FSCQ is the first file system with a machine-checkable proof (using the Coq proof assistant) that its implementation meets its specification and whose specification includes crashes. FSCQ provably avoids bugs that have plagued previous file systems, such as performing disk writes without sufficient barriers or forgetting to zero out directory blocks. If a crash happens at an inopportune time, these bugs can lead to data loss. FSCQ's theorems prove that, under any sequence of crashes followed by reboots, FSCQ will recover the file system correctly without losing data. To state FSCQ's theorems, this paper introduces the Crash Hoare logic (CHL), which extends traditional Hoare logic with a crash condition, a recovery procedure, and logical address spaces for specifying disk states at different abstraction levels. CHL also reduces the proof effort for developers through proof automation. Using CHL, we developed, specified, and proved the correctness of the FSCQ file system. Although FSCQ's design is relatively simple, experiments with FSCQ running as a user-level file system show that it is sufficient to run Unix applications with usable performance. FSCQ's specifications and proofs required significantly more work than the implementation, but the work was manageable even for a small team of a few researchers.

No abstract

FSCQ is the first file system with a machine-checkable proof that its implementation meets a specification, even in the presence of fail-stop crashes. FSCQ provably avoids bugs that have plagued previous file systems, such as performing disk writes without sufficient barriers or forgetting to zero out directory blocks. If a crash happens at an inopportune time, these bugs can lead to data loss. FSCQ's theorems prove that, under any sequence of crashes followed by reboots, FSCQ will recover its state correctly without losing data. To state FSCQ's theorems, this paper introduces the Crash Hoare logic (CHL), which extends traditional Hoare logic with a crash condition, a recovery procedure, and logical address spaces for specifying disk states at different abstraction levels. CHL also reduces the proof effort for developers through proof automation. Using CHL, we developed, specified, and proved the correctness of the FSCQ file system. Although FSCQ's design is relatively simple, experiments with FSCQ as a user-level file system show that it is sufficient to run Unix applications with usable performance. FSCQ's specifications and proofs required significantly more work than the implementation, but the work was manageable even for a small team of a few researchers.

This investigation subjected Super's postulated self-concept-vocational preference relationship to empirical test. Four hundred twenty-eight male college students, representing 39 college majors, selected their most-and least-preferred occupational interest areas from a list of 14 areas. The subjects described themselves and their most-and least-preferred occupational member concepts with Adjective Check List items. Individuals perceived a greater degree of congruence between themselves and their most-preferred occupational member concepts than between themselves and their leastpreferred occupational member concepts. Additional support for Super's theory was that certain distinctive self-concept features were found for individuals attracted to different occupational interest areas. Super (1951) has formulated a theory of vocational development in which an individual's occupational choice is seen as his attempt to implement his self-concept. Specifically, Super, Starishevsky, Matlin, and Jordaan (1963) have stated:In expressing a vocational preference, a person puts into occupational terminology his idea of the kind of person he is; that in entering an occupation, he seeks to implement a concept of himself; that in getting established in an occupation he achieves self-actualization, [p. 1]

No abstract