In this paper the interaction between users and the interactive theorem prover HOL is investigated from a human-computer interaction perspective. First, we outline three possible views of interaction, and give a brief survey of some current interfaces and how they may be described in terms of these views. Second, we describe and present the results of an empirical study of intermediate and expert HOL users. The results are analysed for evidence in support of the proposed view of proof activity in HOL. We believe that this approach provides a principled basis for the assessment and design of interfaces to theorem provers.

No abstract

We consider the problems of verifying properties of LOTOS speci cations with speci c reference t o t w o case studies, one of which was proposed b y a n i n d u strial collaborator. The case studies present quite different veri cation requirements and we study a range of veri cation and validation techniques, based o n various behavioural congruences and preorders, which may be applied, also using some mechanised t o ol support. We consider the implications of the (formal) proofs which succeed or fail with respect to our desired properties, and draw some conclusions about the verication process. what we can conclude about the state of the art in LOTOS veri cation. In this paper we g i v e a n o verview of some of the work we h a ve carried out, including the techniques and tools used, and two kinds of case studies considered. We describe our experiences with two particular case studies in some detail: a communications protocol and a control device for a dual mode radiotherapy m a c hine. The former case study originates from a major U.K. defence contractor and the latter is an abstraction of a real machine. While some aspects of these two particular studies have been reported elsewhere, e.g. in 13] and 24], we use these two studies here to illustrate what we h a ve learned about various aspects of the veri cation issues given above, as well as reporting on further work on the studies. LOTOSThe reader is referred to the LOTOS standard 10] and 1] for an introduction to LOTOS. LOTOS consists of two parts: so-called Basic LOTOS, for describing interaction and ow o f c o n trol, and ACT ONE, for describing equationally speci ed abstract data types. Basic LOTOS is very similar to CCS 21], drawing some aspects, particularly multi-way s y n c hronisation, from CSP 9].The semantics of LOTOS speci cations are given by structured labelled transition systems (de ned by inference rules). Various relations based on observable behaviour may be de ned over these systems we have found the most useful relations for veri cation purposes are weak bisimulation congruence and the testing relation cred. The full de nitions of these relations may be found in 10].Brie y, t wo processes are weak bisimulation congruent if they have the same observable behaviour in all contexts, ignoring occurrences of the internal action, and two processes are related via the cred preorder if, in all contexts, whenever one process passes a test, the other process does too. We c hoose these relations as the system under examination will probably have t o interact with other systems, therefore it is important that it behaves in the same way in all contexts.

This paper presents the problem of designing the functional behaviour of the interaction between two side-stick controllers, an autopilot, and a flight control computer in a fly-by-wire aircraft. Two models are developed using the ISO formal description technique LOTOS, and analysed using rigorous abstract testing techniques.

No abstract