|
|
|
| e-Pub |
Previous | 
Home
Section: New Results
Software specification and verification
Tools for TLA+
Participants : Damien Doligez, Jael Kriener, Leslie Lamport [Microsoft Research] , Stephan Merz [EPI VeriDis] , Tomer Libal [Microsoft Research-Inria Joint Centre] , Hernán Vanzetto [Microsoft Research-Inria Joint Centre] .
Damien Doligez is head of the “Tools for Proofs” team in the Microsoft-Inria Joint Centre. The aim of this team is to extend the TLA+ language with a formal language for hierarchical proofs, formalizing the ideas in [61] , and to build tools for writing TLA+ specifications and mechanically checking the corresponding formal proofs.
This year, we released two versions of the TLA+ Proof System (TLAPS), the part of the TLA+ tools that handles mechanical checking of TLA+ proofs. This environment is described in [55] .
These versions add the propositional temporal logic prover LS4 as a back-end, which allows TLAPS to deal with propositional temporal formulas. This relies on a technique called coalescing [40] , which allows users to prove arbitrary safety properties, as well as some liveness properties, by translating them into the back-end prover's logic without increasing the complexity of the formulas.
Jael Kriener started a post-doc contract in December 2013, funded by the ADN4SE contract, and left in September 2014. She worked on the theory of temporal proofs in TLA+ and, in collaboration with CEA, on proving some properties of the PharOS real-time operating system.
Web sites:
http://research.microsoft.com/users/lamport/tla/tla.html
http://tla.msr-inria.inria.fr/tlaps
The Zenon automatic theorem prover
Participants : Damien Doligez, David Delahaye [CNAM] , Pierre Halmagrand [Equipe DEDUCTEAM] , Guillaume Bury [Equipe DEDUCTEAM] , Olivier Hermant [Mines ParisTech] .
Damien Doligez continued the development of Zenon, a tableau-based prover for first-order logic with equality and theory-specific extensions.
Pierre Halmagrand continued his thesis work, funded by ANR BWare, on integrating Deduction Modulo in Zenon, with emphasis on making it efficient for dealing with B set theory.
Guillaume Bury did an internship, also funded by ANR BWare. He implemented an extension of Zenon, based on the simplex method, to deal with arithmetic formulas.
Well-typed generic fuzzing for module interfaces
Participants : Thomas Braibant, Jonathan Protzenko, Gabriel Scherer.
Property-based testing generates arbitrary instances of inputs to check a given correctness predicate/property. Thomas Braibant proposed that, instead of a random generation function defined from the internals of one's data-structure, one could use the user-exposed interface to generate instances by composition of API calls. GADTs let us reflect/reify a typed API, and program a type-respecting exploration/testing directly in the host language. We developed a prototype library, Articheck, to experiment with this idea. This work was presented at the ML Workshop [38] .
Depth-First Search and Strong Connectivity in Coq
Participant : François Pottier.
In 2002, Ingo Wegener published a short paper which sketches a proof of Kosaraju's linear-time algorithm for computing the strongly connected components of a directed graph. At the same time, Wegener's paper helps explain why the algorithm works, which, from a pedagogical standpoint, makes it quite valuable. In 2013 and 2014, François Pottier produced a machine-checked version of Wegener's proof, and wrote a precise informal account of it, which will be presented at JFLA 2015 [36] .
Implementing hash-consed structures in Coq
Participants : Thomas Braibant, Jacques-Henri Jourdan, David Monniaux [CNRS, VERIMAG] .
Hash-consing is a programming technique used to implement maximal sharing of immutable values in memory, keeping a single copy of semantically equivalent objects. Hash-consed data-structures give a unique identifier to each object, allowing fast hashing and comparisons of objects. This may lead to major improvements in execution time by itself, but it also makes it possible to do efficient memoization of computations.
Hash-consing and memoization are examples of imperative techniques that are of prime importance for performance, but are not easy to implement and prove correct using the purely functional language of a proof assistant such as Coq.
We published an article in Journal of Automated Reasoning [15] , explaining our work on this subject during the last 3 years. We gave four different approaches for implementing hash-consed data-structures in Coq. Then, we performed an in-depth comparative study of how our “design patterns” for certified hash-consing fare on two real-scale examples: BDDs and lambda-terms.