Constructive program verification

I. Bratko and M. Grobelnik. Inductive learning applied to program construction and verification. In Proc. of ILP 93 (TR US-DP-6707, J. Stefan Inst., Slovenia), pp. 279-292. 

Gaussian is designed to execute as a batch job. It can readily be used with common batch-queueing systems. The program may be purchased as source code or executables and comes with hundreds of sample input and output files. These may be employed as examples of how to construct inputs. They may also be employed to verify that a compilation from source code was successful. In our experience, such verification is essential. 

We assume that we are given a flowchart scheme P and a path a in P. This path may be from START to STOP or it may be from any statement in P to any other statement in P. We assume that we are given an initial predicate A and final predicate B. We wish to construct mechanically - i.e. by an algorithm which can be implemented on a computer - a VERIFICATION CONDITION V(P,a,A,B) with the following property. We assune now that input variables X and program variables Y are disjoint. 

If the flowchart P has a loop-free graph - if P is a tree - then the construction of W(P,A,B) is now quite simple. If P is loop-free there are only a finite number of paths 0, ...,on from START to STOP which are consistent and hence execution sequences. The input condition A(X) is a function only of the inputs, of course, while the output condition B(X,Y) can be regarded as a function of the input and of the final values of all the program variables (some of these values, of course, may play no role in the statement of the condition). Notice that under these conditions, when is a complete execution sequence from START to STOP, the path verification condition VCPjO AB, ) for any interpretation I is a function of the input X alone. 

It does not seem clear which procedure is easier to implement or more efficient (if and when it works ). Both can be augmented to handle other constructions in any particular programming language. The first procedure is augmented by changing the PATH VERIFICATION CONDITION GENERATOR and the second by adding additional axioms or rules to the THEOREM PROVER. 

After all this has been done, we apply the usual verification procedure to the main program and to each procedure body - constructing verification conditions and sending them to a THEOREM PROVER just as before. We claim that if all the verification conditions hold for the main program and all procedures, then the whole program is partially correct for A and B. ... 

The owner s Inspector is responsible to the owner to verify that all required examinations, inspections, and testing are complete. The owner s Inspector verifies that all required certifications and records have been completed. Also, the owner s Inspector is responsible for verification of the construction organization s quality systems program implementation. 

Concurrent with the beginning of construction of the baseline incineration facility at JACADS in 1987, the Army requested that the National Research Council (NRC) review and evaluate the Chemical Stockpile Disposal Program (CSDP) and provide scientific and technical advice and counsel. The NRC established the standing Committee on Review and Evaluation of the Army Chemical Stockpile Disposal Program (Stockpile Committee), one of whose early reports was a study of operational verification testing at JACADS prior to the start of agent disposal operations. In the intervening years, the Stockpile Committee produced 27 reports on various aspects of the CSDP. ... 

The objective of an inspection and test program is to assure the reliable performance of critical equipment and construction features. Since most safety related equipment and construction features remain idle until needed under emergency conditions, their condition and readiness often cannot be verified through normal use. Inspections and tests provide essential verification that they will perform effectively when needed. 

The verification of operability begins after completion of subsystems construction with a verification that all drains go to the correct collecting destination. This is followed by the Initial Test Programs of Chapter 14, specifically tests 14.2.12.1.45 14.2.12.1.46 and 14.2.12.1.49. All instrumentation critical in determining RCS leakage is designed and located to be calibrated while the plant is operating. 

---