51 research outputs found
Assertion-based proof checking of Chang-Roberts leader election in PVS
We report a case study in automated incremental assertion-based proof checking with PVS. Given an annotated distributed algorithm, our tool ProPar generates the proof obligations for partial correctness, plus a proof script per obligation. ProPar then lets PVS attempt to discharge all obligations by running the proof scripts. The Chang-Roberts algorithm elects a leader on a unidirectional ring with unique identities. With ProPar, we check its correctness with a very high degree of automation: over 90% of the proof obligations is discharged automatically. This case study underlines the feasibility of the approach and is, to the best of our knowledge, the first verification of the Chang-Roberts algorithm for arbitrary ring size in a proof checker
Verifiable certificates for predicate subtyping
Adding predicate subtyping to higher-order logic yields a very expressive language in which type-checking is undecidable, making the definition of a system of verifiable certificates challenging. This work presents a solution to this issue with a minimal formalization of predicate subtyping, named PVS-Core, together with a system of verifiable certificates for PVS-Core, named PVS-Cert. PVS-Cert is based on the introduction of proof terms and explicit coercions. Its design is similar to that of PTSs with dependent pairs, at the exception of the definition of conversion, which is based on a specific notion of reduction → β * , corresponding to β-reduction combined with the erasure of coercions. The use of this reduction instead of the more standard reduction → βσ allows to establish a simple correspondence between PVS-Core and PVS-Cert. On the other hand, a type-checking algorithm is designed for PVS-Cert, built on proofs of type preservation of → βσ and strong normalization of both → βσ and → β *. Using these results, PVS-Cert judgements are used as verifiable certificates for predicate subtyping. In addition, the reduction → βσ is used to define a cut elimination procedure adapted to predicate subtyping. Its use to study the properties of predicate subtyp-ing is illustrated with a proof of consistency
New results on rewrite-based satisfiability procedures
Program analysis and verification require decision procedures to reason on
theories of data structures. Many problems can be reduced to the satisfiability
of sets of ground literals in theory T. If a sound and complete inference
system for first-order logic is guaranteed to terminate on T-satisfiability
problems, any theorem-proving strategy with that system and a fair search plan
is a T-satisfiability procedure. We prove termination of a rewrite-based
first-order engine on the theories of records, integer offsets, integer offsets
modulo and lists. We give a modularity theorem stating sufficient conditions
for termination on a combinations of theories, given termination on each. The
above theories, as well as others, satisfy these conditions. We introduce
several sets of benchmarks on these theories and their combinations, including
both parametric synthetic benchmarks to test scalability, and real-world
problems to test performances on huge sets of literals. We compare the
rewrite-based theorem prover E with the validity checkers CVC and CVC Lite.
Contrary to the folklore that a general-purpose prover cannot compete with
reasoners with built-in theories, the experiments are overall favorable to the
theorem prover, showing that not only the rewriting approach is elegant and
conceptually simple, but has important practical implications.Comment: To appear in the ACM Transactions on Computational Logic, 49 page
Removing Algebraic Data Types from Constrained Horn Clauses Using Difference Predicates
We address the problem of proving the satisfiability of Constrained Horn
Clauses (CHCs) with Algebraic Data Types (ADTs), such as lists and trees. We
propose a new technique for transforming CHCs with ADTs into CHCs where
predicates are defined over basic types, such as integers and booleans, only.
Thus, our technique avoids the explicit use of inductive proof rules during
satisfiability proofs. The main extension over previous techniques for ADT
removal is a new transformation rule, called differential replacement, which
allows us to introduce auxiliary predicates corresponding to the lemmas that
are often needed when making inductive proofs. We present an algorithm that
uses the new rule, together with the traditional folding/unfolding
transformation rules, for the automatic removal of ADTs. We prove that if the
set of the transformed clauses is satisfiable, then so is the set of the
original clauses. By an experimental evaluation, we show that the use of the
differential replacement rule significantly improves the effectiveness of ADT
removal, and we show that our transformation-based approach is competitive with
respect to a well-established technique that extends the CVC4 solver with
induction.Comment: 10th International Joint Conference on Automated Reasoning (IJCAR
2020) - version with appendix; added DOI of the final authenticated Springer
publication; minor correction
A Monad for Basic Java Semantics
This paper describes the role of a computational monad in the denotational semantics of sequential Java and investigates some of its properties. This denotational semantics is an abstraction of the one used for the verication of (sequential) Java programs using proof tools, see [11,15]
Von Tauchern eingesetzte versus ferngesteuerte Kammern bei Unterwasser-Tracerexperimenten
PVS: An Experience Report
PVS is a comprehensive interactive tool for specification and verification combining an expressive specification language with an integrated suite of tools for theorem proving and model checking. PVS has many academic and industrial users and has been applied to a wide range of verification tasks. In this note, we summarize some of its applications
- …