Formalization of the General Hoare Logic Laws

Formal verification involves the use of logical and computational methods to establish claims that are expressed in precise mathematical terms. These can include ordinary mathematical theorems, as well as claims that pieces of hardware or software, network protocols, and mechanical and hybrid systems meet their specifications. In practice, there is not a sharp distinction between verifying a piece of mathematics and verifying the correctness of a system: formal verification requires describing hardware and software systems in mathematical terms, at which point establishing claims as to their correctness becomes a form of theorem proving. Conversely, the proof of a mathematical theorem may require a lengthy computation, in which case verifying the truth of the theorem requires verifying that the computation does what it is supposed to do. The gold standard for supporting a mathematical claim is to provide a proof, and twentieth-century developments in logic show most if not all conventional proof methods can be reduced to a small set of axioms and rules in any of a number of foundational systems. With this reduction, there are two ways that a computer can help establish a claim: it can help find a proof in the first place, and it can help verify that a purported proof is correct. Automated theorem proving focuses on the “finding” aspect. Resolution theorem provers, tableau theorem provers, fast satisfiability solvers, and so on provide means of establishing the validity of formulas in propositional and first-order logic. Other systems provide search procedures and decision procedures for specific languages and domains, such as linear or nonlinear expressions over the integers or the real numbers. Architectures like SMT (“satisfiability modulo theories”) combine domain-general search methods with domain-specific procedures. Computer algebra systems and specialized mathematical software packages provide means of carrying out mathematical computations, establishing mathematical bounds, or finding mathematical objects. A calculation can be viewed as a proof as well, and these systems, too, help establish mathematical claims. Automated reasoning systems strive for power and efficiency, often at the expense of guaranteed soundness. Such systems can have bugs, and it can be difficult to ensure that the results they deliver are correct. In contrast, interactive theorem proving focuses on the “verification” aspect of theorem proving, requiring that every claim is supported by a proof in a suitable axiomatic foundation. This sets a very high standard: every rule of inference and every step of a calculation has to be justified by appealing to prior definitions and theorems, all the way down to basic axioms and rules. In fact, most such systems provide fully elaborated “proof objects” that can be communicated to other systems and checked independently. Constructing such proofs typically requires much more input and interaction from users, but it allows us to obtain deeper and more complex proofs. The Lean Theorem Prover aims to bridge the gap between interactive and automated theorem proving, by situating automated tools and methods in a framework that supports user interaction and the construction of fully specified axiomatic proofs. The goal is to support both mathematical reasoning and reasoning about complex systems, and to verify claims in both domains.

Automated theorem provers for first-order logic usually operate on sets of first-order clauses. It is well-known that the translation of a formula in full first-order logic to a clausal normal form (CNF) can crucially affect performance of a theorem prover. In our recent work we introduced a modification of first-order logic extended by the first class boolean sort and syntactical constructs that mirror features of programming languages. We called this logic FOOL. Formulas in FOOL can be translated to ordinary first-order formulas and checked by first-order theorem provers. While this translation is straightforward, it does not result in a CNF that can be efficiently handled by state-of-the-art theorem provers which use superposition calculus. In this paper we present a new CNF translation algorithm for FOOL that is friendly and efficient for superposition-based first-order provers. We implemented the algorithm in the Vampire theorem prover and evaluated it on a large number of problems coming from formalisation of mathematics and program analysis. Our experimental results show an increase of performance of the prover with our CNF translation compared to the naive translation.

We formalize a Hoare logic for the partial correctness of while programs in PVS and prove its soundness and relative completeness. We use the PVS higher-order logic to define the syntax and semantics of a small imperative programming language, and describe a proof system for Hoare triples involving programs in this language. We prove the soundness of the proof system by demonstrating that only valid triples are provable. We also demonstrate the relative completeness of the proof system by defining the weakest liberal precondition operator and using it to prove that all valid Hoare triples are provable modulo the assertion logic. Finally, we verify a verification condition generator for Hoare logic Variants of Hoare logic have been formalized before in PVS and using other interactive proof assistants. We use Hoare logic as a tutorial exercise to illustrate the effective use of PVS in capturing the syntax and semantics of embedded logics. The embedding of Hoare logic is simple enough to be easily reproduced by the reader, but it also illustrates some of the nuances of formalization and proof using PVS, in particular, and higher-order logic, in general.

This paper proposes a method to automatically generate composite services. The function of a service is specified by its Inputs, Output, Preconditions, and Result (IOPR). These functional descriptions are translated into a first-order logic (FOL) formula. An Automatic Theorem Prover (ATP) is used to generate a proof from known services (as axioms) to the composite service (as an object formula). Based on the deductive program synthesis theory, the implementation of the composite service is extracted from the proof. The “proof to program” method used here guarantees the completeness and correctness of the result. An brief introduction of the prototype system is given.KeywordsSemantic Web ServicesAutomatic Service CompositionAutomatic Theorem ProofDeductive Program Synthesis

The purpose of this note is to provide a graduated selection of problems for use in testing an automatic theorem proving (ATP) system. Included in these problems were the ones I have used in testing my own ATP system (Pelletier 1982, and more recent updates to the system). Some of the problems, especially some of the more difficult ones described at the end of this note, are due to discussions with Len Schubert (Computing, Univ. Alberta), Alasdair Urquhart (Philosophy, Univ. Toronto), and Charles Morgan (Philosophy, Univ. Victoria). People who have tried to compile lists of problems for ATPs in the past (for example, the Association for Automated Reasoning) have discovered that the pro- duction of such a list is difficult because (a) what is ‘easy’ for one system might not be for another, (b) researchers are understandably shy about saying what problems their ATP might have, unless they know that it is so difficult that any ATP will have trouble with it, (c) especially with problems at the ‘easy end’ of the scale, researchers are prone to think that any ATP system can prove it and so there is no call to write them up, (d) the goals of ‘natural’ system ATPs and resolution-based ATPs are different: the former tries to produce a ‘natural’ proof usually without prior conver- sion to clause form. This means that some problems, especially at the ‘easy end’ of the scale, will be trivial for resolution systems but difficult for ‘natural’ systems. On the other hand, proponents of ‘natural’ systems think that at the ‘difficult end’ of the scale, there will be problems within the grasp of the ‘natural’ systems which are beyond the reach of resolution systems. It is therefore difficult to even give a graduated scale of problems. All this has led to publication of dificuft problems, but not to publication of lists of problems suitable for developing an ATP. The locus clussicus of problems is McCharen et al. (1976) which contains a wide range of problems all in clause form. More recently, the Journal of Automated Reasoning has instituted its ‘Problem Corner’. A notable item herein is Lusk and Overbeek (1985). All of us involved in ATP wish to encourage others - graduate students, for example - to look into the field. But where is such a person to start? It is with such neophyte

We present the verification of the normalization of a binary decision diagram (BDD). The normalization follows the original algorithm presented by Bryant in 1986 and transforms an ordered BDD in a reduced, ordered and shared BDD. The verification is based on Hoare logics and is carried out in the theorem prover Isabelle/HOL. The work is both a case study for verification of procedures on a complex pointer structure, as well as interesting on its own, since it is the first proof of functional correctness of the pointer based normalization process we are aware of.

The total correctness of programs with mutually recursive procedures is significantly more complex than their partial correctness. Past methods of proving termination have suffered from being rigid, not general, non-intuitive, and ad hoc in structure, not suitable for mechanization. We have devised a new method for proving termination and mechanized it within an automatic tool called a Verification Condition Generator. This tool analyzes not only the program's syntax but also, uniquely, its procedure call graph, to produce verification conditions sufficient to ensure the program's total correctness. Diversion verification conditions reduce the labor involved in proving termination from infinite to finite. The VCG tool has itself been deeply embedded and proven sound within the HOL theorem prover with respect to the underlying structural operational semantics. Now proofs of total correctness of individual programs may be significantly automated with complete security.

Worst Case Execution Time (WCET) analysis of large and complex hybrid systems can be time consuming. Contract based design allows for compositional reasoning of complex systems. Contracts justify the behavior of a system by way of assumptions (which are to be satisfied by the system environment) and guarantees, which are to be met by the system. Contracts also play a major role in compositional reasoning, refinement and re-usability of the system components. In this paper, we present a formal framework to enforce real-time contracts using Hoare triples, for synchronous system design and verification. In that regard, we propose real-time Hoare rules which are based on the WCET of the system and its components. We verify the real-time behavior of the system by applying these rules. These rules not only justify the system behavior and the behavior of its components but their timing as well. We also show that these Hoare rules are sound. Then we show that the synchronous composition of component level Hoare rules based contracts justify a system level contract. This real-time contract composition and reasoning technique which is based on real-time Hoare logic rules is the first ever attempt in synchronous system design and verification.

This paper offers a new practical approach toward automated commonsense reasoning with first-order logic (FOL) SUMO-based ontologies. We propose a new black-box evaluation framework for SUMO-based ontologies, which exploits the world knowledge encoded in WordNet and its mapping into SUMO. Our proposal consists of both a novel semi-automatic method for the creation of a large set of commonsense problems and a new procedure that enables its automatic evaluation by using automated theorem provers (ATPs). The application of our method enables the creation of a very large benchmark consisting of more than 15 000 problems from a small set of manually built question patterns that exploit the WordNet semantic relations. By means of the resulting benchmark, we successfully evaluate the competency of different translations of SUMO into FOL and the performance of various state-of-the-art FOL ATPs according to several quality criteria. A general analysis of our experimental results demonstrates that the proposed commonsense problems are heterogeneous and non-trivial. Furthermore, a fine-grained analysis of the experimental results obtained for a sample of our benchmark enables the detection of some mapping errors and some discrepancies between the knowledge of WordNet and SUMO. The evaluation benchmark and all the resources that have been used and developed during this work are released in a single package.

For a wide class of programming languages P and expressive interpretations I, we show that there exist sound and relatively complete Hoare-like logics for both partial correctness and termination assertions. In fact, under mild assumptions on P and I, we show that the assertions true for P in I are uniformly decidable in the theory of I (Th(I)) iff the halting problem for P is decidable for finite interpretations. Moreover termination assertions are uniformly r.e. in Th(I) even if the halting problem for P is not decidable for finite interpretations. Since total correctness assertions coincide with termination assertions for deterministic programming languages, this last result unexpectedly suggests that the class of languages with good axiom systems for total correctness may be wider than for partial correctness.

It is claimed in [45] that first-order theorem provers are not efficient for reasoning with ontologies based on description logics compared to specialised description logic reasoners. However, the development of more expressive ontology languages requires the use of theorem provers able to reason with full first-order logic and even its extensions. So far, theorem provers have extensively been used for running experiments over TPTP containing mainly problems with relatively small axiomatisations. A question arises whether such theorem provers can be used to reason in real time with large axiomatisations used in expressive ontologies such as SUMO. In this paper we answer this question affirmatively by showing that a carefully engineered theorem prover can answer queries to ontologies having over 15,000 first-order axioms with equality. Ontologies used in our experiments are based on the language KIF, whose expressive power goes far beyond the description logic based languages currently used in the Semantic Web.KeywordsTheorem ProverDescription LogicPredicate SymbolOntology LanguageQuery AnsweringThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

This paper discusses a multimodal AI system applied to legal reasoning for tax law. The results given here are very general and apply to systems developed for other areas besides tax law. A central goal of this work is to gain a better understanding of the relationships between LLMs (Large Language Models) and automated theorem-proving methodologies. To do this, we suppose (1) two cases for the theorem-proving system: one where it has a countable number of total meanings for its countable number of atoms and the other is where it has an uncountable number of total meanings for its countable number of atoms, and (2) LLMs can have an uncountable number of token meanings. With this in mind, the results given in this paper use the downward and upward Löwenheim–Skolem theorems and logical model theory to contrast these two AI modalities. One modality focuses on syntactic proofs and the other focuses on logical semantics based on LLMs. Particularly, one modality uses a rule-based first-order logic theorem-proving system to perform legal reasoning. The objective of this theorem-proving system is to provide proofs as evidence of valid legal reasoning when enacted laws are applied to particular situations. These proofs are syntactic structures that can be presented in the form of narrative explanations of how the answer to the legal question was determined. The second modality uses LLMs to analyze and transform a user’s tax query so this query can be sent to a first-order logic theorem-proving system to perform its legal reasoning function. The main goal of our application of LLMs is to enhance and simplify user input and output for the theorem-proving system. Using logical model theory, we show how there can exist an equivalence between laws represented in logic of the theorem-proving system, fixed in time when the theorem-proving system was set up, and new semantics given by LLMs. These results are based on logical model theory and Löwenheim–Skolem theorems.

The Conditional Observer and Controller Logic (COCOLOG) is a logical system for the feedback control of finite inputdstatedoutput systems wherein the individual first order logical theories have the properties of consistency, completeness and decidability. The efficiency of automatic theorem proving (ATP) is a crucial issue in the implementation of COCOLOG control systems and in this paper we present a sodcalled function evaluation (FE) based resolutiondrefutation ATP methodology for COCOLOG. FEdresolution ATP replaces the axioms specifying the dynamics of a finite inputdstatedoutput machine by a set of defined function relations. The resulting procedure extends to predicates and hence permits the definition of constant and variable FEdresolution inference. It is shown that FEdresolution ATP is complete in the sense that a set of clauses which is unsatisfiable in all models with the given interpretation of the functions will yield the empty clause under resolution, paramodulation and FEdresolution.

Our theorem proving system named TTP (which is short for Teaching Theorem Proving) can construct the natural deduction proofs of the first-order logic formulas with quantifiers. It is written in CLISP. It has 4 learning models. Students can use the system to do their logic homework step by step and learn the skills of proving logic theorems. If they don't know how to prove the theorems, they can ask for hints. In our university about 300 students used the system to learn logic and do homework during 3 years, they did 2000 problems in logic.

Automatic reasoning tools play an important role when developing provably correct software. Both main approaches, program verification and program synthesis employ automated reasoning tools, more specifically, automated theorem provers. Besides classical logic, non-classical logics are particularly relevant in this field. This chapter presents calculi to automate theorem proving in classical and some important non-classical logics, namely first-order intuitionistic and first-order modal logics. These calculi are based on the connection method, which permits a goal-oriented and, hence, a more efficient proof search. The connection calculi for these non-classical logics extend the calculus for classical logic in an elegant and uniform way by adding so-called prefixes to atomic formulae. The leanCoP theorem prover is a very compact PROLOG implementation of the connection calculus for classical logics. We present details of the implementation and describe some basic techniques to improve its efficiency. leanCoP is adapted to non-classical logics by integrating a prefix unification algorithm, which depends on the specific logic. This results in leading theorem provers for the aforementioned non-classical logics.