A Verified Runtime for a Verified Theorem Prover

Abstract

Abstract. Theorem provers, such as ACL2, HOL, Isabelle and Coq, rely on the correctness of runtime systems for programming languages like ML, OCaml or Common Lisp. These runtime systems are complex and critical to the integrity of the theorem provers. In this paper, we present a new Lisp runtime which has been formally verified and can run the Milawa theorem prover. Our runtime consists of 7,500 lines of machine code and is able to complete a 4 gigabyte Milawa proof effort. When our runtime is used to carry out Milawa proofs, less unverified code must be trusted than with any other theorem prover. Our runtime includes a just-in-time compiler, a copying garbage collector, a parser and a printer, all of which are HOL4-verified down to the concrete x86 code. We make heavy use of our previously developed tools for machine-code verification. This work demonstrates that our approach to machine-code verification scales to non-trivial applications.

Proof Pearl: A Verified Bignum Implementation in x86-64 Machine Code

“…The intention was to make this case study as reusable as possible so that future verified language implementations, e.g. future version of our verified Lisp implementation [16], can make use of arbitrary-precision integer arithmetic.…”

LCF-Style Bit-Blasting in HOL4

“…The resulting theorem is very large and calling the SAT solver (to no avail) took up 82 s. 5 However, this gives a false impression. In practice, run-times are typically much more respectable.…”

“…32-bit and 64-bit words), the run-times for all three problems are in the order of seconds. 5 The timings do not include the printing of terms. For obvious reasons the maximum print-depth must be limited when working with very large terms.…”

“…In this sense the tool has already been very successful. Recently it has been used to great effect by Magnus Myreen during machine code verification as part of the Jitawa project, see [5].…”

The Reflective Milawa Theorem Prover is Sound (Down to the Machine Code that Runs it)

“…The soundness evidence we have proved can be summed up in one top-level soundness theorem: the kernel of the Milawa theorem prover will, when run on our previously verified Lisp runtime [9], only ever prove statements that are true w.r.t. the semantics of Milawa's logic.…”