Provably Correct Software


 Irma Greene
 1 years ago
 Views:
Transcription
1 Provably Correct Software Max Schäfer Institute of Information Science/Academia Sinica September 17, / 48
2 The Need for Provably Correct Software BUT bugs are annoying, embarrassing, and cost gazillions of $/TWD/es every year there are many approaches to developing less buggy software traditionally: code review, testing etc. E. W. Dijkstra: Program testing can be used to show the presence of bugs, but never to show their absence. (EWD 249) we are interested in provably correct software, i.e. software 1 that has a precise (mathematical) specication 2 that provably (machine checkably) fullls it 2 / 48
3 The Need for Provably Correct Software BUT bugs are annoying, embarrassing, and cost gazillions of $/TWD/es every year there are many approaches to developing less buggy software traditionally: code review, testing etc. E. W. Dijkstra: Program testing can be used to show the presence of bugs, but never to show their absence. (EWD 249) we are interested in provably correct software, i.e. software 1 that has a precise (mathematical) specication 2 that provably (machine checkably) fullls it 2 / 48
4 The Need for Provably Correct Software BUT bugs are annoying, embarrassing, and cost gazillions of $/TWD/es every year there are many approaches to developing less buggy software traditionally: code review, testing etc. E. W. Dijkstra: Program testing can be used to show the presence of bugs, but never to show their absence. (EWD 249) we are interested in provably correct software, i.e. software 1 that has a precise (mathematical) specication 2 that provably (machine checkably) fullls it 2 / 48
5 The Need for Provably Correct Software BUT bugs are annoying, embarrassing, and cost gazillions of $/TWD/es every year there are many approaches to developing less buggy software traditionally: code review, testing etc. E. W. Dijkstra: Program testing can be used to show the presence of bugs, but never to show their absence. (EWD 249) we are interested in provably correct software, i.e. software 1 that has a precise (mathematical) specication 2 that provably (machine checkably) fullls it 2 / 48
6 How to get there in order to specify program behavior and reason about programs, we need a mathematical model of the language thus we either need to work in a language that is amenable to mathematical treatment (functional languages, interactive theorem provers) work harder to construct a model for a (simplication of a) real world language, then integrate specications and proofs with programs 3 / 48
7 Outline We will present the following systems: Isabelle/HOL: SMLinspired programming language, about which propositions can be proved (based on LF) Agda: practical dependently typed programming language (based on UTT) Coq: integration of dependently typed programming language and theorem prover (based on PCIC) Proof Carrying Code Why/Caduceus: verication of imperative programs Much of the material is based on lecture notes of the TYPES Summer School 2007 (see 5 / 48
8 Outline 1 Interactive Theorem Provers Verication of Functional Programs Dependent Types and Inductive Families 2 Proof Carrying Code 3 Verication of Imperative Programs 6 / 48
9 Functional Programming in One Slide the interactive theorem provers we discuss all have an internal functional language functions dened in the language should behave like mathematical functions no state, no assignable variables details of program evaluation should matter as little as possible in strongly typed languages (which we exclusively consider here), datatypes are used to ensure that functions are only invoked with meaningful arguments new datatypes can be dened inductively For the moment, we use the language of Isabelle/HOL. 7 / 48
10 Isabelle Isabelle is a generic proof assistant developed by L. C. Paulson (Cambridge) and T. Nipkow (München) since the late '80s it is based on the logical framework approach with a lean metalogic in which object logics can be implemented inference trees of the object logic are represented as terms of the metalogic; correct application of the rules is ensured by type checking the terms of the metalogic most used object logic is Isabelle/HOL, which implements higher order logic from the Isabelle homepage: The main application is the formalization of mathematical proofs and in particular formal verication, which includes proving the correctness of computer hardware or software and proving properties of computer languages and protocols. Homepage: 9 / 48
11 Inductive Datatypes datatype of booleans: datatype bool = False True this tells us: 1 False and True have type bool 2 everything that has type bool is either False or True 3 False and True are dierent datatype of natural numbers: datatype nat = Zero Suc nat this type is recursive; we have: 1 Zero is of type nat, Suc is of type nat>nat 2 elements of type nat are Zero, (Suc Zero), (Suc (Suc Zero)), etc.; but every one is either Zero or of the form (Suc x), where x itself is also of type nat 3 Zero is not equal to any (Suc x); if (Suc x) equals (Suc y), then x equals y for convenience, we can use numerals (0:=Zero, 1:=Suc Zero,... ) 11 / 48
12 Inductive Datatypes datatype of booleans: datatype bool = False True this tells us: 1 False and True have type bool 2 everything that has type bool is either False or True 3 False and True are dierent datatype of natural numbers: datatype nat = Zero Suc nat this type is recursive; we have: 1 Zero is of type nat, Suc is of type nat>nat 2 elements of type nat are Zero, (Suc Zero), (Suc (Suc Zero)), etc.; but every one is either Zero or of the form (Suc x), where x itself is also of type nat 3 Zero is not equal to any (Suc x); if (Suc x) equals (Suc y), then x equals y for convenience, we can use numerals (0:=Zero, 1:=Suc Zero,... ) 11 / 48
13 Inductive Datatypes datatype of booleans: datatype bool = False True this tells us: 1 False and True have type bool 2 everything that has type bool is either False or True 3 False and True are dierent datatype of natural numbers: datatype nat = Zero Suc nat this type is recursive; we have: 1 Zero is of type nat, Suc is of type nat>nat 2 elements of type nat are Zero, (Suc Zero), (Suc (Suc Zero)), etc.; but every one is either Zero or of the form (Suc x), where x itself is also of type nat 3 Zero is not equal to any (Suc x); if (Suc x) equals (Suc y), then x equals y for convenience, we can use numerals (0:=Zero, 1:=Suc Zero,... ) 11 / 48
14 Polymorphic Types datatype of polymorphic lists: datatype 'a list = Nil Cons 'a 'a list list itself is not a type; it needs to be instantiated with a concrete 'a; for example, bool list and nat list are (dierent) types elements of bool list are Nil, Cons true Nil, Cons false (Cons false Nil), etc. elements of nat list are Nil, Cons (Suc (Suc Zero)) (Cons (Suc Zero) Nil), etc. we can not form a list like Cons true (Cons Zero Nil) Nil is ambiguous, it could be either Nil::bool list or Nil::nat list; most of the time, the compiler can gure it out 13 / 48
15 Functions on Lists functions on inductive datatypes can be dened by pattern matching example: appending two lists consts app :: 'a list => 'a list => 'a list primrec app Nil ys = ys app (Cons x xs) ys = Cons x (app xs ys) reversing a list consts rev :: 'a list => 'a list primrec rev Nil = Nil rev (Cons x xs) = app (rev xs) (Cons x Nil) 15 / 48
16 How do we know that they are correct? we can now formulate and prove statements about the functions structural induction on lists: a property P about lists can be proved by showing that 1 P holds on Nil 2 if P holds on xs, then it holds on Cons x xs corresponding induction schemata are automatically derived for every inductive datatype for example: we can prove that reversing a list twice yields the original list in Isabelle: theorem rev_rev: rev (rev xs) = xs 17 / 48
17 A Word about Termination it is very hard to reason about nonterminating functions e.g., if we could dene f(x) = f(x) + 1, then 0 = 0 + f(x) f(x) = 0 + f(x) + 1 f(x) = 1 hence, in Isabelle (and most other proof assistants) only terminating functions can be dened two ways to achieve this: 1 only use restricted recursion schemata (like primitive recursion) 2 provide explicit termination proofs both are possible in Isabelle thus, Isabelle (like most theorem provers) is not Turing complete! 19 / 48
18 Who are we trusting? the proofs are done directly on the source code, no need for translation to pseudo code we need not trust our code or our understanding of it the proofs are checked by Isabelle; we need to trust the Isabelle kernel we do not need to trust the people writing tactics! Slogan Make the amount of code that needs to be trusted as small as possible. 20 / 48
19 Who are we trusting? the proofs are done directly on the source code, no need for translation to pseudo code we need not trust our code or our understanding of it the proofs are checked by Isabelle; we need to trust the Isabelle kernel we do not need to trust the people writing tactics! Slogan Make the amount of code that needs to be trusted as small as possible. 20 / 48
20 Integrating Proofs and Programs programs and proofs about them should not be separated look at the type of app in Isabelle: app :: 'a list => 'a list => 'a list it guarantees that, when given two lists, it will return a list this is not strong enough to convince us of its correctness we would like to know that if we have lists xs and ys of length m and n, then app xs ys is a list of length m + n for any 0 i < m, xs[i]=(app xs ys)[i] for any 0 i < n, ys[i]=(app xs ys)[m+i] we need a stronger type system, in which types can depend on data one language that makes this possible is Agda 22 / 48
21 Agda Agda is a theorem prover/programming language developed at Chalmers rst version was written by Catarina Coquand in the '90s Agda2 is a complete reimplementation, mostly by Ulf Norell it is based on Luo's Universal Type Theory, an extension of the Calculus of Constructions most important concepts are dependent types, universes, and inductive families syntax is similar to Haskell with sophisticated pattern matching Homepage: 24 / 48
22 Inductive Families the type of sized lists in Agda: data list {A : Set} : nat > Set where [] : list A 0 _::_ : {n : nat} > A > list {A} n > list {A} (S n) we now have true :: false :: [] : list {bool} 2 (observe inx notation of ::) safe head function: head : {A : Set} {n : nat} > list {A} (S n) > A head (x :: _) = x note that Agda's pattern matching mechanism gures out that the list argument cannot be empty! 26 / 48
23 The Append Function we can dene the append function _++_ to immediately show the eect on lengths: _++_ : {A : Set} {m n : nat} > list {A} m > list {A} n > list {A} (m + n) [] ++ ys = ys (x :: xs) ++ ys = x :: (xs ++ ys) in order to prove that it does what it should, we need a function to index lists, preferably with a syntax like l[s zero] can you implement the following function? _[_] : {A : Set} {n : nat} > list A n > nat > A 28 / 48
24 The Append Function we can dene the append function _++_ to immediately show the eect on lengths: _++_ : {A : Set} {m n : nat} > list {A} m > list {A} n > list {A} (m + n) [] ++ ys = ys (x :: xs) ++ ys = x :: (xs ++ ys) in order to prove that it does what it should, we need a function to index lists, preferably with a syntax like l[s zero] can you implement the following function? _[_] : {A : Set} {n : nat} > list A n > nat > A 28 / 48
25 Safe Indexing we need to ensure that the index is smaller than n solution: dene, for every n : nat the type below n of natural numbers smaller than it data below : nat > Set where bzero : {n : nat} > below (S n) bsuc : {n : nat} > below n > below (S n) (sadly we cannot reuse the usual notation for natural numbers) now we can dene _[_] : {A : Set} {n : nat} > list A n > below n > A and proceed to prove our implementation of _++_ correct 30 / 48
26 Safe Indexing we need to ensure that the index is smaller than n solution: dene, for every n : nat the type below n of natural numbers smaller than it data below : nat > Set where bzero : {n : nat} > below (S n) bsuc : {n : nat} > below n > below (S n) (sadly we cannot reuse the usual notation for natural numbers) now we can dene _[_] : {A : Set} {n : nat} > list A n > below n > A and proceed to prove our implementation of _++_ correct 30 / 48
27 Function Denitions in Agda function denitions look similar to Haskell, always done by pattern matching functions have to be explicitly annotated with their type in a dependently typed setting it is not generally possible to infer types without annotations type checking is also quite hard; sometimes unexpected results: for Agda, the types list {A} (x+y) and list {A} (y+x) are dierent, although they have the same inhabitants function denitions for which Agda cannot ensure termination are still accepted, but marked by the editor 32 / 48
28 Advanced Dependent Types dependent types in conjunction with universes are extremely powerful; very few primitive concepts are needed example: denition of dependent sum type data Σ {A : Set} (P : A > Set) : exist : {x : A} > P x > Σ P Set where an inhabitant of this type is a pair t, M, where t : A and M : P t; for example, Σ list is a type for lists of any length seen from a logical perspective, this is an implementation of the (constructive) existential quantier 34 / 48
29 Advanced Dependent Types (cont.) example: identity type data _==_ {A : Set} : A > A > Set where refl : (x : A) > x == x the only way to obtain an element of this type is through refl, hence if we have an element of s == t, s and t must in fact be equal Agda's pattern matching can exploit this fact: subst : {A : Set} (C : A > Set) (x y : A) > x == y > C x > C y subst C.x.x (refl x) cx = cx 36 / 48
30 Comparison: Agda vs. Isabelle/HOL dierent goals: Isabelle/HOL is mainly a proof assistant, Agda is mainly a programming language Agda does not have lemmas, tactics, etc. (it can still be used as a proof assistant, however) Agda has type universes (like Set), which Isabelle/HOL lacks underlying concepts are quite similar 38 / 48
31 Throwing Everything Together: Coq Coq unies the programming language approach and the theorem prover approach started as an implementation of a type checker for the pure Calculus of Constructions of Coquand and Huet in the early '80s recent versions are based on the Predicative Calculus of Inductive Constructions it can be used to formulate and prove mathematical results similar to Isabelle inductive families and matching like in Agda are also available (not quite so sophisticated) tactic language similar to Isabelle/HOL, with userdenable tactics large library of predened datatypes, functions, and results about them functions written in Coq can be extracted to OCaml, Haskell, or Scheme for ecient execution (has been done for fairly large programs: Compcert project) Homepage: 40 / 48
32 Writing Certied Programs in Coq dening divisibility in Coq: Definition divides (d m:nat) := exists k, m = k*d. greatest common divisor: Definition is_gcd (m n d:nat) := divides d m /\ divides d n /\ (forall d', divides d' m > divides d' n > d' <= d). we want a function like the following: Definition gcd (m n:nat) : {d:nat is_gcd m n d}. later, we can extract from it an OCaml function gcd : nat > nat > nat without the explicit proofs 42 / 48
33 Comparison: Agda, Coq the technical underpinnings are very similar (at least from a user's perspective) Agda is missing Coq's theorem prover features, it does not have as large a codebase as Coq but this also means it has less historical ballast... the real selling point for Coq is program extraction 43 / 48
34 Outline 1 Interactive Theorem Provers Verication of Functional Programs Dependent Types and Inductive Families 2 Proof Carrying Code 3 Verication of Imperative Programs 44 / 48
35 Proof Carrying Code See the slides by David Pichardie and Benjamin Gregoire on the summer school website. 45 / 48
36 Outline 1 Interactive Theorem Provers Verication of Functional Programs Dependent Types and Inductive Families 2 Proof Carrying Code 3 Verication of Imperative Programs 46 / 48
37 Why/Caduceus Why is a tool for verifying imperative programs based on a simple MLlike imperative language (also called Why), which is annotated with conditions and invariants formulated in wpstyle the Why compiler generates verication conditions which can be solved by an automatic prover or using an interactive proof environment (like Coq or Isabelle/HOL) Caduceus translates annotated C programs into Why for Java, there is a similar tool called Krakatoa Focus is on verication of real world programs with as much automation as possible. 47 / 48
38 Further Explanation and Examples For further explanations and examples see the slides by JeanChristophe Filliâtre on the summer school website. 48 / 48
Coq, a formal proof development environment combining logic and programming. Hugo Herbelin
Coq, a formal proof development environment combining logic and programming Hugo Herbelin 1 Coq in a nutshell (http://coq.inria.fr) A logical formalism that embeds an executable typed programming language:
More informationIntroduction to dependent types in Coq
October 24, 2008 basic use of the Coq system In Coq, you can play with simple values and functions. The basic command is called Check, to verify if an expression is wellformed and learn what is its type.
More informationCoq Summer School. Yves Bertot
Coq Summer School Yves Bertot Introduction Welcome! Coq from the practical side But Theory has practical benets, too. Start from what we expect you know: programming Need to learn a new programming language!
More informationCombining Programming with Theorem Proving
Combining Programming with Theorem Proving Chiyan Chen and Hongwei Xi Boston University Programming with Theorem Proving p.1/27 Motivation for the Research To support advanced type systems for practical
More informationTowards Reasoning about State Transformer Monads in Agda. Master of Science Thesis in Computer Science: Algorithm, Language and Logic.
Towards Reasoning about State Transformer Monads in Agda Master of Science Thesis in Computer Science: Algorithm, Language and Logic Viet Ha Bui Department of Computer Science and Engineering CHALMERS
More informationDeductive Program Verification with Why3, Past and Future
Deductive Program Verification with Why3, Past and Future Claude Marché ProofInUse KickOff Day February 2nd, 2015 A bit of history 1999: JeanChristophe Filliâtre s PhD Thesis Proof of imperative programs,
More informationSOFTWARE VERIFICATION AND COMPUTER PROOF (lesson 1) Enrico Tassi Inria SophiaAntipolis
SOFTWARE VERIFICATION AND COMPUTER PROOF (lesson 1) Enrico Tassi Inria SophiaAntipolis Who am I? 1. I'm a researcher at Inria 2. I work on proof assistants, the kind of tools that we will be using for
More informationthe application rule M : x:a: B N : A M N : (x:a: B) N and the reduction rule (x: A: B) N! Bfx := Ng. Their algorithm is not fully satisfactory in the
The SemiFull Closure of Pure Type Systems? Gilles Barthe Institutionen for Datavetenskap, Chalmers Tekniska Hogskola, Goteborg, Sweden Departamento de Informatica, Universidade do Minho, Braga, Portugal
More informationIdris: Implementing a Dependently Typed Programming Language
Idris: Implementing a Dependently Typed Programming Language Edwin Brady University of St Andrews ecb10@standrews.ac.uk @edwinbrady Type Inference and Automated Proving, Dundee, 12th May 2015 1 / 25 Idris
More information4 Programming with Types
4 Programming with Types 4.1 Polymorphism We ve been working a lot with lists of numbers, but clearly programs also need to be able to manipulate lists whose elements are drawn from other types lists of
More informationAnalysis of dependent types in Coq through the deletion of the largest node of a binary search tree
Analysis of dependent types in Coq through the deletion of the largest node of a binary search tree Sneha Popley and Stephanie Weirich August 14, 2008 Abstract Coq reflects some significant differences
More informationProgramming with Math and Logic
.. Programming with Math and Logic an invitation to functional programming Ed Morehouse Wesleyan University The Plan why fp? terms types interfaces The What and Why of Functional Programming Computing
More informationHow Efficient Can Fully Verified Functional Programs Be  A Case Study of Graph Traversal Algorithms
How Efficient Can Fully Verified Functional Programs Be  A Case Study of Graph Traversal Algorithms Mirko Stojadinović Faculty of Mathematics, University of Belgrade Abstract. One approach in achieving
More informationλ calculus is inconsistent
Content Rough timeline COMP 4161 NICTA Advanced Course Advanced Topics in Software Verification Gerwin Klein, June Andronick, Toby Murray λ Intro & motivation, getting started [1] Foundations & Principles
More informationType Systems. Pierce Ch. 3, 8, 11, 15 CSE
Type Systems Pierce Ch. 3, 8, 11, 15 CSE 6341 1 A Simple Language ::= true false if then else 0 succ pred iszero Simple untyped expressions Natural numbers encoded as succ succ
More informationAugust 510, 2013, Tsinghua University, Beijing, China. Polymorphic types
5th AsianPacific Summer School on Formal Methods August 510, 2013, Tsinghua University, Beijing, China Polymorphic types jeanjacques.levy@inria.fr 201388 http://sts.thss.tsinghua.edu.cn/coqschool2013
More informationCongruence Closure in Intensional Type Theory
Congruence Closure in Intensional Type Theory Daniel Selsam 1 Leonardo de Moura 2 1 Stanford University 2 Microsoft Research June 30, 2016 Goal Intensional type theory (ITT) Coq, Lean, Agda, Epigram, Idris
More informationLists. Michael P. Fourman. February 2, 2010
Lists Michael P. Fourman February 2, 2010 1 Introduction The list is a fundamental datatype in most functional languages. ML is no exception; list is a builtin ML type constructor. However, to introduce
More informationProgramming Languages Fall 2014
Programming Languages Fall 2014 Lecture 7: Simple Types and SimplyTyped Lambda Calculus Prof. Liang Huang huang@qc.cs.cuny.edu 1 Types stuck terms? how to fix it? 2 Plan First I For today, we ll go back
More informationProgramming Languages Fall 2013
Programming Languages Fall 2013 Lecture 7: Simple Types and SimplyTyped Lambda Calculus Prof. Liang Huang huang@qc.cs.cuny.edu Types stuck terms? how to fix it? Plan First I For today, we ll go back to
More informationIdris, a language with dependent types Extended Abstract
Idris, a language with dependent types Extended Abstract Edwin Brady School of Computer Science, University of St Andrews, St Andrews, Scotland. Email: eb@cs.standrews.ac.uk. Tel: +441334463253, Fax:
More informationGeneric Programming With Dependent Types: II
Generic Programming With Dependent Types: II Generic Haskell in Agda Stephanie Weirich University of Pennsylvania March 2426, 2010 SSGIP GenericHaskell style generic programming in Agda Dependentlytyped
More informationPROGRAMMING IN HASKELL. Chapter 2  First Steps
PROGRAMMING IN HASKELL Chapter 2  First Steps 0 The Hugs System Hugs is an implementation of Haskell 98, and is the most widely used Haskell system; The interactive nature of Hugs makes it well suited
More informationProgramming with dependent types: passing fad or useful tool?
Programming with dependent types: passing fad or useful tool? Xavier Leroy INRIA ParisRocquencourt IFIP WG 2.8, 200906 X. Leroy (INRIA) Dependentlytyped programming 200906 1 / 22 Dependent types In
More informationPolymorphic lambda calculus Princ. of Progr. Languages (and Extended ) The University of Birmingham. c Uday Reddy
0602552 Princ. of Progr. Languages (and Extended ) The University of Birmingham Spring Semester 201617 School of Computer Science c Uday Reddy201617 Handout 6: Polymorphic Type Systems 1. Polymorphic
More informationTYPE INFERENCE. François Pottier. The Programming Languages Mentoring ICFP August 30, 2015
TYPE INFERENCE François Pottier The Programming Languages Mentoring Workshop @ ICFP August 30, 2015 What is type inference? What is the type of this OCaml function? let f verbose msg = if verbose then
More informationType Checking and Type Inference
Type Checking and Type Inference Principles of Programming Languages CSE 307 1 Types in Programming Languages 2 Static Type Checking 3 Polymorphic Type Inference Version: 1.8 17:20:56 2014/08/25 Compiled
More informationSecondOrder Type Systems
#1 SecondOrder Type Systems Homework 5 Summary Student : 37.9704 Student : 44.4466 ORIGINAL : 50.2442 Student : 50.8275 Student : 50.8633 Student : 50.9181 Student : 52.1347 Student : 52.1633 Student
More informationFormal Verification. Lecture 10
Formal Verification Lecture 10 Formal Verification Formal verification relies on Descriptions of the properties or requirements of interest Descriptions of systems to be analyzed, and rely on underlying
More informationOverloading, Type Classes, and Algebraic Datatypes
Overloading, Type Classes, and Algebraic Datatypes Delivered by Michael Pellauer Arvind Computer Science and Artificial Intelligence Laboratory M.I.T. September 28, 2006 September 28, 2006 http://www.csg.csail.mit.edu/6.827
More informationOptimization of a verified Deflate implementation
Optimization of a verified Deflate implementation ChristophSimon Senjak Lehr und Forschungseinheit für Theoretische Informatik Institut für Informatik LudwigMaximiliansUniversität München Oettingenstr.67,
More informationTurning proof assistants into programming assistants
Turning proof assistants into programming assistants ST Winter Meeting, 3 Feb 2015 Magnus Myréen Why? Why combine proof and programming assistants? Why proofs? Testing cannot show absence of bugs. Some
More informationBlockchains: new home for provencorrect software. Paris, Yoichi Hirai formal verification engineer, the Ethereum Foundation
Blockchains: new home for provencorrect software Paris, 2017217 Yoichi Hirai formal verification engineer, the Ethereum Foundation Lyon: 2014 January Have you heard of a web site where you can get Bitcoin
More informationFrom Z3 to Lean, Efficient Verification
From Z3 to Lean, Efficient Verification Turing Gateway to Mathematics, 19 July 2017 Leonardo de Moura, Microsoft Research Joint work with Nikolaj Bjorner and Christoph Wintersteiger Satisfiability Solution/Model
More informationCS 161 Computer Security
Wagner Spring 2014 CS 161 Computer Security 1/27 Reasoning About Code Often functions make certain assumptions about their arguments, and it is the caller s responsibility to make sure those assumptions
More informationReview. CS152: Programming Languages. Lecture 11 STLC Extensions and Related Topics. Let bindings (CBV) Adding Stuff. Booleans and Conditionals
Review CS152: Programming Languages Lecture 11 STLC Extensions and Related Topics e ::= λx. e x ee c v ::= λx. e c (λx. e) v e[v/x] e 1 e 2 e 1 e 2 τ ::= int τ τ Γ ::= Γ,x : τ e 2 e 2 ve 2 ve 2 e[e /x]:
More informationAutomatic Proof and Disproof in Isabelle/HOL
Automatic Proof and Disproof in Isabelle/HOL Jasmin Blanchette, Lukas Bulwahn, Tobias Nipkow Fakultät für Informatik TU München 1 Introduction 2 Isabelle s Standard Proof Methods 3 Sledgehammer 4 Quickcheck:
More informationThe Lean Theorem Prover (system description)
The Lean Theorem Prover (system description) Leonardo de Moura 1, Soonho Kong 2, Jeremy Avigad 2, Floris van Doorn 2 and Jakob von Raumer 2* 1 Microsoft Research leonardo@microsoft.com 2 Carnegie Mellon
More informationFrom Math to Machine A formal derivation of an executable Krivine Machine Wouter Swierstra Brouwer Seminar
From Math to Machine A formal derivation of an executable Krivine Machine Wouter Swierstra Brouwer Seminar β reduction (λx. t0) t1 t0 {t1/x} Substitution Realizing βreduction through substitution is a
More informationhas developed a specication of portions of the IEEE 854 oatingpoint standard in PVS [7]. In PVS, the injective function space injection can be dened
PVS: Combining Specication, Proof Checking, and Model Checking? To appear in CAV'96 S. Owre, S. Rajan, J. M. Rushby, N. Shankar, and M. Srivas Computer Science Laboratory, SRI International, Menlo Park
More informationWe Trusted What We Proved! Greatest Common Divisors: Theorem, Proof and Algorithm in PowerEpsilon
We Trusted What We Proved! Greatest Common Divisors: Theorem, Proof and Algorithm in PowerEpsilon MingYuan Zhu CoreTek Systems, Inc. 11 th Floor, 1109, CEC Building 6 South Zhongguancun Street Beijing
More informationCS6202: Advanced Topics in Programming Languages and Systems Lecture 0 : Overview
CS6202: Advanced Topics in Programming Languages and Systems Lecture 0 : Overview Advanced Language Features and Foundations Lecturer : Chin Wei Ngan Email : chinwn@comp.nus.edu.sg Office : S15 0601 CS6202
More informationCSCE 314 Programming Languages
CSCE 314 Programming Languages Haskell 101 Dr. Hyunyoung Lee 1 Contents 1. Historical Background of Haskell 2. Lazy, Pure, and Functional Language 3. Using ghc and ghci 4. Functions 5. Haskell Scripts
More informationInductive data types (I)
5th AsianPacific Summer School on Formal Methods August 510, 2013, Tsinghua University, Beijing, China Inductive data types (I) jeanjacques.levy@inria.fr 201386 http://sts.thss.tsinghua.edu.cn/coqschool2013
More informationAdding GADTs to OCaml the direct approach
Adding GADTs to OCaml the direct approach Jacques Garrigue & Jacques Le Normand Nagoya University / LexiFi (Paris) https://sites.google.com/site/ocamlgadt/ Garrigue & Le Normand Adding GADTs to OCaml 1
More informationBasic Elements of Computer Algebra in MIZAR
Basic Elements of Computer Algebra in MIZAR Adam Naumowicz Czeslaw Bylinski Institute of Computer Science University of Bialystok, Poland adamn@math.uwb.edu.pl Section of Computer Networks University of
More informationIntro to semantics; Smallstep semantics Lecture 1 Tuesday, January 29, 2013
Harvard School of Engineering and Applied Sciences CS 152: Programming Languages Lecture 1 Tuesday, January 29, 2013 1 Intro to semantics What is the meaning of a program? When we write a program, we use
More informationProgram certification with computational
Program certification with computational effects Burak Ekici j.w.w. JeanGuillaume Dumas, Dominique Duval, Damien Pous y LJK, University Joseph Fourier, Grenoble y LIP, ENSLyon November 5, 2014 JNCF 14,
More information15 212: Principles of Programming. Some Notes on Continuations
15 212: Principles of Programming Some Notes on Continuations Michael Erdmann Spring 2011 These notes provide a brief introduction to continuations as a programming technique. Continuations have a rich
More informationCMSC 330: Organization of Programming Languages. Lambda Calculus Encodings
CMSC 330: Organization of Programming Languages Lambda Calculus Encodings CMSC330 Spring 2018 1 The Power of Lambdas Despite its simplicity, the lambda calculus is quite expressive: it is Turing complete!
More informationNatural Semantics [14] within the Centaur system [6], and the Typol formalism [8] which provides us with executable specications. The outcome of such
A Formal Executable Semantics for Java Isabelle Attali, Denis Caromel, Marjorie Russo INRIA Sophia Antipolis, CNRS  I3S  Univ. Nice Sophia Antipolis, BP 93, 06902 Sophia Antipolis Cedex  France tel:
More information2 Introduction to operational semantics
2 Introduction to operational semantics This chapter presents the syntax of a programming language, IMP, a small language of while programs. IMP is called an "imperative" language because program execution
More information1 Introduction One of the contributions of Java is in its bytecode verier, which checks type safety of bytecode for JVM (Java Virtual Machine) prior t
On a New Method for Dataow Analysis of Java Virtual Machine Subroutines Masami Hagiya Department of Information Science, Graduate School of Science, University of Tokyo hagiyais.s.utokyo.ac.jp Abstract
More informationBeluga: A Framework for Programming and Reasoning with Deductive Systems (System Description)
Beluga: A Framework for Programming and Reasoning with Deductive Systems (System Description) Brigitte Pientka and Joshua Dunfield McGill University, Montréal, Canada {bpientka,joshua}@cs.mcgill.ca Abstract.
More informationLecture 5: The Halting Problem. Michael Beeson
Lecture 5: The Halting Problem Michael Beeson Historical situation in 1930 The diagonal method appears to offer a way to extend just about any definition of computable. It appeared in the 1920s that it
More informationInduction for Data Types
Induction for Data Types COMP1600 / COMP6260 Dirk Pattinson Australian National University Semester 2, 2017 Catch Up / Drop in Lab When Fridays, 15.0017.00 Where N335, CSIT Building (bldg 108) Until the
More informationPolymorphism. Lecture 19 CS 565 4/17/08
Polymorphism Lecture 19 CS 565 4/17/08 The Limitations of F 1 (simplytyped λ calculus) In F 1 each function works exactly for one type Example: the identity function id = λx:τ. x : τ τ We need to write
More informationComputing Fundamentals 2 Introduction to CafeOBJ
Computing Fundamentals 2 Introduction to CafeOBJ Lecturer: Patrick Browne Lecture Room: K408 Lab Room: A308 Based on work by: Nakamura Masaki, João Pascoal Faria, Prof. Heinrich Hußmann. See notes on slides
More informationFormalization of Incremental Simplex Algorithm by Stepwise Refinement
Formalization of Incremental Simplex Algorithm by Stepwise Refinement Mirko Spasić, Filip Marić Faculty of Mathematics, University of Belgrade FM2012, 30. August 2012. Overview 1 Introduction 2 Approach
More information15122: Principles of Imperative Computation (Section G)
15122: Principles of Imperative Computation (Section G) Document 2 Solutions 0. Contracts This lecture was mainly about contracts and ensuring correctness of code. Josh Zimmerman There are 4 types of
More informationAutomated Reasoning. Natural Deduction in FirstOrder Logic
Automated Reasoning Natural Deduction in FirstOrder Logic Jacques Fleuriot Automated Reasoning Lecture 4, page 1 Problem Consider the following problem: Every person has a heart. George Bush is a person.
More informationSpecification, Verification, and Interactive Proof
Specification, Verification, and Interactive Proof SRI International May 23, 2016 PVS PVS  Prototype Verification System PVS is a verification system combining language expressiveness with automated tools.
More informationTopic 3: Propositions as types
Topic 3: Propositions as types May 18, 2014 Propositions as types We have seen that the main mathematical objects in a type theory are types. But remember that in conventional foundations, as based on
More informationCMSC 330: Organization of Programming Languages
CMSC 330: Organization of Programming Languages Lambda Calculus Encodings CMSC 330 Spring 2017 1 Review A lambda calculus expression is defined as e ::= x variable λx.e abstraction (fun def) e e application
More informationFundamentals of Artificial Intelligence COMP221: Functional Programming in Scheme (and LISP)
Fundamentals of Artificial Intelligence COMP221: Functional Programming in Scheme (and LISP) Prof. Dekai Wu Department of Computer Science and Engineering The Hong Kong University of Science and Technology
More information7. Introduction to Denotational Semantics. Oscar Nierstrasz
7. Introduction to Denotational Semantics Oscar Nierstrasz Roadmap > Syntax and Semantics > Semantics of Expressions > Semantics of Assignment > Other Issues References > D. A. Schmidt, Denotational Semantics,
More informationcs242 Kathleen Fisher Reading: Concepts in Programming Languages, Chapter 6 Thanks to John Mitchell for some of these slides.
cs242 Kathleen Fisher Reading: Concepts in Programming Languages, Chapter 6 Thanks to John Mitchell for some of these slides. We are looking for homework graders. If you are interested, send mail to cs242cs.stanford.edu
More informationDependent types and program equivalence. Stephanie Weirich, University of Pennsylvania with Limin Jia, Jianzhou Zhao, and Vilhelm Sjöberg
Dependent types and program equivalence Stephanie Weirich, University of Pennsylvania with Limin Jia, Jianzhou Zhao, and Vilhelm Sjöberg What are dependent types? Types that depend on values of other types
More informationVerification of Selection and Heap Sort Using Locales
Verification of Selection and Heap Sort Using Locales Danijela Petrović September 19, 2015 Abstract Stepwise program refinement techniques can be used to simplify program verification. Programs are better
More informationClockdirected Modular Codegeneration for Synchronous Dataflow Languages
1 Clockdirected Modular Codegeneration for Synchronous Dataflow Languages Dariusz Biernacki Univ. of Worclaw (Poland) JeanLouis Colaço Prover Technologies (France) Grégoire Hamon The MathWorks (USA)
More informationOutline. Analyse et Conception Formelle. Lesson 7. Program verification methods. Disclaimer. The basics. Definition 2 (Specification)
Outline Analyse et Conception Formelle Lesson 7 Program verification methods 1 Testing 2 Modelchecking 3 Assisted proof 4 Static Analysis 5 A word about protoypes/models, accuracy, code generation T.
More informationProofProducing Synthesis of ML from HigherOrder Logic
ProofProducing Synthesis of ML from HigherOrder Logic Magnus O. Myreen Scott Owens Computer Laboratory, University of Cambridge, UK {magnus.myreen,scott.owens}@cl.cam.ac.uk Abstract The higherorder
More informationFormal Verification in Industry
Formal Verification in Industry 1 Formal Verification in Industry John Harrison Intel Corporation The cost of bugs Formal verification Machinechecked proof Automatic and interactive approaches HOL Light
More informationType Systems. Parametric Polymorphism. 1. Recall LetPolymorphism. 1. Recall LetPolymorphism. Lecture 9 Dec. 15th, 2004 Sebastian Maneth
Today Parametric Polymorphism Type Systems Lecture 9 Dec. 15th, 2004 Sebastian Maneth 1. Recall LetPolymorphism 4. System Fsub 5. Properties of Fsub http://lampwww.epfl.ch/teaching/typesystems/2004
More informationDependent types and program equivalence. Stephanie Weirich, University of Pennsylvania with Limin Jia, Jianzhou Zhao, and Vilhelm Sjöberg
Dependent types and program equivalence Stephanie Weirich, University of Pennsylvania with Limin Jia, Jianzhou Zhao, and Vilhelm Sjöberg Doing dependent types wrong without going wrong Stephanie Weirich,
More informationDeductive Program Verification with Why3
Deductive Program Verification with Why3 JeanChristophe Filliâtre CNRS Mathematical Structures of Computation Formal Proof, Symbolic Computation and Computer Arithmetic Lyon, February 2014 definition
More informationfor his support. Development of PVS was funded entirely by SRI International.
Acknowledgements. Friedrich von Henke (SRI, currently at U. of Ulm, Germany), David Cyrluk (Stanford), Judy Crow (SRI), Steven Phillips (Stanford), Carl Witty (currently at MIT), contributed to the design,
More informationProgramming and Proving in Isabelle/HOL
Tobias Nipkow Programming and Proving in Isabelle/HOL = Isabelle λ β HOL α October 8, 2017 Contents 1 Introduction............................................... 1 2 Programming and Proving.................................
More informationWeek 5 Tutorial Structural Induction
Department of Computer Science, Australian National University COMP2600 / COMP6260 Formal Methods in Software Engineering Semester 2, 2016 Week 5 Tutorial Structural Induction You should hand in attempts
More informationProgramming with (co)inductive types in Coq
Programming with (co)inductive types in Coq Matthieu Sozeau February 3rd 2014 Programming with (co)inductive types in Coq Matthieu Sozeau February 3rd 2014 Last time 1. Record Types 2. Mathematical Structures
More informationA Verified Compiler from Isabelle/HOL to CakeML
A Verified Compiler from Isabelle/HOL to CakeML Lars Hupel and Tobias Nipkow Technische Universität München lars.hupel@tum.de, nipkow@in.tum.de Abstract. Many theorem provers can generate functional programs
More informationLecture 4: Higher Order Functions
Lecture 4: Higher Order Functions Søren Haagerup Department of Mathematics and Computer Science University of Southern Denmark, Odense September 26, 2017 HIGHER ORDER FUNCTIONS The order of a function
More informationCoq Summer School, Session 2 : Basic programming with numbers and lists. Pierre Letouzey
Coq Summer School, Session 2 : Basic programming with numbers and lists Pierre Letouzey Predened data structures Predened types are actually declared to Coq at load time 1 : Inductive bool := true false.
More informationUsing Dafny, an Automatic Program Verifier
Downloaded from orbit.dtu.dk on: Nov 24, 2017 Using Dafny, an Automatic Program Verifier Herbert, Luke Thomas; Leino, K. Rustan M.; Carvalho Quaresma, Jose Nuno Publication date: 2011 Link back to DTU
More informationIntroduction to System F. Lecture 18 CS 565 4/20/09
Introduction to System F Lecture 18 CS 565 4/20/09 The Limitations of F 1 (simplytyped λ calculus) In F 1 each function works exactly for one type Example: the identity function id = λx:τ. x : τ τ We
More informationDeductive Verification in FramaC and SPARK2014: Past, Present and Future
Deductive Verification in FramaC and SPARK2014: Past, Present and Future Claude Marché (Inria & Université ParisSaclay) OSIS, FramaC & SPARK day, May 30th, 2017 1 / 31 Outline Why this joint FramaC
More informationIntroduction to Functional Programming in Haskell 1 / 56
Introduction to Functional Programming in Haskell 1 / 56 Outline Why learn functional programming? The essence of functional programming What is a function? Equational reasoning Firstorder vs. higherorder
More informationA formal derivation of an executable Krivine machine
A formal derivation of an executable Krivine machine Wouter Swierstra Universiteit Utrecht IFIP WG 2.1 Meeting 68; Rome, Italy 1 β reduction (λx. t0) t1 t0 {t1/x} 2 Motivation Implementing βreduction
More informationTopics in Software Testing
Dependable Software Systems Topics in Software Testing Material drawn from [Beizer, Sommerville] Software Testing Software testing is a critical element of software quality assurance and represents the
More informationIntroduction to the Calculus of Inductive Definitions
Introduction to the Calculus of Inductive Definitions Christine PaulinMohring 1 LRI, Univ ParisSud, CNRS and INRIA Saclay  ÎledeFrance, Toccata, Orsay F91405 Christine.Paulin@lri.fr 1 Introduction
More informationIsabelle. A Proof Assistant for HigherOrder Logic HOL. Markus Wenzel. SpringerVerlag
Tobias Nipkow Markus Wenzel Lawrence C. Paulson = Isabelle λ β HOL α A Proof Assistant for HigherOrder Logic October 8, 2017 SpringerVerlag Berlin Heidelberg NewYork London Paris Tokyo Hong Kong Barcelona
More informationConversion vs. Subtyping. Lecture #23: Conversion and Type Inference. Integer Conversions. Conversions: Implicit vs. Explicit. Object x = "Hello";
Lecture #23: Conversion and Type Inference Administrivia. Due date for Project #2 moved to midnight tonight. Midterm mean 20, median 21 (my expectation: 17.5). In Java, this is legal: Object x = "Hello";
More informationCOMP80 Lambda Calculus Programming Languages Slides Courtesy of Prof. Sam Guyer Tufts University Computer Science History Big ideas Examples:
COMP80 Programming Languages Slides Courtesy of Prof. Sam Guyer Lambda Calculus Formal system with three parts Notation for functions Proof system for equations Calculation rules called reduction Idea:
More informationMore Untyped Lambda Calculus & Simply Typed Lambda Calculus
Concepts in Programming Languages Recitation 6: More Untyped Lambda Calculus & Simply Typed Lambda Calculus Oded Padon & Mooly Sagiv (original slides by Kathleen Fisher, John Mitchell, Shachar Itzhaky,
More informationAdvances in Programming Languages
T O Y H Advances in Programming Languages APL4: JML The Java Modeling Language David Aspinall (slides originally by Ian Stark) School of Informatics The University of Edinburgh Thursday 21 January 2010
More informationSystem Description: Twelf A MetaLogical Framework for Deductive Systems
System Description: Twelf A MetaLogical Framework for Deductive Systems Frank Pfenning and Carsten Schürmann Department of Computer Science Carnegie Mellon University fp@cs.cmu.edu carsten@cs.cmu.edu
More informationDocumentoriented Prover Interaction with Isabelle/PIDE
Documentoriented Prover Interaction with Isabelle/PIDE Makarius Wenzel Univ. ParisSud, Laboratoire LRI December 2013 Project ParalITP ANR11INSE001 Abstract LCFstyle proof assistants like Coq, HOL,
More informationInheritance and Overloading in Agda
Inheritance and Overloading in Agda Paolo Capriotti 3 June 2013 Abstract One of the challenges of the formalization of mathematics in a proof assistant is defining things in such a way that the syntax
More informationHIGHERORDER ABSTRACT SYNTAX IN TYPE THEORY
HIGHERORDER ABSTRACT SYNTAX IN TYPE THEORY VENANZIO CAPRETTA AND AMY P. FELTY Abstract. We develop a general tool to formalize and reason about languages expressed using higherorder abstract syntax in
More informationAdvanced features of Functional Programming (Haskell)
Advanced features of Functional Programming (Haskell) Polymorphism and overloading January 10, 2017 Monomorphic and polymorphic types A (data) type specifies a set of values. Examples: Bool: the type of
More information