The use of general descriptive names, registered names, trademarks, etc. in this publication does... more The use of general descriptive names, registered names, trademarks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.
In Smullyan's classic book, First-Order Logic , the notion of a Boolean valuation is central in m... more In Smullyan's classic book, First-Order Logic , the notion of a Boolean valuation is central in motivating his analytical tableau proof system. Smullyan shows that these valuations are unique if they exist, and then he sketches an existence proof. In addition he suggests a possible computational procedure for finding a Boolean valuation, but it is not related to to the existence proof. A computer scientist would like to see the obvious explicit recursive algorithm for evaluating propositional formulas and a demonstration that the algorithm has the properties of a Boolean valuation. Ideally, the algorithm would be derived from the existence proof. It turns out to be unexpectedly difficult to find a natural existence proof from which the algorithm can be extracted, and it turns out that the implicit computational content of Smullyan's argument is not found where one might expect it. We show that using the notion of a very dependent function type, it is possible to specify the Boolean valuation and prove its existence constructively so that the natural recursive algorithm is extracted and is known to have the mathematically required properties by virtue of its construction. We illustrate all of these points using the Nuprl proof development system .
Proceedings 21st International Conference on Distributed Computing Systems Workshops
As we see a growing variety of network and application behaviors, it becomes more important that ... more As we see a growing variety of network and application behaviors, it becomes more important that protocols adapt to their surroundings. Building adaptive protocols is complicated, and therefore we have considered building hybrid protocols that switch between specialized protocols. In this paper, we show for which communication properties this is a correct solution, and classify these using a new concept called meta-properties. We also show how well these switches perform.
Proceedings DARPA Information Survivability Conference and Exposition II. DISCEX'01, 2001
Formal methods tools have greatly influenced our ability to increase the reliability of software ... more Formal methods tools have greatly influenced our ability to increase the reliability of software and hardware systems by revealing errors and clarifying critical concepts. In this article we show how a rich specification language and a theorem prover for it have contributed to the design and implementation of verifiably correct adaptive protocols. The protocol building team included experts in formal methods who were able to use the theorem prover to help guide protocol construction at the pace of implementation that is not formally assisted. This example shows that formal methods can have a large impact when being engaged at the earliest stages of design and implementation, because they add value to all subsequent stages, including the creation of informative documentation needed for the maintenance and evolution of software.
In computer science we speak of implementing a logic; this is done in a programming language, suc... more In computer science we speak of implementing a logic; this is done in a programming language, such as Lisp, called here the implementation language. We also reason about the logic, as in understanding how to search for proofs; these arguments are expressed in the metalanguage and conducted in the metalogic of the object language being implemented. We also reason about the implementation itself, say to know it is correct; this is done in a programming logic. How do all these logics relate? This paper considers that question and more. We show that by taking the view that the metalogic is primary, these other parts are related in standard ways. The metalogic should be suitably rich so that the object logic can be presented as an abstract data type, and it must be suitably computational (or constructive) so that an instance of that type is an implementation. The data type abstractly encodes all that is relevant for metareasoning, i.e., not only the term constructing functions but also t...
We illustrate the effectiveness of proof transformations which expose the computational content o... more We illustrate the effectiveness of proof transformations which expose the computational content of classical proofs even in cases where it is not apparent. We state without proof a theorem that these transformations apply to proofs in a fragment of type theory and discuss their implementation in Nuprl. We end with a discussion of the applications to Higman's lemma [13, 21, 10] by the second author using the implemented system.
This manual describes the first prototype of a new kind of system which we call a Formal Digital ... more This manual describes the first prototype of a new kind of system which we call a Formal Digital Library (FDL). We designed the system and assembled the prototype as part of a research project sponsored by the Office of Naval Research entitled ... Building Interactive Digital ...
Attack-tolerant distributed systems change their protocols on-the-fly in response to apparent att... more Attack-tolerant distributed systems change their protocols on-the-fly in response to apparent attacks from the environment; they substitute functionally equivalent versions possibly more resistant to detected threats. Alternative protocols can be packaged together as a single adaptive protocol or variants from a formal protocol library can be sent to threatened groups of processes. We are experimenting with libraries of attacktolerant protocols that are correct-by-construction and testing them in environments that simulate specified threats, including constructive versions of the famous FLP imaginary adversary against fault-tolerant consensus. We expect that all variants of tolerant protocols are automatically generated and accompanied by machine checked proofs that the generated code satisfies formal properties.
Abstract We present a constructive formalization of the Myhill-Nerode the-orem on the minimizatio... more Abstract We present a constructive formalization of the Myhill-Nerode the-orem on the minimization of nite automata that follows the account in Hopcroft and Ullman's book Formal Languages and Their Relation to Automata. We chose to formalize this theorem because it illustrates ...
The use of general descriptive names, registered names, trademarks, etc. in this publication does... more The use of general descriptive names, registered names, trademarks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.
In Smullyan's classic book, First-Order Logic , the notion of a Boolean valuation is central in m... more In Smullyan's classic book, First-Order Logic , the notion of a Boolean valuation is central in motivating his analytical tableau proof system. Smullyan shows that these valuations are unique if they exist, and then he sketches an existence proof. In addition he suggests a possible computational procedure for finding a Boolean valuation, but it is not related to to the existence proof. A computer scientist would like to see the obvious explicit recursive algorithm for evaluating propositional formulas and a demonstration that the algorithm has the properties of a Boolean valuation. Ideally, the algorithm would be derived from the existence proof. It turns out to be unexpectedly difficult to find a natural existence proof from which the algorithm can be extracted, and it turns out that the implicit computational content of Smullyan's argument is not found where one might expect it. We show that using the notion of a very dependent function type, it is possible to specify the Boolean valuation and prove its existence constructively so that the natural recursive algorithm is extracted and is known to have the mathematically required properties by virtue of its construction. We illustrate all of these points using the Nuprl proof development system .
Proceedings 21st International Conference on Distributed Computing Systems Workshops
As we see a growing variety of network and application behaviors, it becomes more important that ... more As we see a growing variety of network and application behaviors, it becomes more important that protocols adapt to their surroundings. Building adaptive protocols is complicated, and therefore we have considered building hybrid protocols that switch between specialized protocols. In this paper, we show for which communication properties this is a correct solution, and classify these using a new concept called meta-properties. We also show how well these switches perform.
Proceedings DARPA Information Survivability Conference and Exposition II. DISCEX'01, 2001
Formal methods tools have greatly influenced our ability to increase the reliability of software ... more Formal methods tools have greatly influenced our ability to increase the reliability of software and hardware systems by revealing errors and clarifying critical concepts. In this article we show how a rich specification language and a theorem prover for it have contributed to the design and implementation of verifiably correct adaptive protocols. The protocol building team included experts in formal methods who were able to use the theorem prover to help guide protocol construction at the pace of implementation that is not formally assisted. This example shows that formal methods can have a large impact when being engaged at the earliest stages of design and implementation, because they add value to all subsequent stages, including the creation of informative documentation needed for the maintenance and evolution of software.
In computer science we speak of implementing a logic; this is done in a programming language, suc... more In computer science we speak of implementing a logic; this is done in a programming language, such as Lisp, called here the implementation language. We also reason about the logic, as in understanding how to search for proofs; these arguments are expressed in the metalanguage and conducted in the metalogic of the object language being implemented. We also reason about the implementation itself, say to know it is correct; this is done in a programming logic. How do all these logics relate? This paper considers that question and more. We show that by taking the view that the metalogic is primary, these other parts are related in standard ways. The metalogic should be suitably rich so that the object logic can be presented as an abstract data type, and it must be suitably computational (or constructive) so that an instance of that type is an implementation. The data type abstractly encodes all that is relevant for metareasoning, i.e., not only the term constructing functions but also t...
We illustrate the effectiveness of proof transformations which expose the computational content o... more We illustrate the effectiveness of proof transformations which expose the computational content of classical proofs even in cases where it is not apparent. We state without proof a theorem that these transformations apply to proofs in a fragment of type theory and discuss their implementation in Nuprl. We end with a discussion of the applications to Higman's lemma [13, 21, 10] by the second author using the implemented system.
This manual describes the first prototype of a new kind of system which we call a Formal Digital ... more This manual describes the first prototype of a new kind of system which we call a Formal Digital Library (FDL). We designed the system and assembled the prototype as part of a research project sponsored by the Office of Naval Research entitled ... Building Interactive Digital ...
Attack-tolerant distributed systems change their protocols on-the-fly in response to apparent att... more Attack-tolerant distributed systems change their protocols on-the-fly in response to apparent attacks from the environment; they substitute functionally equivalent versions possibly more resistant to detected threats. Alternative protocols can be packaged together as a single adaptive protocol or variants from a formal protocol library can be sent to threatened groups of processes. We are experimenting with libraries of attacktolerant protocols that are correct-by-construction and testing them in environments that simulate specified threats, including constructive versions of the famous FLP imaginary adversary against fault-tolerant consensus. We expect that all variants of tolerant protocols are automatically generated and accompanied by machine checked proofs that the generated code satisfies formal properties.
Abstract We present a constructive formalization of the Myhill-Nerode the-orem on the minimizatio... more Abstract We present a constructive formalization of the Myhill-Nerode the-orem on the minimization of nite automata that follows the account in Hopcroft and Ullman's book Formal Languages and Their Relation to Automata. We chose to formalize this theorem because it illustrates ...
Uploads
Papers by R. Constable