Automatic Verification of TLA + Proof Obligations with SMT Solvers

TLAPS, the TLA + proof system, is a platform for the development and mechanical verification of TLA + proofs. The TLA + proof language is declarative, and understanding proofs requires little background beyond elementary mathematics. The language supports hierarchical and non-linear proof construction and verification, and it is independent of any verification tool or strategy. Proofs are written in the same language as specifications; engineers do not have to translate their high-level designs into the language of a particular verification tool. A proof manager interprets a TLA + proof as a collection of proof obligations to be verified, which it sends to backend verifiers that include theorem provers, proof assistants, SMT solvers, and decision procedures.The first public release of TLAPS is available from [1], distributed with a BSD-like license. It handles almost all the non-temporal part of TLA + as well as the temporal reasoning needed to prove standard safety properties, in particular invariance and step simulation, but not liveness properties. Intuitively, a safety property asserts what is permitted to happen; a liveness property asserts what must happen; for a more formal overview, see [3,10].KeywordsTheorem ProverProof SystemSafety PropertyProof ObligationProof AssistantThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

The ProB disprover uses constraint solving to find counter-examples for B proof obligations. As the ProB kernel is now capable of determining whether a search was exhaustive, one can also use the disprover as a prover. In this paper, we explain how ProB has been embedded as a prover into Rodin and Atelier B. Furthermore, we compare ProB with the standard automatic provers and SMT solvers used in Rodin. We demonstrate that constraint solving in general and ProB in particular are able to deal with classes of proof obligations that are not easily discharged by other provers and solvers. As benchmarks we use medium sized specifications such as landing gear systems, a CAN bus specification and a railway system. We also present a new method to check proof obligations for inconsistencies, which has helped uncover various issues in existing (sometimes fully proven) models.

Combining decision procedures by (model-)equality propagation

Satisfiability Modulo Theories (SMT) solvers have proven highly scalable, efficient and suitable for integrating theory reasoning. However, for numerous applications from program analysis and verification, the ground fragment is insufficient, as proof obligations often include quantifiers. A well known approach for quantifier reasoning uses a matching algorithm that works against an E-graph to instantiate quantified variables. This paper introduces algorithms that identify matches on E-graphs incrementally and efficiently. In particular, we introduce an index that works on E-graphs, called E-matching code treesthat combine features of substitution and code trees, used in saturation based theorem provers. E-matching code trees allow performing matching against several patterns simultaneously. The code trees are combined with an additional index, called the inverted path index, which filters E-graph terms that may potentially match patterns when the E-graph is updated. Experimental results show substantial performance improvements over existing state-of-the-art SMT solvers.

We introduce BWare, an industrial research project that aims to provide a mechanized framework to support the automated verification of proof obligations coming from the development of industrial applications using the B method and requiring high integrity. The adopted methodology consists in building a generic verification platform relying on different automated theorem provers, such as first order provers and SMT (Satisfiability Modulo Theories) solvers. Beyond the multi-tool aspect of our methodology, the originality of this project also resides in the requirement for the verification tools to produce proof objects, which are to be checked independently. In this paper, we present some preliminary results of BWare, as well as some current major lines of work.Keywords B MethodProof ObligationsFirst Order ProversSMT SolversLogical FrameworksIndustrial UseLarge Scale Study

Traditional structured analysis and design methods have been criticized because the methods lack formality to provide a design for rigorous development. Several approaches have been developed for verifying a design by integrating traditional structured analysis and design methods with formal specification languages. However, the integration of traditional structured analysis and design methods with formal specification languages may confuse the problem definition and understanding with the attempt to define system structures and algorithms in the design phase. In addition, formal specification languages may add complexity to the design due to the complexity of the language syntax and semantics. In this paper, we are presenting an approach to verification of a structured design in HOS without using formal specification languages. Rules for the partial and total correctness of the design are also discussed.

Although set theory is the most popular foundation for mathematics, not many i>mechanized mathematics systems are based on set theory. Zermelo–Fraenkel (ZF) set theory and other traditional set theories are not an adequate foundation for mechanized mathematics. STMM is a version of von-Neumann–Bernays–Godel (NBG) set theory that is intended to be a Set Theory for Mechanized Mathematics. STMM allows terms to denote proper classes and to be undefined, has a definite description operator, provides a sort system for classifying terms by value, and includes lambda-notation with term constructors for function application and function abstraction. This paper describes STMM and discusses why it is a good foundation for mechanized mathematics.

This is the first of two articles dedicated to the notion of constructive set. In them we attempt a comparison between two different notions of set which occur in the context of the foundations for constructive mathematics. We also put them under perspective by stressing analogies and differences with the notion of set as codified in the classical theory Zermelo–Fraenkel. In the current article we illustrate in some detail the notion of set as expressed in Martin–L¨of type theory and present the essential characters of this theory. In a second article we shall explore a distinct notion of set, as arising in the context of intuitionistic versions of Zermelo–Fraenkel set theory. The theory we shall analyse there is Aczel’s CZF (Constructive Zermelo– Fraenkel) and we shall supplement its exposition by a succinct account of Aczel’s interpretation of CZF in type theory. This will enable us to compare the two notions in a more precise sense.

The Satisfiability Modulo Theories (SMT) issue concerns the satisfiability of formulae from multiple background theories, usually expressed in the language of first-order predicate logic with equality. SMT solvers are often based on variants of the Nelson-Oppen combination method, a solver for the quantifier-free fragment of the combination of theories with disjoint signatures, via cooperation among their decision procedures. When each of the theories to be combined by the Nelson-Oppen method is convex (that is, any conjunction of its literals can imply a disjunction of equalities only when it implies at least one of the equalities) and decidable in polynomial time, the running time of the combination procedure is guaranteed to be polynomial in the size of the input formula. In this paper, we prove the convexity of a fragment of Zermelo-Fraenkel set theory, called Multi-Level Syllogistic, most of whose polynomially decidable fragments we have recently characterized.

This chapter introduces the concepts of mathematical induction and recursion. Starting from first-order logic and the Zermelo-Fraenkel axioms of set theory, including the axiom of infinity, the chapter establishes the theoretical basis for proofs by the Principle of Mathematical Induction, followed by definitions through mathematical induction, which forms the basis for the concept of primitive-recursive functions. As an extended example, one section defines integer addition and multiplication as primitive-recursive functions, and hence derives the basic properties of integer arithmetic (associativity, commutativity, and distributivity) by induction. Subsequent sections define ordering relations and derive cancellation laws and exponential laws for integer and rational arithmetic. Another section then applies arithmetic to the cardinalities of unions, intersections, differences, and Cartesian products of finite sets. Yet another section focuses on denumerable and other not-necessarily finite sets, leading to J. M. Whitaker’s proof of the Bernstein-Cantor-Schroder Theorem within Zermelo-Fraenkel set theory. The prerequisites for this chapter consist of a working knowledge of first-order logic and Zermelo-Fraenkel set theory, for instance, as described in chapters 1, 2, and 3, which contain all the logical and set-theoretical theorems cited in this chapter.

Recently, the Elementary Process Theory (EPT) has been developed as a set of fundamental principles that might underlie a gravitational repulsion of matter and antimatter. This paper presents set matrix theory (SMT) as the foundation of the mathematicallogical framework in which the EPT has been formalized: it is, namely, objectionable to use Zermelo-Fraenkel set theory (ZF) as such. SMT is a generalization of ZF: whereas ZF uses only sets as primitive objects, in the framework of SMT nite matrices with set-valued entries are objects sui generis, with a 1 1 set matrix [x] being identical to the set x. It is proved that every set that can be constructed in ZF can also be constructed in SMT: as a mathematical foundation, SMT is thus not weaker than ZF. In addition, it is shown that SMT is more suitable than ZF for the intended application to physics. The conclusion is that SMT, contrary to ZF, is acceptable as the mathematical-logical foundation of the framework for physics that is determined by the EPT.

Assuming the Axiom of Constructibility, necessary and sufficient conditions are given for the vanishing of Ext\ for rings A of global dimension 1.Using Martin's Axiom, the necessity of these conditions is shown not to be a theorem of ZFC.Applications are given to abelian group theory, including a partial solution (assuming V = L) to a problem of Baer on the splitting of abelian groups.Some independence results in abelian group theory are also proved.Introduction.In a remarkable recent paper [22], S. Shelah proved that Whitehead's problem is unsolvable in ordinary set theory (Zermelo-Frankel set theory with the Axiom of Choice).More precisely, he proved that two different answers to the problem are obtained when set theory is extended by adding two different axioms: the Axiom of Constructibility and Martin's Axiom.(See Theorem 4.1.)Shelah's arguments were specific to Whitehead's problem and nonhomological in character.In this paper we extend Shelah's techniques in order to obtain some general results about the vanishing of ExtA (for modules over a ring A of global dimension 1) in different models of set theory, and we apply them to some specific problems in abelian group theory.Assuming the Axiom of Constructibility we obtain necessary and sufficient conditions for the vanishing of ExtA (Theorems 1.2 and 1.5).To state the result in.a special case: if C and A are abelian groups of cardinality N,, Ext(C, A) -0 if and only if C is the union of an increasing chain of countable subgroups [Cv\v < «,} such that the chain is smooth (i.e., C0 -U"<oC, for aii iimit ordinals a) and satisfies Ext(C0, A) = 0 and E\i(Cv+x/Cv,A) = 0 for all v < K,.Although the sufficiency of this condition is an easy consequence of classical homological algebra (see Theorem 1.2), the proof of necessity makes use of the Axiom of Constructibility (Theorem 1.5).The necessity of this condition is not provable in ordinary set theory; in particular the condition is not necessary when Martin's Axiom is assumed ( §3).

Encoding TLA+ into unsorted and many-sorted first-order logic

SCR (Software Cost Reduction) specifications are useful for specifying event-driven systems. To use SCR effectively for critical applications, automated verification of safety properties is important. The fact that model checking approaches are sometimes problematic motivates us to further examine the alternative approach of theorem proving. Theorem proving, in general, is a difficult task; however the regular structure of the proof obligations generated from SCR specifications suggests that relatively unsophisticated theorem provers can discharge many of these obligations. As a feasibility study, we use the B-Toolkit to detect safety violations in an example SCR specification. The B-Toolkit is a good choice because it is commercially available and Supports verified refinement to executables in a commercial programming language (C). We convert the mode transition table in the example SCR specification to an AMN (Abstract Machine Notation) specification and analyze the result with the B-Toolkit. The B-Toolkit generates 120 proof obligations of which 113 are automatically discharged by the theorem prover. The remaining 7 proof obligations are, in fact, not theorems and correspond to the 3 problems in the SCR specification detected by the model checking approaches. For the corrected SCR specification, the B-Toolkit automatically discharges all proof obligations. The example shows that even simple theorem provers are a viable approach to automated analysis for SCR specifications.

In the thirty years since its invention by Abraham Robinson, nonstandard analysis has become a useful tool for research in many areas of mathematics. It seems fair to say, however, that the search for practically satisfactory foundations for the subject is not yet completed. New proposals, intended to remedy various shortcomings of older approaches, continue to be put forward. The objective of this paper is to show that nonstandard concepts have a natural place in the usual (more or less “standard”) set theory, and to argue that this approach improves upon various aspects of hitherto considered systems, while retaining most of their attractive features. We do this by working in Zermelo-Fraenkel set theory with non-well-founded sets. It has always been clear that the axiom of regularity may fail for external sets. The previous approaches either avoid non-well-foundedness by considering only that fragment of nonstandard set theory that is well-founded (over individuals; enlargements of Robinson and Zakon [17]) or reluctantly live with it (various axiomatic nonstandard set theories). Ballard and Davidon [2] were the first to propose constructive use for non-well-foundedness in the foundations of nonstandard analysis. In the present paper we adopt a very strong anti-foundation axiom. In the resulting more or less “usual” set theory, the (to the “standard” mathematician) unfamiliar concepts of standard, external and internal sets can be defined and their requisite properties proved (rather than postulated, as is the case in axiomatic nonstandard set theories).