## Verification Environment in Theorema

Venue: | Articles in Refereed Conference Proceedings 1. N. Popov and |

Citations: | 4 - 1 self |

### BibTeX

@INPROCEEDINGS{Kovács_verificationenvironment,

author = {Laura Ildikó Kovács and Nikolaj Popov and Tudor Jebelean},

title = {Verification Environment in Theorema},

booktitle = {Articles in Refereed Conference Proceedings 1. N. Popov and},

year = {}

}

### OpenURL

### Abstract

Abstract — We present a verification environment for imperative programs (using Hoare logic) and for functional programs (using fixpoint theory) in the frame of the Theorema system (www.theorema.org). In particular, we discuss some methods for finding the invariants of loops and specifications of auxiliary tail recursive functions. These methods use techniques from (polynomial) algebra and combinatorics, namely Groebner bases, variable elimination and symbolic summation (the Gosper algorithm, the technique of generating functions). The methods are demonstrated on several examples which have been treated automatically by our implementation. Index Terms — program analysis and verification, loop invariant generation, theorem proving, symbolic summation I.

### Citations

1486 |
A Discipline of Programming
- Dijkstra
- 1976
(Show Context)
Citation Context ...ed our method with various other examples. For instance, in the case of Fermat’s algorithm for integer factorization [17] the generated invariant is 4∗N +4∗r+2∗u−u 2 −2∗v+v 2 = 0; for LCM computation =-=[6]-=- the obtained invariant is u ∗ x + v ∗ y − 2 ∗ a ∗ b = 0; for Wensley’s algorithm for integer division the generated invariant property is −b + 1 2 ∗ d ∗ Q = 0 ∧ a ∗ d − d ∗ y ∗ Q = 0; for a more comp... |

1458 | An axiomatic basis for computer programming
- Hoare
- 1969
(Show Context)
Citation Context ...rms— program analysis and verification, loop invariant generation, theorem proving, symbolic summation I. INTRODUCTION WE present a verification environment for imperative programs (using Hoare logic =-=[14]-=-) and for functional programs (using fixpoint theory) in the frame of the Theorema system [3] (www.theorema.org). The Theorema system offers facilities for working with higher-order predicate logic fo... |

598 |
Assigning meanings to programs
- Floyd
(Show Context)
Citation Context ...f loops are considered: loops with assignments only, and then loops with conditional statements. A. Verification Environment In order to verify imperative programs, we automated the Floyd/Hoare [14], =-=[8]-=- predicate transformer method: the VCG repeatedly modifies the postcondition Q using a predicate transformer that works recursively bottomup on the program text c, finally generating a logical formula... |

584 | Dynamically discovering likely program invariants to support program evolution
- Ernst, Cockrell, et al.
- 2001
(Show Context)
Citation Context ...iques in order to realize a usable and useful verification environment. A. Related work IN the case of imperative programs, our method follows the static approach (in contrast to the dynamic approach =-=[7]-=-, [1], [5]). Because it operates on the program text, this has the advantage that the reported properties hold for any program run. We mention two main research directions in this area. One is the gen... |

556 | Concrete Mathematics
- Graham, Knuth, et al.
- 1989
(Show Context)
Citation Context ...ert as an invariant property the formula: x ≥ 1. Further Examples. We have tested our algorithm with a number of examples (see [18]). For instance, in the case of Fibonacci numbers’ computation [16], =-=[12]-=-, by applying the technique of generating functions and the Gosper algorithm, the generated invariant property is: F = (φ n−i+1 − ˆ φ n−i+1 )/ √ 5 ∧ H = (φ n−i+2 − ˆφ n−i+2 )/ √ 5, where φ = (1 + √ 5)... |

246 | Discovering models of software processes from event-based data
- Cook, Wolf
- 1998
(Show Context)
Citation Context ...rder to realize a usable and useful verification environment. A. Related work IN the case of imperative programs, our method follows the static approach (in contrast to the dynamic approach [7], [1], =-=[5]-=-). Because it operates on the program text, this has the advantage that the reported properties hold for any program run. We mention two main research directions in this area. One is the generation of... |

144 |
Decision procedure for indefinite hypergeometric summation
- Gosper
- 1978
(Show Context)
Citation Context ...ical variables. This is done by solving the recurrence equations by combinatorial methods, the concrete method being determined by the type of dependencies between the equations: the Gosper algorithm =-=[11]-=- or geometric series manipulation for independent equations, and the technique of generating functions [27] in the case of mutual dependencies. For the example 2.1, the recurrences can be solved by us... |

128 |
Differentiably finite power series
- Stanley
- 1980
(Show Context)
Citation Context ...hod being determined by the type of dependencies between the equations: the Gosper algorithm [11] or geometric series manipulation for independent equations, and the technique of generating functions =-=[27]-=- in the case of mutual dependencies. For the example 2.1, the recurrences can be solved by using the Gosper algorithm. After substitution of the initial values, the solution is: { xk = a + 1 1 − 4 sk ... |

120 |
Quantifier elimination for the elementary theory of real closed fields by cylindrical algebraic decomposition
- Collins
- 1975
(Show Context)
Citation Context ...n of our method is the necessity of manually asserting the inequalities. We are currently working on the generation of these type of invariants using the method of cylindrical algebraic decomposition =-=[4]-=-. Another further development is the use of our techniques for the purpose of loop optimizations, which may benefit from the recent methods introduced in [10] (based on loop transformations like: fusi... |

94 |
The Art of Computer Programming, volume 2
- Knuth
- 1973
(Show Context)
Citation Context ... can be automatically proven by the Theorema system. Further Examples. We have tested our method with various other examples. For instance, in the case of Fermat’s algorithm for integer factorization =-=[17]-=- the generated invariant is 4∗N +4∗r+2∗u−u 2 −2∗v+v 2 = 0; for LCM computation [6] the obtained invariant is u ∗ x + v ∗ y − 2 ∗ a ∗ b = 0; for Wensley’s algorithm for integer division the generated i... |

90 | Powerful techniques for the automatic generation of invariants
- Bensalem, Lakhnech, et al.
- 1996
(Show Context)
Citation Context ...eported properties hold for any program run. We mention two main research directions in this area. One is the generation of invariants using abstract interpretations, widening and narrowing. In [28], =-=[2]-=- linear invariants are generated by computing under- and overapproximations of the reachable state set, using refined2 ANNALS OF MATHEMATICS, COMPUTING & TELEINFORMATICS, VOL 1, NO 3, 2005, PP XX-YY ... |

73 |
The Foundations of Program Verification
- Loeckx, Sieber
- 1987
(Show Context)
Citation Context ...ter fixing apriori the degree of a generic polynomial template. Our approach does not need such apriori hypotheses. Concerning verification of functional programs, the main approaches (see e.g. [20], =-=[19]-=-) do not deal with the problem of unspecified functions. Our method also differs from the ones used in program verification tools, which are either not dealing with recursion over the reals, or they n... |

62 |
Theorema: Towards computeraided mathematical theory exploration
- Buchberger, Craciun, et al.
(Show Context)
Citation Context ...ummation I. INTRODUCTION WE present a verification environment for imperative programs (using Hoare logic [14]) and for functional programs (using fixpoint theory) in the frame of the Theorema system =-=[3]-=- (www.theorema.org). The Theorema system offers facilities for working with higher-order predicate logic formulae (including various general and domain-oriented provers). Our work aims to enhance the ... |

56 |
The Mathematica Book, 3rd ed
- Wolfram
- 1996
(Show Context)
Citation Context ... Obtain automatically the postcondition OA of A, based on solving coupled linear recursive sequences with constant coefficients (see e.g. [12], Chapter 7). The later one is implemented in Mathematica =-=[29]-=-. In more details, this is done by solving first the recurrences: { xn = a1xn−1 + b1yn−1 + c1 , (15) yn = a2xn−1 + b2yn−1 + c2 and obtaining a closed form of xn and yn depending on x0, y0, a1, b1, c1,... |

31 | A technique for invariant generation
- Tiwari, Rue, et al.
(Show Context)
Citation Context ... the reported properties hold for any program run. We mention two main research directions in this area. One is the generation of invariants using abstract interpretations, widening and narrowing. In =-=[28]-=-, [2] linear invariants are generated by computing under- and overapproximations of the reachable state set, using refined2 ANNALS OF MATHEMATICS, COMPUTING & TELEINFORMATICS, VOL 1, NO 3, 2005, PP X... |

30 | Testing using Log File Analysis: Tools, Methods, and Issues
- Andrews
- 1998
(Show Context)
Citation Context ... in order to realize a usable and useful verification environment. A. Related work IN the case of imperative programs, our method follows the static approach (in contrast to the dynamic approach [7], =-=[1]-=-, [5]). Because it operates on the program text, this has the advantage that the reported properties hold for any program run. We mention two main research directions in this area. One is the generati... |

30 | Automatic generation of polynomial loop invariants: Algebraic foundations
- Rodriguez-Carbonell, Kapur
- 2004
(Show Context)
Citation Context ...es. However, in these cases our method is able to generate non-linear generate invariants also. An alternative to the abstract interpretation strategy is the approach of using Groebner bases in [26], =-=[25]-=-, [21]. Here, the invariant generation problem is translated to a (linear or non–linear) constraint solving problem, after fixing apriori the degree of a generic polynomial template. Our approach does... |

23 | Polynomial Constants are Decidable
- Müller-Olm, Seidl
- 2002
(Show Context)
Citation Context ...wever, in these cases our method is able to generate non-linear generate invariants also. An alternative to the abstract interpretation strategy is the approach of using Groebner bases in [26], [25], =-=[21]-=-. Here, the invariant generation problem is translated to a (linear or non–linear) constraint solving problem, after fixing apriori the degree of a generic polynomial template. Our approach does not n... |

16 |
Program verification with the mathematical software system Theorema
- Kirchner
- 1999
(Show Context)
Citation Context ...to assert as an invariant property the formula: x ≥ 1. Further Examples. We have tested our algorithm with a number of examples (see [18]). For instance, in the case of Fibonacci numbers’ computation =-=[16]-=-, [12], by applying the technique of generating functions and the Gosper algorithm, the generated invariant property is: F = (φ n−i+1 − ˆ φ n−i+1 )/ √ 5 ∧ H = (φ n−i+2 − ˆφ n−i+2 )/ √ 5, where φ = (1 ... |

10 | Experimental Program Verification in the Theorema System
- Jebelean, Kovács, et al.
(Show Context)
Citation Context ...gnments, loops, and conditionals (see next example). The construct Module declares the local variables and the program text. B. Loops with Assignments Only We proceed as follows (for more details see =-=[15]-=-): • Extract from the loop body the recursive assignments of the loop variables that are changed during the execution of the loop (critical variables). For the example 2.1, these are: • • { xk+1 = xk ... |

6 |
Verification of Simple Recursive Programs: Sufficient Conditions
- Popov
- 2004
(Show Context)
Citation Context ...nts). The specification is then used for generating the verification conditions for both the auxiliary and the main functions, using the technique previously developed by the authors (see e. g. [24], =-=[22]-=-). This technique is based on the fixpoint theory [20], however the verification conditions (including the termination condition) are first order predicate logic formulae relative only to the theory w... |

5 |
Using combinatorial and algebraic techniques for automatic generation of loop invariants
- Kovacs
- 2005
(Show Context)
Citation Context ...using the option Assert). In the case of example 2.1, the user has to assert as an invariant property the formula: x ≥ 1. Further Examples. We have tested our algorithm with a number of examples (see =-=[18]-=-). For instance, in the case of Fibonacci numbers’ computation [16], [12], by applying the technique of generating functions and the Gosper algorithm, the generated invariant property is: F = (φ n−i+1... |

4 |
Nonlinear Loop Invariant Generation using Groebner Bases
- Sankaranaryanan, Henry, et al.
- 2004
(Show Context)
Citation Context ...operties. However, in these cases our method is able to generate non-linear generate invariants also. An alternative to the abstract interpretation strategy is the approach of using Groebner bases in =-=[26]-=-, [25], [21]. Here, the invariant generation problem is translated to a (linear or non–linear) constraint solving problem, after fixing apriori the degree of a generic polynomial template. Our approac... |

3 |
PVS Specification and Verification System. http: //pvs.csl.sri.com
- group
- 2004
(Show Context)
Citation Context ...es used in program verification tools, which are either not dealing with recursion over the reals, or they need explicitly to use the specification of the program and the termination term (e.g. PVS – =-=[13]-=-). II. IMPERATIVE PROGRAM VERIFICATION WE generate invariants for loops and use them for producing verification conditions using the weakest precondition strategy. Two cases of loops are considered: l... |

3 | A Practical Approach to Proving Termination of Recursive Programs in Theorema
- Popov, Jebelean
- 2004
(Show Context)
Citation Context ...fficients). The specification is then used for generating the verification conditions for both the auxiliary and the main functions, using the technique previously developed by the authors (see e. g. =-=[24]-=-, [22]). This technique is based on the fixpoint theory [20], however the verification conditions (including the termination condition) are first order predicate logic formulae relative only to the th... |

2 | Verification of Simple Recursive Programs in Theorema: Completeness of the Method
- Popov
- 2005
(Show Context)
Citation Context ...arguments which satisfy the respective precondition); (b) the ones which insure that the output of the main function satisfies the postcondition; (c) the termination condition. Furthermore we show in =-=[23]-=- that, for programs satisfying (a), the conditions (b) and (c) are also necessary for total correctness. (We call this completeness of the method.) In the current paper we approach the situation (ofte... |