C.-H. Luke Ong

Applying Game Semantics to Compositional Software Modeling and Verification

We describe a software model checking tool founded on game semantics, highlight the underpinning theoretical results and discuss several case studies. The tool is based on an interpretation algorithm defined compositionally on syntax and thus can also handle open programs. Moreover, the models it produces are equationally fully abstract. These features are essential in the modeling and verification of software components such as modules and turn out to lead to very compact models of programs.

The monadic second order theory of trees given by arbitrary level-two recursion schemes is decidable

A tree automaton can simulate the successful runs of a word or tree automaton working on the word or tree denoted by a level-2 lambda-tree. In particular the monadic second order theory of trees given by arbitrary, rather than only by safe, recursion schemes of level 2 is decidable. This solves the level-2 case of an open problem by Knapik, Niwinski and Urzyczyn.

Recursion Schemes and Logical Reflection

Let R be a class of generators of node-labelled infinite trees, and Lbe a logical language for describing correctness properties of the setrees. Given r in R and phi in L, we say that r_phi is aphi-reflection of r just if (i) r and r_phi generate the same underlying tree, and (ii) suppose a node u of the tree t(r) generated by r has label f, then the label of the node u of t(r_phi) is f* if uin t(r) satisfies phi; it is f otherwise. Thus if t(r) is the computation tree of a program r, we may regard r_phi as a transform of R that can internally observe its behaviour against a specification phi. We say that R is (constructively) reflective w.r.t. L just if there is an algorithm that transforms a given pair (r,phi) to r_phi. In this paper, we prove that higher-order recursion schemes are reflective w.r.t. both modal mu-calculus and monadic second order(MSO) logic. To obtain this result, we give the first characterisation of the winning regions of parity games over the transition graphs of collapsible pushdown automata (CPDA): they are regular sets defined by a new class of automata. (Order-n recursion schemes are equi-expressive with order-n CPDA for generating trees.) As a corollary, we show that these schemes are closed under the operation of MSO-interpretation followed by tree unfolding a la Caucal.

Automatic Verification of Erlang-Style Concurrency

This paper presents an approach to verify safety properties of Erlang-style, higher-order concurrent programs automatically. Inspired by Core Erlang, we introduce λ Actor, a prototypical functional language with pattern-matching algebraic data types, augmented with process creation and asynchronous message-passing primitives. We formalise an abstract model of λ Actor programs called Actor Communicating System (ACS) which has a natural interpretation as a vector addition system, for which some verification problems are decidable. We give a parametric abstract interpretation framework for λ Actor and use it to build a polytime computable, flow-based, abstract semantics of λ Actor programs, which we then use to bootstrap the ACS construction, thus deriving a more accurate abstract model of the input program.

Discreet Games, Light Affine Logic and PTIME Computation

This paper introduces a model of IMLAL, the intuitionistic multiplicative (⊗ - § ! )-fragment of Light Affine Logic, based on games and discreet strategies. We define a generalized notion of threads, so that a play of a game (of depth k) may be regarded as a number of interwoven threads (of depths ranging from 1 to k). To constrain the way threads communicate with each other, we organize them into networks at each depth (up to k), in accord with a protocol: • A network comprises an O-thread (which can only be created by O) and finitely many P-threads (which can only be created by P). • A network whose O-thread arises from a ! -game can have at most one P-thread which must also arise from a ! -game. • No thread can belong to more than one network. • Only O can switch between networks, and only P can switch between threads within the same network. Strategies that comply with the protocol are called discreet, and they give rise to a fully complete model of IMLAL. Since IMLAL has a polytime cut-elimination procedure, the model gives a basis for a denotational-semantic characterization of PTIME.

BOOM: taking boolean program model checking one step further

We present Boom, a comprehensive analysis tool for Boolean programs. We focus in this paper on model-checking non-recursive concurrent programs. Boom implements a recent variant of counter abstraction, where thread counters are used in a program-context aware way. While designed for bounded counters, this method also integrates well with the Karp-Miller tree construction for vector addition systems, resulting in a reachability engine for programs with unbounded thread creation. The concurrent version of Boom is implemented using BDDs and includes partial order reduction methods. Boom is intended for model checking system-level code via predicate abstraction. We present experimental results for the verification of Boolean device driver models.

Analysing mu-calculus properties of pushdown systems

Pushdown systems provide a natural model of software with recursive procedure calls. We provide a tool (PDSolver) implementing an algorithm for computing the winning regions of a pushdown parity game and its adaptation to the direct computation of modal µ-calculus properties over pushdown systems. We also extend the algorithm to allow backwards, as well as forwards, modalities and allow the user to restrict the control flow graph to configurations reachable from a designated initial state. These extensions are motivated by applications in dataflow analysis. We provide two sets of experimental data. First, we obtain a picture of the general behaviour by analysing random problem instances. Secondly, we use the tool to perform dataflow analysis on real-world Java programs, taken from the DaCapo benchmark suite.

Two-level game semantics, intersection types, and recursion schemes

We introduce a new cartesian closed category of two-level arenas and innocent strategies to model intersection types that are refinements of simple types. Intuitively a property (respectively computation) on the upper level refines that on the lower level. We prove Subject Expansion--any lower-level computation is closely and canonically tracked by the upper-level computation that lies over it--which is a measure of the robustness of the two-level semantics. The game semantics of the type system is fully complete: every winning strategy is the denotation of some derivation. To demonstrate the relevance of the game model, we use it to construct new semantic proofs of non-trivial algorithmic results in higher-order model checking.

Unboundedness and downward closures of higher-order pushdown automata

We show the diagonal problem for higher-order pushdown automata (HOPDA), and hence the simultaneous unboundedness problem, is decidable. From recent work by Zetzsche this means that we can construct the downward closure of the set of words accepted by a given HOPDA. This also means we can construct the downward closure of the Parikh image of a HOPDA. Both of these consequences play an important role in verifying concurrent higher-order programs expressed as HOPDA or safe higher-order recursion schemes.

Nondeterminism in Game Semantics via Sheaves

Harmer and McCusker have developed a fully abstract game model for nondeterministic Idealised Algol and, at the same time, revealed difficulties in constructing game models for stateless nondeterministic languages and infinite nondeterminism. We propose a novel approach in which a strategy is not a set, but a tree, of plays, and develop a fully abstract game model for a nondeterministic stateless language. Mathematically such a strategy is formalised as a sheaf over an appropriate site of plays. We conclude with a study on the difficulties pointed out by Harmer and McCusker in terms of the structure of the coverage of the sites.