Claus Sengler’s research while affiliated with Deutsches Forschungszentrum für Künstliche Intelligenz and other places

The reliability of complex software systems is becoming increasingly important for the technical systems they are embedded in. In order to assure the highest levels of trustworthiness of software formal methods for the development of software are required. The VSE-tool was developed by a consortium of German universities and industry to make a tool available which supports this formal development process. VSE is based on a particular method for programming in the large. This method is embodied in an administration system to edit and maintain formal developments. A deduction component is integrated into this administration system in order to provide proof support for the formed concepts. In parallel to the development of the system itself, two large case studies were conducted in close collaboration with an industrial partner. In both cases components of systems previously developed by the industry were re-developed from scratch, starting with a formal specification derived from the original documents. This paper focuses on the deduction component and its integration. We use a part of one of the industrial case studies in order to illustrate the important aspects of the deduction component: We argue that a close integration which makes the structure of developments visible for the theorem prover is necessary for an efficient treatment of changes and an indispensable structuring of the deduction process itself. Also we commend an architecture for interactive strategic theorem proving which has turned out to be adequate for applications in the context of formal program development. The last one of the three main sections addresses the important point of detecting bugs in implementations and specifications.

Um das Vertrauen in die Korrektheit eines IT-Systems (Informationstechnisches System) zu beurteilen, werden in einschlägigen Sicherheitskriterien [IT-SK, ITSEC] Qualitätsanforderungen u.a. an den Entwicklungsprozeß der Sicherheitsfunktionalität von IT-Systemen gestellt. Für die hohen Qualitätssstufen [IT-SK]/Evaluationsstufen [ITSEC] wird insbesondere der Einsatz formaler Methoden zur Entwicklung der sicherheitsrelevanten Systemkomponenten vorgeschrieben. In diesem Beitrag wird das Entwicklungswerkzeug Verification Support Environment und seine Methodik zur Entwicklung vertrauenswürdiger Software-Systeme vorgestellt. Dieses Werkzeug ist konzeptionell an den Anforderungen der höheren Qualitätsstufen/Evaluationsstufen einschlägiger Sicherheitskriterienwerke ausgerichtet. Das Neue und Außergewöhnliche an diesem Werkzeug gegenüber klassischen CASE-Werkzeugen ist die Möglichkeit, über formale Spezifikations- und Verifikationsmethodiken, die Korrektheit ganzer Software-Systeme oder Teilen davon formal nachzuweisen.

. The reliability of complex software systems is becoming increasingly important for the technical systems they are embedded in. In order to assure the highest levels of trustworthiness of software formal methods for the development of software are required. The VSE-tool was developed by a consortium of German universities and industry to make a tool available which supports this formal development process. VSE is based on a particular method for programming in the large. This method is embodied in an administration system to edit and maintain formal developments. A deduction component is integrated into this administration system in order to provide proof support for the formal concepts. In parallel to the development of the system itself, two large case studies were conducted in close collaboration with an industrial partner. In both cases components of systems previously developed by the industry were re-developed from scratch, starting with a formal specification derived from the o...

The amount of user interaction is the prime cause of costs in interactive program verification. This paper describes an internal analogy technique that reuses subproofs in the verification of state-based specifications. It identifies common patterns of subproofs and their justifications in order reuse these subproofs; thus significant savings on the number of user interactions in a verification proof are achievable. 1 Introduction Software verification is the job of taming complexity: in order to verify, say one hundred thousand lines of source code, several ten thousands of proof obligations have to be shown, some of which may require formal proofs of up to eight or ten thousand steps. Usually these long proofs consist of a considerable number of relatively simple subproofs to be established. Even for a small percentage of interactive steps, i.e., those steps the user has to supply as opposed to those steps that are generated automatically by the system (in the VSE system [3] curre...

. Termination proofs for recursively defined operations serve several purposes: On the one hand, of course, they ensure the termination of the respective algorithms which is an essential topic in software verification. On the other hand, a successful termination proof allows to use the termination ordering as an induction ordering for future inductive proofs. So far, in the area of explicit inductive theorem proving only data types were admitted whose objects possess a unique syntactical representation. These data types include nat 1 , lists, and trees. However, there are data types that do not possess this property, as, for instance, finite sets and finite arrays, which are frequently used for specifications in software verification. In this paper we are concerned with these data types. We admit them to explicit inductive theorem proving and, furthermore, we present an approach for an automated termination analysis of recursively defined algorithms over these data types. 1 Motivatio...

. The INKA system is a first-order theorem prover with induction based on the explicit induction paradigm. Since 1986 when a first version of the INKA system was developed there have been many improvements. In this description we will give a short overview of the current system state and its abilities. 1 Introduction The original INKA system dates back to 1986 [2]. The current version of the INKA system which will be described below has been developed at DFKI GmbH 1 between 1991 and 1995. The INKA system is a first-order theorem prover with induction based on the explicit induction paradigm. In contrast to Nqthm, the Boyer-Moore prover, [3], the system is based on a full first-order calculus, a special variant of an ordersorted resolution calculus with paramodulation, [7]. However, it is not specialized on inductive proofs but possesses a powerful predicate-logic proof component. INKA is designed to be used for practical applications of inductive theorem proving, for instance, in th...

The development of software components, that are provably correct with respect to a formal specification, requires semantic conditions to be formalized and proved. Only then, the corresponding development step is guaranteed to be correct. Besides the adequacy of the concepts underlying the overall development method, the time and skill necessary to fulfill these proof obligations are the main limiting factors for an application of formal techniques. Powerful deduction systems are therefore essential components of computer-aided software development systems. The INKA system is a first-order theorem prover with induction, and it is designed to be used for practical applications such as the formal development of software. Therefore, INKA possesses an interaction facility which follows the paradigm of direct manipulation. Any proof or proof attempt is summarized as a proof sketch which contains all deduction steps done so far as well as the strategic information concerning the...