bugs with Specification-Based Testing is Easy! - what: Automated specification-based testing has a long history with several notable tools having emerged. For example, QuickCheck for Haskell focuses on testing against user-provided properties. Others, such as JMLUnit, use specifications in the form of pre- and post-conditions to drive testing. - how much was read: only abstract or first pages read - source - record id: `finding-bugs-with-specification` - First Steps towards Deductive Verification of LLVM IR - what: . Over the last years, deductive program verifiers have sub- stantially improved, and their applicability on non-trivial applications has been demonstrated. However, a major bottleneck is that for every new programming language, a new deductive verifier has to be built. - how much was read: only abstract or first pages read - source - record id: `first-steps-towards-deductive` - FM-Weck: Containerized Execution of Formal-Methods Tools - what: . Software is ubiquitous in the digital world, and the correct function of software systems is critical for our society, industry, and infras- tructure. While testing and static analysis are long-established techniques in software-development processes, it became widely acknowledged only in the past two decades that formal methods are required for giving guarantees of functional correctness. - how much was read: only abstract or first pages read - source - record id: `fm-weck-containerized-execution` - Formal and Executable Semantics of the Ethereum Virtual Machine in Dafny. - what: The Ethereum protocol implements a replicated state machine. The network participants keep track of the system state by: 1) agreeing on the sequence of transactions to be processed and 2) computing the state transitions that correspond to the sequence of transactions. Ethereum transactions are programs, called smart contracts, and computing a state transition requires executing some code. - limits: Read from the saved open PDF; this record uses the abstract/opening section and preserves the exact extracted quote below. - how much was read: only abstract or first pages read - source - record id: `formal-and-executable-semantics` - Formal Autograding in a Classroom - what: . We report our experience in enhancing automated grading in an undergraduate programming course using formal verification. In our experiment, we deploy a program verifier to check the equivalence between student submissions and our reference solutions, alongside the existing testing-based grading infrastructure. - how much was read: only abstract or first pages read - source - record id: `formal-autograding-in-a` - Formal Controller Synthesis for Continuous-Space MDPs via Model-Free Reinforcement Learning. - what: . A novel reinforcement learning scheme to synthesize policies for continuous-space Markov decision processes (MDPs) is proposed. This scheme enables one to apply model-free, off-the-shelf reinforcement learn- ing algorithms for finite MDPs to compute optimal strategies for the corresponding continuous-space MDPs without explicitly constructing the finite-state abstraction. - how much was read: only abstract or first pages read - source - record id: `formal-controller-synthesis-for` - Formal Methods in Railways: A Systematic Mapping Study - what: Formal Methods in Railways: a Systematic Mapping Study ALESSIO FERRARI and MAURICE H. TER BEEK, Istituto di Scienza e Tecnologie dell’Informazione, Consiglio Nazionale delle Ricerche (ISTI–CNR), Italy arXiv:2107.05413v2 [cs.SE] 25 Feb 2022 Formal methods are mathematically based techniques for the rigorous development of software-intensive systems. The railway signaling domain is a field in which formal methods have traditionally been applied, with several success stories. - limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review. - how much was read: only abstract or first pages read - source - record id: `formal-methods-in-railways` - Formal proofs of transcendence for e and pi as an application of multivariate and symmetric polynomials. - what: conics, more precisely hyperbolas, which were already studied in antiquity, e.g. by Apollonius. According to [5], a good historical ac- We describe the formalisation in Coq of a proof that the num- count of this number should mention Apollonius (3rd century B.C.), bers e and π are transcendental. - how much was read: only abstract or first pages read - source - record id: `formal-proofs-of-transcendence` - Formal Reasoning About the Security of Amazon Web Services. - what: . We report on the development and use of formal verifica- tion tools within Amazon Web Services (AWS) to increase the secu- rity assurance of its cloud infrastructure and to help customers secure themselves. We also discuss some remaining challenges that could inspire future research in the community. - how much was read: only abstract or first pages read - source - record id: `formal-reasoning-about-the` - Formal Verification of Coalescing Graph-Coloring Register Allocation - what: . Iterated Register Coalescing (IRC) is a widely used heuristic for performing register allocation via graph coloring. Many implementa- tions in existing compilers follow (more or less faithfully) the imperative algorithm published in 1996. - how much was read: only abstract or first pages read - source - record id: `formal-verification-of-coalescing` - Formal verification of control systems' properties with theorem proving - what: This paper presents the deductive formal verification of high-level properties of control systems with theorem proving, using the Why3 tool. Properties that can be verified with this approach include stability, feedback gain, and robustness, among others. For the systems, modelled in Simulink, we propose three main steps to achieve the verification: specifying the properties of interest over the signals within the model using Simulink blocks, an automatic translation of the model into Why3, and the automatic verification of the properties with theorem provers in Why3. - how much was read: only abstract or first pages read - source - record id: `formal-verification-of-control` - Formal verification of digital circuits using symbolic ternary system models - what: Ternary system modeling involves extending the traditional set of binary values (0,1} with a third value X indicating an unknown or indeterminate condition. By making this extension, we can model a wider range of circuit phenomena. We can also efficiently verify sequential circuits in which the effect of a given operation depends on only a subset of the total system state. - how much was read: only abstract or first pages read - source - record id: `formal-verification-of-digital` - Formal Verification of Hardware Synthesis. - what: . We report on the implementation of a certified compiler for a high-level hardware description language (HDL) called Fe-Si (FEath- erweight SynthesIs). Fe-Si is a simplified version of Bluespec, an HDL based on a notion of guarded atomic actions. - how much was read: only abstract or first pages read - source - record id: `formal-verification-of-hardware` - Formal Verification of Neural Certificates Done Dynamically. - what: . Neural certificates have emerged as a powerful tool in cyber- physical systems control, providing witnesses of correctness. These certifi- cates, such as barrier functions, often learned alongside control policies, once verified, serve as mathematical proofs of system safety. - how much was read: only abstract or first pages read - source - record id: `formal-verification-of-neural` - Formal Verification of Parallel Prefix Sum - what: . With the advent of dedicated hardware for multicore pro- gramming, parallel algorithms have become omnipresent. For example, various algorithms have been proposed for the parallel computation of a prefix sum in the literature. - how much was read: only abstract or first pages read - source - record id: `formal-verification-of-parallel` - Formal Verification With Confidence Intervals to Establish Quality of Service Properties of Software Systems - what: —Formal verification is used to establish the compli- s, s1 , s2 , . states of a Markov chain ance of software and hardware systems with important classes of S set of states of a Markov chain requirements. System compliance with functional requirements n number of states of a Markov chain is frequently analysed using techniques such as model checking, and theorem proving. - how much was read: only abstract or first pages read - source - record id: `formal-verification-with-confidence` - Formalising perfectoid spaces. - what: Perfectoid spaces are sophisticated objects in arithmetic geometry introduced by Peter Scholze in arXiv:1910.12320v2 [cs.LO] 28 May 2020 2012. We formalised enough definitions and theorems in topology, algebra and geometry to define perfectoid spaces in the Lean theorem prover. This experiment confirms that a proof assistant can handle complexity in that direction, which is rather different from formalising a long proof about simple objects. - how much was read: only abstract or first pages read - source - record id: `formalising-perfectoid-spaces` - Formalization of Orthogonal Complements of Normed Spaces. - what: FORMALIZED MATHEMATICS Vol. 32, No. 1, pp. - how much was read: only abstract or first pages read - source - record id: `formalization-of-orthogonal-complements` - Formalization of the Fundamental Group in Untyped Set Theory Using Auto2. - what: . We present a new framework for formalizing mathematics in untyped set theory using auto2. Using this framework, we formalize arXiv:1707.04757v1 [cs.LO] 15 Jul 2017 in Isabelle/FOL the entire chain of development from the axioms of set theory to the definition of the fundamental group for an arbitrary topo- logical space. - how much was read: only abstract or first pages read - source - record id: `formalization-of-the-fundamental` - Formalizing Memory Accesses and Interrupts - what: Formalizing Memory Accesses and Interrupts Reto Achermann Lukas Humbel David Cock Timothy Roscoe Systems Group, Department of Computer Science, ETH Zurich The hardware/software boundary in modern heterogeneous multicore computers is increasingly com- plex, and diverse across different platforms. A single memory access by a core or DMA engine tra- verses multiple hardware translation and caching steps, and the destination memory cell or register often appears at different physical addresses for different cores. Interrupts pass through a complex topology of interrupt controllers and remappers before delivery to one or more cores, each with spe- cific constraints on their configurations. - how much was read: only abstract or first pages read - source - record id: `formalizing-memory-accesses-and` - Formalizing Polynomial Laws and the Universal Divided Power Algebra. - what: Another example is that of a ring 𝑅 given by generators The goal of this paper is to present an ongoing formalization, (𝑥 1, . . . - how much was read: only abstract or first pages read - source - record id: `formalizing-polynomial-laws-and` - Formalizing Size-Optimal Sorting Networks: Extracting a Certified Proof Checker. - what: . Since the proof of the four color theorem in 1976, computer- generated proofs have become a reality in mathematics and computer science. During the last decade, we have seen formal proofs using verified proof assistants being used to verify the validity of such proofs. - how much was read: only abstract or first pages read - source - record id: `formalizing-size-optimal-sorting` - Formalizing the Edmonds-Karp Algorithm - what: . We present a formalization of the Ford-Fulkerson method for computing the maximum flow in a network. Our formal proof closely follows a standard textbook proof, and is accessible even without be- ing an expert in Isabelle/HOL — the interactive theorem prover used for the formalization. - how much was read: only abstract or first pages read - source - record id: `formalizing-the-edmonds-karp` - Formalizing the metatheory of logical calculi and automatic provers in Isabelle/HOL (invited talk). - what: Paradoxically, the automated reasoning community has IsaFoL (Isabelle Formalization of Logic) is an undertaking largely stood on the sidelines of these developments. Like the that aims at developing formal theories about logics, proof shoemaker’s children who go barefoot, we reflexively turn systems, and automatic provers, using Isabelle/HOL. At the to “pen and paper”—by which we usually mean LATEX—to de- heart of the project is the conviction that proof assistants fine our logics, specify our proof systems, and establish their have become mature enough to actually help researchers soundness and completeness. - how much was read: only abstract or first pages read - source - record id: `formalizing-the-metatheory-of` - Formalizing the ring of Witt vectors. - what: first horizon of undergraduate mathematics, but the sea be- The ring of Witt vectors W𝑅 over a base ring 𝑅 is an impor- tween us and the second horizon—graduate mathematics— is vast, little explored, and filled with adventures. arXiv:2010.02595v2 [cs.LO] 23 Dec 2020 tant tool in algebraic number theory and lies at the founda- tions of modern 𝑝-adic Hodge theory. W𝑅 has the interest- As a new expedition into this sea, we have constructed ing property that it constructs a ring of characteristic 0 out the ring of 𝑝-adic Witt vectors and related operations in the of a ring of characteristic 𝑝 > 1, and it can be used more Lean proof assistant and verified some of their fundamental specifically to construct from a finite field containing Z/𝑝Z properties. - how much was read: only abstract or first pages read - source - record id: `formalizing-the-ring-of` - Formally Validating a Practical Verification Condition Generator. - what: . A program verifier produces reliable results only if both the logic used to justify the program’s correctness is sound, and the imple- mentation of the program verifier is itself correct. Whereas it is common to formally prove soundness of the logic, the implementation of a veri- fier typically remains unverified. - how much was read: only abstract or first pages read - source - record id: `formally-validating-a-practical` - Formally Verified EVM Block-Optimizations - what: . The efficiency and the security of smart contracts are their two fundamental properties, but might come at odds: the use of optimiz- ers to enhance efficiency may introduce bugs and compromise security. Our focus is on EVM (Ethereum Virtual Machine) block-optimizations, which enhance the efficiency of jump-free blocks of opcodes by eliminat- ing, reordering and even changing the original opcodes. - how much was read: only abstract or first pages read - source - record id: `formally-verified-evm-block` - Formally verified superblock scheduling. - what: Conference on Certified Programs and Proofs (CPP ’22), January 17– On in-order processors, without dynamic instruction sched- 18, 2022, Philadelphia, PA, USA. ACM, New York, NY, USA, 15 pages. https://doi.org/10.1145/3497775.3503679 uling, program running times may be significantly reduced by compile-time instruction scheduling. - how much was read: only abstract or first pages read - source - record id: `formally-verified-superblock-scheduling` - Formally Verified Trades in Financial Markets - what: . We introduce a formal framework for analyzing trades in fi- nancial markets. These days, all big exchanges use computer algorithms to match buy and sell requests and these algorithms must abide by cer- tain regulatory guidelines. - how much was read: only abstract or first pages read - source - record id: `formally-verified-trades-in` - Formally Verifying a Transformation from MLTL Formulas to Regular Expressions. - what: . Mission-time Linear Temporal Logic (MLTL), a widely used subset of popular specification logics like STL and MTL, is often used to model and verify real world systems in safety-critical contexts. As the results of formal verification are only as trustworthy as their input specifications, the WEST tool was created to facilitate writing MLTL specifications. - how much was read: only abstract or first pages read - source - record id: `formally-verifying-a-transformation` - Formally Verifying an Efficient Sorter. - what: . In this experience report, we present the complete formal verification of a Java implementation of inplace superscalar sample sort (ips4 o) using the KeY program verification system. As ips4 o is one of the fastest general purpose sorting algorithms, this is an important step towards a collection of basic toolbox components that are both provably correct and highly efficient. - how much was read: only abstract or first pages read - source - record id: `formally-verifying-an-efficient` - Formula Normalizations in Verification. - what: . We apply and evaluate polynomial-time algorithms to com- pute two different normal forms of propositional formulas arising in veri- fication. One of the normal form algorithms is presented for the first time. - how much was read: only abstract or first pages read - source - record id: `formula-normalizations-in-verification` - From Non-preemptive to Preemptive Scheduling Using Synchronization Synthesis. - what: . We present a computer-aided programming approach to con- currency. The approach allows programmers to program assuming a friendly, non-preemptive scheduler, and our synthesis procedure inserts synchronization to ensure that the final program works even with a pre- emptive scheduler. - how much was read: only abstract or first pages read - source - record id: `from-non-preemptive-to` - Full LTL Synthesis over Infinite-State Arenas. - what: . Recently, interest has increased in applying reactive synthe- sis to richer-than-Boolean domains. A major (undecidable) challenge in this area is to establish when certain repeating behaviour terminates in a desired state when the number of steps is unbounded. - how much was read: only abstract or first pages read - source - record id: `full-ltl-synthesis-over` - Full-program induction: verifying array programs sans loop invariants - what: Arrays are commonly used in a variety of software to store and process data in loops. Automati- cally proving safety properties of such programs that manipulate arrays is challenging. We present a novel verification technique, called full-program induction, for proving (a sub-class of) quanti- fied as well as quantifier-free properties of programs manipulating arrays of parametric size N . - how much was read: only abstract or first pages read - source - record id: `full-program-induction-verifying` - Fully Generalized Reactivity(1) Synthesis. - what: . Generalized Reactivity(1) (GR(1)) synthesis is a reactive synthesis approach in which the specification is split into two parts: a symbolic game graph, describing the safe transitions of a system, a live- ness specification in a subset of Linear Temporal Logic (LTL) on top of it. Many specifications can naturally be written in this restricted form, and the restriction gives rise to a scalable synthesis procedure – the reasons for the high popularity of the approach. - how much was read: only abstract or first pages read - source - record id: `fully-generalized-reactivity-1` - GACAL: Conjecture-Based Verification - (Competition Contribution). - what: GACAL: Conjecture-based Verification (Competition Contribution) TACAS Artifact Benjamin Quiring ⋆ and Panagiotis Manolios SV-COMP 2020 Northeastern University, Boston MA, USA Accepted Abstract. GACAL verifies C programs by searching over the space of possible invariants, using traces of the input program to identify poten- tial invariants. GACAL uses the ACL2s theorem prover to verify these potential invariants, using an interface provided by ACL2s for connecting with external tools. - how much was read: only abstract or first pages read - source - record id: `gacal-conjecture-based-verification` - Generalized Security-Preserving Refinement for Concurrent Systems - what: CCS Concepts Ensuring compliance with Information Flow Security (IFS) is known • Security and privacy → Information flow control; Logic and to be challenging, especially for concurrent systems with large code- verification. bases such as multicore operating system (OS) kernels. Refinement, which verifies that an implementation preserves certain proper- - how much was read: only abstract or first pages read - source - record id: `generalized-security-preserving-refinement` - Generating Extended Resolution Proofs with a BDD-Based SAT Solver - what: . In 2006, Biere, Jussila, and Sinz made the key observation that the underlying logic behind algorithms for constructing Reduced, Ordered Binary Decision Diagrams (BDDs) can be encoded as steps in a proof in the extended resolution logical framework. Through this, a BDD-based Boolean satisfiability (SAT) solver can generate a checkable proof of unsatisfiability. - how much was read: only abstract or first pages read - source - record id: `generating-extended-resolution-proofs` - Generation of Library Models for Verification of Android Applications - what: Stub Android applications are difficult to verify and test since they have many external dependencies. To overcome this problem, environ- ment generation can be used to create a model of the environment to simulate the behavior of these external dependencies. Creat- Driver Unit Stub ing this environment model manually is a tedious process and although there are many techniques available to generate models, the key lies in identifying how these techniques can be applied to Stub a specific domain. - how much was read: only abstract or first pages read - source - record id: `generation-of-library-models` - Giallar: push-button verification for the qiskit Quantum compiler. - what: verification imposes only a modest overhead to compilation This paper presents Giallar, a fully-automated verification performance. toolkit for quantum compilers. Giallar requires no manual CCS Concepts: • Theory of computation → Quantum specifications, invariants, or proofs, and can automatically information theory; Program verification. - how much was read: only abstract or first pages read - source - record id: `giallar-push-button-verification` - Global Progress in Dynamically Interleaved Multiparty Sessions - what: . A multiparty session forms a unit of structured interactions among many participants which follow a prescribed scenario specified as a global type signature. This paper develops, besides a more traditional communication type system, a novel static interaction type system for global progress in dynamically interleaved multiparty sessions. - how much was read: only abstract or first pages read - source - record id: `global-progress-in-dynamically` - Goblint: Abstract Interpretation for Memory Safety and Termination - (Competition Contribution). - what: Goblint: Abstract Interpretation for Memory Safety and Termination (Competition Contribution) Simmo Saan1(B) ⋆, Julian Erhard2,3 , Michael Schwarz2 , Stanimir Bozhilov2 , Karoliine Holter1 , Sarah Tilscher2,3 , Vesal Vojdani1 , and Helmut Seidl2 1 University of Tartu, Tartu, Estonia {simmo.saan,karoliine.holter,vesal.vojdani}@ut.ee 2 Technische Universität München, Garching, Germany {julian.erhard,m.schwarz,stanimir.bozhilov, sarah.tilscher,helmut.seidl}@tum.de 3 Ludwig-Maximilians-Universität München, Munich, Germany Abstract. Goblint is an abstract interpreter of C programs, focusing on the analysis of multi-threaded code. It is equipped with a variety of abstract domains, as well as analyses which allow it to reason about an array of program properties in a highly configurable manner. - how much was read: only abstract or first pages read - source - record id: `goblint-abstract-interpretation-for` - Gobra: Modular Specification and Verification of Go Programs. - what: . Go is an increasingly-popular systems programming lan- guage targeting, especially, concurrent and distributed systems. Go dif- ferentiates itself from other imperative languages by offering structural subtyping and lightweight concurrency through goroutines with message- passing communication. - how much was read: only abstract or first pages read - source - record id: `gobra-modular-specification-and` - Good-Enough Synthesis. - what: . We introduce and study good-enough synthesis (ge- synthesis) – a variant of synthesis in which the system is required to sat- isfy a given specification ψ only when it interacts with an environments for which a satisfying interaction exists. Formally, an input sequence x is hopeful if there exists some output sequence y such that the induced computation x⊗y satisfies ψ, and a system ge-realizes ψ if it generates a computation that satisfies ψ on all hopeful input sequences. - how much was read: only abstract or first pages read - source - record id: `good-enough-synthesis` - Graph Temporal Logic Inference for Classification and Identification - what: Inferring spatial-temporal properties from data is important for many complex sys- tems, such as additive manufacturing systems, swarm robotic systems and biological networks. Such systems can often be modeled as a labeled graph where labels on the nodes and edges represent relevant measurements such as temperatures and distances. We introduce graph temporal logic (GTL) which can express properties such as “when- ever a node’s label is above 10, for the next 3 time units there are always at least two neighboring nodes with an edge label of at most 2 where the node labels are above 5”. - how much was read: only abstract or first pages read - source - record id: `graph-temporal-logic-inference` - Graves-CPA: A Graph-Attention Verifier Selector (Competition Contribution). - what: . Graves-CPA is a verification tool which uses algorithm se- lection to decide an ordering of underlying verifiers to most effectively verify a given program. Graves-CPA represents programs using an amalgam of traditional program graph representations and uses state- of-the-art graph neural network techniques to dynamically decide how to run a set of verification techniques. - how much was read: only abstract or first pages read - source - record id: `graves-cpa-a-graph` - Guessing Winning Policies in LTL Synthesis by Semantic Learning. - what: . We provide a learning-based technique for guessing a win- ning strategy in a parity game originating from an LTL synthesis prob- lem. A cheaply obtained guess can be useful in several applications. - how much was read: only abstract or first pages read - source - record id: `guessing-winning-policies-in` - High Order Control Lyapunov-Barrier Functions for Temporal Logic Specifications. - what: High Order Control Lyapunov-Barrier Functions for Temporal Logic Specifications Wei Xiao, Calin A. Belta and Christos G. Cassandras Abstract— Recent work has shown that stabilizing an affine that can accommodate state constraints with high relative control system to a desired state while optimizing a quadratic degree and does not require linearization. - how much was read: only abstract or first pages read - source - record id: `high-order-control-lyapunov` - Higher-Order Processes, Functions, and Sessions: A Monadic Integration - what: . In prior research we have developed a Curry-Howard inter- pretation of linear sequent calculus as session-typed processes. In this paper we uniformly integrate this computational interpretation in a func- tional language via a linear contextual monad that isolates session-based concurrency. - how much was read: only abstract or first pages read - source - record id: `higher-order-processes-functions` - HOL with Definitions: Semantics, Soundness, and a Verified Implementation - what: . We present a mechanised semantics and soundness proof for the HOL Light kernel including its definitional principles, extending Har- rison’s verification of the kernel without definitions. Soundness of the logic extends to soundness of a theorem prover, because we also show that a synthesised implementation of the kernel in CakeML refines the inference system. - how much was read: only abstract or first pages read - source - record id: `hol-with-definitions-semantics` - How Stop and Wait Protocols Can Fail over the Internet - what: . The correct operation of computer protocols is essential to the smooth operation of the distributed systems that facilitate our global economy. Formal techniques provide our best chance to ensure that pro- tocol designs are free from errors. - how much was read: only abstract or first pages read - source - record id: `how-stop-and-wait` - How to Handle Assumptions in Synthesis - what: How to Handle Assumptions in Synthesis∗ Roderick Bloem1 Rüdiger Ehlers2,3 Swen Jacobs1 Robert Könighofer1 1 Graz University of Technology 2 University of Bremen 3 DFKI GmbH Graz, Austria Bremen, Germany Bremen, Germany The increased interest in reactive synthesis over the last decade has led to many improved solutions but also to many new questions. In this paper, we discuss the question of how to deal with assump- tions on environment behavior. We present four goals that we think should be met and review several different possibilities that have been proposed. - how much was read: only abstract or first pages read - source - record id: `how-to-handle-assumptions` - Hybrid Controller Synthesis for Nonlinear Systems Subject to Reach-Avoid Constraints. - what: . There is a pressing need for learning controllers to endow systems with properties of safety and goal-reaching, which are crucial for many safety-critical systems. Reinforcement learning (RL) has been deployed successfully to synthesize controllers from user-defined reward functions encoding desired system requirements. - how much was read: only abstract or first pages read - source - record id: `hybrid-controller-synthesis-for` - Icing: Supporting Fast-Math Style Optimizations in a Verified Compiler - what: . Verified compilers like CompCert and CakeML offer increas- ingly sophisticated optimizations. However, their deterministic source semantics and strict IEEE 754 compliance prevent the verification of “fast-math” style floating-point optimizations. - how much was read: only abstract or first pages read - source - record id: `icing-supporting-fast-math` - IMITATOR 3: Synthesis of Timing Parameters Beyond Decidability. - what: . Real-time systems are notoriously hard to verify due to non- determinism, concurrency and timing constraints. When timing con- stants are uncertain (in early the design phase, or due to slight vari- ations of the timing bounds), timed model checking techniques may not be satisfactory. - how much was read: only abstract or first pages read - source - record id: `imitator-3-synthesis-of` - Improved Geometric Path Enumeration for Verifying ReLU Neural Networks. - what: . Neural networks provide quick approximations to complex functions, and have been increasingly used in perception as well as con- trol tasks. For use in mission-critical and safety-critical applications, how- ever, it is important to be able to analyze what a neural network can and cannot do. - how much was read: only abstract or first pages read - source - record id: `improved-geometric-path-enumeration` - Improvements in Software Verification and Witness Validation: SV-COMP 2025. - what: . The 14th edition of the Competition on Software Verification (SV-COMP 2025) evaluated 62 verification tools and 18 witness validation tools, making it the largest comparison of its kind so far. Out of these, 35 verification and 13 validation tools participated with an active sup- port of teams led by 33 different representatives from 12 countries. - how much was read: only abstract or first pages read - source - record id: `improvements-in-software-verification` - Improving Neural Network Verification through Spurious Region Guided Refinement. - what: . We propose a spurious region guided refinement approach for robust- ness verification of deep neural networks. Our method starts with applying the DeepPoly abstract domain to analyze the network. - how much was read: only abstract or first pages read - source - record id: `improving-neural-network-verification` - Incremental temporal logic synthesis of control policies for robots interacting with dynamic agents - what: Incremental Temporal Logic Synthesis of Control Policies for Robots Interacting with Dynamic Agents Tichakorn Wongpiromsarn, Alphan Ulusoy, Calin Belta, Emilio Frazzoli and Daniela Rus Abstract— We consider the synthesis of control policies from computes a sequence of control policies, taking into account temporal logic specifications for robots that interact with only a small subset of the environment agents initially and multiple dynamic environment agents. Each environment agent successively adds more agents to the synthesis procedure in is modeled by a Markov chain whereas the robot is modeled by a finite transition system (in the deterministic case) or Markov each iteration until the computational resource constraints decision process (in the stochastic case). Existing results in are exceeded. - limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review. - how much was read: only abstract or first pages read - source - record id: `incremental-temporal-logic-synthesis` - Integrated Environment for Diagnosing Verification Errors. - what: . A failed attempt to verify a program’s correctness can re- sult in reports of genuine errors, spurious warnings, and timeouts. The main challenge in debugging a verification failure is to determine whether the complaint is genuine or spurious, and to obtain enough information about the failed verification attempt to debug the error. - how much was read: only abstract or first pages read - source - record id: `integrated-environment-for-diagnosing` - Integrating Formal Schedulability Analysis into a Verified OS Kernel. - what: . Formal verification of real-time systems is attractive because these systems often perform critical operations. Unlike non real-time sys- tems, latency and response time guarantees are of critical importance in this setting, as much as functional correctness. - how much was read: only abstract or first pages read - source - record id: `integrating-formal-schedulability-analysis` - Interval change-point detection for runtime probabilistic model checking - what: ACM Reference Format: Recent probabilistic model checking techniques can verify relia- Xingyu Zhao, Radu Calinescu, Simos Gerasimou, Valentin Robu, and David Flynn. Interval Change-Point Detection for Runtime Probabilistic bility and performance properties of software systems affected by Model Checking. In 35th IEEE/ACM International Conference on Automated parametric uncertainty. - how much was read: only abstract or first pages read - source - record id: `interval-change-point-detection` - IsaRare: Automatic Verification of SMT Rewrites in Isabelle/HOL. - what: . Satisfiability modulo theories (SMT) solvers are widely used to ensure the correctness of safety- and security-critical applications. Therefore, being able to trust a solver’s results is crucial. - how much was read: only abstract or first pages read - source - record id: `isarare-automatic-verification-of` - Issy: A Comprehensive Tool for Specification and Synthesis of Infinite-State Reactive Systems. - what: . The synthesis of infinite-state reactive systems from tempo- ral logic specifications or infinite-state games has attracted significant attention in recent years, leading to the emergence of novel solving tech- niques. Most approaches are accompanied by an implementation show- casing their viability on an increasingly larger collection of benchmarks. - how much was read: only abstract or first pages read - source - record id: `issy-a-comprehensive-tool` - JavaBIP meets VerCors: Towards the Safety of Concurrent Software Systems in Java - what: . We present “Verified JavaBIP”, a tool set for the verification of JavaBIP models. A JavaBIP model is a Java program where classes are considered as components, their behaviour described by finite state machine and synchronization annotations. - how much was read: only abstract or first pages read - source - record id: `javabip-meets-vercors-towards` - Kmclib: Automated Inference and Verification of Session Types from OCaml Programs. - what: . Theories and tools based on multiparty session types offer correctness guarantees for concurrent programs that communicate using message-passing. These guarantees usually come at the cost of an intrin- sically top-down approach, which requires the communication behaviour of the entire program to be specified as a global type. - how much was read: only abstract or first pages read - source - record id: `kmclib-automated-inference-and` - Korn - Software Verification with Horn Clauses (Competition Contribution). - what: . Korn is a software verifier that infers correctness certificates and violation witnesses sutomatically using state-of-the-art Horn-clause solvers, such as Z3 and Eldarica. The solvers are used in a portfolio together with cheap random sampling where the latter can be very effec- tive at finding counterexamples. - how much was read: only abstract or first pages read - source - record id: `korn-software-verification-with` - Lazy Abstraction-Based Controller Synthesis - what: controller can be refined to a controller for the original continuous- time system while guaranteeing its time-sampled behavior satisfies the tempo- ral specification. Since its - how much was read: only abstract or first pages read - source - record id: `lazy-abstraction-based-controller` - Lazy Code Transformations in a Formally Verified Compiler - what: impact on those processors than on complex ones that reorder Translation validation verifies the results of an untrusted translator— instructions and perform speculative execution. called an oracle—at the compiler’s runtime using a validator. This Typically, partial redundancy elimination (PRE) is a code motion- approach enables validating intricate optimizations without having based optimization that can suppress duplicated computations even to prove them directly. - how much was read: only abstract or first pages read - source - record id: `lazy-code-transformations-in` - lean-smt: An SMT Tactic for Discharging Proof Goals in Lean. - what: . Lean is an increasingly popular proof assistant based on dependent type theory. Despite its success, it still lacks important automation features present in more seasoned proof assistants, such as the Sledgehammer tactic in Isabelle/HOL. - how much was read: only abstract or first pages read - source - record id: `lean-smt-an-smt` - Leapfrog: certified equivalence for protocol parsers. - what: June 13–17, 2022, San Diego, CA, USA. ACM, New York, NY, USA, We present Leapfrog, a Coq-based framework for verifying 21 pages. https://doi.org/10.1145/3519939.3523715 equivalence of network protocol parsers. - how much was read: only abstract or first pages read - source - record id: `leapfrog-certified-equivalence-for` - Learning Assumptions for Compositional Verification of Timed Automata. - what: . Compositional verification, such as the technique of assume- guarantee reasoning (AGR), is to verify a property of a system from the properties of its components. It is essential to address the state explosion problem associated with model checking. - how much was read: only abstract or first pages read - source - record id: `learning-assumptions-for-compositional` - Learning Probabilistic Termination Proofs. - what: . We present the first machine learning approach to the ter- mination analysis of probabilistic programs. Ranking supermartingales (RSMs) prove that probabilistic programs halt, in expectation, within a finite number of steps. - how much was read: only abstract or first pages read - source - record id: `learning-probabilistic-termination-proofs` - LightDP: towards automating differential privacy proofs - what: of attackers to infer individual-level sensitive information (Dwork The growing popularity and adoption of differential privacy in et al. 2006b; Kifer and Machanavajjhala 2014). academic and industrial settings has resulted in the development Since 2006, differential privacy has seen explosive growth in of increasingly sophisticated algorithms for releasing information many areas, including theoretical computer science, databases, ma- while preserving privacy. - how much was read: only abstract or first pages read - source - record id: `lightdp-towards-automating-differential` - Lightweight Statistical Model Checking in Nondeterministic Continuous Time - what: Lightweight scheduler sampling brings statistical model checking to nondeterministic formalisms with undiscounted properties, in constant memory. Its direct application to continuous-time models is rendered ineffective by their dense concrete state spaces and the need to consider continuous input for optimal decisions. In this paper we describe the challenges and state of the art in applying lightweight scheduler sam- pling to three continuous-time formalisms: After a review of recent work on exploiting discrete abstractions for probabilistic timed automata, we discuss scheduler sampling for Markov automata and apply it on two case studies. - limits: Read from the saved open PDF at abstract/opening-section depth; quote is copied from extracted PDF text. - how much was read: only abstract or first pages read - source - record id: `lightweight-statistical-model-checking` - Linear Logical Relations for Session-Based Concurrency - what: . In prior work we proposed an interpretation of intuitionistic linear logic propositions as session types for concurrent processes. The type system ob- tained from the interpretation ensures fundamental properties of session-based typed disciplines—most notably, type preservation, session fidelity, and global progress. - how much was read: only abstract or first pages read - source - record id: `linear-logical-relations-for` - Linear Temporal Logic Satisfaction in Adversarial Environments Using Secure Control Barrier Certificates. - what: . This paper studies the satisfaction of a class of temporal prop- erties for cyber-physical systems (CPSs) over a finite-time horizon in the presence of an adversary, in an environment described by discrete-time dy- namics. The temporal logic specification is given in sa f e − LTL F , a frag- ment of linear temporal logic over traces of finite length. - how much was read: only abstract or first pages read - source - record id: `linear-temporal-logic-satisfaction` - Linear type theory for asynchronous session types - what: Session types support a type-theoretic formulation of structured patterns of communication, so that the communication behaviour of agents in a distributed system can be verified by static typechecking. Applications include network protocols, business processes and operating system services. In this paper we define a multithreaded functional language with session types, which unifies, simplifies and extends previous work. - how much was read: only abstract or first pages read - source - record id: `linear-type-theory-for` - Linearly Refined Session Types - what: Linearly Refined Session Types Pedro Baltazar Dimitris Mostrous Vasco T. Vasconcelos University of Lisbon, Faculty of Sciences and LaSIGE Lisbon, Portugal {pbtz,dimitris,vv}@di.fc.ul.pt Session types capture precise protocol structure in concurrent programming, but do not specify prop- erties of the exchanged values beyond their basic type. Refinement types are a form of dependent types that can address this limitation, combining types with logical formulae that may refer to pro- gram values and can constrain types using arbitrary predicates. - how much was read: only abstract or first pages read - source - record id: `linearly-refined-session-types` - LinSyn: Synthesizing Tight Linear Bounds for Arbitrary Neural Network Activation Functions. - what: . The most scalable approaches to certifying neural network robustness depend on computing sound linear lower and upper bounds for the network’s activation functions. Current approaches are limited in that the linear bounds must be handcrafted by an expert, and can be sub-optimal, especially when the network’s architecture composes op- erations using, for example, multiplication such as in LSTMs and the recently popular Swish activation. - how much was read: only abstract or first pages read - source - record id: `linsyn-synthesizing-tight-linear` - LLMC: Verifying High-Performance Software. - what: . Multi-threaded unit tests for high-performance thread-safe data structures typically do not test all behaviour, because only a single scheduling of threads is witnessed per invocation of the unit tests. Model checking such unit tests allows to verify all interleavings of threads. - how much was read: only abstract or first pages read - source - record id: `llmc-verifying-high-performance` - Local Type Inference for Context-Free Session Types - what: Local Type Inference for Context-Free Session Types Bernardo Almeida Andreia Mordido Vasco T. Vasconcelos LASIGE, Faculty of Sciences, University of Lisbon, Portugal {bpdalmeida,afmordido,vmvasconcelos}@ciencias.ulisboa.pt We address the problem of local type inference for a language based on System F with context- free session types. We present an algorithm that leverages the bidirectional type checking approach to propagate type information, enabling first class polymorphism while addressing the intricacies brought about by the sequential composition operator and type equivalence. - how much was read: only abstract or first pages read - source - record id: `local-type-inference-for` - Local Verification of Global Invariants in Concurrent Programs. - what: . We describe a practical method for reasoning about realistic concurrent programs. Our method allows global two-state invariants that restrict update of shared state. - how much was read: only abstract or first pages read - source - record id: `local-verification-of-global` - Low-Effort Specification Debugging and Analysis - what: Low-Effort Specification Debugging and Analysis Rüdiger Ehlers Vasumathi Raman University of Bremen & DFKI GmbH California Institute of Technology Bremen, Germany Pasadena, CA, United States Reactive synthesis deals with the automated construction of implementations of reactive systems from their specifications. To make the approach feasible in practice, systems engineers need effec- tive and efficient means of debugging these specifications. In this paper, we provide techniques for report-based specification debugging, wherein salient properties of a specification are analyzed, and the result presented to the user in the form of a report. - how much was read: only abstract or first pages read - source - record id: `low-effort-specification-debugging` - LTSmin: High-Performance Language-Independent Model Checking - what: . In recent years, the LTSmin model checker has been extended with support for several new modelling languages, including probabilis- tic (Mapa) and timed systems (Uppaal). Also, connecting additional language front-ends or ad-hoc state-space generators to LTSmin was sim- plified using custom C-code. - limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review. - how much was read: only abstract or first pages read - source - record id: `ltsmin-high-performance-language` - Manifestly Phased Communication via Shared Session Types - what: . Session types denote message protocols between concurrent processes, allow- ing a type-safe expression of inter-process communication. Although previous work demon- strate a well-defined notion of subtyping where processes have different perceptions of the protocol, these formulations were limited to linear session types where each channel of communication has a unique provider and client. - how much was read: only abstract or first pages read - source - record id: `manifestly-phased-communication-via` - Manthan: A Data-Driven Approach for Boolean Function Synthesis. - what: . Boolean functional synthesis is a fundamental problem in computer science with wide-ranging applications and has witnessed a surge of interest resulting in progressively improved techniques over the past decade. Despite intense algorithmic development, a large number of problems remain beyond the reach of the state of the art techniques. - how much was read: only abstract or first pages read - source - record id: `manthan-a-data-driven` - MaskD: A Tool for Measuring Masking Fault-Tolerance. - what: . We present MaskD, an automated tool designed to measure the level of fault-tolerance provided by software components. The tool focuses on measuring masking fault-tolerance, that is, the kind of fault- tolerance that allows systems to mask faults in such a way that they cannot be observed by the users. - how much was read: only abstract or first pages read - source - record id: `maskd-a-tool-for` - \mathsf StocHy : Automated Verification and Synthesis of Stochastic Processes. - what: . StocHy is a software tool for the quantitative analysis of discrete-time stochastic hybrid systems (shs). StocHy accepts a high-level description of stochastic models and constructs an equivalent shs model. - how much was read: only abstract or first pages read - source - record id: `mathsf-stochy-automated-verification` - MCMAS-SLK: A Model Checker for the Verification of Strategy Logic Specifications. - what: MCMAS-SLK: A Model Checker for the Verification of Strategy Logic Specifications Petr Čermák1 , Alessio Lomuscio1 , Fabio Mogavero2, and Aniello Murano2 1 Imperial College London, UK 2 Università degli Studi di Napoli Federico II, Italy 1 Introduction Model checking has come of age. A number of techniques are increasingly used in industrial setting to verify hardware and software systems, both against models and concrete implementations. While it is generally accepted that obstacles still remain, notably handling infinite state systems efficiently, much of current work involves refining and improving existing techniques such as predicate abstraction. - how much was read: only abstract or first pages read - source - record id: `mcmas-slk-a-model` - Measuring Masking Fault-Tolerance. - what: . In this paper we introduce a notion of fault-tolerance dis- tance between labeled transition systems. Intuitively, this notion of dis- tance measures the degree of fault-tolerance exhibited by a candidate system. - how much was read: only abstract or first pages read - source - record id: `measuring-masking-fault-tolerance` - Memory Simulations, Security and Optimization in a Verified Compiler - what: Current compilers implement security features and optimizations that require nontrivial semantic reasoning about pointers and memory allo- cation: the program after the insertion of the security feature, or after applying the optimization, must simulate the original program despite a different memory layout. In this article, we illustrate such reasoning on pointer allocations through memory extensions and injections, as well as fine points on undefined val- ues, by explaining how we implemented and proved correct two security features (stack canaries and pointer authentication) and one optimization (tail recursion elimination) in the CompCert formally verified compiler. - how much was read: only abstract or first pages read - source - record id: `memory-simulations-security-and` - MetaVal: Witness Validation via Verification. - what: . Witness validation is an important technique to increase trust in verification results, by making descriptions of error paths (violation witnesses) and important parts of the correctness proof (correctness wit- nesses) available in an exchangeable format. This way, the verification result can be validated independently from the verification in a second step. - how much was read: only abstract or first pages read - source - record id: `metaval-witness-validation-via` - Minimal-Time Synthesis for Parametric Timed Automata. - what: . Parametric timed automata (PTA) extend timed automata by allowing parameters in clock constraints. Such a formalism is for instance useful when reasoning about unknown delays in a timed sys- tem. - how much was read: only abstract or first pages read - source - record id: `minimal-time-synthesis-for` - Mining the Archive of Formal Proofs. - what: . The Archive of Formal Proofs is a vast collection of computer-checked proofs developed using the proof assistant Isabelle. We perform an in-depth anal- ysis of the archive, looking at various properties of the proof developments, in- cluding size, dependencies, and proof style. - how much was read: only abstract or first pages read - source - record id: `mining-the-archive-of` - Model Checking for Verification of Quantum Circuits. - what: . In this talk, we will describe a framework for assertion-based veri- fication (ABV) of quantum circuits by applying model checking techniques for quantum systems developed in our previous work, in which: – Noiseless and noisy quantum circuits are modelled as operator- and super- operator-valued transition systems, respectively, both of which can be further represented by tensor networks. – Quantum assertions are specified by a temporal extension of Birkhoff-von Neumann quantum logic. - how much was read: only abstract or first pages read - source - record id: `model-checking-for-verification` - Model Checking Indistinguishability of Randomized Security Protocols. - what: . The design of security protocols is extremely subtle and vul- nerable to potentially devastating flaws. As a result, many tools and techniques for the automated verification of protocol designs have been developed. - how much was read: only abstract or first pages read - source - record id: `model-checking-indistinguishability-of` - Modelling the ARMv8 architecture, operationally: concurrency and ISA. - what: Introduction In this paper we develop semantics for key aspects of the ARMv8 The ARM architecture is the specification of a wide range of pro- multiprocessor architecture: the concurrency model and much of cessors: cores designed by ARM that are integrated into devices the 64-bit application-level instruction set (ISA). Our goal is to produced by many other vendors, and cores designed ab initio by clarify what the range of architecturally allowable behaviour is, and ARM architecture partners, such as Nvidia and Qualcomm. The thereby to support future work on formal verification, analysis, and architecture defines the properties on which software can rely on, testing of concurrent ARM software and hardware. - limits: Read from the saved open PDF; this record uses the abstract/opening section and preserves the exact extracted quote below. - how much was read: only abstract or first pages read - source - record id: `modelling-the-armv8-architecture` - ModelVerification.jl: A Comprehensive Toolbox for Formally Verifying Deep Neural Networks. - what: . Deep Neural Networks (DNN) are crucial in approximating nonlinear functions across diverse applications, ranging from image clas- sification to control. Verifying specific input-output properties can be a highly challenging task due to the lack of a single, self-contained frame- work that allows a complete range of various model architecture and input-output properties. - how much was read: only abstract or first pages read - source - record id: `modelverification-jl-a-comprehensive` - Modular verification of interrupt-driven software. - what: Modular Verification of Interrupt-Driven Software Chungha Sung Markus Kusano Chao Wang University of Southern California Virginia Tech University of Southern California Los Angeles, CA, USA Blacksburg, VA, USA Los Angeles, CA, USA Abstract—Interrupts have been widely used in safety-critical the sound approximation of complex constructs such as loops, computer systems to handle outside stimuli and interact with recursions and numerical computations. However, although ab- the hardware, but reasoning about interrupt-driven software stract interpretation techniques have been successfully applied remains a difficult task. Although a number of static verification techniques have been proposed for interrupt-driven software, to sequential [6] and multithreaded software [27], they have not been abl - how much was read: only abstract or first pages read - source - record id: `modular-verification-of-interrupt` - MoGym: Using Formal Models for Training and Verifying Decision-making Agents. - what: . MoGym, is an integrated toolbox enabling the training and verification of machine-learned decision-making agents based on formal models, for the purpose of sound use in the real world. Given a formal rep- resentation of a decision-making problem in the JANI format and a reach- avoid objective, MoGym (a) enables training a decision-making agent with respect to that objective directly on the model using reinforcement learning (RL) techniques, and (b) it supports rigorous assessment of the quality of the induced decision-making agent by means of deep statistical model checking (DSMC). - how much was read: only abstract or first pages read - source - record id: `mogym-using-formal-models` - Mopsa-C: Improved Verification for C Programs, Simple Validation of Correctness Witnesses (Competition Contribution). - what: . We present advances we brought to Mopsa for SV-Comp 2024. We significantly improved the precision of our verifier in the pres- ence of dynamic memory allocation, library calls such as memset, goto- based loops, and integer abstractions. - how much was read: only abstract or first pages read - source - record id: `mopsa-c-improved-verification` - Most General Winning Secure Equilibria Synthesis in Graph Games. - what: This paper considers the problem of co-synthesis in k-player games over a finite graph where each player has an individual ω-regular specification ϕi . In this context, a secure equilibrium (SE) is a Nash equilibrium w.r.t. the lexicographically ordered objectives of each player to first satisfy their own specification, and second, to falsify other players’ specifications. - how much was read: only abstract or first pages read - source - record id: `most-general-winning-secure` - Multiparty Asynchronous Session Types - what: as a type a global scenario that a programmer wishes to realize through interacting programs (hence against which she would wish to check their correctness) and establish an effective method to ensure composability. Second, linearity analysis of channels, which is the key for ensuring safety and progress, becomes highly involved under a combination of asynchrony and multiparty communication since a conflict of actions can arise more easily. A linearity property holds if a communication via the same channel of a global type does not break the order of messages as it is specified in the global description. - how much was read: only abstract or first pages read - source - record id: `multiparty-asynchronous-session-types` - Multiparty Compatibility for Concurrent Objects - what: Multiparty Compatibility for Concurrent Objects Roly Perera Julien Lange Simon J. Gay University of Glasgow, UK Imperial College London University of Glasgow, UK School of Computing Science Department of Computing School of Computing Science roly.perera@glasgow.ac.uk j.lange@imperial.ac.uk simon.gay@glasgow.ac.uk Objects and actors are communicating state machines, offering and consuming different services at different points in their lifecycle. Two complementary challenges arise when programming such systems. - how much was read: only abstract or first pages read - source - record id: `multiparty-compatibility-for-concurrent` - Multiparty Session Types Within a Canonical Binary Theory, and Beyond - what: . A widespread approach to software service analysis uses session types. Very different type theories for binary and multiparty protocols have been devel- oped; establishing precise connections between them remains an open problem. - how much was read: only abstract or first pages read - source - record id: `multiparty-session-types-within` - Multiparty Session Typing, Embedded. - what: . Multiparty session typing (MPST) is a method to make con- current programming simpler. The idea is to use type checking to auto- matically detect safety and liveness violations of implementations relative to specifications. - how much was read: only abstract or first pages read - source - record id: `multiparty-session-typing-embedded` - Multiparty Session Typing in Java, Deductively. - what: . Multiparty session typing (MPST) is a method to automat- ically prove safety and liveness of protocol implementations relative to specifications. We present BGJ: a new tool to apply the MPST method in combination with Java. - how much was read: only abstract or first pages read - source - record id: `multiparty-session-typing-in` - nekton: A Linearizability Proof Checker - what: . nekton is a new tool for checking linearizability proofs of highly complex concurrent search structures. The tool’s unique features are its paramet- ric heap abstraction based on separation logic and the flow framework, and its support for hindsight arguments about future-dependent linearization points. - how much was read: only abstract or first pages read - source - record id: `nekton-a-linearizability-proof` - Networcat: applying analysis techniques of shared memory software on message-passing distributed systems - what: Communication models are a key aspect in the design and implementation of distributed system architectures. Application logic must consider the guarantees of these models, which fundamentally influence its correctness. Modern multi-core processor architectures face a similar problem when it comes to accessing shared memory: the guarantees of an architecture have a fundamental impact on the observable behavior of software. - how much was read: only abstract or first pages read - source - record id: `networcat-applying-analysis-techniques` - Neural Network-based Control for Multi-Agent Systems from Spatio-Temporal Specifications - what: Neural Network-based Control for Multi-Agent Systems from Spatio-Temporal Specifications Suhail Alsalehi, Noushin Mehdipour, Ezio Bartocci and Calin Belta Abstract— We propose a framework for solving control syn- was used to monitor safety and performance requirements of thesis problems for multi-agent networked systems required to smart cities. STREL extends STL with the spatial operators satisfy spatio-temporal specifications. We use Spatio-Temporal reach and escape, from which it is possible to derive the Reach and Escape Logic (STREL) as a specification language. - how much was read: only abstract or first pages read - source - record id: `neural-network-based-control` - Neural Network Robustness as a Verification Property: A Principled Case Study. - what: . Neural networks are very successful at detecting patterns in noisy data, and have become the technology of choice in many fields. However, their usefulness is hampered by their susceptibility to adversarial attacks. - how much was read: only abstract or first pages read - source - record id: `neural-network-robustness-as` - Neural Network Verification with Branch-and-Bound for General Nonlinearities. - what: . Branch-and-bound (BaB) is among the most effective tech- niques for neural network (NN) verification. However, existing works on BaB for NN verification have mostly focused on NNs with piecewise linear activations, especially ReLU networks. - how much was read: only abstract or first pages read - source - record id: `neural-network-verification-with` - Neural Networks in Imandra: Matrix Representation as a Verification Choice. - what: . The demand for formal verification tools for neural networks has increased as neural networks have been deployed in a growing number of safety-critical applications. Matrices are a data structure essential to formalising neural networks. - how much was read: only abstract or first pages read - source - record id: `neural-networks-in-imandra` - NeuroSynt: A Neuro-symbolic Portfolio Solver for Reactive Synthesis. - what: . We introduce NeuroSynt, a neuro-symbolic portfolio solver framework for reactive synthesis. At the core of the solver lies a seamless integration of neural and symbolic approaches to solving the reactive syn- thesis problem. - how much was read: only abstract or first pages read - source - record id: `neurosynt-a-neuro-symbolic` - NNV 2.0: The Neural Network Verification Tool. - what: . This manuscript presents the updated version of the Neural Network Verification (NNV) tool. NNV is a formal verification software tool for deep learning models and cyber-physical systems with neural net- work components. - how much was read: only abstract or first pages read - source - record id: `nnv-2-0-the` - NNV: The Neural Network Verification Tool for Deep Neural Networks and Learning-Enabled Cyber-Physical Systems. - what: . This paper presents the Neural Network Verification (NNV) software tool, a set-based verification framework for deep neural networks (DNNs) and learning-enabled cyber-physical systems (CPS). The crux of NNV is a collection of reachability algorithms that make use of a vari- ety of set representations, such as polyhedra, star sets, zonotopes, and abstract-domain representations. - how much was read: only abstract or first pages read - source - record id: `nnv-the-neural-network` - Numerically-Robust Inductive Proof Rules for Continuous Dynamical Systems. - what: . We formulate numerically-robust inductive proof rules for unbounded stability and safety properties of continuous dynamical sys- tems. These induction rules robustify standard notions of Lyapunov func- tions and barrier certificates so that they can tolerate small numerical errors. - how much was read: only abstract or first pages read - source - record id: `numerically-robust-inductive-proof` - OccRob: Efficient SMT-Based Occlusion Robustness Verification of Deep Neural Networks. - what: . Occlusion is a prevalent and easily realizable semantic perturbation to deep neural networks (DNNs). It can fool a DNN into misclassifying an input image by occluding some segments, possibly resulting in severe errors. - how much was read: only abstract or first pages read - source - record id: `occrob-efficient-smt-based` - Ogre and Pythia: an invariance proof method for weak consistency models. - what: 1. Overview of the Analytic Semantics We design an invariance proof method for concurrent programs Our analytic semantics describes program executions as their an- parameterised by a weak consistency model. The calculational archic semantics (process computations without any restriction on design of the invariance proof method is by abstract interpretation communications), and their communication semantics (restrictions of a truly parallel analytic semantics. - how much was read: only abstract or first pages read - source - record id: `ogre-and-pythia-an` - On Completeness of SDP-Based Barrier Certificate Synthesis over Unbounded Domains. - what: . Barrier certificates, serving as differential invariants that witness system safety, play a crucial role in the verification of cyber- physical systems (CPS). Prevailing computational methods for synthe- sizing barrier certificates are based on semidefinite programming (SDP) by exploiting Putinar Positivstellensatz. - how much was read: only abstract or first pages read - source - record id: `on-completeness-of-sdp` - On Global Types and Multi-Party Session - what: . Global types are formal specifications that describe communication protocols in terms of their global interactions. We present a new, streamlined language of global types equipped with a trace-based semantics and whose features and restrictions are se- mantically justified. - how much was read: only abstract or first pages read - source - record id: `on-global-types-and` - On Polymorphic Sessions and Functions - what: ) Encodings Bernardo Toninho1,2(B) and Nobuko Yoshida2 1 NOVA-LINCS, Departamento de Informática, FCT, Universidade Nova de Lisboa, Lisbon, Portugal btoninho@fct.unl.pt 2 Department of Computing, Imperial College London, London, UK Abstract. This work exploits the logical foundation of session types to determine what kind of type discipline for the π-calculus can exactly capture, and is captured by, λ-calculus behaviours. Leveraging the proof theoretic content of the soundness and completeness of sequent calculus and natural deduction presentations of linear logic, we develop the first mutually inverse and fully abstract processes-as-functions and functions- as-processes encodings between a polymorphic session π-calculus and a linear formulation of System F. - how much was read: only abstract or first pages read - source - record id: `on-polymorphic-sessions-and` - On Stability in a Happens-Before Propagator for Concurrent Programs (Reproducibility Study). - what: . Analyzing concurrent programs often involves reasoning about happens-before relations, handled by dedicated SMT theory solvers. Recently, preventative propagation rules have been introduced for con- sistency models to avoid unnecessary computations. - how much was read: only abstract or first pages read - source - record id: `on-stability-in-a` - “On the fly” verification of behavioural equivalences and preorders - what: This paper describes decision procedures for hisimulation and simulation relations be- tween two transition systems. The algorithms proposed here do not need to previously construct them: the verification can be performed during their generation. In addition, a diagnosis is computed when the two transitions systems are not equivalent. - how much was read: only abstract or first pages read - source - record id: `on-the-fly-verification` - On the Preciseness of Subtyping in Session Types - what: More recently, another subtyping based on session types [12] Subtyping in concurrency has been extensively studied since early has been applied to many aspects of software design and imple- 1990s as one of the most interesting issues in type theory. The mentations such as web services, programming languages and dis- correctness of subtyping relations has been usually provided as tributed computing [4, 8, 14, 22, 35, 37]. The standpoint of ses- the soundness for type safety. - how much was read: only abstract or first pages read - source - record id: `on-the-preciseness-of` - On the Structure of Inductive Reasoning: Circular and Tree-Shaped Proofs in the μCalculus - what: . In this paper we study induction in the context of the first- order µ-calculus with explicit approximations. We present and compare two Gentzen-style proof systems each using a different type of induction. - how much was read: only abstract or first pages read - source - record id: `on-the-structure-of` - Online Causation Monitoring of Signal Temporal Logic. - what: . Online monitoring is an effective validation approach for hybrid systems, that, at runtime, checks whether the (partial) signals of a system satisfy a specification in, e.g., Signal Temporal Logic (STL). The classic STL monitoring is performed by computing a robustness interval that specifies, at each instant, how far the monitored signals are from violating and satisfying the specification. - how much was read: only abstract or first pages read - source - record id: `online-causation-monitoring-of` - OnlineProver: Experience with a Visualisation Tool for Teaching Formal Proofs - what: OnlineProver: Experience with a Visualisation Tool for Teaching Formal Proofs Ján Perháč * † Samuel Novotný Sergej Chodarev Department of Computers and Informatics, Faculty of Electrical Engineering and Informatics, Technical University of Košice, Košice, Slovakia {jan.perhac,samuel.novotny,sergej.chodarev}@tuke.sk Joachim Tilsted Kristensen Lars Tveito Department of Informatics, University of Oslo, Oslo, Norway {joachkr,larstvei}@ifi.uio.no Oleks Shturmov Michael Kirkedal Thomsen Department of Informatics, University of Oslo, Oslo, Norway Department of Computer Science, University of Copenhagen, Copenhagen, Denmark {michakt,olekss}@ifi.uio.no OnlineProver is an interactive proof assistant tailored for the educational setting. Its main features in- clude a user-friendly interface for editing and checking proofs. The user interface provides feedback directly within the derivation, based - how much was read: only abstract or first pages read - source - record id: `onlineprover-experience-with-a` - PAC learning-based verification and model synthesis. - what: that this work reduces the dichotomy between formal and We introduce a novel technique for verification and model practical software engineering techniques. synthesis of sequential programs. Our technique is based In our technical setting, we assume programs are an- on learning a regular model of the set of feasible paths in notated with program assertions. - how much was read: only abstract or first pages read - source - record id: `pac-learning-based-verification` - PaMpeR: proof method recommendation system for Isabelle/HOL. - what: —Deciding which sub-tool to use for a given proof state it is possible to advise which proof methods are arXiv:1806.07239v1 [cs.LO] 19 Jun 2018 requires expertise specific to each ITP. To mitigate this problem, useful to a given proof state, based only on the meta- we present PaMpeR, a proof method recommendation system for information about the state and information in the Isabelle/HOL. Given a proof state, PaMpeR recommends proof methods to discharge the proof goal and provides qualitative standard library. - how much was read: only abstract or first pages read - source - record id: `pamper-proof-method-recommendation` - Parallel Model Checking Algorithms for Linear-Time Temporal Logic - what: Model checking is a fully automated, formal method for demonstrating absence of bugs in reactive systems. Here, bugs are violations of properties in Linear-time Temporal Logic (LTL). A fundamental challenge to its applica- tion is the exponential explosion in the number of system states. - how much was read: only abstract or first pages read - source - record id: `parallel-model-checking-algorithms` - Parameter Synthesis in Markov Models: A Gentle Survey. - what: . This paper surveys the analysis of parametric Markov models whose transitions are labelled with functions over a finite set of parameters. These models are symbolic representations of uncountable many concrete probabilistic models, each obtained by instantiating the parameters. - how much was read: only abstract or first pages read - source - record id: `parameter-synthesis-in-markov` - Parameterized Concurrent Multi-Party Session Types - what: Parameterized Concurrent Multi-Party Session Types Minas Charalambides Peter Dinges Gul Agha charala1@illinois.edu pdinges@acm.org agha@illinois.edu Department of Computer Science University of Illinois at Urbana–Champaign, USA http://osl.cs.uiuc.edu/ Session types have been proposed as a means of statically verifying implementations of communi- cation protocols. Although prior work has been successful in verifying some classes of protocols, it does not cope well with parameterized, multi-actor scenarios with inherent asynchrony. For example, the sliding window protocol is inexpressible in previously proposed session type systems. - how much was read: only abstract or first pages read - source - record id: `parameterized-concurrent-multi-party` - Parameterized Synthesis. - what: . We study the synthesis problem for distributed architectures with a parametric number of finite-state components. Parameterized specifications arise naturally in a synthesis setting, but thus far it was unclear how to decide realizability and how to perform synthesis. - how much was read: only abstract or first pages read - source - record id: `parameterized-synthesis` - Parameterized Synthesis with Safety Properties. - what: . Parameterized synthesis offers a solution to the problem of construct- ing correct and verified controllers for parameterized systems. Such systems oc- cur naturally in practice (e.g., in the form of distributed protocols where the amount of processes is often unknown at design time and the protocol must work regardless of the number of processes). - how much was read: only abstract or first pages read - source - record id: `parameterized-synthesis-with-safety` - Parameterized Verification of Asynchronous Shared-Memory Systems. - what: . We characterize the complexity of the safety verification problem for parameterized systems consisting of a leader process and arbitrarily many anonymous and identical contributors. Processes communicate through a shared, bounded-value register. - how much was read: only abstract or first pages read - source - record id: `parameterized-verification-of-asynchronous` - Parameterized Verification of Synchronization in Constrained Reconfigurable Broadcast Networks. - what: . Reconfigurable broadcast networks provide a convenient for- malism for modelling and reasoning about networks of mobile agents broadcasting messages to other agents following some (evolving) commu- nication topology. The parameterized verification of such models aims at checking whether a given property holds irrespective of the initial config- uration (number of agents, initial states and initial communication topol- ogy). - how much was read: only abstract or first pages read - source - record id: `parameterized-verification-of-synchronization` - Parameterized Verification under TSO with Data Types. - what: data types over potentially infinite domains. We present a framework that translates the reachability problem for such systems to the reachability problem for register machines enriched with the given abstract data type. We use the translation to obtain tight complexity bounds for TSO-based parameterized verification over several abstract data types, such as push-down automata, ordered multi push- down automata, one-counter nets, one-counter automata, and Petri nets. - how much was read: only abstract or first pages read - source - record id: `parameterized-verification-under-tso` - Parametric Runtime Verification of C Programs. - what: . Many runtime verification tools are built based on Aspect- Oriented Programming (AOP) tools, most often AspectJ, a mature implementation of AOP for Java. Although already popular in the Java domain, there is few work on runtime verification of C programs via AOP, due to the lack of a solid language and tool support. - how much was read: only abstract or first pages read - source - record id: `parametric-runtime-verification-of` - Pardinus: A Temporal Relational Model Finder - what: This article presents Pardinus, an extension of the popular Kodkod [53] relational model finder with linear temporal logic (including past operators), to simplify the analysis of dynamic systems. Pardinus includes a SAT-based bounded-model checking engine and an SMV-based complete model checking engine, both allowing iteration through the different instances (or counter-examples) of a specification. It also supports a decomposed parallel analysis strategy that improves the efficiency of both analysis engines on commodity multi- core machines. - limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review. - how much was read: only abstract or first pages read - source - record id: `pardinus-a-temporal-relational` - PARTY Parameterized Synthesis of Token Rings. - what: . Synthesis is the process of automatically constructing an im- plementation from a specification. In parameterized synthesis, we con- struct a single process such that the distributed system consisting of an arbitratry number of copies of the process satisfies a parameterized spec- ification. - how much was read: only abstract or first pages read - source - record id: `party-parameterized-synthesis-of` - PEREGRiNN: Penalized-Relaxation Greedy Neural Network Verifier. - what: . Neural Networks (NNs) have increasingly apparent safety implications commensurate with their proliferation in real-world appli- cations: both unanticipated as well as adversarial misclassifications can result in fatal outcomes. As a consequence, techniques of formal verifi- cation have been recognized as crucial to the design and deployment of safe NNs. - how much was read: only abstract or first pages read - source - record id: `peregrinn-penalized-relaxation-greedy` - Permissive Controller Synthesis for Probabilistic Systems. - what: . We propose novel controller synthesis techniques for proba- bilistic systems modelled using stochastic two-player games: one player acts as a controller, the second represents its environment, and probabil- ity is used to capture uncertainty arising due to, for example, unreliable sensors or faulty system components. Our aim is to generate robust con- trollers that are resilient to unexpected system changes at runtime, and flexible enough to be adapted if additional constraints need to be im- posed. - how much was read: only abstract or first pages read - source - record id: `permissive-controller-synthesis-for` - PeSCo: Predicting Sequential Combinations of Verifiers - what: PeSCo: Predicting Sequential Combinations of Verifiers (Competition Contribution) Cedric Richter(B) and Heike Wehrheim Department of Computer Science, Paderborn University, Paderborn, Germany cedricr@mail.upb.de, wehrheim@upb.de Abstract. PeSCo is a tool for predicting a (likely best) sequential com- bination of verifiers on a given verification task and then running it. The approach is based on machine learning, more precisely on learning rank- ings of verifiers on verification tasks (where the ordering of verifiers is based on the SV-COMP scoring schema). - how much was read: only abstract or first pages read - source - record id: `pesco-predicting-sequential-combinations` - Physically Feasible Repair of Reactive, Linear Temporal Logic-Based, High-Level Tasks - what: TRANSACTIONS ON ROBOTICS, VOL. XX, NO. XX, MONTH 202X 1 Physically-Feasible Repair of Reactive, Linear Temporal Logic-based, High-Level Tasks Adam Pacheck and Hadas Kress-Gazit Fellow, IEEE Abstract—A typical approach to creating complex robot be- of applying the skill, respectively–while in fact, during skill haviors is to compose atomic controllers, or skills, such that the execution the system might be temporarily in another state. - how much was read: only abstract or first pages read - source - record id: `physically-feasible-repair-of` - PIChecker: A POR and Interpolation based Verifier for Concurrent Programs (Competition Contribution). - what: . PIChecker is a tool for verifying reachability properties of concurrent C programs. It moderates the trace-space explosion problem, aggravated by thread alternation, through utilizing the PC-DPOR and C-Intp techniques. - how much was read: only abstract or first pages read - source - record id: `pichecker-a-por-and` - Policy Verification in Stochastic Dynamical Systems Using Logarithmic Neural Certificates. - what: . We consider the verification of neural network policies for discrete-time stochastic systems with respect to reach-avoid specifica- tions. We use a learner-verifier procedure that learns a certificate for the specification, represented as a neural network. - how much was read: only abstract or first pages read - source - record id: `policy-verification-in-stochastic` - Polymorphic Types for Leak Detection in a Session-Oriented Functional Language - what: . Copyless message passing is a communication paradigm in which only pointers are exchanged between sender and receiver processes. Because of its nature, this paradigm requires that messages are treated as linear resources. - how much was read: only abstract or first pages read - source - record id: `polymorphic-types-for-leak` - Polynomial-Time Verification of PCTL Properties of MDPs with Convex Uncertainties. - what: . We address the problem of verifying Probabilistic Computation Tree Logic (PCTL) properties of Markov Decision Processes (MDPs) whose state transition probabilities are only known to lie within uncertainty sets. We first introduce the model of Convex-MDPs (CMDPs), i.e., MDPs with convex uncer- tainty sets. - how much was read: only abstract or first pages read - source - record id: `polynomial-time-verification-of` - Practical Deductive Verification of OCaml Programs. - what: . In this paper, we provide a comprehensive, hands-on tutorial on how to apply deductive verification to programs written in OCaml. In particular, we show how one can use the GOSPEL specification lan- guage and the Cameleer tool to conduct mostly-automated verification on OCaml code. - how much was read: only abstract or first pages read - source - record id: `practical-deductive-verification-of` - Probabilistic Bisimulation for Parameterized Anonymity and Uniformity Verification. - what: —Bisimulation is crucial for verifying process equiv- is decidable for both probabilistic and nondeterministic finite- alence in probabilistic systems. This paper presents a novel state systems [22]–[24]. For infinite-state systems, such as logical framework for analyzing bisimulation in probabilistic communication protocols involving an unbounded number of parameterized systems, namely, infinite families of finite-state probabilistic systems. - how much was read: only abstract or first pages read - source - record id: `probabilistic-bisimulation-for-parameterized` - Probabilistic Bisimulation for Parameterized Systems - (with Applications to Verifying Anonymous Protocols). - what: . Probabilistic bisimulation is a fundamental notion of process equiva- lence for probabilistic systems. It has important applications, including the for- malisation of the anonymity property of several communication protocols. - how much was read: only abstract or first pages read - source - record id: `probabilistic-bisimulation-for-parameterized-2` - Probabilistic Model Checking and Autonomy - what: Probabilistic Model Checking and Autonomy Marta Kwiatkowska,1 Gethin Norman2 and David Parker3 1 Department of Computer Science, University of Oxford, UK, OX1 3QD; email: marta.kwiatkowska@cs.ox.ac.uk arXiv:2111.10630v1 [cs.LO] 20 Nov 2021 2 School of Computing Science, University of Glasgow, UK, G12 8RZ; email: gethin.norman@glasgow.ac.uk 3 School of Computer Science, University of Birmingham, UK; email: d.a.parker@cs.bham.ac.uk Posted with permission from the Annual Keywords Review of Control, Robotics, and Autonomous Systems, Volume 5; probabilistic modelling, temporal logic, model checking, strategy copyright 2022 Annual Reviews, synthesis, stochastic games, equilibria https://www.annualreviews.org/ Abstract Design and control of autonomous systems that operate in uncertain or adversarial environments can be facilitated by formal modelling and analysis. Probabilistic model checking is a technique to automatically verify, for a given temporal logic specification, that a system model satisfies the specification, as well as to synthesise an optimal strategy for its control. This method has recently been extended to multi-agent systems that exhibit competitive or cooperative behavi - limits: Read from the saved open PDF at abstract/opening-section depth; quote is copied from extracted PDF text. - how much was read: only abstract or first pages read - source - record id: `probabilistic-model-checking-and` - Probabilistic Program Verification via Inductive Synthesis of Inductive Invariants. - what: . Essential tasks for the verification of probabilistic programs include bounding expected outcomes and proving termination in finite expected runtime. We contribute a simple yet effective inductive synthesis approach for proving such quantitative reachability properties by generat- ing inductive invariants on source-code level. - how much was read: only abstract or first pages read - source - record id: `probabilistic-program-verification-via` - Probabilistic Verification of Neural Networks Against Group Fairness. - what: . Fairness is crucial for neural networks which are used in ap- plications with important societal implication. Recently, there have been multiple attempts on improving fairness of neural networks, with a focus on fairness testing (e.g., generating individual discriminatory instances) and fairness training (e.g., enhancing fairness through augmented train- ing). - how much was read: only abstract or first pages read - source - record id: `probabilistic-verification-of-neural` - Product Programs in the Wild: Retrofitting Program Verifiers to Check Information Flow Security. - what: . Most existing program verifiers check trace properties such as functional correctness, but do not support the verification of hyper- properties, in particular, information flow security. In principle, prod- uct programs allow one to reduce the verification of hyperproperties to trace properties and, thus, apply standard verifiers to check them; in practice, product constructions are usually defined only for simple pro- gramming languages without features like dynamic method binding or concurrency and, consequently, cannot be directly applied to verify infor- mation flow security in a full-fledged language. - how much was read: only abstract or first pages read - source - record id: `product-programs-in-the` - Program Verification with Constrained Horn Clauses (Invited Paper). - what: . Many problems in program verification, Model Checking, and type inference are naturally expressed as satisfiability of a verifica- tion condition expressed in a fragment of First-Order Logic called Con- strained Horn Clauses (CHC). This transforms program analysis and verification tasks to the realm of first order satisfiability and into the realm of SMT solvers. - how much was read: only abstract or first pages read - source - record id: `program-verification-with-constrained` - Progress on Software Verification: SV-COMP 2022. - what: . The 11th edition of the Competition on Software Verification (SV-COMP 2022) provides the largest ever overview of tools for software verification. The competition is an annual comparative evaluation of fully automatic software verifiers for C and Java programs. - how much was read: only abstract or first pages read - source - record id: `progress-on-software-verification` - Proof Assistants for Teaching: a Survey - what: Proof Assistants for Teaching: a Survey Frédéric Tran Minh Laure Gonnord Université Grenoble-Alpes, Grenoble INP, LCIS, France Université Grenoble-Alpes, Grenoble INP, LCIS, France frederic.tran-minh@esisar.grenoble-inp.fr laure.gonnord@grenoble-inp.fr Julien Narboux IRIF, Université Paris Cité, CNRS, Paris, France narboux@irif.fr In parallel to the ever-growing usage of mechanized proofs in diverse areas of mathematics and computer science, proof assistants are used more and more for education. This paper surveys previous work related to the use of proof assistants for (mostly undergraduate) teaching. This includes works where the authors report on their experiments using proof assistants to teach logic, mathematics or computer science, as well as designs or adaptations of proof assistants for teaching. - limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review. - how much was read: only abstract or first pages read - source - record id: `proof-assistants-for-teaching` - Proof-Guided Underapproximation Widening for Bounded Model Checking. - what: . Bounded Model Checking (BMC) is a popularly used strat- egy for program verification and it has been explored extensively over the past decade. Despite such a long history, BMC still faces scalability challenges as programs continue to grow larger and more complex. - how much was read: only abstract or first pages read - source - record id: `proof-guided-underapproximation-widening` - Proof-Producing Synthesis of CakeML from Monadic HOL Functions - what: We introduce an automatic method for producing stateful ML programs together with proofs of correctness from monadic functions in HOL. Our mechanism supports references, excep- tions, and I/O operations, and can generate functions manipulating local state, which can then be encapsulated for use in a pure context. We apply this approach to several non-trivial exam- ples, including the instruction encoder and register allocator of the otherwise pure CakeML compiler, which now benefits from better runtime performance. - how much was read: only abstract or first pages read - source - record id: `proof-producing-synthesis-of` - Proof-producing translation of higher-order logic into pure and stateful ML - what: The higher-order logic found in proof assistants such as Coq and various HOL systems provides a convenient setting for the development and verification of functional programs. However, to ef- ficiently run these programs, they must be converted (or ‘extracted’) to functional programs in a programming language such as ML or Haskell. With current techniques, this step, which must be trusted, relates similar looking objects that have very different semantic definitions, such as the set- theoretic model of a logic and the operational semantics of a programming language. - how much was read: only abstract or first pages read - source - record id: `proof-producing-translation-of` - Proof repair across type equivalences - what: Proof Repair across Type Equivalences Talia Ringer RanDair Porter Nathaniel Yazdani University of Washington University of Washington Northeastern University USA USA USA tringer@cs.washington.edu randair@uw.edu yazdani.n@husky.neu.edu John Leo Dan Grossman Halfaya Research University of Washington USA USA leo@halfaya.org djg@cs.washington.edu arXiv:2010.00774v4 [cs.PL] 12 May 2021 Abstract 1 Introduction We describe a new approach to automatically repairing bro- Program verification with interactive theorem provers has ken proofs in the Coq proof assistant in response to changes come a long way since its inception, especially when it comes in types. Our approach combines a configurable proof term to the scale of programs that can be verified. The seL4 [21] transformation with a decompiler from proof terms to sug- verified operating system kernel, for example, is the effort gested tactic - limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review. - how much was read: only abstract or first pages read - source - record id: `proof-repair-across-type` - ProofBuddy: A Proof Assistant for Learning and Monitoring - what: thinking [4, 11, 34, 36] • Proof assistants make the rules of formal reasoning clear [2, 4, 11] • Proof assistants help students learn how to structure proofs [4, 5, 8, 10, 11, 17, 19, 21, 31] • Students are helped by instant feedback on their proofs [2, 4, 8, 10–12, 15, 21, 26] • Proof competence gained using a proof assistant transfers to pen-and-paper [2, 12, 26, 34] • Proof assistants help students fix their proof errors as early as possible [4, 11] • Proof assistants make it easier for students to get started on a proof [4, 15] • Students consult formal definitions to gain understanding [18, 42] • Students experiment with formal definitions to gain understanding [18, 26] • Proof assistants help students experiment with proof ideas [4] • Correcting assignments checked by proof assistants is easier [8] Some authors have however also observed various difficulties that students encounte - how much was read: only abstract or first pages read - source - record id: `proofbuddy-a-proof-assistant` - Proving Nontermination via Safety. - what: . We show how the problem of nontermination proving can be reduced to a question of underapproximation search guided by a safety prover. This reduction leads to new nontermination proving implementa- tion strategies based on existing tools for safety proving. - how much was read: only abstract or first pages read - source - record id: `proving-nontermination-via-safety` - Proving Unrealizability for Syntax-Guided Synthesis. - what: . We consider the problem of automatically establishing that a given syntax-guided-synthesis (SyGuS) problem is unrealizable (i.e., has no solution). Existing techniques have quite limited ability to establish unrealizability for general SyGuS instances in which the gram- mar describing the search space contains infinitely many programs. - how much was read: only abstract or first pages read - source - record id: `proving-unrealizability-for-syntax` - Q: A Sound Verification Framework for Statecharts and Their Implementations - what: C. Rawlings. 2022. - how much was read: only abstract or first pages read - source - record id: `q-a-sound-verification` - QEBVerif: Quantization Error Bound Verification of Neural Networks. - what: . To alleviate the practical constraints for deploying deep neu- ral networks (DNNs) on edge devices, quantization is widely regarded as one promising technique. It reduces the resource requirements for com- putational power and storage space by quantizing the weights and/or activation tensors of a DNN into lower bit-width fixed-point numbers, resulting in quantized neural networks (QNNs). - how much was read: only abstract or first pages read - source - record id: `qebverif-quantization-error-bound` - Quantitative Verification of Masked Arithmetic Programs Against Side-Channel Attacks. - what: . Power side-channel attacks, which can deduce secret data via statistical analysis, have become a serious threat. Masking is an effective countermeasure for reducing the statistical dependence between secret data and side-channel information. - how much was read: only abstract or first pages read - source - record id: `quantitative-verification-of-masked` - R2U2 Version 3.0: Re-Imagining a Toolchain for Specification, Resource Estimation, and Optimized Observer Generation for Runtime Verification in Hardware and Software. - what: R2U2 Version 3.0: Re-Imagining a Toolchain for Specification, Resource Estimation, and Optimized Observer Generation for Runtime Verification in Hardware and Software Chris Johannsen1(B) , Phillip Jones1 , Brian Kempa1 , Kristin Yvonne Rozier1 , and Pei Zhang2 1 Iowa State University, Ames, USA {cgjohann,phjones,bckempa, kyrozier}@iastate.edu 2 Google LLC, Sunnyvale, USA Abstract. R2U2 is a modular runtime verification framework capable of mon- itoring sets of specifications in real time and in resource-constrained environ- ments. Such environments demand that a runtime monitor be fast, easily integrat- able, accessible to domain experts, and have predictable resource requirements. - how much was read: only abstract or first pages read - source - record id: `r2u2-version-3-0` - Ranking Function Synthesis for Bit-Vector Relations. - what: . Ranking function synthesis is a key aspect to the success of modern termination provers for imperative programs. While it is well- known how to generate linear ranking functions for relations over (math- ematical) integers or rationals, efficient synthesis of ranking functions for machine-level integers (bit-vectors) is an open problem. - how much was read: only abstract or first pages read - source - record id: `ranking-function-synthesis-for` - RATSY – A New Requirements Analysis Tool with Synthesis - what: . Formal specifications play an increasingly important role in system design-flows. Yet, they are not always easy to deal with. - how much was read: only abstract or first pages read - source - record id: `ratsy-a-new-requirements` - Relational Equivalence Proofs Between Imperative and MapReduce Algorithms - what: . MapReduce frameworks are widely used for the implemen- tation of distributed algorithms. However, translating imperative algo- rithms into these frameworks requires significant structural changes to the algorithm. - how much was read: only abstract or first pages read - source - record id: `relational-equivalence-proofs-between` - Relational Synthesis of Recursive Programs via Constraint Annotated Tree Automata. - what: . In this paper, we present a new synthesis method based on the novel concept of a constraint annotated tree automaton (CATA). A CATA is a variant of a finite tree automaton (FTA) where the acceptance of a term by the automaton is conditioned upon the logical satisfiabil- ity of a formula. - how much was read: only abstract or first pages read - source - record id: `relational-synthesis-of-recursive` - ReluDiff: differential verification of deep neural networks. - what: n 0,1 n 0,2 f f′ As deep neural networks are increasingly being deployed in prac- tice, their efficiency has become an important issue. While there are compression techniques for reducing the network’s size, energy n 1,1 n 1,2 ′ n 1,1 ′ n 1,2 consumption and computational requirement, they only demon- arXiv:2001.03662v2 [cs.LG] 29 Jan 2020 strate empirically that there is no loss of accuracy, but lack formal guarantees of the compressed network, e.g., in the presence of n 2,1 n 2,2 ′ n 2,1 ′ n 2,2 adversarial examples. Existing verification techniques such as Re- luplex, ReluVal, and DeepPoly provide formal guarantees, but they are designed for analyzing a single network instead of the n 3,1 - how much was read: only abstract or first pages read - source - record id: `reludiff-differential-verification-of` - Replicate, Reuse, Repeat: Capturing Non-Linear Communication via Session Types and Graded Modal Types - what: view of program structure. We focus on semiring graded necessity in this paper (written r A in mathematical notation but A [r] in Granule) which generalises linear logic’s ! [8] and Bounded Linear Logic [9]. - how much was read: only abstract or first pages read - source - record id: `replicate-reuse-repeat-capturing` - Resolution Proofs and Skolem Functions in QBF Evaluation and Applications. - what: . Quantified Boolean formulae (QBF) allow compact encod- ing of many decision problems. Their importance motivated the devel- opment of fast QBF solvers. - how much was read: only abstract or first pages read - source - record id: `resolution-proofs-and-skolem` - Resource-Aware Session Types for Digital Contracts - what: 1 Resource-Aware Session Types for Digital Contracts Technical Report arXiv:1902.06056v3 [cs.PL] 22 Nov 2019 ANKUSH DAS, Carnegie Mellon University STEPHANIE BALZER, Carnegie Mellon University JAN HOFFMANN, Carnegie Mellon University FRANK PFENNING, Carnegie Mellon University ISHANI SANTURKAR, Carnegie Mellon University Programming digital contracts comes with unique challenges, which include (i) expressing and enforcing protocols of interaction, (ii) controlling resource usage, and (iii) preventing the duplication or deletion of a contract’s assets. This article presents the design and type-theoretic foundation of Nomos, a programming language for digital contracts that addresses these challenges. To express and enforce protocols, Nomos is based on shared binary session types. - how much was read: only abstract or first pages read - source - record id: `resource-aware-session-types` - Revisiting Differential Verification: Equivalence Verification with Confidence. - what: . When validated neural networks (NNs) are pruned (and re- trained) before deployment, it is desirable to prove that the new NN behaves equivalently to the (original) reference NN. To this end, our pa- per revisits the idea of differential verification which performs reasoning on differences between NNs: On the one hand, our paper proposes a novel abstract domain for differential verification admitting more efficient rea- soning about equivalence. - how much was read: only abstract or first pages read - source - record id: `revisiting-differential-verification-equivalence` - Robust Dynamic Programming for Temporal Logic Control of Stochastic Systems - what: —Discrete-time stochastic systems are an essential PRISM [17] or MRMC [15]. These tools are also able to modelling tool for many engineering systems. We consider perform policy synthesis for controlling finite-state Markov stochastic control systems that are evolving over continuous decision processes (MDPs) such that the satisfaction prob- spaces. - limits: Read from the saved open PDF at abstract/opening-section depth; quote is copied from extracted PDF text. - how much was read: only abstract or first pages read - source - record id: `robust-dynamic-programming-for` - Robust Markov Decision Processes: A Place Where AI and Formal Methods Meet - what: Markov decision processes (MDPs) are a standard model for sequential decision-making problems and are widely used across many scientific areas, including formal methods and artificial intelligence (AI). MDPs do, however, come with the restrictive assumption that the tran- sition probabilities need to be precisely known. Robust MDPs (RMDPs) overcome this assumption by instead defining the transition probabili- ties to belong to some uncertainty set. - limits: Read from the saved open PDF at abstract/opening-section depth; quote is copied from extracted PDF text. - how much was read: only abstract or first pages read - source - record id: `robust-markov-decision-processes` - Robust, Semi-Intelligible Isabelle Proofs from ATP Proofs - what: Sledgehammer integrates external automatic theorem provers (ATPs) in the Isabelle/HOL proof assistant. To guard against bugs, ATP proofs must be reconstructed in Isabelle. Reconstructing complex proofs involves translating them to detailed Isabelle proof texts, using suitable proof methods to justify the inferences. - limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review. - how much was read: only abstract or first pages read - source - record id: `robust-semi-intelligible-isabelle` - Robust temporal logic model predictive control - what: Robust Temporal Logic Model Predictive Control Sadra Sadraddini and Calin Belta Abstract— Control synthesis from temporal logic specifica- methods for translation of LTL constraints into mixed-integer tions has gained popularity in recent years. In this paper, constraints that are used in the controller synthesis algorithm. we use a model predictive approach to control discrete time More recently, [14], [15] have extended this methodology to linear systems with additive bounded disturbances subject to constraints given as formulas of signal temporal logic (STL). - how much was read: only abstract or first pages read - source - record id: `robust-temporal-logic-model` - Robustness Verification of Quantum Classifiers. - what: . Several important models of machine learning algorithms have been successfully generalized to the quantum world, with poten- tial speedup to training classical classifiers and applications to data ana- lytics in quantum physics that can be implemented on the near future quantum computers. However, quantum noise is a major obstacle to the practical implementation of quantum machine learning. - how much was read: only abstract or first pages read - source - record id: `robustness-verification-of-quantum` - Robustness Verification of Semantic Segmentation Neural Networks Using Relaxed Reachability. - what: . This paper introduces robustness verification for semantic segmentation neural networks (in short, semantic segmentation networks [SSNs]), building on and extending recent approaches for robustness ver- ification of image classification neural networks. Despite recent progress in developing verification methods for specifications such as local adver- sarial robustness in deep neural networks (DNNs) in terms of scalability, precision, and applicability to different network architectures, layers, and activation functions, robustness verification of semantic segmentation has not yet been considered. - how much was read: only abstract or first pages read - source - record id: `robustness-verification-of-semantic` - Runtime Verification in Real-Time with the Copilot Language: A Tutorial. - what: . Ultra-critical systems require high-level assurance, which cannot always be guaranteed at compile time. The use of runtime ver- ification (RV) enables monitoring of these systems during runtime, to detect illegal states early and limit their potential consequences. - how much was read: only abstract or first pages read - source - record id: `runtime-verification-in-real` - RustHorn: CHC-Based Verification for Rust Programs - what: . Reduction to the satisfiablility problem for constrained Horn clauses (CHCs) is a widely studied approach to automated program veri- fication. The current CHC-based methods for pointer-manipulating pro- grams, however, are not very scalable. - how much was read: only abstract or first pages read - source - record id: `rusthorn-chc-based-verification` - Safe Decomposition of Startup Requirements: Verification and Synthesis. - what: . The initialization of complex cyber-physical systems often requires the interaction of various components that must start up with strict timing requirements on the provision of signals (power, refriger- ation, light, etc.). In order to safely allow an independent development of components, it is necessary to ensure a safe decomposition, i.e. - how much was read: only abstract or first pages read - source - record id: `safe-decomposition-of-startup` - Safeguarding AI-Based Software Development and Verification using Witnesses (Position Paper) - what: . This position paper accompanies a presentation and discussion at AISoLA 2023 on the topic of how (generative) AI influences software engineering, namely, the development and verification of software pro- grams. We outline a few opportunities and challenges that are posed by the application of AI. - how much was read: only abstract or first pages read - source - record id: `safeguarding-ai-based-software` - Safety Barrier Certificates for Stochastic Hybrid Systems. - what: . This work is concerned with the safety controller synthesis of stochastic hybrid systems, in which continuous evolutions are described by stochastic differential equations with both Brownian motions and Poisson processes, and instantaneous jumps are governed by stochastic difference equations with additive noises. Our proposed framework leverages the notion of control barrier certificates (CBC), as a discretization- free approach, to synthesize safety controllers for stochastic hybrid systems - how much was read: only abstract or first pages read - source - record id: `safety-barrier-certificates-for` - Safety Verification of Deep Neural Networks. - what: . Deep neural networks have achieved impressive experimental results in image classification, but can surprisingly be unstable with respect to adversar- ial perturbations, that is, minimal changes to the input image that cause the net- work to misclassify it. With potential applications including perception modules and end-to-end controllers for self-driving cars, this raises concerns about their safety. - how much was read: only abstract or first pages read - source - record id: `safety-verification-of-deep` - Safety Verification of Stochastic Systems: A Set-Erosion Approach. - what: — We study the safety verification problem for Multiple techniques have been developed for the safety discrete-time stochastic systems. We propose an approach for verification of discrete-time stochastic systems. For instance, safety verification termed set-erosion strategy that verifies the martingale-based strategies [10], [11], [12] focus on con- safety of a stochastic system on a safe set through the safety of its associated deterministic system on an eroded subset. - how much was read: only abstract or first pages read - source - record id: `safety-verification-of-stochastic` - Sampling-Based Verification of CTMCs with Uncertain Rates. - what: . We employ uncertain parametric CTMCs with parametric transition rates and a prior on the parameter values. The prior encodes uncertainty about the actual transition rates, while the parameters allow dependencies between transition rates. - how much was read: only abstract or first pages read - source - record id: `sampling-based-verification-of` - satabs: A Bit-Precise Verifier for C Programs - (Competition Contribution). - what: SatAbs: A Bit-Precise Verifier for C Programs (Competition Contribution) Gérard Basler, Alastair Donaldson1 , Alexander Kaiser2 , Daniel Kroening2 , Michael Tautschnig2 , and Thomas Wahl3 1 Imperial College, London, United Kingdom 2 University of Oxford, United Kingdom 3 Northeastern University, Boston, United States Abstract. SatAbs is a bit-precise software model checker for ANSI-C programs. It implements sound predicate-abstraction based algorithms for both sequential and concurrent software. - how much was read: only abstract or first pages read - source - record id: `satabs-a-bit-precise` - Scalable Anytime Algorithms for Learning Fragments of Linear Temporal Logic. - what: . Linear temporal logic (LTL) is a specification language for finite sequences (called traces) widely used in program verification, mo- tion planning in robotics, process mining, and many other areas. We consider the problem of learning formulas in fragments of LTL without the U-operator for classifying traces; despite a growing interest of the re- search community, existing solutions suffer from two limitations: they do not scale beyond small formulas, and they may exhaust computational resources without returning any result. - how much was read: only abstract or first pages read - source - record id: `scalable-anytime-algorithms-for` - Scenario-Based Verification of Uncertain MDPs. - what: . We consider Markov decision processes (MDPs) in which the transition probabilities and rewards belong to an uncertainty set parametrized by a collection of random variables. The probability distri- butions for these random parameters are unknown. - how much was read: only abstract or first pages read - source - record id: `scenario-based-verification-of` - SCInfer: Refinement-Based Verification of Software Countermeasures Against Side-Channel Attacks. - what: . Power side-channel attacks, capable of deducing secret using statisti- cal analysis techniques, have become a serious threat to devices in cyber-physical systems and the Internet of things. Random masking is a widely used counter- measure for removing the statistical dependence between secret data and side- channel leaks. - how much was read: only abstract or first pages read - source - record id: `scinfer-refinement-based-verification` - SeaHorn: A Framework for Verifying C Programs (Competition Contribution) - what: SeaHorn: A Framework for Verifying C Programs (Competition Contribution) Arie Gurfinkel1 , Temesghen Kahsai2 , and Jorge A. Navas3 1 Software Engineering Institute / CMU, USA 2 NASA Ames Research Center / CMU, USA 3 NASA Ames Research Center / SGT, USA Abstract. SeaHorn is a framework and tool for verification of safety properties in C programs. - how much was read: only abstract or first pages read - source - record id: `seahorn-a-framework-for` - SeCaV: A Sequent Calculus Verifier in Isabelle/HOL - what: over just any term like with γ-rules. Instead, the term must be arbitrary, i.e. new to the sequent as formalized below, so that any other term could stand in its place. - how much was read: only abstract or first pages read - source - record id: `secav-a-sequent-calculus` - Self-Formalisation of Higher-Order Logic - what: We present a mechanised semantics for higher-order logic (HOL), and a proof of soundness for the inference system, including the rules for making definitions, implemented by the kernel of the HOL Light theorem prover. Our work extends Harrison’s verification of the inference system without definitions. Soundness of the logic extends to soundness of a theorem prover, because we also show that a synthesised implementation of the kernel in CakeML refines the inference system. - how much was read: only abstract or first pages read - source - record id: `self-formalisation-of-higher` - SemML: Enhancing Automata-Theoretic LTL Synthesis with Machine Learning. - what: . Synthesizing a reactive system from specifications given in linear temporal logic (LTL) is a classical problem, finding its applications in safety-critical systems design. We present our tool SemML, which won this year’s LTL realizability tracks of SYNTCOMP, after years of domi- nation by Strix. - how much was read: only abstract or first pages read - source - record id: `semml-enhancing-automata-theoretic` - Separating Sessions Smoothly - what: . This paper introduces Hypersequent GV (HGV), a modular and extensible core calculus for functional programming with session types that enjoys deadlock free- dom, confluence, and strong normalisation. HGV exploits hyper-environments, which are collections of type environments, to ensure that structural congruence is type preserving. - how much was read: only abstract or first pages read - source - record id: `separating-sessions-smoothly` - Sequential Convex Programming for the Efficient Verification of Parametric MDPs. - what: . Multi-objective verification problems of parametric Markov decision processes under optimality criteria can be naturally expressed as nonlinear programs. We observe that many of these computationally demanding problems belong to the subclass of signomial programs. - how much was read: only abstract or first pages read - source - record id: `sequential-convex-programming-for` - Session Type Inference in Haskell - what: representation for the session type based on the ‘de Bruijn levels’. We show an example of the session type inference for a simple SMTP client. - how much was read: only abstract or first pages read - source - record id: `session-type-inference-in` - Session Types for the Transport Layer: Towards an Implementation of TCP - what: Session Types for the Transport Layer: Towards an Implementation of TCP* Samuel Cavoj Ivan Nikitin Colin Perkins samuel@cavoj.net ivan@niktivan.org csp@csperkins.org University of Glasgow University of Glasgow University of Glasgow Ornela Dardha ornela.dardha@glasgow.ac.uk University of Glasgow Session types are a typing discipline used to formally describe communication-driven applications with the aim of fewer errors and easier debugging later into the life cycle of the software. Protocols at the transport layer such as TCP, UDP, and QUIC underpin most of the communication on the modern Internet and affect billions of end-users. The transport layer has different requirements and constraints compared to the application layer resulting in different requirements for verification. - how much was read: only abstract or first pages read - source - record id: `session-types-for-the` - sfPFL: A Probabilistic Logic for Fault Trees. - what: Safety-critical infrastructures must operate in a safe and re- liable way. Fault tree analysis is a widespread method used for risk as- sessment of these systems: fault trees (FTs) are required by, e.g., the Federal Aviation Administration and the Nuclear Regulatory Commis- sion. In spite of their popularity, little work has been done on formulating structural queries about FT and analyzing these, e.g., when evaluating potential scenarios, and to give practitioners instruments to formulate queries on fts in an understandable yet powerful way. - how much was read: only abstract or first pages read - source - record id: `sfpfl-a-probabilistic-logic` - Shared Certificates for Neural Network Verification. - what: . Existing neural network verifiers compute a proof that each input is handled correctly under a given perturbation by propagating a symbolic abstraction of reachable values at each layer. This process is repeated from scratch independently for each input (e.g., image) and perturbation (e.g., rotation), leading to an expensive overall proof effort when handling an entire dataset. - how much was read: only abstract or first pages read - source - record id: `shared-certificates-for-neural` - Sharp Congruences Adequate with Temporal Logics Combining Weak and Strong Modalities. - what: . We showed in a recent paper that, when verifying a modal μ-calculus formula, the actions of the system under verification can be partitioned into sets of so-called weak and strong actions, depending on the combination of weak and strong modalities occurring in the formula. In a compositional verification setting, where the system consists of pro- cesses executing in parallel, this partition allows us to decide whether each individual process can be minimized for either divergence-preserving branching (if the process contains only weak actions) or strong (other- wise) bisimilarity, while preserving the truth value of the formula. - how much was read: only abstract or first pages read - source - record id: `sharp-congruences-adequate-with` - Should We Learn Probabilistic Models for Model Checking? A New Approach and An Empirical Study - what: Many automated system analysis techniques (e.g., model checking, model-based testing) rely on first obtaining a model of the system under anal- ysis. System modeling is often done manually, which is often considered as a hindrance to adopt model-based system analysis and development techniques. To overcome this problem, researchers have proposed to automatically “learn” models based on sample system executions and shown that the learned models can be useful sometimes. - limits: Read from the saved open PDF at abstract/opening-section depth; quote is copied from extracted PDF text. - how much was read: only abstract or first pages read - source - record id: `should-we-learn-probabilistic` - SMT-Based Verification of Software Countermeasures against Side-Channel Attacks. - what: . A common strategy for designing countermeasures against side chan- nel attacks is using randomization techniques to remove the statistical depen- dency between sensitive data and side-channel emissions. However, this process is both labor intensive and error prone, and currently, there is a lack of automated tools to formally access how secure a countermeasure really is. - how much was read: only abstract or first pages read - source - record id: `smt-based-verification-of` - Software Verification of Hyperproperties Beyond k-Safety. - what: . Temporal hyperproperties are system properties that relate multiple execution traces. For (finite-state) hardware, temporal hyper- properties are supported by model checking algorithms, and tools for general temporal logics like HyperLTL exist. - how much was read: only abstract or first pages read - source - record id: `software-verification-of-hyperproperties` - Software Verification with CPAchecker 3.0: Tutorial and User Guide. - what: . This tutorial provides an - how much was read: only abstract or first pages read - source - record id: `software-verification-with-cpachecker` - Software Verification with PDR: An Implementation of the State of the Art. - what: . Property-directed reachability (PDR) is a SAT/SMT-based reachability algorithm that incrementally constructs inductive invariants. After it was successfully applied to hardware model checking, several adaptations to software model checking have been proposed. - how much was read: only abstract or first pages read - source - record id: `software-verification-with-pdr` - Sound Verification Procedures for Temporal Properties of Infinite-State Systems. - what: . First-Order Linear Temporal Logic (FOLTL) is particularly convenient to specify distributed systems, in particular because of the unbounded aspect of their state space. We have recently exhibited novel decidable fragments of FOLTL which pave the way for tractable verifi- cation. - how much was read: only abstract or first pages read - source - record id: `sound-verification-procedures-for` - Specifiable robustness in reactive synthesis - what: When synthesizing a system from a given specification, there is room for automatically adding various requirements, hence improving the resulting system. One such requirement covered extensively in past literature is that of robustness. In particular, the system can fail to read the inputs correctly from the environment, and the environment can fail to satisfy our assumptions about its behavior. - how much was read: only abstract or first pages read - source - record id: `specifiable-robustness-in-reactive` - Staged Specification Logic for Verifying Higher-Order Imperative Programs. - what: . Higher-order functions and imperative states are language features supported by many mainstream languages. Their combination is expressive and useful, but complicates specification and reasoning, due to the use of yet-to-be-instantiated function parameters. - how much was read: only abstract or first pages read - source - record id: `staged-specification-logic-for` - StarV: A Qualitative and Quantitative Verification Tool for Learning-Enabled Systems. - what: . This paper presents StarV, a new tool for verifying deep neu- ral networks (DNNs) and learning-enabled Cyber-Physical Systems (Le- CPS) using the well-known star reachability. Distinguished from exist- ing star-based verification tools such as NNV and NNENUM and oth- ers, StarV not only offers qualitative verification techniques using Star and ImageStar reachability analysis but is also the first tool to propose using ProbStar reachability for quantitative verification of DNNs with piecewise linear activation functions and Le-CPS. - how much was read: only abstract or first pages read - source - record id: `starv-a-qualitative-and` - Static and Dynamic Verification of Relational Properties on Self-composed C Code - what: . Function contracts are a well-established way of formally specifying the intended behavior of a function. However, they usually only describe what should happen during a single call. - how much was read: only abstract or first pages read - source - record id: `static-and-dynamic-verification` - Strategy Representation by Decision Trees in Reactive Synthesis. - what: . Graph games played by two players over finite-state graphs are central in many problems in computer science. In particular, graph games with ω-regular winning conditions, specified as parity objectives, which can express properties such as safety, liveness, fairness, are the basic framework for verification and synthesis of reactive systems. - how much was read: only abstract or first pages read - source - record id: `strategy-representation-by-decision` - Strategy Synthesis for Stochastic Games with Multiple Long-Run Objectives. - what: . We consider turn-based stochastic games whose winning con- ditions are conjunctions of satisfaction objectives for long-run average re- wards, and address the problem of finding a strategy that almost surely maintains the averages above a given multi-dimensional threshold vec- tor. We show that strategies constructed from Pareto set approximations of expected energy objectives are ε-optimal for the corresponding aver- age rewards. - how much was read: only abstract or first pages read - source - record id: `strategy-synthesis-for-stochastic` - Strong Extension-Free Proof Systems - what: We introduce proof systems for propositional logic that admit short proofs of hard formulas as well as the succinct expression of most techniques used by modern SAT solvers. Our proof systems allow the derivation of clauses that are not necessarily implied, but which are redundant in the sense that their addition preserves satisfiability. To guarantee that these added clauses are redundant, we consider various efficiently decidable redundancy criteria which we obtain by first characterizing clause redundancy in terms of a semantic implication relationship and then restricting this relationship so that it becomes decidable in polynomial time. - how much was read: only abstract or first pages read - source - record id: `strong-extension-free-proof` - Structural Synthesis for GXW Specifications. - what: . We define the GXW fragment of linear temporal logic (LTL) as the basis for synthe- arXiv:1605.01153v3 [cs.LO] 6 Jul 2016 sizing embedded control software for safety-critical applications. Since GXW includes the use of a weak-until operator we are able to specify a number of diverse programmable logic control (PLC) problems, which we have compiled from industrial training sets. - how much was read: only abstract or first pages read - source - record id: `structural-synthesis-for-gxw` - Students' Proof Assistant (SPA) - what: Students’ Proof Assistant (SPA) Anders Schlichtkrull Jørgen Villadsen Andreas Halkjær From DTU Compute - Department of Applied Mathematics and Computer Science, Technical University of Denmark, Richard Petersens Plads, Building 324, DK-2800 Kongens Lyngby, Denmark The Students’ Proof Assistant (SPA) aims to both teach how to use a proof assistant like Isabelle and also to teach how reliable proof assistants are built. Technically it is a miniature proof assistant inside the Isabelle proof assistant. In addition we conjecture that a good way to teach structured proving is with a concrete prover where the connection between semantics, proof system, and prover is clear. - how much was read: only abstract or first pages read - source - record id: `students-proof-assistant-spa` - Supermartingale Certificates for Quantitative Omega-Regular Verification and Control. - what: . We present the first supermartingale certificate for quanti- tative ω-regular properties of discrete-time infinite-state stochastic sys- tems. Our certificate is defined on the product of the stochastic system and a limit-deterministic Büchi automaton that specifies the property of interest; hence we call it a limit-deterministic Büchi supermartin- gale (LDBSM). - how much was read: only abstract or first pages read - source - record id: `supermartingale-certificates-for-quantitative` - Supporting Standardization of Neural Networks Verification with VNNLIB and CoCoNet. - what: The interest in the verification of neural networks has been growing steadily in recent years and there have been several advancements in theory, algorithms and tools for the verification of neural networks. Also propelled by VNNCOMP — the annual competition of tools for the verification of neural networks — the community is making steady progress to close the gap with practical applications. In this scenario, we believe that researchers and practitioners should rely on some commonly accepted standard to describe (trained) networks and their properties, as well as a toolset to visualize and to convert from common formats to such standard. - how much was read: only abstract or first pages read - source - record id: `supporting-standardization-of-neural` - Switching Controller Synthesis for Hybrid Systems Against STL Formulas. - what: . Switching controllers play a pivotal role in directing hybrid systems (HSs) towards the desired objective, embodying a “correct-by- construction” approach to HS design. Identifying these objectives is thus crucial for the synthesis of effective switching controllers. - how much was read: only abstract or first pages read - source - record id: `switching-controller-synthesis-for` - Symbolic Verification and Strategy Synthesis for Turn-Based Stochastic Games. - what: . Stochastic games are a convenient formalism for modelling systems that comprise rational agents competing or collaborating within uncertain environments. Probabilistic model checking techniques for this class of models allow us to formally specify quantitative specifications of either collective or individual behaviour and then automatically synthe- sise strategies for the agents under which these specifications are guaran- teed to be satisfied. - how much was read: only abstract or first pages read - source - record id: `symbolic-verification-and-strategy` - Symmetry-Aware Predicate Abstraction for Shared-Variable Concurrent Programs. - what: . Predicate abstraction is a key enabling technology for applying finite- state model checkers to programs written in mainstream languages. It has been used very successfully for debugging sequential system-level C code. - how much was read: only abstract or first pages read - source - record id: `symmetry-aware-predicate-abstraction` - symQV: Automated Symbolic Verification of Quantum Programs. - what: . We present symQV, a symbolic execution framework for writ- ing and verifying quantum computations in the quantum circuit model. symQV can automatically verify that a quantum program complies with a first-order specification. - how much was read: only abstract or first pages read - source - record id: `symqv-automated-symbolic-verification` - Synthesis of Asynchronous Reactive Programs from Temporal Specifications. - what: . Asynchronous interactions are ubiquitous in computing sys- tems and complicate design and programming. Automatic construc- tion of asynchronous programs from specifications (“synthesis”) could ease the difficulty, but known methods are complex, and intractable in practice. - how much was read: only abstract or first pages read - source - record id: `synthesis-of-asynchronous-reactive` - Synthesis of Compact Strategies for Coordination Programs. - what: . In multi-agent settings, such as IoT and robotics, it is nec- essary to coordinate the actions of independent agents to achieve a joint behavior. While it is often easy to specify the desired behavior, pro- gramming the necessary coordination can be difficult. - how much was read: only abstract or first pages read - source - record id: `synthesis-of-compact-strategies` - Synthesis of Distributed Protocols by Enumeration Modulo Isomorphisms - what: . Synthesis of distributed protocols is a hard, often undecid- able, problem. Completion techniques provide partial remedy by turning the problem into a search problem. - limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review. - how much was read: only abstract or first pages read - source - record id: `synthesis-of-distributed-protocols` - Synthesis of Infinite-State Systems with Random Behavior. - what: understood when put into context of robot motion planning and arXiv:2009.12330v1 [cs.SE] 25 Sep 2020 Diversity in the exhibited behavior of a given system is a desirable fuzz testing. characteristic in a variety of application contexts. Synthesis of con- Fuzz testing. - how much was read: only abstract or first pages read - source - record id: `synthesis-of-infinite-state` - Synthesis of machine code from semantics. - what: Synthesis of Machine Code from Semantics ∗ Venkatesh Srinivasan Thomas Reps University of Wisconsin University of Wisconsin and Grammatech, Inc. venk@cs.wisc.edu reps@cs.wisc.edu In this paper, we present a technique to synthesize questions about the properties of binaries. Another potential machine-code instructions from a semantic specification, use of analysis results is to rewrite the binary via seman- given as a Quantifier-Free Bit-Vector (QFBV) logic for- tic transformations. - how much was read: only abstract or first pages read - source - record id: `synthesis-of-machine-code` - Synthesis of Temporal Causality. - what: . We present an automata-based algorithm to synthesize ω- regular causes for ω-regular effects on executions of a reactive system, such as counterexamples uncovered by a model checker. Our theory is a generalization of temporal causality, which has recently been proposed as a framework for drawing causal relationships between trace properties on a given trace. - how much was read: only abstract or first pages read - source - record id: `synthesis-of-temporal-causality` - Synthesis of Universal Safety Controllers. - what: . The goal of logical controller synthesis is to automatically compute a control strategy that regulates the discrete, event-driven be- havior of a given plant s.t. a temporal logic specification holds over all remaining traces. - how much was read: only abstract or first pages read - source - record id: `synthesis-of-universal-safety` - Synthesis Through Unification. - what: . Given a specification and a set of candidate programs (pro- gram space), the program synthesis problem is to find a candidate pro- gram that satisfies the specification. We present the synthesis through unification (STUN) approach, which is an extension of the counter- example guided inductive synthesis (CEGIS) approach. - how much was read: only abstract or first pages read - source - record id: `synthesis-through-unification` - Synthesizing Permissive Winning Strategy Templates for Parity Games. - what: . We present a novel method to compute permissive winning strategies in two-player games over finite graphs with ω-regular winning conditions. Given a game graph G and a parity winning condition Φ, we compute a winning strategy template Ψ that collects an infinite num- ber of winning strategies for objective Φ in a concise data structure. - how much was read: only abstract or first pages read - source - record id: `synthesizing-permissive-winning-strategy` - Synthesizing Robust Systems with RATSY - what: Synthesizing Robust Systems with RATSY∗ Roderick Bloem Hans-Jürgen Gamauf Georg Hofferek Bettina Könighofer Robert Könighofer Institute for Applied Information Processing and Communications (IAIK), Graz University of Technology, Austria Specifications for reactive systems often consist of environment assumptions and system guarantees. An implementation should not only be correct, but also robust in the sense that it behaves reasonably even when the assumptions are (temporarily) violated. We present an extension of the requirements analysis and synthesis tool RATSY that is able to synthesize robust systems from GR(1) specifica- tions, i.e., system in which a finite number of safety assumption violations is guaranteed to induce only a finite number of safety guarantee violations. - how much was read: only abstract or first pages read - source - record id: `synthesizing-robust-systems-with` - Syntroids: Synthesizing a Game for FPGAs using Temporal Logic Specifications. - what: —We present Syntroids, a case study for In this paper, we describe a case study in which we apply the automatic synthesis of hardware from a temporal TSL-based synthesis to the development of a non-trivial arXiv:2101.07232v1 [cs.LO] 18 Jan 2021 logic specification. Syntroids is a space shooter arcade arcade game. We develop Syntroids, a space shooter game game realized on an FPGA, where the control flow architecture has been completely specified in Temporal realized on an FPGA. - how much was read: only abstract or first pages read - source - record id: `syntroids-synthesizing-a-game` - System $F_{\omega }^{\mu }$$withContext-freeSessionTypes-what:.Westudyincreasinglyexpressivetypesystems,fromF\mu —anextensionofthepolymorphiclambdacalculuswithequirecursivetypes—toF\omega \mu ;—thehigher-orderpolymorphiclambdacalculuswithequirecur-sivetypesandcontext-freesessiontypes.Typeequivalenceisgivenbyastandardbisimulationdefinedoveranovellabelledtransitionsystemfortypes.-howmuchwasread:onlyabstractorfirstpagesread-[source](https://doi.org/10.1007/978-3-031-30044-8_{1}5)-recordid:‘system-f-mu-omega‘-TamingDelaysinDynamicalSystems-UnboundedVerificationofDelayDifferentialEquations.-what:.Delayedcouplingbetweenstatevariablesoccursregularlyintech-nicaldynamicalsystems,especiallyembeddedcontrol.Asitconsequentlyisomnipresentinsafety-criticaldomains,thereisanincreasinginterestinthesafetyverificationofsystemsmodelledbyDelayDifferentialEquations(DDEs).-howmuchwasread:onlyabstractorfirstpagesread-[source](https://doi.org/10.1007/978-3-030-25540-4_{3}7)-recordid:‘taming-delays-in-dynamical‘-TEMPEST-SynthesisToolforReactiveSystemsandShieldsinProbabilisticEnvironments.-what:.WepresentTempest,asynthesistooltoautomaticallycreatecorrect-by-constructionreactivesystemsandshieldsfromqualitativeorquantitativespecificationsinprobabilisticenvironments.Ashieldisaspe-cialtypeofreactivesystemusedforrun-timeenforcement;i.e.,ashieldenforcesagivenqualitativeorquantitativespecificationofarunningsys-temwhileinterferingwithitsoperationaslittleaspossible.-howmuchwasread:onlyabstractorfirstpagesread-[source](https://doi.org/10.1007/978-3-030-88885-5_{1}5)-recordid:‘tempest-synthesis-tool-for‘-TemporalLogicResilienceforCyber-PhysicalSystems-what:BABIPENDAHULUAN1.1LatarBelakangPenelitianPerkembanganglobalisasiyangsemakinpesatpadamasakinisecaranyatamemengaruhihubunganmasyarakatinternasionaldalamberbagaibidang,mulaidarisosial,ekonomi,politik,hinggabudaya.Eraglobalisasimembawaberbagaiperubahandalaminteraksiantarnegaradilingkunganinternasional(VeriDianaBaunYueletal.,2023).Perubahandieraglobalisasimenjadiperkembanganzamanyangpesatdalammengaburkanbatas-batasantarnegara,sehinggainteraksidalamsisteminternasionalmenjadisemakinterbukadanintensif.-howmuchwasread:onlyabstractorfirstpagesread-[source](https://doi.org/10.1109/cdc\mathrm{49753.2023.10384033})-recordid:‘temporal-logic-resilience-for‘-TemporalLogicsforHyperproperties-what:.Twonewlogicsforverificationofhyperpropertiesarepro-posed.Hyperpropertiescharacterizesecuritypolicies,suchasnoninter-ference,asapropertyofsetsofcomputationpaths.-howmuchwasread:onlyabstractorfirstpagesread-[source](https://doi.org/10.1007/978-3-642-54792-8_{1}5)-recordid:‘temporal-logics-for-hyperproperties‘-TemporalPropertyVerificationasaProgramAnalysisTask.-what:.Wedescribeareductionfromtemporalpropertyverificationtoaprogramanalysisproblem.Weproduceanencodingwhich,withtheuseofrecursionandnondeterminism,enablesoff-the-shelfprogramanalysistoolstonaturallyperformthereasoningnecessaryforprovingtemporalproperties(e.g.-howmuchwasread:onlyabstractorfirstpagesread-[source](https://doi.org/10.1007/978-3-642-22110-1_{2}6)-recordid:‘temporal-property-verification-as‘-TemporalStreamLogic:SynthesisBeyondtheBools.-what:.Reactivesystemsthatoperateinenvironmentswithcomplexdata,suchasmobileappsorembeddedcontrollerswithmanysensors,aredifficulttosynthesize.Synthesistoolsusuallyfailforsuchsystemsbecausethestatespaceresultingfromthediscretizationofthedataistoolarge.-howmuchwasread:onlyabstractorfirstpagesread-[source](https://doi.org/10.1007/978-3-030-25540-4_{3}5)-recordid:‘temporal-stream-logic-synthesis‘-Terminationandnon-terminationspecificationinference.-what:Tocapturetheterminationandnon-terminationbehaviorsofTechniquesforprovingterminationandnon-terminationofimper-eachprogram,Leetal.[32]hasrecentlyproposedanintegratedativeprogramsareusuallyconsideredasorthogonalmechanisms.specificationlogicwiththreetemporalpredicatesTermM,LoopInthispaper,weproposeanovelmechanismthatanalyzesandandMayLoop,whichdenote,respectively,thescenariosfordefiniteprovesbothprogramterminationandnon-terminationatthesameprogramtermination(withalexicographicrankingmeasureMmadetime.-howmuchwasread:onlyabstractorfirstpagesread-[source](https://doi.org/10.1145/2737924.2737993)-recordid:‘termination-and-non-termination‘-$$\text{textsc}HaliVer$$: Deductive Verification and Scheduling Languages Join Forces
  • what: . The HaliVer tool integrates deductive verification into the popular scheduling language Halide, used for image processing pipelines and array computations. HaliVer uses VerCors, a separation logic- based verifier, to verify the correctness of (1) the Halide algorithms and (2) the optimised parallel code produced by Halide when an optimisa- tion schedule is applied to an algorithm.
  • how much was read: only abstract or first pages read
  • source
  • record id: textsc-haliver-deductive-verification
• The Challenge of Typed Expressiveness in Concurrency
  • what: . By classifying behaviors (rather than data values), behav- ioral types abstract structured protocols and enforce disciplined message- passing programs. Many different behavioral type theories have been proposed: they offer a rich landscape of models in which types delin- eate concurrency and communication.
  • how much was read: only abstract or first pages read
  • source
  • record id: the-challenge-of-typed
• The Complexity of LTL Rational Synthesis.
  • what: . In rational synthesis, we automatically construct a reactive system that satisfies its specification in all rational environments, namely environments that have objectives and act to fulfill them. We complete the study of the complexity of LTL rational synthesis.
  • how much was read: only abstract or first pages read
  • source
  • record id: the-complexity-of-ltl
• The Different Shades of Infinite Session Types
  • what: . Many type systems include infinite types. In session type systems, infinite types are important because they specify communi- cation protocols that are unbounded in time.
  • how much was read: only abstract or first pages read
  • source
  • record id: the-different-shades-of
• The Integration of Testing and Program Verification
  • what: . Formal analysis techniques for software systems are becom- ing more and more powerful, and have been used on non-trivial exam- ples. We argue that the next step forward is to combine these different techniques in a single framework, which makes it possible to (i) analyse different parts of the system with different techniques, (ii) apply differ- ent techniques on a single component, and (iii) seamlessly combine the results of the various analysis.
  • how much was read: only abstract or first pages read
  • source
  • record id: the-integration-of-testing
• The Java Verification Tool KeY:A Tutorial.
  • what: . The KeY tool is a state-of-the-art deductive program verifier for the Java language. Its verification engine is based on a sequent calcu- lus for dynamic logic, realizing forward symbolic execution of the target program, whereby all symbolic paths through a program are explored.
  • how much was read: only abstract or first pages read
  • source
  • record id: the-java-verification-tool
• The Karlsruhe Java Verification Suite
  • what: . Thanks to the deductive verifier KeY, the formal verification of Java programs has a long-standing tradition at Karlsruhe. The design of KeY implies some properties that can restrict its use in real-world application cases: (1) Verifying long, code-intensive methods with many instructions or bit-wise operations is difficult even if their behaviour is not overly complex, and (2) tracking formal guarantees through unverified code is difficult if not impossible using KeY.
  • how much was read: only abstract or first pages read
  • source
  • record id: the-karlsruhe-java-verification
• The mCRL2 Toolset for Analysing Concurrent Systems - Improvements in Expressivity and Usability.
  • what: . Reasoning about the correctness of parallel and distributed systems requires automated tools. By now, the mCRL2 toolset and lan- guage have been developed over a course of more than fifteen years.
  • how much was read: only abstract or first pages read
  • source
  • record id: the-mcrl2-toolset-for
• The Quantitative Verification Benchmark Set.
  • what: . We present an extensive collection of quantitative models to facilitate the development, comparison, and benchmarking of new verifi- cation algorithms and tools. All models have a formal semantics in terms of extensions of Markov chains, are provided in the Jani format, and are documented by a comprehensive set of metadata.
  • how much was read: only abstract or first pages read
  • source
  • record id: the-quantitative-verification-benchmark
• The Session Abstract Machine
  • what: Machine Luı́s Caires1 and Bernardo Toninho2(B) 1 Técnico Lisboa / INESC-ID, Lisbon, Portugal luis.caires@tecnico.ulisboa.pt 2 NOVA FCT / NOVA LINCS, Costa da Caparica, Portugal btoninho@fct.unl.pt Abstract. We build on a fine-grained analysis of session-based interaction as provided by the linear logic typing disciplines to introduce the SAM, an abstract machine for mechanically executing session-typed processes. A re- markable feature of the SAM’s design is its ability to naturally segregate and coordinate sequential with concurrent session behaviours.
  • how much was read: only abstract or first pages read
  • source
  • record id: the-session-abstract-machine
• The VerCors Verifier: A Progress Report.
  • what: . This paper gives an overview of the most recent develop- ments on the VerCors verifier. VerCors is a deductive verifier for con- current software, written in multiple programming languages, where the specifications are written in terms of pre-/postcondition contracts using permission-based separation logic.
  • how much was read: only abstract or first pages read
  • source
  • record id: the-vercors-verifier-a
• The verified CakeML compiler backend
  • what: The CakeML compiler is, to the best of our knowledge, the most realistic verified compiler for a functional programming language to date. The architecture of the compiler, a sequence of inter- mediate languages through which high-level features are compiled away incrementally, enables verification of each compilation pass at an appropriate level of semantic detail. Parts of the com- piler’s implementation resemble mainstream (unverified) compilers for strict functional languages, and it supports several important features and optimisations.
  • how much was read: only abstract or first pages read
  • source
  • record id: the-verified-cakeml-compiler
• The WhyRel Prototype for Modular Relational Verification of Pointer Programs.
  • what: . Verifying relations between programs arises as a task in various verification contexts such as optimizing transformations, relating new versions of programs with older versions (regression verification), and noninterference. However, relational verification for programs acting on dynamically allocated mutable state is not well supported by existing tools, which provide a high level of automation at the cost of restricting the programs considered.
  • how much was read: only abstract or first pages read
  • source
  • record id: the-whyrel-prototype-for
• Theorem and Algorithm Checking for Courses on Logic and Formal Methods
  • what: Theorem and Algorithm Checking for Courses on Logic and Formal Methods∗ Wolfgang Schreiner Research Institute for Symbolic Computation (RISC) & Linz Institute of Technology (LIT) Johannes Kepler University, Linz, Austria Wolfgang.Schreiner@risc.jku.at The RISC Algorithm Language (RISCAL) is a language for the formal modeling of theories and algorithms. A RISCAL specification describes an infinite class of models each of which has finite size; this allows to fully automatically check in such a model the validity of all theorems and the correctness of all algorithms. RISCAL thus enables us to quickly verify/falsify the specific truth of propositions in sample instances of a model class before attempting to prove their general truth in the whole class: the first can be achieved in a fully automatic way while the second typically requires our assistance.
  • how much was read: only abstract or first pages read
  • source
  • record id: theorem-and-algorithm-checking
• Theta: Abstraction Based Techniques for Verifying Concurrency (Competition Contribution).
  • what: Theta: Abstraction Based Techniques for Verifying Concurrency (Competition Contribution) Levente Bajczi(B) ⋆, Csanád Telbisz , Márk Somorjai , Zsófia Adám ´ , Mihály Dobos-Kovács , Dániel Szekeres , Milán Mondok , and Vince Molnár Department of Measurement and Information Systems Budapest University of Technology and Economics, Budapest, Hungary bajczi@mit.bme.hu Abstract. Theta is a model checking framework, with a strong empha- sis on effectively handling concurrency in software using abstraction re- finement algorithms. In SV-COMP 2024, we use 1) an abstraction-aware partial order reduction; 2) a dynamic statement reduction technique; and 3) enhanced support for call stacks to handle recursive programs.
  • how much was read: only abstract or first pages read
  • source
  • record id: theta-abstraction-based-techniques
• Theta: Various Approaches for Concurrent Program Verification (Competition Contribution)
  • what: Theta: Various Approaches for Concurrent Program Verification (Competition Contribution) Csanád Telbisz , Levente Bajczi(B) , Dániel Szekeres , and András Vörös Department of Artificial Intelligence and Systems Engineering Budapest University of Technology and Economics, Budapest, Hungary csanadtelbisz@edu.bme.hu, {bajczi,szekeres,vori}@mit.bme.hu Abstract. Theta is a model checking framework with a strong em- phasis on effectively handling concurrency in software using abstraction refinement algorithms. In SV-COMP 2025, we complement our existing approach (abstraction-aware partial order reduction) for multi-threaded programs with a happens before propagator-based BMC check, expect- ing a significant increase in performance.
  • how much was read: only abstract or first pages read
  • source
  • record id: theta-various-approaches-for
• Time-Varying Soft-Maximum Control Barrier Functions for Safety in an A Priori Unknown Environment.
  • what: Time-Varying Soft-Maximum Control Barrier Functions for Safety in an A Priori Unknown Environment Amirsaeid Safari and Jesse B. Hoagg Abstract— This paper presents a time-varying soft-maximum information). For example, [22] uses a support vector machine composite control barrier function (CBF) that can be used to classifier to build a barrier function using safe and unsafe ensure safety in an a priori unknown environment, where local samples from LiDAR measurements.
  • how much was read: only abstract or first pages read
  • source
  • record id: time-varying-soft-maximum
• Toward Liveness Proofs at Scale
  • what: . While the problem of mechanized proof of liveness of reactive pro- grams has been studied for decades, there is currently no method of proving live- ness that is conceptually simple to apply in practice to realistic problems, can be scaled to large problems without modular decomposition, and does not fail unpre- dictably due to the use of fragile heuristics. We introduce a method of liveness proof by relational rankings, implement it, and show that it meets these criteria in a realistic industrial case study involving a model of the memory subsystem in a CPU.
  • how much was read: only abstract or first pages read
  • source
  • record id: toward-liveness-proofs-at
• Towards a Feature mu-Calculus Targeting SPL Verification
  • what: The modal µ -calculus µL is a well-known fixpoint logic to express and model check prop- erties interpreted over labeled transition systems. In this paper, we propose two variants of the µ -calculus, µL f and µL′f , for feature transition systems. For this, we explicitly incorporate feature expressions into the logics, allowing operators to select transitions and behavior restricted to specific products and subfamilies.
  • how much was read: only abstract or first pages read
  • source
  • record id: towards-a-feature-mu
• Towards a Framework for Developing Verified Assemblers for the ELF Format
  • what: . Most of the existing work on verified compilation leaves unverified the translation of assembly programs into binary code in object file formats (e.g., the Executable and Linkable Format or ELF). The challenges of developing verified assemblers come from the intrinsic com- plexities in low-level assembling processes caused by the need to support different computer architectures and their details, such as encoding a large number of instructions and verifying its correctness.
  • how much was read: only abstract or first pages read
  • source
  • record id: towards-a-framework-for
• Towards Parallel Boolean Functional Synthesis.
  • what: . Given a relational specification ϕ(X, Y ), where X and Y are sequences of input and output variables, we wish to synthesize each output as a function of the inputs such that the specification holds. This is called the Boolean functional synthesis problem and has applications in several areas.
  • how much was read: only abstract or first pages read
  • source
  • record id: towards-parallel-boolean-functional
• Towards verified construction of correct and optimised GPU software
  • what: time-consuming and frustrating. Proper techniques to make Techniques are required that support developers to produce the development and maintenance of GPU software more GPU software that is both functionally correct and high- insightful and less prone to introduce bugs, while helping performing. We envision an integration of push-button for- the developer to introduce performance optimisations, are mal verification techniques into a Model Driven Engineering lacking [43, 50, 73].
  • how much was read: only abstract or first pages read
  • source
  • record id: towards-verified-construction-of
• Traffic Network Control From Temporal Logic Specifications
  • what: —We propose a framework for generating a signal To overcome these scalability limitations, we identify and control policy for a traffic network of signalized intersections to exploit componentwise monotonicity [22] properties inherent accomplish control objectives expressible using linear temporal in flow networks such as traffic networks. These properties al- logic. By applying techniques from model checking and formal methods, we obtain a correct-by-construction controller that low efficient computation of bounds on the one-step reachable arXiv:1408.1437v2 [cs.SY] 21 Jun 2016 is guaranteed to satisfy complex specifications.
  • how much was read: only abstract or first pages read
  • source
  • record id: traffic-network-control-from
• Trainify: A CEGAR-Driven Training and Verification Framework for Safe Deep Reinforcement Learning.
  • what: . Deep Reinforcement Learning (DRL) has demonstrated its strength in developing intelligent systems. These systems shall be for- mally guaranteed to be trustworthy when applied to safety-critical domains, which is typically achieved by formal verification performed after training.
  • how much was read: only abstract or first pages read
  • source
  • record id: trainify-a-cegar-driven
• Training for Verification: Increasing Neuron Stability to Scale DNN Verification.
  • what: . With the growing use of deep neural networks(DNN) in mis- sion and safety-critical applications, there is an increasing interest in DNN verification. Unfortunately, increasingly complex network struc- tures, non-linear behavior, and high-dimensional input spaces combine to make DNN verification computationally challenging.
  • how much was read: only abstract or first pages read
  • source
  • record id: training-for-verification-increasing
• Transducer-Based Algorithmic Verification of Retransmission Protocols over Noisy Channels
  • what: . Unreliable communication channels are a practical reality. They add to the complexity of protocol design and verification.
  • how much was read: only abstract or first pages read
  • source
  • record id: transducer-based-algorithmic-verification
• TYPE-DRIVEN DEVELOPMENT OF CONCURRENT COMMUNICATING SYSTEMS
  • what: Modern software systems rely on communication; for example, mobile appli- cations communicating with a central server, distributed systems coordinating a telecommunications network, or concurrent systems handling events and pro- cesses in a desktop application. However, reasoning about concurrent programs is hard since we must reason about each process and the order in which commu- nication might happen between processes. In this paper, I describe a type-driven approach to implementing communicating concurrent programs using the de- pendently typed programming language Idris.
  • how much was read: only abstract or first pages read
  • source
  • record id: type-driven-development-of
• UCLID5: Multi-modal Formal Modeling, Verification, and Synthesis.
  • what: . UCLID5 is a tool for the multi-modal formal modeling, ver- ification, and synthesis of systems. It enables one to tackle verification problems for heterogeneous systems such as combinations of hardware and software, or those that have multiple, varied specifications, or sys- tems that require hybrid modes of modeling.
  • how much was read: only abstract or first pages read
  • source
  • record id: uclid5-multi-modal-formal
• Unbounded Scalable Verification Based on Approximate Property-Directed Reachability and Datapath Abstraction.
  • what: . This paper introduces the Averroes formal verification sys- tem which exploits the power of two complementary approaches: counter- example-guided abstraction and refinement (CEGAR) of the design’s datapath and the recently-introduced IC3 and PDR approximate reach- ability algorithms. Averroes is particularly suited to the class of hardware designs consisting of wide datapaths and complex control logic, a class that covers a wide spectrum of design styles that range from general- purpose microprocessors to special-purpose embedded controllers and accelerators.
  • how much was read: only abstract or first pages read
  • source
  • record id: unbounded-scalable-verification-based
• Undecidability of asynchronous session subtyping
  • what: Session types are used to describe communication protocols in distributed sys- tems and, as usual in type theories, session subtyping characterizes substi- tutability of the communicating processes. We investigate the (un)decidability of subtyping for session types in asynchronously communicating systems. We first devise a core undecidable subtyping relation that is obtained by imposing limitations on the structure of types.
  • how much was read: only abstract or first pages read
  • source
  • record id: undecidability-of-asynchronous-session
• Understanding Synthesized Reactive Systems Through Invariants.
  • what: . In many applications for which reactive synthesis is attrac- tive, computed implementations need to have understandable behavior. While some existing synthesis approaches compute finite-state machines with a structure that supports their understandability, such approaches do not scale to specifications that can only be realized with a large num- ber of states.
  • how much was read: only abstract or first pages read
  • source
  • record id: understanding-synthesized-reactive-systems
• Unifying Weak Memory Verification Using Potentials.
  • what: . Concurrency verification for weak memory models is inher- ently complex. Several deductive techniques based on proof calculi have recently been developed, but these are typically tailored towards a single memory model through specialised assertions and associated proof rules.
  • how much was read: only abstract or first pages read
  • source
  • record id: unifying-weak-memory-verification
• Unsatisfiability Proofs for Distributed Clause-Sharing SAT Solvers.
  • what: . Distributed clause-sharing SAT solvers can solve problems up to one hundred times faster than sequential SAT solvers by shar- ing derived information among multiple sequential solvers working on the same problem. Unlike sequential solvers, however, distributed solvers have not been able to produce proofs of unsatisfiability in a scalable man- ner, which has limited their use in critical applications.
  • how much was read: only abstract or first pages read
  • source
  • record id: unsatisfiability-proofs-for-distributed
• Unsatisfiability Proofs for Horn Solving
  • what: . Many verification tools currently rely on logic solvers as backend reasoning engines. Despite playing such a pivotal role, bugs are not uncommon in the complex codebases of these solvers.
  • how much was read: only abstract or first pages read
  • source
  • record id: unsatisfiability-proofs-for-horn
• Using ACL2 to Verify Loop Pipelining in Behavioral Synthesis
  • what: Using ACL2 to Verify Loop Pipelining in Behavioral Synthesis Disha Puri∗ Sandip Ray† Kecheng Hao∗ Fei Xie∗ Behavioral synthesis involves compiling an Electronic System-Level (ESL) design into its Register- Transfer Level (RTL) implementation. Loop pipelining is one of the most critical and complex transformations employed in behavioral synthesis. Certifying the loop pipelining algorithm is chal- lenging because there is a huge semantic gap between the input sequential design and the output pipelined implementation making it infeasible to verify their equivalence with automated sequential equivalence checking techniques.
  • how much was read: only abstract or first pages read
  • source
  • record id: using-acl2-to-verify
• Using Flow Specifications of Parameterized Cache Coherence Protocols for Verifying Deadlock Freedom
  • what: . We consider the problem of verifying deadlock freedom for symmet- ric cache coherence protocols. While there are multiple definitions of deadlock in the literature, we focus on a specific form of deadlock which is useful for the cache coherence protocol domain and consistent with the internal definition of deadlock in the Murphi model checker: we refer to this deadlock as a system- wide deadlock (s-deadlock).
  • limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review.
  • how much was read: only abstract or first pages read
  • source
  • record id: using-flow-specifications-of
• Using Formal Specifications to Support Model Based Testing ASDSpec: A Tool Combining the Best of Two Techniques
  • what: Using Formal Specifications to Support Model Based Testing ASDSpec: A Tool Combining the Best of Two Techniques A.P. van der Meer R. Kherrazi M.
  • limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review.
  • how much was read: only abstract or first pages read
  • source
  • record id: using-formal-specifications-to
• Using Ghost Ownership to Verify Union-Find and Persistent Arrays in Rust.
  • what: a function if the mutation is local: that is, variables handled The type system of Rust enforces the “shared xor mutable” by the function may only be modified by it. More generally, principle, which forbids mutation of shared memory. This tracking which aliases currently exist for those variables principle eases verification in Rust, but certain programs is essential.
  • how much was read: only abstract or first pages read
  • source
  • record id: using-ghost-ownership-to
• Using the proof assistant Lean in undergraduate mathematics classrooms
  • what: Using the Proof Assistant Lean in Undergraduate Mathematics Classrooms Gila Hanna1, Brendan Larvor2, Xiaoheng (Kitty) Yan1 1 The University of Toronto, Canada 2 The University of Hertfordshire, UK Abstract In this paper we develop a case for introducing a new teaching tool to undergraduate mathematics. Lean is an interactive theorem prover that instantly checks the correctness of every step and provides immediate feedback. Teaching with Lean might present a challenge, in that students must write their proofs in a formal way using a specific syntax.
  • limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review.
  • how much was read: only abstract or first pages read
  • source
  • record id: using-the-proof-assistant
• Value-Dependent Session Design in a Dependently Typed Language
  • what: Value-Dependent Session Design in a Dependently Typed Language Jan de Muijnck-Hughes Wim Vanderbauwhede Edwin Brady University of Glasgow University of St Andrews Jan.deMuijnck-Hughes@glasgow.ac.uk ecb10@st-andrews.ac.uk Wim.Vanderbauwhede@glasgow.ac.uk Session Types offer a typing discipline that allows protocol specifications to be used during type- checking, ensuring that implementations adhere to a given specification. When looking to realise global session types in a dependently typed language care must be taken that values introduced in the description are used by roles that know about the value. We present Sessions, a Resource Dependent Embedded Domain Specific Language (EDSL) for describing global session descriptions in the dependently typed language Idris.
  • how much was read: only abstract or first pages read
  • source
  • record id: value-dependent-session-design
• VeriAbs: A Tool for Scalable Verification by Abstraction (Competition Contribution)
  • what: VeriAbs: A Tool for Scalable Verification by Abstraction (Competition Contribution) Priyanka Darke? (B), Sakshi Agrawal, and R Venkatesh TCS Research, Pune, India {priyanka.darke, agrawal.sakshi4, r.venky}@tcs.com Abstract. VeriAbs is a strategy selection-based reachability verifier for C pro- grams.
  • how much was read: only abstract or first pages read
  • source
  • record id: veriabs-a-tool-for
• VeriAbs : Verification by Abstraction and Test Generation (Competition Contribution)
  • what: VeriAbs : Verification by Abstraction and Test Generation (Competition Contribution) Mohammad Afzal1, Supratik Chakraborty2 , Avriti Chauhan1, Bharti Chimdyalwar1, Priyanka Darke1,, Ashutosh Gupta2, Shrawan Kumar1, Charles Babu M3, Divyesh Unadkat1,2 , and R Venkatesh1 1 Tata Research Development and Design Center, Pune, India 2 Indian Institute of Technology, Bombay, India 3 Chennai Mathematical Institute, Chennai, India Abstract. VeriAbs is a strategy selection based reachability verifier for C code. It ana- lyzes the structure of loops, and intervals of inputs to choose one of the four verification strategies implemented in VeriAbs.
  • how much was read: only abstract or first pages read
  • source
  • record id: veriabs-verification-by-abstraction
• VeriAbsL: Scalable Verification by Abstraction and Strategy Prediction (Competition Contribution).
  • what: VeriAbsL: Scalable Verification by Abstraction and Strategy Prediction (Competition Contribution) Priyanka Darke1,?( ) , Bharti Chimdyalwar1, Sakshi Agrawal , Shrawan Kumar1, R Venkatesh1, and Supratik Chakraborty2 1 1 TCS Research, Pune, India priyanka.darke@tcs.com 2 Indian Institute of Technology, Bombay, India Abstract. We present VeriAbsL, a reachability verifier that performs ver- ification in three stages. First, it slices the input code using a combination of two slicers, then it verifies the slices using predicted strategies, and at last, it composes the result of verifying the individual slices.
  • how much was read: only abstract or first pages read
  • source
  • record id: veriabsl-scalable-verification-by
• VeriFast: A Powerful, Sound, Predictable, Fast Verifier for C and Java
  • what: . VeriFast is a prototype verification tool for single-threaded and multithreaded C and Java programs. In this paper, we first describe the basic symbolic execution approach in some formal detail.
  • limits: Abstract-level reading from openly available PDF; detailed limitations require full paper review.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifast-a-powerful-sound
• Verifiably Safe Off-Model Reinforcement Learning.
  • what: . The desire to use reinforcement learning in safety-critical set- tings has inspired a recent interest in formal methods for learning algo- rithms. Existing formal methods for learning and optimization primarily consider the problem of constrained learning or constrained optimiza- tion.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifiably-safe-off-model
• Verification-Aided Learning of Neural Network Barrier Functions with Termination Guarantees.
  • what: Verification-Aided Learning of Neural Network Barrier Functions with Termination Guarantees Shaoru Chen1 , Lekan Molu1 , Mahyar Fazlyab2 Abstract— Barrier functions are a general framework for establishing a safety guarantee for a system. However, there is no general method for finding these functions. To address this shortcoming, recent approaches use self-supervised learning techniques to learn these functions using training data that are arXiv:2403.07308v1 [cs.LG] 12 Mar 2024 periodically gen
  • how much was read: only abstract or first pages read
  • source
  • record id: verification-aided-learning-of
• Verification Algorithms for Automated Separation Logic Verifiers.
  • what: . Most automated program verifiers for separation logic use either symbolic execution or verification condition generation to extract proof obligations, which are then handed over to an SMT solver. Exist- ing verification algorithms are designed to be sound, but differ in perfor- mance and completeness.
  • how much was read: only abstract or first pages read
  • source
  • record id: verification-algorithms-for-automated
• Verification and Synthesis of Compatible Control Lyapunov and Control Barrier Functions.
  • what: Verification and Synthesis of Compatible Control Lyapunov and Control Barrier Functions Hongkai Dai∗1 , Chuanrui Jiang∗2 , Hongchao Zhang2 , and Andrew Clark2 Abstract— Safety and stability are essential properties of control systems. Control Barrier Functions (CBFs) and Control Lyapunov Functions (CLFs) are powerful tools to ensure safety and stability respectively. However, previous approaches typically verify and synthesize the CBFs and CLFs separately, arXiv:2406.18914v2 [eess.SY] 14 Sep 202
  • how much was read: only abstract or first pages read
  • source
  • record id: verification-and-synthesis-of
• Verification and Synthesis of Control Barrier Functions.
  • what: Verification and Synthesis of Control Barrier Functions Andrew Clark Abstract— Control systems often must satisfy strict safety control input is a “backup controller”, however, such methods requirements over an extended operating lifetime. Control may be conservative. A systematic approach to verification of Barrier Functions (CBFs) are a promising recent approach CBFs, as well as synthesizing CBFs with provable guarantees to constructing simple and safe control policies.
  • how much was read: only abstract or first pages read
  • source
  • record id: verification-and-synthesis-of-2
• Verification and Synthesis of Symmetric Uni-Rings for Leads-To Properties.
  • what: This paper investigates the verification and synthesis of parameterized protocols that satisfy leadsto properties R Q on symmetric unidirectional rings (a.k.a. uni-rings) of deterministic and constant- space processes under no fairness and interleaving semantics, where R and Q are global state predicates. First, we show that verifying R Q for parameterized protocols on symmetric uni-rings is undecidable, even for deterministic and constant-space processes, and conjunctive state predicates.
  • how much was read: only abstract or first pages read
  • source
  • record id: verification-and-synthesis-of-3
• Verification-guided Programmatic Controller Synthesis.
  • what: . We present a verification-based learning framework VEL that synthesizes safe programmatic controllers for environments with contin- uous state and action spaces. The key idea is the integration of pro- gram reasoning techniques into controller training loops.
  • how much was read: only abstract or first pages read
  • source
  • record id: verification-guided-programmatic-controller
• Verification of Deep Convolutional Neural Networks Using ImageStars.
  • what: . Convolutional Neural Networks (CNN) have redefined state- of-the-art in many real-world applications, such as facial recognition, image classification, human pose estimation, and semantic segmentation. Despite their success, CNNs are vulnerable to adversarial attacks, where slight changes to their inputs may lead to sharp changes in their output in even well-trained networks.
  • how much was read: only abstract or first pages read
  • source
  • record id: verification-of-deep-convolutional
• Verification of Indefinite-Horizon POMDPs.
  • what: The verification problem in MDPs asks whether, for any policy resolving the nondeterminism, the probability that something bad hap- pens is bounded by some given threshold. This verification problem is often overly pessimistic, as the policies it considers may depend on the complete system state. This paper considers the verification problem for partially observable MDPs, in which the policies make their decisions based on (the history of) the observations emitted by the system.
  • how much was read: only abstract or first pages read
  • source
  • record id: verification-of-indefinite-horizon
• Verification of Markov Decision Processes Using Learning Algorithms.
  • what: .We present a general framework for applying machine-learning algo- rithms to the verification of Markov decision processes (MDPs). The primary goal of these techniques is to improve performance by avoiding an exhaustive ex- ploration of the state space. Our framework focuses on probabilistic reachability, which is a core property for verification, and is illustrated through two distinct instantiations.
  • how much was read: only abstract or first pages read
  • source
  • record id: verification-of-markov-decision
• Verification of Quantitative Hyperproperties Using Trace Enumeration Relations.
  • what: . Many important cryptographic primitives offer probabilistic guarantees of security that can be specified as quantitative hyperproper- ties; these are specifications that stipulate the existence of a certain num- ber of traces in the system satisfying certain constraints. Verification of such hyperproperties is extremely challenging because they involve simul- taneous reasoning about an unbounded number of different traces.
  • how much was read: only abstract or first pages read
  • source
  • record id: verification-of-quantitative-hyperproperties
• Verified and Optimized Implementation of Orthologic Proof Search.
  • what: . We report on the development of an optimized and verified decision procedure for orthologic equalities and inequalities. This deci- sion procedure is quadratic-time and is used as a sound, efficient and predictable approximation to classical propositional logic in automated reasoning tools.
  • how much was read: only abstract or first pages read
  • source
  • record id: verified-and-optimized-implementation
• Verified Certification of Reachability Checking for Timed Automata.
  • what: . Prior research has shown how to construct a mechanically verified model checker for timed automata, a popular formalism for modeling real-time systems. In this paper, we shift the focus from verified model checking to certify- ing unreachability.
  • how much was read: only abstract or first pages read
  • source
  • record id: verified-certification-of-reachability
• Verified Compilation of Space-Efficient Reversible Circuits.
  • what: . The generation of reversible circuits from high-level code is an important problem in several application domains, including low- power electronics and quantum computing. Existing tools compile and optimize reversible circuits for various metrics, such as the overall cir- cuit size or the total amount of space required to implement a given function reversibly.
  • how much was read: only abstract or first pages read
  • source
  • record id: verified-compilation-of-space
• Verified Efficient Implementation of Gabow’s Strongly Connected Component Algorithm.
  • what: . We present an Isabelle/HOL formalization of Gabow’s al- gorithm for finding the strongly connected components of a directed graph. Using data refinement techniques, we extract efficient code that performs comparable to a reference implementation in Java.
  • how much was read: only abstract or first pages read
  • source
  • record id: verified-efficient-implementation-of
• Verified High Performance Computing: The SyDPaCC Approach
  • what: The SyDPaCC framework for the Coq proof assistant is based on a transfor- mational approach to develop verified efficient scalable parallel functional programs from specifications. These specifications are written as inefficient (potentially with a high computational complexity) sequential programs using some easily understandable predefined sequential function. We obtain efficient parallel programs implemented us- ing algorithmic skeletons that are higher-order functions implemented in parallel on distributed data structures.
  • how much was read: only abstract or first pages read
  • source
  • record id: verified-high-performance-computing
• Verified Timing Transformations in Synchronous Circuits with \lambda \pi -Ware.
  • what: . We define a DSL for hardware description, called λπ-Ware, embedded in the dependently-typed language Agda, which makes the DSL well-scoped and well-typed by construction. Other advantages of dependent types are that circuit models can be simulated and verified in the same language, and properties can be proven not only of spe- cific circuits, but of circuit generators describing (infinite) families of circuits.
  • how much was read: only abstract or first pages read
  • source
  • record id: verified-timing-transformations-in
• Verified validation of lazy code motion
  • what: by Pnueli et al. (1998b), provides a more systematic way to detect Translation validation establishes a posteriori the correctness of (at compile-time) semantic discrepancies between the input and a run of a compilation pass or other program transformation. In the output of an optimization.
  • how much was read: only abstract or first pages read
  • source
  • record id: verified-validation-of-lazy
• veriFIRE: Verifying an Industrial, Learning-Based Wildfire Detection System.
  • what: . In this short paper, we present our ongoing work on the ver- iFIRE project — a collaboration between industry and academia, aimed at using verification for increasing the reliability of a real-world, safety- critical system. The system we target is an airborne platform for wildfire detection, which incorporates two deep neural networks.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifire-verifying-an-industrial
• VeriFuzz 1.4: Checking for (Non-)termination (Competition Contribution).
  • what: VeriFuzz 1.4: Checking for (Non-)termination (Competition Contribution) Ravindra Metta , Prasanth Yeduru , Hrishikesh Karmarkar , and Raveendra Kumar Medicherla?( ) TCS Research, Tata Consultancy Services, Pune, India {r.metta,prasanth.yeduru,hrishikesh.karmarkar,raveendra.kumar}@tcs.com Abstract. In VeriFuzz 1.4, we implemented two new techniques for checking Non-termination and Termination. VeriFuzz 1.4 won the Ter- mination category of SV-COMP 2023.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifuzz-1-4-checking
• Verifying Array Manipulating Programs by Tiling
  • what: . Formally verifying properties of programs that manipulate arrays in loops is computationally challenging. In this paper, we focus on a useful class of such programs, and present a novel property-driven verification method that first infers array access patterns in loops using simple heuristics, and then uses this information to compositionally prove universally quantified assertions about arrays.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-array-manipulating-programs
• Verifying Array Manipulating Programs with Full-Program Induction.
  • what: . We present a full-program induction technique for proving (a sub-class of) quantified as well as quantifier-free properties of programs manipulating arrays of parametric size N . Instead of inducting over in- dividual loops, our technique inducts over the entire program (possibly containing multiple loops) directly via the program parameter N .
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-array-manipulating-programs-2
• Verifying component and connector models against crosscutting structural views.
  • what: typed input and output ports, and the connectors between The structure of component and connector (C&C) models, them. C&C models are used in many application domains which are used in many application domains of software en- of software engineering, from cyber-physical and embedded gineering, consists of components at different containment systems to web services to enterprise applications, as they levels, their typed input and output ports, and the connec- offer a physically distributed computation model as well as tors between them. C&C views, presented in [24], can be a logically distributed development process.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-component-and-connector
• Verifying Fairness in Quantum Machine Learning.
  • what: . Due to the beyond-classical capability of quantum comput- ing, quantum machine learning is applied independently or embedded in classical models for decision making, especially in the field of finance. Fairness and other ethical issues are often one of the main concerns in decision making.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-fairness-in-quantum
• Verifying Fault-Tolerance of Quantum Error Correction Codes.
  • what: . Quantum computers have advanced rapidly in qubit count and gate fidelity. However, large-scale fault-tolerant quantum comput- ing still relies on quantum error correction code (QECC) to suppress noise.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-fault-tolerance-of
• Verifying Fortran Programs with CIVL.
  • what: . Fortran is widely used in computational science, engineer- ing, and high performance computing. This paper presents an extension to the CIVL verification framework to check correctness properties of Fortran programs.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-fortran-programs-with
• Verifying Functional Correctness Properties at the Level of Java Bytecode.
  • what: . The breakneck evolution of modern programming languages aggra- vates the development of deductive verification tools, which struggle to timely and fully support all new language features. To address this challenge, we present B YTE BACK: a verification technique that works on Java bytecode.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-functional-correctness-properties
• Verifying Generalization in Deep Learning.
  • what: . Deep neural networks (DNNs) are the workhorses of deep learning, which constitutes the state of the art in numerous application domains. However, DNN-based decision rules are notoriously prone to poor generalization, i.e., may prove inadequate on inputs not encountered during training.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-generalization-in-deep
• Verifying Learning-Based Robotic Navigation Systems.
  • what: . Deep reinforcement learning (DRL) has become a dominant deep-learning paradigm for tasks where complex policies are learned within reactive systems. Unfortunately, these policies are known to be susceptible to bugs.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-learning-based-robotic
• Verifying Low-Level Implementations of High-Level Datatypes.
  • what: . For efficiency and portability, network packet processing code is typically written in low-level languages and makes use of bit-level op- erations to compactly represent data. Although packet data is highly structured, low-level implementation details make it difficult to verify that the behavior of the code is consistent with high-level data invari- ants.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-low-level-implementations
• Verifying LTL Properties of Hybrid Systems with K-Liveness.
  • what: . The verification of liveness properties is an important challenge in the design of real-time and hybrid systems. In contrast to the verification of safety properties, for which there are several solutions available, there are really few tools that support liveness properties such as general LTL formulas for hybrid systems, even in the case of timed automata.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-ltl-properties-of
• Verifying message-passing programs with dependent behavioural types.
  • what: Proceedings of the 40th ACM SIGPLAN Conference on Programming Concurrent and distributed programming is notoriously hard. Language Design and Implementation (PLDI ’19), June 22–26, 2019, Phoenix, AZ, USA. ACM, New York, NY, USA, 15 pages.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-message-passing-programs
• Verifying Neural Networks Against Backdoor Attacks.
  • what: . Neural networks have achieved state-of-the-art performance in solv- ing many problems, including many applications in safety/security-critical sys- tems. Researchers also discovered multiple security issues associated with neu- ral networks.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-neural-networks-against
• Verifying Relational Properties using Trace Logic.
  • what: Verifying Relational Properties using Trace Logic Gilles Barthe∗† , Renate Eilers‡ , Pamina Georgiou‡ , Bernhard Gleiss‡, Laura Kovács‡§ , Matteo Maffei‡ ∗ Max Planck Institute for Security and Privacy, Germany † IMDEA Software Institute, Spain ‡ TU Wien, Austria § Chalmers University of Technology, Sweden Abstract—We present a logical framework for the verification arXiv:1906.09899v3 [cs.LO] 12 Aug 2019 1 func main() of relational properties in imperative programs. Our frame- 2 { work reduces verification of relational properties of imperative 3 const Int[] a; programs to a validity problem in trace logic, an expressive 4 const Int alength; instance of first-order predicate logic. Trace logic draws its 5 expressiveness from its syntax, which allows expressing properties 6 Int i = 0; over computation traces.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-relational-properties-using
• Verifying Tree-Manipulating Programs via CHCs
  • what: . Programs that manipulate tree-shaped data structures often require complex, specialized proofs that are difficult to generalize and automate. This paper introduces a unified, foundational approach to veri- fying such programs.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-tree-manipulating-programs
• Verifying Verified Code
  • what: . A recent case study from AWS by Chong et al. proposes an effective methodology for Bounded Model Checking in industry.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-verified-code
• Verifying Whiley Programs with Boogie
  • what: The quest to develop increasingly sophisticated verification systems continues unabated. Tools such as Dafny, Spec#, ESC/Java, SPARK Ada and Whiley attempt to seamlessly inte- grate specification and verification into a programming language, in a similar way to type checking. A common integration approach is to generate verification conditions that are handed off to an automated theorem prover.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-whiley-programs-with
• Verifying x86 instruction implementations.
  • what: Verification of modern microprocessors is a complex task that requires a substantial allocation of resources. Despite significant progress in formal verification, the goal of complete verification of an in- dustrial design has not been achieved. In this paper, we describe a current contribution of formal methods to the validation of modern x86 microprocessors at Centaur Technology.
  • how much was read: only abstract or first pages read
  • source
  • record id: verifying-x86-instruction-implementations
• VeriQR: A Robustness Verification Tool for quantum Machine Learning Models.
  • what: . Adversarial noise attacks present a significant threat to quantum machine learning (QML) models, similar to their classical counterparts. This is especially true in the current Noisy Intermediate- Scale Quantum era, where noise is unavoidable.
  • how much was read: only abstract or first pages read
  • source
  • record id: veriqr-a-robustness-verification
• Verisig 2.0: Verification of Neural Network Controllers Using Taylor Model Preconditioning.
  • what: . This paper presents Verisig 2.0, a verification tool for closed- loop systems with neural network (NN) controllers. We focus on NNs with tanh/sigmoid activations and develop a Taylor-model-based reach- ability algorithm through Taylor model preconditioning and shrink wrap- ping.
  • how much was read: only abstract or first pages read
  • source
  • record id: verisig-2-0-verification
• VeSCMul: Verified Implementation of S-C-Rewriting for Multiplier Verification.
  • what: . Formal verification of multipliers is difficult. This paper pre- sents a custom tool, VeSCMul, designed to address this problem.
  • how much was read: only abstract or first pages read
  • source
  • record id: vescmul-verified-implementation-of
• VeyMont: Parallelising Verified Programs Instead of Verifying Parallel Programs.
  • what: . We present VeyMont: a deductive verification tool that aims to make reasoning about functional correctness and deadlock freedom of parallel programs (relatively complex) as easy as that of sequential programs (relatively simple). The novelty of VeyMont is that it “inverts the workflow”: it supports a new method to parallelise verified programs, in contrast to existing methods to verify parallel programs.
  • how much was read: only abstract or first pages read
  • source
  • record id: veymont-parallelising-verified-programs
• Visualizing Game-Based Certificates for Hyperproperty Verification.
  • what: . Hyperproperties relate multiple executions of a system and are commonly used to specify security and information-flow policies. While many verification approaches for hyperproperties exist, provid- ing a convincing certificate that the system satisfies a given property is still a major challenge.
  • how much was read: only abstract or first pages read
  • source
  • record id: visualizing-game-based-certificates
• VPN: Verification of Poisoning in Neural Networks.
  • what: . Neural networks are successfully used in a variety of appli- cations, many of them having safety and security concerns. As a result researchers have proposed formal verification techniques for verifying neural network properties.
  • how much was read: only abstract or first pages read
  • source
  • record id: vpn-verification-of-poisoning
• VyPR2: A Framework for Runtime Verification of Python Web Services.
  • what: . Runtime Verification (RV) is the process of checking whether a run of a system holds a given property. In order to perform such a check online, the algorithm used to monitor the property must induce mini- mal overhead.
  • how much was read: only abstract or first pages read
  • source
  • record id: vypr2-a-framework-for
• Weak Memory Model Formalisms: Introduction and Survey
  • what: Weak Memory Model Formalisms: Introduction and Survey ROGER C. SU, School of Computing, Australian National University, Australia ROBERT J. COLVIN, Defence Science and Technology Group, Australia and School of Electrical Engineer- ing and Computer Science, University of Queensland, Australia Memory consistency models define the order in which accesses to shared memory in a concurrent system may be observed to occur.
  • how much was read: only abstract or first pages read
  • source
  • record id: weak-memory-model-formalisms
• What causes a system to satisfy a specification?
  • what: Even when a system is proven to be correct with respect to a specification, there is still a question of how complete the specification is, and whether it really covers all the behaviors of the system. Cov- erage metrics attempt to check which parts of a system are actually relevant for the verification process to succeed. Recent work on coverage in model checking suggests several coverage metrics and algo- rithms for finding parts of the system that are not covered by the specification.
  • how much was read: only abstract or first pages read
  • source
  • record id: what-causes-a-system
• What’s Decidable About Program Verification Modulo Axioms?
  • what: . We consider the decidability of the verification problem of programs modulo axioms — automatically verifying whether programs satisfy their assertions, when the function and relation symbols are inter- preted as arbitrary functions and relations that satisfy a set of first-order axioms. Though verification of uninterpreted programs (with no axioms) is already undecidable, a recent work introduced a subclass of coherent uninterpreted programs, and showed that they admit decidable verifica- tion [26].
  • how much was read: only abstract or first pages read
  • source
  • record id: what-s-decidable-about
• What’s Hard About Boolean Functional Synthesis?
  • what: . Given a relational specification between Boolean inputs and outputs, the goal of Boolean functional synthesis is to synthesize each output as a function of the inputs such that the specification is met. In this paper, we first show that unless some hard conjectures in complex- ity theory are falsified, Boolean functional synthesis must generate large Skolem functions in the worst-case.
  • how much was read: only abstract or first pages read
  • source
  • record id: what-s-hard-about
• Wit4Java: A Violation-Witness Validator for Java Verifiers (Competition Contribution).
  • what: . We describe and evaluate a violation-witness validator for Java verifiers called Wit4Java. It takes a Java program with a safety property and the respective violation-witness output by a Java verifier to generate a new Java program whose execution deterministically vio- lates the property.
  • how much was read: only abstract or first pages read
  • source
  • record id: wit4java-a-violation-witness
• ZDD Boolean Synthesis.
  • what: . Motivated by applications in boolean-circuit design, boolean synthesis is the process of synthesizing a boolean function with multi- ple outputs, given a relation between its inputs and outputs. Previous work has attempted to solve boolean functional synthesis by converting a specification formula into a Binary Decision Diagram (BDD) and quan- tifying existentially the output variables.
  • how much was read: only abstract or first pages read
  • source
  • record id: zdd-boolean-synthesis
• Zonotope-Based Symbolic Controller Synthesis for Linear Temporal Logic Specifications
  • what: —This paper studies the controller synthesis problem symbolic abstraction, the controller is synthesized to be correct for nonlinear control systems under linear temporal logic (LTL) by design [8], and the formal verification may be unnecessary. specifications using zonotope techniques. A local-to-global control In the abstraction-based control approach, the bottom-up strategy is proposed for the desired specification expressed as arXiv:2405.00924v1 [eess.SY] 2 May 2024 an LTL formula.
  • how much was read: only abstract or first pages read
  • source
  • record id: zonotope-based-symbolic-controller
• Formalizing the Bruck–Ryser–Chowla Theorem: Combinatorial Design Theory in Lean (2026)
  • what: Reports Lean4 formalization of combinatorial designs, Fisher’s rank inequality, both directions of Kramer–Mesner for general t-designs, and even/odd Bruck–Ryser–Chowla necessary conditions for symmetric BIBDs. Develops reusable counting, incidence-matrix, congruence/direct-sum and quadratic-form Witt-cancellation infrastructure. Describes proof/representation choices and human-written proof code; AI assisted prose/documentation/literature lookup only. Records the exact design hierarchy and finiteness boundaries, Fisher hypotheses and fair comparison scope, orbit multiplicity semantics, even/odd BRC proof routes, typed-index associativity workaround, reflection-based Witt cancellation, rational-to-integer conversion, concrete examples and author-reported development size. Finds printed Theorem11 omits λ>0; current-main source includes it. Separates already proved mathematics from a future executable certified construction pipeline.
  • limits: Design ι X stores indexed finite blocks, permitting repetitions through different indices. Base point type need not be finite; significant cardinality/counting/rank results use finite types and decidability. BIBD is a 2-design with 2≤k<v; a nontrivial RPBD only requires one block with size strictly between0 andv, not uniform size or λ>0. Representation equivalence to finite multisets is asserted under finite point/index types, not arbitrary infinite families. Theorem3/4 replication r=λ(v−1)/(k−1), bk=vr; symmetric means number of blocks equals number of points, not a symmetric incidence matrix. Incidence M has points as rows, block indices as columns. MMᵀ=λJ+(r−λ)I encodes regularity/pair balance. rpbdCondition is definable over a ring, but reading modular equality as equality of natural counts requires an injective natural-number interpretation; the printed predicate alone does not prove an unrestricted-ring combinatorial equivalence. Fisher theorem for a nontrivial RPBD: λ<r from a nontrivial block, determinant nonzero, v=rank(MMᵀ)≤rank(M)≤b. Printed Lean theorem explicitly needs an ordered field (Field, LinearOrder, IsStrictOrderedRing), not any field of positive characteristic. Symmetric b=v gives invertible incidence matrix. Printed Theorem11 says any nontrivial RPBD with b=v is a BIBD, but this is false under the stated definitions without λ>0: on X={0,1,2}, take each singleton as one block; r=1, λ=0, b=v=3 and blocks are nonempty proper subsets, but k=1 violates2≤k. Targeted current-main source symmNontrivialRPBD_to_symmBIBD explicitly has (hl : l > 0). Its uniformity argument still works at λ=0; the missing positivity matters for the BIBD size condition. This is a printed-statement omission, not a Lean-kernel failure. Kramer–Mesner assumes finite group acting on finite X, k<v and t≤k. Its matrix has k-subset orbits as rows and t-subset orbits as columns: a_ij counts members of k-orbit i containing a representative of t-orbit j; nonnegative integer row vector z satisfies zA=λ·ones. For repeated blocks, invariance must preserve multiplicity throughout an orbit, stronger than support closure alone. Current-main IsGInvariant compares complete block multisets after each group action and does preserve multiplicities. BRC is necessary, not sufficient, for existence of symmetric(v,k,λ)-BIBD: evenv requires k−λ square; oddv requires a nonzero integer triple satisfying x²=(k−λ)y²+(−1)^((v−1)/2)λz². Printed Lean uses BIBD X X and Inhabited X. No general design-existence decision procedure follows. Congruence M∼N means M=ANAᵀ for invertibleA. Its quadratic-form forward implication holds over any field and arbitrary matrices; reverse needs symmetric matrices and characteristic≠2. Direct sums use disjoint-sum index types; associativity requires transport since index types are isomorphic rather than definitionally identical. Authors reject cumbersome heterogeneous congruence in favor of homogeneous congruence with matched reassociation lemmas. Four-square lemma: characteristic-zero field, dimension divisible by4 and positive integer multiplier m imply mI∼I. Witt cancellation operates over fields with2 invertible, via quadratic-form isometries and weighted-squares decomposition; the transferred matrix result needs symmetric survivingN/P but not cancelledM. The paper gives proof sketches and snippets with by…, rather than full source proofs. Author-reported absence of sorry/axiom is local-development evidence, not a claim that Lean/Mathlib use no foundational axioms or that this reading reproduced a build. Novelty/first-formalization claims are attributed to authors, not independently exhaustive historical findings. Four linear-algebra files are intended for Mathlib contribution; integration is not reported complete. Artifact software link and Software Heritage directory identifier are supplied. Targeted source inspection used current-main commit2f5c3f801e575a535881e8533750779c7074295f and lean-toolchain v4.27.0, not a verified match to paper archive f89852141f28ef205935f5f7d5f22c1e5dbf0bac. No build, full axiom dependency audit, timing benchmark or generated-proof agent evaluated.
  • how much was read: reading depth not recorded
  • source
  • record id: formalizing-the-bruck-ryser-2026
• Galois essential post (2026)
  • title: Formal Verification Has Become Essential: Let’s Solve the Last Bottlenecks
  • what: Calls for common semantics and verified translation across the whole software stack.
  • limits: A proposed direction. CompCert, seL4 and HACL* are earlier examples built by humans.
  • how much was read: reading depth not recorded
  • source; notes: Galois vision and benchmark initiatives: proposals, not completed kern
  • record id: galois-essential-post-2026
• Nitro Isabelle post (2026)
  • title: Isabelle/HOL: The proof assistant behind the Nitro Isolation Engine
  • what: Background on how Isabelle/HOL is used for foundational proofs about the Nitro Isolation Engine.
  • limits: The review notes found no mention of LLMs or agents in the article body.
  • how much was read: reading depth not recorded
  • source; notes: AWS: production proofs exist; published accounts do not attribute them
  • record id: nitro-isabelle-post-2026
• Formalizing the Cholesky Factorization Theorem (2024)
  • what: Reports ACL2(r) proof that, for square symmetric A satisfying recursive positive-definite-p, the lower triangular part L of chol(A) obeys L L^T=A. Uses L as a witness for a Skolemized existence theorem. Develops partitioned-matrix support and a Schur-complement recognizer structurally aligned with chol to guide induction/rewrite automation. The bridge from this recognizer to ordinary quantified positive definiteness is justified informally in the paper, not established by a displayed machine theorem; floating-point backward-error/stability verification remains future work. Tracks exact theorem predicates, executable-versus-logical square-root distinction, totalization/guards, unchanged upper triangle, source-level witness and auxiliary hints. Records informal-equivalence boundary, a false printed determinant identity, proof-resource measurements and absence of a verified approximation/error theorem for chol-exec. These details prevent conflating an exact logical decomposition proof with floating-point numerical safety.
  • limits: Real square symmetric input is intended. Standard positive definiteness means v^T A v>0 for every nonzero compatible realv; the formal theorem instead assumes positive-definite-p(A), symmetry and equal row/column counts. Its recursive recognizer excludes nonmatrices/nonreal or nonpositive pivots, accepts the empty matrix and descends through rank-one Schur complements. The paper’s introductory phrase about positivity of diagonals of principal submatrices must be read as positivity of successive Schur pivots, not merely positive original diagonal entries. Partition A=[[α,a12^T],[a21,A22]]. Set λ=sqrtα>0, l=a21/λ, recursively factor S=A22−l l^T. chol stores updated diagonal/lower column and recursively processed trailing block while retaining original upper rowa12; therefore chol(A) itself is generally not lower triangular. Correct output factor is get-L(chol(A)). The equality proof uses symmetry a12=a21 to recover off-diagonal blocks and align recognizer and algorithm updates. ACL2 logical functions are total. Program1 returns an empty matrix for nonmatrix input, unchanged empty input, or same-dimension zero matrix for nonreal/nonpositive pivot. It handles nonsquare row/column cases for logic admission even though useful correctness is restricted. Program1 execution guards require matrixp, squareness and symmetry; they do not themselves assert positive definiteness. Guard checking is not a proof that arbitrary input is SPD. Logic/execution split uses mbe; equivalence must hold under verified guards. mbt is logically its argument but evaluates as true in runtime mode once guards justify skipping the check. The declaration’s dimension measure decreases through the trailing block. This is a functional list representation, not a demonstrated C/Rust memory-safety/in-place destructive-update proof. Program2 positive-definite-p has only matrix/square guards and does not enforce symmetry; Program3 adds symmetry explicitly. It scales botha12/a21 bysqrtα and updates with out-(a12,a21), while chol uses out-(a21,a21). Equality follows under symmetry. The recognizer name alone does not guarantee ordinary SPD for arbitrary nonsymmetric matrices; e.g. [[1,100],[0,1]] is accepted by its pivot recurrence yet has a negative quadratic form at(1,−1). This reader example explains necessity of theorem’s symmetry hypothesis. §4.2 invokes Sylvester’s criterion and Schur-complement positivity from cited textbook, then explicitly gives an informal proof of Algorithm2 recognizer equivalence. No displayed ACL2 theorem equates positive-definite-p to quantified v^TAv>0 or positive leading determinants. Targeted chol.lisp contains the recursive predicate and decomposition/existence theorems, not this classical-equivalence theorem. This is a semantic bridge justified by mathematics outside the shown mechanization, not an independently machine-checked equivalence. Equation2 p10 is false as printed: it substitutes a21^T a12/det(A11) for a21^T A11^(-1)a12 and also mixes α11/α22. In general inverse(A11) is not I/det(A11). Correct Schur formula uses the inverse and the appropriate scalar blockα22. Reader symmetric SPD example A11=diag(2,3), a12=a21=(1,0), α22=4 gives determinant21, while the inverse-to-determinant substitution gives23. The correct Proposition5 can justify the recognizer; this erroneous informal identity does not refute the conditional ACL2 theorem. Algorithm1 p5 swaps row/column base-case conditions relative to n×m dimensions: n1 displays a column and m1 a row. Its column scale usesα^(-1) rather than(√α)^(-1), and row expression usesa21 wherea12 is appropriate. Program1 p8 and inspected source use actual empty-column/row tests and sqrt scaling. These printed rectangular-case slips do not affect the square-SPD theorem’s1×1 branch; do not implement raw Algorithm1 literally. Program4 uses defun-sk to express existence of lower-triangularL with LL^T=A. Program5 sufficiency theorem is automatically introduced; Program6 instantiates it with get-L(chol(A)). This establishes existence under the same recursive-predicate hypotheses. It does not establish uniqueness, positive-diagonal uniqueness, an optimized linear solver, a normal-equation solver or an asymptotic complexity theorem. ACL2(r) supplies exact logical real square roots via nonstandard analysis. §5 describes alternative chol-exec using sqrt-iter and cites convergence of the scalar approximation, but does not give a matrix-level error bound or factorization correctness for a finite tolerance. Targeted current source retains :verify-guards nil for chol-exec and comments that sqrt-iter guard verification is unresolved/a placeholder. The exact chol-correctness theorem is about chol with acl2-sqrt, not chol-exec(A,eps). Scalar convergence alone does not establish a verified stable numerical decomposition. Paper calls algorithm in place at the block-derivation level, but actual matrices are lists of lists and future work proposes stobjs/destructive assignment. No verified relation to raw memory layout or compiled numerical library is shown. Reducing symmetric updates to one triangle, HouseholderQR, norms, backward-error analysis and floating-point numerical correctness are future directions. Current source pinned at4559795a382a0d8df695c686f928df322933fae5, targeted entirechol.lisp/README read. Paper cites SoftwareHeritage directory59ed119089ee943a78fe019c760fc4f75046e663; equality to current source not established. Supporting mlayers/msym/msplice/mout and imported sqrt/matrix books not fully audited. No certification/build or axiomatic trust audit performed. Authors’ first-formalization and comparative library/executability claims are historical assessments, not an independently exhaustive/current survey. Human-developed invariant, recognizer, supporting rewrites and witness hint drive automation; “largely automatic” does not mean no human proof engineering. No LLM-assisted derivation or comparative agent evaluation. Application paragraph’s least-squares B^T B is positive definite only if B has full column rank; the text does not state that assumption explicitly. General rank-deficient normal equations cannot use this SPD theorem without further treatment. No application experiment demonstrates solving real systems or least squares.
  • how much was read: reading depth not recorded
  • source
  • record id: formalizing-the-cholesky-factorization-2024
• Towards Solid Abelian Groups: A Formal Proof of Nöbeling’s Theorem (2024)
  • what: Formalizes in Lean4/Mathlib that the integer module of locally constant maps from any profinite space S to Z is free. Since Z is discrete this is the group C(S,Z) of continuous maps. Constructs a basis by well-ordering all clopen coordinates, selecting finite Boolean coordinate products not generated by earlier products, proving spanning through finite quotients and proving independence by ordinal induction. Supplies a detailed mathematical exposition and explains implementation choices and integration into Mathlib. Reconstructs the Boolean-product basis, spanning argument, exact sequence and three ordinal cases; tracks fixed ambient coordinates, closed-cover pasting contracts and well-founded recursion. Separates the proved profinite special case from the original bounded-function theorem and future structural results for solid condensed groups. Records actual final Lean statement and noncomputable basis, targeted pinned-source scope, qualitative code-size reports and lack of experimental comparison.
  • limits: Profinite means totally disconnected, compact and Hausdorff. No finite/countable or nonempty assumption on S. Integers carry the discrete topology. A free Z-module means a basis giving unique finite integer linear combinations; it is an algebraic assertion, not freeness as a topological group. Original Nöbeling theorem concerns bounded integer-valued functions on any set; this paper formalizes the profinite continuous-function special case, not that stronger statement. Any profinite S embeds as a closed subset of Bool^I by indicators of all clopen subsets. Total separation gives injectivity; continuity and compact-to-Hausdorff give closed embedding. A well-order on I uses classical choice. The basis is noncomputable; neither the theorem nor proof is an algorithm to enumerate a basis for an arbitrary profinite input. Products P are finite strictly decreasing lists in I, ordered lexicographically; empty product is1. eval multiplies 0/1 coordinate indicators. E(S) consists of products whose evaluations are outside the Z-span of all earlier evaluations. This greedy definition alone does not guarantee independence for arbitrary Z-generators; special Boolean geometry and ordinal argument establish it here. Projection πJ preserves coordinates in J and zeroes the rest, with source and target the same full product Bool^I. It does not change coordinate type to J. SJ is its image. Precomposition C(SJ,Z)→C(S,Z) is injective because the projection onto its image is surjective. Good products on SJ cannot contain a coordinate outside J, since their evaluation would be0. Spanning: P is well-ordered, so induction eliminates a non-good product through earlier products. S is the cofiltered limit of its images SJ for finite J; bijectivity uses separation by individual coordinates and directed closed compact nonempty fibers, with generalized Cantor intersection. Every continuous map into discrete Z factors through a finite quotient. Finite point-delta functions are products of ei or(1−ei), whose expansions are integer combinations of P. Ordinal induction fixes I throughout and proves independence, separately from already proved spanning. Predicate Q(μ) quantifies over all closed S⊆Bool^I with every true coordinate index<μ, for μ≤the order type of I. Merely saying E(S) is a basis while changing I does not specify the induction hypothesis used by this proof. The author identifies that ambiguity in earlier informal exposition. Zero case: S supported below0 is empty or the singleton false vector. Empty S yields the zero module and empty good-product basis; singleton yields the empty product1 as its basis. For a limit μ every finite product is supported below some μ′<μ, so E(Sμ) is a directed union of earlier good products; injective pullbacks preserve independence and directed unions of independent subsets are independent. Successor μ+1: split S by μ-coordinate into S0/S1 and put S′=S0∩πμ(S1), supported belowμ. Define g(f)(x)=f(x with coordinateμ set1)−f(x with coordinateμ set0). The sequence0→C(Sμ,Z)→C(S,Z)→C(S′,Z) is left exact: first map injective and its image is ker g. No terminal0 or surjectivity of g is claimed/needed. Kernel factorization pastes the restrictions on closed sets S0 and πμ(S1), agreeing on their intersection. Good products split into old E(Sμ) and new products startingμ. For newp, g(eval p)=eval(tail p) on S′. Contraposition plus exactness/spanning shows tail p is good on S′; the tail map on products startingμ is injective. Independence on both sides and the commutative left-exact diagram imply independence of the combined family. Printed Lemma38 defers its case proof to linked Lean, rather than giving all proof steps on paper. Lean Products I is a subtype of lists satisfying Chain′(>); adjacency plus transitivity yields strict decrease. GoodProducts.isGood tests nonmembership in Submodule.span of earlier evaluations. The final source combines GoodProducts.linearIndependent with GoodProducts.span through Basis.mk, then transports freeness across the clopen-coordinate closed embedding. LocallyConstant.piecewise pastes maps on two closed sets covering the whole ambient space, assuming agreement on the intersection and decidable membership. Variant piecewise′ allows C0⊆C1∪C2 with all sets in one ambient X and returns a map on C0. This avoids recasting the fixed Boolean ambient space as a nested subtype during induction. Printed isLocallyConstant:=omitted abbreviates exposition; it is not evidence of an admitted theorem in source. Paper links pin Mathlib commit ba9f2e5baab51310883778e1ea3b48772581521c. Saved the entire Nobeling.lean file at this immutable URL, but only introduction, relevant definitions and final proof sections were read. No dependency audit, admission/axiom audit, archive equivalence check, build or kernel execution performed. Nobeling_aux has an inhabited-coordinate context; final coordinates are clopen sets, inhabited by the empty clopen even when S is empty. Solid condensed group motivation is a future application. Define Z[S]^solid=lim Z[Si] over finite quotients; solid A means every map from free condensed Z[S] to A uniquely extends along Z[S]→Z[S]^solid. Combining discreteness characterization with Nöbeling gives a product-of-Z structural result in the mathematics, but paper says Lean3 supporting code must still be ported to Lean4 before formalizing that result in Mathlib. Do not credit this paper with a completed Lean4 solid-group construction. Author reports informal proof21 lines versus formal1500–3000 lines depending on prerequisites, and a P-well-order proof near300 lines replaced by one ten times shorter. These are qualitative code-size comparisons with differing boundaries, not controlled measurements of effort/performance. Author calls comparison with full expanded §4 fairer. Mathlib reviewers improved style/performance but no timing or measured speedup is supplied. Development used a Mathlib branch and new files to avoid repeated deep import rebuilds; later fully integrated into Mathlib. Maintaining one library definition per concept and reviewed integration are reported workflow benefits. Claims about first external Mathlib ordinal-induction use, LTE history and condensed development status are author statements at publication time, not independently verified current facts. No LLM authorship, protocol/distributed implementation, Verus/Rust or TLA+ experiment. No substantive counterexample to the main theorem identified in this reading. Minor printed slips: Lemma27 asks for an element of C where S is intended; Lemma28 writes fji where point delta fx is intended. The well-order proof is explicitly a sketch, and author says its formal implementation is the one proof differing significantly from the exposition.
  • how much was read: reading depth not recorded
  • source
  • record id: towards-solid-abelian-groups-2024
• Formalization of a Stochastic Approximation Theorem (2022)
  • what: Classical Coq formalization of regular and extended real-valued Dvoretzky stochastic-approximation convergence theorems, using the Derman–Sacks proof. A conditional-mean-zero noise process with summable second moments converges almost surely under a drift bound with vanishing error, summable multiplicative slack and divergent cumulative decrease. Supporting infrastructure includes general probability spaces, almost-everywhere reasoning, expectations, Lp spaces, conditional expectations and filtrations. Records every main theorem hypothesis, deterministic versus stochastic drift and nonmeasurable auxiliary controls, pointwise versus almost-sure assumptions, proof dependence on conditional-expectation factorization, du Bois-Reymond weighted-series lemma, Borel–Cantelli/Chebyshev and a deterministic backward-iteration argument. Preserves actual classical axioms, library representation choices and the distinction between mathematical applications and completed algorithm formalization.
  • limits: §2 Theorem4: Probability space(Ω,F,P), increasing filtration Fn⊆F, Fn-adapted real Xn, measurable deterministic history function Tn:R^n→R, noise Wn measurable at time n+1 and Xn+1=Tn(history)+Wn. Noise has E[Wn|Fn]=0 almost surely and sum E[Wn²]<∞. Noise need not be independent across times. Each second moment must be finite in the inspected formal source. §2 Theorem4: Fixed real target x*, nonnegative real sequences αn,βn,γn with αn→0,sumβn finite,sumγn=+∞. Drift condition for all histories:|Tn(history)−x*|≤max(αn,(1+βn)|xn−x*|−γn). Conclusion is Xn→xalmost surely, not just in probability, and not a finite-time bound, convergence rate or numeric implementation guarantee. §2 Theorem5/§4.2: Tn may be stochastic with its realized process Fn-adapted; α/β/γ become Ω→R functions and their limit/sum hypotheses hold almost surely. They are not required to be Fn-measurable; footnote6 says that original revisited-paper assumption was unused. Final source still assumes nonnegativity and the drift bound pointwise for all n,ω, while only asymptotic limit/sum conditions are almost sure. Do not weaken every source premise to almost everywhere merely because §4.2 uses that phrase broadly. Inspected source Results: Regular history map is vector R n→R with measurable-vector premise; extended map is(vector R n×Ts)→R and requires adaptedness of realized T. Both final corollaries construct X from X0,T,W and assume adapted X; H16 bounds only realized T′n(ω),X′n(ω), a weaker sufficient condition than the paper’s all-histories presentation. vector refers to the list of scalar history values, not a multidimensional/Hilbert-valued convergence theorem. §4.2: Alternative bound|max drift|≤max(αn,(1+βn−γn)|xn−x|) is also formalized with remaining hypotheses intact, using an Abel-type rescaling of divergent positive series. This is a separate convenient corollary, not an unconditional relaxation of every standard drift condition. §3.1: pre_events are predicates Ts→Prop; sigma algebras close under countable union/complement/fullspace; events package membership proofs in a dependent pair. Probability spaces use nonnegative countably additive measures with mass1. Borel generation by half-open intervals/open sets is proved equivalent; generated sigma algebra intersection and inductive closure are equivalent so proofs can use induction. §3.2: almost P means P contains a measurable event of probability1, so P itself need not be measurable. almostR2 lifts an arbitrary binary relation and inherits suitable order properties. This definition is relevant to auxiliary control functions without measurability hypotheses; it does not silently assume a completed measure space. §3.3: Expectation is built from finite-range and nonnegative functions, then positive/negative parts. option Rbar distinguishes undefined infinity differences(None),finite expectations and signed infinity. The library extends Coquelicot limits to extended-real-valued sequences using coinciding inf/sup limits, avoiding direct use of a uniform-space filter construction. FiniteExpectation packages well-defined finite values to simplify side conditions. §3.4: Quotient random variables by almost-everywhere equality so the norm is definite. Paper reports Lp module/Banach results and Hilbert structure for L2. It prints IsLp with real exponent n and also mentions p=∞; no independent source inspection of the infinity endpoint was made. Extensionality and choice principles listed in footnote7 support the quotient; this is not an axiom-free constructive library. §3.5: Conditional expectation first has an indicator-integral universal property, uniqueness only almost everywhere, linearity/tower/factor-out/monotonicity/Jensen. Existence starts with L2 orthogonal projection using the Lax–Milgram Hilbert library, chooses an equivalence-class representative, approximates nonnegative L1 functions with min(f,n), and takes a limit. A wrapper adjusts null-set representatives to make simple properties exact where possible. §3.5: General conditional-expectation function can be defined broadly but the defining universal property is proved only for nonnegative or finite-expectation functions; an arbitrary signed nonintegrable function is not automatically covered. FiniteConditionalExpectation returns real values under finite-expectation premises. The paper reports contraction on Lp and L2-loss minimization, not executable sampling or an algorithm for evaluating conditional expectations. §§3.6–3.8: Filtrations/adaptedness encode available history. Library begins martingale theory but does not claim every martingale theorem. Finite-range value lists may contain duplicates/extraneous values. General random variables are supported, but product-space constructions and monotone convergence are limited to probability measures; general measure theory is only partial groundwork. §4.1: du Bois-Reymond lemma for nonnegative an:sum an converges iff some positive bn→∞ has sum an bn finite. Existing proofs assumed strictly positive terms or an unavailable integral test; formal proof handles zero terms/cases and uses a Rudin exercise. This supplies a vanishing threshold α with sum E[Wn²]/αn² finite, not an extra original noise assumption. §4.1: Center target at0 and set Zn=Wn sign(Tn). Measurability/adaptedness and conditional-mean-zero factor-out give the orthogonality needed for a Loève series theorem; summable second moments imply sum Zn converges almost surely. Chebyshev+Borel–Cantelli give eventual |Zn|≤αn. Then |Xn+1|≤max(2αn,(1+βn)|Xn|+Zn−γn) eventually almost surely. §4.1 Lemma8: Nonnegative a,b,c,ξ; a→0,sumb finite,sumc divergent,sumδ convergent(δ need not be nonnegative); eventual ξn+1≤max(an,(1+bn)ξn+δn−cn) implies ξ→0. Proof iterates backward, uses finite products/list maxima and Abel descending convergence. A separate random exceptional set must be removed before applying this deterministic pathwise statement. Classical assumptions: Coq standard real-number axioms, functional/propositional extensionality and constructive definite description(unique choice) for quotienting are explicitly reported; proof also invokes constructive indefinite description for a classical sequence case split. Similar names do not mean computationally constructive extraction. No complete transitive axiom audit or independent compilation was performed. §1 examples are motivation: sample mean, deterministic contraction/Bellman iteration and SGD/root estimation illustrate mathematical applicability. The formal main result is scalar and conditional. Q-learning convergence is explicitly future work in §6; no completed distributed RL implementation, verified optimizer executable, machine learning experiment or asymptotic rate is evaluated. §1 Example3 claims differentiation commutes with expectation because it is linear, even while the sampling distribution may depend on x. Linearity alone is insufficient: differentiating an x-dependent measure adds a term, and exchanging derivative/integral needs regularity. Thus this motivation does not establish arbitrary SGD convergence; the abstract theorem still requires its own drift/noise assumptions. Presentation: §3.7 prose says probability of all but finitely many events occurring is0; displayed Coq statement is limsup(tail unions), i.e. infinitely many events, the correct first Borel–Cantelli conclusion. §1p5 uses equality sum E[Wn²]=sum an²σ² where a variance bound normally yields≤; record treats it as an upper-bound argument. §4.1p14 mentions eventually positive versus not, while p15 says eventually zero versus not; full source case analysis was not audited. Artifact: official ITP2022 README gives opam/make/Docker instructions and alpha/research-project qualification. Formal_ML.opam requires Coq≥8.12.1,OCaml≥4.07.0 and Coquelicot/mathcomp/Flocq≥4.0.0/Interval/ExtLib, not a complete exact lock. README’s example Docker Coq8.8.2 predates this opam lower bound; no claim that example builds the release. Wrong guessed lowercase opam path failed404; actual case-sensitive Formal_ML.opam retrieved from release tree. No installation/build/artifact execution. No Verus, verified Rust, TLA+, LLM-generated proof/specification agent or distributed protocol evaluated. Relevance is adjacent proof-engineering evidence for probabilistic assumptions, explicit measurability, null sets, theorem interfaces and trust boundaries.
  • how much was read: reading depth not recorded
  • source
  • record id: formalization-of-a-stochastic-2022
• Proof Pearl: Formalizing Spreads and Packings of the Smallest Projective Space PG(3,2) Using the Coq Proof Assistant (2022)
  • what: Finite Coq model of 15-point,35-line PG(3,2) with Boolean incidence and generated witnesses; verifies projective-space interface, exhaustive spread/packing descriptions and classification under collineations. Reports56labelled spreads in one class,240labelled packings in two120-element classes and20160collineations. An external C generator supplies specifications, candidates and large proof scripts; Coq checking includes explicit functional-extensionality assumptions. Preserves generator-versus-checker contract, soundness/completeness versus classification, canonical list order and sorting, finite-model scope, admitted extensionality, generated proof scaling, exact hardware/timing evidence and internal timing inconsistency. Targeted source resolves misleading standalone partition helper: combined spread/packing predicates also require pairwise disjointness.
  • limits: Concrete finite incidence model only: point/line datatypes15/35constructors, exactly3points/line from a table; no equivalence to a GF(2)^4 coordinate model is shown here. Generic module parameters/axioms are an interface whose concrete model is reportedly proved, not all retained geometric assumptions for the finite computation. Abstract Boolean equalities need their concrete meaning; Table2 omits generic reflection laws connecting eqP/eqL with Leibniz equality. Projective axioms include line through any two points (Table2 even equal points), uniqueness, ≥3distinctpoints/line, Pasch with four distinctpoints and incidence hypotheses, skewlines to force dimension>2, and transversal for three distinctlines to bound dimension≤3. Witnesses are generated functions but their specified properties must be checked. The work does not prove all abstract projective geometries have the concrete counts/classification. External C code is a candidate/specification/proof-script generator, not a verified C implementation. Correctness of accepted mathematical conclusions rests on Coq checking the generated definitions/proof terms relative to chosen formal statements/axioms; input-table/model fidelity remains a specification issue. This is conventional program-generated proof work, not an LLM-agent experiment. Some script unfolding/naming edits still manual. §5.2.2 explicitly adds fp_ext/fl_ext as Admitted functional-extensionality lemmas for Point→Point and Line→Line. The author calls them safe; they are additional assumptions, not proved in the supplied development. In particular exhaustive function-pair list membership and classification separation use extensional equality. Do not claim an axiom-free kernel-only classification or assume finite domains alone make function equality derivable in intensional Coq. Spreads are5pairwise-disjoint lines partitioning15points; packings7pairwise-disjoint spreads partitioning35lines. Generic is_partition/is_partition7 helper alone tests coverage plus absence of an element in all5/all7 lists; this is weaker than a partition. Combined predicates include disj_5l/disj_7s. Targeted pinned source confirms these are full pairwise disjointness checks, so the helper weakness does not refute spread/packing theorems. Completeness is stated for canonical representations: spread line list sorted nondecreasing by leL, packing spread list strictly increasing lexicographically by ltS and every constituent in the canonical56spread list. Counts are labelled subsets modulo internal order permutations, not all ordered tuples and not quotient counts up to collineation. One/two isomorphism classes are a separate result. Printed spread isomorphism requires exact ordered list equality map fl s1=s2; packing isomorphism sorts each image spread and requires membership in both canonical spread list and target packing. Its displayed definition alone is a forward-inclusion property for arbitrary lists; equal-sized genuine packing inputs plus bijection supply intended equivalence. Do not generalize it to arbitrary malformed lists or conflate raw list equality with unordered-set equality. Exhaustive collineation completeness uses images of a projective basis P0,P1,P3,P7, with15·14·12·8choices. Each image pair forP0/P1 has96completions,210groups total. Candidate validation alone would establish only at-most-class connections; nonisomorphism needs completeness of20160candidate list, then no mapping PA0→PA1. Reported runtime is internally inconsistent: footnote2 and§6 say about13hours;§6 gives584minutes, which is9hours44minutes, not13hours. Preserve both statements rather than treating them as one consistent measurement. Hardware IntelCorei5-4460@3.20GHz,32GBinstalled RAM; no measured peak memory, repetitions or clean baseline. No per-optimization timing/ablation supplied. Abstract says360360=15·14·13·12·11possible5-line candidates; this is not the ordinary count of unordered5-line subsets of35lines (324632), nor ordered distinct5-line tuples (38955840). The abstract does not explain a restricted encoding yielding that count. Main56result has separate exhaustive theorem; numerical ambiguity alone is not a refutation. Author reports >50files, >317345specification/proof lines, >290000proof steps; these largely generated quantities measure artifact volume rather than human effort or proof quality. Own-datatype speed versus MathematicalComponents finite types, Boolean proofs, tactical ordering, par and wlog benefits are qualitative observations, not controlled performance results. Targeted source check at repository commit 4c416256429cb62d5dd3f41292087ebf620599a7 read spread/packing definition fragments and saved three sourcefiles; not complete source/dependency/axiom audit, archived directory comparison or reproduced Coq compilation. Paper archived directory swh:1:dir:f4ea06977d8a030690dddc924ccaa0b7590831ff not independently equated with current repository. LargerPG(3,3)/PG(4,2), Z3 and stronger symmetry-based enumeration are future work.
  • how much was read: reading depth not recorded
  • source
  • record id: proof-pearl-formalizing-spreads-2022
• Mechanising Complexity Theory: The Cook-Levin Theorem in Coq (2021)
  • what: Coq formalization of polynomial-time computability, NP, reductions and Cook–Levin using weak call-by-value lambda calculus L as a concrete cost model. Proves SAT and3SAT NP-complete through a chain from a generic L bounded-halting problem, heap machine and Turing-machine problems, covering-card tableaux, binary tableaux, Boolean formulas and Tseitin CNF. All reduction functions and their runtime/output-size bounds are implemented and analyzed in L, even though TMs are intermediate objects. Records why output-size bounds are separate from beta-step bounds, admissible bounded-halting inputs and why they repair the one-sided compiler-time argument, the actual versus expositional reduction factorization, overlapping-card soundness/completeness and polarity invariants, flat encodings and two-stage correspondence proofs, exact reported proof effort, concrete SAT-verifier resource analysis, printed formula discrepancies and the formal certificate bound checked in official coqdoc.
  • limits: §§2–3: Constructive Coq type theory; finite alphabets mean decidable equality plus exhaustive enumeration. L is untyped weak call-by-value with de Bruijn indices and Scott encodings. Its uniformly confluent reduction makes every terminating path have the same beta-step count. Encodings determine the size model, so unary and binary arithmetic cannot be interchanged silently. §3 Definitions1–2: Polynomial boundedness uses a monotone polynomial majorant. Polynomial-time computability requires both a polynomial beta-step bound and polynomial encoded result size. The latter is explicit because L can construct exponentially large terms in few steps; it is required to make composition and comparison with TMs sound. §3 Definitions3–6: NP uses a polynomial-time decidable verifier relation with soundness and existence of a polynomially bounded certificate. The verifier need not reject oversized certificates; completeness promises a short one. Certificates are L terms; a generalized introduction permits other injectively encoded certificate types with polynomial-time decoding. Many-one reductions preserve yes/no equivalence, not merely a forward implication. Printed Definition4,p5 has a self-bound: size(enc y)≤f(size(enc y)), rather than an input-size bound. Official coqdoc polyCertRel.complete__pCR instead uses size(enc y)≤p__pCR(size(enc x)); this resolves the paper typo without inferring an artifact defect. The complete NP coqdoc file was read; it is source-text evidence, not an independent kernel check. §1/§8: Existing polynomial-time L/TM simulations justify equivalence of complexity classes mathematically, as the abstract says. However, §8 explicitly leaves mechanizing agreement of this NP definition with a TM-based NP definition to future work. Do not claim that equivalence theorem is mechanized in this paper. §§4–5: Generic inputs include program, unary certificate bound k and unary time bound t. The GenNP subtype restricts programs to closed abstractions and admissibility: whenever any certificate halts, some certificate within k halts; any halting certificate run finishes within t. Analogous restrictions apply to the multi-tape problem. The NP-hardness reduction constructs instances satisfying these conditions. §5: The actual mechanization factors GenNP→LMGenNP→mTMGenNP, with a structure-sharing heap machine and linear overhead. Footnote4 says the exposition instead separates a TM evaluator directly as a better factorization. CheckCert translates arbitrary guessed tapes into Boolean-list encodings and invalid encodings diverge; EvalL is a fixed interpreter, not a per-input compiled machine. §5: Multi-to-single compilation supplies an upper runtime bound and halting preservation. A short compiled run alone does not bound the original run. Admissibility supplies existence of a short certificate and the original time bound, allowing the reverse implication. The prose accidentally uses k/k′ for runtime in pp9–10; the definitions consistently assign k to certificate size and t to time. §§2,6.1: TM tapes have no distinguished blank symbol and use optional current symbols. Tableau encoding adds blank, delimiter and state/head symbols. The state symbol stays at the string center; moving the head shifts the whole tape representation. Uniform polarity tags enforce a common shift. §6.1 redefines k:=|in|+k_cert, the combined fixed-input and certificate-size bound. Thus z=k+t=|in|+k_cert+t, with two additional blanks per side; tableau width is O(|in|+k_cert+t). §6.1: Covering cards constrain every overlapping width3 window of each adjacent pair of rows. This differs from applying a single rewrite rule at one position. General CC permits card width ω, offset o, and final substrings. Binary conversion uses codes of length |Σ|, not logarithmic codes. Each binary cell becomes a Boolean variable, and initial/card/final gadgets are conjoined. §6.1 Theorems14–16: For a represented configuration with |tp|<z and a TM step, there is a unique CC successor representing that step. Initial tape length≤k, where §6.1 uses k=|in|+k_cert, and step bound t establish completeness and soundness of bounded runs. Halting-configuration replication pads runs that halt before t to exactly t covering steps. A separate nondeterministic prelude guesses the certificate using a disjoint alphabet. §§4,6.2–6.3: Tseitin conversion avoids exponential CNF distribution. SAT NP membership is proved by a polynomial-time assignment verifier; the paper omits its full correctness proof. Footnote8 strengthens the result to3SAT. Official overview explicitly states CookLevin0:NPcomplete(kSAT3) and CookLevin:NPcomplete SAT, with proof compositions; no dependencies were rebuilt. §7: Flat first-order encodings support certifying Coq→L extraction. Dependent/finite-type problem formulations are retained for correctness proofs, separate natural-number alphabet versions compute reductions, and agreement transfers results. Indexed inductive card predicates support inversion/eauto; enumerated flat card lists are shown equivalent first over finite types and then over natural-number encodings. §7: Definitions with computational witnesses, such as explicit time and result-size functions, are placed in Type when projections are needed. The official NP interface also wraps witnesses in Prop via inNP. Do not read the paper’s design advice as asserting every complexity predicate lives in Type. §7.1: f≤c g means an explicit multiplicative constant bounding every input, not asymptotic big-O beyond a threshold. It supports arbitrary uncurried argument types and hides constants while allowing them to be projected. Concrete encoding-size inequalities are still required after deriving bounds in abstract sizes. §7.1,p16 printed recurrences require8≤T_existsb(Tf,[]) and Tf(h)+T_existsb(Tf,l)+15≤T_existsb(Tf,h::l), followed by claimed T_existsb≤c(sum Tf+length+1). These lower constraints alone do not establish the stated upper bound; no proof defect is inferred without checking the underlying recurrence lemmas. The same illustration calls maxVar a clause statistic but prints maxVar(a) with assignment a, leaving notation unclear; the record preserves that ambiguity rather than silently fixing it. §§7–8: Authors report Coq8.12.1 and no axioms. Code counts exclude evaluator/compiler where marked and reuse large libraries. Their claim that L is easier than a hypothetical full-TM approach is experience-based, not a controlled comparison or runtime benchmark. No LLM, Verus, verified Rust, TLA+ or distributed protocol is evaluated. Artifact: README identifies a snapshot of the complexity library plus undecidability library and generated coqdoc. Full README/two coqdoc files were read. GitHub tree request using master failed404 because the repository default branch is paper-cook-levin; repository metadata was fetched to resolve the branch. No installation, make, Coq execution, complete repository read or axiom/dependency audit occurred. A later request to the correct branch successfully fetched its tree (SHA e24a92af25746f6758a09ea1dc51e57491508e60,568entries); those repository files were not read.
  • how much was read: reading depth not recorded
  • source
  • record id: mechanising-complexity-theory-the-2021
• Learning dynamic polynomial proofs (2019)
  • what: DQN selects elementary polynomial inference steps, building a small set of nonnegative lemmas. A linear program combines those lemmas into an upper-bound certificate. A permutation-invariant polynomial embedding supports transfer across graph sizes. On dense random maximum-stable-set instances, reports tighter bounds with much smaller final LPs than tested static hierarchy levels. Learned search proposes steps; algebraic rules and final identities justify the certificates. Explains the distinction between a feasible stable set (existential lower bound) and a nonnegativity proof (universal upper bound). Gives strict-positivity completeness for hypercube certificates, a complete-graph dynamic degree-two derivation, and a supplementary n/l lower bound for the specified static LP. Constructs trilinear monomial-orbit features invariant to variable renaming plus max pooling over memories/equalities. Supplies dense LP-based rewards, cached action scoring, full DQN settings, a symmetry ablation and explicit rational graph certificates.
  • limits: Inference rules multiply an established nonnegative polynomial by x_i or 1−x_i and take nonnegative linear combinations. Their soundness requires x in [0,1]^n and correct initial axioms. Stable-set experiments also reduce modulo x_i^2=x_i and x_ix_j=0 for graph edges. Polynomial simplification and coefficient equality must preserve that quotient semantics. The main completeness theorem is quoted from Krivine: strictly positive polynomials on the compact hypercube have a finite nonnegative sum of x^alpha(1−x)^beta generators. The footnote restricts the completeness claim to strict positivity/refutation. It does not prove every merely nonnegative polynomial has such a certificate, nor that bounded-degree learned search is complete. Training uses random graphs with25 vertices and edge probability p in[0.5,1]. Generated memories start with2n inequality axioms and graph/Boolean equalities. Search is capped at100 additions and degree2 intermediate lemmas. Results do not establish performance on arbitrary polynomial optimization, sparse graphs, distributed programs or natural-language statements. No human proofs or optimal α(G) labels train the agent, but the dense reward depends on solving a mathematical LP after each addition. “Unsupervised” here means absence of supplied target proofs/optimum labels; it does not mean learning without an exact optimization environment. The orbit-based embedding and symmetric pooling establish architectural invariance under set enumeration and joint variable relabeling. Invariance is not injectivity or a proof of successful generalization. Fixed degree bounds the orbit feature dimension independently of sufficiently large n, while enumerating polynomials/actions still grows with n. Bounds are certified only if nonnegative coefficients and polynomial identities are checked accurately. Printed rational examples admit exact arithmetic; the paper does not provide a verified LP implementation or a systematic numerical-to-rational certificate-reconstruction/error protocol for every aggregate experiment. Supplementary theorem γ_l≥n/l concerns the precise product-generator hierarchy in Eq.10 with only Boolean and edge equalities. It is not a lower bound for every static method or for formulations strengthened by extra valid inequalities. Dynamic advantage is demonstrated against tested levels2–5 and random legal actions, not every proof search strategy. Only one training seed(0) and one NVIDIA V100 are specified. Test means cover100 random graph instances for each reported size. No intervals, multi-seed variability, end-to-end wall-clock comparison, total GPU training time or ground-truth optimality-gap table is supplied.
  • how much was read: reading depth not recorded
  • record id: learning-dynamic-polynomial-proofs-2019
• Perennial (2019)
  • title: Verifying concurrent, crash-safe systems with Perennial
  • what: Perennial adds reasoning about crashes and recovery to concurrent separation logic. It separates specs for ordinary calls from specs for recovery, and durable ownership from volatile ownership. Examples are a crash-safe mail system and local replicated disks.
  • limits: It covers replication across local disks only, not a replication protocol over a network.
  • how much was read: reading depth not recorded
  • source; notes: Verifying concurrent, crash-safe systems with Perennial
  • record id: perennial-2019
• Verifiable Reinforcement Learning via Policy Extraction (2018)
  • what: VIPER distills an oracle control policy into a decision tree by iteratively sampling learner trajectories, labeling visited states with oracle actions, aggregating data and resampling according to oracle value loss before CART training. Theory motivates Q-weighted imitation under convex/no-regret assumptions; the decision-tree implementation is heuristic. Structured policies enable model-specific SMT safety checks, local polynomial-model Lyapunov analysis, and pointwise action robustness. Experiments separate perfect finite-rollout rewards from counterexamples and conditional verification. Preserves Q-DAGGER theorem conditions versus heuristic CART, complete appendix proof calculations and printed normalization issues, explicit verification model/initial-set/horizon and approximation contracts, fixed-policy versus environment repairs, unstable high-reward oracle case requiring iLQR, exact tree/reward/timing comparisons and limited sample populations. Records formula transcription errors and missing invariance/model-error details without assuming the unaudited implementation uses them.
  • limits: §2/Lemma2.1: Finite-horizonT MDP, state rewards, terminalVT0,singleinitials0, deterministicstationarypolicy;V sums rewards,J=−V0. Oracleπ* supplies actions andQvalues. State losslt=V*−Q*(s,π(s)); average learner-occupancy lossl satisfiesT l=Jπ−Jπ*. This is expected-reward performance difference, not pathwise safety, exact imitation, termination, refinement or a proof about source-code implementation. §2/Theorem2.2: Convex upper-bound imitationloss gtilde weighted byV*−min_aQ*, boundedlmax, DAGGER/no-regret learning assumptions. States existence of sampledpolicy withJ≤J*+TεN+Otilde1 afterN=Thetatilde(lmax²T²log1/δ),prob≥1−δ. εN itself includes critical-state weights and can grow withT; improvedO(T) wording assumes high accuracy on critical states, not uniformly better worst-case loss or guaranteed safe extraction. §2/Algorithm1: Startπhat0oracle,collectM learnerrollouts/iteration,labeloracleactions,aggregateD,resampleproportionalnonnegativeweight,trainCART,returnbestiterationbycrossvalidation. Nonconvex decision-tree loss lacks the theorem-required online-learning guarantees; paper explicitly uses follow-the-leader heuristic. No bound on actual CART tree size/reward/safety follows directly from convexQ-DAGGER theorem. §2: Oracle andQ assumedtime-independent in practicalVIPER. Policy-gradient fallbackQ(s,a)=logπ*(s,a) invokes maximumentropy formulation; ordinary stochastic-policy probabilities need not be a calibrated true environmentQ. No error bound from approximateoracleQ or imitation into formal safety. Zero probabilities/logs and all-zero resampling weights not handled in printed algorithm. §2 resampling equality: Sincep proportionalwD, exact expectation isE_D[wgtilde]/E_D[w], notE_D[wgtilde] as printed, unlessweights normalized tomean1. Positive constant preserves population minimizers, so proportional-objective idea remains; finite resampling/CART need not optimize exact weighted population loss. AppendixA.1/arXivp12: Proof telescopesV* terms usingoccupancy recursion andVT0 to getV0−Vπ0, but repeatedly writesT^−1l onleft instead ofTl required by definition/mainLemma2.1. Correct telescoping establishesLemma withTl; printed normalization is inconsistent. AppendixA.2/arXivp12: First inequalityT^−1l≤εN+γN+2lmax(1+T)/N+sqrt(2lmax²log1/δ/(mN)), thenl≤TεN+Otilde1 and invokesLemma2.1. As printed, combining givesJgap≤T²εN+Otilde(T), not statedTεN+Otilde1. Intended proof requires consistent average-loss normalization; m introduced without definition there. Underlying no-regret theorem cited rather than reproved. Figure2/Theorem2.3/AppendixA.3: Constructed chainT3(k+1),rewardT attilde andT−α atsk,constantα∈(0,1). Alwaysleftmissestonecriticalturn,J0,loss1;alwaysrightJ−(T−α),lossα/T despite many disagreements. Appendixclaimsgright=1−1/T while trajectories hitabsorbingstateafterk+1steps and labels thereignored; treatmentofno-actionabsorbingstate/fullTnormalization needsclarification for exactg. ClaimedO1versusO1/Tseparation survives naturalfiniteepisode interpretation. §3toyPong: Continuous5Dsymbolicstate,x/ypositions,velocities,paddleposition;frictionlesselasticcollisions,noopponentpaddle. InitialballupperhalfY0,|vy|>vmin;parametersxmax30/ymax20/vmin1/vmax2/half-paddleL4. Returninvariantwithinceil(2ymax/vmin)=40steps claimed to yieldindefinitenoloss. Requirescorrectcontinuousstate/piecewise-lineardynamics,collisionterminationmodel and no unsafeprefix hiddenbyreturnevent;velocitystrictboundversusclosedinitialinterval endpoints differ in text. §3toyPong/renderedp5: Printedtransitionφt=OR_i(st−1∈Si⇒st=βi^Tst−1). Forpartitionwithmultiplepieces,inactiveimplicationistrue,so disjunctiondoesnotconstraintransition. Correct encoding needsANDofimplicationsorORofconjoinedguard/update. Affinecollisionsmayneedconstantcoordinate,whereprintedupdatehomogeneouslinear. These are printed-specification issues;Z3artifact/actualencodingnotinspected. §3toyPong: Mainψ assertsreturnY0fromY0underdynamics; simplifiedclaimrestrictsdownwardinitialvelocityandchecksreachupwardvelocity. Neither printedreturnformula explicitlyconjoinsavoidunsafeatallprefixsteps;gameovermustbeencodedsoareturnimpliesnoloss. Fulltransitionrulesandpaddlemotionspeed notprovidedhere. ReportedUNSATisconditionalontheimplementedmodel,notproofaboutAtariorrealworld. §3cart-polesafety:4Dinitialbox[−.05,.05]^4, intendedpoledeviation≤y0foreverwhilecartmovesright. Actualcheckedpropertyuseslinearizedf≈As+BaandTmax10only,withoutcertifiednonlinearremainder. No numeric y0/linearization matrices/timestep/fullSMTquery inpaper. Printedψconjoinsinitialmembershipratherthanusinganimplication;UNSATnegationrequiresinitialdomainanddynamics separatelyrestricted. Infinitehorizon/nonlinearsafetydoesnotfollow. §3stability/Eq1: Forpolynomialclosedloop,quadraticLyapunovV=s^TPs,positiveexceptoriginandnegativeorbitalderivative;Eq1selectsPusinglinearizedsystem. s^TPAs differsfromfullquadraticderivativebypositivefactor2for symmetricP,whichdoesnotaffectstrictsign. SOS is sufficient certificate search, not complete characterizationofallstablecontrollers;floatingpointsolvercertificates/kernelcheckingnotreported. §3stability/Eq2/renderedpp6–7: Constraintλ(s)(s^TPfπ(s))+(ρ−V(s))||s||²≤0,λ≥0 makesderivativetermnegativeininterior0<V<ρ. Followingprose reversesρ/Vinequalitiesandpositive/nonpositive explanations;atboundaryVρitonlyimpliesnonstrictsignwhenλpositive,notautomaticstrictnegativity. Text’sclaimstrictlynegativeonclosedU needsboundary/invarianceargument beyondshowninequality. Eq2 jointlyρ/ΛwithfixedP is anSOSfeasibility/optimization approach;noexactproofcertificate audited. §3stability: Treewithlinearleafcontrollers choosesleafcontainingorigin andlinearpolicyextendedglobally. PaperwritesU=Utilde∩routed(originleaf). Arbitraryintersectionneednotbepositivelyinvariant: trajectorycanleaveleafbeforeconverging,changingcontroller. A verifiedLyapunovsublevelcontainedinsideleaforadditionalboundaryargumentisrequired;PDFdoesnotspelloutthatstep. Localresultnotglobalstabilityoftree. §3/§4stability: Degree5Taylorapproximation used, polynomialdynamicsrequired;true-systemapproximationerrornotbounded. Paperacknowledges reformulation/errorhandlingaspossibleextensions. Verificationislocalnearorigin,notallstatesorallcart-polenonlinearphysics. §3robustness/renderedp7: CorrectlydefinednormL∞(notL1whicholdfonttextmisextracts),constantactionforallstatesinball. PrintedleafLPmaximizesεsubjecttodistance≤ε,whichisunboundedaboveoncefeasible;nearestadversarialdistance requiresminε. Finalradiuswritesargminleafratherthannumericminimum. Branchδs≤thresholdneedssign-adjustedthresholdforrightbranchandstrictboundary/tiehandling. Intendedmethodclear,printedLPnotliteralcorrectalgorithm;implementationnotchecked. §3robustness: Pointwiseinputactioninvariance,footnoteexplicitlydifferentfromcontrol-theoryrobustness. No guaranteeofwinning/safety underdynamicaldisturbances,measurementnoiseovertrajectory,orcorrectaction. Radiusballmayincludenonphysicalfeaturecombinationsunlessdomainrestricted;featureunits/scalingaffectnumericradius. Same-actionadjacentleavesmaymerge,so mustconsiderallopposite-actionleaves,notjustnearestsplit. §4Atari: Papercallsstate7D/R7butlistsballx,y,vx,vypluspaddleyp,vp,ap,jp=eightnamedcomponents;exactfeaturevectorambiguous. OracleDQNoperatespixels,treeonextractedfeatures. N80/M10,769nodes,reward21mean50rollouts. Robustnessatonly5randomstates,ε.5–2.8,time<2.9seach2.5GHzCorei7;noglobalrobustnessorAtaricorrectnessproof,dynamicsunavailable. §4Reluplex: ComparedpolicygradientstochasticDNNR7×A,not necessarilyoriginalDQNteacher. Same5states,line search4iterations/tolerance.1 versus treeprecision1e−5;times12/136/641/649splusonehourtimeout. Differencesinrepresentation/model/solverandprecisionallcontribute;notcontrolledidentical-policysemanticscomparison. Noruntimeconfidenceintervals/repeatseeds. §4toyPong: Oracleand31nodetreeaverage250rewardover50rollouts,yetSMTfindsedgeoscillationloss. Manualrepairaddstop-levelsafetybranch;alternativelychangesenvironmentbyextendingfullpaddlelength1,L4→4.5. RerunUNSAT<5sreportedforboth. Environmentrepairdoesnotproveoriginalcontrolleronoriginalenvironment;oraclelackedthisparticularcounterexamplebutwasnotcertifiedcounterexample-free. §4cart-pole: Discreteactions±1,movingright,one-hidden-layerpolicygradientoraclemean200over100rollouts;3nodetreealsoreward200,Z3safety1.5sfor10steplinearmodel. Separatestandingstillreward200DNN/treearenotstable;rewardceilingmeanssurvivaloffiniteepisode,notconvergencetoorigin. §4stabilityoracle: SwitchfromDNNtoiLQR/model-basedoracle(T50,n3),LQRlinearizationfallback||s||∞≤.05,continuousboundedactionsand3nodetreewithlinearleaves. UsesQ(s,a)=−JT(s),state-onlyfinalcost;howaction-specificranking/resamplingisobtainednotexplained. Reward200,SOS3.9s,ρ3.75,claimedregioncontains||s||∞≤.03. Enum>10minfindsvolume1e−15ofregion;implementation/model/certificate notindependentlyreproduced. §4baselines: FittedQiterationcart-poleincludesoracletrainingrolloutsinVIPERbudget;after200Krolloutsbaseline104.3versusVIPER200. DAGGERAtarimaxdepths4–16;smallesttreesforreward0=31vs127,20=127vs3459,21=769vs7967. Ratio127/31≈4.10atR0,notorder-of-magnitudeeverypoint;others27.24/10.36. DAGGERrobustness36–40sversusunder3. Fewbenchmarks/norepeatuncertainty. §4half-cheetah:9757noderegressiontree/PPOteacherreward4014vs4189,≈95.82%teacherreward. Noverificationproperty/certificateforthislargercontinuouscontrolcase. Abstractequalperformance/<1000nodesclaimsapplyselectedPong/cart-polecases,notallreportedexperiments. Fulltraininghyperparameters/resamplingcounts/crossvalidationdetails/codecertificatepathsabsentfromPDF;noartifactexecutionhere.
  • how much was read: reading depth not recorded
  • record id: verifiable-reinforcement-learning-via-2018
• Coalescing (2014)
  • title: Coalescing: Syntactic Abstraction for Reasoning in First-Order Modal Logics
  • what: The paper sends mathematical proof obligations to ordinary first-order provers. It sends temporal combinations (statements about how things change over time) to a propositional temporal prover. Each backend never sees the expressions it cannot interpret, since they are hidden.
  • limits: It does not claim to fully automate liveness. The implementation limits it describes are historical and do not describe current TLAPS.
  • how much was read: reading depth not recorded
  • source; notes: P04. Coalescing: Syntactic Abstraction for Reasoning in First-Order Mo
  • record id: coalescing-2014
• Pak TIETZE2 finite-dimensional extension 2014 (2014)
  • title: Tietze Extension Theorem for n-dimensional Spaces
  • what: Pąk extends the scalar Tietze extension principle to compact convex finite-dimensional targets with nonempty interior, then transports it to homeomorphic targets. The actual theorems preserve the target subset, stronger than merely extending into ambient Euclidean space. A converse for positive dimension derives normality from the universal extension property. Extensive hypercube/product-homeomorphism infrastructure tracks interiors and supports the finite-dimensional construction. Records coordinate assembly, hypercube range/face/interior facts, positive-radius and dimension contracts, boundary-preserving products, target-preserving transport and the positive-dimension converse with quantified closed domains.
  • limits: MML TIETZE_2 version8.1.02 5.22.1199 identifies a Mizar formalization. Normality is the domain-space separation property used by Tietze. In §3 A is a closed subset of T throughout; f has domain the subspace T restricted to A. This inherited closedness is essential though not restated in every theorem (pp.11,16–18). “Non boundary” for the convex compact targets means nonempty interior in the ambient Euclidean topology. Theorems23/24 require compactness, convexity and this property; they do not cover arbitrary nonconvex targets or infinite-dimensional normed spaces. Summary says extension g:T→E^n, while theorem23 actually gives g:T→E^n restricted to X, preserving the target X (pp.11,17). Proposition1 interchanges indexing of a family of coordinate functions with evaluation of their assembled product. Proposition21 states assembly into E^n is continuous when every coordinate function is continuous; n must be nonzero there. Coordinate continuity is a finite-product topology fact, not a claim that arbitrary separately continuous multivariable maps are jointly continuous (pp.12,16–17). Definition1 imports the open hypercube centered at p with common radius r; Proposition2 preserves membership on changing a coordinate inside its interval; Propositions3/4 give exact coordinate projections/membership. Definition2 uses potentially unequal half-widths R(i): all q(i) lie in[p(i)-R(i),p(i)+R(i)] (p.12). Propositions5/6 handle negative or nonnegative supplied half-widths, and nonnegative R makes the closed hypercube nonempty. Convexity/compactness are registered even for the general finite-sequence representation. Do not silently assume len R=n: Proposition9 explicitly requires n≤len R to compare an open cube with r≤inf rng R (pp.12–13). Proposition7 permits coordinate replacement within a closed interval; Proposition8 proves each coordinate projection is that interval when the whole closed cube is nonempty. Proposition10 characterizes boundary points by membership and some coordinate at an endpoint. For common radius r>0, Proposition12 identifies the interior with OpenHypercube; Propositions11/13/14 give center/inclusion/nested-radius facts. A positive-radius closed cube has nonempty interior (p.13). Proposition15 preserves homeomorphisms under products. Proposition16 maps a product of n- and m-dimensional closed cubes of positive radii onto the unit(n+m)-cube and sends the product of open interiors onto its open interior. Its proof normalizes each factor, uses a coordinate-concatenation homeomorphism E^n×E^m→E^(n+m), restricts to cubes and composes (pp.13–14). Proposition17 precomposes that cube map with arbitrary given homeomorphisms from nonempty T1,T2 and preserves the iff interior-membership condition. Proposition18 transports via boundary-preserving homeomorphisms for any compact convex bodies A,B,C with nonempty interior in dimensions n,m,n+m. It proves an existence homeomorphism, not an affine isomorphism or metric isometry (pp.14–16). Propositions19/20 specialize to products of positive-radius closed disks/balls and an(n+m)-dimensional unit closed disk, preserving the product of open balls as the open unit ball. The rendering has closure bars on balls in the proof and Proposition20, which raw extraction drops; ordinary open Ball and its closed version must not be conflated (p.16). Proposition22 extends f from closed A into the unit closed n-cube without leaving it. Intended construction extends each scalar coordinate to[-1,1] using the scalar Tietze result, assembles continuous coordinates (Proposition21), and uses coordinate-range characterization (Proposition8) to retain the cube. The PDF labels22 a consequence of8,1,21 but does not print the complete scalar-extension proof/source (p.17). Proposition23 transports a map into compact convex X with nonempty interior through a homeomorphism to a cube, applies22, then composes back. Proposition24 additionally transports to B subset S whenever B and such X are homeomorphic: if h:B→X, the extended map is h^-1 composed with an extension of h composed with f. Equality g restricted to A=f is exact, not approximation or equality only up to homotopy (p.17). Proposition25 requires T nonempty and n≥1. Its premise quantifies over every topological S, every nonempty closed A subset T, every B homeomorphic to an eligible n-dimensional X, and every continuous f:T|A→S|B. If all such maps extend into that same B, T is normal. This is a universal extension property, not a consequence of extending one selected map (pp.17–18). The converse sketch reduces to extension of scalar functions into[-1,1], which characterizes normality; a positive-dimensional cube permits embedding such a scalar coordinate and projecting an extension. This explains why the explicit n≥1 guard matters: a zero-dimensional singleton target cannot characterize normality. The PDF prints only the short scalar-extension reduction, not the full coordinate embedding instantiation (p.18). Forward results are existence theorems. No executable extension algorithm, numeric worked example, computational complexity, proof size/check time, empirical comparison or checker transcript is supplied. Library homeomorphism and scalar Tietze proofs are imported, not independently audited here. No distributed protocol, Verus/Rust/TLA+ or LLM proof/specification-agent evaluation (entire paper). Exact quotations preserve raw-extraction defects, especially lost ball closure bars, U+0016 restriction signs, product symbols and inequality glyphs. Renderings were inspected; interpretation distinguishes open/closed sets. Ninepages,twodefinitions,25propositions/allsuppliedsketches,onefootnote,44references and received date read; no artifact execution.
  • how much was read: reading depth not recorded
  • source
  • record id: pak-tietze2-finite-dimensional-extension-2014-2014
• Raft (2014)
  • title: In Search of an Understandable Consensus Algorithm
  • what: Raft’s randomised leader election uses timing to get a stable leader. The paper gives a rule of thumb for the timing.
  • limits: This is engineering guidance. It is not a deterministic GST theorem, and not a machine-checked liveness claim.
  • how much was read: reading depth not recorded
  • source; notes: Consensus: where the assumptions enter the proof
  • record id: raft-2014
• Pak BROUWER2 convex-body fixed points 2011 (2011)
  • title: Brouwer Fixed Point Theorem in the General Case
  • what: Pąk formalizes Brouwer fixed-point existence for continuous selfmaps of compact convex subsets of finite-dimensional Euclidean space with nonempty ambient interior. The article first establishes ray/frontier facts,then gives a homeomorphism from each such convex body to the closed unit disk carrying its frontier to the unit sphere. It also obtains boundary-preserving homeomorphisms between two such bodies and proves that a nonempty boundary subspace cannot be a retract of its body. Records the full-dimensional interior guard,subspace topology,selfmap requirement and boundary-preserving homeomorphism contract. Separates the general ray supremum lemma from convex uniqueness,and distinguishes fixed-point existence from uniqueness,computation or an arbitrary compact-convex-set theorem without interior. Includes the non-retraction conclusion absent from the Summary.
  • limits: MML BROUWER2 version7.11.07 4.160.1126 identifies the article. The Summary explicitly says an arbitrary convex compact subset ofEuclideanE^n “with a non empty interior”;the main statements use the imported attribute“non boundary.” This record reads that attribute in the Summary’s nonempty-interior sense,without independently auditing its library definition. Ambientn is a natural number,not an arbitrary infinite-dimensional normed space (pp.151–152). In the standing conventionA/Bare convex subsets;S is an arbitrary subset. Result1rewrites an affine combination as a ray displacement. Result2says two points on the same halfline fromp at the same distance fromp coincide. Result3assumesp∈S,p≠q and only boundedness ofS∩halfline(p,q);it suppliesw on the frontier and ray,at least as far fromp as every ray point ofS,and approximable arbitrarily closely by such points. It does not assumeSclosed orconvex,and does not promisew∈S (p.151). Result4does use closed convexA,p in its ambientinterior,p≠q and a bounded ray intersection;the frontier-ray intersection is a singleton. Result5identifies the frontier of a positive-radius closed ball with its sphere (the closed-ball overbar is lost in raw text),and a registration preserves boundedness under translation. These facts support radial descriptions,but no explicit radial homeomorphism formula or continuity proof is printed (p.152). Result6assumes convexAcompact andnonboundary. It produces h:E^n restricted toA→Tdisk(0,1),a homeomorphism whose image ofFrA is exactlySphere(0,1). Tdisk is the closed unit disk convention,consistent with the compact-body homeomorphism. No specified center ofA,lipschitzconstant,differentiability,volume preservation or canonical/computable choice ofh is stated (p.152). Result7assumes the same properties for bothAandB and yields a homeomorphism between their induced subspaces takingFrAontoFrB. This is a topological equivalence with boundary preservation,not an affine/linear equivalence or equality of shapes (p.152). Result8states every continuous function from the induced subspaceA into itself has a fixed point. Compactness,convexity andnonboundary remain premises through the standingAconvention. It is an existence result;it gives no uniqueness,iteration method,convergence rate or finite computation. For the identity map every point is fixed,so uniqueness cannot be inferred (p.152 plus labelled reading example). Nonempty ambientinterior excludes a line segment inR²,a singleton inR^n forpositiven,and other lower-dimensional convex sets. Brouwer existence can be extended through an affine-hull reduction,but that reduction is not a displayed result here. The title“General Case” must not erase this printed guard (pp.151–152). Result9assumes a nonempty convex compactnonboundaryA and a nonempty subspaceF1ofA whose entire carrier isFrA. It concludesF1is not a retract ofA:a continuous retraction would restrict to the identity on the boundary. A nonempty boundary subspace is explicitly required;in ambientdimension0that antecedent cannot supply a nonempty frontier (p.152). Reading proof connection,not a printed sketch:transport a hypothetical boundary retraction to the closed unit disk via6. If r:disk→sphere were a continuous retraction,thenx↦−r(x) would be a continuous disk selfmap. A fixed point from8lies on the sphere,where r(x)=x,sox=−x impliesx=0,contradicting unitnorm. This explains why boundary preservation matters;the paper prints no proof bodies for6–9. Reading premise check,not printed:on the convex open interval(0,1),f(x)=(x+1)/2 is a continuous selfmap with no fixed point,illustrating the compactness requirement. On a closed cube[-1,1]^n,n≥1,the theorem applies;it does not say a particular numerical iteration will find its fixed point. All three pages,nineresults/all clauses,bounded-translation registration,theorem-name footnote,21references/date read;one sheet covering every page inspected. No numbered definitions,proof sketches,figures,tables or appendices. Quotations are raw-extraction excerpts,not visual formula transcriptions;Euclidean superscripts,subspace restrictions,image/norm notation are distorted. This reading did not execute formal artifacts. The paper reports no empirical experiment,proof time/size,automation benchmark or distributed/Verus/Rust/TLA+/LLM-agent result.
  • how much was read: reading depth not recorded
  • source
  • record id: pak-brouwer2-convex-body-fixed-points-2011-2011
• Pak RLAFFIN3 barycentric continuity 2011 (2011)
  • title: Continuity of Barycentric Coordinates in Euclidean Topological Spaces
  • what: Pąk formalizes ordered barycentric coordinates for finite affinely independent Euclidean vertex sets, their invariance under translation, nonzero scaling and injective linear maps, and continuity on the affine hull. Prefix coordinate maps reflect as well as preserve openness and closedness when fewer than all barycentric coordinates are retained. Full affine bases give global coefficient continuity; arbitrary affinely independent sets require the relative topology on their affine hull. Records cardinality/rank conditions, exact enumeration transport, zero-coordinate tests for affine hulls of vertex subsets, affine-to-linear basis conversion and the dimension limit on topology equivalences. Distinguishes affine-hull continuity from unsupported continuity on the entire ambient space.
  • limits: MML RLAFFIN3 version7.11.07 4.160.1126 identifies the formalization. V is a real linear space; the topological conclusions concern finite-dimensional Euclidean E^n. A2 is a finite affinely independent subset of V and A4 an affinely independent subset of E^n, automatically finite. Generic A1 need only be finite; barycentric uniqueness/topology conclusions use affine independence (pp.139–140). Propositions1/2 distribute interval boxes and Cartesian-product membership over finite-sequence concatenation. Propositions3–6 connect finite dimension with the whole carrier, establish dim(E^n)=n, bound |A|≤dim(V)+1 for affine independence, and characterize |A|=dim(V)+1 by Affin A=V. The overbar means cardinality, not closure (pp.139–140). Proposition7 makes a cylinder defined by the first k≤n ordinary coordinates open iff its base in E^k is open. Proposition8 gives the corresponding statement for the embedded subspace formed by appending n zeros. These distinguish ambient topology from subspace topology (p.140). Proposition9 states conv(A)∩Affin(B)=conv(B) for B⊆affinely independent A. Proposition10 distributes scalar multiplication over function images;11 identifies an affine hull containing zero with the carrier of its linear span. Proposition12 is |A|=|rA| iff r≠0 or A is trivial (at most one element), not the generally false set equality A=rA; bars are visible in the rendering but absent in extracted text (p.140). Definition1 makes an enumeration an injective finite sequence with range exactly X. Translation transports it elementwise (13); scaling transports an enumeration iff the scalar is nonzero or the set is trivial (14). Proposition15 requires an n×m matrix of rank n; in this row-vector convention its map E^n→E^m is injective, so vertex distinctness is preserved. Rank cannot be omitted (p.141). Definition2 orders the coefficient function x→A by composition with the enumeration E, yielding x→E with length |A| (16). Translation (17), nonzero scaling (18) and full-row-rank linear maps (19) leave this ordered coefficient vector unchanged when the vertex enumeration is transported with the point. Their point hypotheses restrict to the original affine hull; no arbitrary off-hull coefficient interpretation is inferred (p.141). Proposition20 characterizes membership in the affine hull of a vertex subset by zero coefficients at excluded vertices, assuming x∈Affin A2. Propositions21/22 specialize to first-k and remaining vertices: the excluded suffix or prefix of the ordered coordinate vector is zero. The first uses truncated natural subtraction |A2|−0k; the second explicitly assumes k≤|A2| (p.141). When zero is the last enumerated vertex, removing it leaves an ordered linear basis of the span (23); coefficients in that basis equal the first |A4|−1 barycentric coefficients (24). This supplies the affine-to-linear-coordinate bridge. The paper states propositions without their proofs, so this is a dependency/strategy reading, not a reconstruction of a Mizar proof trace (p.142). For a full affine basis |A4|=n+1,25/26 say A5⊆E^k is open/closed iff its first-k barycentric-coordinate inverse image is open/closed in E^n, provided k≤n. For an arbitrary A4,27/28 replace the ambient domain by E^n restricted to Affin A4 and require k<|A4|. Relative topology and the strict coordinate-count bound are material; these are stronger than one-way continuity (p.142). Reason for the coordinate-count limit (reading inference): all |A| barycentric coordinates satisfy sum=1, so the full coordinate image is an affine hyperplane rather than all E^|A|. For vertices0,1 in R, coordinates are (1−t,t). A nonempty closed singleton disjoint from that line has empty open inverse image but is not open in R², disproving the unrestricted reflected-openness claim. This is an illustrative derivation, not a printed example. Definition3 fixes a vertex/index x and defines the real coefficient function v↦(v→A)(x). Outside A it is identically0 (29); for affine independence the converse holds (30). Proposition31 proves continuity only after restriction to Affin A4;32 gives ambient continuity if |A4|=n+1. Nothing here establishes ambient continuity for a nonspanning vertex set (p.142). The paper also registers every Euclidean affine subset as closed, every halfline as closed, and conv(A4) as closed. Proposition33 states that Int A4 is open if |A4|=n+1. Its imported Int operator is not defined in this paper; the record preserves that notation rather than silently identifying it with ordinary topological interior of the vertex set (pp.142–143). No numerical example, executable barycentric algorithm, floating-point error bound, performance measurement, proof-size/check-time statistics or independent checker transcript appears. The 33 references include affine-independence, linear-coordinate and Euclidean-transformation libraries; those dependencies are not independently read for this record. No distributed protocol, Verus/Rust/TLA+ or LLM-agent evaluation. Exact quotations retain extraction defects: cardinality overbars disappear, restriction glyphs become U+0016/U+0017, finite-sequence concatenation renders as a and function-composition/application ordering is typographic. Renderings govern interpretation. All six pages/three definitions/33 propositions and reference/date material read; formal source/checker not executed.
  • how much was read: reading depth not recorded
  • source
  • record id: pak-rlaffin3-barycentric-continuity-2011-2011
• Pak SIMPLEX2 Brouwer simplex 2011 (2011)
  • title: Brouwer Fixed Point Theorem for Simplexes
  • what: Pąk formalizes Brouwer fixed-point existence for a continuous self-map of a full-dimensional Euclidean simplex. The article develops Lebesgue numbers,uniform bounds on simplex diameters,a geometric barycentric-subdivision mesh decay estimate,and a closed-face-cover intersection theorem. It also states that the small inductive dimension of the simplex and E^n is n. The quantitative decrease concerns individual-simplex mesh,not shrinkage of the whole realized domain. Records open-cover quantifiers,mesh supremum/fallback,subcomplex monotonicity,convex-hull diameter preservation,exact degree-dependent decay,closed-cover face conditions and fixed-map domain/range. Separates statements from an inferred KKM/barycentric proof route because no proof sketches are printed.
  • limits: MML SIMPLEX2 version7.11.07 4.160.1126 identifies the article. Main23/24 use A affinely independent in E^n with cardinality n+1,and f a continuous function from the subspace conv A into itself. They guarantee a fixed point in dom f,with no contraction,uniqueness,or rate-of-iteration hypothesis. Lower-dimensional simplices embedded in E^n are not directly covered by that full-dimensional displayed statement (pp.145,149). Definition1 uses a nonempty metric space whose topology is compact and an open covering family F. A Lebesgue number is positive and satisfies:for every p,there exists a member ofF containing the whole open ball at p of that fixed radius. The chosen cover member may depend on p. Theorems1–3 preserve the number under enlarging/coarsening the cover and under taking a smaller positive radius (pp.145–146). Theorem4 attains a finite nonempty metric subset’s diameter at two points. Definition2 M-bounded requires one uniform real bound on the diameter of every face in the complex’s family,not just boundedness of each face separately. Subcomplexes/skeletons inherit boundedness and finite-vertex complexes are bounded (5/6). The word topology here names the abstract complex’s face family;it is not an arbitrary family of ambient open sets (p.146). The complex diameter is mesh:the least upper bound on its simplex/face diameters. Definition3 includes a fallback value0 when the face family does not meet the metric carrier’s power set;Definition4 gives the simpler simplex-supremum characterization for M-bounded nonvoid subset-closed complexes. Theorems7–10 give nonnegativity,subcomplex/skeleton monotonicity,and equality to diam S for the complex generated by finite S (p.147). Definitions5/6 specialize metric boundedness/mesh to Euclidean complexes. Mesh does not bound distances between arbitrary vertices in different disconnected faces:as a reading illustration,singleton faces at all integer points in R have mesh0 but unbounded union. Subdivision therefore decreases local simplex size,not necessarily the diameter of the realized domain (pp.146–148). Theorem11 compares differences of barycenters from a nested finite face family. It gives a1−a2=r(b1−b2),with0≤r≤(|union F|−1)/|union F|. This is the vertex-count source of the subdivision contraction factor. K2 appears in the printed statement without an explicit local declaration;the imported complex-type conventions are not audited here (p.148). Theorem12 expresses a selected-vertex face as an intersection of facets missing excluded vertices,assuming dom E minus X is nonempty. The printed prefix notation conv A {E(k)} must be grouped as conv(A{E(k)}) for that facet reading;removing only the vertex from the already-convex set would not express the same identity. Parentheses are not printed and the source parse was not audited (p.148). Theorem13 places conv A in the closed ball centered at anyp∈conv A of radius diam A;the overbar is missing in raw extraction. Theorem14 preserves boundedness under convex hull and15 preserves diameter. A closed rather than open ball is essential when diameter is attained or zero (p.148). Theorems16–18 require a bounded finite-degree nonvoid simplicial complex and the explicit imported containment |K|⊆Omega_K. They give mesh(BCS K)≤d/(d+1)mesh(K),then mesh(BCS(k,K))≤(d/(d+1))^k mesh(K),and for every positive target r some k has mesh<r. For d≥0 the ratio is<1. The geometric containment is retained literally rather than assigned an unaudited interpretation (p.148). Theorems19/20 concatenate coordinates to a homeomorphism E^i×E^j→E^(i+j),mapping products of equal-radius open hypercubes to one open hypercube. Theorem21 characterizes Euclidean boundedness by containment in some open hypercube. Closed bounded Euclidean subsets and convex hulls of affine-independent sets are then registered compact (pp.148–149). Theorem22 is a closed-cover intersection condition:nonempty affinely independent A,enumeration E,a sequence F of |A| closed subsets of the subspace conv A,and for every index subset S,conv(E(S))⊆union(F(S)). Then the intersection of all F_i is nonempty. Closedness is relative to conv A and the face condition is required for every S,not only vertices or the whole simplex. This is the displayed KKM-type intermediary (p.149). Standard fixed-point route,reading inference rather than a supplied proof:write barycentric coordinates ofx andf(x),and define F_i={x:f_i(x)≤x_i}. Coordinate continuity makes the F_i closed. On a face indexedS,the x_i sum to1 overS while f_i are nonnegative and their sum overS is≤1,so at least onei∈S satisfies the inequality. The22intersection gives all coordinate inequalities;equal total sums force equality and hence f(x)=x. The article cites barycentric continuity and Sperner libraries but gives no full proof/dependency trace. Theorems23/24 state fixed-point existence;25 gives small inductive dimension ofconv A equaln when|A|=n+1,and26 gives ind(E^n)=n. Small inductive dimension is the topological dimension defined recursively through boundaries of neighborhoods;the imported formal definition and dimension proof are not reproduced or independently audited. At n=0 the full simplex has one vertex and the fixed-point conclusion is immediate (p.149). No executable fixed-point algorithm,worked numerical example,approximation error for a computed point,proof/check-time statistics,benchmark or checker transcript appears. The mesh decay is an analytic estimate rather than measured runtime. Thirty-five references include abstract complexes,Sperner,barycentric continuity and inductive dimension;those dependencies not independently read for this record. No distributed protocol,Verus/Rust/TLA+ or LLM-agent experiment. All six pages,five sections,six definitions,26numbered results/all clauses,unnumbered registrations,35references/date read. Exact quote text follows saved raw extraction,not a visual mathematical transcription;cardinality/closed-ball bars vanish,diameter becomes∅,composition and restrictions are distorted. Renderings checked,especially pp148/149. No formal-source/checker execution.
  • how much was read: reading depth not recorded
  • source
  • record id: pak-simplex2-brouwer-simplex-2011-2011
• Paxos Made Simple (2001)
  • what: The paper separates the safety of agreement from progress. Section 2.4 shows that proposers can alternate higher-numbered proposals and stop any value from being chosen. So a distinguished proposer must be selected.
  • limits: It does not claim a machine-checked termination spec.
  • how much was read: reading depth not recorded
  • source; notes: Consensus: where the assumptions enter the proof
  • record id: paxos-made-simple-2001
• Civl
  • title: Civl verifier (official site)
  • what: A verifier built on layers of refinement (each layer a simpler or more detailed version of the one next to it) and structured programs. An SMT solver discharges the checking conditions. Its samples include Paxos, 2PC and Chang-Roberts.
  • limits: The test suite is a repository that keeps changing. An evaluation needs a pinned commit.
  • how much was read: reading depth not recorded
  • source; notes: Civl and inductive sequentialization
  • record id: civl
• LeanMachines (2026)
  • title: LeanMachines: State-based Modeling with Refinement (a Lean4 Framework)
  • what: A Lean 4 library for modelling stateful systems as machines refined step by step, in the style of Event-B, where a refinement step cannot be built without discharging its proof obligations.
  • limits: Full text not obtained: the journal article had no open PDF; only package-registry and search-result descriptions were read, which call the library alpha-stage and not compatible with Event-B or Rodin. The IFM 2024 predecessor (‘Stateful Functional Modeling with Refinement (a Lean4 Framework)’) was not read.
  • how much was read: not read; title and metadata only
  • notes: ## LeanMachines (2026): metadata only
  • record id: leanmachines-2026
• Blockchain verification monograph (2025)
  • title: Security analysis and formal verification on blockchain and its applications
  • what: Per its abstract, a monograph that sorts real blockchain correctness and security flaws, and surveys the models, specifications and techniques used to formally verify blockchains.
  • limits: Full text not obtained: publisher PDF is behind a bot-check page (not worked around), no open copy found. Only the publisher abstract from Crossref was read, so nothing about its content beyond the abstract is recorded.
  • how much was read: not read; title and metadata only
  • source; notes: Security analysis and formal verification on blockchain and its applic
  • record id: blockchain-verification-monograph-2025
• Cazamariposas (2025)
  • title: Cazamariposas: Automated instability debugging in SMT-based program verification
  • what: The paper automates debugging of verification instability, where proofs pass or fail unpredictably. It targets SMT-based verifiers (verifiers that use a solver) such as Dafny and F*.
  • limits: The review notes saw only a Google Scholar title and snippet and did not read the paper.
  • how much was read: not read; title and metadata only
  • record id: cazamariposas-2025
• Practical Verification of Distributed Systems: Streamlining Safety Proofs Using Invariant Taxonomies, and Verifying Latency Properties Using Symbolic Latency (2025)
  • what: PhD thesis on proving distributed protocols safe by sorting the needed invariants into types, and on extending verification to end-to-end latency. Full text could not be fetched; this record rests on a search-engine summary of the library page.
  • limits: Full text blocked: the Deep Blue library (deepblue.lib.umich.edu) returned a Cloudflare ‘Just a moment’ challenge to command-line fetches, and I did not try to get around it. Nothing here comes from reading the thesis.
  • how much was read: not read; title and metadata only
  • source; notes: Practical Verification of Distributed Systems (2025)
  • record id: practical-verification-of-distributed-2025
• A Calculus for the Specification, Design, and Verification of Distributed Concurrent Systems (2024)
  • what: Listed as an unread search lead from OpenAlex. The notes give only its title, year and DOI.
  • limits: Not read. Claims are unverified.
  • how much was read: not read; title and metadata only
  • source
  • record id: a-calculus-for-the-2024
• Kukovec TU Wien dissertation (2024)
  • title: SMT-driven techniques for verifying distributed systems
  • what: The dissertation develops symbolic-transition abstractions, SMT encodings of TLA+ and type inference to verify distributed algorithms.
  • number: 168 pages
  • limits: Repository metadata/abstract read; linked 1.97 MB PDF not downloaded in this pass.
  • how much was read: not read; title and metadata only
  • source
  • record id: kukovec-tu-wien-dissertation-2024
• TLA logic in Dafny (2024)
  • what: The post writes weak fairness as a Dafny predicate. The example is a countdown timer that the author calls silly.
  • limits: The review notes read it only through a summarizer.
  • how much was read: not read; title and metadata only
  • source
  • record id: tla-logic-in-dafny-2024
• Counterexample Driven Quantifier Instantiations with Applications to Distributed Protocols (2023)
  • what: An interactive method in Ivy that stops SMT solvers from diverging on quantifier-heavy proofs of distributed protocols, by abstracting functions as relations and refining with counterexamples.
  • limits: Full text not read: the ACM PDF sits behind a bot check, and no open copy was found. Facts here come from the input abstract and a web-search summary.
  • how much was read: not read; title and metadata only
  • source; notes: Counterexample Driven Quantifier Instantiations (2023)
  • record id: counterexample-driven-quantifier-instantiations-2023
• KEVM (2018)
  • title: KEVM: A Complete Formal Semantics of the Ethereum Virtual Machine
  • what: A formal semantics of the EVM in the K framework. The notes inspected only the repository README. It names concrete execution on LLVM and symbolic execution in Haskell.
  • limits: The full paper was not obtained (links returned 404/403). No paper-level results are used.
  • how much was read: not read; title and metadata only
  • source; notes: Bytecode-semantics prerequisites: repository evidence and retrieval ga; notes: Bytecode-semantics prerequisites: repository evidence and retrieval ga
  • record id: kevm-2018
• Practical TLA+ (2018)
  • what: Citation-snowball lead; full text was not retrieved from the attempted open endpoints.
  • limits: Metadata-only: attempted open endpoints returned access-denied or non-PDF HTML; the paper was not read.
  • how much was read: not read; title and metadata only
  • source
  • record id: practical-tla-2018
• Thread modularity at many levels: a pearl in compositional verification (2017)
  • what: Citation-snowball lead; full text was not retrieved from the attempted open endpoints.
  • limits: Metadata-only: attempted open endpoints returned access-denied or non-PDF HTML; the paper was not read.
  • how much was read: not read; title and metadata only
  • source
  • record id: thread-modularity-at-many-2017
• Ramsey vs. Lexicographic Termination Proving (2013)
  • what: Citation-snowball lead; full text was not retrieved from the attempted open endpoints.
  • limits: Metadata-only: attempted open endpoints returned access-denied or non-PDF HTML; the paper was not read.
  • how much was read: not read; title and metadata only
  • source
  • record id: ramsey-vs-lexicographic-termination-2013
• Detecting Fair Non-termination in Multithreaded Programs (2012)
  • what: Citation-snowball lead; full text was not retrieved from the attempted open endpoints.
  • limits: Metadata-only: attempted open endpoints returned access-denied or non-PDF HTML; the paper was not read.
  • how much was read: not read; title and metadata only
  • source
  • record id: detecting-fair-non-termination-2012
• Brookes CSL semantics (2007)
  • title: A semantics for concurrent separation logic
  • what: It is the source of the soundness proof for concurrent separation logic (a logic for reasoning about threads that own parts of memory).
  • limits: The notes’ author verified the metadata. The author’s PDF could not be fetched.
  • how much was read: not read; title and metadata only
  • source; notes: S32–S33
  • record id: brookes-csl-semantics-2007
• O’Hearn CSL (2007)
  • title: Resources, concurrency, and local reasoning
  • what: The original source on concurrent separation logic. Threads own resources, and shared-resource invariants sit at synchronization points.
  • limits: Metadata verified. The author’s PDF could not be fetched.
  • how much was read: not read; title and metadata only
  • source; notes: S32–S33
  • record id: o-hearn-csl-2007
• Proving thread termination (2007)
  • what: Citation-snowball lead; full text was not retrieved from the attempted open endpoints.
  • limits: Metadata-only: attempted open endpoints returned access-denied or non-PDF HTML; the paper was not read.
  • how much was read: not read; title and metadata only
  • source
  • record id: proving-thread-termination-2007
• A Complete Method for the Synthesis of Linear Ranking Functions (2004)
  • what: Citation-snowball lead; full text was not retrieved from the attempted open endpoints.
  • limits: Metadata-only: attempted open endpoints returned access-denied or non-PDF HTML; the paper was not read.
  • how much was read: not read; title and metadata only
  • source
  • record id: a-complete-method-for-2004
• Liveness Checking as Safety Checking (2002)
  • what: Citation-snowball lead; full text was not retrieved from the attempted open endpoints.
  • limits: Metadata-only: attempted open endpoints returned access-denied or non-PDF HTML; the paper was not read.
  • how much was read: not read; title and metadata only
  • source
  • record id: liveness-checking-as-safety-2002
• Princeton TR-110-87 (1987)
  • title: Distributed Reachability Analysis for Protocol Verification Environments
  • what: The Princeton technical-report record presents reachability analysis for coupled finite-state-machine protocol verification and the SPANNER environment.
  • limits: The record is historical and only the abstract/page was read.
  • how much was read: not read; title and metadata only
  • source
  • record id: princeton-tr-110-87-1987
• Lentil
  • what: Lentil is proof infrastructure for linear temporal logic in Lean 4. It has its own proof mode.
  • limits: It embeds LTL. It does not translate TLA+ files.
  • how much was read: not read; title and metadata only
  • source
  • record id: lentil