Cogent: Accurate Theorem Proving for Program Verification

Mathematical Structures in Computer Science, 2014

In this paper, aimed at dependently typed programmers, we present a novel connection between automated and interactive theorem proving paradigms. The novelty is that the connection offers a better trade-off between usability, efficiency and soundness when compared to existing techniques. This technique allows for a powerful interactive proof framework that facilitates efficient verification of finite domain theorems and guided construction of the proof of infinite domain theorems. Such situations typically occur with industrial verification. As a case study, an embedding of SAT and CTL model checking is presented, both of which have been implemented for the dependently typed proof assistant Agda.Finally, an example of a real world railway control system is presented, and shown using our proof framework to be safe with respect to an abstract model of trains not colliding or derailing. We demonstrate how to formulate safety directly and show using interactive theorem proving that sign...

Lecture Notes in Computer Science, 2014

Calculational Style of Programming, while very appealing, has several practical difficulties when done manually. Due to the large number of proofs involved, the derivations can be cumbersome and errorprone. To address these issues, we have developed automated theorem provers assisted program and formula transformation rules, which when coupled with the ability to extract context of a subformula, help in shortening and simplifying the derivations. We have implemented this approach in a Calculational Assistant for Programming from Specifications (CAPS). With the help of simple examples, we show how the calculational assistant helps in taking the drudgery out of the derivation process while ensuring correctness.

IEEE Transactions on Software Engineering, 37 (1): 109-125, 2011

We present an integrated method for program proving, testing, and debugging. Using the concept of metamorphic relations, we select necessary properties for target programs. For programs where global symbolic evaluation can be conducted and the constraint expressions involved can be solved, we can either prove that these necessary conditions for program correctness are satisfied, or identify all inputs that violate the conditions. For other programs, our method can be converted into a symbolic testing approach. Our method extrapolates from the correctness of a program for tested inputs to the correctness of the program for related untested inputs. The method supports automatic debugging through the identification of constraint expressions that reveal failures.

Journal of Automated Reasoning, 2010

Boogie is a verification condition generator for an imperative core language. It has front-ends for the programming languages C# and C enriched by annotations in first-order logic, i. e. pre-and postconditions, assertions, and loop invariants. Moreover, concepts like ghost fields, ghost variables, ghost code and specification functions have been introduced to support a specific modeling methodology. Boogie's verification conditions-constructed via a wp calculus from annotated programs-are usually transferred to automated theorem provers such as Simplify or Z3. This also comprises the expansion of language-specific modeling constructs in terms of a theory describing memory and elementary operations on it; this theory is called a machine/memory model. In this paper, we present a proof environment, HOL-Boogie, that combines Boogie with the interactive theorem prover Isabelle/HOL, for a specific C front-end and a machine/memory model. In particular, we present specific techniques combining automated and interactive proof methods for code verification. The main goal of our environment is to help program verification engineers in their task to "debug" annotations and to find combined proofs where purely automatic proof attempts fail.

2009

We describe the design and implementation of an automatic invariant generator for imperative programs. While automatic invariant generation through constraint solving has been extensively studied from a theoretical viewpoint as a classical means of program verification, in practice existing tools do not scale even to moderately sized programs. This is because the constraints that need to be solved even for small programs are already too difficult for the underlying (non-linear) constraint solving engines. To overcome this obstacle, we propose to strengthen static constraint generation with information obtained from static abstract interpretation and dynamic execution of the program. The strengthening comes in the form of additional linear constraints that trigger a series of simplifications in the solver, and make solving more scalable. We demonstrate the practical applicability of the approach by an experimental evaluation on a collection of challenging benchmark programs and comparisons with related tools based on abstract interpretation and software model checking.

Lecture Notes in Computer Science, 2000

We describe practical experiments of program verification in the frame of the Theorema system (www.theorema.org). This includes both functional programs (using fixpoint theory), as well as imperative programs (using Hoare logic). By comparing dierent approaches we are trying to find general schemes which are useful for practical work. The Theorema system oers facilities for working with higher-order predicate logic formulae (including various general and domain-oriented provers) and also for defining and testing algorithms both in functional and in imperative styles. We generate verification conditions as natural-style predicate logic formulae, which can be then proven by Theorema, by issuing natural-style proofs which are human-readable.

IEEE Transactions on Pattern Analysis and Machine Intelligence, 2000

A noninductive method for mechanical theorem proving is presented, which deals with a recursive class of theorems involving iterative functions and predicates. The method is based on the symbolic evaluation of the formula to be proved and requires no inductive step. Induction is avoided since a metatheorem is proved which establishes the conditions on the evaluation of any formula which are sufficient to assure that the formula actually holds. The proof of a supposed theorem consists in evaluating the formula and checking the conditions. The method applies to assertions that involve element-byelement checking of typed homogeneous sequences which are hierarchically constructed out of the primitive type consisting of the truth values. The sequences can be computed by means of iterative and "accumulator" functions. The paper includes the definition of a simple typed iterative language in which both predicates and functions are expressed. The language precisely defines the scope of the proof method. The method proves a wide variety of theorem$ about iterative functions on sequences, including that which states that REVERSE is its own inverse, and that it can be inversely distributed on APPEND, that FLATTEN can be distributed on APPEND and that each element of any sequence is a MEMBER of the sequence itself. Although the method is not complete, it does provide the basis for an extremely efficient tool to be used in a complete mechanical theorem prover. Index Terms-Function behavior estimate, hierarchical lemma generation, inductionless proofs, iterative functions, mechanical theorem proving, program properties, symbolic computation.

1999

This paper examines an approach to computer assisted formalreasoning in relation to functional programming. Instead of usinga generic proof tool which may di# er on some points from the functionallanguage used, a new proof tool is to be developed which is solelyintended for proving properties of programs written in one specific language. This proof tool is intended to be inserted in the Integrated DevelopmentEnvironment of the programming language, which ensures aseamless integration.

Lecture Notes in Computer Science, 2008

Boogie is a program verification condition generator for an imperative core language. It has front-ends for the programming languages C# and C enriched by annotations in first-order logic. Its verification conditions -constructed via a wp calculus from these annotations -are usually transferred to automated theorem provers such as Simplify or Z3. In this paper, however, we present a proofenvironment, HOL-Boogie, that combines Boogie with the interactive theorem prover Isabelle/HOL. In particular, we present specific techniques combining automated and interactive proof methods for codeverification. We will exploit our proof-environment in two ways: First, we present scenarios to "debug" annotations (in particular: invariants) by interactive proofs. Second, we use our environment also to verify "background theories", i.e. theories for data-types used in annotations as well as memory and machine models underlying the verification method for C.