THETA is a secure distributed operating system designed to run on a variety of hardware platforms. We are currently undertaking an effort to formally specify and implement a new THETA kernel to improve its security properties and to increase its portability. We used a number of "formal methods" tools in developing the specification and analyzing its implementation. The report presents an overview of the THETA kernel architecture, then discusses the methods and tools that we used to develop it. We include a critique of the tools and a discussion of the relative merits of using Ada and C to implement complex secure systems.>

The Penelope verification editor and its formal basis are described. Penelope is a prototype system for the interactive development and verification of programs that are written in a rich subset of sequential Ada. Because it generates verification conditions incrementally, Penelope can be used to develop a program and its correctness proof in concert. If an already-verified program is modified, one can attempt to prove the modified version by replaying and modifying the original sequence of proof steps. Verification conditions are generated by predicate transformers whose logical soundness can be proven by establishing a precise formal connection between predicate transformation and denotational definitions in the style of continuation semantics. Penelope's specification language, Larch/Ada, belongs to the family of Larch interface languages. It scales up properly, in the sense that one can demonstrate the soundness of decomposing an implementation hierarchically and reasoning locally about the implementation of each node in the hierarchy.>

We begin with a simple observation and a simple question. If we fix Th(x), some reasonable formulation of “x is the Gödel number of a theorem of Peano Arithmetic”, then for any sentence σ, Peano Arithmetic proves σ → Th(⌈σ⌉). (Here ⌈σ⌉ is the canonical term denoting the Gödel number of σ.) This observation is crucial to the proof of the Second Incompleteness Theorem. Call ψ a self-prover (with respect to Th(x)) if ψ → Th(⌈ψ⌉) is a theorem of Peano Arithmetic (from now on, PA). Our simple question is this: Does the observation have a converse—must every self-prover be provably equivalent to a sentence? Whatever φ happens to be, the formula φ ∧ Th(⌈φ⌉) is a self-prover. This makes it seem clear that there must exist self-provers which are not provably : We need only use a suitably complicated φ. Deciding what sort of complication is “suitable” and finding such a φ is surprisingly annoying. Here is a quick example: One might guess that any φ which is unprovable and would work. In that case we could take φ to be CON—that is, ¬Th(⌈0 = 1⌉); but CON ∧ Th(⌈CON⌉) is refutable in PA, so is provably equivalent to the quantifier-free formula 0 = 1.

Call a set A of ordinals “definable” over a theory T if T is some brand of set theory and whenever A appears in the standard part of a (not necessarily standard) model of T, A is “definable”. Two kinds of “definability” are considered, for each of which is provided a complete (or almost complete) characterization of the hereditarily countable sets of ordinals “definable” over true finitely axiomatizable set theories: (1) there is a single formula ϕ such that in any model of T containing A, A is the unique solution to ϕ; (2) the defining formula is allowed to vary from model to model. (Note. The restrictions “finitely axiomatizable”, and “true” are largely for the sake of convenience: such theories provably have lots of models.) There are few allusions to what a model theorist would regard as his subject—the methods coming from recursion theory and set theory; but the treatment is intended to be intelligible to nonspecialists. The referee's criticisms have greatly improved the exposition. I would like to thank Leo Harrington for several discussions, both helpful and hapless, and especially for a clever and timely proof which rescued this project from a moribund state. (Further thanks are due to the Movshon family, as a result of whose New Year's Eve party it became clear that the only really magic formulas are Σ1 formulas.)

The Kondo-Addison theorem says that every set A of reals contains a real which is implicit (for short, Imp). Any real which is Imp is constructible, and it is the main purpose of this note to show that a close examination of the usual Kondo-Addison argument allows us to compute (in terms of the ordinals associated with A by the classical representation theorem) where in the constructible hierarchy an element of A ∩ Imp must occur. This result is related to a basis theorem of Barwise and Fisher [1] and is accompanied by a strong counterexample which shows that certain tepid improvements of their theorem (and, a fortiori, of the main theorem in this note) are impossible. As a final flourish, the ‘classifying ordinals’ used to compute the locations of the singletons are themselves characterized using an idea from [1].