J-E-L-L-O! The Jell-O program starring Jack Benny with Mary Livingston, Phil Harris, Dennis Dane, and yours truly, Don Wilson. The orchestra opens a program with Old Johnny. This morning I was looking over the book reviews of the Sunday paper and reading the lists of bestsellers, and that just happened to give me an idea. I'd like to recommend to you a grand bestseller in the field of desserts, a dessert that's not only currently popular, but has been on the bestseller list for years and years. The author is General Foods, and the name is Jell-O, and ladies and gentlemen, that's a mighty important thing, because it's a trademark. It's the property of General Foods. And it tells you here is the real thing, the one and only Jell-O. If you hear any other gelatin dessert called Jell-O, you'll know that's incorrect, for there is no other. So when you buy, don't accept any substitutes. It's made for Jell-O by name, and you can be sure every time of getting your favorite dessert. You can be sure of enjoying that delicious, extra-rich flavor, so full-bodied and tempting as inviting as a fresh ripe fruit. Look for those big red letters on the box. They spell Jell-O, your password to pleasure. That was Old Johnny, played by Phil Harrison, his orchestra.  Yes, Don? Is your tooth still bothering you? It's a little, Don, but it'll be all right. Go ahead. And now, ladies and gentlemen, you ought to see a deadest, Jack. A toothache can be very annoying. I know, Don, but I'm all right. Go ahead and introduce it. And now, ladies and gentlemen, but Jack, it must hurt. Don't you feel any jumping pains? Only when you mention it. Now, please, go ahead and introduce me. All right, Jack. Good. And now, ladies and gentlemen, without further ado, we bring you a man who, despite a severe toothache, feels that the show must go on. A brave little soldier, that grand old trooper, Jack Benny. Thank you. Thank you. Oh, that tooth. Uh, Jell-O again, this is Jack Benny talking through a murderous molar. Well, Don, here it is Sunday again. We're back on the old merry-go-round. Time sure flies, doesn't it? Oh, it certainly does. You know, Jack, it doesn't seem possible that we've been on the air six times already this season. No, it doesn't. No kidding, fellas. Have we been on the air six weeks? Yes, Phil. And they sure roll around fast, don't they? Yeah, it seems like I hardly get one paycheck till I have to start battling for the next one. Oh, you do. Well, listen, Phil, if I were you, I'd take my paychecks any way I could get them. Yeah? Yeah. And I wouldn't complain about your job. You're very lucky. You know, in musical circles, they refer to you as Horseshoe Harris. And that goes for your boys, too, those 17-rabbit speed. So, let the well enough alone.  You were complaining about your tooth. I was not. I was talking about how the weeks fly by. You know, Don, sometimes it amazes me how I can prepare all the ideas that go into this program in seven days. It's really quite a grind. I can appreciate that, Jack. It must be pretty tough. Oh, it is, Don. Tiz. I don't know what you're squawking about. Look at all the band numbers. I gotta rehearse and get ready. It's no sense. Believe me.  Those voodoo vultures? Sure, we gotta have everything right up to snuff. We gotta live up to our slogan, you know. Your slogan? Oh, you've got a slogan now. Sure. Listen to this. If it's a Harris selection, it's sheer perfection. Well, well, say that's very good. I got another one we use on the road. Get this. If it's a Harris number, you will never slumber. I agree with you there. And Phil, if you can stand one more slogan, it goes like this. If it's a Harris melody, it's sure to smell a day. And I don't mean Christmas night. Now, where was I? What were we talking about, Don? You were complaining about your tooth. I was not. You know, Don, there are times. Oh, hello, Mary. Hello, Jack. Say, what's the matter with your face? My face? Yeah, one cheek isn't sunk in anymore. Oh, that's my tooth. My left cheek is swollen a little. A little? It's not a squirrel. It's all set for a long winter. Oh, I do. My goodness, Jack. That tooth has been bothering you all week. Why don't you have it pulled out? Oh, the pain will go away. Say, fellas. I never saw anybody so scared of a dentist. I'm not scared of a dentist. That tooth is loose. It will probably fall out by itself. You mean like that thin stuff on top of your head? I mean, don't worry about me. I'll get this tooth fixed my own way. Say, Jackson. What?  He'll be glad to knock it out.  No, the other one. Oh. Oh, hello, butch. I didn't see it.  He won't hit you, Jack, with those glasses on. She's right, Jack. It's against the law to hit anybody that's wearing glasses. Listen, Don.  So don't tell anyone. I told him to put his glasses on, but he said he's not going to need it anymore. Don't tell anybody. I'll tell you, don't worry about me. I'll get this tooth fixed my own way. Say, Jackson. What?  He'll be glad to knock it out. Punch me in the nose and put him back on again So don't tell me what were you doing in the meantime Jack was explaining the law to him Yes, he'll know better next time Say Phil how about playing a number? My tooth is acting up again. I want to put a couple of drops in it Okay, what kind of toothache drops are you using Jack? I don't know. It's something Rochester makes I think it's chloroform and white mule It does the trick though go ahead Phil play something all right Jackson get ready boys and remember folks If it's a Harris selection, it's sheer perfection. Yeah Hey, what's that for? Oh, you weren't here Mary, but Phil has suddenly become slogan conscious I'll give her that other one Phil. Well, here's one. You haven't even heard yet when smiling Harris plays a tune Every month in the year is June How's that Mary? Wow, that's corn that isn't even ripe yet That's a good one say Jack what if vaudeville ever comes back. I got a swell slogan for you Never mind.  Jack You've all had your little poetry. How about giving me a chance? Okay, Don Let's hear your contribution said he with a look of innocence in his baby blue eyes Take it down. All right, but I want you to help me Jack now you start me off with hello, Joe Okay. Hello, Joe. What do you know? I just got back from the grocery store Did you buy a box of you know what yes, sirie, that's what I got what's in this box It's so delish. I bet you wish you had a dish can this be jello that you mean yuck yuck yuck. I'm Madam Queen Mary you spoiled the whole thing that last line didn't make sense.  Oh, maharajah And now folks wait a minute Jack are you insinuating that number was in harmonious What's that in harmonious mediocre lacking in finesse and euphony? Why Phil? Well, that's today's work. Good night all Rosalind come back here What a guy he learns four big words and he's all in And now folks before we say where's Dennis?  I said she needed a rest. Well, she got it. So watch out Oh Mary Mrs. Day is much too broad-minded to be upset about a little joke and now folks However, Mary, I wouldn't mention anything about it when she comes in, you know, yeah, I know, you know how it is Yeah, I know how to yeah, and now folks and now folks Mary. Let me alone And now folks following our success last week with our version of the women tonight we are going to oh boy Wasn't I marvelous in that play? What didn't I give a terrific performance? Yes, Phil you were sensational. Would you consider a thousand dollar raise in salary? I feel guilty having you at these prices That's a deal shake get away or I'll break your arm Terrific performance anyway folks as I was saying following our success last week with the women Tonight we are going to offer. Oh, look who's coming. Well. Hello Dennis. Hello, Mr. Benny and your mother's with you Well, well, this is nice a good evening. This is Dave. How do you do? Well, you're looking very good. Appreciate thanks, and you will please refer to me as Mrs. Day Well, it is now 20 degrees cooler inside Mary well Dennis, I'm glad you're here, and I know you have a lovely song prepared for us tonight Are you ready? Yes, I am say mr.. Benny. What's the matter with your jaw? Did someone hit you no Dennis?  Oh, did you enjoy the show? Yes, especially the part where you called me a pest It was such a brilliant remark by Mrs. Day. I called you a pet. Yes, you did on the radio Yes on the radio on my program. It wasn't Duke Ginsburg and his happy Hawaiian Very quiet Now look Mrs. Day it may have sounded like I called you a pest But this darned tooth of mine slurs my words than bother me all week your tooth Yes, you can see for yourself. Look It's the rug one right here the one on the urn sir. Oh, that does look pretty bad. Yeah, it hurts like the dickens Hey Jack, let me hear you say your name work.  That's what I thought Mary I've got a toothache. I prefer a little sympathy to ridicule. Well, I'm for heaven's sake. Stop complaining to go to a dentist I'm not going to a dentist. What's the matter? You afraid? No, I'm not afraid. Well, there's only one other reason So let's take up a collection Well, I won't be necessary the first time I ever had trouble with a tooth I haven't been to a dentist since I was 10 years old. Don't tell me you made those uppers yourself Now I didn't make those uppers my town Jack I don't want to be an alarmist But I think you ought to do something about that tooth that might lead to serious consequences. Well, gee it does hurt But I don't know who to go to I know a good dentist Jack and he's just two blocks from here Come on, let's go. Oh, don't pull go ahead Jack. We'll take care of the program. Sure. I got some swell jokes And I'm dying to tell him.  Have you got frogs legs? No, I always walk this way That's nice smart material Come on, Mary. Let's go. Okay. Well so long fellas All right, Dennis you can go ahead with your song now. What's it going to be?  You'll do nothing of a kind. I'd rather wait He's as swell Dennis Jack. It's not very modest. Is it?  Yeah, how do you do sir? How do you do? I'd like to see dr. Nelson. Why yes, well, you know what you're doing Mrs. Is that a drill? Yes, the doctor is working out a patient some say Mary. Are you are you sure this Dennis is all right? Of course, he's all right. Do I look worried? No, but then I'm the one with the toothache I'm not worried Mary, but I just want to make sure I hate this waiting. Come on Mary Yeah, come painless. What was that six o'clock? I'm getting out of here That'll be all for today. Mrs. Stewart. When will I see you again? You should live so long Well young man, are you waiting to see me? Yes, but I your name, please Benny. I'm Jack Benny the actor Sorry, we don't give theatrical rates. Well, I didn't mean it that way I expect to pay the same price as anybody else eventually Who that tooth throbbing again step right this way, please follow me. Can I come in too? Yes, Mary You stick right with me. Oh nurse sterilize my mandibular injector and have the gut a perch are ready Yes, doctor now step into this chair mr. Benny, and I'll strap you in Strap me in. Yes. We don't want you squirming around. Oh, would you like a manicure? No, thanks I just dropped in to have my toothpick. Oh, yes the tooth now first. We must determine which one it is just a moment Is it this one? No, this one No, is it this one Yeah The one doctor heard something awful. We'll take care of that This is a large cavity, and I'll have to fill it right away. Do you want gold or silver? I want cement cement is no good. Mr. Benny. It wears out. Listen doctor I've seen sidewalks around here for years, and they're holding up all right Now go ahead and fill it very well, I'll use cement and then we'll all put our footprints in it I'm not brown man's Chinese Furthermore, I don't want to bother filling this tooth. I want to pull all right, then perhaps I ought to give you an anesthetic Perhaps nothing knock me out perhaps yet very well. We'll give you gas now take it easy Mr. Benny relax and breathe deeply.  Yes, doctor now inhale slowly, and you'll soon be in dream land No, wait a minute doctor. Wait a minute now just relax. Bye. Bye, mr. Benny Mary Mary, where are you here? I am Jack Mary keep your eye on my money while I'm under the Well, I'm under the anesthetic. Okay, which stock is it in the right one Hey doctor, I don't think I want to send me those clamps. So you are doctor. I don't think and that's a live ejector Yes, doctor. I don't think I Don't think I live and brush my teeth with Ipana if it isn't Benny and he's sleeping sounder than his audience on Sunday night Oh nurse nurse. Yes, dr. Allen hand me that chisel. I'm going to do this the hard way here. You are dr. Allen Thank you, Mrs. Day. This is day Fred Allen Where am I? The Jell-O program starring Phil Harris with Mary Livingston, Mahatma Gandhi George Bernard Shaw and yours truly Lady Godiva This is Jack Benny talking now hold on there Benny. It's town hall tonight. What? Wait a minute. That's not Portland. That's Mary Livingston.  Oh my goodness. Look at this white fur all over me Jell-O program starring Phil Harrison This orchestra the orchestra opens a program with Scheherazade by Rimsky-Korsakov. That's a lie They'll never make it. Let me let me out of this chair now here. Hold still Carmichael. I'm not Carmichael I'm Jack Benny Mrs. Day hand me that crowbar. I'm not getting anywhere with this chisel. Oh crowbar. Let me out of here What am I doing in this cage? Who's that coming torquey? Carmichael your day has come What I've been waiting a long time for this Rochester Rochester. What are you doing with that razor? Ain't no use backing away Carmichael winners coming and Papa needs a fur coat Look Rochester. I'm not Carmichael. This is me your boss. Mr. Benny. Mr. Benny. Yes, put down that razor I'll give you a new tuxedo. I'll give you anything you want. I'll give you a raisin salary. Uh-huh. You ain't mr. Benny Rochester Carmichael you're about to become a fond memory Rochester. Let go of me. Ain't no use scratching pull in those long claws These aren't claws Rochester. These are my fingernails. Would you like a manicure mr. Benny? No, I'm just here to get my tooth pulled Rochester get away from me. What are you going to do Carmichael? I'm going to carve you up and have you for a Thanksgiving dinner Rochester. You don't even know when Thanksgiving is who does Rochester for the last time get away from it. Hi you Rochester. Look, there's Phil Harris. He'll tell you who I am Hello, Philzy. Hi you Carmichael. There's a fish for you Look at me. I'm not Carmichael. I'm Jack your pal Jack Benny the actor. I'm sorry. We don't give theatrical rate Doctor doctor hand me that hacksaw mrs. Day. We're coming along fine. Here you are doctor. Thank you mrs. Day I'm not mrs. Day. I'm Carmichael. You are not.  How can I laugh? I'm a poached egg. You're talking about where are you? Oh my tooth. Oh dr. Allen, you'll never get the tooth out that way.  Day hand me my machine gun machine gun. No, no Now hold still Benny. I want to make a nice clean job of this. Please Fred. Please you can't do this to me I'm a polar bear. Don't you love animals? Don't Fred All over mr. Benny that didn't hurt now did it hurt Where's Fred Allen? Where's Harris? Where did I get my hands on that rocket? I'll calm down mr. Benny. You were just dreaming Dreaming Oh, yes, you gave me gas didn't I certainly did and here's your tooth. It's a beauty, isn't it? My tooth. Yes, you mind if I keep it. I'm an elk, you know Oh, that's perfectly all right. Well, I feel much better now. How much do I owe you doctor? That'll be 35 dollars 35 dollars There he goes again folks Repeated by popular request in the language of radio and the theater that means a hit And it means a hit too when applied to some tasty dish that must be served again and again Because of the whole family's enthusiasm for it Such a dish ladies and gentlemen is pineapple strawberry whip an exciting new jello dessert For one thing it's as easy as can be to make Simply dissolve one package of fragrant strawberry jello in a pint of hot water Then chill until cold and syrupy Next place it in a bowl of cracked ice or ice water and whip with a rotary egg beater until it becomes light and fluffy And finally just before molding it fold in one cup of canned crushed pineapple It's downright thrilling the way those golden tidbits of juicy pineapple Compliment the rich ruby goodness of strawberry jello And you can bet that everybody will want this colorful striking dessert repeated by popular requests many times So ask your grocer tomorrow for some strawberry jello And tomorrow night when the family gather around the dinner table Surprise them with a glorious bowl of jello's new pineapple strawberry whip The last number of the sixth program of the new jello series And we will be with you again next sunday night at the same time Before we say good night I would like to remind you of the annual red cross roll call Every citizen should join because your memberships are the sole support of the regular red cross program Of fighting the suffering caused by disease accident and disaster So may I urge you to join the red cross through your local red cross chapter? Good night folks J.E.L.L.L. Here's news every tuesday night the aldrich family is on the air starring esra stone as henry aldrich that lovable hard luck kid consult your local newspaper or radio guide from thiamin stations and be sure to tune in on the aldrich family Next tuesday night. This is the national broadcast in guppah


Fiery horse for the speed of light, a cloud of dust, and a hearty high old silver, the lone ranger. Before this exciting adventure, a word from our sponsor, General Mills, makers of Cheerios, the old cereal that's ready to eat, Betty Crocker mixes, and Wheaties, the breakfast of champions, present by special recording, the Lone Ranger. Mmm, you're going to love the big exciting news today. Now there are two brand new Betty Crocker cake mixes. There's chocolate malt and peanut delight. I'll bet you can hardly wait to try them, and I wouldn't blame you. They're just so good. Today, let me tell you about the chocolate malt. It's a wonderful new way to enjoy an old flavor that's a favorite with so many of us. There's honest to goodness delicious malted milk right in the mix, and of course, there are all the other fine quality ingredients you choose yourself, like famous soft to silk cake flour and pure vegetable shortening. And because it is a Betty Crocker cake mix, mom knows it's the easiest way ever to bake a perfect cake. So next time mom goes shopping, be sure to remind her to get that brand new delicious treat. Betty Crocker's chocolate malt cake mix. You'll love it. With his faithful Indian companion title, the daring and resourceful mask writer of the plains let the fight for law and order in the early western United States. Nowhere in the pages of history can one find a greater champion of justice. Return with us now to those thrilling days of yesteryear. From out of the past come the thundering hoofbeats of the great horse Silver, the lone ranger rides again. A curious and expectant crowd have gathered at the small new depot in Silverton. Suddenly, as the distant sound of a whistle was heard, they waved their hands from here and walked in. It's always been one. You sure don't sound like it's making you happy. Why should it? You mean you're afraid the railroad's going to affect your freight to stage coastline. Yes, I should, Luke. But I don't say we did yesterday. You should talk to him. Let me get back to my office. I'll tell you all about it. Let's go. I'll see you in a minute. A short-time leaker, the two men, Luke and Jim, sat in the office of the James Melvin freight and stage company. As Jim Melvin eased into the chair behind his desk, Luke looked at him and said, What's this all about, Jim? If the employees meeting you had yesterday, you told us the new railroad wouldn't affect business much. That's right. It did. We don't make any money on the stage run anyway. But my freight line made plenty. And I figured it still would. Well, the reason I figured that way was because old man Mason of the Mason mine had come in and told me not to worry. He said he'd come in and continue to have us haul the ore and supplies between the mine and Lyft and Mike always. And then why are you worrying? Well, because Mason came in last night and told me he was thinking about closing the deal with the railroad. Oh, so that's it, huh? Then all you'd get would be the hauling from the mine to here. And the railroad would take you all from here to Lyft. Well, we wouldn't even get that, Luke. The railroad's going to run a spur from here to the mine. Oh, now maybe that's just tall. No, it isn't. I'd have a work training gang here tomorrow to lay the tracks for the mine. Yeah, if the mining company gives them their haul and other business will follow. Let me think things over, Jim. Maybe there is some way to show Mason the railroad isn't better. And if there is, I'm going to find it. It was late Friday afternoon when the lone ranger and tautel rode along the old trail from Lyft to the mine. They were about half the distance of the 30 miles between the two towns when they heard the distance whistle of a train. They reigned to a halt. Oh, no, no, no! The train from Lyft is coming to the canyon over there, Tautel. We'll see it pass in a few minutes. Ah, it looked like other iron horse stopped on crack and weigh a train. That's not good. That's the train. Waiting on a striding until the regular train passes. Wait a minute. What do you look at? Over there, see? Oh, it looked like two men on horses beyond work train. The work train is leaving. As soon as it passes, I'll get a look at those horses through my binoculars. Oh, I see them clearly. What can look like? One's heavy set with iron gray head, one's heavy set with iron gray head, one's heavy set with iron gray head, one's heavy set with iron gray head, the other's a large man with a black mustache. He's pulling up the tracks to the canyon. Here, take a look. Let me see them clear now. Let me know if we need them. They may be railroad men. Then leave now, ride to Silverton. We better be going on, too, if we want to reach Silverton before sundown. Come on, Silverton. The long ranger and topo found a campsite near the trail just outside of town. While the masked man prepared the camp, topo rode on into town for supplies. The son was setting when he returned with news of interest. Oh, come on, come on. Easy, come on. It didn't take you long, topo. Now, town, not far. That's him a hobby? Yes. We find out about two men we see watch trains at Sidonville. What did you find out? Heavy set man with gray hair, him Jim Melbourne, him own freight and stage company. I see. Other kind of work for Melbourne, him name Luke Jenkins. Melbourne, not like Ray Road coming to Silverton. I understand that. He's bound to lose a lot of business between Lipton and Silverton. I'd like to know more about Jim Melbourne. After dark, I'll put on a disguise and we'll ride into town. That evening, Jim Melbourne was alone in his office, when the lone ranger disguised as a rancher entered. Good evening. Well, indeed he's a stranger. Do you have something for him? I came to get some information about your freight line, Mr. Melbourne. Sit down, sit down. Thank you. I suppose you've got some hauling to do, eh? I might have. I'd like to get your rates to compare with those offered by the railways. Now the train's coming town from Lipton. That's not Railroad. Let me tell you something, Mr. Nothing's going to take the place of horsepower. When I take a job, you can be sure your stuff is going through. Wouldn't shipping by Railroad be quicker and cheaper? Well, I admit I can't match the rate. Oh, then the Railroad is cheaper. It wouldn't be quicker and cheaper if your shipment didn't get there. Our freight lines proved it can get stuff through safe and on time. But the Railroad hasn't proved itself yet. I'll still take a chance on the Railroad. Sure. But if you decided to come back to me, you'll find the rate you're going up. Don't forget that either. Hey, Jim, I've got Jeff going.  We just noticed he had company, Jim. Hi. I was just leaving. Hi, Mr. Melbourne. Hey, who's that on there? Who do you think it was? Another fool who's decided to use the Railroad. Yeah, he'll be back. You told me about the plans you made. When we get through that Railroad, they won't ever get any oil in business again. That's right. They won't. You're going along with Jack and me tomorrow, Jim? No, you two can handle the job and make sure you do it upright. Why don't you come along? My sister Jessica, the only living relative I have, is coming over on the stage from Lyft in Des Moines. I gotta be here to meet her. It's better anyway for me to be a real man. It's better anyway for me to be around town when folks get the news of what's happened. Yeah, I guess that's right, Jim. Well, after tomorrow, we won't have to worry. The Melbourne Freighton Stage Company will have all the business it can handle. Meantime, the Lone Ranger walked to the edge of town where a tunnel waited in the shadows with the horses. You must not be... Yes, I just came from Melbourne's office. What did you find out? He's very bitter about the railroad. Oh... Just before I left, two of his men came in. One of them started to say something about a plan, but Melbourne shut him up. Almost too quickly, it seemed to me. You think they'll have plan against the railroad? They'll check in town for further information. And we'll leave the horses here. Come on. Nothing more was learned that night. But the next morning, one of Jim Melbourne's men went to the freight company's office. Where did he went for it? The man down at the depot asked me to bring this to you, boss. To tell the ground for me? Huh? He went with the wires all the way from Lipton. I was there when it was ticking out. Give it to me. It is, just like you gave it to me. It must be from my sister. I guess she's not taking the stage today. She decided to try the new railroad train this afternoon. Meet me at the depot just in case. Great job. What's the matter, boss? Don't you like this? We've got to keep that work train from leaving town. The work train's already gone. I watched it pull out. Something wrong? Very pretty. Stay here at the office. I believe it. If I don't get to that side before that work train leaves, my sister's going to be in a big train race. We'll continue our lone ranger adventure in just a moment. All you're doing is a costume. And here's one that people have to say, Oh, we need to do, do, do, do, do an okay job. Doing okay? You bet the champs in good ol' New York are. Listen, now in New York we wait for days to see a guy called Willie Mays because Wheaties keeps him leaping high to grab those line drives on the fly. And Yogi Berra's the Wheaties lad whose batting style makes pitchers sad. No matter how they throw the ball, that Yogi belts it through the wall. And look, both Willie Mays and Yogi Berra turn to Wheaties for extra energy because there's a whole kernel of wheat in every Wheaties' flake. Wheaties, breakfast of champions. Now to continue. The lone ranger had saddled Silver in preparation for the trip to town with Toto. Suddenly they heard pounding hoofbeats approaching from the direction of town on the trail above them. Some right-up trail in big hurdy-kim-shuddy. Most people use a new trail along the railroad when riding to Lipton. This old trail shorter. No, wherever that is, he won't see our cam from the trail. He's passing, I wonder who that is. This horse is falling, Toto, come on. Oh, the horse is all right. That's how I run ground. Him hurt. Boy, this is your Melbourne. That's the way I go. We'll have a look at it. My shirt's lost. No, we're not outlaws. Forget the mask. You have a bad sprain here. I gotta ride on that. Easy there, easy. The horse stepped into a hole. I have to get to the railroad side. I have to, do you hear? You're not able to ride. Ankle. Plenty bad. Why do you have to go to the siding, Melbourne? You know me. That voice. Are you a Mr. Jones? That's it. She's the man who came. I came to your office in disguise. I'll answer my question. Why the hurry to reach the siding? My only sister. She's coming on the afternoon train. She'll be killed. Folks, sense, Melbourne. Get to the point. All right, I gotta tell you, I guess. Get to the siding. Stop Luke and Jack from sending the work train down the track in the path of the train. They went to the siding. Gonna wait for the work train. Put bandanas in one of the faces. Hold up the engineer and fire him. Then what? They'll start the work train, send it into the path of the on-couple-afternoon train. There'll be a big break. Oh, that was your plan. Yeah, yeah. Get to them and stuff them. My sister's on that train. I just got word. Others are on that train, too, Melbourne. I don't know. Get him back to town, take him to the sheriff. I'll tell the sheriff everything. Hurry. You gotta stop him. I'll do my best. You'll have to take the consequences later, Melbourne. Move, Henry! Went miles to go. The lone ranger gave silver his head and the great white stallion, sensing the urgency of the moment, responded dynamically to the ringing cry of his master. Move, Henry! Faster, boy! Faster! Later after, hiding their forces behind some big boulders nearby, Jack and Luke crouched behind some tall bushes near the siding and waited until the work train had rolled to a stop. Let's get going. I'll cover your face so they won't know you next time. I'm ready. Go ahead. Get back. We don't see this yet. All right, here we are. I'll get you done ready. All right, you two, come down out of that engine.  It's a couple of loud hoots.  Huh? Well, we're coming down. What's the idea? We haven't got anything and the two-flat cars are empty.  Go on, Luke. I'll watch these two hombres. What are you up to, anyway? You just watch and see. Pull the lever way back and jump for it. Hey, that'll start the train. Send it into the one that's due to be coming from Lipton. That's the idea, monsieur. A nice big wreck.  I won't let you. Oh, my leg! Just so your friend won't interfere. Now go ahead, Luke. Hurry up. Here she goes. Jump, Luke. Jump. Yeah, I made it. Here goes the work train. Ha, ha, ha. It sure will be a big wreck when those trains meet. Get on. That's right. I'd like to be watching with... Hey, Jack, look. Somebody on the train. It's up behind the bushes, quick. The man's over there. Yeah, and he's chasing after the work train. Hey, he looks like that man's number he's trying to spoil our plane. I forget it. He hasn't got a chance. All right, let's get away from here and head back to town. Meanwhile, as he raced after the work train, the lone ranger knew the seconds counted if he was to prevent a disaster. He urged the great horse, Silver, to further at her. Come on, Silver. Faster, big fellow, faster. Slowly, seemingly, inch by inch, Silver lessened the distance between them and the train. Just a little further, boy. Careful, Silver. Slowly, they came. Until, Silver, they came. They came. They came. They came. They came. They came. Until, Silver was racing near the iron lungs of the last flight car. Then, the lone ranger braced himself for the leap which he dared not miss. Isn't it, Silver? Hey, big fellow. Stay there. Quickly, the masked man moved along the swaying cars and over the fuel tender into the engine cab. He grasped the throttle and pulled it back. Then, reached for the brake lever. He pushed that lever and put all the brakes. The other train. I must stop the work train and put it into reverse. In one of the passenger cars of the train from Lipton, Jim Meldon's sister, Jessica, was enjoying her first train ride when the conductor stopped at her seat. Silver, meet the work train beside to just be on the train. You can see from this window where the tracks enter the canyon. Yes, that's right. I look another train and it's coming this way. Here's the odyssey. The work train it didn't wait until sir it broke off and smacked into it. Who can't stop or die? The engineer sees him. We're on the train! The work engine. The lone ranger had tried practically to move the brake lever which, again, because of the strong and sudden shove given it by Luke when he released it. The work train had run through the short canyon and out onto the curving track beyond before the lever responded. Let's get it. The train can lift him. He can't stop in time. Try to get this train reversing fast. A few moments had seemed that in spite of the lone ranger's efforts the train would crash before the work train could gather enough reverse speed. The last man held his breath as the engine of the passenger train came close. Then, gradually, the work train gathered speed enough to run ahead until the other train could come to a stop close back to the siding where the lone ranger brought the work train to a standstill. As the lone ranger swung down to the engine cabin, the passenger train slowly approached and stopped. He was soon surrounded by a relieved but angry crowd. A masked hour hoop was running that train. We are going to string him up right now. We are almost close to running. Come back! I don't expect thanks. I do expect a chance to prove what I say. There comes a sheriff who's been from town. Now you'll have your proof. See you, my buddy. Yes, Otto. See you found Silver. All right. Mr. It's America. You got that work train stopped. We picked up the two men who started that work engine down the tracks. Where are they now? Send the deputy back to town. Now that you are here to take charge, Sheriff, we'll leave one day perhaps. We'll meet again. Are you ready, Otto? Be ready. We'll see you in a big bus.  Then that masked man wasn't to blame at all, was he, sir? Nope. He risked his life to save all of you. If it hadn't been for him, there'd have been a big wreck. Hey, Sheriff, who was that masked man? The masked man? Yeah. You can thank your lucky stars. He was around when this began to happen, conductor. He's the Lone Ranger. The Lone Ranger? What's that? A copyrighted feature of the Lone Ranger Incorporated is produced by Kendall Campbell Muir Incorporated. A part of the Lone Ranger is played by Brace Beamer. Your announcer is Fred Boyle. Listen to the Lone Ranger brought to you by Special Recording Mondays through Fridays at this same time.


Hi everyone, my name is Dr. Manisha Ashvindhavre, I am a clinical immunologist and a rheumatologist at Manipal Hospital Whitefield. Today, 12th October, we are observing World Arthritis Day worldwide. This is just to raise awareness of different forms of arthritis. The major arthritis is osteoarthritis, which is also called as degenerative arthritis or wear and tear arthritis. And other forms of arthritis, inflammatory arthritis, which is predominantly related to immune system dysfunction. So, if these arthritis are not diagnosed early, it can lead to significant damage in joints and some other systems also. Because the global burden of arthritis is increasing year by year, in current status also around 15% of Indian population is affected by some or the other form of arthritis. So, if we are not aware about the symptoms of arthritis, which is pain in joint, swelling in the joint, stiffness in the joint, it can easily get missed and it can have impact on your quality of life. So, diagnosis of arthritis by a specialist at the earliest can give you better quality of life and it can help you in preventing future damage or future impact on your life. This is also important in your quality of life, even the help of your caregivers is also important. So, whenever you have symptoms of significant duration, like if you are suffering from continuous arthritis for more than 2 weeks duration, you better consult your rheumatologist doctor, so that the diagnosis can be done properly and the treatment can be started at the earliest. There are some risk factors whom we should keep under observation. Like if you have joint symptoms, if you have family history of arthritis, if your weight is more, if you are living a very stressful life and even if you are smoker, then you will be at risk of developing arthritis. So, these factors are very much reversible factor except for the family history of genetic factors which we cannot change. So, if you have symptoms as I had told before, you need to evaluate yourself and you need to meet a consultant, so that diagnosis and treatment can be started at the earliest. Certain lifestyle modification is necessary, like I told to keep weight under control, to be physically active, like if you are doing exercises regularly, particularly low impact exercises, then your joint symptoms can be kept under control and if you eat healthy diet, healthy diet, like anti-inflammatory diet nowadays, dietitians are advising more of vegetables, more of fruits in the diet and less of red meat category, then you need to stop smoking if you are doing so. So, these are certain factors that can certainly reduce the risk of progression of arthritis and hence the damage in the joints as well as in other systems can be kept under control. So, the theme of world arthritis day this time is living with an RMD for all stages of life. So, why this theme was chosen this time because majorly if immune system related arthritis is there, they are non curable problem, so you need to live with them, but how to live with them with good quality of life, like symptom-free or damage-free that you can discuss with your specialist doctor, that is a rheumatology doctor. So, do not delay your diagnosis and meet your doctor at the earliest to know for further information. Thank you.


So, the next speaker of today will tell us more about the glorious future, where machine checked proofs will be used in everyday software, all the way down to hardware development. We have Adam Cipala, he's a faculty at MIT, and he builds computer systems and has fun proving them using COC, not written as you think it is. Thank you. So from the earliest days of programming, people started to realize that the actual act of writing the code was going to be a relatively small fraction of the time that they spent building useful things. And here's a quote from one of the pioneers of computer science telling us about how at some point he realized a good part of his life was going to be spent finding errors in his own code. So we know that it would make a huge difference for developers, they could get a lot more cool stuff built if they could reduce the time that they spent trying to get their code to be correct, trying to understand what their code does, all these activities besides just writing it. And I want to tell you about some opportunities with technologies that are getting mature enough to potentially make a big impact in saving a lot of people time building correct systems. And I think these are just ready enough that if you want to be on the bleeding edge, you could start looking into these systems today. So first let me summarize a perspective on what programmers are doing today to gain confidence that their code is correct. So there's debugging the classic way to find a flaw in a program where you sort of do some detective work, make successive runs of a program, change a small thing between runs, see what happens differently on each execution. I'll graph these different approaches in a very wishy-washy two axis way. Rigor, I'm going to use to refer to the, when you use some sort of method to understand your program, how closely tied it is to the actual code that runs. So you know it's accurate. And then completeness is covering how many different execution scenarios you get some guarantees about. So with debugging, we only get guarantees about the scenarios we run. So that's low completeness. But I'm calling it high rigor because it's literally running your code. You can also, when you're writing your code in the first place at a white border or just in your head, think through carefully all the things that can happen. Consider all sorts of what-if scenarios. Convince yourself, don't worry, my program is ready for those. Or I'll add some new code to be ready for that. There can be all sorts of branching and we can think very carefully. And if we're very principled, then we get high levels of completeness but low rigor because this is just an abstract whiteboard level kind of exercise. Testing has a very similar profile to debugging. We create a bunch of scenarios that are saved in a list of test cases that we can run over and over again in an automatic way. And an alternative is to put lots of comments in your program that capture exactly your expectations, what should be true whenever you reach that comment. And then read the code and think through the interactions between all these expectations. So we could call this the comments approach, which might have a high level of completeness. There could be comments everywhere saying a lot of things about a lot of code. But it's not so rigorous because there's typically no tool that connects the comments to the actual running behavior of the code. Another approach is auditing and there's a whole spectrum of different levels of seriousness. We can use an auditing. We can do relatively cheap auditing where we maybe read a lot of code but don't think too hard about it or we can have some more in-depth auditing where we probably need to read a smaller amount of code but we can be much more thorough in checking the properties of that code. So the techniques I want to tell you about are a way to sort of get the best of both worlds to get high ratings on both of these axes in contrast to the traditional methods. So I'm a professor at university.  This is great. We're going to prove things about programs. I think this is an even more popular research area here in Germany than in the U.S. where I'm from. It's been around for a long time, still not too widely used in industry in the open source world but maybe there's hope. I think most people in those worlds are used to this kind of scenario where people doing formal methods research are saying it's really the right thing to do to prove your program. Don't you want to do the right thing? And then the developers just sort of nod and smile politely and then they need to get back to work because they need to implement a few new features for the version of the system that ships next week. I want to try to argue that formal methods, if not already there today, are very close to the point where they will actually save you time. They will reduce the cost of developing systems, especially those where bugs are especially costly. So the pitch I'm trying to make is that in the history of computing we've gone through layers upon layers of building new higher level abstractions that lower the cost of creating particular functionality. And we've built each of these levels upon earlier ones. They provided new possibilities for modularity and abstraction. And formal methods is actually an enabler for some of these next level of possibilities for dividing big programs into small pieces that we can understand effectively. So what I'm claiming should be feasible by let's say 10 years from now with the right kind of community forming around it and doing the work is complete deployed computer systems with top to bottom correctness proofs, meaning from hardware up to applications where these proofs will be checked algorithmically so we don't have to worry about low reliability people reading long mathematical documents. And we will get to the point where none of the code that you run needs to be trusted to guarantee the properties you care about whether they're in security or other kinds of correctness. And as if that weren't good enough, by the way, this will play to hardware designs, not just software code. And this kind of approach should be able to lower development costs in the same way that a good systematic testing framework can. And to a large extent should be able to replace very time-intensive activities like debugging, testing and code review. So I better go into a little more detail on what kind of techniques I'm talking about here and why we should believe this stuff is ready. But before I get into the next level of detail, I'll just summarize how this kind of approach can substitute for the traditional development activities. Instead of debugging where we're exploring concrete executions of a system, we can do proving where we're exploring symbolic arguments that cover all possible executions. Instead of testing, which applies to concrete scenarios, we can do specification writing where we describe general requirements that can cover all scenarios. And instead of auditing our code in detail, we can audit the specifications in detail. Specifications should be much shorter and typically don't include optimizations, which can be some of the hardest parts of code to understand. So a summary of what I'm going to cover in the rest of this talk, I'm going to introduce the key technology that I'm selling here, which is called proof assistance. I'll cover some common objections and the standard answers to those questions about why do we believe this can actually be applied to real systems, why it can be applied cost effectively. I'll explain a few different ways that this technology can be used in the development of computer systems. I'll talk about two case studies, one in hardware and one in cryptographic software. And I'll finish up with some pointers to further reading for continuing the journey along learning this subject. So one of the first questions people have about formal methods is essentially based on an argument embodied in a paper from 1979 by DeMillo Lipton and Perlis called social processes and proofs of theorems and programs. They had a lot to say in that paper, but I would kind of boil it down to they say real systems are so complex and they change so frequently that it is beyond the powers of human concentration to read careful proofs about those systems. And it's not just one proof, it's version after version of the system, you'll need a new proof to cover the correctness of the new system. And I would say today we learned that these authors were both right and wrong about this point. They're probably right that people can't be trusted to read proofs about real systems. But they were implicitly assuming you would be people who read the proofs. Today we have a better way. Let's get algorithms to read the proofs. So here's how this kind of proving can scale up to real systems. So here's a proof engineer trying to prove a theorem. He wrote a proof about it. And don't worry, he didn't have to write it all himself. There's an ecosystem of libraries of existing proof facts as well as proof techniques that can be reused. And the proof is actually ASCII source code. It's checked in diversion control, like on GitHub. And that allows a number of developers to collaborate, writing different theorems within a larger development, get them to all wind up in the same place and have their versions tracked. We can plug our version control into continuous integration, which is effectively running over and over again checking, is this proof still convincing? Is it still convincing? Every time there's a change. And how do we know it's convincing? We have an automatic proof checker that reads the source code of our proofs and applies some straightforward rules to validate that they really prove the facts that they're claiming to prove. And by the way, one risk here is that some of these programmers or developers prove the wrong theorems. So we do some code review where each proof engineer might read the theorem statements written by the others and make sure that we're really proving what we set out to prove. So one, probably some of you are thinking, this picture looks just like the way that software development works today in the real world. And that is very true. It's also true that we also have all these tools already for doing this kind of development for systems with correctness proofs. And I will try to demonstrate that in the rest of this talk. So this future is more or less here today, though there are a lot more rough edges on the proof versions of some of these tools than on the traditional programming versions. And there's a lot of opportunity to get involved with improving the tools. So the key system we're going to use here is called a proof assistant. It's a software package that is basically an IDE for stating and proving mathematical theorems, where you have to do manual work to write the proofs of the theorems as ASCII source code, but then they are checked automatically, just like we're used to with, say, type checkers in programming. There are a number of proof assistants that have been developed for the last few decades and that are pretty usable today. One of them is called Isabel Hall. A large part of that development was done here in Germany at TU Munich. And probably its best-known application is the L4.Verified project, which has done a correctness proof of an operating system. Another proof assistant is called Cauch, developed at Inria in France. One of its best-known applications is CompSert, which is a C compiler with a proof of correctness, bridging the gap from the C code down to the assembly code that is produced. I'm going to focus on the Cauch system in this presentation because that's what I use in most of my work. So how does this process work where we have a sort of collaboration between the human and the machine to come to a convincing proof? Well, the human user is repeatedly making suggestions to the automatic engine, basically saying, I think the following strategy ought to work for the next step of this proof. And then the engine spins for a while and then says, OK, if we do that, then here's what's left to prove. Please tell me what to do here. And the library of steps, or tactics, is not fixed. We can plug in new libraries to the tactic engine, introducing higher and higher level abstractions of what constitutes a valid piece of an argument. In the end, after we've finished this cycle and there is nothing left to prove, then the tactic engine outputs what's called a proof term, which is essentially a program in a small language with just a few reasoning steps built into it. And in fact, everything I've shown you up to this point is untrusted in the sense of trusted computing bases and security. The only thing we need to trust, the only place where a bug in the infrastructure could lead us to accept an incorrect proof, is a separate, relatively small proof checker that only looks at the proof term, ignores the way it was produced, and checks whether it actually establishes the theorem that we were interested in. So what are those primitive deduction steps that the small proof checker is implementing? I'll just give you one classic example of a kind of step, which is more or less built into systems like Calk. This is the modus ponens rule. It says if you know P implies Q and you know P, then you're allowed to deduce Q. So imagine a set of roughly 10 rules like this that we write out in ASCII syntax for the core proof terms of the system. And this is actually a language inspired by functional programming. It's a lot like OCaml. In fact, Caml was invented to use to implement Calk in the 80s. And so we have lines like this that are essentially chaining the other proof steps and we have little applications like that modus ponens at the end saying, and here's the deduction rule we use here. And believe it or not, these chains of steps are enough to reproduce all of the results from math and computer science and all sorts of other logic-based fields. And it's easy to write a relatively small trustworthy checker for applications of these rules that will apply to all those different domains. So let me make this a bit more concrete and show you an example of a proof or two in Calk. So I'm going to be working with this code in Emacs. There's an Emacs mode for Calk authoring, of course. So Calk is based on a functional programming language. It's a lot like Haskell or OCaml, for those of you who know those. We can do things like write this expression, which is a list of natural numbers, 51389. I run a check command and I press some keys and then I got this highlighting in this region, which indicates this is now where the processing of the proof assistant has moved up to. And it tells me this is a list of natural numbers. I can make a list of Booleans and I can use this alternative notation for lists with an IntX operator colon colon for adding a new element to the front of a list. So this is the list consisting of 51389 with an empty list here. It's another way of writing this. And I've also written a recursive function here called length that for any type A takes in a list of type A and returns a natural number and we do pattern matching and say an empty list maps to number zero and a non-empty list maps to one plus the length of the tail of the list where I'm assigning the name LS prime to the tail. I don't have time to go over all the classic ideas from functional programming like in Haskell and ML. Hopefully this will make just enough sense for people who aren't used to seeing those but it's very similar notation to in those languages. So let's prove a theorem. Well, first I'll check. What's the length of this list? It's three, good. And I also define another classic function that takes two lists and essentially concatenates them, makes a new list that's first the elements of the first list then the elements of the second list. You would just write this as plus for lists in Python for instance. Here I'm calling it append and I can append one, two with three, four, five and get one, two, three, four, five down here. So you can already see some of these elements that led me to call this an IDE. We're getting constant feedback as we go much like the ominous red squigglies in Eclipse when you make a mistake in your code. We'll have those coming up shortly when we try to do some proofs and we get this feedback on the computational behavior of what we're defining. So here's a theorem. For any type A and for two lists of that type, if I append them and then take the length, that's the same as taking the sum of their individual lengths. So there's this red background that admitted telling us this is a fact we didn't prove yet. So let's prove it so we don't have to look at that red anymore. And so I'm gonna say, my first step is, I'm gonna prove this by induction on the variable LS1. And then what this is going to do is create two new sub-goals. Here's our current goal just repeated from up here. When I run this, let's give us more space there. There are now two sub-goals, a base case and an inductive case. In the base case, LS1 was replaced with an empty list and in the inductive case, LS1 was replaced with an arbitrary non-empty list with some head element and some tail element. So let's start proving the base case. One thing I'll do, I noticed the goal here starts with a for all, so I'll run a step called intro that's going to take out the for all and instead give us a local variable called LS2. Here it is. And then I notice, this looks pretty obvious, just from the definition of a pen. So let's ask Koch to do some algebraic simplification with that definition. Essentially running parts of the program at compile time, if you will. And then now this looks pretty clear. The same thing is on both sides of the equality so I can say reflexivity. And that case is proved. Let's go into the inductive case. I'll start at the same way. I'll get rid of that for all down below here and simplify. Now I notice there's this term here, length of a pen, blah, blah, blah, which is actually also present up here. What appears here? In general, above the double line, our hypotheses are known facts that we're allowed to appeal to. And here we have an induction hypothesis which has the theorem restated essentially but applying specifically to the tail of the current list so I can say, hey, let's take that known equality, use it to rewrite, we'll match this with this, and therefore we'll be able to replace it with this. So we run like that. And now reflexivity applies. Very good. And the most exciting moment of any proof in Coq you write QED, process that. And if the system doesn't complain, this is the equivalent of typing your code into Eclipse and not getting any red squigglies under it. This is a correct proof. Coq is convinced that the theorem is true. Thank you. One more example to show how we reuse lemmas in proofs. This is a reverse function for lists that takes in a list and then steps down and building a new list using the append function to repeatedly add elements that were on the front onto the end. So reverse one, two, three into three, two, one. And so then we can quickly prove length rev. I'll do this by induction on the list. I'm reversing. I want to show the length does not change when you reverse a list. So the base case is pretty simple here. I'll use algebraic simplification and then that's obviously true. And let's see what happens in this case. Well, here I see I have a length of an append that doesn't directly match my induction hypothesis, but luckily I proved something called length append or append length. I don't remember, we'll find out. Length append, which replaced length of append with sum of the lengths. So we'll play that again. We have the length of the rev plus the length of the singleton list. Then I can simplify this. And now we're very close. I can rewrite with IHLS. By the way, this capital S is the plus one function. It stands for successor. So this is pretty obviously true, though capital S is not defined as plus one. It's a little different, but I can call it procedure called omega, which is a solver for what's called linear arithmetic, which knows how to prove all sorts of numerical facts like that. So that was an example primarily of using a fact we already proved within a larger proof. And this allows us to build up to proofs that cover pretty significant systems and their correctness properties. One last example that I will not go through in much detail. I just want to show that even for programs I can write in one page of code, it's not very straightforward naively to establish their correctness. I've defined a language of abstract syntax trees for expressions with plus and times, as well as constants and variables. I've defined a recursive function to evaluate those expressions to numbers, given values for all variables. And I've defined a medium complexity optimizer that finds parts of the arithmetic that we can actually simplify at compile time. This is a classic optimization called constant folding. But I won't dwell on the code there. I just want to show, here I started trying to prove the correctness, namely when you constant fold and then interpret, it's the same answer as if you interpreted the original program in the same variable environment, xs. And then I started approved by induction. The first case was easy, the second case was easy, but then I started needing to do case analysis on which constructor was used to build particular terms in the abstract syntax tree type. And then I needed to do a sub case analysis inside that one. Then I needed to do a sub case analysis inside that one. And I'm typing the same thing over and over again. A lot of stuff is going on here, but it's very repetitive. And at some point I just gave up and wrote, oh, that's not gonna work. Too hard to write that manually. So keep that in mind. But for now, this is some reason to be skeptical that this approach will scale to full scale, realistic deployed systems if we have to work this hard on a program that fits in one page. But I will come back to that. All right, so having concretized things about the use of proof assistance, you might have a few questions and I'm going to try to answer the standard ones now. One is, okay, we know it's pretty hard for programmers to get the code right. Despite all these techniques that we have, there are still frequently high cost bugs in the wild. Is it really that much better to make programmers get the specs right? For many systems we have trouble imagining how an unambiguous specification would be much shorter or simpler than the original code. One answer is, I would claim verification of this kind is most worthwhile when we apply it to the most commonly used system infrastructure that sits underneath everything else that we run. So processors, operating systems, compilers, databases and so on. Our first foundation for everything else we do and second, they do turn out to have much shorter specifications than implementations. For instance, in a compiler, you can have a specification that doesn't say anything about the particular optimizations the compiler uses, even though those are the most complex parts of it and the easiest ones to introduce bugs in. So in my experience, when we think about what makes a spec a lot shorter than the original program, if we take a spec which covers the functional behavior of a system and then we add in optimizations that make the system fast enough, use little enough memory and so on, then we recover the original implementation. So to the extent there are a lot of optimizations in the system, then there's a real opportunity to write a spec that is much clearer than the original system. But still, this is essentially programming just in a different language and it's still hard to get right, so let's take an example to think through what might be the biggest challenge is imagine we have a compiler who corrects this theorem essentially says the compiler bridges the gap between the semantics of the source language and the target language. For this purpose, let's say, the target language is machine language and imagine each of these semantics, when I write the word semantics, it really means reference interpreter or something like that, though usually it's written in a logical notation. I only wrote the compiler because I wanted to use it to compile some applications and imagine each application has its own specification and then the application theorem kind of snaps together with the compiler theorem through the semantics of the source language of the compiler. And then down below I have my processor that implements the machine language semantics on top of, say, the HDL semantics or semantics for whatever language the processor is written in. So now think of all this together as one composite verified unit. The theorems I've proved for the different parts all compose with each other to create the abstraction of a thing that sits on a particular circuit board and behaves in this application specific way. The really neat thing about this style of development is that first, none of the code we wrote is trusted anymore. It's all internal details inside this big block and it's all covered by the proofs that we've done. Second, even the internal specifications are now no longer trusted. They've become encapsulated details of the system and it's proof. So a mistake in, say, the semantics of the C programming language, which you could imagine is pretty easy to make if you're trying to write out the meaning of C and not miss any cases, does not allow you to accidentally accept an incorrect system in this style as long as you keep that specification internal to the overall functionality that you're building. So let's contrast this with what we have to do to convince ourselves in the current standard software development approach. We have to run not just unit tests about our individual libraries, but also full system integration tests. Because as we compose libraries and modules together, the state space of the system is growing exponentially and therefore it's much easier to have a complete feeling coverage for individual functions than for full systems. In contrast with the computer proof assistant approach, the system integration theorems that we prove actually imply all the components inside the box are doing what they need to do to make the full system work. And we really fundamentally don't need the equivalent of unit tests in such a central role as it has today. In the old way, we have to do careful code review of all of our components because a bug in a corner case and any one of them could completely destroy our guarantees of the whole system. In contrast with the proof-based style, we only need to do careful code review on the externally facing specifications. In fact, you could even accept in theory a component from your worst enemy as long as it was proved to meet the appropriate specification, you could run it without even inspecting the code. And this is potentially a way to support, say, downloading applications from untrusted parties and doing proof checking to guarantee that they meet particular security policies. So, another concern, I showed that as I tried to write out that proof for a medium-sized program modeled after a compiler optimization, it got out of hand quickly and I ran out of patience. Well, we're familiar with the scenario. If you imagine it's 1950 or so and someone says, writing machine code program sure is a lot of work. It's never gonna be very popular. Today we know we have compilers that will go from successively higher levels of abstraction and automatically write that code for us. And by the way, we also have libraries at each of these language levels that we can typically reuse for most of the work, say if you're putting together a web application with a popular framework. We don't expect to rewrite everything each time. In fact, the same story applies in the world of machine check theorem proving where we can build up layers of automatic proof generators. We can build up libraries of lemmas that we appeal to for commonly useful facts. And this is the secret to building up an ecosystem of tools to make it relatively low-cost to create a new development with a proof that is roughly similar to one you've done previously. So let me now go back in and make these proofs that I wrote before a little more appetizing. And so I'll restart this one. So I wrote this proof out here with some very manual steps, but it turns out I can just do this. I can first, I'm gonna use a semi-colon to say, take this, run this step. A bunch of new sub-goals will exist afterward. Then run this one on all of them and then run this one on all of them. The next one has a kind of funny name called intuition. It actually refers to intuitionistic logic, but people typically experience it in a different way at first. That's not what it means. And then that just proves everything. And let's see if we can get lucky with the same thing. The next proof, oops, now it's called LS. And almost, it almost worked. What we're missing is, recall down here, I mentioned a lemma we already proved. Hadn't been told that it should consider that lemma, so it didn't try. So what if I say two steps? I'm gonna take the lemma we already proved. It's called length append. And I'm gonna say, hey, remember that lemma I approved? That'll be useful. Try to use it as a rewriting rule. And I can say auto rewrite with core. And now it's applied here. And we're almost done. I just need to say these three steps should be done over and over again until theorem is proved. So this is an example of a loop here. This is actually a Turing complete scripting language. It's very different from the primitive proof term language with just 10 or so steps in it. We can build up whatever abstractions we need here with loops and recursion and data structures. So what we're really doing is we're writing scripts that find the proofs for us. A particular script is designed to be readable by humans. But because you can read the script doesn't mean you understand every precise detail behind the low level proof it's generating. And that would generally be completely overwhelming to have to understand those details. And a nice thing about writing scripts like this is that often if you change the system you're verifying, if you wrote the script well, it will keep working. And that's a partial answer to the concerns from that 1979 article about proofs keeping up with changes to systems. So it's an engineering problem just like good library design. We want to design good proofs that are adaptable to many similar situations. We don't have to give up any formal assurance if we do this properly. Okay, so here's this example which I didn't have time to explain in detail. I just wanna show how short this proof can be. I've proved some lemmas before. I won't even need those. What we can do here, induction E. Let's see, simple tuition. A few cases are left. What I see when I look at this is this program contains a program level pattern match over a term, this. We should, that's essentially a case split in the program. We should mirror it with a case split in the proof. So let's try that. Match goal is a construction for examining what we're trying to prove and doing something differently based on what we see. And what I'll do is I'll look for any pattern match. This is a syntax for matching any pattern match inside the goal. And I will do a case analysis on that and then simplify things afterward. And I'll say, do this over and over again on all the sub-goals that we generated. Now we're very close to done. We have just a bunch of arithmetic facts. And here we have Neval on a particular term which, given the definition of Neval, take that word for it, can be simplified. So if I just say simplify, not just below the line but everywhere, then those will go to simpler forms as well. And now I notice I have this form with a bunch of things are equal to evaluation results. I want to use those equalities to rewrite down below here. So let me do that as well. Repeatedly look for cases of hypothesis that says something is equal to evaluate something. Rewrite that and then get rid of it. So now all those are gone. We get simple looking things like n equals zero plus n. And it turns out, I have how many of these? It says I have 53 of these facts, a whole bunch of not too interesting things with zeros and pluses and everything. It turns out all of these follow from the axioms of the algebraic structure called semi-ring, which the natural numbers that I'm using here belong to.  So cool thing about this kind of proof, imagine I added a completely new kind of node to my syntax trees. Like I got really ambitious and added subtraction and then this same proof would pretty much work without any changes and even more ambitious changes to the language or the optimization could lead to similar outcomes. So this essentially is how proof authoring scales to large systems and to rapidly changing systems. So back to these slides. So this is the underlying technology for a bunch of different cool things that we can do with proof assistance. So the traditional mode, math proofs is the user has some sort of theorem in mind, writes a proof of it, passes it off to the proof checker and we make sure that it's convincing. We can do the same thing for programs where we start with an implementation and prove a theorem about it and check that that proof is true, that's called verification. There's also kind of the other direction called synthesis where we don't even have the artifact to begin with, we just have a wish list, a specification that says I sure wish I had a foobar that did Baz and then we actually pass that specification into some automated system that builds the implementation for us and actually builds the proof of the implementation at the same time and we can check that proof without having to trust the synthesis engine that did this work for us. Both of these can often be useful and they build on the same technology. I also showed examples so far that only write programs in the functional language that's built into the COC system, but it's such a rich logic that we can encode pretty much any other language you can think of, we can write down its syntax and semantics. So here are some examples of languages that developments in COC have worked with by formalizing what exactly these languages are. Going all the way from high level database query languages down to hardware description languages and we can define these, compose them, do all sorts of cool things. We can also use a wide variety of tools to construct our programs and our proofs. We can use compilers between languages, we can build automated provers that live within the COC ecosystem and generate COC proofs, we can build synthesis tools. The key thing is every tool we introduce in this ecosystem, just like say in a regular software ecosystem, everything needs to somehow connect to a common binary object format. Here everything needs to connect to a common proof format. The most straightforward way of doing that is to take each of these pieces, say some arrow that does translation and prove that the translator itself is correct. It always maps inputs to appropriate outputs. But another approach is to create a proof generating piece that for instance takes in an input, produces not just the output, but also a proof that that particular output is correct. And for different circumstances it's more appropriate to use one of these two styles. Luckily the same proof checker can be used with both of them. So to get more concrete, let me tell you about two projects that I've been working on recently. First one is called COMI. It's all about proof support for digital hardware. It's joint work with a number of other people at MIT listed here. And basically the story is, let's imagine that we want to support rapid open source development of new digital hardware systems by mashing up components from libraries. So for instance you might pull some processors out of one library, a Cascuer here in memory system out of another. Maybe we write our own new accelerators for a particular purpose. And by the way, all these boxes have proofs. So when you assemble your system, you don't just run it, you also combine the proofs of the pieces into a proof that the full system is correct. And you can potentially know correctness without needing to do any debugging if you've proved your top level, it's written your top level theorem correctly and checked that it follows from the constituent proofs. What do I mean by correctness? Well, imagine we have a highly optimized implementation of some hardware component and we've also written a specification which is essentially the simplest possible way to express functionally what that box is supposed to do. We ignore optimization performance, et cetera. We might call this a reference implementation, not just a spec. And we want to prove in the semantics literature we would call a contextual refinement property. What that really means is let's invite into the picture an omniscient judge who's going to very carefully inspect both boxes, he's gonna send them inputs, look at the outputs, and what he's trying to do is find any difference in the way they behave. So if this judge can ever get the implementation to have some externally visible IO behavior that the spec couldn't possibly generate then our system loses. But if in every possible interaction he could have, anything the left side can do, the right side can also do, then we say it is a correct implementation. And in our system we write these hardware components in the blue spec high level hardware language which makes it particularly straightforward to define what exactly are the legal ways to interact with the system. And importantly, many internal implementation details may not be observed directly just like you can't peek into the private fields of a Java class. And that's important for facilitating optimization without foreseeing the details in the spec. So a few words about the blue spec language, it's kind of in an object oriented style where program modules are objects that have private state and public methods that are the only ones allowed to access the private state. And methods can call other methods and other objects. Every method call appears to execute atomically without any interleaving concurrency. And we can summarize any atomic method call with a trace of all the sub method calls that happen. Some coming into this module, some going out to others with their arguments and return values. And then this property that connects the implementation to the spec is basically saying, any trace that my implementation could ever generate could also be generated by the specification. And this is a nice modular way of setting things up because it allows you to then link modules or objects together. As you do that, certain methods become private and they stop appearing in the traces and you can hide the details of how your spec is implemented with a particular hierarchy of optimized components. So let me show you a quick example of some code in the Kami framework. This one's called tutorial. Here is some code for, this is a producer consumer example with two hardware nodes with a queue in between them. This is the producer side. It's a module, it's a particular register in it and a rule that might run on a particular clock cycle, reads a register, calls a method of another module, et cetera. One thing I want to point out here, COC has an extensible parser. So in this framework, we've taught COC the syntax of this hardware description language. There's no built-in keyword module, register, rule, any of that. We've defined the syntax and semantics in logic of this hardware language and that allows us to use it to define systems and do proofs. And here's the consumer definition. It's a lot shorter. Then we define a spec that actually combines the producer and the consumer into one module and avoids using an intermediate queue. And then with less than 100 lines in the file, we get down and prove Ethereum that the implementation is a correct refinement of the specification. And take my word for it. All this can be scaled up to pipeline processors, cache-coherent memory systems. We've done all those examples. So we prove those individually, we compose them and also compose their proofs at the same time. And it is quite general. I also wanna mention one application area that we've been working on for this technology. Some of you might have heard of the risk five instruction set. I think there was another verification talk about it on the first day of the Congress. And I'm wearing a risk five t-shirt here. In the back it says instruction sets want to be free. Risk five is basically like the Linux of hardware instruction sets. If we think of Linux in 1995 or so, it is an open instruction set controlled by a nonprofit foundation in terms of the definition of what are the instructions, what do they do? And has a lot of opportunities for getting involved, including informal methods. So we've been working within the risk five foundation to formally define the meaning of the instruction set. We've been verifying components that you can use to assemble your own risk five systems with correctness proofs. We've been working towards some support for verifying the correctness of risk five machine code as well as infrastructure for composing those proofs together. And there are some nice consequences of this open model that fits really well with formal methods. So in the traditional world, the processor manufacturers control the intellectual property that defines the instruction set and the processors. And they actually don't want most developers to know how things really work because then they could potentially build competing processors and hurt the bottom lines of the companies that own the IP. But in the risk five open model, then we can have a formal semantics at the center of everything that says exactly what the instruction set is. Allows everyone to build a cloned version of the processor. All those can be made open source. They can all have theorems associated with them connected to this formal spec. Others can come along and mash up existing components. And it can dramatically lower the cost of getting into hardware development in this kind of space. So we're trying to build that formal semantics to enable this story. The second case study I want to talk about to finish up here is one we've done in cryptographic code, namely elliptic curve cryptography, which is used in TLS and many other settings. Also joint work with a few folks at MIT. And so here's the story here. Cryptography, as we know, is really important. And most applications using cryptography just take libraries off the shelf, which were written by a small handful of elite cryptographic implementers. Let's think about how hard they have to work to get everything together here. There's a medium-sized set of cryptographic algorithms for all the primitives we need. It turns out many of these are parameterized by large prime numbers that are the moduli for arithmetic. And there's a medium-sized set of different hardware architectures that we'd like to target. It turns out that in practice, for every choice of one circle from each of these bubbles, an expert spends at least a few days rewriting everything from scratch, possibly in assembly language. And this is not a very scalable process. And of course, when doing that sort of thing, we can believe that bugs could be introduced that have serious security consequences. So what if we could have a compiler that automatically did that work when you choose something from each of these bubbles and produces not just the fast low-level code, but also a machine-checkable proof that it truly implements the whiteboard-level math. So that's what we're after here. So we're doing a crypto verification. One kind of property people often prove about cryptography is that these high-level security properties like if you don't know the secret key, then it'll take you more than polynomial time to compute something. Through protocol verification, we can show that a particular mathematical algorithm meets such a property. And through an implementation synthesis process, we can then generate low-level efficient code that follows the mathematical algorithm. Our project is only in that second category. There's been a lot of interesting work in the first category, too. And our system has been adopted by Chrome through the boring SSL library to replace the manually-written elliptic curve finite-field arithmetic that they had had previously. You can find our implementation of curve 25519 in Chrome version 64, which is in beta now. And the next version of Chrome after that will have our implementation of P256. Together, these are the curves that are used in the vast majority of TLS connections. So really quick demo of running this generation process. What we've done is we've built a library of functional programs that capture the generality of arithmetic in this domain. So it turns out these numbers are way too big to fit in hardware registers. We have to be clever about splitting one number among many registers and then essentially implement grade school arithmetic ourselves with some catches for performance on popular processors. And we do that using standard functional programming stuff like folds and maps and so on. For instance, here's a definition of multiplication. It uses a flat map and a map. I won't go into details on exactly our representation. This is kind of a simplified version for demo purposes. But we get caught to process all this and make our way down to the bottom of this file where I'm going to essentially state the following goal. Assume we have two 10 tuples of integers. It turns out that on 32-bit processors for curve 25519 you want to represent each number with 10 different word size digits. So that's why these are 10 tuples. And we say, please find an element of this set. Tuples that are the correct answers to the problem of multiplying the two inputs mod two to the 255 minus 19. And I run a few steps here that I want to explain in detail to start symbolic manipulation. And then key step is here. This is going to run for about 10 seconds, I think. We're asking Cork to do some correct by construction derivation of concrete code for computing this multiplication result.  I think this is the last digit of the answer in some of the arithmetic for computing it. It has a lot of redundant parts to it. So let's use the ring algebraic laws to simplify this a bit more. And this one takes a few tens of seconds to run. But what's happening is the system is automatically computing the code that traditionally has been written by hand for this cryptographic primitive. And it's doing it in a way that doesn't just build the code, it also builds the proof that it's related back to the original whiteboard level modular arithmetic definition. And this will finish any moment now. And it will no longer have all these constants and that these will be combined into a nicer form. And the output that'll pop up here is not the end of the story. We also have later phases that lower it into C-like code, do bounds analysis to make sure we've assigned enough bits to each register. That all happens automatically given the other parameters. And here we have an example of the output. So this might look familiar to people who've been implementing curve 25519. It's still in a relatively high level form without breaking things down into individual temporary variables. But we didn't have to manually figure out, for instance, there should be a 38 here and 19 here. And all those things, it was done for us automatically. And you can put in different parameters and generate the standard code for any of the other curves and any of the hardware architectures that folks like to use them on. So to finish this up, our implementation automatically builds that code from a way of writing down the prime modules in a suggestive way, like the here. This is typically how these are written as sums and differences of powers of two or small multiples of them. So we wrote a Python script that uses that to generate a few lines of configuration to our system. And then we scraped the elliptic curve mailing list at moderncrypto.org to find every prime number that appears in the archives. So we could use them all as inputs for automatically generating code. There were only a few weird prime numbers posted there that are actually very inefficient to implement. That was probably a newbie to the list who made a suggestion and was quickly rebuffed. But we generated those two or tried to. Sometimes you ran out of memory with those. And we automatically built code for all these cases compared against the GNU multi-precision library, which is a very standard off-the-shelf library for big integer arithmetic. Here are our results generating for 64-bit x86 here for a 32-bit ARM running on an Android phone. And generally, the GNU multi-precision version of things will take two to 10 times longer to run one of the elliptic curve operations than with our code, which was created completely automatically and also has strong guarantees of correctness. So thanks. I'll just leave you with a few pointers to places to follow up if you'd like to learn more about this subject. Number one place to start, an online book called Software Foundations written by Benjamin Pierce and others. It introduces caulk just assuming standard undergraduate computer science material, no formal methods, or even functional programming experience. I should also advertise our multi-university initiative in the US called the Science of Deep Specification, or DeepSpec. In particular, in summer 2018, we'll be running a summer school that introduces all this stuff with some hands-on practice with hardware verification and C program verification and a few other topics in caulk. It'll be held in Princeton, New Jersey. And you can subscribe to our mailing list on the website if you'd like to get updates as we pin down more of the details. Here are the GitHub projects for my own projects that I mentioned here, and two of the others that we made code contributions to. Thank you. We have about 10 minutes for Q&A. Yeah, microphone one. Thanks to great talk. I enjoyed it really much. I have a question, what strategies you have for finding the right theorems. Because I think this is the hardest part here. And you said you make reviews for this. And I think maybe that's not enough. For example, when you have a reverse function and the sorting function, you can have the theorem that, for the invariant, that the length will always be the same when you execute it. But maybe that's not enough for the theorems. So what are your strategies? Because maybe I think a combination to have some concrete example test that tests the functions also good here. So theorems are maybe not enough. What are your thoughts on this? Yeah, so this relates to a number of the frequently asked questions, answers that I had in the middle of the talk. Generally, we build infrastructure to support applications. And applications tend to have more straightforward specifications in many cases than the systems infrastructure below. We try to set things up so if we got the infrastructure theorem wrong, we will not be able to use it to prove the application result. So in general, one technique is when you build a verified component, use it in as many different contexts as possible. And don't peek back inside the implementation. Only look at the original theorem you chose.  And you mentioned it might be useful to have a set of test cases as part of a specification for a component. That could be a good strategy also. But it's kind of covered by reusing your component in many different settings where you're naturally, say, calling your function with different arguments. And you need that function to be correct to get the larger system to be correct. Microphone 3. Hi. Thank you very much for the excellent talk. The specifications of many, many problems also involve time. So you have not only to have the correct answer, you have to have the correct answer before the TCP session times out, the user gets bored, the machine gets rebooted, your deadline is over. How do you write down time specifications in Cog like this thing will finish after at most this many milliseconds? Yeah, I think we'll probably hold off in trying to prove that users don't get bored for now, but maybe someday. But for the timeout property, I think, so we're working in a very general mathematical framework that can essentially encode anything that you'd find in a math textbook. And it's pretty easy to define what time is from the program execution perspective. And there have been projects that, for instance, prove that a C compiler preserves running time between the source code and the assembly code with probably a naive model at the bottom. And I don't have any projects of my own in that vein so far, but a number of people have looked at that. So I think my main answer is, very flexible framework. You can encode whatever you want. You can prove whatever you want. It's just a question of how much labor is going to be required. And we'll learn more about better abstractions that will reduce that labor over time. Thank you. We have a question from the signal angel. Yes, maybe somewhat related to the last one. So can proofs help against side channel attacks, for example, by proving a certain function runs in constant time because the main point of manual crypto implementation is to avoid side channel attacks and do the automatically created implementations that you presented address this issue? So the automatically created implementations I presented are actually in a very restrictive language that enforces constant time by construction. It's all straight line code. Think of it as the performance critical inner loops of the cryptographic library. And so yes, that one does, by construction, provide constant time. Other formal methods projects have done automatic program analysis to guarantee constant time properties. I think this is an important kind of analysis to do. It's among the easier ones for formal methods, which is great given the big payoff in security. So I'm optimistic about scaling up to whatever settings it's needed in. Microphone 4? Yeah, so about scaling up, to what extent is the user? To what extent do you look at human factors? Because in many cases, that's how this is break. Well, it depends. If you're talking about the humans who are writing the proofs, then that's us. We're very concerned about us. And we make an effort to help ourselves by improving tools. Do you mean the users of the software or hardware that we're creating in some way that they might be worse off because of this methodology? Yeah, so to what extent? So when you're talking about full system specifications, it's really a question of what do you include in your system? I see. Oh, you're asking do we formally model the user in the theorems? So we'll do things like the top level theorem of the hardware models that it has, an input channel and an output channel. We have no idea what's on the other side, but our specification says if you get this input, you need to give that output, that sort of thing. I don't know of anyone who's been doing anything like cognitively modeling users and what you should expect from them in this kind of setting. That could be worthwhile, though I expect there'd be a lot of disagreement about exactly how to write the theorem down. Thanks. Microphone 1. So I'd just like to start by saying that I already agree with everything you said here, so you don't need to actually assault me on any of it. I basically believe that the average industrial program was a Dunning-Kruger poster trial. And so anyway, Tony Hort said that null references were his billion-dollar mistake, and he has this following quote, which is, 10 years ago, researchers into formal methods predicted that the programming world would embrace with gratitude every assistance promised by formalization to solve the problems of reliability that arise when programs get large and more safety critical. Then he says more stuff and concludes, which is like the most dismal, sad thing I've ever heard. It has turned out that the world just does not suffer significantly from the kind of problem that our research was originally intended to solve. OK. And why do you believe that programmers will accept this now when they have, for 30 years, developed so many confused epicycles on the ideas of research that do work? In my experience, at least for some isolated communities of developers, like the authors of the main crypto libraries, they do worry about correctness, and they're very interested in exploring these kinds of techniques. So that's one answer, let's say the very high assurance domain where people are especially interested, especially willing to accept certain costs for correctness. The other answer I'd give is that I think we're progressively improving the usability and creating many component libraries that can do most of the work for you for each project so you don't have to start from scratch. And I think we're heading towards passing some critical point where the ecosystem is big enough that there's a fundamental change in the cost of applying these tools. And if we get there, then I think that'll make the difference for the kind of barrier that Hora was talking about. I agree with that, but I also think my example was null references. And all you need in order to eliminate nulls from a language are parametric polymorphism and some types.  I don't make those kind of mistakes. Well, I guess we can discuss this later. There's another question from the internet. How does the halting problem limit what you can prove and is there the problem in real life applications?  Luckily, the pieces of code we care about were written by people who had understandings of them in mind. And I personally believe that the author of the code should be responsible for distributing a proof with it. And it is then decidable to check if the proof is convincing, which is the real problem that matters for this domain. Microphone three. The baby examples you gave us with proofs, the proofs to me looked still very verbose because the examples were very simple. So is there more optimization possible and people are doing that? There are a wide variety of approaches to proof automation. I think of those proofs as pretty short. They're definitely significantly shorter than the programs that they're applying to. It was maybe one fifth the size of the program, which if you look at these kind of proofs 20 years ago, it's a big improvement already and we can extrapolate from that and hope for even shorter proofs in the future. Last question, microphone three. You said that in the semantics of blue spec, methods executed atomically. So what actually happens if there's a failure during a method? Well, so this is in hardware land where within a method, everything's running just as propagation of signals over wires. So you have to plan ahead and detect the failures with guard conditions at the beginning and then you just don't look at what's flowing down that part of the circuit. No, that's it. I'm sorry, I have to kill it. Next talk will be in 15 minutes. Thanks. Thanks. Thank you.