Haut PDF The Three Gap Theorem : Specification and Proof in Coq

The Three Gap Theorem : Specification and Proof in Coq

The Three Gap Theorem : Specification and Proof in Coq

Unit´e de recherche INRIA Lorraine, Technopˆole de Nancy-Brabois, Campus scientifique, ` NANCY 615 rue du Jardin Botanique, BP 101, 54600 VILLERS LES Unit´e de recherche INRIA Rennes, Ir[r]

34 En savoir plus

Specification and Proof of High-Level Functional Properties of Bit-Level Programs

Specification and Proof of High-Level Functional Properties of Bit-Level Programs

Related tools and experiments. Stefan Berghofer (Secunet, Germany) is using the sup- port for bit vectors in SPARK, on the big number package of libsparkcrypto ( https: //bitbucket.org/sberghofer/libsparkcrypto/ ). He uses Isabelle/HOL to interac- tively discharge the VCs that cannot be proved automatically. The BitWalker case study was initially written in C and specified using the ACSL specification language of Frama-C. For that purpose a theory of bit vectors of unbounded size was designed using the Coq proof assistant, and the proofs were done with a significant amount of interaction within Coq. Thanks to the mapping of our bit vector theory to SMT-LIB we were able to prove BitWalker fully automatically. The source language, C or Ada, is not important, although the choice between signed versus unsigned types in the source makes a difference: in Ada their semantics are significantly different. The Boogie [ 2 ] verifier and its front-ends VCC [ 13 ] and Dafny [ 19 ] also use the built-in bit vector sup- port of Z3, to model machine words. We are not aware of any work, in this context, about the problem of mixing bit vectors with high-level specifications.
En savoir plus

16 En savoir plus

Coq Coq Correct! Verification of Type Checking and Erasure for Coq, in Coq

Coq Coq Correct! Verification of Type Checking and Erasure for Coq, in Coq

NICOLAS TABAREAU, Inria Nantes, France THÉO WINTERHALTER, Inria Nantes, France Coq is built around a well-delimited kernel that perfoms typechecking for definitions in a variant of the Calculus of Inductive Constructions (CIC). Although the metatheory of CIC is very stable and reliable, the correctness of its implementation in Coq is less clear. Indeed, implementing an efficient type checker for CIC is a rather complex task, and many parts of the code rely on implicit invariants which can easily be broken by further evolution of the code. Therefore, on average, one critical bug has been found every year in Coq. This paper presents the first implementation of a type checker for the kernel of Coq (without the module system and template polymorphism), which is proven correct in Coq with respect to its formal specification and axiomatisation of part of its metatheory. Note that because of Gödel’s incompleteness theorem, there is no hope to prove completely the correctness of the specification of Coq inside Coq (in particular strong normalisation or canonicity), but it is possible to prove the correctness of the implementation assuming the correctness of the specification, thus moving from a trusted code base (TCB) to a trusted theory base (TTB) paradigm. Our work is based on the MetaCoq project which provides metaprogramming facilities to work with terms and declarations at the level of this kernel. Our type checker is based on the specification of the typing relation of the Polymorphic, Cumulative Calculus of Inductive Constructions (PCUIC) at the basis of Coq and the verification of a relatively efficient and sound type-checker for it. In addition to the kernel implementation, an essential feature of Coq is the so-called extraction: the production of executable code in functional languages from Coq definitions. We present a verified version of this subtle type-and-proof erasure step, therefore enabling the verified extraction of a safe type-checker for Coq.
En savoir plus

29 En savoir plus

CoqIOA : a formalization of IO automata in the Coq proof assistant

CoqIOA : a formalization of IO automata in the Coq proof assistant

1.4 Challenges Prior work has explored reasoning about IO automata within a proof assistant, but the approaches do not support proper compositional reasoning. Work by Bogdanov, which formalizes IO automata in the Larch Prover [ 11 ], does not support automata composition at all. Work by Lim implements a translation from a timed IO automata specification language to the PVS prover [ 12 ], but it handles compositions in the specification language by recursively inlining the composed automata into a single automaton in PVS, precluding reasoning about individual automata separately from the composition. Work by Nipkow and Slind formalizes IO automata in Isabelle/HOL and supports composition, but it requires that the programmer declare the entire set of possible actions used in a development ahead of time, making compositional reasoning impossible without deciding a priori all the automata that will be composed.
En savoir plus

53 En savoir plus

Implementation of Bourbaki's Elements of Mathematics in Coq: Part Three Structures

Implementation of Bourbaki's Elements of Mathematics in Coq: Part Three Structures

Y 0 are empty. We exclude this case by assuming E i non-empty, so that T(E) is non-empty, whatever T. In this case X = Y and X 0 = Y 0 . We now must show that E n = P (X) is absurd. Here we take E n = 3 (our proof relies in the fact that 0 = ;, 1 = {0}, 2 = {0, 1} and 3 = {0, 1, 2}; but obviously a set with three elements cannot be a power set, since the cardinal of a power set is a power of two). Note that P (X) 6= Y × Y 0 . If pairs are defined via an axiom (as was the case in earlier versions of Bourbaki), this statement is hard to prove (maybe false with our limited choice of sets for E). However, defining pairs as doubletons ensures that the empty set is not a pair; it belongs to the power set, but not to the product. Finally, we have to exclude the case E n = Y × Y 0 . It suffices to take E n = 1 (recall that 1 is the powers et of 0).
En savoir plus

119 En savoir plus

Coqoon An IDE for interactive proof development in Coq

Coqoon An IDE for interactive proof development in Coq

1 Introduction In the last decade, computer-aided proof development has been gaining mo- mentum. Interactive proof assistants allow their users to state a mathematical theorem in a language that the system understands and then prove that theo- rem within the system. As long as the proof assistant’s verification code is free from bugs, this guarantees that all proofs are actually correct, that no details have been overlooked, and that no mistakes were made. Mechanizing proofs in this way makes very large proofs feasible and protects against subtle and hard- to-notice human errors. Two recent milestones in computer science include the verification of an optimising C compiler [ 6 ] and of a micro-kernel [ 17 ]. Proof as- sistants have also been used to verify advanced results in mathematics, such as the Odd Order Theorem, using Coq [ 12 ], and the proof of the Kepler conjecture, using HOL-Light and Isabelle [ 14 ].
En savoir plus

18 En savoir plus

A Formal Proof in Coq of LaSalle's Invariance Principle

A Formal Proof in Coq of LaSalle's Invariance Principle

the existence of an equilibrium plays no role in the validity of Theorem 1. Thus, we removed the hypothesis F (0) = 0. Still regarding the vector field F , the assumption “F has continuous first partial derivatives” is also a convenience. What is truly needed, as LaSalle puts it, is “any other conditions that guarantee the existence and uniqueness of solutions and the continuity of the solutions relative to the initial conditions”. We can even go further and assume these properties only on the subset K of the ambient space. Indeed, for some systems the vector field is valid only in a restricted area, for instance when using a control function which has singularities (see e.g. [18]). Then, the ambient space does not need to be IR n , nor does it need to be a finite-dimensional vector space. A normed module over IR was sufficient to prove this result. Since we work in an abstract normed module, we cannot express ˜ V using the gradient of V . However, in IR n we know that for any points p and q, the scalar product between q and the gradient of V at point p is the value of the differential of V at point p applied to q. Thus, ˜ V (p) can be expressed as the differential of V at point p applied to F (p), which generalizes the definition of ˜ V to normed modules.
En savoir plus

18 En savoir plus

The proof-theoretic strength of Ramsey's theorem for pairs and two colors

The proof-theoretic strength of Ramsey's theorem for pairs and two colors

1.5 Hilbert’s program and finitistic reductionism During the early 20th century, mathematics went through a serious foundational crisis, with the discovery of various paradoxes and inconsistencies. Some great mathematicians such as Kronecker, Poincar´ e and Brouwer challenged the validity of infinitistic reasoning. Hilbert [ 30 ] proposed a three-step program to answer those criticisms. First, he suggested to identify the finitistic part of mathematics, then to axiomatize infinite reasoning, and eventually to give a finitistically correct consistency proof of this axiomatic system. However, his program was nipped in the bud by G¨ odel’s incompleteness theorems [ 25 ].
En savoir plus

33 En savoir plus

A Formal Proof in Coq of a Control Function for the Inverted Pendulum

A Formal Proof in Coq of a Control Function for the Inverted Pendulum

ProperFilter F -> (A `&` cluster F) !=set0. Here, we use the notation A `&` B for the intersection of A with B and A !=set0 for exists p, A p. In our formalization of the inverted pendulum from Lozano et al. [ 25 ], we prove that the set K is compact by proving that it is closed and bounded, as explained in Sect. 4.1 . A closed and bounded set is compact in a finite dimensional space be- cause it is a closed subset of a compact set (the finite product of segments defined by its bound). We have thus to prove that a finite product of compact sets in R is compact. We decided to formalize the more general Tychonoff Theorem, which admits a simple proof thanks to filters, although it re- quires the axiom of choice in the form of Zorn’s Lemma (we used the version of Zorn’s Lemma contained in Schepler’s small library on set theory 5 ).
En savoir plus

15 En savoir plus

A Generic Coq Proof of Typical Worst-Case Analysis

A Generic Coq Proof of Typical Worst-Case Analysis

The most obvious advantage of formal proofs is that they provide strong guarantees: one only needs to read the specification and the main correctness theorem; there is no need to look at the proof itself which is machine-checked. Furthermore, using a proof assistant brings other benefits. Since the assumptions are explicit and tracked by Coq, we can rely on the proof checker to guide generalization. In our case, the proof started as a proof of the original TWCA for FPP with arrival curves [27]. The proof assistant allowed us to see which properties were required to prove the analysis. After removing the direct dependencies on FPP, mostly syntactic occurrences of priorities, the relevant properties were isolated. This led us to the requirements of Section III on busy windows which allowed us to develop the generic analysis. The generic proof reuses parts of the original proof in a safe way by replacing references to properties of the system model by properties which are consequences of the hypotheses in Section III. The use of a proof assistant was critical in identifying the relevant assumptions for the generic analysis.
En savoir plus

13 En savoir plus

A Case Study in Formalizing Projective Geometry in Coq: Desargues Theorem

A Case Study in Formalizing Projective Geometry in Coq: Desargues Theorem

1. Introduction This article deals with formalizing projective geometry in the Coq proof assistant [1, 7] and studies Desargues property both in the plane and in an at least three dimensional setting (noted ≥ 3-dimensional). In the plane, proofs are constructed in a traditional way using points and lines. However, in a ≥3-dimensional space, we use the concept of rank to formally prove Desargues theorem (in Coq). In the longer term, the underlying objective of the presented work consists in designing a formal geometry prover able to handle the non-degeneracy conditions, and especially in geometric constraint solving [14, 16].
En savoir plus

36 En savoir plus

Applications of Foundational Proof Certificates in theorem proving

Applications of Foundational Proof Certificates in theorem proving

In this chapter, we have presented a determinate checker written in OCaml side by side with a formalization of this MaxChecker in Coq which was restricted to the propositional fragment. In extending this treatment to the quantifiers, and with them to full first-order logic, the handling of bindings predictably becomes the principal point of interest. In Coq, bindings are not first-class constructs of the language and must therefore be explicitly modeled and their metatheory proved; several Coq libraries facilitate facilitate work with bindings and mitigate the increase in the complexity of proofs. Our use of Prop as the type of atoms is a further complication that needs to be addressed. A simplifying factor lifted from the OCaml checker consists of fixing a single type of terms—over which quantification may occur—mimicking the kernel in Figure 4.3 and those to come in Part III. An aspect of the OCaml code which resists easy formalization is the representation of bindings by function spaces in the encoding of higher-order abstract syntax. Adopting functions leads to so-called exotic terms and are far more general than the limited operation of substitution they are expected to represent (Despeyroux et al., 1995).
En savoir plus

327 En savoir plus

Short proof of Menger's Theorem in Coq (Proof Pearl)

Short proof of Menger's Theorem in Coq (Proof Pearl)

We conclude that, while the library could profit from some additional cleanup (e.g., more consistent naming conventions and additional documentation), it is already quite usable. In order to establish the library as generally useful, more diverse case studies would need to be carried out. In addition to the more direct proof of the excluded-minor characterization of treewidth-two graphs currently in progress, we also plan to verify the graph-rewriting based completeness proof for 2p-algebras [8]. Further, we would like to carry out a comparative case study with the work of Noschinski [22] who formalized the characterization of Eulerian graphs in terms of vertex degrees and a verified a checker for certificates of non-planarity based on Kuratowski graphs. This should provide insights into the trade-offs between the higher degree of proof automation in Isabelle/HOL and the more expressive type theory of Coq as it comes to reasoning about graphs. Beyond the aforementioned checker for non- planarity, the verification of (abstract) graph algorithms using the library (whose definitions are proof-centered and not intended for computation) and the refining them to efficient implementations along the lines of [4] seems a promising direction.
En savoir plus

12 En savoir plus

Formalizing Desargues' theorem in Coq using ranks in Coq

Formalizing Desargues' theorem in Coq using ranks in Coq

We proposed a new way to express ni ely in iden e re- lations in a 3D setting thanks to ranks and designed an axiom system to apture proje tive geometry using ranks. We su essfully applied it to prove Desargues' theorem. We presented proof engineering te hniques whi h allow to have proofs of reasonable size. In the future, we plan to study how the notion of rank an be used to automati ally derive in iden e properties. We believe that the generi ity of the notation will help the automation pro ess.

7 En savoir plus

Parameterized Specification and Verification of PLC Systems in Coq

Parameterized Specification and Verification of PLC Systems in Coq

Paper [12] is close to our work except that the specification language they choose is TLA + . V. C ONCLUDING R EMARKS Programmable logic controllers (PLCs) are used extensively in the field of automation. They are getting more complex. Modular development is deployed to solve this problem. Besides the benefits it brings to the software development, it also helps the formal specification and verification of PLC systems. In this paper, we propose a method to do modular and parameterized specification and verification of PLC systems in the theorem proving system Coq. Record type is used to specify the components. Both atomic and compound components of PLCs are dealt in a similar way. Besides them, a kind of specification generators is proposed and realized using Record as well. The process of constructing a compound component from several subcomponents is modeled by a function, which builds a link between the implementation and the specification. Various related aspects are discussed and demonstrated via examples.
En savoir plus

5 En savoir plus

An Existence Theorem of Nash Equilibrium in Coq and Isabelle

An Existence Theorem of Nash Equilibrium in Coq and Isabelle

• Variants of the base case were proved independently in [12] and [11]. The fact that the idea behind the theorem emerged in different communities suggests that it is broadly interesting. A significant contribution of this article is the modification of the proof structure of [14, Lemma 2.4] to simplify its formalization: In [14, Lemma 2.4], the preferences are extended linearly in the beginning of the proof. Then the new linear preferences are lifted to subsets of outcomes, where the definition of the lift hinges upon the linearity assumption. This helps find an NE for the new preferences, which is also an NE for the original ones. While it is convenient to invoke linear extension in the paper-and-pencil proof, it is costly to formalize. It was already formalized in Coq in [13] (and improved in [1] in terms of algorithmic complexity), but we prefer to avoid relying too much on external libraries. So we generalize the lift such that the input may be an arbitrary partial order instead of necessarily a linear order.
En savoir plus

16 En savoir plus

Design of a proof assistant: Coq version 7

Design of a proof assistant: Coq version 7

We have presented the new implementation of the system Coq. It ombines the eÆ ien y and safety requirements in a ompletely new design, where the riti al part of the system, a type he ker for the CIC, is learly isolated. This type he ker is now written is a purely fun tional way. It uses eÆ ient fun tional data stru tures and is even slightly faster than the previous type he kers that were partly imperative. Being fun tional, this riti al kernel is now easier to maintain and to reason about. One an now think of formally ertifying it. Following the work of B. Barras [3℄, it ould even be \bootstrapped" i.e. erti ed by Coq itself.
En savoir plus

9 En savoir plus

A Geometric Proof of Hermite’s Theorem in Function Fields

A Geometric Proof of Hermite’s Theorem in Function Fields

Let L be the Galois closure of K over k. Our conclusion seems to follow immediately from Proposition A.3. However, L/k is not, in general, a geo- metric extension, so there remains some work to be done. Let E be the con- stant field of L. Then, L is a geometric and Galois extension of k 0 = E(T ). Since [E : F] ≤ [L : k] ≤ n!, there are only finitely many possibilities for E. Thus, it suffices to show that for each possible E there are only finitely many possibilities for L as a geometric, Galois extension of k 0 . We do this by showing there are bounds on [L : k 0 ] and deg k 0 d L/k 0 which depend only
En savoir plus

16 En savoir plus

A PROOF OF THE CAFFARELLI CONTRACTION THEOREM VIA ENTROPIC REGULARIZATION

A PROOF OF THE CAFFARELLI CONTRACTION THEOREM VIA ENTROPIC REGULARIZATION

in Section 3.  In the setting of Theorem 1, it turns out that much more can be said about the functions f and g. This is explained in the following result, which seems of independent interest. Theorem 8. With the same notation as in Proposition 7, let µ be a probability measure of the form µ pdxq “ e V pxq γ dpdxq with a finite second moment and ν be a compactly supported probability measure on R d of the form ν pdxq “ e ´W pxq γdpdxq, with V, W convex and V bounded from below. There exist a log-convex function f ε : R d Ñ r1, `8q and a log-concave function g ε : R d Ñ r0, `8q such that the unique optimal coupling π ε P Πpµ, νq is of the form π ε pdxdyq “ f ε pxqg ε pyq R ε pdxdyq. Moreover, the function log f ε is integrable with respect to µ and the function log g ε is integrable with respect to ν and it holds
En savoir plus

17 En savoir plus

Money Transfer Made Simple: a Specification, a Generic Algorithm, and its Proof

Money Transfer Made Simple: a Specification, a Generic Algorithm, and its Proof

note that the previously cited reliable broadcast algorithms do not use sequence numbers. They only use different types of implementation messages which can be encoded with two bits. 3 Money Transfer: a Formal Definition Money transfer: operations From an abstract point of view, a money-transfer object can be seen as an abstract array ACCOUNT [1..n] where ACCOUNT [i] represents the current value of p i ’s account. This object provides the processes with two operations denoted balance() and transfer(), whose semantics are defined below. The transfer by a process of the amount of money v to a process p j is represented by the pair hj, vi. Without loss of generality, we assume that a process does not transfer money to itself. It is assumed that each ACCOUNT [i] is initialized to a non-negative value denoted init[i]. It is assumed the array init[1..n] is initially known by all the processes. 8
En savoir plus

17 En savoir plus

Show all 10000 documents...