The use of formal methods provides confidence in the correctness of developments. Yet one may argue about the actual level of confidence obtained when the method itself -- or its implementation -- is not formally checked. We address this question for the B, a widely used formal method that allows for the derivation of correct programs from specifications. Through a deep embedding of the B logic in Coq, we check the B theory but also implement B tools. Both aspects are illustrated by the description of a proved prover for the B logic.
in a proof assistant consists in mechanizing a logic by encoding its syntax and semantic into a logic ( @cite_8 @cite_5 @cite_2 ). In a embedding, the encoding is partially based on a direct translation of the guest logic into constructs of the host logic. In a embedding the syntax and the semantic are formalised as datatypes. At a fundamental level, taking the view presented in Sec. , the deep embedding of a logic is simply a definition of the set of all sequents (the terms) and a predicate marking those that are (the inference rules of the guest logic being encoded as constructors of this predicate).
@cite_5 @cite_2 @cite_8
1968724907 2071787143 1497884533 2011757033
A logic for specification and verification is derived from the axioms of Zermelo-Fraenkel set theory. The proofs are performed using the proof assistant Isabelle. Isabelle is generic, supporting several different logics. Isabelle has the flexibility to adapt to variants of set theory. Its higher-order syntax supports the definition of new binding operators. Unknowns in subgoals can be instantiated incrementally. The paper describes the derivation of rules for descriptions, relations, and functions and discusses interactive proofs of Cantor's Theorem, the Composition of Homomorphisms challenge [9], and Ramsey's Theorem [5]. A generic proof assistant can stand up against provers dedicated to particular logics. Abstract In this paper, we outline a proof procedure which combines reasoning with defined predicates together with reasoning with undefined, abducible , predicates. Defined predicates are defined in if-and-only-if form. Abducible predicates are constrained by means of integrity constraints. Given an initial query, the task of the proof procedure is to construct a definition of the abducible predicates and a substitution for the variables in the query, such that both the resulting instance of the query and the integrity constraints are implied by the extended set of definitions. The iff proof procedure can be regarded as a hybrid of the proof procedure of and the SLDNFA procedure of Denecker and De Schreye. It consists of a number of inference rules which, starting from the initial query, rewrite a formula into an equivalent formula. These rules are: 1) unfolding , which replaces an atom by its definition; 2) propagation , which resolves an atom with an implication; 3) splitting , which uses distributivity to represent a goal as a disjunction of conjunctions; 4) case analysis for an equality X = t in the conditions of an implication, which considers the two cases X = t and X ≠ t ; 5) factoring of two abducible atoms, which considers the two cases, where the atoms are identical and where they are different, 6) rewrite rules for equality , which simulate the unification algorithm; and 7) logical simplifications , such as A ∧ false ↔ false . The proof procedure is both sound and complete relative to the three-valued completion semantics. These soundness and completeness results improve previous results obtained for other proof procedures. Techniques such as verification condition generation, predicate abstraction, and expressive type systems reduce software verification to proving formulas in expressive logics. Programs and their specifications often make use of data structures such as sets, multisets, algebraic data types, or graphs. Consequently, formulas generated from verification also involve such data structures. To automate the proofs of such formulas we propose a logic (a “calculus”) of such data structures. We build the calculus by starting from decidable logics of individual data structures, and connecting them through functions and sets, in ways that go beyond the frameworks such as Nelson-Oppen. The result are new decidable logics that can simultaneously specify properties of different kinds of data structures and overcome the limitations of the individual logics. Several of our decidable logics include abstraction functions that map a data structure into its more abstract view (a tree into a multiset, a multiset into a set), into a numerical quantity (the size or the height), or into the truth value of a candidate data structure invariant (sortedness, or the heap property). For algebraic data types, we identify an asymptotic many-to-one condition on the abstraction function that guarantees the existence of a decision procedure. In addition to the combination based on abstraction functions, we can combine multiple data structure theories if they all reduce to the same data structure logic. As an instance of this approach, we describe a decidable logic whose formulas are propositional combinations of formulas in: weak monadic second-order logic of two successors, two-variable logic with counting, multiset algebra with Presburger arithmetic, the Bernays-Schonfinkel-Ramsey class of first-order logic, and the logic of algebraic data types with the set content function. The subformulas in this combination can share common variables that refer to sets of objects along with the common set algebra operations. Such sound and complete combination is possible because the relations on sets definable in the component logics are all expressible in Boolean Algebra with Presburger Arithmetic. Presburger arithmetic and its new extensions play an important role in our decidability results. In several cases, when we combine logics that belong to NP, we can prove the satisfiability for the combined logic is still in NP. Modern proof assistants such as Coq and Isabelle provide high degrees of expressiveness and assurance because they support formal reasoning in higher-order logic and supply explicit machine-checkable proof objects. Unfortunately, large scale proof development in these proof assistants is still an extremely difficult and time-consuming task. One major weakness of these proof assistants is the lack of a single language where users can develop complex tactics and decision procedures using a rich programming model and in a typeful manner. This limits the scalability of the proof development process, as users avoid developing domain-specific tactics and decision procedures. In this paper, we present VeriML - a novel language design that couples a type-safe effectful computational language with first-class support for manipulating logical terms such as propositions and proofs. The main idea behind our design is to integrate a rich logical framework - similar to the one supported by Coq - inside a computational language inspired by ML. The language design is such that the added features are orthogonal to the rest of the computational language, and also do not require significant additions to the logic language, so soundness is guaranteed. We have built a prototype implementation of VeriML including both its type-checker and an interpreter. We demonstrate the effectiveness of our design by showing a number of type-safe tactics and decision procedures written in VeriML.