Increasingly computer science research has been done using workstations with high-resolution bitmap display systems. Smalltalk-80↑ is a very attractive programming language for such computation environments, since it has very sophisticated graphical systems and programming environments. Unfortunately there are still very few computer systems on which Smalltalk-80 can run with satisfactory speed, and furthermore they are quite expensive. In order to make Smalltalk-80 accessible to a large group of people at low cost,. we have developed compiler techniques useful to generate efficient code for standard register machines such as MC68000. We have also extended Smalltalk-80 to include type expressions, which allow compilers to generate efficient code

Smalltalk is an object-oriented language designed and implemented by the Learning Research (Group of the Xerox Palo Alto Research Center [2, 5, 14]. Some features of this language are: abstract data classes, information inheritance by a superclass-subclass mechanism, message passing semantics, extremely late binding no type declarations, and automatic storage management. Experience has shown that large complex systems can be written in Smalltalk in quite a short period of time; it is also used to teach programming to children quite effectively. Object-oriented languages like Smalltalk have begun to be accepted as friendly languages for novice programmers on personal computers.

We describe a formal theory of the total correctness of parallel programs, including such heretofore theoretically incomplete properties as safety from deadlock and starvation under fair-scheduling. We present a sound and complete set of proof rules for the total correctness of parallel programs expressed in nondeterministic form. The proof of soundness and completeness is novel in that we show that the weakest pre-conditions for the correctness criteria are actually fixed-points (least or greatest) of continuous functions over the complete lattice of total predicates. We have obtained proof rule schemata which can universally be applied to least or greatest fixed-points of continuous functions. Therefore, a system of proof rules is a priori sound and complete once it is shown that certain weakest pre-conditions are extremum fixed-points. The relationship between true parallelism and nondeterminism is also discussed.

Pointer manipulation is one of the trickiest operations in programming and is a major source of programming errors. A great deal of research effort has been dedicated to making programs with pointers more reliable. In this paper we will present pointer operations which reduce conceptual difficulties when writing pointer programs, and increase reliability of programs. We will analyze theoretically as well as empirically why these operations are more convenient. Finally, we will define the safety of rotations, and show that it is decidable to check whether the rotation is safe and also show that it is a good measure of the correctness of programs. (That is, if the rotation is safe it is highly probable that the program is correct, and if it is unsafe it is highly probable that the program is incorrect.)Probably the most successful effort to eliminate difficulties associated with pointer manipulation is the invention of abstract data types and the use of implementation modules. Pointers are often used to implement complex data structures, which in turn represent abstract data types. We can textually localize relevant pointer manipulations using abstract data types. Thus, we can easily check correctness of pointer programs. This approach is successful when the structure of abstract data types is simple, or efficiency is not seriously required. However, programs like garbage collection, list marking and copying, and balanced tree manipulations have not been well specified by abstract types.The approach taken in this paper is complementary to abstract data types, and makes programs like list marking and copying more reliable and easy to write. The idea behind this approach is to introduce higher-level pointer manipulation primitives instead of pointer assignments. Since most pointer assignments do not appear isolated, we can group several assignments together and replace them by one of these new primitives. We also show some theoretical evidence why these operations are nicer.Two primitives are introduced in this paper. One is the n-way pointer rotation, which is defined as being equivalent to the following procedure:Rotate: procedure(var x1, x2, … , xn:T) = begin var w:T; w:=x1; x1:=x2; … ;xn:=w endwhere all the locations of arguments x1, x2, … , xn are distinct. The other operation is n-way pointer slide, which is as powerful as pointer assignment yet keeps the elegance of rotation.Section 2 of this paper reviews previous work related to this subject. We give definitions of pointer operations analyzed in this paper in section 3. Using these operations, Deutsch-Schorr-Waite algorithm is rewritten in section 4. In section 5 we analyze pointer rotations extensively and obtain several properties which are not attainable by ordinary pointer assignments. In section 6 we define the safety of pointer rotation when applied to linear list and trees. Then, we extend this definition to arbitrary pointer data structures and show a decision procedure to check safety. In section 7 we show two examples, list marking and list copying programs written using rotations and slides. We examine how we can directly code the algorithms using these operations and safety checking algorithms are useful.

A program annotated with inductive assertions is said to be verification decidable If all of the verification conditions generated from the program and assertions are formulas In a decidable theory A theory is defined, which is called Presburger array theory, containing two logical sorts integer and array of integer Addltmn, subtraction, and comparisons are permztted for integers Array access and assignment functmns are allowed Since the elements of the arrays are integers, array accesses may be nested First, it is observed that the validity of unquantlfied formulas in Presburger array theory is decidable, yet quantified formulas in general are undecldable It is then shown that, with certain restrictions, one can add a new predicate Perm(M, N)--meanlng array M is a permutation of array N--to the assertion language and still have a solvable decision problem for verification conditions generated from unquantified assertions The significance of this result is that almost all known one-array sorting programs are verlticatmn decidable when annotated with inductive assertions for proving that the output is a permutation of the input

A practical method is presented for automating in a uniform way the verification of Pascal programs that operate on the standard Pascal data structures Array, Record, and Pointer. New assertion language primitives are introduced for describing computational effects of operations on these data structures. Axioms defining the semantics of the new primitives are given. Proof rules for standard Pascal operations on data structures are then defined using the extended assertion language. An axiomatic rule for the Pascal storage allocation operation, NEW, is also given. These rulers have been implemented in the Stanford Pascal program verifier. Examples illustrating the verification of programs which operate on list structures implemented with pointers and records are discussed. These include programs with side effects.

We describe a formal theory of the total correctness of parallel programs, including such heretofore theoretically incomplete properties as safety from deadlock and starvation. We present a consistent and complete set of proof rules for the total correctness of parallel programs expressed in nondeterministic form. The proof of consistency and completeness is novel in that we show that the weakest preconditions for each correctness criterion are actually fixed-points (least or greatest) of continuous functions over the complete lattice of total predicates. We have obtained proof rule schemata which can universally be applied to least or greatest fixed points of continuous functions. Therefore, our proof rules are a priori consistent and complete once it is shown that certain weakest preconditions are extremum fixed-points. The relationship between true parallelism and nondeterminism is also discussed.

This paper describes a system which checks correctness of array accesses automatically without any inductive assertions or human interaction. For each array access in the program a condition that the subscript is greater than or equal to the lower bound and a condition that the subscript is smaller than or equal to the upper bound are checked and the results indicating within the bound, out of bound, or undetermined are produced. It can check ordinary programs at about fifty lines per ten seconds, and it shows linear time complexity behavior.It has been long discussed whether program verification will ever become practical. The main argument against program verification is that it is very hard for a programmer to write assertions about programs. Even if he can supply enough assertions, he must have some knowledge about logic in order to prove the lemmas (or verification conditions) obtained from the verifier.However, there are some assertions about programs which must always be true no matter what the programs do; and yet which cannot be checked for all cases. These assertions include: integer values do not overflow, array subscripts are within range, pointers do not fall off NIL, cells are not reclaimed if they are still pointed to, uninitialized variables are not used.Since these conditions cannot be completely checked, many compilers produce dynamic checking code so that if the condition fails, then the program terminates with proper diagnostics. These dynamic checking code sometimes take up much computation time. It is better to have some checking so that unexpected overwriting of data will not occur, but it is still very awkward that the computation stops because of error. Moreover, these errors can be traced back to some other errors in the program. If we can find out whether these conditions will be met or not before actually running the program, we can benefit both by being able to generate efficient code and by being able to produce more reliable programs by careful examination of errors in the programs. Similar techniques can be used to detect semantically equivalent subexpressions or redundant statements to do more elaborate code movement optimization.The system we have constructed runs fast enough to be used as a preprocessor of a compiler. The system first creates logical assertions immediately before array elements such that these assertions must be true whenever the control passes the assertion in order for the access to be valid. These assertions are proved using similar techniques as inductive assertion methods. If an array element lies inside a loop or after a loop a loop invariant is synthesized. A theorem prover was created which has the decision capabilities for a subset of arithmetic formulas. We can use this prover to prove some valid formulas, but we can also use it to generalize nonvalid formulas so that we can hypothesize more general loop invariants.Theoretical considerations on automatic synthesis of loop invariants have been taken into account and a complete formula for loop invariants was obtained. We reduced the problem of loop invariant synthesis to the computation of this formula. This new approach of the synthesis of loop invariant will probably give more firmer basis for the automatic generation of loop invariants in general purpose verifiers.