HOL Theorem Prover Research Articles

HOL4P4: Mechanized Small-Step Semantics for P4

We present the first semantics of the network data plane programming language P4 able to adequately capture all key features of P4 16 , the most recent version of P4, including external functions (externs) and concurrency. These features are intimately related since, in P4, extern invocations are the only points at which one execution thread can affect another. Reflecting P4’s lack of a general-purpose memory and the presence of multithreading the semantics is given in small-step style and eschews the use of a heap. In addition to the P4 language itself, we provide an architectural level semantics, which allows the composition of P4-programmed blocks, models end-to-end packet processing, and can take into account features such as arbitration and packet recirculation. A corresponding type system is provided with attendant progress, preservation, and type-soundness theorems. Semantics, type system, and meta-theory are formalized in the HOL4 theorem prover. From this formalization, we derive a HOL4 executable semantics that supports verified execution of programs with partially symbolic packets able to validate simple end-to-end program properties.

Towards the formal performance analysis of multistate coherent systems using HOL theorem proving

Many practical engineering systems and their components have multiple performance levels and failure modes. If these systems form a monotonically increasing structure function (system model) with respect to the performance of their components and also if all of their components affect the overall system performance, then they are said to be multistate coherent systems. Traditionally, the reliability analysis of these multistate coherent systems has been carried out using paper-and-pencil or simulation based methods. The former method is often prone to human errors, while the latter requires high computational resources for large and complex systems having components with multiple operational states. As a complimentary approach, we propose to use Higher-order-logic (HOL) theorem proving to develop a sound reasoning framework to analyze the reliability of multistate coherent systems in this paper. This framework allows us to formally verify generic mathematical properties about multistate coherent systems with an arbitrary number of components and their states. Particularly, we present the HOL formalization of series and parallel multistate coherent systems and formally verify their deterministic and probabilistic properties using the HOL4 theorem prover. For illustration purposes, we present the formal reliability analysis of the multistate oil and gas pipeline to demonstrate the effectiveness of our proposed framework.

Mechanisation of Model-theoretic Conservative Extension for HOL with Ad-hoc Overloading

Definitions of new symbols merely abbreviate expressions in logical frameworks, and no new facts (regarding previously defined symbols) should hold because of a new definition. In Isabelle/HOL, definable symbols are types and constants. The latter may be ad-hoc overloaded, i.e. have different definitions for non-overlapping types. We prove that symbols that are independent of a new definition may keep their interpretation in a model extension. This work revises our earlier notion of model-theoretic conservative extension and generalises an earlier model construction. We obtain consistency of theories of definitions in higher-order logic (HOL) with ad-hoc overloading as a corollary. Our results are mechanised in the HOL4 theorem prover.

Cause-Consequence Diagram Reliability Analysis Using Formal Techniques With Application to Electrical Power Networks

Cause-consequence Diagram (CCD) is widely used as a deductive safety analysis technique for decision-making at the critical-system design stage. This approach models the causes of subsystem failures in a highly-critical system and their potential consequences using Fault Tree (FT) and Event Tree (ET) methods, which are well-known dependability modeling techniques. Paper-and-pencil-based approaches and simulation tools, such as the Monte-Carlo approach, are commonly used to carry out CCD analysis, but lack the ability to rigorously verify essential system reliability properties. In this paper, we propose to use formal techniques based on theorem proving for the formal modeling and step-analysis of CCDs to overcome the inaccuracies of the simulation-based analysis and the error-proneness of informal reasoning by mathematical proofs. In particular, we use the HOL4 theorem prover, which is a computer-based mathematical reasoning tool. To this end, we developed a formalization of CCDs in Higher-Order Logic (HOL), based on the algebraic approach, using HOL4. We demonstrate the practical effectiveness of the proposed CCD formalization by performing the formal reliability analysis of the IEEE 39-bus electrical power network. Also, we formally determine the Forced Outage Rate ( $\mathcal {FOR}$ ) of the power generation units and the network reliability index, i.e., System Average Interruption Duration Index ( $\mathcal {SAIDI}$ ). To assess the accuracy of our proposed approach, we compare our results with those obtained with MATLAB Monte-Carlo Simulation (MCS) as well as other state-of-the-art approaches for subsystem-level reliability analysis.

Do you have space for dessert? a verified space cost semantics for CakeML programs

Garbage collectors relieve the programmer from manual memory management, but lead to compiler-generated machine code that can behave differently (e.g. out-of-memory errors) from the source code. To ensure that the generated code behaves exactly like the source code, programmers need a way to answer questions of the form: what is a sufficient amount of memory for my program to never reach an out-of-memory error? This paper develops a cost semantics that can answer such questions for CakeML programs. The work described in this paper is the first to be able to answer such questions with proofs in the context of a language that depends on garbage collection. We demonstrate that positive answers can be used to transfer liveness results proved for the source code to liveness guarantees about the generated machine code. Without guarantees about space usage, only safety results can be transferred from source to machine code. Our cost semantics is phrased in terms of an abstract intermediate language of the CakeML compiler, but results proved at that level map directly to the space cost of the compiler-generated machine code. All of the work described in this paper has been developed in the HOL4 theorem prover.

Mechanisation of the AKS Algorithm

The AKS algorithm (by Agrawal, Kayal and Saxena) is a significant theoretical result, establishing “PRIMES in P” by a brilliant application of ideas from finite fields. This paper describes an implementation of the AKS algorithm in our theorem prover HOL4, together with a proof of its correctness and its computational complexity. The complexity analysis is based on a conservative computation model using a writer monad. The method is elementary, but enough to show that our implementation of the AKS algorithm takes a number of execution steps bounded by a polynomial function of the input size. This establishes formally that the AKS algorithm indeed shows “PRIMES is in P”.

Unique solutions of contractions, CCS, and their HOL formalisation

The unique solution of contractions is a proof technique for (weak) bisimilarity that overcomes certain syntactic limitations of Milner's “unique solution of equations” theorem. This paper presents an overview of a comprehensive formalisation of Milner's Calculus of Communicating Systems (CCS) in the HOL theorem prover (HOL4), with a focus towards the theory of unique solutions of equations and contractions. The formalisation consists of about 24,000 lines (1MB) of code in total. Some refinements of the “unique solution of contractions” theory itself are obtained. In particular we remove the constraints on summation, which must be guarded, by moving from contraction to rooted contraction. We prove the “unique solution of rooted contractions” theorem and show that rooted contraction is the coarsest precongruence contained in the contraction preorder.

Proof-Producing Synthesis of CakeML from Monadic HOL Functions

We introduce an automatic method for producing stateful ML programs together with proofs of correctness from monadic functions in HOL. Our mechanism supports references, exceptions, and I/O operations, and can generate functions manipulating local state, which can then be encapsulated for use in a pure context. We apply this approach to several non-trivial examples, including the instruction encoder and register allocator of the otherwise pure CakeML compiler, which now benefits from better runtime performance. This development has been carried out in the HOL4 theorem prover.

Formalization of the Gateaux derivative of functional and application in the principle of virtual work

Analytical mechanics provides the central guidelines for the design of engineering machinery in use today. One of the main pillars for analytical mechanics is the principle of virtual work. In the establishment of this principle, the Gateaux derivative plays an indispensable role. In this paper, we formalize the Gateaux derivative in the interactive theorem prover HOL Light. On this basis, we formally verify the principle of virtual work. This effort paves way for the computerized formalization of analytical mechanics. Thus, it will ultimately contribute to the verified design of engineering machinery, which comes with correctness guarantees beyond what is enabled by the currently adopted validation techniques.

A verified proof checker for higher-order logic

We present a computer program for checking proofs in higher-order logic (HOL) that is verified to accept only valid proofs. The proof checker is defined as functions in HOL and synthesized to CakeML code, and uses the Candle theorem prover kernel to check logical inferences. The checker reads proofs in the OpenTheory article format, which means proofs produced by various HOL proof assistants are supported. The proof checker is implemented and verified using the HOL4 theorem prover, and comes with a proof of soundness.

Toward the Formalization of Macroscopic Models of Traffic Flow Using Higher-Order-Logic Theorem Proving

Next-generation transportation will be integrated, interconnected and highly autonomous. One key challenge in traffic management is ensuring safety while maintaining the required level of service quality. In such future mobility systems, rigorous formalization and validation will thus become critical to ensure that the transportation network operates as intended, traffic properties are reliably maintained, and services resume in a timely manner after potential disruptions. Formal methods have recently gained considerable attention as a modeling and verification paradigm capable of addressing many challenges associated with next-generation transportation systems. In this regard, we propose to use higher-order-logic theorem proving for formally analyzing transportation systems. As a first step towards this direction, we present a logical framework for the formal analysis of macroscopic models of traffic flow. Leveraging upon the high expressiveness of the underlying logic, we formally model the continuous components of macroscopic models while capturing their real behavior. In particular, we present a formalization of some foundation concepts of macroscopic models, namely density, flow rate, mean speed, relative occupancy, and shockwave using the higher-order-logic theorem prover HOL Light . This choice is primarily motivated by the fact that the macroscopic models deal with the traffic flow dynamics and thus play a vital role in planning strategies in allocating resources for implementing optimized and balanced transportation systems. For illustration, we perform the formal input-output and shockwave analysis of a German freeway. The case study demonstrated the practicability of this formal approach due to the high expressiveness of the underlying logic. The proposed research is first step towards formalizing the foundational mathematical theories and core concepts of traffic flow theory. This accomplishment will open new ways to plan and model various components of the transportation systems such as highway links, ramp metering, merging behavior and eventually address the problem of routing vehicles in a network of automated vehicles.

On the verification of system-level information flow properties for virtualized execution platforms

The security of embedded systems can be dramatically improved through the use of formally verified isolation mechanisms such as separation kernels, hypervisors, or microkernels. For trustworthiness, particularly for system-level behavior, the verifications need precise models of the underlying hardware. Such models are hard to attain, highly complex, and proofs of their security properties may not easily apply to similar but different platforms. This may render verification economically infeasible. To address these issues, we propose a compositional top-down approach to embedded system specification and verification, where the system-on-chip is modeled as a network of distributed automata communicating via paired synchronous message passing. Using abstract specifications for each component allows to delay the development of detailed models for cores, devices, etc., while still being able to verify high-level security properties like integrity and confidentiality, and soundly refine the result for different instantiations of the abstract components at a later stage. As a case study, we apply this methodology to the verification of information flow security for an industry-scale security-oriented hypervisor on the ARMv8-A platform and report on the complete verification of guest mode security properties in the HOL4 theorem prover.

TrABin: Trustworthy analyses of binaries

Verification of microkernels, device drivers, and crypto routines requires analyses at the binary level. In order to automate these analyses, in the last years several binary analysis platforms have been introduced. These platforms share a common design: the adoption of hardware-independent intermediate representations, a mechanism to translate architecture dependent code to this representation, and a set of architecture independent analyses that process the intermediate representation. The usage of these platforms to verify software introduces the need for trusting both the correctness of the translation from binary code to intermediate language (called transpilation) and the correctness of the analyses. Achieving a high degree of trust is challenging since the transpilation must handle (i) all the side effects of the instructions, (ii) multiple instruction encodings (e.g. ARM Thumb), and (iii) variable instruction length (e.g. Intel). Similarly, analyses can use complex transformations (e.g. loop unrolling) and simplifications (e.g. partial evaluation) of the artifacts, whose bugs can jeopardize correctness of the results. We overcome these problems by developing a binary analysis platform on top of the interactive theorem prover HOL4. First, we formally model a binary intermediate language and we prove correctness of several supporting tools (i.e. a type checker). Then, we implement two proof-producing transpilers, which respectively translate ARMv8 and CortexM0 programs to the intermediate language and generate a certificate. This certificate is a HOL4 proof demonstrating correctness of the translation. As demonstrating analysis, we implement a proof-producing weakest precondition generator, which can be used to verify that a given loop-free program fragment satisfies a contract. Finally, we use an AES encryption implementation to benchmark our platform.

Formal Probabilistic Analysis of Low Latency Approximate Adders

Approximate computing is an emerging trend in hardware and software design that leverages upon the inherent tolerance for inaccuracy in applications to optimize their power consumption, latency, and area. Due to the widespread usage of adders in digital hardware designs, numerous approximate adders, offering various error margins and area, latency and power constraints, have been proposed. Probabilistic error analysis of these adders holds a significant step in selecting an appropriate approximate adder for a given application. Traditionally, this analysis has been conducted using Monte-Carlo simulations or analytical analysis, which do not ascertain a sound and complete analysis. In order to overcome these limitations, we propose to use interactive theorem proving for error analysis of approximate adders. For this purpose, we present a higher-order-logic formalization of probability distributions and error related events encountered in approximate adders that comprise of subadder units, based on a probability theory formalization available in the HOL4 theorem prover. We also propose an algorithm for analyzing the probability of error as a metric for accurate comparison for high-speed, low-latency approximate adders with uniformly distributed inputs. For illustration purposes, we present the formal error analysis of three of the most widely acclaimed approximate adders, i.e., error tolerant adder-I, accuracy configurable adder, and generic accuracy configurable adder.

The verified CakeML compiler backend

AbstractThe CakeML compiler is, to the best of our knowledge, the most realistic verified compiler for a functional programming language to date. The architecture of the compiler, a sequence of intermediate languages through which high-level features are compiled away incrementally, enables verification of each compilation pass at an appropriate level of semantic detail. Parts of the compiler’s implementation resemble mainstream (unverified) compilers for strict functional languages, and it supports several important features and optimisations. These include efficient curried multi-argument functions, configurable data representations, efficient exceptions, register allocation, and more. The compiler produces machine code for five architectures: x86-64, ARMv6, ARMv8, MIPS-64, and RISC-V. The generated machine code contains the verified runtime system which includes a verified generational copying garbage collector and a verified arbitrary precision arithmetic (bignum) library. In this paper, we present the overall design of the compiler backend, including its 12 intermediate languages. We explain how the semantics and proofs fit together and provide detail on how the compiler has been bootstrapped inside the logic of a theorem prover. The entire development has been carried out within the HOL4 theorem prover.

A Verified Generational Garbage Collector for CakeML

This paper presents the verification of a generational copying garbage collector for the CakeML runtime system. The proof is split into an algorithm proof and an implementation proof. The algorithm proof follows the structure of the informal intuition for the generational collector’s correctness, namely, a partial collection cycle in a generational collector is the same as running a full collection on part of the heap, if one views pointers to old data as non-pointers. We present a pragmatic way of dealing with ML-style mutable state, such as references and arrays, in the proofs. The development has been fully integrated into the in-logic bootstrapped CakeML compiler, which now includes command-line arguments that allow configuration of the generational collector. All proofs were carried out in the HOL4 theorem prover.

Formal analysis of the kinematic Jacobian in screw theory

Abstract As robotic systems flourish, reliability has become a topic of paramount importance in the human–robot relationship. The Jacobian matrix in screw theory underpins the design and optimization of robotic manipulators. Kernel properties of robotic manipulators, including dexterity and singularity, are characterized with the Jacobian matrix. The accurate specification and the rigorous analysis of the Jacobian matrix are indispensable in guaranteeing correct evaluation of the kinematics performance of manipulators. In this paper, a formal method for analyzing the Jacobian matrix in screw theory is presented using the higher-order logic theorem prover HOL4. Formalizations of twists and the forward kinematics are performed using the product of exponentials formula and the theory of functional matrices. To the best of our knowledge, this work is the first to formally analyze the kinematic Jacobian using theorem proving. The formal modeling and analysis of the Stanford manipulator demonstrate the effectiveness and applicability of the proposed approach to the formal verification of the kinematic properties of robotic manipulators.

Unique Solutions of Contractions, CCS, and their HOL Formalisation

The unique solution of contractions is a proof technique for bisimilarity that overcomes certain syntactic constraints of Milner's "unique solution of equations" technique. The paper presents an overview of a rather comprehensive formalisation of the core of the theory of CCS in the HOL theorem prover (HOL4), with a focus towards the theory of unique solutions of contractions. (The formalisation consists of about 20,000 lines of proof scripts in Standard ML.) Some refinements of the theory itself are obtained. In particular we remove the constraints on summation, which must be weakly-guarded, by moving to rooted contraction, that is, the coarsest precongruence contained in the contraction preorder.

A Library for Combinational Circuit Verification Using the HOL Theorem Prover

Interactive theorem provers can overcome the scalability limitations of model checking and automated theorem provers by verifying generic circuits and universally quantified properties but they require explicit user guidance, which makes them quite uninteresting for industry usage. As a first step to overcome these issues, this paper presents a formally verified library of commonly used combinational circuits using the higher-order logic theorem prover HOL4. This library can in turn be used to verify the structural view of any arbitrary combinational circuit against its behavior with very minimal user-guidance. For illustration, we verified several combinational circuits, including a 24-bit adder/subtractor, the 8-bit shifter module of the c3540 benchmark, the 17-bit EqualZ_W module of the c2670 benchmark, a 16:1 Multiplexer, and a 512-bit Multiplier.

Verifying efficient function calls in CakeML

We have designed an intermediate language (IL) for the CakeML compiler that supports the verified, efficient compilation of functions and calls. Verified compilation steps include batching of multiple curried arguments, detecting calls to statically known functions, and specialising calls to known functions with no free variables. Finally, we verify the translation to a lower-level IL that only supports closed, first-order functions. These compilation steps resemble those found in other compilers (especially OCaml). Our contribution here is the design of the semantics of the IL, and the demonstration that our verification techniques over this semantics work well in practice at this scale. The entire development was carried out in the HOL4 theorem prover.