Automating Event-B invariant proofs by rippling and proof patching

Abstract

The use of formal method techniques can contribute to the production of more reliable and dependable systems. However, a common bottleneck for industrial adoption of such techniques is the needs for interactive proofs. We use a popular formal method, called Event-B, as our working domain, and set invariant preservation (INV) proofs as targets, because INV proofs can account for a significant proportion of the proofs requiring human interactions. We apply an inductive theorem proving technique, called rippling, for Event-B INV proofs. Rippling automates proofs using meta-level guidance. The guidance is in particular useful to develop proof patches to recover failed proof attempts. We are interested in the case when a missing lemma is required. We combine a scheme-based theory-exploration system, called IsaScheme [MRMDB10], with rippling to develop a proof patch via lemma discovery. We also develop two new proof patches to unfold operator definitions and to suggest case-splits, respectively. The combined use of rippling with these three proof patches as a proof method significantly improves the proof automation for our evaluation set.

Adventures in Mathematical Reasoning

“…Out of interest, I downloaded one of Alan's latest paper [31]. To my surprise and pleasure, it repeats and expands on many of the ideas I've discussed here.…”

The History of the DReaM Group

“…There is a strong relationship between loop invariants and induction rules, so Andrew Ireland adapted our techniques for suggesting induction rules to suggest loop invariants [37]. Yuhui Lin used ripple failures to suggest intermediate lemmas in Event-B verification proofs [49]. As mentioned in §5.1, we have also explored a variety of techniques for program synthesis [43,27,38].…”

“…Proof Planning: Our development of proof methods and meta-level reasoning crystallised into proof planning: specifying proof tactics so that plan formation could be used to construct a plan for a whole proof [8] (see §6.5.1). Applications of Proof Planning to Formal Methods: Since inductive reasoning is required for reasoning about repetition in both software and hardware, our automation of it could be applied to software verification [37,51,49], hardware verification [17] and program synthesis [43,27,38] (see §6.6.1). Applications to Cyber Security: Inductive reasoning was also applied to discover attacks on security protocols [69].…”

The Complex Approach of the C-lightVer System to the Automated Error Localization in C-programs

“…Другой класс исследований основан на узкоспециализированных стратегиях, ориентированных на упрощение формальной верификации [32]. Отметим, что наличие циклов приводит к необходимости автоматизации доказательства по индукции [23]. Так как для решения этой проблемы нами был разработан комплексный подход, основанный на стратегиях доказательства, то применяемый в системе C-lightVer подход можно отнести к данному классу.…”