## Proof styles in operational semantics (2004)

### Cached

### Download Links

- [www.cs.utexas.edu]
- [www.cs.utexas.edu]
- [www.cs.utexas.edu]
- [www.cs.utexas.edu]
- DBLP

### Other Repositories/Bibliography

Venue: | Proceedings of the 5th International Conference on Formal Methods in Computer-Aided Design (FMCAD 2004), volume 3312 of LNCS |

Citations: | 9 - 5 self |

### BibTeX

@INPROCEEDINGS{Ray04proofstyles,

author = {Ip Ray and J Strother Moore},

title = {Proof styles in operational semantics},

booktitle = {Proceedings of the 5th International Conference on Formal Methods in Computer-Aided Design (FMCAD 2004), volume 3312 of LNCS},

year = {2004},

pages = {67--81},

publisher = {Springer-Verlag}

}

### OpenURL

### Abstract

Abstract. We relate two well-studied methodologies in deductive verification of operationally modeled sequential programs, namely the use of inductive invariants and clock functions. We show that the two methodologies are equivalent and one can mechanically transform a proof of a program in one methodology to a proof in the other. Both partial and total correctness are considered. This mechanical transformation is compositional; different parts of a program can be verified using different methodologies to achieve a complete proof of the entire program. The equivalence theorems have been mechanically checked by the ACL2 theorem prover and we implement automatic tools to carry out the transformation between the two methodologies in ACL2.

### Citations

1377 | An axiomatic basis for computer programming - Hoare - 1969 |

570 | Assigning meaning to programs - Floyd - 1967 |

539 | PVS: A prototype verification system
- Owre, Rushby
- 1992
(Show Context)
Citation Context ...nt proof transformation tools we implement, are of practical value in simplifying ACL2 proofs of large-scale programs. Our work can be easily adapted to any other mechanized logic like HOL [7] or PVS =-=[8]-=-, that is expressive enough to specify arbitrary first-order formulas, and analogous tools for proof transformation can be implemented for theorem provers in such logics. The remainder of this paper i... |

532 |
A Computational Logic
- Boyer, Moore
- 1979
(Show Context)
Citation Context ...l Axiom: (fact n) = (if (zp n) 1 (* n (fact (- n 1)))) Here (zp n) returns nil if n is a positive natural number, and otherwise T. To ensure consistency, ACL2 must prove that the recursion terminates =-=[12]-=-. In particular, one must exhibit a “measure” m that maps the set of arguments in the function to some set W , where 〈W, ≺〉 forms a well-founded structure. The proof obligation, then, is to show that ... |

264 |
Computer-Aided Reasoning: An Approach
- Kaufmann, Monolios, et al.
- 2000
(Show Context)
Citation Context ...y describe the ACL2 logic. This provides a formal notational and reasoning framework to be used in the rest of the paper. Full details of the ACL2 logic and its theorem proving engine can be found in =-=[9, 10]-=-. ACL2 is essentially a first-order logic of recursive functions. The inference rules constitute propositional calculus with equality and instantiation, and wellfounded induction up to ɛ0. The languag... |

161 | Towards a Mathematical Science of Computation
- McCarthy
- 1962
(Show Context)
Citation Context ...in a final state satisfying some desired “postcondition”. Deductive verification of sequential programs has traditionally used one of two reasoning strategies, namely the inductive invariant approach =-=[1]-=-, and the clock functions or direct approach [2] respectively. While both the strategies guarantee correctness, to our knowledge no formal analysis has been performed on whether the theorems proved us... |

58 |
eds.): Introduction to HOL: a theorem proving environment for higher order logic
- Gordon, Melham
- 1993
(Show Context)
Citation Context ...he consequent proof transformation tools we implement, are of practical value in simplifying ACL2 proofs of large-scale programs. Our work can be easily adapted to any other mechanized logic like HOL =-=[7]-=- or PVS [8], that is expressive enough to specify arbitrary first-order formulas, and analogous tools for proof transformation can be implemented for theorem provers in such logics. The remainder of t... |

49 | Structured theory development for a mechanized logic
- Kaufmann, Moore
(Show Context)
Citation Context ...uce total functions, (ii) the encapsulation principle to introduce constrained functions, and (iii) the defchoose principle to introduce Skolem functions. We briefly sketch these principles here. See =-=[11]-=- for a detailed description of these principles along with soundness arguments.sDefinitional Principle: The definitional principle allows the user to define new total functions in the logic. For examp... |

30 | A Verified Operating System Kernel - Bevier - 1987 |

28 | Mechanized formal reasoning about programs and computing machines
- Boyer, Moore
- 1996
(Show Context)
Citation Context ...ndition”. Deductive verification of sequential programs has traditionally used one of two reasoning strategies, namely the inductive invariant approach [1], and the clock functions or direct approach =-=[2]-=- respectively. While both the strategies guarantee correctness, to our knowledge no formal analysis has been performed on whether the theorems proved using one strategy are in any sense stronger than ... |

26 | Inductive assertions and operational semantics
- Moore
- 2003
(Show Context)
Citation Context ...d, the notion of invariants we use is tied to an operational view, and cannot be formally reconciled with the denotational approach without an extra-logical verification condition generator. However, =-=[18]-=- gives a way of proving partial correctness using inductive invariants incurring exactly the proof obligations for a denotational approach. Consequently, this work shows that clock functions can be de... |

22 | A verified code generator for a subset of Gypsy - Young - 1988 |

21 | Executable JVM model for analytical reasoning: a study
- Liu, Moore
- 2003
(Show Context)
Citation Context ...n used in ACL2 (and other theorem provers) for modeling complex programs in practical systems. For example, formal models of programs in the Java TM Virtual Machine (JVM) have been formalized in ACL2 =-=[3, 13]-=-. Operational models accurately reflecting the details of practical computing systems are elaborate and complex; however such elaborations are not of our concern in this paper. For this presentation, ... |

19 | Proving theorems about Java and the JVM with ACL2
- Moore
- 2003
(Show Context)
Citation Context ...s argument for total correctness. Proofs involving clock functions typically require induction on the length of the execution. However, the definition of clock follows the control flow of the program =-=[2, 3]-=-; a user familiar with the branches and loops of a program can often define clock with relative ease, and the definition of clock provides a hint on the induction to be used in proving the correctness... |

19 | Cuarded commands, nondeterminacy and a calculus for the derivation of programs - Dijkstra - 1975 |

18 | A verified implementation of an applicative language with dynamic storage allocation - Flatau - 1992 |

10 |
Deductive Verification of Pipelined Machines Using First-Order Quantification
- Ray, Jr
- 2004
(Show Context)
Citation Context ...ists”, and use the witness as the specific p to reason about. We and others have found this convenient in diverse contexts, in formalizing weakest precondition, and reasoning about pipelined machines =-=[19]-=-. Acknowledgements The authors benefitted from discussions with the ACL2 group at UT Austin. We particularly thank Jeff Golden, Matt Kaufmann, RobertsKrug, Erik Reeber, Rob Sumners, and Vinod Vishwana... |

7 | Robust computer system proofs in PVS
- Wilding
- 1997
(Show Context)
Citation Context ...n Boyer-Moore theorem provers, clock functions have found greater success, at least for total correctness proofs. Similar proofs have been done using other theorem provers too, though less frequently =-=[14]-=-. We do not advocate one proof style over another. Our goal is to allow the possibility of going “back and forth” between the two styles; thus a program component can be verified using the strategy th... |