Larch Prover

Key takeaways

Larch Prover belongs to mathematics; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Larch Prover to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Larch Prover from memory before moving on to harder problems.

Reference excerpt

The Larch Prover, or LP for short, is an interactive theorem proving system for multi-sorted first-order logic. It was used at MIT and elsewhere during the 1990s to reason about designs for circuits, concurrent algorithms, hardware, and software. Unlike most theorem provers, which attempt to find proofs automatically for correctly stated conjectures, LP was intended to assist users in finding and correcting flaws in conjectures—the predominant activity in the early stages of the design process. It worked efficiently on large problems, had many important user amenities, and could be used by relatively naïve users.

Development LP was developed by Stephen Garland and John Guttag at the MIT Laboratory for Computer Science with assistance from James Horning and James Saxe at the DEC Systems Research Center, as part of the Larch project on formal specifications. It extended the REVE 2 equational term rewriting system developed by Pierre Lescanne, Randy Forgaard with assistance from David Detlefs and Katherine Yelick. It supports proofs by equational term rewriting (for terms with associative-commutative operators), cases, contradiction, induction, generalization, and specialization. LP was written in the CLU programming language.

Sample LP Axiomatization declare sorts E, S declare variables e, e1, e2: E, x, y, z: S declare operators {}: -> S {__}: E -> S insert: E, S -> S __ \union __: S, S -> S __ \in __: E, S -> Bool __ \subseteq __: S, S -> Bool ..

set name setAxioms assert sort S generated by {}, insert; {e} = insert(e, {}); ~(e \in {}); e \in insert(e1, x) <=> e = e1 \/ e \in x; {} \subseteq x; insert(e, x) \subseteq y <=> e \in y /\ x \subseteq y; e \in (x \union y) <=> e \in x \/ e \in y .. set name extensionality assert \A e (e \in x <=> e \in y) => x = y

Sample LP Proofs set name setTheorems prove e \in {e} qed

prove \E x \A e (e \in x <=> e = e1 \/ e = e2) resume by specializing x to insert(e2, {e1}) qed

% Three theorems about union (proved using extensionality)

prove x \union {} = x instantiate y by x \union {} in extensionality qed

prove x \union insert(e, y) = insert(e, x \union y) resume by contradiction set name lemma critical-pairs *Hyp with extensionality qed

prove ac \union resume by contradiction set name lemma critical-pairs *Hyp with extensionality resume by contradiction set name lemma critical-pairs *Hyp with extensionality qed

% Three theorems about subset

set proof-methods =>, normalization

prove e \in x /\ x \subseteq y => e \in y by induction on x resume by case ec = e1c set name lemma complete qed

prove x \subseteq y /\ y \subseteq x => x = y set name lemma prove e \in xc <=> e \in yc by <=> complete complete instantiate x by xc, y by yc in extensionality qed

prove (x \union y) \subseteq z <=> x \subseteq z /\ y \subseteq z by induction on x qed

% An alternate induction rule

prove sort S generated by {}, {__}, \union set name lemma resume by induction critical-pairs *GenHyp with *GenHyp critical-pairs *InductHyp with lemma qed

Bibliography Pascal André, Annya Romanczuk, Jean-Claude Royer, and Aline Vasconcelos, "Checking the consistency of UML class diagrams using Larch Prover", Proceedings of the 2000 International Conference on Rigorous Object-Oriented Methods, page 1, York, UK, BCS Learning & Development Ltd., Swindon, GBR, January 2000. Boutheina Chetali, "Formal verification of concurrent programs using the Larch Prover", IEEE Transactions on Software Engineering 24:1, pages 46–62, January 1998. doi: 10.1109/32.663997. Manfred Broy, "Experiences with software specification and verification using LP, the Larch proof assistant", Formal Methods in System Design 8:3, pages 221–272, 1996. Urban Engberg, Peter Grønning, and Leslie Lamport, "Mechanical Verification of Concurrent Systems with TLA", Computer-Aided Verification, G. v. Bochmann and D. K. Probst editors, Proceedings of the Fourth International Conference CAV'92), Lecture Notes in Computer Science 663, Springer-Verlag, June 1992, pages 44–55. Urban Engberg, Reasoning in the Temporal Logic of Actions, BRICS Dissertation Series DS 96–1, Department of Computer Science, University of Aarhus, Denmark, August 1996. ISSN 1396-7002. Stephen J. Garland and John V. Guttag, "Inductive methods for reasoning about abstract data types," Fifteenth Annual ACM Symposium on Principles of Programming Languages, pages 219–228, San Diego, CA, January 1988. Stephen J. Garland and John V. Guttag, "LP: The Larch Prover," Ninth International Conference on Automated Deduction Lecture Notes in Computer Science 310, pages 748–749, Argonne, Illinois, May 1988. Springer-Verlag. Stephen J. Garland, John V. Guttag, and Jørgen Staunstrup, "Verification of VLSI circuits using LP," The Fusion of Hardware Design and Verification, pages 329–345, Glasgow, Scotland, July 4–6, 1988. IFIP WG 10.2, North Holland. Stephen J. Garland and John V. Guttag, "An overview of LP, the Larch Prover," Third International Conference on Rewriting Techniques and Applications Lecture Notes in Computer Science 355, pages 137–151, Chapel Hill, NC, April 1989. Springer-Verlag. Stephen J. Garland and John V. Guttag, "Using LP to debug specifications," Programming Concepts and Methods, Sea of Galilee, Israel, April 2–5, 1990. IFIP WG 2.2/2.3, North-Holland. Stephen J. Garland and John V. Guttag, A Guide to LP: the Larch Prover, MIT Laboratory for Computer Science, December 1991. Also published as Digital Equipment Corporation Systems Research Center Report 82, 1991. Victor Luchangco, Ekrem Söylemez, Stephen Garland, and Nancy Lynch, "Verifying timing properties of concurrent algorithms," FORTE '94: Seventh International Conference on Formal Description Techniques, pages 259–273, Berne, Switzerland, October 4–7, 1994. Chapman & Hall. Ursula Martin and Michael Lai, "Some experiments with a completion theorem prover", Journal of Symbolic Computation 13:1, 1992, pages 81–100, ISSN 0747-7171. Ursula Martin and Jeannette M. Wing, editors, First International Workshop on Larch, Proceedings of the First International Workshop non Larch, Dedham, Massachusetts, July 13–15 1992, Workshops in Computing, Springer-Verlag, 1992.

… excerpt ends here. Continue reading the full article.

Worked examples

Example 1 — a first encounter with Larch Prover

Start with the simplest possible case. Write down what Larch Prover claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In mathematics, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Larch Prover before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Larch Prover ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Larch Prover

In research: Larch Prover appears in mathematics research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Larch Prover in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Larch Prover is common in secondary-school and first-year university syllabi. It links to neighbouring topics Theorem proving software systems, so understanding it makes those chapters shorter.
In everyday life: Look for Larch Prover outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

How to study Larch Prover in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Larch Prover means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Larch Prover out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Larch Prover in simple terms?

The Larch Prover, or LP for short, is an interactive theorem proving system for multi-sorted first-order logic. It was used at MIT and elsewhere during the 1990s to reason about designs for circuits, concurrent algorithms, hardware, and software.

Why does Larch Prover matter?

Because it connects several mathematics ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Larch Prover?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Larch Prover.