Editing Formal methods (section)

====Automated proof====
In contrast, there is increasing interest in producing proofs of correctness of such systems by automated means. Automated techniques fall into three general categories:
* [[Automated theorem proving]], in which a system attempts to produce a formal proof from scratch, given a description of the system, a set of logical [[axiom]]s, and a set of [[Rule of inference|inference rules]].
* [[Model checking]], in which a system verifies certain properties by means of an exhaustive search of all possible states that a system could enter during its execution.
* [[Abstract interpretation]], in which a system verifies an over-approximation of a behavioural property of the program, using a fixpoint computation over a (possibly complete) [[lattice (order theory)|lattice]] representing it.

Some [[Automated theorem proving|automated theorem provers]] require guidance as to which properties are "interesting" enough to pursue, while others work without human intervention. Model checkers can quickly get bogged down in checking millions of uninteresting states if not given a sufficiently abstract model.

Proponents of such systems argue that the results have greater mathematical certainty than human-produced proofs, since all the tedious details have been algorithmically verified. The training required to use such systems is also less than that required to produce good mathematical proofs by hand, making the techniques accessible to a wider variety of practitioners.

Critics note that some of those systems are like [[Oracle machine|oracle]]s: they make a pronouncement of truth, yet give no explanation of that truth. There is also the problem of "[[Quis custodiet ipsos custodes?|verifying the verifier]]"; if the program that aids in the verification is itself unproven, there may be reason to doubt the soundness of the produced results. Some modern model checking tools produce a "proof log" detailing each step in their proof, making it possible to perform, given suitable tools, independent verification.

The main feature of the abstract interpretation approach is that it provides a sound analysis, i.e. no false negatives are returned. Moreover, it is efficiently scalable, by tuning the abstract domain representing the property to be analyzed, and by applying widening operators<ref>A. Cortesi and M. Zanioli, [http://www.dsi.unive.it/~cortesi/paperi/CL_2011.pdf Widening and Narrowing Operators for Abstract Interpretation]. Computer Languages, Systems and Structures. Volume 37(1), pp. 24–42, Elsevier, {{ISSN|1477-8424}} (2011).</ref> to get fast convergence.