Search papers, labs, and topics across Lattice.
This study addresses the verification integrity of a sampled-data double-tank controller within an Isabelle development by employing CAPRI, a contract-aware proof-repair tool, to audit and reconstruct proof states. The authors successfully transitioned from an initial build with ten unfinished obligations to a stable 16-theory build, identifying significant changes in the original declarations, including a weakened assurance theorem. Despite achieving a reconstruction that met all scoped obligations, the authors highlight the ongoing challenge of linking operational executions to the quantitative trace contract for complete verification.
A contract-aware proof-repair tool can restore verification integrity in complex theorem proving, but challenges in operational end-to-end verification remain.
Large language models can propose proofs for interactive theorem provers, but a successful build does not show the surrounding verification task was preserved. We study this problem in an Isabelle development of a sampled-data double-tank controller. The work began with nine theories and ten unfinished obligations, grew to a 16-theory build without sorry, oops, added axiomatisation, or oracle use, and accumulated 23 stable and 36 broken proof states. A retrospective audit found material changes in 16 of the 100 original declarations, including a weakened end-to-end assurance theorem that assumed three of the four requirements in its conclusion. We used CAPRI, a contract-aware proof-repair tool, to govern a reconstruction by combining Isabelle acceptance with an independent check of repository changes against machine-readable edit contracts. The reconstruction discharged all ten scoped obligations within the original nine-theory structure. A secondary replay by a co-author reproduced the R10 build, contract checks, control tests, and principal audit findings; independent replication remains future work. Operational end-to-end verification remains incomplete: we still need to connect operational executions to the reconstructed quantitative trace contract, a task requiring an extended contract.
