## Automatic Proof and Disproof in Isabelle/HOL (2011)

Citations: | 3 - 1 self |

### BibTeX

@MISC{Blanchette11automaticproof,

author = {Jasmin Christian Blanchette and Lukas Bulwahn and Tobias Nipkow},

title = {Automatic Proof and Disproof in Isabelle/HOL},

year = {2011}

}

### OpenURL

### Abstract

Isabelle/HOL is a popular interactive theorem prover based on higherorder logic. It owes its success to its ease of use and powerful automation. Much of the automation is performed by external tools: The metaprover Sledgehammer relies on resolution provers and SMT solvers for its proof search, the counterexample generator Quickcheck uses the ML compiler as a fast evaluator for ground formulas, and its rival Nitpick is based on the model finder Kodkod, which performs a reduction to SAT. Together with the Isar structured proof format and a new asynchronous user interface, these tools have radically transformed the Isabelle user experience. This paper provides an overview of the main automatic proof and disproof tools.

### Citations

795 |
Isabelle/HOL: A Proof Assistant for Higher-Order Logic, volume 2283
- Nipkow, Paulson, et al.
- 2002
(Show Context)
Citation Context ...d the Isabelle user experience. This paper provides an overview of the main automatic proof and disproof tools. 1 Introduction In the tradition of LCF-style interactive theorem provers [21], Isabelle =-=[35]-=- has long emphasized tactics: functions written in ML that operate on the proof state via a trusted inference kernel. Tactics discharge a proof goal directly or, more often, break it down into one or ... |

770 | Symbolic model checking without BDDs
- Biere, Cimatti, et al.
- 1999
(Show Context)
Citation Context ...e soundly replaced by a fresh constant q satisfying the axiom q = F q. For the remaining positive occurrences of p, Nitpick unrolls the predicate a given number of times, as in bounded model checking =-=[4]-=-. The situation is mirrored for coinductive predicates: Positive occurrences are coded using the fixed-point equation, and negative occurrences are unrolled. 5.4 Encoding of (Co)inductive Datatypes In... |

475 | Z3: An efficient SMT solver
- Moura, Bjørner
- 2008
(Show Context)
Citation Context ...em to first-order logic along with the conjecture, and delegates the proof search to external 3resolution provers (E [48], SPASS [56], and Vampire [44]) and SMT solvers (CVC3 [2], Yices [16], and Z3 =-=[33]-=-). Sledgehammer is very effective [9] and has achieved great popularity with users, novices and experts alike. 3.1 Relevance Filtering Most automatic provers perform poorly in the presence of thousand... |

336 |
Software Abstractions Logic, Language, and Analysis
- Jackson
- 2006
(Show Context)
Citation Context ...atypes as well as recursive and corecursive functions, are treated specially to ensure efficient SAT solving. The actual reduction to SAT is performed by the Kodkod library [53] (the Alloy Analyzer’s =-=[25]-=- backend). With so many tools at their disposal, users run the risk of forgetting to invoke them at the right point; this is especially true for the counterexample generators, given that humans have a... |

329 | QuickCheck: a lightweight tool for random testing of Haskell programs
- Claessen, Hughes
- 2000
(Show Context)
Citation Context ...he main ones are Quickcheck (Section 4) and Nitpick (Section 5). Quickcheck [3] combines Isabelle’s code generation infrastructure with random testing, in the style of the QuickCheck tool for Haskell =-=[14]-=-. It analyses the definitions of inductively defined predicates to generate values that satisfies them by construction [11] and has recently been extended with exhaustive testing and narrowing. A radi... |

285 |
ComputerAided Reasoning: An Approach
- Kaufmann, Manolios, et al.
- 2000
(Show Context)
Citation Context ...d. 2 Standard Proof Methods Isabelle provides the user with an array of general-purpose proof methods that perform proof search. We discuss the most important ones. 2.1 Simplification Just as in ACL2 =-=[26]-=-, simplification is the main workhorse in Isabelle. It performs conditional, contextual rewriting with a number of hooks for customizations: – Pattern-driven simplification procedures that derive and ... |

181 |
The Design and Implementation of Vampire
- Riazanov, Voronkov
- 2002
(Show Context)
Citation Context ... or axioms) from Isabelle’s libraries, translates them to first-order logic along with the conjecture, and delegates the proof search to external 3resolution provers (E [48], SPASS [56], and Vampire =-=[44]-=-) and SMT solvers (CVC3 [2], Yices [16], and Z3 [33]). Sledgehammer is very effective [9] and has achieved great popularity with users, novices and experts alike. 3.1 Relevance Filtering Most automati... |

93 | Combining superposition, sorts and splitting
- Weidenbach
- 2001
(Show Context)
Citation Context ...mmas, definitions, or axioms) from Isabelle’s libraries, translates them to first-order logic along with the conjecture, and delegates the proof search to external 3resolution provers (E [48], SPASS =-=[56]-=-, and Vampire [44]) and SMT solvers (CVC3 [2], Yices [16], and Z3 [33]). Sledgehammer is very effective [9] and has achieved great popularity with users, novices and experts alike. 3.1 Relevance Filte... |

88 |
C.P.: Edinburgh LCF: A Mechanised Logic
- Gordon, Milner, et al.
- 1979
(Show Context)
Citation Context ...ally transformed the Isabelle user experience. This paper provides an overview of the main automatic proof and disproof tools. 1 Introduction In the tradition of LCF-style interactive theorem provers =-=[21]-=-, Isabelle [35] has long emphasized tactics: functions written in ML that operate on the proof state via a trusted inference kernel. Tactics discharge a proof goal directly or, more often, break it do... |

74 | Type classes and overloading in higher-order logic
- Wenzel
- 1997
(Show Context)
Citation Context ...ith large axiom bases than others, that number was optimized independently for each prover. 3.2 Translation to First-Order Logic Isabelle’s formalism, polymorphic higher-order logic with type classes =-=[59]-=-, is much richer than the first-order logics supported by the automatic provers. Sledgehammer relies on different translations depending on the class of prover [6, 31]. For resolution provers, standar... |

65 | Kodkod: A relational model finder
- Torlak, Jackson
- 2007
(Show Context)
Citation Context ...nductive predicates and datatypes as well as recursive and corecursive functions, are treated specially to ensure efficient SAT solving. The actual reduction to SAT is performed by the Kodkod library =-=[53]-=- (the Alloy Analyzer’s [25] backend). With so many tools at their disposal, users run the risk of forgetting to invoke them at the right point; this is especially true for the counterexample generator... |

62 |
Melham, eds., Introduction to HOL: A Theorem Proving Environment for Higher Order Logic
- Gordon, F
- 1993
(Show Context)
Citation Context ...proof methods. Much effort has been devoted to developing general-purpose proof methods (or tactics) that work equally well on all object logics supported by Isabelle, notably higherorder logic (HOL) =-=[20]-=- and Zermelo–Fraenkel set theory (ZF) [37, 38]. The most important methods are the simplifier, which rewrites the goal using equations as oriented rewrite rules, and the tableau prover (Section 2). Th... |

51 | First-Order Proof Tactics in Higher-Order Logic Theorem Provers
- Hurd
- 2003
(Show Context)
Citation Context ... but is no match for the best automatic provers. Nor does it know about simplification, which is a great loss. Taking this one step further, Metis is a resolution theorem prover written in ML by Hurd =-=[24]-=-. Metis is sufficiently capable that it is a respectable competitor at CASC [51]. It has been ported to Isabelle and follows the same philosophy as blast: The proof search is performed directly in ML,... |

48 | Set theory for verification: I. From foundations to functions
- Paulson
- 1993
(Show Context)
Citation Context ...d to developing general-purpose proof methods (or tactics) that work equally well on all object logics supported by Isabelle, notably higherorder logic (HOL) [20] and Zermelo–Fraenkel set theory (ZF) =-=[37, 38]-=-. The most important methods are the simplifier, which rewrites the goal using equations as oriented rewrite rules, and the tableau prover (Section 2). These are complemented by specialized decision p... |

45 | Set theory for verification: II. Induction and recursion
- Paulson
- 1995
(Show Context)
Citation Context ...d to developing general-purpose proof methods (or tactics) that work equally well on all object logics supported by Isabelle, notably higherorder logic (HOL) [20] and Zermelo–Fraenkel set theory (ZF) =-=[37, 38]-=-. The most important methods are the simplifier, which rewrites the goal using equations as oriented rewrite rules, and the tableau prover (Section 2). These are complemented by specialized decision p... |

42 | Random testing in isabelle/hol
- Berghofer, Nipkow
- 2004
(Show Context)
Citation Context ...o make proving more enjoyable and productive, Isabelle includes counterexample generators that complement the proof tools. The main ones are Quickcheck (Section 4) and Nitpick (Section 5). Quickcheck =-=[3]-=- combines Isabelle’s code generation infrastructure with random testing, in the style of the QuickCheck tool for Haskell [14]. It analyses the definitions of inductively defined predicates to generate... |

32 | A brief overview of HOL4
- Slind, Norrish
- 2008
(Show Context)
Citation Context ... Related Work Isabelle is not the only interactive theorem prover that provides a palette of automatic proof and disproof tools. We briefly review what the other popular provers have to offer. – HOL4 =-=[20, 49]-=- includes the original version of Metis [24] and an integration of SMT solvers [55] with proof reconstruction for Z3 [10]. – PVS includes a Quickcheck-like random testing tool [36] and integrates the ... |

30 | L.C.: Lightweight relevance filtering for machine-generated resolution problems
- Meng, Paulson
- 2009
(Show Context)
Citation Context ... popularity with users, novices and experts alike. 3.1 Relevance Filtering Most automatic provers perform poorly in the presence of thousands of axioms. Sledgehammer employs a simple relevance filter =-=[32]-=- to extract a few hundred facts from Isabelle’s libraries that seem relevant to the problem at hand. Despite its simplicity, this filter greatly improves Sledgehammer’s success rate. The filter works ... |

30 | TSTP Data-Exchange Formats for Automated Theorem Proving Tools
- Sutcliffe, Zimmer, et al.
(Show Context)
Citation Context ...f reconstruction and minimization. Two instances of the relevance filter are run, to account for different sets of built-in constants. The relevant facts and the conjecture are translated to the TPTP =-=[52]-=- or SMT version of first-order logic, and the resulting problems are passed to the provers. The translation for Z3 is done slightly differently than for CVC3 and Yices to profit from Z3’s support for ... |

29 | Functional logic programming
- Antoy, Hanus
- 2010
(Show Context)
Citation Context ... refine these terms as needed. Technically, this can be achieved in at least three different ways: 1. Target a language that natively supports narrowing, such as the functional-logical language Curry =-=[1]-=-, instead of ML. 2. Simulate narrowing by generating a functional program that includes its own refinement algorithm [46]. 3. Simulate narrowing by embedding the narrowing-based execution with a libra... |

28 | L.C.: Translating higher-order clauses to first-order clauses
- Meng, Paulson
- 2008
(Show Context)
Citation Context ...y, in practice Metis calls are almost always generated by Sledgehammer for reconstructing external resolution proofs (Section 3.4). 3 Sledgehammer: Proof Discovery Using External Provers Sledgehammer =-=[31, 42]-=- is Isabelle’s subsystem for harnessing the power of first-order automatic theorem provers. Given a conjecture, it heuristically selects a few hundred relevant facts (lemmas, definitions, or axioms) f... |

28 | Generic automatic proof tools
- Paulson
- 1997
(Show Context)
Citation Context ... quickly focus on the core of a problem. Strengthened versions of auto perform more sophisticated proof search, while still interleaving it with simplification. The search is based on tableau methods =-=[39]-=-. These methods are often useful, but since search is involved, not only are they slower than the simplifier and auto, they are endgame provers that do not provide any hints when they fail to prove th... |

26 | Smallcheck and Lazy Smallcheck: Automatic exhaustive testing for small values
- Runciman, Naylor, et al.
- 2008
(Show Context)
Citation Context ...d Quickcheck with exhaustive and narrowing-based testing as complements to random testing. Exhaustive testing checks the formula for every possible set of values up to a given bound, as in SmallCheck =-=[46]-=-, and hence finds counterexamples that random testing might miss. Narrowing can be more precise and more efficient than the other two approaches because it considers the formula symbolically, instead ... |

25 | Nitpick: A counterexample generator for higher-order logic based on a relational model finder
- Blanchette, Nipkow
- 2010
(Show Context)
Citation Context ...e testing and narrowing. A radically different approach is based on systematic model enumeration using a SAT solver. This approach was pioneered by the tool Refute [54] and is now embodied by Nitpick =-=[8]-=-. Nitpick looks for finite fragments (substructures) of infinite countermodels, soundly approximating problematic constructs. Common Isabelle idioms, such as inductive and coinductive predicates and d... |

24 | T.: Sledgehammer: Judgement Day
- Böhme, Nipkow
- 2010
(Show Context)
Citation Context ... conjecture, and delegates the proof search to external 3resolution provers (E [48], SPASS [56], and Vampire [44]) and SMT solvers (CVC3 [2], Yices [16], and Z3 [33]). Sledgehammer is very effective =-=[9]-=- and has achieved great popularity with users, novices and experts alike. 3.1 Relevance Filtering Most automatic provers perform poorly in the presence of thousands of axioms. Sledgehammer employs a s... |

22 |
T.: Fast LCF-style proof reconstruction for Z3
- Böhme, Weber
- 2010
(Show Context)
Citation Context ...h more robust and more concise. On the SMT side of things, proofs that involve no arithmetic reasoning steps can usually be replayed by Metis; otherwise, step-by-step proof replay is supported for Z3 =-=[10]-=-, whereas CVC3 and Yices can be invoked as oracles. Z3 proof replay relies extensively on Isabelle’s simplifier, tableau prover, and arithmetic decision procedures. Certificates make it possible to st... |

21 | Isabelle/Isar – a generic framework for human-readable proof documents
- Wenzel
- 2007
(Show Context)
Citation Context ...ce kernel. Tactics discharge a proof goal directly or, more often, break it down into one or more subgoals that must then be tackled by other tactics. In the last decade, the structured Isar language =-=[34,57]-=- has displaced ML as the language of choice for Isabelle proofs, but the most important ML tactics are still available as Isar proof methods. Much effort has been devoted to developing general-purpose... |

20 | Relational analysis of algebraic datatypes
- Kuncak, Jackson
- 2005
(Show Context)
Citation Context ...Datatypes In contrast to Isabelle’s constructor-oriented treatment of inductive datatypes, Nitpick’s FORL axiomatization revolves around selectors and discriminators, following a standard Alloy idiom =-=[28]-=-. The selector/discriminator view is usually more efficient than the constructor view because it breaks high-arity constructors into several low-arity selectors, with correspondingly smaller function ... |

18 | Extending Sledgehammer with SMT solvers
- Blanchette, Böhme, et al.
- 2011
(Show Context)
Citation Context ...t cannot be discharged directly by standard proof methods: In a recent study involving older Isabelle proof scripts, Sledgehammer could prove 43% of the more difficult goals containedin those proofs =-=[6]-=-. The addition of SMT solvers is recent and helps solve both arithmetic and nonarithmetic problems [6]. Sledgehammer works well in combination with structured Isar proofs: The new way of teaching Isab... |

18 | J.C.: Three years of experience with Sledgehammer, a practical link between automatic and interactive theorem provers - Paulson, Blanchette |

17 | Finding lexicographic orders for termination proofs in isabelle/hol
- Bulwahn, Krauss, et al.
- 2007
(Show Context)
Citation Context ...s the axiomatic specification of p. In general, this is unsound since it underspecifies p, but there are two important cases for which this method is sound: 11– If the recursion in F is well-founded =-=[12]-=-, the fixed point equation p = F p admits exactly one solution that can safely be taken as p’s specification. – If p occurs negatively in the formula, these occurrences can be soundly replaced by a fr... |

17 | Source-level proof reconstruction for interactive theorem proving
- PAULSON, SUSANTO
(Show Context)
Citation Context ...y, in practice Metis calls are almost always generated by Sledgehammer for reconstructing external resolution proofs (Section 3.4). 3 Sledgehammer: Proof Discovery Using External Provers Sledgehammer =-=[31, 42]-=- is Isabelle’s subsystem for harnessing the power of first-order automatic theorem provers. Given a conjecture, it heuristically selects a few hundred relevant facts (lemmas, definitions, or axioms) f... |

17 | SAT-based Finite Model Generation for Higher-Order Logic
- Weber
(Show Context)
Citation Context ...ecently been extended with exhaustive testing and narrowing. A radically different approach is based on systematic model enumeration using a SAT solver. This approach was pioneered by the tool Refute =-=[54]-=- and is now embodied by Nitpick [8]. Nitpick looks for finite fragments (substructures) of infinite countermodels, soundly approximating problematic constructs. Common Isabelle idioms, such as inducti... |

16 |
The CADE-21 automated theorem proving system competition
- Sutcliffe
- 2008
(Show Context)
Citation Context ...cation, which is a great loss. Taking this one step further, Metis is a resolution theorem prover written in ML by Hurd [24]. Metis is sufficiently capable that it is a respectable competitor at CASC =-=[51]-=-. It has been ported to Isabelle and follows the same philosophy as blast: The proof search is performed directly in ML, and any proof found is checked by the Isabelle kernel. The blast method relies ... |

15 | Combining testing and proving in dependent type theory
- Dybjer, Haiyan, et al.
- 2003
(Show Context)
Citation Context ...er base, advisory tools are conspicuously missing. An SMT integration with proof certification is in the works [27]. 12– Earlier versions of the Agda proof assistant included a version of QuickCheck =-=[17]-=-, but like the original QuickCheck for Haskell it required users to write dedicated data generators for custom datatypes. The Agsy tool [29, 30] implements narrowing for both counterexample generation... |

13 |
A.: Sine qua non for large theory reasoning
- Hoder, Voronkov
- 2011
(Show Context)
Citation Context ...mmer lets the external provers run in parallel, either locally or remotely. On a typical Isabelle installation, E, SPASS, and Z3 are run on the user’s machine, whereas Vampire and the SInE metaprover =-=[23]-=- are provided via the remote SystemOnTPTP service [50]. Users can also enable CVC3 and Yices. 4Sledgehammer Relevance filter Relevance filter TPTP translation SMT tr. SMT translation E SPASS Vampire ... |

12 | Purely functional lazy non-deterministic programming
- Fischer, Kiselyov, et al.
- 2009
(Show Context)
Citation Context .... Simulate narrowing by generating a functional program that includes its own refinement algorithm [46]. 3. Simulate narrowing by embedding the narrowing-based execution with a library of combinators =-=[18, 30]-=- in a functional language. We tried out the first two approaches and found that the second approach is faster. The third approach looks promising but would require a more involved translation. The mai... |

12 | Property Directed Generation of First-Order Test Data
- Lindblad
- 2007
(Show Context)
Citation Context .... Simulate narrowing by generating a functional program that includes its own refinement algorithm [46]. 3. Simulate narrowing by embedding the narrowing-based execution with a library of combinators =-=[18, 30]-=- in a functional language. We tried out the first two approaches and found that the second approach is faster. The third approach looks promising but would require a more involved translation. The mai... |

11 | System description: SystemOnTPTP
- Sutcliffe
- 2000
(Show Context)
Citation Context ... locally or remotely. On a typical Isabelle installation, E, SPASS, and Z3 are run on the user’s machine, whereas Vampire and the SInE metaprover [23] are provided via the remote SystemOnTPTP service =-=[50]-=-. Users can also enable CVC3 and Yices. 4Sledgehammer Relevance filter Relevance filter TPTP translation SMT tr. SMT translation E SPASS Vampire SInE Z3 CVC3 Yices Metis proof Metis proof Metis proof... |

11 |
2010): Asynchronous Proof Processing with Isabelle/Scala and Isabelle/jEdit
- Wenzel
(Show Context)
Citation Context ... better than one-click invocation is zero-click invocation, whereby the tools spontaneously run on newly entered conjectures. A more flexible user interface, such as the experimental jEdit-based PIDE =-=[58]-=-, could help further here, by asynchronously dispatching the tools to tackle any unfinished proofs in the current proof document, irrespective of the text cursor’s location. Interactive theorem provin... |

9 | Monotonicity inference for higher-order formulas
- Blanchette, Krauss
- 2010
(Show Context)
Citation Context ... every term. (Because the proofs are rechecked by Isabelle’s inference kernel, soundness is not crucial.) The current implementation safely erases most type information by inferring type monotonicity =-=[7, 15]-=-, resulting in a sound and efficient encoding. For SMT solvers, the translation maps equality and arithmetic operators to the corresponding SMT-LIB [43] concepts. The SMT-LIB logic is many-sorted, whi... |

8 |
SMT solvers: New oracles for the HOL theorem prover
- Weber
- 2011
(Show Context)
Citation Context ...te of automatic proof and disproof tools. We briefly review what the other popular provers have to offer. – HOL4 [20, 49] includes the original version of Metis [24] and an integration of SMT solvers =-=[55]-=- with proof reconstruction for Z3 [10]. – PVS includes a Quickcheck-like random testing tool [36] and integrates the SMT solver Yices as an oracle [47]. – For Mizar, the MizAR web service [45] is a re... |

6 |
Sort it out with monotonicity: translating between many-sorted and unsorted first-order logic
- Claessen, Lillieström, et al.
- 2011
(Show Context)
Citation Context ... every term. (Because the proofs are rechecked by Isabelle’s inference kernel, soundness is not crucial.) The current implementation safely erases most type information by inferring type monotonicity =-=[7, 15]-=-, resulting in a sound and efficient encoding. For SMT solvers, the translation maps equality and arithmetic operators to the corresponding SMT-LIB [43] concepts. The SMT-LIB logic is many-sorted, whi... |

5 |
The SMT-LIB Standard, Version 1.2, 2006. Available from the ”Documents” section of http://www.smtlib.org
- Ranise, Tinelli
(Show Context)
Citation Context ...e information by inferring type monotonicity [7, 15], resulting in a sound and efficient encoding. For SMT solvers, the translation maps equality and arithmetic operators to the corresponding SMT-LIB =-=[43]-=- concepts. The SMT-LIB logic is many-sorted, which would seem to make it more appropriate to encode HOL typing information than classical firstorder logic, but it does not support polymorphism. The so... |

4 |
Relational analysis of (co)inductive predicates, (co)inductive datatypes, and (co)recursive functions
- Blanchette
- 2010
(Show Context)
Citation Context ...alities for the atomic types (type variables and other uninterpreted types) occurring in the conjecture and generates one Kodkod problem (and ultimately one SAT problem) per cardinality specification =-=[5]-=-. To exhaust all models up to a given cardinality bound k for a formula involving n atomic types, it must in principle iterate through k n combinations of cardinalities, but a sophisticated monotonici... |

4 |
Integrating testing and interactive theorem proving. See URL http://www.ccs.neu.edu/home/harshrc/ITaITP.pdf
- Chamarthi, Dillinger, et al.
(Show Context)
Citation Context ...R web service [45] is a recent addition that exploits external resolution provers in the style of Sledgehammer. – The Sedan version of ACL2 includes a counterexample generator based on random testing =-=[13]-=-. The tool analyses the goal to compute dependencies between free variables, similar to Quickcheck’s data-flow analysis. – Although Coq has a considerable user base, advisory tools are conspicuously m... |

4 |
and L.Moura, The YICES SMT Solver, 2006, available at http://yices.csl.sri.com
- Dutertre
(Show Context)
Citation Context ...translates them to first-order logic along with the conjecture, and delegates the proof search to external 3resolution provers (E [48], SPASS [56], and Vampire [44]) and SMT solvers (CVC3 [2], Yices =-=[16]-=-, and Z3 [33]). Sledgehammer is very effective [9] and has achieved great popularity with users, novices and experts alike. 3.1 Relevance Filtering Most automatic provers perform poorly in the presenc... |

4 | A Tutorial Introduction to Structured Isar Proofs,” http://www.cl.cam.ac.uk/research/hvg/Isabelle/dist/Isabelle/d oc/isar-overview.pdf
- Nipkow
(Show Context)
Citation Context ...ce kernel. Tactics discharge a proof goal directly or, more often, break it down into one or more subgoals that must then be tackled by other tactics. In the last decade, the structured Isar language =-=[34,57]-=- has displaced ML as the language of choice for Isabelle proofs, but the most important ML tactics are still available as Isar proof methods. Much effort has been devoted to developing general-purpose... |

4 | Escape to ATP for Mizar
- Rudnicki, Urban
(Show Context)
Citation Context ...solvers [55] with proof reconstruction for Z3 [10]. – PVS includes a Quickcheck-like random testing tool [36] and integrates the SMT solver Yices as an oracle [47]. – For Mizar, the MizAR web service =-=[45]-=- is a recent addition that exploits external resolution provers in the style of Sledgehammer. – The Sedan version of ACL2 includes a counterexample generator based on random testing [13]. The tool ana... |

2 |
test data generators via logic programming
- Bulwahn
- 2011
(Show Context)
Citation Context ...ructure with random testing, in the style of the QuickCheck tool for Haskell [14]. It analyses the definitions of inductively defined predicates to generate values that satisfies them by construction =-=[11]-=- and has recently been extended with exhaustive testing and narrowing. A radically different approach is based on systematic model enumeration using a SAT solver. This approach was pioneered by the to... |