103 research outputs found
Proof-Pattern Recognition and Lemma Discovery in ACL2
We present a novel technique for combining statistical machine learning for
proof-pattern recognition with symbolic methods for lemma discovery. The
resulting tool, ACL2(ml), gathers proof statistics and uses statistical
pattern-recognition to pre-processes data from libraries, and then suggests
auxiliary lemmas in new proofs by analogy with already seen examples. This
paper presents the implementation of ACL2(ml) alongside theoretical
descriptions of the proof-pattern recognition and lemma discovery methods
involved in it
ACL2(ml):machine-learning for ACL2
ACL2(ml) is an extension for the Emacs interface of ACL2. This tool uses
machine-learning to help the ACL2 user during the proof-development. Namely,
ACL2(ml) gives hints to the user in the form of families of similar theorems,
and generates auxiliary lemmas automatically. In this paper, we present the two
most recent extensions for ACL2(ml). First, ACL2(ml) can suggest now families
of similar function definitions, in addition to the families of similar
theorems. Second, the lemma generation tool implemented in ACL2(ml) has been
improved with a method to generate preconditions using the guard mechanism of
ACL2. The user of ACL2(ml) can also invoke directly the latter extension to
obtain preconditions for his own conjectures.Comment: In Proceedings ACL2 2014, arXiv:1406.123
Hipster: Integrating Theory Exploration in a Proof Assistant
This paper describes Hipster, a system integrating theory exploration with
the proof assistant Isabelle/HOL. Theory exploration is a technique for
automatically discovering new interesting lemmas in a given theory development.
Hipster can be used in two main modes. The first is exploratory mode, used for
automatically generating basic lemmas about a given set of datatypes and
functions in a new theory development. The second is proof mode, used in a
particular proof attempt, trying to discover the missing lemmas which would
allow the current goal to be proved. Hipster's proof mode complements and
boosts existing proof automation techniques that rely on automatically
selecting existing lemmas, by inventing new lemmas that need induction to be
proved. We show example uses of both modes
ΠΠΎΠΌΠΏΠ»Π΅ΠΊΡΠ½ΡΠΉ ΠΏΠΎΠ΄Ρ ΠΎΠ΄ ΡΠΈΡΡΠ΅ΠΌΡ C-lightVer ΠΊ Π°Π²ΡΠΎΠΌΠ°ΡΠΈΠ·ΠΈΡΠΎΠ²Π°Π½Π½ΠΎΠΉ Π»ΠΎΠΊΠ°Π»ΠΈΠ·Π°ΡΠΈΠΈ ΠΎΡΠΈΠ±ΠΎΠΊ Π² C-ΠΏΡΠΎΠ³ΡΠ°ΠΌΠΌΠ°Ρ
The C-lightVer system for the deductive verification of C programs is being developed at the IIS SB RAS. Based on the two-level architecture of the system, the C-light input language is translated into the intermediate C-kernel language. The meta generator of the correctness conditions receives the C-kernel program and Hoare logic for the C-kernel as input. To solve the well-known problem of determining loop invariants, the definite iteration approach was chosen. The body of the definite iteration loop is executed once for each element of the finite dimensional data structure, and the inference rule for them uses the substitution operation rep, which represents the action of the cycle in symbolic form. Also, in our meta generator, the method of semantic markup of correctness conditions has been implemented and expanded. It allows to generate explanations for unproven conditions and simplifies the errors localization. Finally, if the theorem prover fails to determine the truth of the condition, we can focus on proving its falsity. Thus a method of proving the falsity of the correctness conditions in the ACL2 system was developed. The need for more detailed explanations of the correctness conditions containing the replacement operation rep has led to a change of the algorithms for generating the replacement operation, and the generation of explanations for unproven correctness conditions. Modifications of these algorithms are presented in the article. They allow marking rep definition with semantic labels, extracting semantic labels from rep definition and generating description of break execution condition.Π ΠΠ‘Π Π‘Π Π ΠΠ ΡΠ°Π·ΡΠ°Π±Π°ΡΡΠ²Π°Π΅ΡΡΡ ΡΠΈΡΡΠ΅ΠΌΠ° C-lightVer Π΄Π»Ρ Π΄Π΅Π΄ΡΠΊΡΠΈΠ²Π½ΠΎΠΉ Π²Π΅ΡΠΈΡΠΈΠΊΠ°ΡΠΈΠΈ Π‘-ΠΏΡΠΎΠ³ΡΠ°ΠΌΠΌ. ΠΡΡ
ΠΎΠ΄Ρ ΠΈΠ· Π΄Π²ΡΡ
ΡΡΠΎΠ²Π½Π΅Π²ΠΎΠΉ Π°ΡΡ
ΠΈΡΠ΅ΠΊΡΡΡΡ ΡΠΈΡΡΠ΅ΠΌΡ, Π²Ρ
ΠΎΠ΄Π½ΠΎΠΉ ΡΠ·ΡΠΊ C-light ΡΡΠ°Π½ΡΠ»ΠΈΡΡΠ΅ΡΡΡ Π² ΠΏΡΠΎΠΌΠ΅ΠΆΡΡΠΎΡΠ½ΡΠΉ ΡΠ·ΡΠΊ C-kernel. ΠΠ΅ΡΠ°Π³Π΅Π½Π΅ΡΠ°ΡΠΎΡ ΡΡΠ»ΠΎΠ²ΠΈΠΉ ΠΊΠΎΡΡΠ΅ΠΊΡΠ½ΠΎΡΡΠΈ ΠΏΡΠΈΠ½ΠΈΠΌΠ°Π΅Ρ Π½Π° Π²Ρ
ΠΎΠ΄ C-kernel ΠΏΡΠΎΠ³ΡΠ°ΠΌΠΌΡ ΠΈ Π»ΠΎΠ³ΠΈΠΊΡ Π₯ΠΎΠ°ΡΠ° Π΄Π»Ρ C-kernel. ΠΠ»Ρ ΡΠ΅ΡΠ΅Π½ΠΈΡ ΠΈΠ·Π²Π΅ΡΡΠ½ΠΎΠΉ ΠΏΡΠΎΠ±Π»Π΅ΠΌΡ Π·Π°Π΄Π°Π½ΠΈΡ ΠΈΠ½Π²Π°ΡΠΈΠ°Π½ΡΠΎΠ² ΡΠΈΠΊΠ»ΠΎΠ² Π²ΡΠ±ΡΠ°Π½ ΠΏΠΎΠ΄Ρ
ΠΎΠ΄ ΡΠΈΠ½ΠΈΡΠ½ΡΡ
ΠΈΡΠ΅ΡΠ°ΡΠΈΠΉ. Π’Π΅Π»ΠΎ ΡΠΈΠΊΠ»Π° ΡΠΈΠ½ΠΈΡΠ½ΠΎΠΉ ΠΈΡΠ΅ΡΠ°ΡΠΈΠΈ ΠΈΡΠΏΠΎΠ»Π½ΡΠ΅ΡΡΡ ΠΎΠ΄ΠΈΠ½ ΡΠ°Π· Π΄Π»Ρ ΠΊΠ°ΠΆΠ΄ΠΎΠ³ΠΎ ΡΠ»Π΅ΠΌΠ΅Π½ΡΠ° ΡΡΡΡΠΊΡΡΡΡ Π΄Π°Π½Π½ΡΡ
ΠΊΠΎΠ½Π΅ΡΠ½ΠΎΠΉ ΡΠ°Π·ΠΌΠ΅ΡΠ½ΠΎΡΡΠΈ, Π° ΠΏΡΠ°Π²ΠΈΠ»ΠΎ Π²ΡΠ²ΠΎΠ΄Π° Π΄Π»Ρ Π½ΠΈΡ
ΠΈΡΠΏΠΎΠ»ΡΠ·ΡΠ΅Ρ ΠΎΠΏΠ΅ΡΠ°ΡΠΈΡ Π·Π°ΠΌΠ΅Π½Ρ rep, Π²ΡΡΠ°ΠΆΠ°ΡΡΡΡ Π΄Π΅ΠΉΡΡΠ²ΠΈΠ΅ ΡΠΈΠΊΠ»Π° Π² ΡΠΈΠΌΠ²ΠΎΠ»ΠΈΡΠ΅ΡΠΊΠΎΠΉ ΡΠΎΡΠΌΠ΅. Π’Π°ΠΊΠΆΠ΅ Π² Π½Π°ΡΠ΅ΠΌ ΠΌΠ΅ΡΠ°Π³Π΅Π½Π΅ΡΠ°ΡΠΎΡΠ΅ Π²Π½Π΅Π΄ΡΠ΅Π½ ΠΈ ΡΠ°ΡΡΠΈΡΠ΅Π½ ΠΌΠ΅ΡΠΎΠ΄ ΡΠ΅ΠΌΠ°Π½ΡΠΈΡΠ΅ΡΠΊΠΎΠΉ ΡΠ°Π·ΠΌΠ΅ΡΠΊΠΈ ΡΡΠ»ΠΎΠ²ΠΈΠΉ ΠΊΠΎΡΡΠ΅ΠΊΡΠ½ΠΎΡΡΠΈ. ΠΠ½ ΠΏΠΎΠ·Π²ΠΎΠ»ΡΠ΅Ρ ΠΏΠΎΡΠΎΠΆΠ΄Π°ΡΡ ΠΏΠΎΡΡΠ½Π΅Π½ΠΈΡ Π΄Π»Ρ Π½Π΅Π΄ΠΎΠΊΠ°Π·Π°Π½Π½ΡΡ
ΡΡΠ»ΠΎΠ²ΠΈΠΉ ΠΈ ΡΠΏΡΠΎΡΠ°Π΅Ρ Π»ΠΎΠΊΠ°Π»ΠΈΠ·Π°ΡΠΈΡ ΠΎΡΠΈΠ±ΠΎΠΊ. ΠΠ°ΠΊΠΎΠ½Π΅Ρ, Π΅ΡΠ»ΠΈ ΡΠΈΡΡΠ΅ΠΌΠ° ACL2 Π½Π΅ ΡΠΏΡΠ°Π²Π»ΡΠ΅ΡΡΡ Ρ ΡΡΡΠ°Π½ΠΎΠ²Π»Π΅Π½ΠΈΠ΅ΠΌ ΠΈΡΡΠΈΠ½Π½ΠΎΡΡΠΈ ΡΡΠ»ΠΎΠ²ΠΈΡ, ΠΌΠΎΠΆΠ½ΠΎ ΡΠΎΡΡΠ΅Π΄ΠΎΡΠΎΡΠΈΡΡΡΡ Π½Π° Π΄ΠΎΠΊΠ°Π·Π°ΡΠ΅Π»ΡΡΡΠ²Π΅ Π΅Π³ΠΎ Π»ΠΎΠΆΠ½ΠΎΡΡΠΈ. Π Π°Π½Π΅Π΅ Π½Π°ΠΌΠΈ Π±ΡΠ» ΡΠ°Π·ΡΠ°Π±ΠΎΡΠ°Π½ ΡΠΏΠΎΡΠΎΠ± Π΄ΠΎΠΊΠ°Π·Π°ΡΠ΅Π»ΡΡΡΠ²Π° Π»ΠΎΠΆΠ½ΠΎΡΡΠΈ ΡΡΠ»ΠΎΠ²ΠΈΠΉ ΠΊΠΎΡΡΠ΅ΠΊΡΠ½ΠΎΡΡΠΈ Π΄Π»Ρ ΡΠΈΡΡΠ΅ΠΌΡ ACL2. ΠΠ΅ΠΎΠ±Ρ
ΠΎΠ΄ΠΈΠΌΠΎΡΡΡ Π² Π±ΠΎΠ»Π΅Π΅ ΠΏΠΎΠ΄ΡΠΎΠ±Π½ΡΡ
ΠΎΠ±ΡΡΡΠ½Π΅Π½ΠΈΡΡ
ΡΡΠ»ΠΎΠ²ΠΈΠΉ ΠΊΠΎΡΡΠ΅ΠΊΡΠ½ΠΎΡΡΠΈ, ΡΠΎΠ΄Π΅ΡΠΆΠ°ΡΠΈΡ
ΠΎΠΏΠ΅ΡΠ°ΡΠΈΡ Π·Π°ΠΌΠ΅Π½Ρ rep, ΠΏΡΠΈΠ²Π΅Π»Π° ΠΊ ΠΈΠ·ΠΌΠ΅Π½Π΅Π½ΠΈΡ Π°Π»Π³ΠΎΡΠΈΡΠΌΠΎΠ² Π³Π΅Π½Π΅ΡΠ°ΡΠΈΠΈ ΠΎΠΏΠ΅ΡΠ°ΡΠΈΠΈ Π·Π°ΠΌΠ΅Π½Ρ, ΠΈΠ·Π²Π»Π΅ΡΠ΅Π½ΠΈΡ ΡΠ΅ΠΌΠ°Π½ΡΠΈΡΠ΅ΡΠΊΠΈΡ
ΠΌΠ΅ΡΠΎΠΊ ΠΈ Π³Π΅Π½Π΅ΡΠ°ΡΠΈΠΈ ΠΎΠ±ΡΡΡΠ½Π΅Π½ΠΈΠΉ Π½Π΅Π΄ΠΎΠΊΠ°Π·Π°Π½Π½ΡΡ
ΡΡΠ»ΠΎΠ²ΠΈΠΉ ΠΊΠΎΡΡΠ΅ΠΊΡΠ½ΠΎΡΡΠΈ. Π ΡΡΠ°ΡΡΠ΅ ΠΏΡΠ΅Π΄ΡΡΠ°Π²Π»Π΅Π½Ρ ΠΌΠΎΠ΄ΠΈΡΠΈΠΊΠ°ΡΠΈΠΈ Π΄Π°Π½Π½ΡΡ
Π°Π»Π³ΠΎΡΠΈΡΠΌΠΎΠ². ΠΡΠΈ ΠΈΠ·ΠΌΠ΅Π½Π΅Π½ΠΈΡ ΠΏΠΎΠ·Π²ΠΎΠ»ΡΡΡ ΠΏΠΎΠΌΠ΅ΡΠΈΡΡ ΠΈΡΡ
ΠΎΠ΄Π½ΡΠΉ ΠΊΠΎΠ΄ ΡΡΠ½ΠΊΡΠΈΠΈ rep ΡΠ΅ΠΌΠ°Π½ΡΠΈΡΠ΅ΡΠΊΠΈΠΌΠΈ ΠΌΠ΅ΡΠΊΠ°ΠΌΠΈ, ΠΈΠ·Π²Π»Π΅ΠΊΠ°ΡΡ ΡΠ΅ΠΌΠ°Π½ΡΠΈΡΠ΅ΡΠΊΠΈΠ΅ ΠΌΠ΅ΡΠΊΠΈ ΠΈΠ· ΠΎΠΏΡΠ΅Π΄Π΅Π»Π΅Π½ΠΈΡ rep, Π° ΡΠ°ΠΊΠΆΠ΅ Π³Π΅Π½Π΅ΡΠΈΡΠΎΠ²Π°ΡΡ ΠΎΠΏΠΈΡΠ°Π½ΠΈΠ΅ ΡΡΠ»ΠΎΠ²ΠΈΡ ΠΈΡΠΏΠΎΠ»Π½Π΅Π½ΠΈΡ ΠΈΠ½ΡΡΡΡΠΊΡΠΈΠΈ break
Michael John Caldwell Gordon (FRS 1994), 28 February 1948 -- 22 August 2017
Michael Gordon was a pioneer in the field of interactive theorem proving and
hardware verification. In the 1970s, he had the vision of formally verifying
system designs, proving their correctness using mathematics and logic. He
demonstrated his ideas on real-world computer designs. His students extended
the work to such diverse areas as the verification of floating-point
algorithms, the verification of probabilistic algorithms and the verified
translation of source code to correct machine code. He was elected to the Royal
Society in 1994, and he continued to produce outstanding research until
retirement.
His achievements include his work at Edinburgh University helping to create
Edinburgh LCF, the first interactive theorem prover of its kind, and the ML
family of functional programming languages. He adopted higher-order logic as a
general formalism for verification, showing that it could specify hardware
designs from the gate level right up to the processor level. It turned out to
be an ideal formalism for many problems in computer science and mathematics.
His tools and techniques have exerted a huge influence across the field of
formal verification
Automating Event-B invariant proofs by rippling and proof patching
This work is supported by EPSRC grants EP/H024204/1, EP/E005713/1, EP/M018407/1 and EP/J001058/1.The use of formal method techniques can contribute to the production of more reliable and dependable systems. However, a common bottleneck for industrial adoption of such techniques is the needs for interactive proofs. We use a popular formal method, called Event-B, as our working domain, and set invariant preservation (INV) proofs as targets, because INV proofs can account for a significant proportion of the proofs requiring human interactions. We apply an inductive theorem proving technique, called rippling, for Event-B INV proofs. Rippling automates proofs using meta-level guidance. The guidance is in particular useful to develop proof patches to recover failed proof attempts. We are interested in the case when a missing lemma is required. We combine a scheme-based theory-exploration system, called IsaScheme [MRMDB10], with rippling to develop a proof patch via lemma discovery. We also develop two new proof patches to unfold operator definitions and to suggest case-splits, respectively. The combined use of rippling with these three proof patches as a proof method significantly improves the proof automation for our evaluation set.Publisher PDFPeer reviewe
- β¦