Isabelle/UTP. Isabelle/UTP [38, 72, 36] is a mechanisation of the UTP semantic framework in the proof assistant Isabelle/HOL [59]. It allows us to define UTP theories within the alphabetised relational calculus, whilst taking advantages of Isabelle’s type checker, and then mechan- ically prove associated theorems, such as algebraic laws. Such laws can then be applied to program verification tasks in Isabelle. ⇒ An alphabetised relation is essentially a set of possible observations that can be made of the model, such as the set of possible input and output mappings. Our model of alphabetised predicates, therefore, is α upred ¾ α bool, where α is a suitable type for modelling the alphabet, that corresponds to the state space. This means that we can easily implement the usual operators of boolean algebra and complete lattices by lifting the corresponding HOL notions on sets. Similarly, relational operators like composition P ; Q can also be obtained by lifting the corresponding HOL functions. ⇒ ≈ Variables in the state space α are modelled abstractly using lenses [31, 30], which are perhaps best known in the functional programming world. A lens V = S, for view type V and source type S, identifies V with a subregion of S. This is illustrated in Figure 4, where the hatched region denotes the portion of S that V corresponds to. Lenses can be used to abstract many types of data structure. For example, if S is a record type, then V might be a particular field, or if S is a function type, then V might be an element of the domain. A lens consists of two functions: get that extracts a view from a larger source, and put that puts back an updated view. Moreover the behaviour of lenses is constrained by a number of algebraic laws which are summarised in Figure 5. Since lenses are semantic rather than syntactic entities, we cannot compare them just using (in)equality, and thus we introduce further operators. Lens equivalence, X Y, states that lenses X and Y view precisely the same region of the source, though these views may have different types. Lens independence, X da Y, states that the two lens views are independent: manipulating the source type using X has no effect on the region identified by Y and vice-versa. Such operators can be used as the basis for comparison of variables. ⊕ We have mechanised a theory of lenses in Isabelle during this project, including an algebra that allows us to variously compose lenses in the style of separation algebra [12]. For example, the sum lens X...
Isabelle/UTP. In order to verify the correctness of UTP-based semantic models, we need mechanical support for formalising UTP theories, proving algebraic laws, composing them to produce denota- tional models, and providing provably corresponding semantic bases. In a theorem prover like Isabelle, we can go even further and construct proof tactics and procedures for proving prop- erties of theory objects (i.e. programs or models) in a particular semantic interface, such as a Hoare logic based program verifier. This then means that we have an unbroken chain from proof of program correctness to justification in terms of high-level properties in the underlying denotational semantic models and theories. We have therefore mechanised the UTP semantic framework in Isabelle/UTP [15, 17]. Is- abelle/UTP is a framework that allows the formation of theories, semi-automated proof of their properties, and theory combination to provide semantic models. It is a (relatively) deep se- mantic embedding of the UTP relational calculus into the HOL object logic. Unlike typical deep embeddings, it is also integrated with Isabelle’s type system and automated proof tactics. Thus it allows both precise reasoning about program semantics, and also facilitates program verification. Isabelle/UTP facilitates mechanised theory engineering, that is the creation and false € Q = ⊥D (8) ⊥D; (P € Q) = ⊥D (9) (P1 € Q1) H (P2 € Q2) = (P1 ∧ P2 € Q1 ∨ Q2) (10) (p1 € Q1); (p2 € Q2) = (p1 ∧ (Q1 wp p2)) € (Q1; Q2) (11) Table 5: Algebraic laws of designs Figure 2: A UTP proof using the ISAR language exploration of the theories of programming with machine aided reasoning facilities. For exam- ple, all the laws shown in Tables 3 and 5 have been verified with respect to our model in this framework. We give a model to alphabetised predicates as a derived Isabelle type, and then define the standard constructs of predicates and relations as Isabelle functions. We also give a purely se- mantic model to expressions, variable renaming, and substitution. We then define proof tactics that allow us to automate proofs. The majority of these tactics work by soundly translating a UTP predicate into some kind of Isabelle/HOL construct, such as sets or binary relations, for which a large number of laws have already been proven. For example utp-pred-tac converts a UTP predicate into a HOL predicate, and this allow standard predicate reasoning to be applied. In contrast utp-rel-tac can be applied to relational conjecture, through ...
Isabelle/UTP. Isabelle/UTP is a theorem prover implemented within the Isabelle proof assistant and logic of HOL. It supports proof in the context of Hoare and He’s Unifying Theories of Programming (UTP) [20]. This is a general and unifying framework to define programming language semantics, and we have used it to encode Circus, amongst other languages. The UTP adopts a predicative approach that represents computational mod- els as relations over a theory-specific alphabet of variables. Those variables determine the observable quantities and can, for instance, include the state variables of a program, traces of a reactive process, or trajectories of a hybrid system. State spaces in Isabelle/UTP are modelled by record types (named tuples). In Isabelle/UTP, we use the command alphabet to construct such types. Below is an example that introduces three variables, x, y and z. The alphabet command is similar to Isabelle/HOL’s built-in record com- mand for introducing record types, but caters for some additional set-up in the context of UTP. We give a detailed technical explanation of it in [15]. To give an example of a predicate encoding, let us consider a model of the assignment z := x ∗ y . We encode it as follows in Isabelle/UTP. The above corresponds to the hand-written relational predicate x j = x ∧ yj = y ∧ z j = x ∗ y . Primed variables are used to refer to the values of variables after a computa- tion has finished, and plain (unprimed) variables refer to their values at the start of a computation. Whereas the third conjunct specifies the new value of z , we note that the first two conjuncts are necessary to ensure that x and y retain their values. The encoding illustrates a few salient points about Isabelle/UTP. First of all, variables have to be prefixed with either & or $, depending on whether they are used in the context of a plain predicate that does not allow primed variables, or in the context of a relational predicate that does so, like the one above. Secondly, operators (such as ‘=’ above) usually have to be subscripted to delineate them from HOL operators. There are a few exceptions to this; for instance, arithmetic operators can be written as in HOL. ∧ ⇒ ∧ Important to note is that the general view of the UTP modelling computa- tions as predicates facilitates a contractual view. For instance, more gener- ally, predicates of the form ok P ok j Q specify total-correctness pro- grams as familiar pre- and postcondition pairs (P, Q ). Here, ok and ok j are special...
Isabelle/UTP. Isabelle/UTP is a theorem prover implemented in the Isabelle proof assistant, on top of Higher-Order Logic (HOL). It supports proof in the context of Hoare and He’s Unifying Theories of Programming (UTP) [21]. This is a general and unifying framework to define programming language semantics. It adopts a predicative approach that represents computational models as relations over a theory-specific alphabet of variables. These determine the observable quantities and can, for instance, include the state variables of a program, traces of a reactive process, or trajectories of a hybrid system. To give an example, we consider the predicate
