Determining the specification of a control system from that of its environment

Well understood methods exist for developing programs from given specifications. A formal method identifies proof obligations at each development step: if all such proof obligations are discharged, a precisely defined class of errors can be excluded from the final program. For a class of closed systems such methods offer a gold standard against which less formal approaches can be measured. For open systems -those which interact with the physical world- the task of obtaining the program specification can be as challenging as the task of deriving the program. And, when a system of this class must tolerate certain kinds of unreliability in the physical world, it is still more challenging to reach confidence that the specification obtained is adequate. We argue that widening the notion of software development to include specifying the behaviour of the relevant parts of the physical world gives a way to derive the specification of a control system and also to record precisely the assumptions being made about the world outside the computer.

Tool-supported invariant-based programming

The development of correct programs is a core problem in computer science. Although formal verification methods for establishing correctness with mathematical rigor are available, programmers often find these difficult to put into practice. One hurdle is deriving the loop invariants and proving that the code maintains them. So called correct-by-construction methods aim to alleviate this issue by integrating verification into the programming workflow. Invariant-based programming is a practical correct-by-construction method in which the programmer first establishes the invariant structure, and then incrementally extends the program in steps of adding code and proving after each addition that the code is consistent with the invariants. In this way, the program is kept internally consistent throughout its development, and the construction of the correctness arguments (proofs) becomes an integral part of the programming workflow. A characteristic of the approach is that programs are described as invariant diagrams, a graphical notation similar to the state charts familiar to programmers. Invariant-based programming is a new method that has not been evaluated in large scale studies yet. The most important prerequisite for feasibility on a larger scale is a high degree of automation. The goal of the Socos project has been to build tools to assist the construction and verification of programs using the method. This thesis describes the implementation and evaluation of a prototype tool in the context of the Socos project. The tool supports the drawing of the diagrams, automatic derivation and discharging of verification conditions, and interactive proofs. It is used to develop programs that are correct by construction. The tool consists of a diagrammatic environment connected to a verification condition generator and an existing state-of-the-art theorem prover. Its core is a semantics for translating diagrams into verification conditions, which are sent to the underlying theorem prover. We describe a concrete method for 1) deriving sufficient conditions for total correctness of an invariant diagram; 2) sending the conditions to the theorem prover for simplification; and 3) reporting the results of the simplification to the programmer in a way that is consistent with the invariantbased programming workflow and that allows errors in the program specification to be efficiently detected. The tool uses an efficient automatic proof strategy to prove as many conditions as possible automatically and lets the remaining conditions be proved interactively. The tool is based on the verification system PVS and i uses the SMT (Satisfiability Modulo Theories) solver Yices as a catch-all decision procedure. Conditions that were not discharged automatically may be proved interactively using the PVS proof assistant. The programming workflow is very similar to the process by which a mathematical theory is developed inside a computer supported theorem prover environment such as PVS. The programmer reduces a large verification problem with the aid of the tool into a set of smaller problems (lemmas), and he can substantially improve the degree of proof automation by developing specialized background theories and proof strategies to support the specification and verification of a specific class of programs. We demonstrate this workflow by describing in detail the construction of a verified sorting algorithm. Tool-supported verification often has little to no presence in computer science (CS) curricula. Furthermore, program verification is frequently introduced as an advanced and purely theoretical topic that is not connected to the workflow taught in the early and practically oriented programming courses. Our hypothesis is that verification could be introduced early in the CS education, and that verification tools could be used in the classroom to support the teaching of formal methods. A prototype of Socos has been used in a course at Åbo Akademi University targeted at first and second year undergraduate students. We evaluate the use of Socos in the course as part of a case study carried out in 2007.

Report and Specification for Transportation Program Management System, HR-394, 1997

TPMS is proposed as a distributed, PC-based system for automating two processes required for road improvements in Iowa: a) the annual preparation, submission, and approval of road improvement programs. b) the ongoing process of developing plans and obtaining approval for projects to be let for bids.

Research safety vehicle program (phase II) specification review. Volume II. Final technical report.

National Highway Traffic Safety Administration, Washington, D.C.

Specification and testing of multiplicative time-varying GARCH models with applications

In this article, we develop a specification technique for building multiplicative time-varying GARCH models of Amado and Teräsvirta (2008, 2013). The variance is decomposed into an unconditional and a conditional component such that the unconditional variance component is allowed to evolve smoothly over time. This nonstationary component is defined as a linear combination of logistic transition functions with time as the transition variable. The appropriate number of transition functions is determined by a sequence of specification tests. For that purpose, a coherent modelling strategy based on statistical inference is presented. It is heavily dependent on Lagrange multiplier type misspecification tests. The tests are easily implemented as they are entirely based on auxiliary regressions. Finite-sample properties of the strategy and tests are examined by simulation. The modelling strategy is illustrated in practice with two real examples: an empirical application to daily exchange rate returns and another one to daily coffee futures returns.

Role of ATH5 in the specification of retinal ganglion cells and expression and cell compartmentalization of EFEMP1, a protein associated with Malattia Leventinese

ABSTRACT : The development of the retina is a very complex process, occurring through the progressive restriction of cell fates, from pluripotent cell populations to complex tissues and organs. In all vertebrate species analyzed so far, retinal differentiation starts with the generation of retinal ganglion cells (RGC)s. One of the documented key essential events in the specification of RGCs is the expression of ATHS, an atonal homolog encoding a bHLH transcription factor. Despite the putative role of master regulator of RGC differentiation, the mechanism of integrating its functions into a coherent program underlying the production of this subclass of retinal neurons has not yet been elucidated. By using chromatin immunoprecipitation combined with microarray (ChIP-on-chip) we have screened for ATH5 direct targets in the developing chick retina at two consecutive periods: E3.5 (stage HH22) and E6 (stage HH30), covering the stages of progenitor proliferation, neuroepithelium patterning, RGC specification, cell cycle exit and early neuronal differentiation. In parallel, complementary analysis with Affymetrix expression microarrays was conducted. We compared RGCs versus retina to see if the targets correspond to genes preferentially expressed in RGCs. We also precociously overexpressed ATH5 in the retina of individual embryo, and contralateral retina vas used as a control. Our integrated approach allowed us to establish a compendium of ATH5-targets and enabled us to position ATH5 in the transcription network underlying neurogenesis in the retina. Malattia Leventinese (ML) is an autosomal, dominant retinal dystrophy characterized by extracellular, amorphous deposits known as drusen, between the retinal pigment epithelium (RPE) and Bruch's membrane. On the genetic level, it has been associated with a single missense mutation (R345W) in a widely expressed gene with unknown function called EFEMP1. We determined expression patterns of the EFEMP1 gene in normal and ML human retinas. Our data shown that the upregulation of EFEMP1 is not specific to ML eye, except for the region of the ciliary body. We also analyzed the cell compartmentalization of different versions of the protein (both wild type and mutant). Our studies indicate that both abnormal expression of the EFEMP1 gene and mutation and accumulation of EFEMP 1 protein (inside or outside the cells) might contribute to the ML pathology. Résumé : 1er partie : L'ontogenèse de la rétine est un processus complexe au cours duquel des cellules progénitrices sont engagée, par vagues successives, dans des lignées où elles vont d'abord être déterminées puis vont se différencier pour finalement construire un tissu rétinien composé de cinq classes de neurones (les photorécepteurs, les cellules horizontales, bipolaires, amacrines et ganglionnaires) et d'une seule de cellules gliales (les cellules de Muller). Chez tous les vertébrés, la neurogenèse rétinienne est d'abord marquée par la production des cellules ganglionnaires (RGCs). La production de cette classe de neurone est liée à l'expression du gène ATH5 qui est un homologue du gène atonal chez la Drosophile et qui code pour un facteur de transcription de la famille des protéines basic Helix-Loop-Helix (bHLH). Malgré le rôle central que joue ATH5 dans la production des RGCs, le mécanisme qui intègre la fonction de cette protéine dans le programme de détermination neuronale et ceci en relation avec le développement de la rétine n'est pas encore élucidé. Grâce à une technologie qui permet de combiner la sélection de fragments de chromatine liant ATH5 et la recherche de séquences grâce à des puces d'ADN non-codants (ChIP-on-chip), nous avons recherché des cibles potentielles de la protéine ATH5 dans la rétine en développement. Nous avons conduit cette recherche à deux stades de développement de manière à englober la phase de prolifération cellulaire, la détermination des RGCs, la sortie du cycle cellulaire ainsi que les premières étapes de la différentiation de ces neurones. Des expériences complémentaires nous ont permis de définir les patrons d'expression des gènes sélectionnés ainsi que l'activité promotrice des éléments de régulation identifiés lors de notre criblage. Ces approches expérimentales diverses et complémentaires nous ont permis de répertorier des gènes cibles de la protéine ATH5 et d'établir ainsi des liens fonctionnels entre des voies métaboliques dont nous ne soupçonnions pas jusqu'alors qu'elles puissent être associées à la production d'une classe de neurones centraux. 2ème partie : Malattia Leventinese (ML) est une maladie génétique qui engendre une dystrophie de la rétine. Elle se caractérise par l'accumulation de dépôt amorphe entre l'épithélium pigmentaire et la membrane de Bruch et connu sous le nom de drusen. Cette maladie est liée à une simple mutation non-sens (R345W) dans un gène dénommé EFEMP1 qui est exprimé dans de nombreux tissus mais dont la fonction reste mal définie. Une étude détaillée de l'expression de ce gène dans des rétines humaines a révélé une expression à un niveau élevé du gène EFEMP1 dans divers tissus de l'oeil ML mais également dans des yeux contrôles. Alors que l'accumulation d'ARN messager EFEMP1 dans les cellules de l'épithélium pigmentaire n'est pas spécifique à ML, l'expression de ce gène dans le corps cilié n'a été observée que dans l'oeil ML. Nous avons également comparé la sécrétion de la protéine sauvage avec celle porteuse de la mutation. En résumé, notre étude révèle que le niveau élevé d'expression du gène EFEMP1 ainsi que l'accumulation de la protéine dans certains compartiments cellulaires pourraient contribuer au développement de pathologies rétiniennes liées à ML.

Automation concept for an electrically excited synchronous motor: Setup and requirements specification

This bachelor’s thesis is a part of the research project realized in the summer 2011 in Lappeenranta University of Technology. The goal of the project was to create an automation concept for controlling an electrically excited synchronous motor. This thesis concentrates on the setup and requirements specification part of the concept. The setup consists of ABB AC500 as the PLC master device, DCS800 as an exciter and ACS800 as a frequency converter. The ACS800 frequency converter uses permanent magnet synchronous machine software to control the stator’s magnetic field, the DC drive handles the excitation and the AC500 PLC master controls the communication and functionality of the system. The requirements specification briefly explains the general over-view of the concept, the use and functionality of the PLC program and the requirements needed for the whole concept and the PLC program to work as intended.

A Categorical Framework for the Specification and the Verification of Aspect Oriented Systems

Un objectif principal du génie logiciel est de pouvoir produire des logiciels complexes, de grande taille et fiables en un temps raisonnable. La technologie orientée objet (OO) a fourni de bons concepts et des techniques de modélisation et de programmation qui ont permis de développer des applications complexes tant dans le monde académique que dans le monde industriel. Cette expérience a cependant permis de découvrir les faiblesses du paradigme objet (par exemples, la dispersion de code et le problème de traçabilité). La programmation orientée aspect (OA) apporte une solution simple aux limitations de la programmation OO, telle que le problème des préoccupations transversales. Ces préoccupations transversales se traduisent par la dispersion du même code dans plusieurs modules du système ou l’emmêlement de plusieurs morceaux de code dans un même module. Cette nouvelle méthode de programmer permet d’implémenter chaque problématique indépendamment des autres, puis de les assembler selon des règles bien définies. La programmation OA promet donc une meilleure productivité, une meilleure réutilisation du code et une meilleure adaptation du code aux changements. Très vite, cette nouvelle façon de faire s’est vue s’étendre sur tout le processus de développement de logiciel en ayant pour but de préserver la modularité et la traçabilité, qui sont deux propriétés importantes des logiciels de bonne qualité. Cependant, la technologie OA présente de nombreux défis. Le raisonnement, la spécification, et la vérification des programmes OA présentent des difficultés d’autant plus que ces programmes évoluent dans le temps. Par conséquent, le raisonnement modulaire de ces programmes est requis sinon ils nécessiteraient d’être réexaminés au complet chaque fois qu’un composant est changé ou ajouté. Il est cependant bien connu dans la littérature que le raisonnement modulaire sur les programmes OA est difficile vu que les aspects appliqués changent souvent le comportement de leurs composantes de base [47]. Ces mêmes difficultés sont présentes au niveau des phases de spécification et de vérification du processus de développement des logiciels. Au meilleur de nos connaissances, la spécification modulaire et la vérification modulaire sont faiblement couvertes et constituent un champ de recherche très intéressant. De même, les interactions entre aspects est un sérieux problème dans la communauté des aspects. Pour faire face à ces problèmes, nous avons choisi d’utiliser la théorie des catégories et les techniques des spécifications algébriques. Pour apporter une solution aux problèmes ci-dessus cités, nous avons utilisé les travaux de Wiels [110] et d’autres contributions telles que celles décrites dans le livre [25]. Nous supposons que le système en développement est déjà décomposé en aspects et classes. La première contribution de notre thèse est l’extension des techniques des spécifications algébriques à la notion d’aspect. Deuxièmement, nous avons défini une logique, LA , qui est utilisée dans le corps des spécifications pour décrire le comportement de ces composantes. La troisième contribution consiste en la définition de l’opérateur de tissage qui correspond à la relation d’interconnexion entre les modules d’aspect et les modules de classe. La quatrième contribution concerne le développement d’un mécanisme de prévention qui permet de prévenir les interactions indésirables dans les systèmes orientés aspect.

Extraction of structured programs from specification proofs

We present a method using an extended logical system for obtaining programs from specifications written in a sublanguage of CASL. These programs are “correct” in the sense that they satisfy their specifications. The technique we use is to extract programs from proofs in formal logic by techniques due to Curry and Howard. The logical calculus, however, is novel because it adds structural rules corresponding to the standard ways of modifying specifications: translating (renaming), taking unions, and hiding signatures. Although programs extracted by the Curry-Howard process can be very cumbersome, we use a number of simplifications that ensure that the programs extracted are in a language close to a standard high-level programming language. We use this to produce an executable refinement of a given specification and we then provide a method for producing a program module that maximally respects the original structure of the specification. Throughout the paper we demonstrate the technique with a simple example.

Specification, execution and verification of interaction protocols: an approach based on computational logic

Interaction protocols establish how different computational entities can interact with each other. The interaction can be finalized to the exchange of data, as in 'communication protocols', or can be oriented to achieve some result, as in 'application protocols'. Moreover, with the increasing complexity of modern distributed systems, protocols are used also to control such a complexity, and to ensure that the system as a whole evolves with certain features. However, the extensive use of protocols has raised some issues, from the language for specifying them to the several verification aspects. Computational Logic provides models, languages and tools that can be effectively adopted to address such issues: its declarative nature can be exploited for a protocol specification language, while its operational counterpart can be used to reason upon such specifications. In this thesis we propose a proof-theoretic framework, called SCIFF, together with its extensions. SCIFF is based on Abductive Logic Programming, and provides a formal specification language with a clear declarative semantics (based on abduction). The operational counterpart is given by a proof procedure, that allows to reason upon the specifications and to test the conformance of given interactions w.r.t. a defined protocol. Moreover, by suitably adapting the SCIFF Framework, we propose solutions for addressing (1) the protocol properties verification (g-SCIFF Framework), and (2) the a-priori conformance verification of peers w.r.t. the given protocol (AlLoWS Framework). We introduce also an agent based architecture, the SCIFF Agent Platform, where the same protocol specification can be used to program and to ease the implementation task of the interacting peers.

Neuroretina specification in mouse embryos requires Six3-mediated suppression of Wnt8b in the anterior neural plate.

Retinal degeneration causes vision impairment and blindness in humans. If one day we are to harness the potential of stem cell-based cell replacement therapies to treat these conditions, it is imperative that we better understand normal retina development. Currently, the genes and mechanisms that regulate the specification of the neuroretina during vertebrate eye development remain unknown. Here, we identify sine oculis-related homeobox 3 (Six3) as a crucial player in this process in mice. In Six3 conditional-mutant mouse embryos, specification of the neuroretina was abrogated, but that of the retinal pigmented epithelium was normal. Conditional deletion of Six3 did not affect the initial development of the optic vesicle but did arrest subsequent neuroretina specification. Ectopic rostral expansion of Wnt8b expression was the major response to Six3 deletion and the leading cause for the specific lack of neuroretina, as ectopic Wnt8b expression in transgenic embryos was sufficient to suppress neuroretina specification. Using chromatin immunoprecipitation assays, we identified Six3-responsive elements in the Wnt8b locus and demonstrated that Six3 directly repressed Wnt8b expression in vivo. Our findings provide a molecular framework to the program leading to neuroretina differentiation and may be relevant for the development of novel strategies aimed at characterizing and eventually treating different abnormalities in eye formation.

Mineralogy and structural specification of ODP Leg 125 peridotite samples

Abundant serpentinite seamounts are found along the outer high of the Mariana forearc at the top of the inner slope of the trench. One of them, Conical Seamount, was drilled at Sites 778, 779, and 780 during Leg 125. The rocks recovered at Holes 779A and 780C, respectively, on the flanks and at the summit of the seamount, include moderately serpentinized depleted harzburgites and some dunites. These rocks exhibit evidence of resorption of the orthopyroxene, when present, and the local presence of very calcic-rich diopside in veins oblique to the main high-temperature foliation of the rock. The peridotites, initially well-foliated with locally poikiloblastic textures, show overprints of a two-stage deformation history: (1) a high-temperature (>1000°C), low-stress (0.02 GPa), homogeneous deformation that has led to the present Porphyroclastic textures displayed by the rocks and (2) heterogeneous ductile shearing at a much higher stress (0.05 GPa). This heterogeneous shearing probably describes a single tectonic event because it began at high temperatures, producing dynamic recrystallization of olivine in the shear zone, and ended at low temperatures in the stability field of chlorite and serpentine. In a few samples, olivine shows evidence of quasi-hydrostatic recrystallization at a very high temperature. Here, we propose that this recrystallization was related to fluid/magma percolation, a process that can also account for the resorption of the orthopyroxene and for the late crystallization of diopside veins in the rock. The impregnation by fluid or magma, development of the main high-temperature, low-stress deformation, and subsequent migration recrystallization of olivine probably occurred in a mantle fragment involved in the arc formation. In addition, this mantle has preserved structures that may have formed earlier in the oceanic lithosphere upon which the arc formed. Heterogeneous ductile shear zones in the peridotites may have developed during uplift. The "cold" deformation may have taken place during diapiric rise of hot mantle that underwent subsequent serpentinization or gliding along normal faults associated with the extension of the eastern margin of the forearc.

LED bulb lamps technical specification and testing procedure for solar home systems.

With the consolidation of the new solid state lighting LEOs devices, te5t1n9 the compliance 01 lamps based on this technology lor Solar Home Systems (SHS) have been analyzed. The definition of the laboratory procedures to be used with final products 15 a necessary step in arder to be able to assure the quality of the lamps prior to be installed [1]. As well as with CFL technology. particular attention has been given to simplicity and technical affordability in arder to facilitate the implementation of the test with basie and simple laboratory too15 even on the same SHS electrification program locations. The block of test procedures has been applied to a set of 14 low-cost lamps. They apply to lamp resistance, reliability and performance under normal, extreme and abnormal operating conditions as a simple but complete quality meter tool 01 any LEO bulb.

LED bulbs technical specification and testing procedure for solar home systems

The definition of technical specifications and the corresponding laboratory procedures are necessary steps in order to assure the quality of the devices prior to be installed in Solar Home Systems (SHS). To clarify and unify criteria a European project supported the development of the Universal Technical Standard for Solar Home Systems (UTSfSHS). Its principles were to generate simple and affordable technical requirements to be optimized in order to facilitate the implementation of tests with basic and simple laboratory tools even on the same SHS electrification program countries. These requirements cover the main aspects of this type of installations and its lighting chapter was developed based on the most used technology at that time: fluorescent tubes and CFLs. However, with the consolidation of the new LED solid state lighting devices, particular attention is being given to this matter and new procedures are required. In this work we develop a complete set of technical specifications and test procedures that have been designed within the frame of the UTSfSHS, based on an intense review of the scientific and technical publications related to LED lighting and their practical application. They apply to lamp reliability, performance and safety under normal, extreme and abnormal operating conditions as a simple but complete quality meter tool for any LED bulb.

An intrinsic genetic program for autonomous differentiation of muscle cells in the ascidian embryo.

The B-line presumptive muscle cells of ascidian embryos have extensive potential for self-differentiation dependent on determinants prelocalized in the myoplasm of fertilized eggs. Ascidian larval muscle cells therefore provide an experimental system with which to explore an intrinsic genetic program for autonomous specification of embryonic cells. Experiments with egg fragments suggested that maternal mRNAs are one of the components of muscle determinants. Expression of larval muscle actin genes begins as early as the 32-cell stage, prior to the developmental fate restriction of the cells. The timing of initiation of the actin gene expression proceeds the expression of an ascidian homologue of vertebrate MyoD by a few hours. Mutations in the proximal E-box of the 5' flanking region of the actin genes did not alter the promoter activity for muscle-specific expression of reporter gene. These results, together with results of deletion constructs of fusion genes, suggest that muscle determinants regulate directly, or indirectly via regulatory factors other than MyoD, the transcription of muscle-specific structural genes leading to the terminal differentiation.