Generating

Data

Flow

Analysis

Algorithms

from

Modal

Specifications

Bernhard

Steffen

Lehrstuhl

f?ur

Informatik

II

RWTH

-LCB-

Aachen

Aachen

Aachener

Informatikberichte

Nr

-LCB-

Abstract

The

paper

develops

a

framework

that

is

based

on

the

idea

that

modal

logic

provides

an

appropriate

framework

for

the

specification

of

data

flow

analysis

-LRB-

DFA

-RRB-

algorithms

as

soon

as

programs

are

represented

as

models

of

the

logic

This

can

be

exploited

to

construct

a

DFA-generator

that

generates

efficient

implementations

of

DFA-algorithms

from

modal

specifications

by

partially

evaluating

a

specific

model

checker

with

respect

to

the

specifying

modal

formula

Moreover

the

use

of

a

modal

logic

as

specification

language

for

DFA

algorithms

supports

the

compositional

development

of

specifications

and

structured

proofs

of

properties

of

DFA-algorithms

-LCB-

The

framework

is

illustrated

by

means

of

a

real

life

example

the

problem

of

determining

optimal

computation

points

within

flow

graphs

Introduction

Data

flow

analysis

-LRB-

DFA

-RRB-

is

concerned

with

the

automatic

identification

of

program

points

enjoying

specific

properties

like

for

example

lifeness

of

variables

or

equivalence

of

program

terms

Typically

data

flow

analysis

algorithms

are

constructed

for

a

given

program

property

of

interest

and

therefore

have

the

following

functionality

DFA-algorithm

for

a

property

programs

program

points

enjoying

the

property

Model

checking

is

concerned

with

the

automatic

identification

of

those

states

of

a

finite

system

satisfying

a

specific

modal

-LRB-

or

temporal

-RRB-

formula

that

expresses

for

example

properties

like

deadlock

divergence

or

liveness

Typically

model

checkers

are

parameterized

on

the

formula

of

interest

and

therefore

have

the

following

functionality

model

checker

modal

formulas

model

states

satisfying

the

argument

formula

Identifying

programs

with

models

program

points

with

states

and

program

properties

with

modal

formulas

model

checkers

can

be

seen

as

DFA

algorithms

that

have

the

program

property

of

interest

as

a

parameter

In

this

paper

we

exploit

this

observation

in

order

to

develop

an

algorithm

that

automatically

generates

efficient

implementations

of

DFA-algorithms

from

specifications

written

in

a

modal

logic

In

essence

this

DFA-generator

works

by

partially

evaluating

an

appropriate

model

checker

with

respect

to

its

modal

formula

parameter

the

result

is

a

standard

iterative

DFA-algorithm

-LRB-

cf.

-LSB-

Kil

-RSB-

-RRB-

which

directly

runs

on

the

machine

the

model

checker

is

implemented

on

For

simplicity

we

will

refer

to

these

implementations

just

as

DFA-algorithms

Our

framework

covers

the

standard

bit-vector

DFA

in

an

efficient

manner

it

allows

concise

high

level

specifications

and

the

generated

algorithms

are

guaranteed

to

be

linear

in

the

size

of

the

program

being

analysed

Moreover

it

supports

the

specification

of

and

reasoning

about

DFA-algorithms

Both

can

be

done

structurally

by

reasoning

within

the

modal

logic

serving

as

specification

language

The

framework

is

illustrated

by

means

of

an

example

of

practical

relevance

an

improved

version

of

Morel/Renvoise

's

algorithm

for

eliminating

partial

redundancies

-LSB-

MR

-RSB-

The

algorithm

generated

here

from

a

one

line

consists

of

a

sequence

of

a

backward

and

a

forward

analyses

Thus

our

algorithm

is

as

efficient

as

the

standard

uni-directional

algorithms

because

the

decomposition

of

the

usual

bi-directional

structure

into

a

sequence

of

two

uni-directional

analyses

guarantees

the

efficiency

of

the

well-known

bit-vector

techniques

Moreover

the

results

of

the

generated

algorithm

are

provably

optimal

To

our

knowledge

the

only

comparable

optimality

results

that

have

been

proved

before

are

the

ones

in

-LSB-

-RSB-

which

concern

more

complex

placement

algorithms

Summary

of

Technical

Results

Section

presents

the

program

representation

which

consists

of

transition

systems

where

nodes

and

states

are

labeled

This

representation

is

very

close

to

the

standard

models

for

modal

logics

-LSB-

-RSB-

and

it

allows

a

simple

adaptation

of

the

program

representations

used

in

DFA

For

example

nondeterministic

flow

graphs

a

standard

program

representation

in

DFA

can

be

easily

transformed

into

this

format

Section

develops

two

specification

languages

a

low

level

specification

language

with

a

general

fixpoint

operator

and

a

high

level

specification

language

where

the

general

fixpoint

such

algorithms

determine

things

like

life

variables

-LRB-

very

-RRB-

busy

expressions

or

use-definition

chains

-LSB-

He

-RSB-

this

type

of

algorithm

is

given

by

means

of

a

complex

equation

system

operator

is

replaced

by

intuitively

easy

to

understand

derived

operators

The

section

closes

with

logical

characterizations

of

structural

constraints

of

certain

program

models

Section

deals

with

a

real

life

example

A

bidirectional

DFA-algorithm

determining

the

optimal

placement

of

computations

within

programs

is

specified

and

its

correctness

and

optimality

is

established

The

development

in

this

section

is

dramatically

simplified

by

the

assumption

that

the

argument

programs

are

transformed

into

a

specific

format

-LRB-

transparent

placement

models

-RRB-

This

demonstrates

the

power

of

combining

simple

program

transformations

with

general

purpose

analysis

methods

Section

provides

a

correct

and

complete

model

checker

which

is

linear

in

the

size

of

the

program

model

being

Our

DFA-generator

works

by

partially

evaluating

this

model

checker

with

respect

to

the

modal

formula

used

to

specify

the

DFA-property

of

interest

This

partial

evaluation

process

is

illustrated

by

generating

a

DFA-algorithm

from

the

specification

developed

in

Section

Finally

Section

contains

conclusions

and

directions

for

future

work

Related

Work

Already

in

the

seventies

a

DFA-generator

has

been

developed

which

essentially

works

on

syntax

trees

and

generates

DFA-algorithms

from

specifications

given

as

computation

functions

for

attribute

values

-LSB-

-RSB-

Thus

its

specifications

explicitly

describe

the

way

in

which

the

program

properties

of

interest

are

determined

To

our

knowledge

this

principle

has

been

maintained

in

all

later

developments

-LRB-

eg

-LSB-

Gie

LPRS

SFRW

Ven

-RSB-

-RRB-

In

contrast

we

specify

DFA-algorithms

just

by

means

of

the

program

property

under

consideration

All

the

details

about

the

corresponding

analysis

algorithm

are

hidden

in

the

model

checker

our

approach

is

based

upon

This

yields

concise

high

level

specifications

simplifies

the

specification

development

and

supports

the

reasoning

about

features

such

as

correctness

and

optimality

of

the

corresponding

DFA-algorithms

Models

for

Programs

We

model

programs

as

transition

systems

whose

states

and

transitions

are

labeled

with

sets

of

atomic

propositions

and

actions

respectively

Intuitively

atomic

propositions

describe

properties

of

states

while

actions

describe

-LRB-

properties

of

-RRB-

statements

As

usual

the

control

flow

is

modelled

by

the

graph

structure

of

the

transition

system

Definition

A

program

model

P

is

a

quintuple

-LRB-

S

A

B

>=-RRB-

where

S

is

a

finite

set

of

nodes

or

program

states

A

is

a

set

of

atoms

The

subsets

of

A

play

the

role

of

what

is

usually

called

actions

We

will

denote

this

set

of

actions

by

Act

S

Act

S

is

a

set

of

labeled

transitions

which

define

the

control

flow

of

P.

B

is

a

set

of

atomic

propositions

is

a

function

S

that

labels

states

with

subsets

of

B

We

will

write

p

A

q

instead

of

-LRB-

p

A

q

-RRB-

and

given

Act

we

will

call

p

an

predecessor

of

q

and

q

an

successor

of

p

if

A

The

set

of

all

predecessors

and

successors

will

be

abbreviated

by

Pred

and

Succ

respectively

algorithm

is

a

variant

of

the

algorithm

presented

in

-LSB-

CES

-RSB-

modified

to

simplify

partial

evaluation

that

the

Act-predecessors

and

Act-successors

are

just

the

predecessors

and

successors

in

the

usual

sense

Essentially

a

program

model

is

a

combination

of

a

standard

labeled

transition

system

and

a

Kripke

structure

which

allows

us

to

speak

about

state

and

statement

properties

explicitly

and

separately

without

using

any

complicated

encodings

New

is

only

the

set

structure

of

the

actions

This

is

necessary

because

we

want

to

deal

with

abstract

interpretations

which

treat

concrete

statements

as

sets

of

properties

-LRB-

cf.

-LSB-

CC

-RSB-

-RRB-

However

one

should

abstract

from

the

internal

structure

of

actions

where

it

is

unimportant

like

e.g.

in

Section

and

most

of

Section

Definition

A

DFA-model

is

a

program

model

with

two

distinct

states

s

-LRB-

the

start

state

-RRB-

and

e

-LRB-

the

end

state

-RRB-

satisfying

s

and

e

do

not

possess

any

predecessor

and

successor

respectively

Every

program

state

is

reachable

from

s.

e

is

reachable

from

every

program

state

The

additional

requirements

for

DFA-models

are

standard

in

data

flow

analysis

In

fact

they

do

not

impose

any

restrictions

there

because

one

can

always

reach

this

format

by

eliminating

unreachable

parts

and

adding

nodes

s

and

e

appropriately

Modelling

Nondeterministic

Flow

Graphs

We

will

transform

nondeterministic

flow

graphs

into

DFA-models

Nondeterministic

flow

graphs

are

directed

graphs

whose

nodes

represent

statements

-LRB-

as

usual

we

will

concentrate

on

assignments

here

-RRB-

and

whose

edges

represent

the

flow

of

control

As

mentioned

above

we

can

additionally

assume

that

they

possess

unique

start

and

end

nodes

There

are

two

straightforward

ways

to

transform

flow

graphs

into

DFA-models

First

by

pushing

the

statements

from

the

nodes

into

the

outgoing

edges

In

this

case

we

arrive

at

a

precondition

model

because

here

the

nodes

will

represent

preconditions

to

the

statements

that

have

been

originally

associated

with

the

nodes

Second

and

dually

by

pushing

the

statements

upwards

into

the

ingoing

edges

Here

one

arrives

at

a

postcondition

model

In

the

discussion

of

our

example

we

will

deal

with

precondition

models

In

general

the

appropriate

choice

of

model

depends

on

the

particular

application

In

order

to

establish

the

setup

for

our

real

life

example

-LRB-

see

Section

-RRB-

let

V

and

T

be

sets

of

program

variables

and

program

terms

respectively

and

Ac

be

the

set

of

all

assignments

of

the

form

v

t

where

v

V

and

t

T.

Furthermore

let

B

df

fstart

endg

be

a

set

of

atomic

propositions

and

c

the

labeling

function

which

associates

the

empty

set

of

properties

with

each

node

of

the

model

except

for

c

-LRB-

s

-RRB-

fstartg

and

c

-LRB-

e

-RRB-

fendg

Then

the

precondition

model

-LRB-

or

equivalently

the

postcondition

model

-RRB-

of

a

flow

graph

forms

a

DFA

model

-LRB-

S

Ac

B

c

-RRB-

where

the

state

labeling

just

identifies

the

start

and

the

end

state

and

the

transition

labeling

the

statement

corresponding

to

a

state

transition

We

will

refer

to

such

DFA-models

as

concrete

DFA-models

However

the

DFA-models

we

want

to

deal

with

and

which

allow

an

automatic

analysis

arise

as

abstractions

from

concrete

DFA-models

A

typical

abstraction

is

given

by

choosing

Aa

fmod

-LRB-

t

-RRB-

j

t

Tg

-LSB-

fuse

-LRB-

t

-RRB-

j

t

Tg

as

the

set

of

transition

labels

together

with

the

abstraction

function

abstr

Ac

Aa

which

is

defined

by

abstr

-LRB-

fv

tg

-RRB-

df

fmod

-LRB-

-RRB-

j

v

is

subterm

of

-LSB-

fuse

-LRB-

-RRB-

j

is

a

subterm

of

tg

and

the

-LRB-

additivity

-RRB-

property

abstr

-LRB-

A

-RRB-

S

f

abstr

-LRB-

v

t

-RRB-

j

v

t

A

g

order

to

make

these

transformations

work

in

general

we

assume

that

start

and

end

nodes

of

flow

graphs

represent

skip

statements

Transitions

labeled

with

mod

-LRB-

t

-RRB-

or

use

-LRB-

t

-RRB-

represent

statements

that

modify

or

use

the

term

t

Our

illustrating

example

will

work

with

this

abstraction

which

is

tailored

to

address

problems

dealing

with

invariance

and

usage

of

program

terms

and

in

particular

program

variables

In

fact

many

DFA-problems

can

be

dealt

with

by

means

of

this

abstraction

or

slight

extensions

However

in

general

the

appropriate

abstract

interpretation

of

the

statements

must

be

chosen

problem

dependently

The

following

notion

of

computation

DAG

captures

the

essences

of

the

computational

behaviour

of

a

program

Definition

A

computation

DAG

is

a

totally

expanded

DFA-model

i.e.

every

backward

edge

is

transformed

into

a

forward

edge

by

copying

its

destiny

In

the

following

we

will

use

computation

DAGs

whenever

we

formally

deal

with

the

computational

behaviour

of

a

program

because

they

define

the

appropriate

level

of

abstraction

In

particular

they

allow

proofs

by

induction

on

the

depth

of

a

node

which

corresponds

to

the

number

of

computation

steps

that

have

been

executed

The

Specification

Languages

We

present

two

specification

languages

a

low

level

language

which

is

primary

and

a

derived

high

level

language

Whereas

the

low

level

language

is

used

to

formally

define

the

semantics

of

formulas

the

high

level

language

is

easier

to

understand

and

should

be

used

for

specification

Low

Level

Specifications

Our

low-level

specification

language

is

essentially

a

sublanguage

of

the

modal

mu-calculus

-LSB-

Koz

-RSB-

which

is

characterized

by

a

restricted

use

of

fixpoint

constructions

The

syntax

of

our

low

level

specification

language

is

parameterized

by

denumerable

sets

Var

B

and

Act

of

propositional

variables

atomic

propositions

and

actions

respectively

where

X

ranges

over

Var

over

B

and

over

subsets

of

Act

X

j

tt

j

j

j

j

-LSB-

-RSB-

j

-LSB-

-RSB-

j

X

The

semantics

of

closed

formulas

where

all

occurrences

of

variables

are

bound

by

some

fixpoint

operator

is

defined

with

respect

to

a

program

model

P

according

to

the

following

intuition

every

program

state

satisfies

the

formula

tt

while

program

state

p

satisfies

if

it

satisfies

both

and

Moreover

a

program

state

satisfies

if

it

does

not

satisfy

it

satisfies

if

it

is

labeled

by

a

set

containing

and

it

satisfies

-LSB-

-RSB-

if

every

of

its

successors

satisfies

Note

that

this

implies

that

a

program

state

p

satisfies

-LSB-

-RSB-

exactly

when

p

has

no

successors

Analogously

a

program

state

p

satisfies

-LSB-

-RSB-

if

every

predecessor

satisfies

Thus

in

analogy

a

program

state

p

satisfies

-LSB-

-RSB-

exactly

when

p

has

no

predecessors

The

formula

X

is

a

recursive

formula

and

should

be

thought

of

as

the

largest

solution

to

the

equation

X

Since

P

is

finite-state

this

formula

is

equivalent

to

the

infinite

conjunction

i

where

tt

i

-LSB-

i

X

-RSB-

that

the

-LRB-

similar

-RRB-

notion

of

computation

tree

would

not

be

sufficient

because

we

are

dealing

with

the

forward

as

well

as

the

backward

flow

of

programs

here

-LSB-

-LSB-

tt

-RSB-

-RSB-

S

-LSB-

-LSB-

-RSB-

-RSB-

-LSB-

-LSB-

-RSB-

-RSB-

-LSB-

-LSB-

-RSB-

-RSB-

-LSB-

-LSB-

-RSB-

-RSB-

S

n

-LSB-

-LSB-

-RSB-

-RSB-

-LSB-

-LSB-

-RSB-

-RSB-

fp

S

j

-LRB-

p

-RRB-

g

-LSB-

-LSB-

-LSB-

-RSB-

-RSB-

-RSB-

f

p

S

j

Succ

-LRB-

p

-RRB-

q

-LSB-

-LSB-

-RSB-

-RSB-

g

-LSB-

-LSB-

-LSB-

-RSB-

-RSB-

-RSB-

f

q

S

j

Pred

-LRB-

q

-RRB-

p

-LSB-

-LSB-

-RSB-

-RSB-

g

-LSB-

-LSB-

X

-RSB-

-RSB-

-LSB-

S

j

-LSB-

-LSB-

-RSB-

-RSB-

where

is

with

X

interpreted

as

g

Figure

The

semantics

of

formulas

and

the

substitution

-LSB-

X

-RSB-

is

defined

in

the

standard

way

As

usual

there

is

a

syntactic

restriction

on

expressions

of

the

form

X

which

is

necessary

to

ensure

the

continuity

of

the

fixpoint

operator

X

is

required

to

appear

within

the

range

of

an

even

number

of

negations

in

All

this

is

completely

standard

except

for

the

meaning

of

modalities

which

is

defined

for

sets

of

actions

here

rather

than

just

for

single

actions

This

is

a

convenient

generalization

which

simplifies

the

representation

of

certain

properties

enormously

-LRB-

cf.

-LSB-

BS

-RSB-

-RRB-

The

formal

semantic

definition

of

the

logic

is

given

in

Figure

It

maps

closed

formulas

to

sets

of

program

states

intuitively

the

program

states

for

which

the

formula

is

true

Note

that

the

semantics

of

X

is

based

on

Tarski

's

fixpoint

theorem

-LSB-

Tar

-RSB-

its

meaning

is

defined

as

the

greatest

fixpoint

of

a

continuous

function

over

the

powerset

of

the

set

of

states

The

continuity

of

this

function

follows

from

the

syntactic

restriction

mentioned

above

which

deals

with

the

problems

of

negations

and

the

continuity

of

the

semantic

interpretations

of

the

other

propositional

constructors

In

the

following

we

will

write

-LSB-

-RSB-

or

-LSB-

-RSB-

instead

of

-LSB-

Act

-RSB-

or

-LSB-

Act

-RSB-

Moreover

as

usual

we

can

define

the

following

duals

to

the

operators

of

our

language

and

the

implication

operator

-RRB-

by

tt

:-LRB-

-RRB-

h

i

-RSB-

-LRB-

-RRB-

h

i

-RSB-

-LRB-

-RRB-

X

X

:-LRB-

-LSB-

X

X

-RSB-

-RRB-

-RRB-

Our

low

level

specification

language

consists

of

all

closed

and

guarded

formulas

where

no

variables

occur

free

inside

the

scope

of

a

fixpoint

expression

Closed

means

that

all

variables

are

bound

by

a

fixpoint

operator

and

guarded

that

they

all

occur

inside

the

range

of

a

modality

In

future

we

will

also

use

the

derived

operators

except

for

the

minimal

fixpoint

operator

which

we

avoid

here

in

order

to

keep

the

presentation

of

the

model

checker

-LRB-

Section

-RRB-

as

simple

as

possible

point

of

this

condition

is

to

avoid

the

possibility

of

alternated

nesting

-LSB-

EL

-RSB-

Of

course

there

are

weaker

conditions

to

guarantee

this

but

they

are

unnecessarily

complicated

for

our

purpose

UF

F

y

y

UF

y

F

y

Figure

The

Weak

Until

Operator

High

Level

Specifications

The

recursive

proposition

constructors

add

a

tremendous

amount

of

expressive

power

to

the

logic

-LRB-

cf.

-LSB-

EL

-RSB-

-RRB-

For

example

they

allow

the

description

of

invariance

-LRB-

or

safety

-RRB-

and

eventuality

-LRB-

or

liveness

-RRB-

properties

However

general

fixpoint

formulas

are

in

general

unintuitive

and

difficult

to

understand

Therefore

we

will

consider

the

intuitively

easy

to

understand

derived

Henceforth

and

Until

operators

of

the

temporal

logic

CTL

-LSB-

CES

-RSB-

AG

X

-LRB-

-LSB-

-RSB-

X

-RRB-

U

X

-LRB-

-LRB-

-LSB-

-RSB-

X

-RRB-

-RRB-

and

their

past-time

counterparts

AG

X

-LRB-

-LSB-

-RSB-

X

-RRB-

U

X

-LRB-

-LRB-

-LSB-

-RSB-

X

-RRB-

-RRB-

U

holds

of

p

if

holds

for

every

state

of

every

path

that

starts

in

p

until

a

state

is

reached

where

is

true

while

U

holds

of

p

if

holds

for

every

state

of

every

path

that

ends

in

p

after

has

been

true

the

last

time

This

is

illustrated

in

Figure

which

sketches

the

essence

of

these

definitions

on

a

computation

DAG

AG

is

simply

an

abbreviation

for

U

ff

Our

high

level

specification

language

which

will

be

denoted

by

L

arises

from

the

low

level

specification

language

by

replacing

the

general

fixpoint

operator

with

the

operators

established

above

This

language

is

quite

expressive

and

it

allows

concise

specifications

of

the

standard

bit-vector

algorithms

In

addition

to

this

our

specification

language

is

expressive

enough

to

cover

structural

properties

of

program

models

as

well

This

allows

us

to

prove

properties

of

DFA-algorithms

within

our

logical

framework

even

if

these

properties

depend

on

structural

restrictions

of

the

program

models

under

consideration

For

example

the

three

structural

restrictions

for

DFA-models

given

in

Definition

are

characterized

by

Proposition

-LRB-

DFA-Models

-RRB-

A

DFA-model

is

characterized

by

universally

satisfying

the

following

three

properties

-LRB-

start

-RRB-

-LSB-

-RSB-

-RRB-

-LRB-

end

-RRB-

-LSB-

-RSB-

-RRB-

:-LRB-

AG

start

-RRB-

:-LRB-

AG

end

-RRB-

-LSB-

-RSB-

more

complex

operators

have

been

introduced

In

this

exposition

I

will

concentrate

on

a

specific

format

of

program

models

which

can

easily

be

obtained

by

transformation

-LRB-

see

Section

-RRB-

and

simplifies

the

specification

of

the

data

flow

analysis

algorithms

enormously

Whereas

part

-LRB-

-RRB-

is

obvious

parts

-LRB-

-RRB-

and

-LRB-

-RRB-

express

the

corresponding

properties

of

a

DFA

model

indirectly

part

-LRB-

-RRB-

says

for

every

state

of

the

model

it

is

not

the

case

that

all

the

path

never

reach

the

end

state

which

is

equivalent

to

from

every

state

there

exists

a

path

reaching

the

end

state

Part

-LRB-

-RRB-

is

expressed

analogously

Also

a

property

of

precondition

models

which

is

important

for

the

proof

of

the

Correctness

Theorem

and

the

Optimality

Theorem

can

be

stated

within

our

specification

language

This

requires

the

introduction

of

the

set

complement

operator

c

which

will

also

be

used

in

the

sequel

Proposition

-LRB-

Precondition

Models

-RRB-

A

precondition

model

satisfies

universally

for

every

Act

h

itt

-RRB-

-LSB-

c

-RSB-

ff

Intuitively

this

property

means

that

all

the

transitions

of

a

state

-LRB-

program

point

-RRB-

in

a

precondition

model

are

labelled

identically

This

property

is

valid

in

precondition

models

because

there

the

labels

of

all

the

transitions

leaving

a

specific

state

are

derived

from

the

same

statement

Example

Optimal

Placement

of

Computations

In

this

section

we

will

develop

a

specification

of

a

bi-directional

DFA-algorithm

that

determines

optimal

computation

points

for

a

given

term

t

within

a

DFA-model

-LRB-

flow

graph

-RRB-

During

this

development

we

will

fix

t

which

simplifies

the

notation

because

we

can

drop

t

from

the

argument

list

of

the

predicates

Transparent

Placement

Models

It

is

well-known

that

in

completely

arbitrary

graph

structures

the

placement

process

may

deliver

unsatisfactory

results

because

specific

patterns

may

cause

that

the

code

motion

process

gets

blocked

-LRB-

for

details

see

e.g.

-LRB-

cf.

-LSB-

RWZ

-RSB-

-RRB-

This

problem

can

be

solved

by

means

of

the

following

transformation

insert

an

artificial

state

into

each

original

transition

that

ends

at

a

state

with

more

than

one

predecessor

whose

-LRB-

unique

-RRB-

ingoing

transition

maintains

the

label

of

the

splitted

original

transition

and

whose

-LRB-

unique

-RRB-

outgoing

transition

is

labeled

with

the

empty

statement

skip

-LRB-

cf.

-LSB-

Dha

-RSB-

-RRB-

In

fact

this

transformation

preserves

the

central

property

of

precondition

models

in

the

following

sense

the

result

after

this

transformation

is

the

same

as

if

the

transition

splitting

would

have

been

done

for

the

original

flow

graph

by

inserting

skip

nodes

and

subsequently

constructing

the

precondition

model

for

this

transformed

flow

graph

For

DFA-models

the

essence

of

this

transformation

can

be

characterized

logically

as

follows

Characterization

of

Placement

Models

A

placement

model

is

characterized

by

universally

satisfying

the

following

three

properties

-LRB-

-RRB-

-LSB-

-RSB-

-LSB-

-RSB-

-RRB-

-LRB-

h

i

-RRB-

-LSB-

-RSB-

-RRB-

-LRB-

-RRB-

-LSB-

-RSB-

-LSB-

-RSB-

-RRB-

-LRB-

h

i

-RRB-

-LSB-

-RSB-

-RRB-

and

Act

h

itt

-RRB-

-LSB-

c

-RSB-

ff

Intuitively

the

first

property

means

that

there

are

two

classes

of

states

in

a

placement

model

-LSB-

Dha

-RSB-

this

is

done

implicitly

by

placing

the

computations

in

the

edges

of

the

flow

graph

under

consideration

A

-RRB-

B

-RRB-

Figure

Placement

Models

A

A

n

A

i

A

j

Figure

Transparent

Models

ffl

the

ones

that

are

similar

to

-LRB-

have

exactly

the

same

properties

as

-RRB-

all

their

brothers

as

it

is

illustrated

in

Figure

-LRB-

A

-RRB-

and

ffl

the

ones

whose

predecessors

are

all

similar

as

it

is

illustrated

in

Figure

-LRB-

B

-RRB-

The

second

property

is

the

forward

analogon

of

the

first

property

and

the

third

property

guarantees

that

all

the

transitions

that

lead

to

the

same

state

have

identical

labels

In

fact

it

is

possible

to

obtain

an

optimal

placement

algorithm

as

soon

as

we

restrict

ourselves

to

precondition

models

with

this

property

-LRB-

cf.

Optimality

Theorem

-RRB-

From

the

specification

point

of

view

these

models

are

particularly

interesting

because

they

are

transparent

in

the

following

sense

they

allow

to

control

the

transition

properties

by

means

of

state

properties

which

simplifies

our

specification

framework

This

control

is

due

to

the

fact

that

the

label

of

the

last

and

the

next

transition

are

determined

by

the

current

state

Figure

illustrates

the

essence

of

the

following

corollary

which

implicitly

formalizes

the

notion

of

transparency

Corollary

-LRB-

Transparency

-RRB-

A

precondition

placement

model

satisfies

universally

for

every

Act

h

itt

-RRB-

-LSB-

c

-RSB-

ff

h

itt

-RRB-

-LSB-

c

-RSB-

ff

The

corollary

is

simply

the

conjunction

of

Proposition

and

the

third

characterizing

property

for

placement

models

-LSB-

-RSB-

much

more

complicated

specifications

needed

to

be

introduced

in

order

to

deal

with

slightly

more

general

models

Correctness

and

Optimality

of

a

Placement

In

this

section

we

are

going

to

prepare

the

proof

of

our

claim

that

the

placement

of

computations

specified

in

this

paper

is

optimal

i.e.

better

than

every

other

placement

which

is

guaranteed

to

be

correct

In

order

to

establish

this

result

within

our

logical

framework

we

need

to

formalize

in

the

logic

what

it

means

to

be

correct

and

better

The

following

conventions

which

are

justified

by

Corollary

support

a

concise

formalization

Conventions

ffl

p

j

h

itt

is

abbreviated

by

p

j

ffl

p

j

h

itt

is

abbreviated

by

p

j

Moreover

we

define

M

df

f

A

j

mod

A

g

and

U

df

f

A

j

use

A

g

and

we

will

allow

a

set

of

states

to

be

regarded

as

an

atomic

proposition

that

is

true

exactly

for

its

members

-LCB-

The

latter

propositions

do

not

appear

in

the

specification

of

the

algorithm

They

are

only

necessary

when

reasoning

about

the

properties

of

the

specified

algorithm

Correctness

A

correct

placement

of

the

computations

of

a

term

t

is

a

set

S

of

states

which

guarantees

that

the

following

program

transformation

does

not

effect

the

program

semantics

ffl

Initialize

a

distinct

auxiliary

variable

-LRB-

or

a

register

-RRB-

h

at

every

state

of

S.

ffl

Replace

every

original

computation

of

t

by

h

In

particular

a

correct

placement

of

computations

must

guarantee

that

the

auxiliary

variable

contains

the

required

value

at

each

of

its

usages

and

that

the

introduction

of

the

computations

of

t

at

S

does

not

introduce

any

new

values

on

any

paths

Whereas

the

need

for

the

first

requirement

the

definedness

is

immediately

clear

the

second

requirement

the

safety

is

necessary

because

the

introduction

of

new

computations

may

lead

to

new

run-time

errors

e.g.

division

by

or

overflow

Definedness

is

logically

expressed

by

requiring

that

each

backward

path

from

a

state

satisfying

U

will

not

meet

the

start

state

or

a

modifying

transition

before

a

member

of

S

is

Definition

A

subset

set

S

S

-LRB-

here

regarded

as

a

set

of

computation

points

-RRB-

guarantees

definedness

if

every

state

of

the

program

model

definedness

-LRB-

S

-RRB-

df

U

-RRB-

-LRB-

-LRB-

M

start

-RRB-

-RRB-

U

S

More

intuitively

this

property

could

be

read

as

follows

on

each

path

to

a

usage

of

t

there

is

a

member

of

S

-LRB-

a

computation

point

-RRB-

after

which

the

value

of

t

is

guaranteed

to

be

preserved

The

definition

of

safety

follows

a

similar

pattern

Definition

A

subset

set

S

S

-LRB-

again

viewed

as

a

set

of

computation

points

-RRB-

is

safe

if

the

following

predicate

holds

of

all

states

safety

-LRB-

S

-RRB-

df

S

-RRB-

-LRB-

-LRB-

-LRB-

M

start

-RRB-

-RRB-

U

U

-RRB-

-LRB-

-LRB-

-LRB-

M

end

-RRB-

-RRB-

U

U

-RRB-

This

formalization

is

based

on

the

observation

that

for

a

given

computation

point

safety

is

equivalent

to

the

requirement

that

the

computations

must

either

occur

on

each

path

ending

at

this

or

they

must

occur

on

each

path

starting

in

it

and

ending

in

the

end

state

meaning

pattern

is

typical

for

specifications

in

our

framework

the

definition

of

M

which

simply

says

that

the

transitions

entering

the

currently

considered

state

are

labeled

by

a

member

of

M

i.e.

they

modify

t.

means

that

the

computation

is

redundant

at

this

point

that

the

computation

is

necessary

at

this

point

This

equivalence

is

due

to

the

fact

that

there

are

now

mixed

situations

because

every

path

reaching

a

certain

program

point

can

be

continued

by

every

path

leaving

this

point

Given

two

arbitrary

subsets

S

and

of

S

we

consider

as

being

better

than

S

if

on

every

path

through

the

program

model

the

number

of

occurrences

of

states

of

S

is

as

least

as

large

as

the

number

of

occurrences

of

states

of

This

reflects

the

intuition

that

a

set

of

computation

points

is

better

than

another

one

if

it

causes

less

computations

during

the

program

execution

The

following

logical

formulation

is

more

restrictive

because

it

additionally

requires

that

the

members

of

the

better

set

of

computation

points

must

also

occur

earlier

This

slightly

stronger

requirement

will

be

satisfied

by

the

placement

specified

in

the

next

section

Definition

Let

S

S

be

arbitrary

sets

of

states

Then

is

better

than

S

if

the

following

predicate

holds

universally

-LRB-

Sc

-RRB-

-RRB-

-LSB-

-RSB-

-LRB-

-LRB-

-LRB-

end

-RRB-

-RRB-

U

S

-RRB-

Intuitively

the

formula

guarantees

that

all

the

and

the

end

state

are

pairwisely

separated

by

S-occurrences

The

Specification

of

an

Optimal

Placement

In

our

framework

DFA-algorithms

are

specified

by

means

of

the

program

property

they

are

checking

for

Thus

the

DFA-algorithm

to

determine

the

optimal

placement

of

computations

is

specified

by

means

of

the

specification

of

the

optimal

computation

points

These

can

be

characterized

in

two

steps

As

mentioned

in

the

previous

section

the

placement

must

be

safe

This

property

is

satisfied

if

all

the

inserted

computations

are

necessary

i.e.

satisfy

the

second

disjunct

in

the

definition

of

safety

Guaranteeing

Safety

NEC

df

-LRB-

-LRB-

M

end

-RRB-

-RRB-

U

U

The

definedness

will

be

guaranteed

by

the

requirement

that

computations

should

be

placed

as

early

as

possible

Note

that

a

computation

can

only

be

moved

upwards

if

it

can

be

moved

upwards

along

every

ingoing

transition

Thus

earliestness

means

intuitively

that

such

a

movement

is

not

possible

without

violating

correctness

In

particular

the

start

state

is

earliest

because

there

it

is

not

possible

to

move

the

computation

up

at

all

Earliestness

EAR

df

start

-LRB-

-LSB-

-RSB-

-LRB-

-LRB-

-LRB-

M

start

-RRB-

-RRB-

U

-LRB-

NEC

M

-RRB-

-RRB-

-RRB-

Figure

illustrates

the

negation

of

earliestness

on

each

path

to

the

currently

considered

state

there

exists

an

earlier

state

which

could

safely

be

used

for

the

initialization

of

the

auxiliary

variable

Technically

this

is

expressed

by

these

earlier

states

satisfying

NEC

and

the

connecting

paths

being

modification-free

The

combination

of

necessity

and

earliestness

yields

the

desired

specification

The

Computation

Points

OCP

df

EAR

NEC

As

will

be

established

in

the

next

subsection

OCP

is

already

the

complete

specification

of

the

DFA-algorithm

that

determines

the

optimal

computation

points

-LRB-

for

t

-RRB-

Thus

a

subsequent

program

transformation

which

S

-LRB-

M

start

-RRB-

a

a

a

M

NEC

Figure

Earliestness

ffl

initializes

an

auxiliary

variable

at

each

program

point

satisfying

OCP

and

ffl

replaces

all

the

original

computations

-LRB-

of

t

-RRB-

by

this

auxiliary

variable

places

the

computations

of

t

optimally

within

a

precondition

placement

model

During

the

rest

of

this

section

let

SI

df

f

s

j

s

j

OCP

g

Then

the

following

theorem

yields

that

OCP

specifies

a

correct

placement

-LRB-

set

of

program

points

or

states

-RRB-

Theorem

-LRB-

Correctness

-RRB-

In

precondition

placement

models

we

have

ffl

safety

-LRB-

SI

-RRB-

ffl

definedness

-LRB-

SI

-RRB-

Proof

Whereas

the

proof

of

the

first

part

is

immediate

from

the

definitions

the

second

part

needs

an

inductive

argument

on

the

depth

of

the

computation

DAG

Because

U

implies

NEC

it

is

enough

to

show

-LRB-

-RRB-

NEC

implies

-LRB-

M

start

-RRB-

-RRB-

U

SI

for

every

state

of

a

precondition

placement

model

We

proceed

by

induction

on

the

depth

in

the

corresponding

computation

DAG

-LRB-

-RRB-

is

trivially

true

for

the

start

state

s

where

the

earliestness

predicate

is

always

satisfied

Thus

let

p

s

be

a

state

of

the

computation

DAG

such

that

all

states

q

with

smaller

depth

in

the

computation

DAG

satisfy

-LRB-

-RRB-

Then

the

following

holds

at

state

p

NEC

implies

SI

EAR

implies

SI

-LRB-

-LRB-

-LSB-

-RSB-

-LRB-

-LRB-

-LRB-

M

start

-RRB-

-RRB-

U

-LRB-

NEC

M

-RRB-

-RRB-

-RRB-

start

-RRB-

implies

SI

-LRB-

-LRB-

-LSB-

-RSB-

-LRB-

-LRB-

-LRB-

M

start

-RRB-

-RRB-

U

-LRB-

-LRB-

-LRB-

-LRB-

M

start

-RRB-

-RRB-

U

SI

-RRB-

M

-RRB-

-RRB-

-RRB-

start

-RRB-

implies

SI

-LRB-

-LRB-

M

-LRB-

-LSB-

-RSB-

-LRB-

-LRB-

-LRB-

M

start

-RRB-

-RRB-

U

-LRB-

-LRB-

-LRB-

M

start

-RRB-

-RRB-

U

SI

-RRB-

-RRB-

-RRB-

-RRB-

start

-RRB-

implies

SI

-LRB-

-LRB-

M

start

-RRB-

-LRB-

-LSB-

-RSB-

-LRB-

-LRB-

-LRB-

M

start

-RRB-

-RRB-

U

SI

-RRB-

-RRB-

-RRB-

implies

-LRB-

M

start

-RRB-

-RRB-

U

SI

where

the

third

implication

follows

by

induction

the

fourth

is

a

rearrangement

of

the

formalization

that

guarantees

the

absence

of

intermediate

the

fifth

implication

is

a

consequence

of

the

logical

equivalence

between

U

-LRB-

U

-RRB-

and

U

and

all

the

other

implications

are

straightforward

Finally

let

us

turn

to

establishing

the

optimality

of

the

placement

This

requires

some

preparation

Lemma

The

following

holds

universally

in

every

precondition

placement

model

NEC

-RRB-

-LRB-

NEC

-RRB-

U

U

EAR

-RRB-

-LRB-

EAR

-RRB-

U

M

and

-LRB-

SI

U

-RRB-

-RRB-

-LSB-

-RSB-

-LRB-

-LRB-

-LRB-

SI

end

-RRB-

U

U

-RRB-

Proof

Obviously

we

have

NEC

-RRB-

-LSB-

-RSB-

-LRB-

NEC

U

-RRB-

and

therefore

by

a

simple

inductive

extension

the

first

part

of

the

proof

The

proof

of

the

second

part

is

similar

For

the

proof

of

the

third

part

we

first

observe

that

the

necessity

requirement

for

the

members

of

SI

reduces

our

goal

to

the

statement

that

every

p

SI

with

p

j

U

satisfies

p

j

-LSB-

-RSB-

-LRB-

-LRB-

SI

U

U

-RRB-

because

it

is

not

possible

to

reach

the

end

state

before

meeting

a

state

satisfying

U

This

means

that

every

path

between

p

and

another

member

q

of

SI

has

at

least

one

U-occurrence

Thus

let

ss

be

such

a

path

Then

we

can

assume

without

loss

of

generality

that

-LRB-

a

-RRB-

p

is

not

the

predecessor

of

q

in

ss

because

this

would

only

be

possible

in

case

of

p

j

M

U

-LRB-

b

-RRB-

NEC

holds

along

ss

because

part

-LRB-

-RRB-

of

this

lemma

would

otherwise

require

a

U-occurrence

in

order

to

retain

NEC

for

p

and

that

-LRB-

c

-RRB-

every

intermediate

state

lies

in

SI

c

Now

-LRB-

c

-RRB-

and

the

definition

of

SI

yields

that

of

the

intermediate

states

of

ss

satisfy

EAR

On

the

other

hand

q

SI

yields

q

j

EAR

Thus

applying

part

-LRB-

-RRB-

of

this

lemma

we

obtain

that

q

must

satisfy

M

Now

-LRB-

b

-RRB-

implies

that

the

predecessor

of

q

in

ss

satisfies

U

and

therefore

the

existence

of

the

required

U-occurrence

in

ss

After

this

preparation

we

are

able

to

prove

our

optimality

result

Theorem

-LRB-

Optimality

-RRB-

The

placement

of

computations

specified

by

OCP

is

better

than

every

other

correct

placement

Proof

Let

S

S

be

an

arbitrary

correct

placement

of

computations

Then

we

must

show

-LRB-

-RRB-

-LRB-

SI

Sc

-RRB-

-RRB-

-LSB-

-RSB-

-LRB-

-LRB-

-LRB-

SI

end

-RRB-

-RRB-

U

S

-RRB-

As

a

first

step

we

show

that

this

goal

is

implied

by

-LRB-

-RRB-

SI

-RRB-

-LRB-

U

-RRB-

U

S

The

correctness

of

this

reduction

is

a

consequence

of

the

following

sequence

of

implications

which

derives

-LRB-

-RRB-

from

-LRB-

-RRB-

by

means

of

Lemma

-LRB-

-RRB-

SI

implies

-LRB-

-LRB-

U

-RRB-

U

S

-RRB-

-LRB-

U

-LSB-

-RSB-

-LRB-

-LRB-

-LRB-

SI

end

-RRB-

-RRB-

U

U

-RRB-

-RRB-

implies

-LRB-

U

S

-RRB-

-LRB-

U

-LSB-

-RSB-

-LRB-

-LRB-

U

-RRB-

U

S

-RRB-

-LSB-

-RSB-

-LRB-

-LRB-

-LRB-

SI

end

-RRB-

-RRB-

U

U

-RRB-

-RRB-

implies

S

-LRB-

U

-LSB-

-RSB-

-LRB-

-LRB-

-LRB-

U

-RRB-

U

S

-RRB-

-LRB-

-LRB-

-LRB-

SI

end

-RRB-

-RRB-

U

U

-RRB-

-RRB-

-RRB-

implies

S

-LSB-

-RSB-

-LRB-

-LRB-

-LRB-

SI

end

-RRB-

-RRB-

U

S

-RRB-

that

we

are

only

considering

transparent

models

here

Thus

it

remains

to

verify

-LRB-

-RRB-

Let

therefore

-LRB-

pn

-RRB-

be

a

path

in

the

model

under

consideration

satisfying

ffl

j

SI

ffl

n

pi

j

U

and

ffl

pn

j

U

Then

it

is

obviously

enough

to

show

-LRB-

-RRB-

ng

pi

j

S

First

we

obtain

because

of

j

SI

that

j

EAR

start

-LRB-

-LSB-

-RSB-

-LRB-

-LRB-

-LRB-

M

start

-RRB-

-RRB-

U

-LRB-

NEC

M

-RRB-

-RRB-

In

the

case

of

j

start

the

definedness

property

for

S

directly

implies

-LRB-

-RRB-

Thus

we

can

assume

that

there

exists

a

path

-LRB-

qm

-RRB-

satisfying

ffl

j

M

start

and

ffl

mg

qi

j

NEC

ffl

qm

is

a

predecessor

of

Now

let

ss

-LRB-

rn

m

-RRB-

be

the

concatenation

of

and

Obviously

ss

is

a

path

from

a

state

satisfying

M

start

to

a

state

satisfying

U

and

therefore

because

of

the

definedness

property

for

S

possesses

a

component

ri

with

ri

j

S.

Thus

it

remains

to

show

that

i

m

This

however

is

a

consequence

of

the

fact

that

mg

ri

qi

j

NEC

excludes

the

validity

of

the

safety

property

for

i

mg

whereas

the

first

disjunct

in

the

definition

of

safety

is

explicitly

excluded

the

second

disjunct

can

also

not

be

valid

because

it

would

require

mg

ri

j

U

which

in

conjunction

with

the

fact

that

U

implies

NEC

would

lead

to

a

contradiction

DFA-Generation

The

Principle

The

principle

of

the

DFA-generator

proposed

here

is

partial

evaluation

of

an

appropriate

model

checker

with

respect

to

the

modal

formula

that

serves

as

the

specification

of

the

DFA-algorithm

The

model

checker

we

are

going

to

use

is

a

variant

of

the

algorithm

presented

in

-LSB-

CES

-RSB-

modified

to

support

partial

evaluation

with

respect

to

the

specifying

formula

It

iteratively

determines

the

set

of

all

states

of

the

program

model

under

consideration

that

satisfy

the

argument

formula

This

is

done

by

computing

a

maximal

fixpoint

over

a

node

labeling

consisting

of

bit-vectors

that

represent

approximate

truth

values

of

certain

-LRB-

low

level

-RRB-

modal

formulas

Our

model

checker

works

in

four

steps

that

n

may

well

be

The

Model

Checker

Translate

the

high

level

specification

into

the

corresponding

low

level

specification

This

can

be

done

in

a

straightforward

manner

However

one

can

also

add

optimizations

here

that

yield

an

equivalent

but

more

compact

representation

as

for

example

the

shared

representation

used

in

Section

Construct

a

-LRB-

higher

order

-RRB-

function

from

the

low

level

formula

that

associates

every

program

state

of

every

potential

program

model

with

its

corresponding

predicate

transformer

i.e.

with

a

function

that

computes

the

next

approximate

bit-vector

labeling

for

a

given

program

state

from

the

current

approximate

solutions

-LRB-

bit-vector

values

-RRB-

of

its

predecessors

and

successors

The

resulting

predicate

transformers

operate

on

bit-vectors

having

one

component

corresponding

to

each

subformula

that

appears

as

an

operand

of

a

modality

We

will

refer

to

these

subformulas

as

critical

subformulas

Given

a

program

point

p

and

a

critical

subformula

the

predicate

transformers

update

the

corresponding

bitvector

component

with

the

truth

value

of

the

formula

that

arises

from

by

replacing

all

subformulas

having

a

modality

as

the

top

most

operator

by

their

truth

value

under

the

current

approximation

-LRB-

see

Figure

for

illustration

-RRB-

All

this

is

rather

straightforward

except

for

the

following

fact

approximations

for

critical

subformulas

that

are

separated

by

negation

operations

must

be

computed

in

a

hierarchical

manner

in

order

to

guarantee

the

monotonicity

of

the

iteration

process

Therefore

the

low

level

formula

is

also

partitioned

into

monotonicity

levels

the

iteration

mechanism

of

the

third

step

depends

upon

Note

however

that

all

this

can

be

done

independently

of

the

particular

program

model

under

consideration

Compute

the

greatest

fixpoint

over

the

bit-vector

labeling

of

the

program

model

under

consideration

with

respect

to

the

predicate

transformers

that

have

been

generated

by

the

algorithm

of

the

second

step

This

can

be

done

by

means

of

a

standard

work

list

modified

to

determine

the

fixpoints

monotonicity-level-wise

a

level

gets

executed

if

all

its

sub-levels

are

already

dealt

with

The

computation

of

the

greatest

fixpoint

for

a

given

monotonicity

level

proceeds

in

two

steps

-LRB-

a

-RRB-

Initialize

the

bit-vectors

of

all

program

states

to

tt

Note

that

the

usual

frame

conditions

are

implicit

in

the

atomic

propositions

the

states

are

labeled

with

e.g.

start

and

end

-LRB-

see

Section

-RRB-

-LRB-

b

-RRB-

Process

the

elements

of

the

work

list

by

applying

their

corresponding

predicate

transformer

until

the

maximal

fixpoint

is

reached

Finally

for

each

state

the

value

of

the

complete

specifying

formula

s

is

determined

using

the

fixpoint

values

computed

in

the

third

step

We

will

write

p

s

if

this

yields

tt

for

p

This

model

checker

is

quite

general

it

can

easily

be

extended

to

larger

high

level

languages

just

by

extending

the

first

step

In

particular

an

extension

covering

CTL

can

be

obtained

straightforwardly

-LCB-

In

analogy

to

-LSB-

CES

-RSB-

we

have

Theorem

-LRB-

Correctness

Completeness

and

Efficiency

-RRB-

Let

P

be

a

program

model

and

p

be

a

state

of

P

Then

we

have

p

iff

p

-LSB-

-LSB-

-RSB-

-RSB-

Moreover

the

effort

to

determine

the

set

of

all

states

satisfying

is

proportional

to

the

size

of

P.

work

list

is

a

mean

to

obtain

a

fair

and

therefore

terminating

computation

U

-LSB-

-RSB-

v

M

U

-LRB-

M

end

-RRB-

v

A

-RRB-

U

v

v

start

n

X

-LSB-

-RSB-

-LRB-

M

start

-RRB-

v

U

v

M

v

v

n

X

v

-LRB-

M

end

-RRB-

v

v

-LSB-

-RSB-

B

-RRB-

v

v

start

-LRB-

M

start

-RRB-

v

Figure

Construction

of

the

Low

Level

Specification

Representation

Partial

evaluation

of

this

model

checker

with

respect

to

a

high

level

specification

consists

of

executing

the

first

two

-LRB-

program

independent

-RRB-

steps

This

can

be

automated

yielding

a

generator

that

produces

nested

iterative

data

flow

analysis

algorithms

from

modal

specifications

whose

worst

case

run

time

complexity

is

proportional

to

the

size

of

P

Instead

of

going

into

formal

detail

here

we

will

rather

continue

our

real

life

example

for

illustration

Continuation

of

the

Example

Generating

the

DFA-Algorithm

The

evaluation

of

the

first

step

transforms

the

specifying

formula

OCP

EAR

NEC

stepwisely

by

means

of

macro

substitution

into

the

graph

representations

shown

in

Figure

Such

shared

representations

take

care

of

common

subexpressions

and

therefore

improve

the

efficiency

of

the

DFA-algorithm

generated

The

second

step

constructs

a

higher

order

function

that

associates

every

state

of

a

program

model

with

a

predicate

transformer

which

realizes

the

evaluation

of

the

formula

above

in

the

current

In

our

example

the

predicates

are

represented

by

means

of

bit-vectors

required

it

is

also

possible

to

straightforwardly

generate

traditional

equational

specifications

of

data

flow

U

-LRB-

-LRB-

-LRB-

M

end

-RRB-

-RRB-

-LRB-

-RRB-

-RRB-

v

V

v

v

-LRB-

M

-RRB-

-LRB-

-LRB-

M

start

-RRB-

-LRB-

-RRB-

-RRB-

v

v

v

V

v

Figure

The

Predicate

Transformer

of

length

two

whose

components

hold

the

current

approximations

of

the

values

of

the

subformulas

that

are

marked

with

an

extra

circle

in

Figure

This

choice

reflects

the

fact

that

during

the

global

iteration

process

the

only

relevant

information

is

given

by

the

approximate

values

of

the

subformulas

that

appear

as

an

operand

of

a

modality

The

values

of

all

the

other

subformulas

can

be

computed

locally

Figure

shows

how

the

approximate

bit-vector

values

are

updated

in

step

-LRB-

b

-RRB-

here

the

next

approximation

for

the

first

bit

of

the

bit-vector

in

the

center

of

the

picture

is

computed

with

respect

to

the

conjunction

of

the

approximate

solutions

for

the

first

bits

of

the

successor

states

Analogously

the

value

of

the

second

component

of

this

bit-vector

is

updated

with

respect

to

its

own

first

bit

and

the

conjunction

of

the

approximate

values

of

the

second

components

of

its

predecessor

states

The

two

-LRB-

automatic

-RRB-

evaluation

steps

described

above

generate

an

iterative

DFA-algorithm

for

the

placement

problem

which

directly

runs

on

the

machine

the

model

checker

is

implemented

on

It

is

worth

noting

that

we

only

need

to

iterate

according

to

two

Boolean

values

here

one

for

the

forward

flow

and

one

for

the

backward

flow

This

flow

structure

is

much

cleaner

and

simpler

than

in

previous

algorithms

where

backward

and

forward

flow

are

interwoven

-LRB-

cf.

-LSB-

Dha

MR

-RSB-

-RRB-

Besides

yielding

clarity

this

simplicity

also

improves

the

run

time

behaviour

of

the

algorithm

because

it

guarantees

the

efficiency

of

the

well-known

bit

vector

techniques

for

reducible

flow

graphs

analyses

from

our

modal

specifications

Conclusion

and

Future

Work

A

framework

has

been

developed

using

a

modal

logic

for

the

specification

of

DFA-algorithms

Main

achievements

of

this

development

are

the

DFA-generator

which

works

by

partial

evaluation

of

a

specific

model

checker

and

the

compositionality

of

both

the

development

of

DFA

specifications

and

the

structure

of

proofs

of

properties

of

the

DFA-algorithms

generated

All

these

features

have

been

illustrated

by

means

of

the

problem

of

optimally

placing

computations

within

a

program

This

example

is

particularly

suitable

for

illustration

because

it

is

complex

enough

to

require

a

nontrivial

specification

and

verification

phase

Moreover

the

automatically

generated

algorithm

improved

on

previously

know

algorithm

for

this

problem

Currently

we

focus

on

imperative

languages

and

plan

as

a

first

step

to

implement

a

generator

for

intraprocedural

DFA-algorithms

as

an

extension

of

the

Edinburgh

Concurrency

Workbench

-LSB-

-RSB-

Subsequently

this

generator

will

be

extended

to

automatically

generate

interprocedural

algorithms

as

well

This

can

be

done

along

the

lines

indicated

in

-LSB-

SP

-RSB-

Ultimately

it

is

planned

to

achieve

language

independency

by

using

Mosses

action

notation

-LRB-

cf.

-LSB-

Mos

MW

-RSB-

-RRB-

as

a

common

intermediate

language

The

program

models

for

our

DFA

generator

will

then

be

given

by

abstractly

interpreted

transitions

systems

which

arise

from

the

corresponding

structured

operational

semantics

-LRB-

cf.

-LSB-

Plo

-RSB-

-RRB-

This

will

allow

us

to

uniformly

deal

with

imperative

and

functional

languages

and

distributed

systems

Current

research

-LRB-

cf.

-LSB-

-RSB-

-RRB-

has

shown

that

one

can

analyze

formulas

containing

mutually

recursive

equation

systems

in

linear

time

as

long

as

there

is

no

alternated

nesting

-LSB-

EL

-RSB-

This

suggests

to

use

these

more

general

formulas

for

low

level

specification

which

in

particular

would

allow

to

express

the

shared

representation

used

in

Section

directly

on

this

level

We

plan

to

investigate

this

change

in

detail

in

particular

with

respect

to

its

impact

on

the

partial

evaluation

process

Acknowledgement

I

am

very

grateful

to

Olaf

Burkart

Rance

Cleaveland

Marion

Dreim?uller

Hardi

Hungar

Jens

Knoop

Jens

Palsberg

and

Oliver

R?uthing

for

their

careful

proof

reading

and

their

helpful

comments

and

to

Karla

Kerres

for

drawing

the

pictures

References

-LSB-

BS

-RSB-

J.

Bradfield

C.Stirling

Local

Model

Checking

for

Finite

State

Spaces

LFCS

Report

Series

June

-LSB-

CC

-RSB-

P.

Cousot

R.

Cousot

Abstract

interpretation

A

unified

Lattice

Model

for

static

Analysis

of

Programs

by

Construction

or

Approximation

of

Fixpoints

In

Proceedings

POPL

Los

Angeles

California

January

-LSB-

CES

-RSB-

E.

Clarke

E.A.

Emerson

A.P.

Sistla

Automatic

Verification

of

Finite

State

Concurrent

Systems

using

Temporal

Logic

Specifications

A

Practical

Approach

In

Proceedings

POPL

-LSB-

-RSB-

R.

Cleaveland

J.G.

Parrow

B.

Steffen

A

Semantic-Based

Verification

Tool

for

FiniteState-Systems

Protocol

Specification

Testing

and

Verification

IX

Elsevier

Science

Publications

B.V.

-LRB-

North

Holland

-RRB-

-LSB-

-RSB-

R.

Cleaveland

J.G.

Parrow

B.

Steffen

The

Concurrency

Workbench

Workshop

on

Automatic

Verification

Methods

for

Finite

State

Systems

LNCS

-LSB-

-RSB-

R.

Cleaveland

B.

Steffen

Computing

Behavioural

Relations

Logically

In

Proceedings

ICALP

LNCS

-LSB-

-RSB-

R.

Cleaveland

B.

Steffen

A

Linear-Time

Model-Checking

Algorithm

for

the

Alternation-Free

Modal

Mu-Calculus

In

Proceedings

CAV

-LSB-

Dha

-RSB-

D.

Dhamdhere

A

Fast

Algorithm

for

Code

Movement

Optimization

SIGPLAN

Notices

Vol

-LSB-

EL

-RSB-

E.

Emerson

J.

Lei

Efficient

model

checking

in

fragments

of

the

propositional

mucalculus

In

Proceedings

LICS

-LSB-

Gie

-RSB-

R.

Giegerich

Automatic

Generation

of

Machine

Specific

Code

Generation

In

Proceedings

POPL

Albuquerque

New

Mexico

January

-LSB-

He

-RSB-

S.M.

Hecht

Flow

Analysis

of

Computer

Programs

Elsevier

North

Holland

-LSB-

Kil

-RSB-

G.A.

Kildall

A

Unified

Approach

to

Global

Program

Optimization

In

Proceedings

POPL

Boston

Massachusetts

-LSB-

Koz

-RSB-

D.

Kozen

Results

on

the

Propositional

mu-Calculus

TCS

-LSB-

La

-RSB-

K.

Larsen

Proof

Systems

for

Hennessy

-LCB-

Milner

Logic

with

Recursion

in

Proceedings

CAAP

-LSB-

Mos

-RSB-

P.D.

Mosses

Action

Semantics

To

appear

-LSB-

MR

-RSB-

E.

Morel

C.

Renvoise

Global

Optimization

by

Suppression

of

Partial

Redundancies

CACM

-LSB-

MW

-RSB-

P.D.

Mosses

A.A.

Watt

The

Use

of

Action

Semantics

In

Formal

Description

of

Programming

Concepts

III

-LSB-

-RSB-

F.

Nielson

A

Bibliography

on

Abstract

Interpretations

ACM

SIGPLAN

Notices

-LSB-

-RSB-

F.

Nielson

A

Denotational

Framework

for

Data

Flow

Analysis

Acta

Informatica

-LSB-

Plo

-RSB-

G.

Plotkin

A

Structural

Approach

to

Operational

Semantics

University

of

Aarhus

DAIMI

-LSB-

LPRS

-RSB-

Peter

Lee

Frank

Pfenning

Gene

Rollins

and

William

Scherlis

The

Ergo

Support

System

An

Integrated

Set

of

Tools

for

Prototyping

Integrated

Environments

SIGPLAN

Notices

Vol

No.

February

-LSB-

RWZ

-RSB-

B.

K.

Rosen

M.

N.

Wegman

and

F.

K.

Zadeck

Global

Value

Numbers

and

Redundant

Computations

POPL

San

Diego

California

-LSB-

SFRW

-RSB-

S.

Sagiv

N.

Francez

M.

Rodeh

R.

Wilhelm

A

Logic-Based

Approach

to

Data

Flow

Analysis

Problems

To

appear

-LSB-

-RSB-

B.

Steffen

J.

Knoop

O.

R?uthing

The

Value

Flow

Graph

A

Program

Representation

for

Optimal

Program

Transformations

In

Proceedings

ESOP

LNCS

-LSB-

-RSB-

B.

Steffen

J.

Knoop

O.

R?uthing

Optimal

Placement

of

Computations

within

Flow

Graphs

A

Practical

Approach

In

Proceedings

TAPSOFT

LNCS

-LSB-

SP

-RSB-

M.

Sharir

A.

Pnueli

Two

Approaches

to

Interprocedural

Data

Flow

Analysis

In

S.S.

Muchnick

N.D.

Jones

Program

Flow

Analysis

Theory

and

Applications

PrenticeHall

Englewood

Cliffs

N.J.

-LSB-

-RSB-

B.

Steffen

Characteristic

Formulae

In

Proceedings

ICALP

LNCS

-LSB-

-RSB-

B.

Steffen

Data

Flow

Analysis

as

Model

Checking

In

Proceedings

TACS

LNCS

-LSB-

-RSB-

C.

Stirling

Modal

and

Temporal

Logics

In

Handbook

of

Logics

in

Computer

Science

Vol

Oxford

University

Press

to

appear

-LSB-

Tar

-RSB-

Tarski

A.

A

Lattice-Theoretical

Fixpoint

Theorem

and

its

Applications

Pacific

Journal

of

Mathematics

v.

-LSB-

Ven

-RSB-

G.A.

Venkatesh

A

framework

for

construction

and

evaluation

of

high-level

specifications

for

program

analysis

techniques

In

Proceedings

SIGPLAN

-LSB-

-RSB-

R.

Wilhelm

Global

Flow

Analysis

and

Optimization

in

the

Compiler

Generating

System

In

S.S.

Muchnick

N.D.

Jones

Program

Flow

Analysis

Theory

and

Applications

Prentice-Hall

Englewood

Cliffs

N.J.

-LSB-

-RSB-

R.

Wilhelm

Codeoptimierung

mittels

attributierter

Transformationsgrammatiken

LNCS

Aachener

Informatik-Berichte

Please

write

to

Informatik-Bibliothek

RWTH

Aachen

Ahornstr

W

Aachen

Jahresbericht

D.

de

Frutos

Escrig

K.

Indermark

Equivalence

relations

of

non-deterministic

Ianov-schemes

M.

Nagl

A

Software

Development

Environment

Based

on

Graph

Technology

C.

Lewerentz

M.

Nagl

B.

Westfechtel

On

Integration

Mechanisms

within

a

Graph-based

Software

Development

Environment

R.

Rinn

Uber

Eingabeanomalien

bei

verschiedenen

Inferenzmodellen

W.

Damm

G.

D?ohmen

Specifying

Distributed

Computer

Architectures

in

AADL

G.

Engels

C.

Lewerentz

W.

Sch?afer

Graph

Grammar

Engineering

A

Software

Specification

Method

M.

Nagl

Set

Theoretic

Approaches

to

Graph

Grammars

C.

Lewerentz

A.

Sch?urr

Experiences

with

a

Database

System

for

Software

Documents

H.

Klaeren

K.

Indermark

A

New

Implementation

Technique

for

Recursive

Function

Definitions

R.

Loogen

Design

of

a

parallel

programmable

graph

reduction

machine

with

distributed

memory

J.

B?orstler

U.

M?oncke

R.

Wilhelm

Table

Compression

for

Tree

Automata

C.

Lewerentz

Extended

Programming

in

the

Large

in

a

Software

Development

Environment

G.

Engels

Th

Janning

W.

Sch?afer

A

Highly

Integrated

Tool

Set

for

Program

Development

Support

R.

Loogen

U.

Goltz

A

non-interleaving

semantic

model

for

nondeterministic

concurrent

processes

Th

Hafer

On

the

Boolean

Closure

of

B?uchi

Tree

Automaton

Definable

Sets

of

w-Trees

U.

Heuter

First-Order

Properties

of

Trees

Star-Free

Expressions

and

Aperiodicity

G.

Esser

J.

R?uckert

F.

Wagner

-LRB-

Hrsg

-RRB-

Gesellschaftliche

Aspekte

der

Informatik

P.

Martini

O.

Spaniol

Token-Passing

in

High-Speed

Backbone

Networks

for

Campus-Wide

Environments

Th

Welzel

Simulation

of

a

Multiple

Token

Ring

Backbone

P.

Martini

Performance

Comparison

for

HSLAN

Media

Access

Protocols

P.

Martini

Performance

Analysis

of

Multiple

Token

Rings

A.

Mann

J.

R?uckert

O.

Spaniol

Datenfunknetze

A.

Mann

J.

R?uckert

Packet

Radio

Networks

for

Data

Exchange

A.

Mann

J.

R?uckert

Concurrent

Slot

Assignment

Protocol

for

Packet

Radio

Networks

W.

Kremer

F.

Reichert

J.

R?uckert

A.

Mann

Entwurf

einer

Netzwerktopologie

f?ur

ein

Mobilfunknetz

zur

Unterst?utzung

des

offentlichen

Strassenverkehrs

K.

Jakobs

Towards

User-Friendly

Networking

K.

Jakobs

The

Directory

Evolution

of

a

Standard

K.

Jakobs

Directory

Services

in

Distributed

Systems

A

Survey

M.

Sch?ummer

a

Protocol

for

the

Plant

Floor

U.

Quernheim

Satellite

Communication

Protocols

A

Performance

Comparison

Considering

On-Board

Processing

P.

Martini

O.

Spaniol

Th

Welzel

File

Transfer

in

High

Speed

Token

Ring

Networks

Performance

Evaluation

by

Approximate

Analysis

and

Simulation

Jahresbericht

W.

Thomas

Automata

on

Infinite

Objects

M.

Sonnenschein

On

Petri

Nets

and

Data

Flow

Graphs

H.

Vogler

Functional

Description

of

the

Contextual

Analysis

in

Block-Structured

Programming

Languages

A

Case

Study

of

Tree

Transducers

Th

Welzel

Einsatz

des

Simulationswerkzeuges

zur

Leistungsbewertung

von

Kommunikationsprotokollen

Th

Janning

C.

Lewerentz

Integrated

Project

Team

Management

in

a

Software

Development

Environment

J.

Engelfriet

H.

Vogler

Modular

Tree

Transducers

W.

Thomas

Automata

and

Quantifier

Hierarchies

U.

Heuter

Generalized

Definite

Tree

Languages

Jahresbericht

G.

Esser

J.

R?uckert

F.

Wagner

-LRB-

Hrsg

-RRB-

Gesellschaftliche

Aspekte

der

Informatik

H.

Vogler

Bottom-Up

Computation

of

Primitive

Recursive

Tree

Functions

A.

Sch?urr

Introduction

to

PROGRESS

an

Attribute

Graph

Grammar

Based

Specification

Language

J.

B?orstler

Wiederverwendbarkeit

und

Softwareentwicklung

Probleme

L?osungsans?atze

und

Bibliographie

K.

Jakobs

OSI

An

Appropriate

Basis

for

Group

Communication

K.

Jakobs

ISO

s

Directory

Proposal

Evolution

Current

Status

and

Future

Problems

B.

Westfechtel

Extension

of

a

Graph

Storage

for

Software

Documents

with

Primitives

for

Undo

Redo

and

Revision

Control

P.

Martini

High

Speed

Local

Area

Networks

A

Tutorial

Jozef

Filser

Bolidische

Gedangen

-LRB-

Gabidel

-RRB-

Ieber

die

Kombjuderkunzt

P.

Davids

Th

Welzel

Performance

Analysis

of

DQDB

Based

on

Simulation

M.

Nagl

-LRB-

Ed

-RRB-

Abstracts

of

Talks

presented

at

the

WG

International

Workshop

on

Graphtheoretic

Concepts

in

Computer

Science

Rolduc

-LRB-

NL

-RRB-

near

Aachen

-LRB-

D

-RRB-

June

P.

Martini

The

DQDB

Protocol

Is

it

Playing

the

Game

M.

Sch?ummer

CNC

DNC

Communication

with

MAP

M.

Sch?ummer

Local

Area

Networks

for

Manufactoring

Environments

with

hard

Real-Time

Requirements

M.

Sch?ummer

Th

Welzel

P.

Martini

Integration

of

Field

Bus

and

MAP

Networks

Hierarchical

Communication

Systems

in

Production

Environments

G.

Vossen

K.-U

Witt

SUXESS

Towards

a

Sound

Unification

of

Extensions

of

the

Relational

Data

Model

J.

Derissen

P.

Hruschka

M.v.d.Beeck

Th

Janning

M.

Nagl

Integrating

Structured

Analysis

and

Information

Modelling

A.

Maassen

Programming

with

Higher

Order

Functions

M.

Rodriguez-Artalejo

H.

Vogler

Note

on

A

Narrowing

Machine

for

Syntax

Directed

BABEL

H.

Kuchen

R.

Loogen

J.

J.

Moreno-Navarro

M.

Rodriguez-Artalejo

Graphbased

Implementation

of

a

Functional

Logic

Language

O.

Spaniol

Nat?urliche

Intelligenz

oder

Der

Parallel-Igel

G.

Vossen

S.

Wang

Correct

and

Efficient

Deadlock

Detection

and

Resolution

in

Distributed

Database

Systems

G.

Vossen

R.

Schwarz

Dynamic

Scheduling

of

Transactions

in

Design

Databases

based

on

Version

Consistency

Jahresbericht

V.

Jansen

A.

Potthoff

W.

Thomas

U.

Wermuth

A

Short

Guide

to

the

AMORE

System

-LRB-

computing

Automata

MOnoids

and

Regular

Expressions

-RRB-

J.

Skurczynski

On

Three

Hierarchies

of

Weak

SkS

Formulas

R.

Loogen

Stack-based

Implementation

of

Narrowing

H.

Kuchen

A.

Wagener

Comparison

of

Dynamic

Load

Balancing

Strategies

K.

Jakobs

F.

Reichert

Directory

Services

for

Mobile

Communication

K.

Jakobs

What

's

Beyond

the

Interface-OSI

Networks

to

Support

CooperativeWork

K.

Jakobs

Directory

Names

and

Schema

An

Evaluation

U.

Quernheim

D.

Kreuer

Das

CCITT

Signalisierungssystem

Nr

auf

Satellitenstrecken

Simulation

der

Zeichengabestrecke

U.

Quernheim

St.

Jacobs

D.

Kreuer

Adaptive

ARQ-Fehlersicherungsverfahren

f?ur

die

Point-to-Multipoint-Satellitenkommunikation

J.J.Moreno-Navarro

H.

Kuchen

R.

Loogen

M.

Rodriguez-Artalejo

Lazy

Narrowing

in

a

Graph

Machine

K.

Jakobs

J.

Kaltwasser

F.

Reichert

O.

Spaniol

Der

Computer

f?ahrt

mit

R.

Mathar

A.

Mann

Analyzing

a

Distributed

Slot

Assignment

Protocol

by

Markov

Chains

A.

Maassen

Compilerentwicklung

in

Miranda

ein

Praktikum

in

funktionaler

Programmierung

M.

Nagl

A.

Sch?urr

A

Specification

Environment

for

Graph

Grammars

A.

Sch?urr

PROGRESS

a

VHL-Language

Based

on

Graph

Grammars

M.

M?oller

Ein

Ebenenmodell

wissensbasierter

Konsultationen

Unterst?utzung

f?ur

Wissensakquisition

und

Erkl?arungsf?ahigkeit

E.

Kowalewski

Entwurf

und

Interpretation

einer

Sprache

zur

Beschreibung

von

Konsultationsphasen

in

Expertensystemen

F.

Strauss

Erkl?arungsf?ahigkeit

eines

ebenenorientierten

Expertensystemmodells

Y.

Ortega-Mallen

D.

de

Frutos-Escrig

A

Complete

Proof

System

for

Timed

Observations

M.

Nagl

Modelling

of

Software

Architectures

Importance

Notions

Experiences

H.

Fassbender

H.

Vogler

A

Call-by-need

Implementation

of

Syntax

Directed

Functional

Programming

Th

Janning

M.

Lefering

A

Transformation

from

Requirements

Engineering

into

Design

The

Method

and

the

Tool

J.

Noack

Nat?urlichsprachliche

Interaktion

mit

Datenbanken

R.

Mathar

Concurrence

Probabilities

for

a

Locally

Slotted

Packet

Radio

Network

by

Combinatorial

Methods

F.

Herrmann

Heiko

Vogler

Primitive

Recursive

Programs

for

Defining

Tree

Functions

Z.

F?ul?op

F.

Herrmann

S.

Vagv?olgyi

H.

Vogler

Tree

Transducers

with

External

Functions

P.

Bachmann

W.

Oberschelp

B.

Thalheim

G.

Vossen

The

Design

of

RAD

Towards

an

Interactive

Toolbox

for

Database

Design

Jahresbericht

F.

Beuting

F.

Piron

K.

Rausch

Ein

neuronales

Modell

zur

Feststellung

von

f?ur

die

visuelle

Aufmerksamkeit

relevanten

Figureneigenschaften

B.

Steffen

A.

Ingolfsdottir

Characteristic

Formulae

for

Processes

with

Divergence

M.

Portz

A

new

class

of

cryptosystems

based

on

interconnection

networks

H.

Kuchen

G.

Geiler

Distributed

Applicative

Arrays

L.

Staiger

Kolmogorov

Complexity

and

Hausdorff

Dimension

L.

Staiger

Syntactic

congruences

for

languages

K.

Jakobs

K.

D.

Kleefeld

Using

Public

Communication

Services

for

Archaeological

Applications

E.

Kuikka

A

Proposal

for

a

Syntax-Directed

Text

Processing

System

K.

Gladitz

H.

Fassbender

H.

Vogler

Compiler-based

Implementation

of

SyntaxDirected

Functional

Programming

R.

Loogen

S.

Winkler

Dynamic

Detection

of

Determinism

in

Functional

Logic

Languages

K.

Indermark

M.

Rodr?iguez

Artalejo

-LRB-

Eds

-RRB-

Granada

Workshop

on

the

Integration

of

Functional

and

Logic

Programming

R.

Hager

W.

Kremer

The

Adaptive

Priority

Scheduler

A

More

Fair

Priority

Service

Discipline

A.

Fasbender

W.

Kremer

A

New

Approximation

Algorithm

for

Tandem

Networks

with

Priority

Nodes

J.

B?orstler

A.

Z?undorf

Revisiting

extensions

to

to

improve

reusability

J.

B?orstler

T.

Janning

Bridging

the

gap

between

Requirements

Analysis

and

Design

A.

Z?undorf

A.

Sch?urr

Nondeterministic

Control

Structures

for

Graph

Rewriting

Systems

M.

Jarke

J.

Mylopoulos

J.

W.

Schmidt

Y.

Vassiliou

DAIDA

An

Environment

for

Evolving

Information

Systems

M.

Jeusfeld

M.

Jarke

From

Relational

to

Object-Oriented

Integrity

Simplification

G.

Hogen

A.

Kindler

R.

Loogen

Automatic

Parallelization

of

Lazy

Functional

Programs

O.

Spaniol

ODP

-LRB-

Open

Distributed

Processing

-RRB-

Yet

another

Viewpoint

H.

Kuchen

F.

L?ucking

H.

Stoltze

The

Topology

Description

Language

TDL

S.

Graf

B.

Steffen

Compositional

Minimization

of

Finite

State

Systems

R.

Cleaveland

J.

Parrow

B.

Steffen

The

Concurrency

Workbench

A

Semantics

Based

Tool

for

the

Verification

of

Concurrent

Systems

R.

Mathar/J

Mattfeldt

Optimal

Transmission

Ranges

for

Mobile

Communication

in

Linear

Multihop

Packet

Radio

Networks

M.

Jeusfeld

M.

Staudt

Query

Optimization

in

Deduktive

Object

Bases

J.

Knoop/B

Steffen

The

Interprocedural

Coincidence

Theorem

J.

Knoop/B

Steffen

Unifying

Strength

Reduction

and

Semantic

Code

Motion

R.

Cleaveland/M

Dreim

uller/B

Steffen

Faster

Model

Checking

in

the

Model

MuCalculus

T.

Margaria

First-Order

Theories

for

the

Verification

of

Complex

FSMs

B.

Steffen

Generating

Data

Flow

Analysis

Algorithms

from

Modal

Specifications

data flow analysis
modal logic
model checking
partial evaluation
transition systems

bit-vector algorithms
data flow analysis generator
mu-calculus