Tool Support for proof Engineering

1
Tool Support for proof Engineering
Anne Mulhern
Charles Fischer
Ben Liblit
Anne Mulhern Computer Sciences Department Universi
ty of Wisconsin-Madison Madison, WI
USA mulhern_at_cs.wisc.edu www.cs.wisc.edu/mulhern
2
Size of Proofs

• Certified C compiler in Coq Leroy et al
• Compiler proof that compiler preserves
  semantics
• Back-end
• One man-year
• 35,000 lines of Coq scripts, definitions, and
  tactics
• Front-end
• 3/4 man-year
• 6,000 lines of Coq scripts, definitions, and
  tactics

3
Proof Material/Definitions
Formal Certification of a Compiler Back-end or
Programming a Compiler with a Proof Assistant
Xavier Leroy, POPL 2006
4
Proof Objects/Proof Scripts

• Proof objects can be an order of magnitude larger
  than proof scripts
• Factors
• Down
• Good modularization
• Up
• Powerful tactics
• Good use of hints

5
Size of Linux Kernel

• 1991 - 10,000 lines
• 1996 - 800,000 lines
• 2001 - 3 million lines
• 2006 - 7 million lines

6
Integrated Proof Environment

• Abbreviated as IPE
• Similar to an IDE (Integrated Development
  Environment)
• Uncommon

7
This is a position paper
tools and techniques from IDEs can be transferred
to IPEs
tools and techniques from IDEs should be
transferred to IPEs
8
Outline

• Motivation
• Tools and Techniques
• Mechanisms

9
Outline

• Motivation
• Tools and Techniques
• Mechanisms

10
Motivation

• Programming languages are my specialty
• Formal proofs of programming language properties
• The POPLmark challenge
• Generation of certified programs by extraction
• Formal Certification of a Compiler Back-end or
  Programming a Compiler with a Proof Assistant
  Xavier Leroy, POPL 2006

11
PL Proofs are different

• Proofs should be easy to modify and reuse
• For certified programs structure of the
  generated proof matters
• Proofs frequently proceed by induction
• Inductive theorems are particularly challenging
• On Strategies for Inductive Theorem Proving
  Bernhard Gramlich, Strategies 2004 Invited Talk

12
Proofs are Programs

• Theory
• Curry-Howard isomorphism
• Practice
• Extend
• Refactor
• Debug
• We can tackle similar problems with similar
  techniques

13
PhoX
Minlog
HOL
ACL2
Mizar
Coq
B method
IMPS
Alfa/Agda
Theorema
PVS
Isabelle/Isar
Otter/Ivy
Metamath
Lego
Nuprl
Omega
The Seventeen Provers of the World Wiedjik
14
Outline

• Motivation
• Tools and Techniques
• Mechanisms

15
Tools and Techniques

• Common Conveniences
• Proof Visualization in the Large
• Navigation by Derivation

16
Common Conveniences in IDEs

• Multiple Views for understanding and navigation
• Collapsed and expanded text
• Outline Views
• And so forth
• Automatic Refactoring
• Rewriting while preserving meaning or behavior

17
(No Transcript)
18
(No Transcript)
19
(No Transcript)
20
Common Conveniences in IPEs
21
Make Variable Implicit

• Variables whose value can be inferred from the
  type of other variables may be made implicit
• If a variable is implicit its value must not be
  given
• To make a variable implicit
• Make implicit in definition
• Change all uses of definition

22
Tools and Techniques

• Common Conveniences
• Proof Visualization in the Large
• Navigation by Derivation

23
Software Visualization in the Large

• Ball and Eick, 1996
• Unary properties
• Color
• Large projects
• Multiple files

24
Software Visualization in the Large Ball and
Eick, 1996
25
Proof Visualization in the Large

• Lemma hot spots
• Revision information
• Proportion of proofs to definitions
• Goal depth

26
Goal depth

?
?
?
?
?
27
Tools and Techniques

• Common Conveniences
• Proof Visualization in the Large
• Navigation by Derivation

28
(No Transcript)
29
Navigation by Derivation

• No obvious analog currently in IDEs but
• Numerous instances where original line numbering
  is preserved
• Parsers map to grammar file line numbers
• gcc maps to source file line numbers
• Source/assembly navigation tool desirable

30
Outline

• Motivation
• Tools and Techniques
• Mechanisms

31
Mechanisms

• Textual Analysis on proofs or scripts
• Multiple Views
• Compiler/Debugger techniques
• Navigation by derivation
• Both
• Refactoring
• Proof visualization in the large

32
Summary

• IPEs non-existent
• Proofs must be managed
• Technology already exists
• Considerable theoretical possibilities

33
Tool Support for proof Engineering
Anne Mulhern
Charles Fischer
Ben Liblit
Anne Mulhern Computer Sciences Department Universi
ty of Wisconsin-Madison Madison, WI
USA mulhern_at_cs.wisc.edu www.cs.wisc.edu/mulhern