AbstractWe describe the Proverʼs Palette, a general, modular architecture for combining tools for formal verification, with the key differentiator that the integration emphasises the role of the user. A concrete implementation combining the theorem prover Isabelle with the computer algebra systems Maple and QEPCAD-B is then presented. This illustrates that the design principles of the Proverʼs Palette simplify tool integrations while enhancing the power and usability of theorem provers

Aspinall

Brown

Collins

Gast

Jacques D. Fleuriot

Laura I. Meikle

Meng

Paulson

Redfern

Tiwari

Meikle, Laura I.

Fleuriot, Jacques D.

Elsevier - Publisher Connector 

Integrating Systems around the User: Combining Isabelle, Maple, and QEPCAD in the Proverʼs Palette 

Crossref

Electronic Notes in Theoretical Computer Science

Integrating Systems around the User: Combining Isabelle, Maple, and QEPCAD in the Proverʼs Palette

Edinburgh Research Explorer

     Edinburgh Research Explorer                                      Integrating Systems around the User: Combining Isabelle, Maple,and QEPCAD in the Prover's PaletteCitation for published version:Meikle, LI & Fleuriot, JD 2012, 'Integrating Systems around the User: Combining Isabelle, Maple, andQEPCAD in the Prover's Palette' Electronic Notes in Theoretical Computer Science, vol 285, pp. 115-119.DOI: 10.1016/j.entcs.2012.06.010Digital Object Identifier (DOI):10.1016/j.entcs.2012.06.010Link:Link to publication record in Edinburgh Research ExplorerDocument Version:Peer reviewed versionPublished In:Electronic Notes in Theoretical Computer ScienceGeneral rightsCopyright for the publications made accessible via the Edinburgh Research Explorer is retained by the author(s)and / or other copyright owners and it is a condition of accessing these publications that users recognise andabide by the legal requirements associated with these rights.Take down policyThe University of Edinburgh has made every reasonable effort to ensure that Edinburgh Research Explorercontent complies with UK legislation. If you believe that the public display of this file breaches copyright pleasecontact openaccess@ed.ac.uk providing details, and we will remove access to the work immediately andinvestigate your claim.Download date: 28. Apr. 2017Integrating Systems around the User:Combining Isabelle, Maple, and QEPCADin the Prover’s PaletteLaura I. Meikle1 Jacques D. Fleuriot2CISA, School of InformaticsUniversity of EdinburghUKAbstractWe describe the Prover’s Palette, a general, modular architecture for combining tools for formal veriﬁcation,with the key diﬀerentiator that the integration emphasises the role of the user. A concrete implementationcombining the theorem prover Isabelle with the computer algebra systems Maple and QEPCAD-B is thenpresented. This illustrates that the design principles of the Prover’s Palette simplify tool integrations whileenhancing the power and usability of theorem provers.Keywords: theorem proving, computer algebra, UI, Isabelle, Eclipse, QEPCAD, Maple.1 Introducing the Prover’s PaletteInteractive theorem proving today permits the veriﬁcation of sophisticated theo-rems and complex algorithms, although the process remains cumbersome and time-consuming. We believe that in many instances, access to other tools such as Com-puter Algebra Systems (CAS) can accelerate this process. Whilst there have beensigniﬁcant advances in combining provers with external tools, as described in pre-vious work [6], the increased complexity of current proof developments places newdemands and challenges on tool integrations.We begin with the premise that an integration’s primary goal is to accelerate theproof development process. To date, this has been achieved primarily by integra-tions which can automatically simplify expressions and discharge subgoals [8][11].With more complicated veriﬁcation tasks—and with more mathematicians using1 Email: lauram@dai.ed.ac.uk2 Email: jdf@inf.ed.ac.ukAvailable online at www.sciencedirect.comElectronic Notes in Theoretical Computer Science 285 (2012) 115–1191571-0661/$ – see front matter © 2012 Published by Elsevier B.V.www.elsevier.com/locate/entcsdoi:10.1016/j.entcs.2012.06.010provers—we believe that the process of formal proof can also beneﬁt from tool inte-grations which are able to enhance a user’s understanding of a problem. To achievethis, it is important that integrations support multiple modes of interaction: theuser should be given the option to use external systems in a fully automated way,but they should also have the option to modify how that system is being used.A novice user can then beneﬁt from a variety of proof assistants, even if he isnot familiar with them, while the expert user is not hindered from accessing thefull richness of these tools. This can be essential for some problems, as even thebest fully automated integrations cannot always tune the parameters appropriately.Furthermore, by allowing visibility and modiﬁability to more aspects of the toolintegration, the user is given greater ﬂexibility in exploring the problem. We be-lieve that a semi-interactive integration framework now has a vital role to play: theframework should support automatically conﬁguring settings appropriate to a spe-ciﬁc problem but also emphasise usability in exploring and changing these values,all while maintaining consistency between systems.This philosophy has led us to develop the Prover’s Palette, a user-centric ap-proach to tool integrations. A concrete implementation that combines Isabelle andQEPCAD-B, assisting the user in reasoning about real nonlinear polynomials, hasalready been achieved [6]. In this paper, we apply our approach to a further sys-tems integration in order to show that the design principles apply more generallyand that our architecture can be easily extended to support more tools. In particu-lar, we present an integration of Maple [10] into the Prover’s Palette and show howits plotting capabilities can provide signiﬁcant insight into theorems being proven.Our framework is available for download at www.cognetics.org/proverspalette.2 System DesignThe key idea of our approach is to unify multiple tools through a cohesive userinterface (UI), allowing any relevant tool to be used at any point in the proofprocess. This is accomplished by constructing a UI “View” widget for each externaltool. These Views sit alongside the proof script in the IDE, and:• When the proof state changes, each View is notiﬁed by the framework and is up-dated appropriately, automatically acquiring a translation in its native languageand a choice of appropriate default settings.• Each View can be conﬁgured to run in “novice” mode, using sensibly-chosen de-fault settings and running with a single user-click (some can be further conﬁguredto run automatically, appearing only when they yield a result).• By exposing an optional sequence of “tabs”, each View also allows full inspectabil-ity and customisation of the translation and settings.• Each View presents the results of the external system’s computation in an inte-grated form, commonly a command in the prover’s language which can then beautomatically inserted into the proof script.L.I. Meikle, J.D. Fleuriot / Electronic Notes in Theoretical Computer Science 285 (2012) 115–119116We have implemented this design in Java, making each View a plug-in to theEclipse Proof General Kit [1], leveraging its broker structure, and targeting theIsabelle theorem prover [9]. The Prover’s Palette framework also uses libraries fromthe Feature Wizard [5] to support translation and the PG ProofScriptEditor APIfor post-processing insertion into the proof script 3 .The implementation supplies abstract superclasses which encapsulate commonfunctionality, including deﬁning the View and tabs, tracking and translating theproof state, modifying the proof state where necessary (e.g. expanding deﬁnitions,converting to PNF), and inserting results in various ways (via an oracle, by instanti-ation, etc). This minimises the additional code required to integrate a new tool withthe Prover’s Palette. We demonstrate this next by describing our implementationwhich adds Maple support to our system.3 Using Maple in the Prover’s PaletteFigure 1. Reasoning with the Prover’s Palette: Isabelle, QEPCAD and Maple in the IDEAs Maple is a powerful and popular CAS we selected it for integration intothe Prover’s Palette. We illustrate our approach—and this integration— througha real-world example making use of Maple’s plotting capabilities. Figure 1 shows ascreenshot of the prover IDE with the new Maple view.The proof script in Figure 1 revisits a collision problem described by Collinsand Hong [3]. This involves robot motion planning and queries whether a movingcircle (1) and a moving square (2) will ever collide, speciﬁcally asking whether∃ t x y. t ≥ 0 ∧ (1) ∧ (2):3 The Prover’s Palette currently inserts commands using Isabelle’s “tactic“ procedural mode, but supportfor the declarative “Isar” mode would be easy to add.L.I. Meikle, J.D. Fleuriot / Electronic Notes in Theoretical Computer Science 285 (2012) 115–119 117(1) (x− t)2 + y2 ≤ 1(2) −1 ≤ x − 1716 t ≤ 1 ∧ −9 ≤ y − 1716 t ≤ −7Relying solely on a theorem prover, this can be a diﬃcult proof, with the userhaving to contend with questions ranging from how the myriad lemmas should beapplied through to whether the objects are deﬁned correctly and whether the the-orem is provable. Maple can give reassurances with regard to the latter two. Withthe Prover’s Palette, the Maple View continually updates to reﬂect the currentproof goal state: the user can then, for example, choose to plot these equations(on the “Problem” tab of the Maple View, as shown in Figure 1). The integrationautomatically converts the problem—stripping away quantiﬁers, breaking up con-juncts, and converting inequalities—then determines which equations are suitablefor inclusion and which plot type and command is appropriate (e.g. ImplicitPlot,ImplicitPlot3D, animate) 4 .With the collision problem, the Maple integration defaults to a 2D animation.It has automatically determined the variables for each axis and deduced that ﬁveout of the six constituent equations should be plotted. In this plot conﬁguration,t = 0 does not make sense; however the user is free to change the variables-to-axesmappings, and if t and x are swapped — so that t is plotted along the x-axis andwe animate over time x — then the list of enabled equations is updated to includet = 0, although the plots may be unintuitive!Figure 2. Maple Animated PlotThe user can then select the “Finish”button to send the plot command to Maple.Alternatively the user can go to the “Pre-view” tab to inspect the script to be sent,making edits where desired: applying coloursor labels, or even adding additional equa-tions. This tab also allows cancelling the ex-ternal process at any time. Asking Maple toplot the collision problem results in a newwindow containing an interactive animationof the circle and square moving over time.Figure 2 shows a still of this animation wherethe circle and square are colliding, conﬁrmingthat the problem is provable.Following the visual insight aﬀorded by Maple, the user could also invoke QEP-CAD within the Prover’s Palette environment. Previously we showed how QEPCADcan be used to conﬁrm that the problem is “True” [6]. It can also generate witnesses(t=9617 , x=9617 and y = −1) which the integration can instantiate into the proof witha single click.4 Due to space limitations, the automatic conversion and conﬁguration to make problems suitable for usewith Maple is not covered here. The interested reader is referred to [7].L.I. Meikle, J.D. Fleuriot / Electronic Notes in Theoretical Computer Science 285 (2012) 115–1191184 ConclusionBy integrating Maple into the Prover’s Palette we have shown that the frameworkcan generalise to support other external tools. It would be interesting to furtherextend the system to support other theorem provers that can be made compatiblewith PG Kit; and with the advent of new Java-based prover IDEs such as I3P[4], we believe our system has promise for even wider integration. We have alsoshown that an interactive integration framework is capable of enhancing the user’sunderstanding of proof problems. This supports our hypothesis that the user ismost empowered when a palette of tightly integrated—yet customisable—tools isconveniently at their disposal. A successful integration framework enables a deeperunderstanding of proof obligations, freeing the user from the burden of tedious,mundane proof details, but without overly restricting what is possible.AcknowledgementWe would like to thank the reviewers for their useful comments. This work wasfunded by the EPSRC grant EP/E005713/1.References[1] Aspinall D., C. Lu¨th, and D. Winterstein, A Framework for Interactive Proof. Towards MechanizedMathematical Assistants, Springer LNAI 4573 (2007), 161-175.[2] Brown C. W., QEPCAD B: a program for computing with semi-algebraic sets using CADs, SIGSAMBulletin, 37 (2003), 97-108.[3] Collins G. E., and H. Hong, Partial Cylindrical Algebraic Decomposition for Quantiﬁer Elimination,Journal of Symbolic Computation 12 (1991), 299-328.[4] Gast H., I3P, www-pu.informatik.uni-tuebingen.de/i3p[5] Heneveld A., Using Features for Automated Problem Solving, PhD Thesis, University of Edinburgh,2007.[6] Meikle L. I., and J. D. Fleuriot, Combining Isabelle and QEPCAD-B in the Prover’s Palette,AISC/MKM/Calculemus (2008), 315-330.[7] Meikle L. I., The Formal Veriﬁcation of Geometric Algorithms, to appear as PhD Thesis, Universityof Edinburgh.[8] Meng J., C. Quigley, and L. C. Paulson, Automation for interactive proof: ﬁrst prototype, Inf. Comput.,204: 10 (2006), 1575-1596.[9] Paulson L. C., Isabelle: A Generic Theorem Prover, LNCS 828 (1994).[10] Redfern M., and D. Betounes, “Mathematical Computing: An Introduction to Programming UsingMaple”, Telos Press, 2002.[11] Tiwari A., PVS-QEPCAD, www.csl.sri.com/users/tiwari/qepcad.html.L.I. Meikle, J.D. Fleuriot / Electronic Notes in Theoretical Computer Science 285 (2012) 115–119 119

file:///data/remote/core/dit/data/elsevier/pdf/5a6/aHR0cDovL2FwaS5lbHNldmllci5jb20vY29udGVudC9hcnRpY2xlL3BpaS9zMTU3MTA2NjExMjAwMDMwOA==.pdf