1. © Andrew IrelandDependable Systems Group Proof Automation for the SPARK Approach to High Integrity Ada Andrew Ireland Computing & Electrical Engineering Heriot-Watt University Edinburgh

2. © Andrew IrelandDependable Systems Group Executive Summary Funded by the EPSRC Critical Systems programme ( GR/R24081 ) in collaboration with Praxis Critical Systems Julian Richardson (Co-investigator) and Bill Ellis (Research Associate) Investigate the role of proof planning within the SPARK approach to high integrity Ada

3. © Andrew IrelandDependable Systems Group Progress Report (month 7) Background and basic approach Proposed verification architecture Initial investigation into proof automation Future work

4. © Andrew IrelandDependable Systems Group The SPARK Language A subset of Ada that eliminates potential ambiguities and insecurities (Praxis Critical Systems) Supports code level annotations Static analysis: data flow and information flow analysis and formal verification Correctness-by-construction: Z specifications down to SPARK code Applications include SHOLIS: UK MoD’s first Def Standard 00-55 project

5. © Andrew IrelandDependable Systems Group The SPARK Tools SPADE Simplifier SPARK Examiner SPADE Proof Checker proof code VCs user rules (lemmas) path functions flow analysis feedback

6. © Andrew IrelandDependable Systems Group Benefits: reduces the level of user guided search by automating the “big steps” within proof development Proof Automation Proof Plans: AI technique for mechanizing formal reasoning based upon high-level proof patterns Proof Plan = Tactics + Methods + Critics

7. © Andrew IrelandDependable Systems Group Clam-Oyster plannerchecker tactic conjectures theory proof user

8. © Andrew IrelandDependable Systems Group Mathematical induction: program verification, synthesis, and optimization; hardware verification; correction of faulty specifications. Non-inductive proof: summing series; limit theorems. Automatic proof patching: conjecture generalization, lemma discovery, induction revision, case splitting, loop invariant discovery. Applications of Proof Plans

9. © Andrew IrelandDependable Systems Group Proof Plan Reuse ripple fertilize simplify induction ripple fertilize simplify tautology ind-stratinv-strat

10. © Andrew IrelandDependable Systems Group Automatic Generalization initial conjecture schematic conjecture tactic for generalized conjecture planner

11. © Andrew IrelandDependable Systems Group Productive Use Of Failure Generalization Case split Revise induction Lemma speculation Precondition Patch X X X X 4321

12. © Andrew IrelandDependable Systems Group NuSPADE Architecture plannerchecker cmd s VCs conjectures theory proof user

13. © Andrew IrelandDependable Systems Group Playing Devil’s Advocate Long history dating back to 70s, Wegbreit, German, Katz & Manna, … Early focus on post-hoc verification where theorem proving and heuristic components were kept separate SPARK approach advocates correctness- by-construction and proof planning integrates high-level theorem proving with the heuristic components

14. © Andrew IrelandDependable Systems Group Results of Initial Investigations Previous proof plans for reasoning about imperative code carry across on paper Proofs of the absence of run-time errors exhibit common pattern – ripe for proof plan development (aim to revisit early work of Steven German) Proof patching mechanism requires extensions – constraint solving capability and bottom-up invariant generation techniques

15. © Andrew IrelandDependable Systems Group Future Work Complete first prototype of NuSPADE Conduct initial testing on “real world” applications supplied by Praxis Further investigate new proof plans and proof management issues