The Role of Human Creativity in Mechanized Verification J Strother - - PowerPoint PPT Presentation

the role of human creativity in mechanized verification
SMART_READER_LITE
LIVE PREVIEW

The Role of Human Creativity in Mechanized Verification J Strother - - PowerPoint PPT Presentation

The Role of Human Creativity in Mechanized Verification J Strother Moore Department of Computer Science University of Texas at Austin 1 John McCarthy (Sep 4, 1927 Oct 23, 2011) 2 Contributions Lisp, mathematical semantics for


slide-1
SLIDE 1

The Role of Human Creativity in Mechanized Verification

J Strother Moore Department of Computer Science University of Texas at Austin

1

slide-2
SLIDE 2

John McCarthy(Sep 4, 1927 – Oct 23, 2011)

2

slide-3
SLIDE 3

Contributions Lisp, mathematical semantics for programming languages, “Artificial Intelligence,” garbage collection, if-then-else, circumscription for non-monotonic logic, . . .

3

slide-4
SLIDE 4

In order for a program to be capable of learning something it must first be capable of being told it. — John McCarthy, “Programs with Common Sense” (aka “The Advice Taker”), 1959

4

slide-5
SLIDE 5

Instead of debugging a program, one should prove that it meets its specifications, and this proof should be checked by a computer program. — John McCarthy, “A Basis for a Mathematical Theory of Computation,” 1961

5

slide-6
SLIDE 6

The meaning of a program is defined by its effect on the state vector. – John McCarthy, “Towards a Mathematical Science of Computation,” 1962

6

slide-7
SLIDE 7

If you’d given this talk in 1981, I would have said ‘What took so long?’ — John McCarthy, after a talk by J Moore

  • n applications of ACL2 in the mid-1990s

7

slide-8
SLIDE 8

8

slide-9
SLIDE 9

Delusion Mouse Trap (1876)

9

slide-10
SLIDE 10

Royal Number 1 Trap (1879)

10

slide-11
SLIDE 11

Hotchkiss 5-hole Choker (1890?)

11

slide-12
SLIDE 12

12

slide-13
SLIDE 13

13

slide-14
SLIDE 14

14

slide-15
SLIDE 15

15

slide-16
SLIDE 16

16

slide-17
SLIDE 17

17

slide-18
SLIDE 18

18

slide-19
SLIDE 19

19

slide-20
SLIDE 20

Mathematicians Do It Too Virtually every textbook proof has been cleaned up, sometimes to the point where the original proof (or even the original theorem) is completely absent.

20

slide-21
SLIDE 21

Probably every theorem of analysis proved in the 17th and 18th centuries was proved again more cleanly and rigorously in the 19th century using the “epsilon-delta” approach.

21

slide-22
SLIDE 22

“The original proof of CRT [the Church–Rosser theorem] was fairly long and very complicated. . . . Newman generalized the universe of discourse . . . . He proved a result similar to CRT by topological arguments. Curry . . . generalized the Newman result . . . .

22

slide-23
SLIDE 23

Unfortunately, it turned out that neither the Newman result nor the Curry generalization entailed CRT. . . . This was discovered by Schroer . . . . Schroer derived still further generalizations of the Newman and Curry results, which indeed do entail CRT. . . . Schroer 1965 is 627 typed pages . . . .

23

slide-24
SLIDE 24

Chapter 4 of Curry and Feys 1958 is devoted to a proof of CRT for λ-calculus and . . . is not recommended for light

  • reading. . . . Meanwhile a genuine

simplification of the proof of CRT had come in sight. See Martin-L¨

  • f 1972.

24

slide-25
SLIDE 25

It is agreed that Martin-L¨

  • f got some of his

ideas from lectures by Tait. An exposition

  • f the proof of CRT according to Tait and

Martin-L¨

  • f appears in Appendix I of

Hindley, Lercher and Seldin 1972.” – J.B. Rosser

25

slide-26
SLIDE 26

It is (apparently) in our natures to polish

  • ur work to make it more beautiful,

elegant, and understandable.

26

slide-27
SLIDE 27

It is (apparently) in our natures to polish

  • ur work to make it more beautiful,

elegant, and understandable. This is great if your only concern is the beauty/elegance/clarity of the final product.

27

slide-28
SLIDE 28

It is (apparently) in our natures to polish

  • ur work to make it more beautiful,

elegant, and understandable. This is great if your only concern is the beauty/elegance/clarity of the final product. But it is harmful in our business!

28

slide-29
SLIDE 29

Our Business Formal methods research is not about proving hardware and software correct. Formal methods research is about mechanizing creativity. By polishing our results we obscure the problems we’re really trying to solve.

29

slide-30
SLIDE 30

A Trivial Example from My Class

  • (endp x) — determines if x is empty
  • (car x) — first element of x (when x is

non-empty)

  • (cdr x) — rest of x (when x is

non-empty)

30

slide-31
SLIDE 31
  • (member e x) — determines whether e
  • ccurs as an element of list x
  • (rm! e x) — deletes every occurrence
  • f e as a element from x

31

slide-32
SLIDE 32

A Student’s Definition (defun set-equal (x y) (if (endp x) (endp y) (and (member (car x) y) (set-equal (rm! (car x) x) (rm! (car x) y)))) This function determines whether x and y have the same elements, ignoring order and duplication.

32

slide-33
SLIDE 33

The Student’s Goal Theorem (set-equal (append a a) a)

33

slide-34
SLIDE 34

The Student’s Goal Theorem (set-equal (append a a) a) (defun append (x y) (if (endp x) y (cons (car x) (append (cdr x) y))))

34

slide-35
SLIDE 35

The Student’s Goal Theorem (set-equal (append a a) a) Axiom (append x y) = (if (endp x) y (cons (car x) (append (cdr x) y)))

35

slide-36
SLIDE 36

The Student’s Goal Theorem (set-equal (append a a) a) Axiom Instance (append a a) = (if (endp a) a (cons (car a) (append (cdr a) a)))

36

slide-37
SLIDE 37

We tackled this interactively in class. Here is our more general theorem: (defthm crux (implies (subset b a) (set-equal (append a b) a))) (defthm goal (set-equal (append a a) a))

37

slide-38
SLIDE 38

The Definition of Subset (defun subset (x y) (if (endp x) t (and (member (car x) y) (subset (cdr x) y))))

38

slide-39
SLIDE 39

In class we proved several beautiful and helpful lemmas, e.g., (rm! e (append a b)) = (append (rm! e a) (rm! e b)) But with no time remaining in class our still unproved crux looked like this:

39

slide-40
SLIDE 40

(defthm crux (implies (subset b a) (set-equal (append a b) a)) :hints (("Goal" :induct (set-equal a b)) ("Subgoal *1/2’’" :use (:instance subset-rm! (x b) (y a) (e (car a)))) ("Subgoal *1/3’" :expand ((set-equal (append a b) a)))))

40

slide-41
SLIDE 41

(defthm crux (implies (subset b a) (set-equal (append a b) a)) :hints (("Goal" :induct (set-equal a b)) ("Subgoal *1/2’’" :use (:instance subset-rm! (x b) (y a) (e (car a)))) ("Subgoal *1/3’" :expand ((set-equal (append a b) a)))))

41

slide-42
SLIDE 42

Class ended. I went home. I ate, watched TV, read, showered, slept. I woke up with the alarm and knew I should change my approach in two ways.

42

slide-43
SLIDE 43

Insight 1: Redefine subset (defun subset (x y) (if (endp x) t (and (member (car x) y) (subset (cdr x) y))))

43

slide-44
SLIDE 44

Insight 1: Redefine subset (defun subset (x y) (if (endp x) t (and (member (car x) y) (subset (cdr x) y))))

44

slide-45
SLIDE 45

Insight 1: Redefine subset (defun subset (x y) (if (endp x) t (and (member (car x) y) (subset (rm! (car x) x) (rm! (car x) y)))))

45

slide-46
SLIDE 46

This is Fair It does not change the goal theorem. The definitional principle is conservative. Subset is not mentioned in the final theorem. So how it is defined doesn’t matter – except to the proof.

46

slide-47
SLIDE 47

The Proof Plan (defthm crux (implies (subset b a) (set-equal (append a b) a))) (defthm goal (set-equal (append a a) a))

47

slide-48
SLIDE 48

Redefining Subset is a Good Move

(defun subset (x y) (if (endp x) t (and (member (car x) y) (subset (rm! (car x) x) (rm! (car x) y))))) (defun set-equal (x y) (if (endp x) (endp y) (and (member (car x) y) (set-equal (rm! (car x) x) (rm! (car x) y)))))

48

slide-49
SLIDE 49

Insight 2: Re-state crux (defthm crux ; Old (implies (subset b a) (set-equal (append a b) a)))

49

slide-50
SLIDE 50

Insight 2: Re-state crux (defthm crux ; Old (implies (subset b a) (set-equal (append a b) a)))

50

slide-51
SLIDE 51

Insight 2: Re-state crux (defthm crux ; New (implies (subset b a) (set-equal (append b a) a)))

51

slide-52
SLIDE 52

The Proof Plan Still “Works” (defthm crux ; New (implies (subset b a) (set-equal (append b a) a))) (defthm goal (set-equal (append a a) a))

52

slide-53
SLIDE 53

But the New Crux is Easier to Prove (defthm crux ; Old (implies (subset b a) (set-equal (append a b) a))) (defthm crux ; New (implies (subset b a) (set-equal (append b a) a)))

53

slide-54
SLIDE 54

About Induction To prove φ(x, y) by induction on x: Base: (endp x) → φ(x, y) Induction Step: (¬(endp x) ∧ φ(x′, y′)) → φ(x, y) where x′ is “shorter than” x.

54

slide-55
SLIDE 55

About Induction To prove φ(x, y) by induction on x: Base: (endp x) → φ(x, y) Induction Step: (¬(endp x) ∧ φ(x′, y′)) → φ(x, y) where x′ is “shorter than” x.

55

slide-56
SLIDE 56

About Induction To prove φ(x, y) by induction on x: Base: (endp x) → φ(x, y) Induction Step: (¬(endp x) ∧ φ(x′, y′)) → φ(x′, y′) where x′ is “shorter than” x.

56

slide-57
SLIDE 57

About Induction To prove φ(x, y) by induction on x: Base: (endp x) → φ(x, y) Induction Step: (¬(endp x) ∧ φ(x′, y′)) → φ(x′, y′) where x′ is “shorter than” x.

57

slide-58
SLIDE 58

So the key to proving φ(x, y) by induction is finding a φ with the property that it can be rewritten to an instance of itself.

58

slide-59
SLIDE 59

Rewrite to an Instance? (defthm crux ; Old (implies (subset b a) (set-equal (append a b) a))) (defthm crux ; New (implies (subset b a) (set-equal (append b a) a)))

59

slide-60
SLIDE 60

The Old Crux: Rewrite to an Instance? (implies (subset b a) (set-equal (append a b) a))

60

slide-61
SLIDE 61

The Old Crux: Rewrite to an Instance? (implies (subset b a) (set-equal (append a b) a))

61

slide-62
SLIDE 62

The Old Crux: Rewrite to an Instance? (implies (subset b a) (set-equal (append a b) a))

62

slide-63
SLIDE 63

The Old Crux: Rewrite to an Instance? (implies (subset (rm! (car b) b) (rm! (car b) a)) (set-equal (append a b) a))

63

slide-64
SLIDE 64

The Old Crux: Rewrite to an Instance? (implies (subset (rm! (car b) b) (rm! (car b) a)) (set-equal (append a b) a))

64

slide-65
SLIDE 65

The Old Crux: Rewrite to an Instance? (implies (subset (rm! (car b) b) (rm! (car b) a)) (set-equal (rm! (car a) (append a b)) (rm! (car a) a)))

65

slide-66
SLIDE 66

The Old Crux: Rewrite to an Instance? (implies (subset (rm! (car b) b) (rm! (car b) a)) (set-equal (append (rm! (car a) a) (rm! (car a) b)) (rm! (car a) a)))

66

slide-67
SLIDE 67

The Old Crux: Rewrite to an Instance? (implies (subset (rm! (car b) b) (rm! (car b) a)) (set-equal (append (rm! (car a) a) (rm! (car a) b)) (rm! (car a) a)))

67

slide-68
SLIDE 68

The Old Crux: (implies (subset b a) (set-equal (append a b) a))

68

slide-69
SLIDE 69

The Old Rewritten Crux: Not an Instance! (implies (subset (rm! (car b) b) (rm! (car b) a)) (set-equal (append (rm! (car a) a) (rm! (car a) b)) (rm! (car a) a)))

69

slide-70
SLIDE 70

The Old Rewritten Crux: Not an Instance! (implies (subset (rm! (car b) b) (rm! (car b) a)) (set-equal (append (rm! (car a) a) (rm! (car a) b)) (rm! (car a) a)))

70

slide-71
SLIDE 71

The Old Rewritten Crux: Not an Instance! (implies (subset (rm! (CAR B) b) (rm! (car b) a)) (set-equal (append (rm! (car a) a) (rm! (CAR A) b)) (rm! (car a) a)))

71

slide-72
SLIDE 72

The Old Crux... is hard to prove by induction because some

  • f its subterms remove (car b) but others

remove (car a), so we need “inconsistent instantiations”, sometimes replacing b by

  • ne term, (rm! (car b) b), and

sometimes by another, (rm! (car a) b).

72

slide-73
SLIDE 73

The New Crux: Rewrite to an Instance? (implies (subset b a) (set-equal (append b a) a))

73

slide-74
SLIDE 74

The New Crux: Rewrite to an Instance? (implies (subset b a) (set-equal (append b a) a))

74

slide-75
SLIDE 75

The New Crux: Rewrite to an Instance? (implies (subset b a) (set-equal (append b a) a))

75

slide-76
SLIDE 76

The New Crux: Rewrite to an Instance? (implies (subset (rm! (car b) b) (rm! (car b) a)) (set-equal (append b a) a))

76

slide-77
SLIDE 77

The New Crux: Rewrite to an Instance? (implies (subset (rm! (car b) b) (rm! (car b) a)) (set-equal (append b a) a))

77

slide-78
SLIDE 78

The New Crux: Rewrite to an Instance? (implies (subset (rm! (car b) b) (rm! (car b) a)) (set-equal (rm! (car b) (append b a)) (rm! (car b) a)))

78

slide-79
SLIDE 79

The New Crux: Rewrite to an Instance? (implies (subset (rm! (car b) b) (rm! (car b) a)) (set-equal (append (rm! (car b) b) (rm! (car b) a)) (rm! (car b) a)))

79

slide-80
SLIDE 80

The New Crux: Rewrite to an Instance? (implies (subset (rm! (car b) b) (rm! (car b) a)) (set-equal (append (rm! (car b) b) (rm! (car b) a)) (rm! (car b) a)))

80

slide-81
SLIDE 81

The New Crux (implies (subset b a) (set-equal (append b a) a))

81

slide-82
SLIDE 82

The New Rewritten Crux: an Instance! (implies (subset (rm! (car b) b) (rm! (car b) a)) (set-equal (append (rm! (car b) b) (rm! (car b) a)) (rm! (car b) a)))

82

slide-83
SLIDE 83

The New Crux The improved formulation is easy to prove because we remove (car b) uniformly from b and from a everywhere.

83

slide-84
SLIDE 84

So after breakfast, I typed in the new formulation of subset and crux and the proof was done. Then, while driving to campus...

84

slide-85
SLIDE 85

Insight 3: No Generalization Needed Using the rules developed for the proof above, we can prove (defthm goal (set-equal (append a a) a)) directly by induction on a by (rm! (car a) a). There is no need for subset or crux!

85

slide-86
SLIDE 86

A Tale of Two Papers Which is the better paper to write? An Automatic Proof of Goal

  • r

How Not to Prove Goal, and Why Which paper might lead somebody to breakthrough research?

86

slide-87
SLIDE 87

Other Examples

  • How do you model the system in

question? Should you include the behavior of resource x in your model? Why not?

  • What is the right specification?

87

slide-88
SLIDE 88
  • How do you define the concepts used in

the specification? What “goes wrong” if you adopt some equally obvious alternative?

  • What “obvious” variable orderings did

you try before the one that worked? Why were they “wrong?”

88

slide-89
SLIDE 89
  • What “obvious” canonical forms did you

adopt before finding the ones that worked? Why were they “wrong?”

  • What modeling/testing/proof debugging

tools did you use? By highlighting such issues we facilitate automation.

89

slide-90
SLIDE 90

Summary Our customers rightly want to see the elegant solution. But we should be showing each other the failures and false starts.

90

slide-91
SLIDE 91

91