Subtypes for Specications John Rushby Science Laboratory Computer International SRI Menlo Park, CA J. Rushby FSE97: Subtypes for Specications 1
|
|
- Priscilla Reed
- 6 years ago
- Views:
Transcription
1 of Software Engineering/European Software Foundations Conference, Zurich, Sep 97 Engineering
2 Subtypes for Specications John Rushby Science Laboratory Computer International SRI Menlo Park, CA J. Rushby FSE97: Subtypes for Specications 1
3 Formal methods contribute useful mental frameworks, and systematic methods to the design, notations, But the primary benet from specically formal methods is they allow certain questions about a design to be that These symbolic calculations can be used for debugging and exploration as well as post-hoc verication design Comparable to the way computational uid dynamics is used the design of airplanes and jet engines in Formal Methods and Calculation documentation, and analysis of computer systems by symbolic calculation answered formal deduction, model checking) (e.g., J. Rushby FSE97: Subtypes for Specications 2
4 Tools are not the most important thing about formal methods Specication languages should be designed so that they ecient calculation (i.e., deduction) support Specication languages can also be designed to exploit the calculations provided by tools ecient Corollaries They are the only important thing Just like any other engineering calculations, it's tools that make formal calculations feasible and useful in practice E.g., based on higher-order logic, not set theory The topic of another talk... E.g., to better detect errors in specications The topic of this talk J. Rushby FSE97: Subtypes for Specications 3
5 Must be examined by proving challenge theorems, and inspection \execution," Can avoid inconsistencies using denitional styles of that guarantee \conservative extension" specication But these are often restrictive or inappropriate constructive) (too So a worthwhile goal is to increase the expressiveness and of the part of the specication language for convenience Errors in Formal Specications Most formal specications are full of errors A specication may fail to say what is intended A specication may fail to say anything at all Because it is inconsistent which we can guarantee conservative extension J. Rushby FSE97: Subtypes for Specications 4
6 Type systems for programming languages guarantee that errors will not occur during execution certain We should expect the type system for a specication also to guarantee absence of certain kinds of errors language Type systems for programming languages are traditionally to those for which type correctness is trivially restricted But specication languages should be used in environments powerful theorem proving is available, so suppose where Deduction Exploiting Increase the Power of Typechecking To E.g., inconsistency decidable typechecking could use theorem proving... J. Rushby FSE97: Subtypes for Specications 5
7 Subtypes can allow more concise and more precise specications But how do we characterize those integers that are also naturals? But this is not tightly bound to the subtype: reduces the for automation, and may allow inconsistencies opportunity Subtypes When types are interpreted as sets of values There is a natural association of subtype with subset E.g., natural is a subtype of integer Could add an axiom AXIOM 8(n: nat): n 0 nat_ax: J. Rushby FSE97: Subtypes for Specications 6
8 Are those where a characterizing predicate is tightly bound subtype denitions to Predicate Subtypes For example (in the notation of PVS) nat: TYPE = f i: int i 0 g Then we can write nat_prop: LEMMA 8(i, j: nat): i+j i ^ i+j j the prover can easily establish this result because the And information is recorded with the type for i and j necessary This is concise and ecient Now let's see where error detection comes in J. Rushby FSE97: Subtypes for Specications 7
9 Generate a proof obligation called a type correctness (TCC) to do this condition Specications are not considered typechecked until their have been discharged TCCs Nonemptiness Proof Obligations for Predicate Subtypes Subtypes may be empty, so a constant declaration c: nat introduce an inconsistency unless we ensure that its Would is nonempty type c_tcc1: OBLIGATION 9(x: nat): TRUE J. Rushby FSE97: Subtypes for Specications 8
10 Predicates are functions of return type bool, written as bool = i 0 nat?(i:int): Some PVS Notation The examples use the notation of PVS A verication system freely available from SRI Specication language is a simply-typed higher-order logic Augmented with dependent types and predicate subtypes Sets and predicates are equivalent in higher-order logic Regarded as a predicate, membership is written nat?(x) Regarded as a set, it is written x 2 nat? A predicate in parentheses denotes the corresponding subtype (nat?) is the same type as nat given earlier PVS has theory-level parameterization setof[nat] is the type of sets of natural numbers J. Rushby FSE97: Subtypes for Specications 9
11 We can specify the minimum a set axiomatically as a value two properties satisfying ^ 8(n: nat): n 2 s min(s) n An Example: The Minimum of a Set of Naturals It is a member of the given set It is no greater than any other member In PVS, this is min(s: setof[nat]): nat simple_ax: AXIOM 8(s:setof[nat]): min(s) 2 s Unfortunately, this specication is inconsistent J. Rushby FSE97: Subtypes for Specications 10
12 The problem is that the argument s to min could be an set empty But the rst conjunct to simple ax asserts that min(s) is a of this set member The Inconsistency J. Rushby FSE97: Subtypes for Specications 11
13 Using predicate subtypes, it is natural to factor the rst into the return type for min conjunct In higher-order logic, functions are just constants of \higher" so PVS forces us to prove that the corresponding type type, not empty is OBLIGATION 9(x: [s: setof[nat]! (s)]): TRUE min_tcc1: Detecting the Error With Predicate Subtypes min(s: setof[nat]): (s) (Observe that this is a dependent type) A (total) function type is nonempty if either Its range type is nonempty, or Both its domain and range types are empty Here, domain type is nonempty, but the range type may be So the TCC is false, and the inconsistency is revealed J. Rushby FSE97: Subtypes for Specications 12
14 the TCC becomes And OBLIGATION 9(x: [s: (nonempty?[nat])! (s)]): TRUE min_tcc: The second conjunct of the dening axiom can also be into the type factored Fixing the Specication Must either weaken properties of the value returned by min Or restrict its argument to be a nonempty set The predicate that tests for nonemptiness is nonempty?[nat] So the revised signature is (nonempty?[nat])): (s) min(s: Which is true and provable min(s: (nonempty?[nat])): f x: (s) 8(n: (s)): x n g J. Rushby FSE97: Subtypes for Specications 13
15 It might then seem natural to dene a max function dually (nonempty?[nat])): f x: (s) 8(n: (s)): x n g max(s: This generates the following TCC OBLIGATION max_tcc1:! fx: (s) 8(n: (s)): x ng ]): TRUE To which we can apply the following PVS proof commands + "(s:(nonempty?[nat])): (inst The PVS prover command grind does simplication using procedures and rewriting decision Extending the Example: from Minimum to Maximum 9(x1: [s: (nonempty?[nat]) choose( fx: (s) 8(n: (s)): x ng )") (grind :if-match nil) (rewrite "forall_not") J. Rushby FSE97: Subtypes for Specications 14
16 These proof steps produce the following goal x!1 0 [-1] Not true! We are alerted to the inconsistency in our specication By moving what was formerly specied by an axiom into the of the range type, we are using PVS's predicate specication Another Error is Revealed by Predicate Subtypes [-2] s!1(x!1) f1g 9(x: (s!1)): 8(n: (s!1)): x n is asking us to prove that any nonempty set of natural Which has a largest member numbers to mechanize generation of proof-obligations for subtyping axiom satisfaction problem the J. Rushby FSE97: Subtypes for Specications 15
17 Which is true, and can be proved by appealing to the of the naturals well-foundedness (9(y:(p)): (8(x:(p)): (NOT x < y)))) Why Doesn't Minimum Have the Same Problem? The corresponding proof goal for min is [-1] x!1 0 [-2] s!1(x!1) f1g 9(x: (s!1)): 8(n: (s!1)): x n well_founded?(<): bool = (8p: (9y: p(y)) wf_nat: AXIOM well_founded?( (i, j: nat): i < j) This is stated in the built-in \prelude" library of PVS J. Rushby FSE97: Subtypes for Specications 16
18 Now we see the importance of well-foundedness, can write a specication for min over any well-founded order generic Notice that the constraint on < is stated as a predicate will be required to prove that any actual subtype we The following nonemptiness TCC is generated OBLIGATION min_tcc1:! fx: (s) 8(i: (s)): x < i _ x = ig]): TRUE A Generic Specication for Minimum minspec[t: TYPE, <: (well_founded?[t])]: THEORY BEGIN min((s: (nonempty?[t]))): f x: (s) 8(i: (s)): x < i _ x = i g END minspec parameter satises the conditions for well-foundedness 9(x1: [s: (nonempty?[t]) J. Rushby FSE97: Subtypes for Specications 17
19 We can discharge the TCC by exhibiting the \choice choose function" Although this discharges the main goal, choose requires its to be nonempty (we'll see why later) so we get a argument f1g 8(s: (nonempty?[t])): Discharging the TCC from the Generic Specication (INST + "(s:(nonempty?[t])): choose(fx: (s) 8(i: (s)): x<i _ x=ig)") subsidiary TCC proof obligation from the instantiation min_tcc1 (TCC): nonempty?[(s)](fx: (s) 8(i: (s)): x < i _ x = ig) J. Rushby FSE97: Subtypes for Specications 18
20 The subsidiary goal looks as though it should follow by so we introduce this fact as follows well-foundedness, And obtain the following proof goal s!1(x!1) [-1] y!1 = i!1 f3g is not true in general! Which And Another Error is Revealed by Predicate Subtyping (typepred "<") (grind :if-match nil) i!1 < y!1 f1g y!1 < i!1 f2g We realize that well-foundedness is not enough Need trichotomy as well Must revise specication to require that < is a well-ordering J. Rushby FSE97: Subtypes for Specications 19
21 epsilon(p) returns a value satisfying p if there are any, some value of type T otherwise Automating Proofs With Predicate Subtypes We have already seen choice functions a couple of times The standard one is Hilbert's " function epsilons [T: NONEMPTY_TYPE]: THEORY BEGIN p: VAR setof[t] epsilon(p): T epsilon_ax: AXIOM (9x: x 2 p) epsilon(p) 2 p END epsilons Notice the type T is required to be nonempty J. Rushby FSE97: Subtypes for Specications 20
22 If p is constrained to be nonempty, can give the following specialization epsilon alt is similar to the built-in choose, but if we use it in proof of min TCC1, we get an additional subgoal the f1g 8(s: (nonempty?[t])): 8(i: (s)): _ epsilon_alt[(s)](fx: (s) 8(i: (s)): x<i _ x=ig) = i Another Choice Function choice [T: TYPE]: THEORY p: VAR (nonempty?[t]) epsilon_alt(p): T epsilon_alt_ax: AXIOM epsilon_alt(p) 2 p END choice epsilon_alt[(s)](fx: (s) 8(i: (s)): x<i _ x=ig) < i J. Rushby FSE97: Subtypes for Specications 21
23 The extra subgoal is asking us to prove that the value of alt satises the predicate supplied as its argument epsilon It did so because its specication is VAR (nonempty?[t]) p: Which records in its type the fact that choose(p) satises p It is quite hard for a prover to locate and instantiate stated in general axioms (unless they have special properties Making Information Available in the Types Follows from epsilon alt ax but has quite complicated proof How did choose avoid this? choose(p): (p) such as rewrite rules), but predicate subtypes bind forms to types, so the prover can locate them easily properties J. Rushby FSE97: Subtypes for Specications 22
24 Suppose we introduce a new subtype for even integers TYPE = fi:int 9(j:int): i=2jg even: And a function half with signature [ even! int ] half: And then pose the conjecture LEMMA 8(i: int): half(i+i+2) = i+1 even_prop: The argument i+i+2 to half has type int, but is required to even be However, int is a supertype of even, so we can generate a to check that the value satises the predicate for even TCC PVS provides \type judgments" that allow closure properties the sum of two evens is even) to be stated and proved (e.g., Another Proof Obligation for Predicate Subtypes even_prop_tcc1: OBLIGATION 8(i:int): 9(j: int): i+i+2 = 2j once and for all J. Rushby FSE97: Subtypes for Specications 23
25 Given a name, the phone book should return the set of numbers associated with that name phone There should also be functions for adding, changing, and phone numbers deleting Here is the beginning of a suitable specication phone_numbers: TYPE names, Enforcing Invariants with Predicate Subtypes Consider a specication for a city phone book phone_book: TYPE = [names! setof[phone_numbers]] B: VAR phone_book n: VAR names p: VAR phone_numbers add_number(b, n, p): phone_book = B WITH [(n) := B(n)[fpg]... J. Rushby FSE97: Subtypes for Specications 24
26 Suppose that dierent names are required to have disjoint of phone numbers sets Introduce unused number predicate and modify add number as follows And how do we know the the modied add number function it? preserves Adding an Invariant unused_number(b, p): bool = 8(n: names): NOT p 2 B(n) add_number(b, n, p): phone_book = IF unused_number(b, p) THEN B WITH [(n) := B(n)[fpg] ELSE B ENDIF But where is the disjointness property stated explicitly? J. Rushby FSE97: Subtypes for Specications 25
27 Simply change the type for phone book as follows TYPE = phone_book: f B: [ names! setof[phone_numbers]] Furthermore, typechecking add number generates the TCC following 8(r, m: names): r 6= m Making the Invariant Explicit with a Predicate Subtype 8(n, m: names): n 6= m disjoint?(b(n), B(m)) g This makes the invariant explicit add_number_tcc1: OBLIGATION 8(B, n, p): unused_number(b, p) disjoint?(b WITH [(n) := B(n)[fpg](r), B WITH [(n) := B(n)[fpg](m)) Which requires us to prove that it really is invariant J. Rushby FSE97: Subtypes for Specications 26
28 For example, division can be typed as follows real: TYPE = f r: real r 6= 0 g nonzero Then typechecking prop: LEMMA 8 (x, y: real): div Generates the following proof obligation OBLIGATION 8 (x, y: real): div_prop_tcc1: Notice that the context of the subtype occurrence (under a reading) appears in the TCC left-to-right Predicate Subtypes and Partial Functions partial functions become total when their domains are Many more precisely specied /: [real, nonzero real! real] x 6= y (x - y)/(y - x) = -1 x 6= y (y - x) 6= 0 Discharged automatically by the PVS decision procedures J. Rushby FSE97: Subtypes for Specications 27
29 This function is undened if j > i The subp \Challenge" Consider the function subp on the integers dened by subp(i; j) = if i = j then 0 else subp(i; j + 1) + 1 endif When j i; subp(i; j) = i? j Often cited as demonstrating the need for partial functions But is easily handled using dependent predicate subtypes (j:int j i)): RECURSIVE int = subp((i:int), IF i = j THEN 0 ELSE subp(i, j+1) + 1 ENDIF MEASURE i-j subp_val: LEMMA 8 (i,j: int): ji subp(i,j) = i-j J. Rushby FSE97: Subtypes for Specications 28
30 The subp \Challenge" (continued) Specication generates the following TCCs % Subtype TCC generated (line 6) for i - j subp_tcc1: OBLIGATION 8(i: int), (j: int j i): i-j 0 % Subtype TCC generated (line 5) for j + 1 subp_tcc2: OBLIGATION 8(i: int), (j: int j i): NOT i = j j+1 i % Termination TCC generated (line 5) for subp subp_tcc3: OBLIGATION 8(i: int), (j: int j i): NOT i = j i - (j+1) < i-j All three proved automatically by PVS decision procedures J. Rushby FSE97: Subtypes for Specications 29
31 It often contributes clarity and precision to a specication if are identied as injections, surjections, etc. functions But how to ensure a purported surjection really has the property? Predicate subtypes! The surjections are a subtype of the associated with the following predicate functions So that alt: (surjective?[even, int]) = (e: even): e/2 half Generates the following proof obligation OBLIGATION half_alt_tcc2: Higher-Order Predicate Subtypes function props[dom, rng: TYPE]: THEORY surjective?(f): bool = 8 (r: rng): 9 (d: dom): f(d) = r surjective?[even, int](lambda (e: even): e / 2) J. Rushby FSE97: Subtypes for Specications 30
32 Higher-Order Predicate Subtypes (continued) The proof command (grind :if-match nil) reduces this to half_alt_tcc2 : f-1g integer_pred(y!1) f1g (9(x: even): x / 2 = y!1) Which is easily discharged J. Rushby FSE97: Subtypes for Specications 31
33 The datatype invariants of VDM have some similarity to subtypes (e.g., proof obligations in typechecking) predicate But are part of VDM's mechanisms for specifying operations terms of pre- and post-conditions on a state, rather than in And Z/Eves does \domain checking" for Z (and has found thereby in every specication checked) aws Predicate subtypes are fully supported as part of a logic only by Nuprl and PVS (as far as I know) specication PVS separates the algorithmic elements from those that TCCs require Languages with Predicate Subtypes part of the type system for its logic ACL2 has predicate \guards" on appl'ns of partial functions In Nuprl, all typechecking requires theorem proving J. Rushby FSE97: Subtypes for Specications 32
34 Some treatments of programming languages use \structural" to account for Object-Oriented features subtypes Intuition is dierent to \subtypes as subsets": value of allowed anywhere one of the parent type is subtype Thus adding elds to a record creates a subtype: function operates on \points" should also operate on \colored that Extension to function types leads to normal or covariant on range types subtyping Other Approaches to Subtyping points" [ nat! nat] is a subtype of [ nat! int] But contravariant subtyping on domain types [ int! nat] is a subtype of [ nat! nat] J. Rushby FSE97: Subtypes for Specications 33
35 Interesting research challenge to combine structural with subtyping (contravariance complicates equality) predicate PVS does extend subtyping covariantly over range types of functions However, PVS also provides type \conversions" that can restrict, or (less automatically) expand the automatically E.g., allow setof[int] to be provided where setof[nat] is (and vice-versa) expected Combinations And over the positive parameters to abstract data types E.g., list[nat] is a subtype of list of list[int] But requires equality on domain types domain of a function J. Rushby FSE97: Subtypes for Specications 34
36 Via earlier Ehdm system, where Friedrich von Henke them from ANNA adopted I nd them the most useful innovation I have seen in language design specication But not everybody agrees: Lamport and Paulson make a for untyped specication languages (when used by hand) case Conclusion Predicate subtypes in PVS due to Sam Owre and N. Shankar Formal semantics available on the PVS web site Many users exploit them very eectively I hope to have persuaded you of their value, too J. Rushby FSE97: Subtypes for Specications 35
37 Browse general papers and technical reports at Detailed Information about PVS is available from gets you to a of tutorials and their supporting specication directory To Learn More About PVS tse95.html is a good overview of PVS pvs-bib.html links to a bibliography with over 140 entries les You can get PVS from ftp://ftp.csl.sri.com/pub/pvs Allegro Lisp for SunOS, Solaris, IBM AIX, or Linux Need 64M memory, 100M swap space, Sparc 20 or better (Best is 64MB 200 MHz P6, costs under $3,000 in USA) J. Rushby FSE97: Subtypes for Specications 36
has developed a specication of portions of the IEEE 854 oating-point standard in PVS [7]. In PVS, the injective function space injection can be dened
PVS: Combining Specication, Proof Checking, and Model Checking? To appear in CAV'96 S. Owre, S. Rajan, J. M. Rushby, N. Shankar, and M. Srivas Computer Science Laboratory, SRI International, Menlo Park
More informationfor his support. Development of PVS was funded entirely by SRI International.
Acknowledgements. Friedrich von Henke (SRI, currently at U. of Ulm, Germany), David Cyrluk (Stanford), Judy Crow (SRI), Steven Phillips (Stanford), Carl Witty (currently at MIT), contributed to the design,
More informationRecursion and Induction
Recursion and Induction Paul S. Miner NASA Langley Formal Methods Group p.s.miner@nasa.gov 28 November 2007 Outline Recursive definitions in PVS Simple inductive proofs Automated proofs by induction More
More informationS. Owre, J. M. Rushby, N. Shankar and M. K. Srivas. fowre, rushby, shankar,
A Tutorial on Using PVS for Hardware Verication? S. Owre, J. M. Rushby, N. Shankar and M. K. Srivas fowre, rushby, shankar, srivasg@csl.sri.com Computer Science Laboratory, SRI International, Menlo Park
More informationProgram Design in PVS. Eindhoven University of Technology. Abstract. Hoare triples (precondition, program, postcondition) have
Program Design in PVS Jozef Hooman Dept. of Computing Science Eindhoven University of Technology P.O. Box 513, 5600 MB Eindhoven, The Netherlands e-mail: wsinjh@win.tue.nl Abstract. Hoare triples (precondition,
More informationRandom Testing in PVS
Random Testing in PVS Sam Owre SRI International, Computer Science Laboratory 333 Ravenswood Avenue, Menlo Park, CA 94025, USA owre@csl.sri.com Abstract. Formulas are difficult to formulate and to prove,
More informationThe Prototype Verification System PVS
The Prototype Verification System PVS Wolfgang Schreiner Wolfgang.Schreiner@risc.uni-linz.ac.at Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.uni-linz.ac.at
More informationTheorem proving. PVS theorem prover. Hoare style verification PVS. More on embeddings. What if. Abhik Roychoudhury CS 6214
Theorem proving PVS theorem prover Abhik Roychoudhury National University of Singapore Both specification and implementation can be formalized in a suitable logic. Proof rules for proving statements in
More informationCSCI.6962/4962 Software Verification Fundamental Proof Methods in Computer Science (Arkoudas and Musser) Sections p.
CSCI.6962/4962 Software Verification Fundamental Proof Methods in Computer Science (Arkoudas and Musser) Sections 10.1-10.3 p. 1/106 CSCI.6962/4962 Software Verification Fundamental Proof Methods in Computer
More informationLee Pike. June 3, 2005
Proof NASA Langley Formal Methods Group lee.s.pike@nasa.gov June 3, 2005 Proof Proof Quantification Quantified formulas are declared by quantifying free variables in the formula. For example, lem1: LEMMA
More informationsuch internal data dependencies can be formally specied. A possible approach to specify
Chapter 6 Specication and generation of valid data unit instantiations In this chapter, we discuss the problem of generating valid data unit instantiations. As valid data unit instantiations must adhere
More informationType Systems. Pierce Ch. 3, 8, 11, 15 CSE
Type Systems Pierce Ch. 3, 8, 11, 15 CSE 6341 1 A Simple Language ::= true false if then else 0 succ pred iszero Simple untyped expressions Natural numbers encoded as succ succ
More informationAXIOMS FOR THE INTEGERS
AXIOMS FOR THE INTEGERS BRIAN OSSERMAN We describe the set of axioms for the integers which we will use in the class. The axioms are almost the same as what is presented in Appendix A of the textbook,
More informationSpecification, Verification, and Interactive Proof
Specification, Verification, and Interactive Proof SRI International May 23, 2016 PVS PVS - Prototype Verification System PVS is a verification system combining language expressiveness with automated tools.
More informationCMSC 330: Organization of Programming Languages
CMSC 330: Organization of Programming Languages Operational Semantics CMSC 330 Summer 2018 1 Formal Semantics of a Prog. Lang. Mathematical description of the meaning of programs written in that language
More informationProgramming Languages Lecture 14: Sum, Product, Recursive Types
CSE 230: Winter 200 Principles of Programming Languages Lecture 4: Sum, Product, Recursive Types The end is nigh HW 3 No HW 4 (= Final) Project (Meeting + Talk) Ranjit Jhala UC San Diego Recap Goal: Relate
More informationThis is already grossly inconvenient in present formalisms. Why do we want to make this convenient? GENERAL GOALS
1 THE FORMALIZATION OF MATHEMATICS by Harvey M. Friedman Ohio State University Department of Mathematics friedman@math.ohio-state.edu www.math.ohio-state.edu/~friedman/ May 21, 1997 Can mathematics be
More informationThe ight schedule database shall store the scheduling associated with all departing and arriving information In particular the database shall contain:
W. Butler Ricky Langley Research Center NASA, Flight Schedule Database Example by May 19, 1995 1 The ight schedule database shall store the scheduling associated with all departing and arriving information
More informationMACHINE golfclub (maxmembers, maxhandicap) CONSTRAINTS maxmembers : NAT & maxhandicap : NAT SETS PERSON members, handicaps INVARIANT members <: PERSON
Supporting the B-method in PVS: An Approach to the Abstract Machine Notation in Type Theory Cesar Mu~noz Computer Science Laboratory SRI International 333 Ravenswood Avenue Menlo Park, CA 94025, USA Email:
More informationInduction Schemes. Math Foundations of Computer Science
Induction Schemes Math Foundations of Computer Science Topics Induction Example Induction scheme over the naturals Termination Reduction to equational reasoning ACL2 proof General Induction Schemes Induction
More informationProvably Correct Software
Provably Correct Software Max Schäfer Institute of Information Science/Academia Sinica September 17, 2007 1 / 48 The Need for Provably Correct Software BUT bugs are annoying, embarrassing, and cost gazillions
More informationthe application rule M : x:a: B N : A M N : (x:a: B) N and the reduction rule (x: A: B) N! Bfx := Ng. Their algorithm is not fully satisfactory in the
The Semi-Full Closure of Pure Type Systems? Gilles Barthe Institutionen for Datavetenskap, Chalmers Tekniska Hogskola, Goteborg, Sweden Departamento de Informatica, Universidade do Minho, Braga, Portugal
More informationNASA Technical Memorandum A Bitvectors Library For PVS. Ricky W. Butler. Paul S. Miner. Langley Research Center, Hampton, Virginia
NASA Technical Memorandum 110274 A Bitvectors Library For PVS Ricky W. Butler Paul S. Miner Langley Research Center, Hampton, Virginia Mandayam K. Srivas SRI International, Menlo Park, California Dave
More informationCMSC 330: Organization of Programming Languages. Formal Semantics of a Prog. Lang. Specifying Syntax, Semantics
Recall Architecture of Compilers, Interpreters CMSC 330: Organization of Programming Languages Source Scanner Parser Static Analyzer Operational Semantics Intermediate Representation Front End Back End
More informationComputing Fundamentals 2 Introduction to CafeOBJ
Computing Fundamentals 2 Introduction to CafeOBJ Lecturer: Patrick Browne Lecture Room: K408 Lab Room: A308 Based on work by: Nakamura Masaki, João Pascoal Faria, Prof. Heinrich Hußmann. See notes on slides
More informationFirst Order Logic in Practice 1 First Order Logic in Practice John Harrison University of Cambridge Background: int
First Order Logic in Practice 1 First Order Logic in Practice John Harrison University of Cambridge http://www.cl.cam.ac.uk/users/jrh/ Background: interaction and automation Why do we need rst order automation?
More information9.5 Equivalence Relations
9.5 Equivalence Relations You know from your early study of fractions that each fraction has many equivalent forms. For example, 2, 2 4, 3 6, 2, 3 6, 5 30,... are all different ways to represent the same
More informationTradeoffs. CSE 505: Programming Languages. Lecture 15 Subtyping. Where shall we add useful completeness? Where shall we add completeness?
Tradeoffs CSE 505: Programming Languages Lecture 15 Subtyping Zach Tatlock Autumn 2017 Desirable type system properties (desiderata): soundness - exclude all programs that get stuck completeness - include
More informationTypes. Type checking. Why Do We Need Type Systems? Types and Operations. What is a type? Consensus
Types Type checking What is a type? The notion varies from language to language Consensus A set of values A set of operations on those values Classes are one instantiation of the modern notion of type
More informationPVS System Guide Version 2.4 December 2001
PVS System Guide Version 2.4 December 2001 S. Owre N. Shankar J. M. Rushby D. W. J. Stringer-Calvert {Owre,Shankar,Rushby,Dave_SC}@csl.sri.com http://pvs.csl.sri.com/ SRI International Computer Science
More informationMutable References. Chapter 1
Chapter 1 Mutable References In the (typed or untyped) λ-calculus, or in pure functional languages, a variable is immutable in that once bound to a value as the result of a substitution, its contents never
More informationCS558 Programming Languages
CS558 Programming Languages Winter 2017 Lecture 7b Andrew Tolmach Portland State University 1994-2017 Values and Types We divide the universe of values according to types A type is a set of values and
More informationZ Notation. June 21, 2018
Z Notation June 21, 2018 1 Definitions There are many different ways to introduce an object in a Z specification: declarations, abbreviations, axiomatic definitions, and free types. Keep in mind that the
More informationChapter 1. Introduction
1 Chapter 1 Introduction An exciting development of the 21st century is that the 20th-century vision of mechanized program verification is finally becoming practical, thanks to 30 years of advances in
More informationA Tutorial Introduction to PVS. Presented at WIFT '95: Workshop on Industrial-Strength Formal. Specication Techniques, Boca Raton, Florida, April 1995
A Tutorial Introduction to PVS Presented at WIFT '95: Workshop on Industrial-Strength Formal Specication Techniques, Boca Raton, Florida, April 1995 Judy Crow, Sam Owre, John Rushby, Natarajan Shankar,
More informationNatural Numbers. We will use natural numbers to illustrate several ideas that will apply to Haskell data types in general.
Natural Numbers We will use natural numbers to illustrate several ideas that will apply to Haskell data types in general. For the moment we will ignore that fact that each type in Haskell includes possible
More informationDependent Object Types - A foundation for Scala's type system
Dependent Object Types - A foundation for Scala's type system Draft of January 14, 2010 Do Not Distrubute Martin Odersky, Georey Alan Washburn EPFL Abstract. 1 Introduction This paper presents a proposal
More informationThe initial development of PVS was funded by SRI International. Subsequent enhancements were partially funded by SRI and by NASA Contracts NAS
PVS Prover Guide Version 2.3 ffl September 1999 N. Shankar S. Owre J. M. Rushby D. W. J. Stringer-Calvert Owre,Shankar,Rushby,Dave_SC}@csl.sri.com http://pvs.csl.sri.com/ SRI International Computer Science
More informationAlgebraic Properties of CSP Model Operators? Y.C. Law and J.H.M. Lee. The Chinese University of Hong Kong.
Algebraic Properties of CSP Model Operators? Y.C. Law and J.H.M. Lee Department of Computer Science and Engineering The Chinese University of Hong Kong Shatin, N.T., Hong Kong SAR, China fyclaw,jleeg@cse.cuhk.edu.hk
More informationChapter 3. Semantics. Topics. Introduction. Introduction. Introduction. Introduction
Topics Chapter 3 Semantics Introduction Static Semantics Attribute Grammars Dynamic Semantics Operational Semantics Axiomatic Semantics Denotational Semantics 2 Introduction Introduction Language implementors
More informationJohns Hopkins Math Tournament Proof Round: Point Set Topology
Johns Hopkins Math Tournament 2019 Proof Round: Point Set Topology February 9, 2019 Problem Points Score 1 3 2 6 3 6 4 6 5 10 6 6 7 8 8 6 9 8 10 8 11 9 12 10 13 14 Total 100 Instructions The exam is worth
More information,, 1{48 () c Kluwer Academic Publishers, Boston. Manufactured in The Netherlands. Optimal Representations of Polymorphic Types with Subtyping * ALEXAN
,, 1{48 () c Kluwer Academic Publishers, Boston. Manufactured in The Netherlands. Optimal Representations of Polymorphic Types with Subtyping * ALEXANDER AIKEN aiken@cs.berkeley.edu EECS Department, University
More information[Ch 6] Set Theory. 1. Basic Concepts and Definitions. 400 lecture note #4. 1) Basics
400 lecture note #4 [Ch 6] Set Theory 1. Basic Concepts and Definitions 1) Basics Element: ; A is a set consisting of elements x which is in a/another set S such that P(x) is true. Empty set: notated {
More informationProgramming Languages Lecture 15: Recursive Types & Subtyping
CSE 230: Winter 2008 Principles of Programming Languages Lecture 15: Recursive Types & Subtyping Ranjit Jhala UC San Diego News? Formalize first-order type systems Simple types (integers and booleans)
More informationCHAPTER 8. Copyright Cengage Learning. All rights reserved.
CHAPTER 8 RELATIONS Copyright Cengage Learning. All rights reserved. SECTION 8.3 Equivalence Relations Copyright Cengage Learning. All rights reserved. The Relation Induced by a Partition 3 The Relation
More informationLecture 2 - Graph Theory Fundamentals - Reachability and Exploration 1
CME 305: Discrete Mathematics and Algorithms Instructor: Professor Aaron Sidford (sidford@stanford.edu) January 11, 2018 Lecture 2 - Graph Theory Fundamentals - Reachability and Exploration 1 In this lecture
More informationInduction and Semantics in Dafny
15-414 Lecture 11 1 Instructor: Matt Fredrikson Induction and Semantics in Dafny TA: Ryan Wagner Encoding the syntax of Imp Recall the abstract syntax of Imp: a AExp ::= n Z x Var a 1 + a 2 b BExp ::=
More information3.4 Deduction and Evaluation: Tools Conditional-Equational Logic
3.4 Deduction and Evaluation: Tools 3.4.1 Conditional-Equational Logic The general definition of a formal specification from above was based on the existence of a precisely defined semantics for the syntax
More informationHiding local state in direct style: a higher-order anti-frame rule
1 / 65 Hiding local state in direct style: a higher-order anti-frame rule François Pottier January 28th, 2008 2 / 65 Contents Introduction Basics of the type system A higher-order anti-frame rule Applications
More informationA Michael Jackson presentation. CSE503: Software Engineering. The following slides are from his keynote at ICSE 1995
A Michael Jackson presentation CSE503: Software Engineering The following slides are from his keynote at ICSE 1995 David Notkin University of Washington Computer Science & Engineering Spring 2006 1 2 3
More informationCIS4/681 { Articial Intelligence 2 > (insert-sort '( )) ( ) 2 More Complicated Recursion So far everything we have dened requires
1 A couple of Functions 1 Let's take another example of a simple lisp function { one that does insertion sort. Let us assume that this sort function takes as input a list of numbers and sorts them in ascending
More informationhas phone Phone Person Person degree Degree isa isa has addr has addr has phone has phone major Degree Phone Schema S1 Phone Schema S2
Schema Equivalence in Heterogeneous Systems: Bridging Theory and Practice R. J. Miller y Y. E. Ioannidis z R. Ramakrishnan x Department of Computer Sciences University of Wisconsin-Madison frmiller, yannis,
More informationCS4215 Programming Language Implementation. Martin Henz
CS4215 Programming Language Implementation Martin Henz Thursday 26 January, 2012 2 Chapter 4 The Language simpl In this chapter, we are exting the language epl in order to provide a more powerful programming
More information(Refer Slide Time: 4:00)
Principles of Programming Languages Dr. S. Arun Kumar Department of Computer Science & Engineering Indian Institute of Technology, Delhi Lecture - 38 Meanings Let us look at abstracts namely functional
More informationLecture 3: Recursion; Structural Induction
15-150 Lecture 3: Recursion; Structural Induction Lecture by Dan Licata January 24, 2012 Today, we are going to talk about one of the most important ideas in functional programming, structural recursion
More informationA Simplied NP-complete MAXSAT Problem. Abstract. It is shown that the MAX2SAT problem is NP-complete even if every variable
A Simplied NP-complete MAXSAT Problem Venkatesh Raman 1, B. Ravikumar 2 and S. Srinivasa Rao 1 1 The Institute of Mathematical Sciences, C. I. T. Campus, Chennai 600 113. India 2 Department of Computer
More informationfcyrluk, sree, shankar, verication lies in their generality. The major practical challenge
Eective Theorem Proving for Hardware Verication? D. Cyrluk, 1 S. Rajan, 2 N. Shankar, 3 and M.K. Srivas 3 fcyrluk, sree, shankar, srivasg@csl.sri.com 1 Dept. of Computer Science, Stanford University, Stanford
More informationLogic, and last but not least the previous acquaintance of the author with this particular verication system. Experiences with proving the correctness
PAMELA+PVS { Verication of Sequential Programs Bettina Buth 1 Introduction Tool support is an essential requirement for the applicability of Formal Methods to realistic, large-scale systems, and the acceptance
More informationTyped Racket: Racket with Static Types
Typed Racket: Racket with Static Types Version 5.0.2 Sam Tobin-Hochstadt November 6, 2010 Typed Racket is a family of languages, each of which enforce that programs written in the language obey a type
More informationTopic 3: Propositions as types
Topic 3: Propositions as types May 18, 2014 Propositions as types We have seen that the main mathematical objects in a type theory are types. But remember that in conventional foundations, as based on
More information3.7 Denotational Semantics
3.7 Denotational Semantics Denotational semantics, also known as fixed-point semantics, associates to each programming language construct a well-defined and rigorously understood mathematical object. These
More informationINPUT SYSTEM MODEL ANALYSIS OUTPUT
Detecting Null Pointer Violations in Java Programs Xiaoping Jia, Sushant Sawant Jiangyu Zhou, Sotiris Skevoulis Division of Software Engineering School of Computer Science, Telecommunication, and Information
More informationMyla Archer, Constance Heitmeyer, and Steve Sims. farcher, heitmeyer, Abstract
TAME: A PVS Interface to Simplify Proofs for Automata Models Presented at UITP 98, Eindhoven, Netherlands, July 13-15, 1998 Myla Archer, Constance Heitmeyer, and Steve Sims Code 5546, Naval Research Laboratory,
More informationChapter 3 (part 3) Describing Syntax and Semantics
Chapter 3 (part 3) Describing Syntax and Semantics Chapter 3 Topics Introduction The General Problem of Describing Syntax Formal Methods of Describing Syntax Attribute Grammars Describing the Meanings
More informationCS 6110 S11 Lecture 12 Naming and Scope 21 February 2011
CS 6110 S11 Lecture 12 Naming and Scope 21 February 2011 In this lecture we introduce the topic of scope in the context of the λ-calculus and define translations from λ-cbv to FL for the two most common
More informationSORT INFERENCE \coregular" signatures, they derive an algorithm for computing a most general typing for expressions e which is only slightly more comp
Haskell Overloading is DEXPTIME{complete Helmut Seidl Fachbereich Informatik Universitat des Saarlandes Postfach 151150 D{66041 Saarbrucken Germany seidl@cs.uni-sb.de Febr., 1994 Keywords: Haskell type
More informationWorst-case running time for RANDOMIZED-SELECT
Worst-case running time for RANDOMIZED-SELECT is ), even to nd the minimum The algorithm has a linear expected running time, though, and because it is randomized, no particular input elicits the worst-case
More informationAbstract This paper describes AxSL, an Axiomatic Specication Language that extends algebraic axiom methods to support object-oriented concepts such as
Extending Algebraic Axiom Techniques to Handle Object-Oriented Specications Alyce Brady, Member, IEEE David R. Musser, Member, IEEE Computer Society David L. Spooner, Member, IEEE August 2, 1999 Abstract
More informationBases of topologies. 1 Motivation
Bases of topologies 1 Motivation In the previous section we saw some examples of topologies. We described each of them by explicitly specifying all of the open sets in each one. This is not be a feasible
More informationFormal verication of programs for abstract register machines
Bull. Nov. Comp. Center, Comp. Science, 35 (2013), 3956 c 2013 NCC Publisher Formal verication of programs for abstract register machines D. A. Chkliaev, V. A. Nepomniaschy Abstract. Abstract register
More informationCSCI.6962/4962 Software Verification Fundamental Proof Methods in Computer Science (Arkoudas and Musser) Chapter 11 p. 1/38
CSCI.6962/4962 Software Verification Fundamental Proof Methods in Computer Science (Arkoudas and Musser) Chapter 11 p. 1/38 CSCI.6962/4962 Software Verification Fundamental Proof Methods in Computer Science
More informationNASA Technical Memorandum An Introduction to Requirements Capture Using PVS: Specication of a Simple Autopilot. Ricky W.
NASA Technical Memorandum 110255 An Introduction to Requirements Capture Using PVS: Specication of a Simple Autopilot Ricky W. Butler Langley Research Center, Hampton, Virginia May 1996 National Aeronautics
More informationWork-in-progress: "Verifying" the Glasgow Haskell Compiler Core language
Work-in-progress: "Verifying" the Glasgow Haskell Compiler Core language Stephanie Weirich Joachim Breitner, Antal Spector-Zabusky, Yao Li, Christine Rizkallah, John Wiegley June 2018 Let's prove GHC correct
More information[12] Sam Owre, John Rushby, Natarajan Shankar, and Friedrich von Henke. Formal
[12] Sam Owre, John Rushby, Natarajan Shankar, and Friedrich von Henke. Formal verication for fault-tolerant architectures: Some lessons learned. In J. C. P. Woodcock and P. G. Larsen, editors, FME '93:
More informationIntroduction to Functional Programming: Lecture 7 2 Functions as innite data structures Ordinary ML data structures are always nite. We can, however,
Introduction to Functional Programming: Lecture 7 1 Introduction to Functional Programming John Harrison University of Cambridge Lecture 7 Innite data structures Topics covered: Functions as innite data
More informationSubtyping (cont) Formalization of Subtyping. Lecture 15 CS 565. Inversion of the subtype relation:
Subtyping (cont) Lecture 15 CS 565 Formalization of Subtyping Inversion of the subtype relation:! If "
More informationSubtyping. Lecture 13 CS 565 3/27/06
Subtyping Lecture 13 CS 565 3/27/06 Polymorphism Different varieties of polymorphism: Parametric (ML) type variables are abstract, and used to encode the fact that the same term can be used in many different
More informationTyped Scheme: Scheme with Static Types
Typed Scheme: Scheme with Static Types Version 4.1.1 Sam Tobin-Hochstadt October 5, 2008 Typed Scheme is a Scheme-like language, with a type system that supports common Scheme programming idioms. Explicit
More informationChecks and Balances - Constraint Solving without Surprises in Object-Constraint Programming Languages: Full Formal Development
Checks and Balances - Constraint Solving without Surprises in Object-Constraint Programming Languages: Full Formal Development Tim Felgentreff, Todd Millstein, Alan Borning and Robert Hirschfeld Viewpoints
More informationIntroduction to the Lambda Calculus. Chris Lomont
Introduction to the Lambda Calculus Chris Lomont 2010 2011 2012 www.lomont.org Leibniz (1646-1716) Create a universal language in which all possible problems can be stated Find a decision method to solve
More informationLecture 1 Contracts. 1 A Mysterious Program : Principles of Imperative Computation (Spring 2018) Frank Pfenning
Lecture 1 Contracts 15-122: Principles of Imperative Computation (Spring 2018) Frank Pfenning In these notes we review contracts, which we use to collectively denote function contracts, loop invariants,
More informationCMSC 330: Organization of Programming Languages. Operational Semantics
CMSC 330: Organization of Programming Languages Operational Semantics Notes about Project 4, Parts 1 & 2 Still due today (7/2) Will not be graded until 7/11 (along with Part 3) You are strongly encouraged
More informationCafeOBJ. CafeOBJ. Starting CafeOBJ. Wolfgang Schreiner 1. A Quick Overview. 2.
CafeOBJ Wolfgang Schreiner Wolfgang.Schreiner@risc.uni-linz.ac.at 1. A Quick Overview Research Institute for Symbolic Computation (RISC) Johannes Kepler University, Linz, Austria http://www.risc.uni-linz.ac.at
More informationPVS, SAL, and the ToolBus
PVS, SAL, and the ToolBus John Rushby Computer Science Laboratory SRI International Menlo Park, CA John Rushby, SR I An Evidential Tool Bus 1 Overview Backends (PVS) and frontends (SAL) What s wrong with
More informationto automatically generate parallel code for many applications that periodically update shared data structures using commuting operations and/or manipu
Semantic Foundations of Commutativity Analysis Martin C. Rinard y and Pedro C. Diniz z Department of Computer Science University of California, Santa Barbara Santa Barbara, CA 93106 fmartin,pedrog@cs.ucsb.edu
More informationLecture 1 Contracts : Principles of Imperative Computation (Fall 2018) Frank Pfenning
Lecture 1 Contracts 15-122: Principles of Imperative Computation (Fall 2018) Frank Pfenning In these notes we review contracts, which we use to collectively denote function contracts, loop invariants,
More informationDynamic Logic David Harel, The Weizmann Institute Dexter Kozen, Cornell University Jerzy Tiuryn, University of Warsaw The MIT Press, Cambridge, Massac
Dynamic Logic David Harel, The Weizmann Institute Dexter Kozen, Cornell University Jerzy Tiuryn, University of Warsaw The MIT Press, Cambridge, Massachusetts, 2000 Among the many approaches to formal reasoning
More informationLambda Calculus and Type Inference
Lambda Calculus and Type Inference Björn Lisper Dept. of Computer Science and Engineering Mälardalen University bjorn.lisper@mdh.se http://www.idt.mdh.se/ blr/ October 13, 2004 Lambda Calculus and Type
More information1 Introduction. 3 Syntax
CS 6110 S18 Lecture 19 Typed λ-calculus 1 Introduction Type checking is a lightweight technique for proving simple properties of programs. Unlike theorem-proving techniques based on axiomatic semantics,
More informationCSCI.6962/4962 Software Verification Fundamental Proof Methods in Computer Science (Arkoudas and Musser) Section 17.2
CSCI.6962/4962 Software Verification Fundamental Proof Methods in Computer Science (Arkoudas and Musser) Section 17.2 Instructor: Carlos Varela Rensselaer Polytechnic Institute Spring 2018 CSCI.6962/4962
More informationYices 1.0: An Efficient SMT Solver
Yices 1.0: An Efficient SMT Solver AFM 06 Tutorial Leonardo de Moura (joint work with Bruno Dutertre) {demoura, bruno}@csl.sri.com. Computer Science Laboratory SRI International Menlo Park, CA Yices: An
More informationMAX-PLANCK-INSTITUT F UR. Ordered Semantic Hyper-Linking. David A. Plaisted. MPI{I{94{235 August 1994 INFORMATIK. Im Stadtwald. D Saarbrucken
MAX-PLANCK-INSTITUT F UR INFORMATIK Ordered Semantic Hyper-Linking David A. Plaisted MPI{I{94{235 August 1994 k I N F O R M A T I K Im Stadtwald D 66123 Saarbrucken Germany Authors' Addresses David Plaisted
More informationSearch Algorithms in Type Theory
Search Algorithms in Type Theory James L. Caldwell Ian P. Gent Judith Underwood Revised submission to Theoretical Computer Science: Special Issue on Proof Search in Type-theoretic Languages May 1998 Abstract
More informationSemantic Subtyping. Alain Frisch (ENS Paris) Giuseppe Castagna (ENS Paris) Véronique Benzaken (LRI U Paris Sud)
Semantic Subtyping Alain Frisch (ENS Paris) Giuseppe Castagna (ENS Paris) Véronique Benzaken (LRI U Paris Sud) http://www.cduce.org/ Semantic Subtyping - Groupe de travail BD LRI p.1/28 CDuce A functional
More informationcapture cumulative changes over an interval, while in the HIOA model, the evolution of the continuous state variables over time is modeled using traje
Developing Strategies for Specialized Theorem Proving about Untimed, Timed, and Hybrid I/O Automata? Sayan Mitra 1 and Myla Archer 2 1 MIT Laboratory for Computer Science, 200 Technology Square, Cambridge,
More informationRecursively Enumerable Languages, Turing Machines, and Decidability
Recursively Enumerable Languages, Turing Machines, and Decidability 1 Problem Reduction: Basic Concepts and Analogies The concept of problem reduction is simple at a high level. You simply take an algorithm
More informationCMSC 336: Type Systems for Programming Languages Lecture 5: Simply Typed Lambda Calculus Acar & Ahmed January 24, 2008
CMSC 336: Type Systems for Programming Languages Lecture 5: Simply Typed Lambda Calculus Acar & Ahmed January 24, 2008 Contents 1 Solution to the Exercise 1 1.1 Semantics for lambda calculus.......................
More informationFunctional Languages. Hwansoo Han
Functional Languages Hwansoo Han Historical Origins Imperative and functional models Alan Turing, Alonzo Church, Stephen Kleene, Emil Post, etc. ~1930s Different formalizations of the notion of an algorithm
More informationIntegration of SMT Solvers with ITPs There and Back Again
Integration of SMT Solvers with ITPs There and Back Again Sascha Böhme and University of Sheffield 7 May 2010 1 2 Features: SMT-LIB vs. Yices Translation Techniques Caveats 3 4 Motivation Motivation System
More informationProgramming Languages Third Edition
Programming Languages Third Edition Chapter 12 Formal Semantics Objectives Become familiar with a sample small language for the purpose of semantic specification Understand operational semantics Understand
More information