A Generic Deskolemization Strategy

Formal verification involves the use of logical and computational methods to establish claims that are expressed in precise mathematical terms. These can include ordinary mathematical theorems, as well as claims that pieces of hardware or software, network protocols, and mechanical and hybrid systems meet their specifications. In practice, there is not a sharp distinction between verifying a piece of mathematics and verifying the correctness of a system: formal verification requires describing hardware and software systems in mathematical terms, at which point establishing claims as to their correctness becomes a form of theorem proving. Conversely, the proof of a mathematical theorem may require a lengthy computation, in which case verifying the truth of the theorem requires verifying that the computation does what it is supposed to do. The gold standard for supporting a mathematical claim is to provide a proof, and twentieth-century developments in logic show most if not all conventional proof methods can be reduced to a small set of axioms and rules in any of a number of foundational systems. With this reduction, there are two ways that a computer can help establish a claim: it can help find a proof in the first place, and it can help verify that a purported proof is correct. Automated theorem proving focuses on the “finding” aspect. Resolution theorem provers, tableau theorem provers, fast satisfiability solvers, and so on provide means of establishing the validity of formulas in propositional and first-order logic. Other systems provide search procedures and decision procedures for specific languages and domains, such as linear or nonlinear expressions over the integers or the real numbers. Architectures like SMT (“satisfiability modulo theories”) combine domain-general search methods with domain-specific procedures. Computer algebra systems and specialized mathematical software packages provide means of carrying out mathematical computations, establishing mathematical bounds, or finding mathematical objects. A calculation can be viewed as a proof as well, and these systems, too, help establish mathematical claims. Automated reasoning systems strive for power and efficiency, often at the expense of guaranteed soundness. Such systems can have bugs, and it can be difficult to ensure that the results they deliver are correct. In contrast, interactive theorem proving focuses on the “verification” aspect of theorem proving, requiring that every claim is supported by a proof in a suitable axiomatic foundation. This sets a very high standard: every rule of inference and every step of a calculation has to be justified by appealing to prior definitions and theorems, all the way down to basic axioms and rules. In fact, most such systems provide fully elaborated “proof objects” that can be communicated to other systems and checked independently. Constructing such proofs typically requires much more input and interaction from users, but it allows us to obtain deeper and more complex proofs. The Lean Theorem Prover aims to bridge the gap between interactive and automated theorem proving, by situating automated tools and methods in a framework that supports user interaction and the construction of fully specified axiomatic proofs. The goal is to support both mathematical reasoning and reasoning about complex systems, and to verify claims in both domains.

This paper presents a machine-verified analysis of a number of classical algorithms for the list update problem: 2-competitiveness of move-to-front, the lower bound of 2 for the competitiveness of deterministic list update algorithms and 1.6-competitiveness of the randomized COMB algorithm, the best randomized list update algorithm known to date. The analysis is verified with help of the theorem prover Isabelle; some low-level proofs could be automated.

This book constitutes the proceedings of the 28th International Conference on Automated Reasoning with Analytic Tableaux and Related Methods, TABLEAUX 2019, held in London, UK, in September 2019, colocated with the 12th International Symposium on Frontiers on Combining Systems, FroCoS 2019. The 25 full papers presented were carefully reviewed and selected from 43 submissions.They present research on all aspects of the mechanization of tableaux-based reasoning and related methods, including theoretical foundations, implementation techniques, systems development and applications. The papers are organized in the following topical sections: tableau calculi, sequent calculi, semantics and combinatorial proofs, non-wellfounded proof systems, automated theorem provers, and logics for program or system verification.

We show that theorem proving, logic programming and constraint solving can be combined in a straightforward manner. This is shown not only by setting up a theoretical framework, but also by a real world application: the calculation of banking fees. We tackle the problem of deciding whether such a rule set is total and deterministic. Although these questions are undecidable in general, the restricted form of the investigated rule sets makes them decidable and even tractable in practise. Experiences with our system implemented in Prolog as well as some questions one may have with the application are discussed. The success of this application is due to the combination of constraint logic programming and first-order theorem proving, based on the model elimination calculus which is in the focus of the German research program on deduction. Each approach alone is not powerful enough to find the solution in reasonable time. The procedure proposed here can easily be generalized to analyzing arbitrary rule sets.

Structured prediction algorithms—used when applying machine learning to tasks like natural language parsing and image understanding—present some opportunities for fine-grained parallelism, but also have problem-specific serial dependencies. Most implementations exploit only simple opportunities such as parallel BLAS, or embarrassing parallelism over input examples. In this work we explore an orthogonal direction: using the fact that these algorithms can be described as specialized forward-chaining theorem provers [1], [2], and implementing fine-grained parallelization of the forward-chaining mechanism. We study context-free parsing as a simple canonical example, but the approach is more general.

MUSCADET: An automatic theorem proving system using knowledge and metaknowledge in mathematics

In proof checkers and theorem provers (e.g. Coq [4] and ProPre [13]) recursive definitions of functions are shown to terminate automatically. In standard non-formalised termination proofs of recursive functions, a decreasing measure is sometimes used. Such a decreasing measure is usually difficult to find.By observing the proof trees of the proofs of termination of recursive functions in ProPre (the system used in Coq’s proofs of termination), [14] finds a decreasing measure which could be used to show termination in the standard non-formalised way. This is important because it establishes a method to find decreasing measures that help in showing termination. As the ProPre system made heavy use of structural rather than inductive rules, an extended more powerful version has been built with new proof trees based on new rules.In this article, we show that the ordinal measures found in [14] lose the decreasing property in the extended ProPre system and then, set out to show that the extended ProPre system will still be suitable for finding measures required by other systems (e.g. NQTHM). We do this by showing that exist other measures that can be associated to the proof trees developed in the extended ProPre system that respect the decreasing property. We also show that the new parameterised measure functions preserve the decreasing property up to a simple condition.

The introduction of automated deduction systems in secondary schools face several bottlenecks. Beyond the problems related with the curricula and the teachers, the dissonance between the outcomes of the geometry automated theorem provers and the normal practice of conjecturing and proving in schools is a major barrier to a wider use of such tools in an educational environment. Since the early implementations of geometry automated theorem provers, applications of artificial intelligence methods, synthetic provers based on inference rules and using forward chaining reasoning are considered to be more suited for education proposes. Choosing an appropriate set of rules and an automated method that can use those rules is a major challenge. We discuss one such rule set and its implementation using the geometry deductive databases method (GDDM). The approach is tested using some chosen geometric conjectures that could be the goal of a 7th year class (approx. 12-year-old students). A lesson plan is presented, its goal is the introduction of formal demonstration of proving geometric theorems, trying to motivate students to that goal

Problem solving by searching for models with a theorem prover

Formal verification of information flow security with dynamic policies of security-critical systems is a grand challenge. This paper presents the first effort to formally specify and verify a capability-based system model with dynamic information flow policies. We build a generic security model with dynamic security policies. In the security model, we define a set of information flow security properties and provide an inference framework for them. Based on the security model, we propose a system model for capability-based secure systems. The system model specifies critical events including system initialization, inter-domain communication, and capability management. We prove information flow security of the capability-based model by an unwinding theorem. Formal specification and security proof are carried out in the Isabelle/HOL theorem prover and could be applied to formally develop and verify the security of capability-based secure systems, such as separation kernels and secure hypervisors. To our knowledge, this is the first machine-checked proof of capability-based information security with dynamic policies.

This paper describes a formal change impact analysis approach for systematic evolution of communicating systems. Systems are modeled using a network of communicating extended finite state machines (CEFSMs) with variables ranging over commonly used data types including numbers, Booleans, arrays, and object fields. Parameterized messages exchanged over queues and shared variables are used for communication. Changes to the system are performed at the transition level by adding/deleting transitions. Given a changed transition, the impacted system transitions are automatically computed using a bounded, selective, state exploration based on the inductive assertion approach. A theorem prover extended with queue axioms is used to discharge the verification conditions. Multiple symbolic values for each variable present in a system state are represented as a set of rewrite rules to minimize state space overheads. Rewrite-rule based procedures are described for reducing the number of symbolic values in system states. We also describe heuristics to identify simultaneously enabled and disabling transitions and describe a procedure to reduce the number of verification conditions generated during the impact analysis. The effectiveness of the proposed approach is illustrated on several applications including Web services and cache coherence protocols.

Cobalt: A Language for Writing Provably-Sound Compiler Optimizations

We give a proof of refutational completeness for Extended Narrowing And Resolution (ENAR), a calculus introduced by Dowek, Hardin and Kirchner in the context of Theorem Proving Modulo. ENAR integrates narrowing with respect to a set of rewrite rules on propositions into automated first-order theorem proving by resolution. Our proof allows to impose ordering restrictions on ENAR and provides general redundancy criteria, which are crucial for finding nontrivial proofs. On the other hand, it requires confluence and termination of the rewrite system, and in addition the existence of a well-founded ordering on propositions that is compatible with rewriting, compatible with ground inferences, total on ground clauses, and has some additional technical properties. Such orderings exist for hierarchical definitions of predicates. As an example we provide such an ordering for a fragment of set theory.

The Amber rules are well-known and widely used for subtyping iso-recursive types. They were first briefly and informally introduced in 1985 by Cardelli in a manuscript describing the Amber language. Despite their use over many years, important aspects of the metatheory of the iso-recursive style Amber rules have not been studied in depth or turn out to be quite challenging to formalize. This paper aims to revisit the problem of subtyping iso-recursive types. We start by introducing a novel declarative specification that we believe captures the “spirit” of Amber-style iso-recursive subtyping. Informally, the specification states that two recursive types are subtypes if all their finite unfoldings are subtypes . The Amber rules are shown to be sound with respect to this declarative specification. We then derive a sound , complete and decidable algorithmic formulation of subtyping that employs a novel double unfolding rule. Compared to the Amber rules, the double unfolding rule has the advantage of: 1) being modular; 2) not requiring reflexivity to be built in; and 3) leading to an easy proof of transitivity of subtyping. This work sheds new insights on the theory of subtyping iso-recursive types, and the new double unfolding rule has important advantages over the original Amber rules for both implementations and metatheoretical studies involving recursive types. All results are mechanically formalized in the Coq theorem prover. As far as we know, this is the first comprehensive treatment of iso-recursive subtyping dealing with unrestricted recursive types in a theorem prover.

We propose a partial information state-based framework for collaborative dialogue and argument between agents. We employ a three-valued based nonmonotonic logic, NML3, for representing and reasoning about Partial Information States (PIS). NML3 formalizes some aspects of revisable reasoning and it is sound and complete. Within the framework of NML3, we present a formalization of some basic dialogue moves and the rules of protocols of some types of dialogue. The rules of a protocol are nonmonotonic in the sense that the set of propositions to which an agent is committed and the validity of moves vary from one move to another. The use of PIS allows an agent to expand consistently its viewpoint with some of the propositions to which another agent, involved in a dialogue, is overtly committed. A proof method for the logic NML3 has been successfully implemented as an automatic theorem prover. We show, via some examples, that the tableau method employed to implement the theorem prover allows an agent, absolute access to every stage of a proof process. This access is useful for constructive argumentation and for finding cooperative and/or informative answers.