Features/Formal Methods

From FedoraProject

< Features(Difference between revisions)
Jump to: navigation, search
(Owner)
(Detailed Description: Add link to new page)
 
(2 intermediate revisions by one user not shown)
Line 3: Line 3:
  
 
= Feature Name =
 
= Feature Name =
Provers
+
Formal methods
  
 
<!-- If too short, could say "Basic support for key provers, solvers, and formal methods tools" -->
 
<!-- If too short, could say "Basic support for key provers, solvers, and formal methods tools" -->
  
 
== Summary ==
 
== Summary ==
Add basic support for some key provers, solvers, and formal methods tools.
+
"Formal methods" are techniques that use mathematics to prove that models of software, hardware, or systems will or will not have certain behaviors. To be practical, they must be automated using tools.  
These tools let you prove that some facts are true (given other facts) and/or model
+
systems using mathematics. In some limited cases they can be used to
+
greatly increase the reliability of software and hardware.
+
  
== Owner ==
+
Fedora has now added basic support for some key formal methods tools,
* Name: [[User:dwheeler|David A. Wheeler]] (proposer)
+
letting you prove that some facts are true (given other facts) and/or model systems using mathematics. In some limited cases they can be used to greatly increase the reliability of software and hardware.
  
 
This suite has been primarily packaged by the members of the [[FormalMethods|Fedora Formal Methods SIG]].
 
This suite has been primarily packaged by the members of the [[FormalMethods|Fedora Formal Methods SIG]].
 +
 +
== Owner ==
 +
* Name: [[User:dwheeler|David A. Wheeler]] (proposer)
  
 
== Current status ==
 
== Current status ==
* Targeted release: [[Releases/10 | Fedora10 ]]  
+
* Targeted release: [[Releases/13 | Fedora13 ]]  
* Last updated: 2008-08-07
+
* Last updated: 2010-01-14
* Percentage of completion: 95% (MiniSAT packaged and approved, but not yet in devel repository)
+
* Percentage of completion: 100%
  
 
<!-- CHANGE THE "FedoraVersion" TEMPLATES ABOVE TO PLAIN NUMBERS WHEN YOU COMPLETE YOUR PAGE. -->
 
<!-- CHANGE THE "FedoraVersion" TEMPLATES ABOVE TO PLAIN NUMBERS WHEN YOU COMPLETE YOUR PAGE. -->
Line 35: Line 35:
 
Although these tools are still maturing, they are beginning to become useful in some limited circumstances.
 
Although these tools are still maturing, they are beginning to become useful in some limited circumstances.
 
Now some key ones are packaged so developers on Fedora can begin to experiment with them.
 
Now some key ones are packaged so developers on Fedora can begin to experiment with them.
 +
 +
The [[Formal methods tool suite]] page provides a longer description of the various kinds of tools, and the packages that implement them.
  
 
Here are some of these kinds of tools, along with packages of programs
 
Here are some of these kinds of tools, along with packages of programs
 
that perform them:
 
that perform them:
 
* Automated Theorem Provers: These take mathematical facts and attempt to prove a goal, completely automatically. Packages: ''prover9'', ''Zenon''.
 
* Automated Theorem Provers: These take mathematical facts and attempt to prove a goal, completely automatically. Packages: ''prover9'', ''Zenon''.
* Interactive Theorem Provers: These help humans take mathematical facts and attempt to prove a goal, in cases where the automated tools can't manage.  Package: ''Coq''
+
* Interactive Theorem Provers: These help humans take mathematical facts and attempt to prove a goal, in cases where the automated tools can't manage.  Package: ''Coq'', ''PVS'' (as pvs-sbcl)
 
* Program Provers: These take software code and work to prove claims about them, typically by breaking the code and claims into a large number of verification conditions (VCs) for the above to prove. Package: ''Why'' (for annotated C and Java)
 
* Program Provers: These take software code and work to prove claims about them, typically by breaking the code and claims into a large number of verification conditions (VCs) for the above to prove. Package: ''Why'' (for annotated C and Java)
 
* Formal specification languages: These let people describe software or systems using a mathematically rigorous language, such as Z.  Package: ''tex-zfuzz''
 
* Formal specification languages: These let people describe software or systems using a mathematically rigorous language, such as Z.  Package: ''tex-zfuzz''
* Boolean Satisfiability (SAT) solvers: These take boolean equations and solve for them; they are a basic building block for some implementations of the above. Packages: sat4j, ''[https://bugzilla.redhat.com/show_bug.cgi?id=453701 MiniSAT2]'
+
* Boolean Satisfiability (SAT) solvers: These take boolean equations and solve for them; they are a basic building block for some implementations of the above. Packages: sat4j, minisat2
  
 
Do ''not'' assume that you can just take a program prover on a big existing program and start
 
Do ''not'' assume that you can just take a program prover on a big existing program and start
Line 63: Line 65:
 
== Scope ==
 
== Scope ==
 
Developers have had to package a number of programs, most of which have not been packaged before.
 
Developers have had to package a number of programs, most of which have not been packaged before.
In some cases, we've had to address integration problems (e.g., Zenon changed its input format, but the
+
In some cases, we've had to address integration problems.
Why developers didn't know that).
+
It has no effect on those who don't wish to use these tools.
+
  
There is ongoing work work to package PVS (interactive prover) and Alt-Ergo (automated prover),
+
This feature has no effect on those who don't wish to use these tools.
both of which can support Why.
+
It would be great if they were part of the initial Fedora 10 release,
+
but they are not required to have a reasonable initial set of provers and related tools available in Fedora 10.
+
Even if they are not part of the initial Fedora 10 release, they are expected to be added soon afterwards.
+
Alt-Ergo requires Ocaml-graph, which ''is'' being added to Fedora 10, so we are at least laying the groundwork.
+
Unfortunately, Alt-Ergo uses the extremely rare CeCILL-C license (not CeCILL); this license
+
has not been reviewed, so it's not certain if it is FLOSS, and that review will take time.
+
We had hoped to add CVC3 to Fedora, but the current CVC3 license includes some highly problematic
+
clauses, so CVC3 will not be included.
+
A major new release of Harvey is expected relatively soon, but not in time for Fedora 10.
+
It is expected that future versions of Fedora will build on this set of capabilities,
+
adding more tools to handle different circumstances.
+
  
 
== Test Plan ==
 
== Test Plan ==
Line 115: Line 103:
  
 
== Documentation ==
 
== Documentation ==
Documentation on these tools is notoriously bad; some tool developers (including MiniSAT and Zenon) don't
+
Where permitted by license, packages include documentation.
provide any documentation at all.
+
In a few cases (e.g., minisat2), no documentation was provided at all,
We have written some brief documentation in some cases, to help people get started.
+
and we have added some basic documentation to help people get started.
 
We expect this to improve in future releases; it will also be easier to get
 
We expect this to improve in future releases; it will also be easier to get
 
people to write documentation once the programs themselves are easier to install.
 
people to write documentation once the programs themselves are easier to install.

Latest revision as of 15:41, 20 January 2010


Contents

[edit] Feature Name

Formal methods


[edit] Summary

"Formal methods" are techniques that use mathematics to prove that models of software, hardware, or systems will or will not have certain behaviors. To be practical, they must be automated using tools.

Fedora has now added basic support for some key formal methods tools, letting you prove that some facts are true (given other facts) and/or model systems using mathematics. In some limited cases they can be used to greatly increase the reliability of software and hardware.

This suite has been primarily packaged by the members of the Fedora Formal Methods SIG.

[edit] Owner

[edit] Current status

  • Targeted release: Fedora13
  • Last updated: 2010-01-14
  • Percentage of completion: 100%


[edit] Detailed Description

No realistic software or hardware can be exhaustively tested; exhaustively testing a program that merely adds three 64-bit numbers would take more time than the Earth has existed. So for decades people have worked to develop tools that can apply mathematical techniques to prove that software and hardware (or a model of them) does or does not do something. These tools can also be used whenever it's important to prove something is true, or to solve for values given a large number of constraints.

Although these tools are still maturing, they are beginning to become useful in some limited circumstances. Now some key ones are packaged so developers on Fedora can begin to experiment with them.

The Formal methods tool suite page provides a longer description of the various kinds of tools, and the packages that implement them.

Here are some of these kinds of tools, along with packages of programs that perform them:

  • Automated Theorem Provers: These take mathematical facts and attempt to prove a goal, completely automatically. Packages: prover9, Zenon.
  • Interactive Theorem Provers: These help humans take mathematical facts and attempt to prove a goal, in cases where the automated tools can't manage. Package: Coq, PVS (as pvs-sbcl)
  • Program Provers: These take software code and work to prove claims about them, typically by breaking the code and claims into a large number of verification conditions (VCs) for the above to prove. Package: Why (for annotated C and Java)
  • Formal specification languages: These let people describe software or systems using a mathematically rigorous language, such as Z. Package: tex-zfuzz
  • Boolean Satisfiability (SAT) solvers: These take boolean equations and solve for them; they are a basic building block for some implementations of the above. Packages: sat4j, minisat2

Do not assume that you can just take a program prover on a big existing program and start using it effectively; program prover tools are just starting to become mature. All such tools have limitations, scale can be a problem, and it's typically more effective to develop the proofs simultaneously with the program. Nevertheless, for those who are interested in the technology, have small-scale problems where they can be applied, or who wish to help it mature, these are a great place to start.

SAT solvers have been used in a variety of places. Another distribution is using a SAT solver to speed up RPM dependency analysis.

For more information, and a list of FLOSS tools, see Assurance (for Security or Safety) and Free-Libre / Open Source Software (FLOSS)... with Lots on Formal Methods / Software Verification.

[edit] Benefit to Fedora

This enables developers to start using these kinds of programs in a variety of circumstances.

[edit] Scope

Developers have had to package a number of programs, most of which have not been packaged before. In some cases, we've had to address integration problems.

This feature has no effect on those who don't wish to use these tools.

[edit] Test Plan

No special hardware or system preparation is required; simply install the packages listed above. Many of the toolsuites include some checking. In addition, the "Why" suite can use many other tools; we have used its "binary-search.c" example with gwhy to test integration with Zenon and Coq.


[edit] User Experience

Target users will notice that they can easily install these tools.

[edit] Dependencies

There are no special dependencies.

[edit] Contingency Plan

None necessary, revert any undesirable packages.


[edit] Documentation

Where permitted by license, packages include documentation. In a few cases (e.g., minisat2), no documentation was provided at all, and we have added some basic documentation to help people get started. We expect this to improve in future releases; it will also be easier to get people to write documentation once the programs themselves are easier to install.


[edit] Release Notes

No special release notes.