The CARE toolset for developing verified programs from formal specifications

SCR (Software Cost Reduction) specifications are useful for specifying event-driven systems. To use SCR effectively for critical applications, automated verification of safety properties is important. The fact that model checking approaches are sometimes problematic motivates us to further examine the alternative approach of theorem proving. Theorem proving, in general, is a difficult task; however the regular structure of the proof obligations generated from SCR specifications suggests that relatively unsophisticated theorem provers can discharge many of these obligations. As a feasibility study, we use the B-Toolkit to detect safety violations in an example SCR specification. The B-Toolkit is a good choice because it is commercially available and Supports verified refinement to executables in a commercial programming language (C). We convert the mode transition table in the example SCR specification to an AMN (Abstract Machine Notation) specification and analyze the result with the B-Toolkit. The B-Toolkit generates 120 proof obligations of which 113 are automatically discharged by the theorem prover. The remaining 7 proof obligations are, in fact, not theorems and correspond to the 3 problems in the SCR specification detected by the model checking approaches. For the corrected SCR specification, the B-Toolkit automatically discharges all proof obligations. The example shows that even simple theorem provers are a viable approach to automated analysis for SCR specifications.

Integration of SMT-solvers in B and Event-B development environments

This paper describes the application of the Real-Time Maude tool and the Maude formal methodology to the specification and analysis of the AER/NCA suite of active network multicast protocol components. Because of the time-sensitive and resource-sensitive behavior and the composability of its components, AER/NCA poses challenging new problems for its formal specification and analysis. Real-Time Maude is a natural extension of the Maude rewriting logic language and tool for the specification and analysis of real-time object-based distributed systems. It supports a wide spectrum of formal methods, including: executable specification; symbolic simulation; and infinite-state model checking of temporal logic formulas. These methods complement those offered by finite-state model checkers and general-purpose theorem provers. Real-Time Maude has proved to be well-suited to meet the AER/NCA modeling challenges, and its methods have been effective in uncovering subtle and important errors in the informal use case specification.

Abstraction is essential in the formal specification of programs. A common way of writing abstract specifications is to specify implementations in terms of basic mathematical structures. Specification languages like JML offer so-called model classes that provide interfaces to such structures. One way to reason about specifications that make use of model classes is to map model classes directly to structures provided by the theorem prover used for verification. Crucial to the soundness of this technique is the existence of a semantic correspondence between the model class and the related structure. In this paper, we present a formal framework based on theory interpretation for proving this correspondence. The framework provides a systematic way of determining the necessary proof obligations and justifies the soundness of the approach.

We introduce BWare, an industrial research project that aims to provide a mechanized framework to support the automated verification of proof obligations coming from the development of industrial applications using the B method and requiring high integrity. The adopted methodology consists in building a generic verification platform relying on different automated theorem provers, such as first order provers and SMT (Satisfiability Modulo Theories) solvers. Beyond the multi-tool aspect of our methodology, the originality of this project also resides in the requirement for the verification tools to produce proof objects, which are to be checked independently. In this paper, we present some preliminary results of BWare, as well as some current major lines of work.Keywords B MethodProof ObligationsFirst Order ProversSMT SolversLogical FrameworksIndustrial UseLarge Scale Study

TLA + is a formal specification language that is based on ZF set theory and the Temporal Logic of Actions TLA. The TLA + proof system tlaps assists users in deductively verifying safety properties of TLA + specifications. tlaps is built around a proof manager, which interprets the TLA + proof language, generates corresponding proof obligations, and passes them to backend verifiers. In this paper we present a new backend for use with SMT solvers that supports elementary set theory, functions, arithmetic, tuples, and records. Type information required by the solvers is provided by a typing discipline for TLA + proof obligations, which helps us disambiguate the translation of expressions of (untyped) TLA + , while ensuring its soundness. Preliminary results show that the backend can help to significantly increase the degree of automation of certain interactive proofs.KeywordsFunction SymbolProof ObligationType InferenceInput LanguageType AssignmentThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

PSGraph (Grov et al. in LPAR. Springer, Berlin, pp 324–339, 2013) is a graphical language to support the development and maintenance of proof tactics for interactive theorem provers. By using labelled hierarchical graphs this formalisation improves upon analysis and maintenance found in traditional tactic languages. Tool support for PSGraph is achieved by Tinker (Grov et al. in UITP 2014, ENTCS, vol 167. Open Publishing Association, London, pp 23–34, 2014; Lin et al. in Tools and algorithms for the construction and analysis of systems. Springer, Berlin, pp 573–579, 2016): a theorem prover-independent system, which is connected to several different provers, with a graphical user interface including novel features to develop and debug proof tactics graphically. In this paper we provide a detailed and formal account of PSGraph and show how theorem prover independence is achieved by Tinker. We then show practical use of PSGraph and Tinker by developing several proof patterns using the language and tool.

The purpose of this note is to provide a graduated selection of problems for use in testing an automatic theorem proving (ATP) system. Included in these problems were the ones I have used in testing my own ATP system (Pelletier 1982, and more recent updates to the system). Some of the problems, especially some of the more difficult ones described at the end of this note, are due to discussions with Len Schubert (Computing, Univ. Alberta), Alasdair Urquhart (Philosophy, Univ. Toronto), and Charles Morgan (Philosophy, Univ. Victoria). People who have tried to compile lists of problems for ATPs in the past (for example, the Association for Automated Reasoning) have discovered that the pro- duction of such a list is difficult because (a) what is ‘easy’ for one system might not be for another, (b) researchers are understandably shy about saying what problems their ATP might have, unless they know that it is so difficult that any ATP will have trouble with it, (c) especially with problems at the ‘easy end’ of the scale, researchers are prone to think that any ATP system can prove it and so there is no call to write them up, (d) the goals of ‘natural’ system ATPs and resolution-based ATPs are different: the former tries to produce a ‘natural’ proof usually without prior conver- sion to clause form. This means that some problems, especially at the ‘easy end’ of the scale, will be trivial for resolution systems but difficult for ‘natural’ systems. On the other hand, proponents of ‘natural’ systems think that at the ‘difficult end’ of the scale, there will be problems within the grasp of the ‘natural’ systems which are beyond the reach of resolution systems. It is therefore difficult to even give a graduated scale of problems. All this has led to publication of dificuft problems, but not to publication of lists of problems suitable for developing an ATP. The locus clussicus of problems is McCharen et al. (1976) which contains a wide range of problems all in clause form. More recently, the Journal of Automated Reasoning has instituted its ‘Problem Corner’. A notable item herein is Lusk and Overbeek (1985). All of us involved in ATP wish to encourage others - graduate students, for example - to look into the field. But where is such a person to start? It is with such neophyte

The ProB disprover uses constraint solving to find counter-examples for B proof obligations. As the ProB kernel is now capable of determining whether a search was exhaustive, one can also use the disprover as a prover. In this paper, we explain how ProB has been embedded as a prover into Rodin and Atelier B. Furthermore, we compare ProB with the standard automatic provers and SMT solvers used in Rodin. We demonstrate that constraint solving in general and ProB in particular are able to deal with classes of proof obligations that are not easily discharged by other provers and solvers. As benchmarks we use medium sized specifications such as landing gear systems, a CAN bus specification and a railway system. We also present a new method to check proof obligations for inconsistencies, which has helped uncover various issues in existing (sometimes fully proven) models.

LEO-II and Satallax on the Sledgehammer test bench

Coq is a proof assistant featuring a tactic-based interactive theorem prover. The latest incarnation comes with over 150 tactics that assist the user in developing a formal proof. These tactics range from the simple and mundane to the ‘allpowerful’. Some examples from the latter category are the omega tactic that solves a goal in Presburger arithmetic and the ring and field tactics that solve identities modulo associativity and commutativity in ring and field structures. This paper presents a new proof tactic that decides equalities and inequalities between terms over lattices. It uses a decision procedure that is a variation on Whitman’s algorithm and is implemented using a technique known as proof by reflection. We will paint the essence of the approach in broad strokes and discuss the use of certified functional programs to aid the automation of formal reasoning. This paper makes three contributions. Firstly it serves an an introduction to using proof by reflection approach Coq. This utilizes the Ltac language and two recent extensions to the Coq system: type classes and the PROGRAM extension. Secondly it gives a certified implementation of Whitman’s algorithm in Coq, with proofs of correctness and termination. Thirdly, the final product of this work is a useable proof tactic that can be applied to proof goals involving equalities and inequalities in lattice theory. The rest of the paper is organized as follows: Section 2 will give a short introduction to Coq, highlighting the concept of a proof term, and will refresh the necessary details of lattice theory. We will give a motivation for the problem in Section 3, and a Coq-based introduction to free lattices along with the decision

Formal verification of information flow security with dynamic policies of security-critical systems is a grand challenge. This paper presents the first effort to formally specify and verify a capability-based system model with dynamic information flow policies. We build a generic security model with dynamic security policies. In the security model, we define a set of information flow security properties and provide an inference framework for them. Based on the security model, we propose a system model for capability-based secure systems. The system model specifies critical events including system initialization, inter-domain communication, and capability management. We prove information flow security of the capability-based model by an unwinding theorem. Formal specification and security proof are carried out in the Isabelle/HOL theorem prover and could be applied to formally develop and verify the security of capability-based secure systems, such as separation kernels and secure hypervisors. To our knowledge, this is the first machine-checked proof of capability-based information security with dynamic policies.

The wide adoption of semistructured data has created a growing need for effective ways to ensure the correctness of its organization. One effective way to achieve this goal is through formal specification and automated verification. This paper presents a theorem proving approach towards verifying that a particular design or organization of semistructured data is correct. We formally specify the semantics of the Object Relationship Attribute data model for Semistructured Data (ORA-SS) modeling notation and its correctness criteria for semistructured data normalization using the Prototype Verification System (PVS). The result is that effective verification on semistructured data models and their normalization can be carried out using the PVS theorem prover.

A Program Result Checker for the Lexical Analysis of the GNU C Compiler

We provide a precise illustration of what can be the idea of “computational creativity”, that is, the whole set of the methods by which a computer may simulate creativity. This paper is restricted to multiple predicate learning in Inductive Logic Programming (ILP) and to Program Synthesis from its Formal Specification (PSFS). These two subfields of Computer Science deal with problems where creativity is of primary importance. They had to add to their basic formalisms, ILP and Beth’s tableaux (for PSFS), sets of heuristics enabling the program to solve the problem of Multiple Predicate synthesis. Some of these are what is usually called a heuristic, that is, a method by which the execution speed of the program is supposed to be boosted, at the price of a lost of some solutions. This paper, inversely, shows heuristics the goal of which is to provide the program with some kind of inventiveness. The basic tool for computational creativity is what we call an ’asset generator’ a specification of which is given in section 4, followed by a detailed description of our methodology for the generation of assets in PSFS. Since it may seem that our ’asset generation methodology’ for PSFS relies essentially on making explicit the logician’s good sense while performing a recursion constructive proof, and as an example of its efficiency, we provide in conclusion a result, a kind of challenge for the other theorem provers, namely: ‘invent’ a form of the Ackerman function which is recursive with respect to the second variable instead of the first variable as the usual definitions are.In ILP multiple predicate synthesis, the assets have been provided by members of the ILP community, while our methodology tries to make explicit a way to discover these assets when they are needed.KeywordsInduction HypothesisDomain KnowledgeTheorem ProveInfinite SequenceInductive Logic ProgrammingThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.