Unit´e de recherche INRIA Lorraine, Technopˆole de Nancy-Brabois, Campus scientifique, ` NANCY 615 rue du Jardin Botanique, BP 101, 54600 VILLERS LES Unit´e de recherche INRIA Rennes, Ir[r]

Related tools **and** experiments. Stefan Berghofer (Secunet, Germany) is using **the** sup- port for bit vectors **in** SPARK, on **the** big number package of libsparkcrypto ( https:
//bitbucket.org/sberghofer/libsparkcrypto/ ). He uses Isabelle/HOL to interac-
tively discharge **the** VCs that cannot be proved automatically. **The** BitWalker case study was initially written **in** C **and** specified using **the** ACSL **specification** language of Frama-C. For that purpose a theory of bit vectors of unbounded size was designed using **the** **Coq** **proof** assistant, **and** **the** proofs were done with a significant amount of interaction within **Coq**. Thanks to **the** mapping of our bit vector theory to SMT-LIB we were able to prove BitWalker fully automatically. **The** source language, C or Ada, is not important, although **the** choice between signed versus unsigned types **in** **the** source makes a difference: **in** Ada their semantics are significantly different. **The** Boogie [ 2 ] verifier **and** its front-ends VCC [ 13 ] **and** Dafny [ 19 ] also use **the** built-**in** bit vector sup- port of Z3, to model machine words. We are not aware of any work, **in** this context, about **the** problem of mixing bit vectors with high-level specifications.

En savoir plus
NICOLAS TABAREAU, Inria Nantes, France
THÉO WINTERHALTER, Inria Nantes, France
**Coq** is built around a well-delimited kernel that perfoms typechecking for definitions **in** a variant of **the** Calculus of Inductive Constructions (CIC). Although **the** metatheory of CIC is very stable **and** reliable, **the** correctness of its implementation **in** **Coq** is less clear. Indeed, implementing an efficient type checker for CIC is a rather complex task, **and** many parts of **the** code rely on implicit invariants which can easily be broken by further evolution of **the** code. Therefore, on average, one critical bug has been found every year **in** **Coq**. This paper presents **the** first implementation of a type checker for **the** kernel of **Coq** (without **the** module system **and** template polymorphism), which is proven correct **in** **Coq** with respect to its formal **specification** **and** axiomatisation of part of its metatheory. Note that because of Gödel’s incompleteness **theorem**, there is no hope to prove completely **the** correctness of **the** **specification** of **Coq** inside **Coq** (**in** particular strong normalisation or canonicity), but it is possible to prove **the** correctness of **the** implementation assuming **the** correctness of **the** **specification**, thus moving from a trusted code base (TCB) to a trusted theory base (TTB) paradigm. Our work is based on **the** MetaCoq project which provides metaprogramming facilities to work with terms **and** declarations at **the** level of this kernel. Our type checker is based on **the** **specification** of **the** typing relation of **the** Polymorphic, Cumulative Calculus of Inductive Constructions (PCUIC) at **the** basis of **Coq** **and** **the** verification of a relatively efficient **and** sound type-checker for it. **In** addition to **the** kernel implementation, an essential feature of **Coq** is **the** so-called extraction: **the** production of executable code **in** functional languages from **Coq** definitions. We present a verified version of this subtle type-**and**-**proof** erasure step, therefore enabling **the** verified extraction of a safe type-checker for **Coq**.

En savoir plus
1.4 Challenges
Prior work has explored reasoning about IO automata within a **proof** assistant, but **the** approaches do not support proper compositional reasoning. Work by Bogdanov, which formalizes IO automata **in** **the** Larch Prover [ 11 ], does not support automata composition at all. Work by Lim implements a translation from a timed IO automata **specification** language to **the** PVS prover [ 12 ], but it handles compositions **in** **the** **specification** language by recursively inlining **the** composed automata into a single automaton **in** PVS, precluding reasoning about individual automata separately from **the** composition. Work by Nipkow **and** Slind formalizes IO automata **in** Isabelle/HOL **and** supports composition, but it requires that **the** programmer declare **the** entire set of possible actions used **in** a development ahead of time, making compositional reasoning impossible without deciding a priori all **the** automata that will be composed.

En savoir plus
Y 0 are empty. We exclude this case by assuming E i non-empty, so that T(E) is non-empty,
whatever T. **In** this case X = Y **and** X 0 = Y 0 . We now must show that E n = P (X) is absurd. Here
we take E n = 3 (our **proof** relies **in** **the** fact that 0 = ;, 1 = {0}, 2 = {0, 1} **and** 3 = {0, 1, 2}; but
obviously a set with **three** elements cannot be a power set, since **the** cardinal of a power set is a power of two). Note that P (X) 6= Y × Y 0 . If pairs are defined via an axiom (as was **the** case **in** earlier versions of Bourbaki), this statement is hard to prove (maybe false with our limited choice of sets for E). However, defining pairs as doubletons ensures that **the** empty set is not a pair; it belongs to **the** power set, but not to **the** product. Finally, we have to exclude **the** case E n = Y × Y 0 . It suffices to take E n = 1 (recall that 1 is **the** powers et of 0).

En savoir plus
119 En savoir plus

1 Introduction
**In** **the** last decade, computer-aided **proof** development has been gaining mo- mentum. Interactive **proof** assistants allow their users to state a mathematical **theorem** **in** a language that **the** system understands **and** then prove that theo- rem within **the** system. As long as **the** **proof** assistant’s verification code is free from bugs, this guarantees that all proofs are actually correct, that no details have been overlooked, **and** that no mistakes were made. Mechanizing proofs **in** this way makes very large proofs feasible **and** protects against subtle **and** hard- to-notice human errors. Two recent milestones **in** computer science include **the** verification of an optimising C compiler [ 6 ] **and** of a micro-kernel [ 17 ]. **Proof** as- sistants have also been used to verify advanced results **in** mathematics, such as **the** Odd Order **Theorem**, using **Coq** [ 12 ], **and** **the** **proof** of **the** Kepler conjecture, using HOL-Light **and** Isabelle [ 14 ].

En savoir plus
1.5 Hilbert’s program **and** finitistic reductionism
During **the** early 20th century, mathematics went through a serious foundational crisis, with **the** discovery of various paradoxes **and** inconsistencies. Some great mathematicians such as Kronecker, Poincar´ e **and** Brouwer challenged **the** validity of infinitistic reasoning. Hilbert [ 30 ] proposed a **three**-step program to answer those criticisms. First, he suggested to identify **the** finitistic part of mathematics, then to axiomatize infinite reasoning, **and** eventually to give a finitistically correct consistency **proof** of this axiomatic system. However, his program was nipped **in** **the** bud by G¨ odel’s incompleteness theorems [ 25 ].

En savoir plus
ProperFilter F -> (A `&` cluster F) !=set0. Here, we use **the** notation A `&` B for **the** intersection of A with B **and** A !=set0 for exists p, A p.
**In** our formalization of **the** inverted pendulum from Lozano et al. [ 25 ], we prove that **the** set K is compact by proving that it is closed **and** bounded, as explained **in** Sect. 4.1 . A closed **and** bounded set is compact **in** a finite dimensional space be- cause it is a closed subset of a compact set (**the** finite product of segments defined by its bound). We have thus to prove that a finite product of compact sets **in** R is compact. We decided to formalize **the** more general Tychonoff **Theorem**, which admits a simple **proof** thanks to filters, although it re- quires **the** axiom of choice **in** **the** form of Zorn’s Lemma (we used **the** version of Zorn’s Lemma contained **in** Schepler’s small library on set theory 5 ).

En savoir plus
1. Introduction
This article deals with formalizing projective geometry **in** **the** **Coq** **proof** assistant [1, 7] **and** studies Desargues property both **in** **the** plane **and** **in** an at least **three** dimensional setting (noted ≥ 3-dimensional). **In** **the** plane, proofs are constructed **in** a traditional way using points **and** lines. However, **in** a ≥3-dimensional space, we use **the** concept of rank to formally prove Desargues **theorem** (**in** **Coq**). **In** **the** longer term, **the** underlying objective of **the** presented work consists **in** designing a formal geometry prover able to handle **the** non-degeneracy conditions, **and** especially **in** geometric constraint solving [14, 16].

En savoir plus
327 En savoir plus

We conclude that, while **the** library could profit from some additional cleanup (e.g., more consistent naming conventions **and** additional documentation), it is already quite usable. **In** order to establish **the** library as generally useful, more diverse case studies would need to be carried out. **In** addition to **the** more direct **proof** of **the** excluded-minor characterization of treewidth-two graphs currently **in** progress, we also plan to verify **the** graph-rewriting based completeness **proof** for 2p-algebras [8]. Further, we would like to carry out a comparative case study with **the** work of Noschinski [22] who formalized **the** characterization of Eulerian graphs **in** terms of vertex degrees **and** a verified a checker for certificates of non-planarity based on Kuratowski graphs. This should provide insights into **the** trade-offs between **the** higher degree of **proof** automation **in** Isabelle/HOL **and** **the** more expressive type theory of **Coq** as it comes to reasoning about graphs. Beyond **the** aforementioned checker for non- planarity, **the** verification of (abstract) graph algorithms using **the** library (whose definitions are **proof**-centered **and** not intended for computation) **and** **the** refining them to efficient implementations along **the** lines of [4] seems a promising direction.

En savoir plus
We proposed a new way to express ni
ely **in**
iden
e re- lations **in** a 3D setting thanks to ranks **and** designed an axiom system to
apture proje
tive geometry using ranks. We su
essfully applied it to prove Desargues' **theorem**. We presented **proof** engineering te
hniques whi
h allow to have proofs of reasonable size. **In** **the** future, we plan to study how **the** notion of rank
an be used to automati
ally derive **in**
iden
e properties. We believe that **the** generi
ity of **the** notation will help **the** automation pro
ess.

Paper [12] is close to our work except that **the** **specification** language they choose is TLA + .
V. C ONCLUDING R EMARKS
Programmable logic controllers (PLCs) are used extensively **in** **the** field of automation. They are getting more complex. Modular development is deployed to solve this problem. Besides **the** benefits it brings to **the** software development, it also helps **the** formal **specification** **and** verification of PLC systems. **In** this paper, we propose a method to do modular **and** parameterized **specification** **and** verification of PLC systems **in** **the** **theorem** proving system **Coq**. Record type is used to specify **the** components. Both atomic **and** compound components of PLCs are dealt **in** a similar way. Besides them, a kind of **specification** generators is proposed **and** realized using Record as well. **The** process of constructing a compound component from several subcomponents is modeled by a function, which builds a link between **the** implementation **and** **the** **specification**. Various related aspects are discussed **and** demonstrated via examples.

En savoir plus
• Variants of **the** base case were proved independently **in** [12] **and** [11]. **The** fact that **the** idea behind **the** **theorem** emerged **in** different communities suggests that it is broadly interesting.
A significant contribution of this article is **the** modification of **the** **proof** structure of [14, Lemma 2.4] to simplify its formalization: **In** [14, Lemma 2.4], **the** preferences are extended linearly **in** **the** beginning of **the** **proof**. Then **the** new linear preferences are lifted to subsets of outcomes, where **the** definition of **the** lift hinges upon **the** linearity assumption. This helps find an NE for **the** new preferences, which is also an NE for **the** original ones. While it is convenient to invoke linear extension **in** **the** paper-**and**-pencil **proof**, it is costly to formalize. It was already formalized **in** **Coq** **in** [13] (**and** improved **in** [1] **in** terms of algorithmic complexity), but we prefer to avoid relying too much on external libraries. So we generalize **the** lift such that **the** input may be an arbitrary partial order instead of necessarily a linear order.

En savoir plus
We have presented **the** new implementation of **the** system **Coq**. It
ombines **the** eÆ
ien
y **and** safety requirements **in** a
ompletely new design, where **the**
riti
al part of **the** system, a type
he
ker for **the** CIC, is
learly isolated.
This type
he
ker is now written is a purely fun
tional way. It uses eÆ
ient fun
tional data stru
tures **and** is even slightly faster than **the** previous type
he
kers that were partly imperative. Being fun
tional, this
riti
al kernel is now easier to maintain **and** to reason about. One
an now think of formally
ertifying it. Following **the** work of B. Barras [3℄, it
ould even be \bootstrapped" i.e.
ertied by **Coq** itself.

En savoir plus
Let L be **the** Galois closure of K over k. Our conclusion seems to follow immediately from Proposition A.3. However, L/k is not, **in** general, a geo- metric extension, so there remains some work to be done. Let E be **the** con- stant field of L. Then, L is a geometric **and** Galois extension of k 0 = E(T ). Since [E : F] ≤ [L : k] ≤ n!, there are only finitely many possibilities for E. Thus, it suffices to show that for each possible E there are only finitely many possibilities for L as a geometric, Galois extension of k 0 . We do this by showing there are bounds on [L : k 0 ] **and** deg k 0 d L/k 0 which depend only

En savoir plus
note that **the** previously cited reliable broadcast algorithms do not use sequence numbers. They only use different types of implementation messages which can be encoded with two bits.
3 Money Transfer: a Formal Definition
Money transfer: operations From an abstract point of view, a money-transfer object can be seen as an abstract array ACCOUNT [1..n] where ACCOUNT [i] represents **the** current value of p i ’s account. This object provides **the** processes with two operations denoted balance() **and** transfer(), whose semantics are defined below. **The** transfer by a process of **the** amount of money v to a process p j is represented by **the** pair hj, vi. Without loss of generality, we assume that a process does not transfer money to itself. It is assumed that each ACCOUNT [i] is initialized to a non-negative value denoted init[i]. It is assumed **the** array init[1..n] is initially known by all **the** processes. 8

En savoir plus