1. Advanced Formal Methods Lecture 6: Isabelle - HOL Mads Dam KTH/CSC Course 2D1453, 2006-07 Material from L. Paulson

2. What Is Higher Order Logic? Propositional logic No quantifiers All variables have type bool First Order Logic Quantification over values of base type Terms and formulas are syntactically distinct Higher Order Logic Quantification over functions and predicates Consistency by typing Formula = term of type bool Predicate = function with codomain bool ! + a few types and constants

3. Natural Deduction Two kinds of rules for each logical operator © Introduction rules: How can A © B be proved? Elimination rules: What can be inferred from A © B? Natural deduction calculus: Proof trees may have unproven leaves = assumptions Assumptions can be introduced and discharged Sequent calculus: All assumptions (and alternative conclusions) represented explicitly in proof judgments

4. Rule Notation Write Instead of «A 1 ;... ; A n ¬ ) A In other words: Stipulating an inference rule ”RuleName” Same as: Declaring an Isabelle metalogic term «A 1 ;... ; A n ¬ ) A to be provable by named rule Derived rule «A 1 ;... ; A n ¬ ) A Rule is provable in Isabelle’s metalogic A 1... A n A RuleName

5. Natural Deduction, Propositional Logic A B A Æ B ÆIÆI AÆB «A;B¬ ) C C ÆEÆE AÇB A ) C B ) C C ÇEÇE A A Ç B ÇI1/2 B A Ç B A ) B A ! B )I)I A ) B A B ) C C )E)E A ) B B ) A A = B iffI A ) False :A :I:I A = B A ) B iffD1/2 A = B B ) A :A A C :E:E D for ”definition”

6. Equality Exercise 1: Prove that the following rules are derived: - t = t =I s = t A[s/x] A[t/x] =E s = t t = s Sym r = s s = t r = t Trans s = t A[s/x] A[t/x] ) C C =E’

7. More Rules ccontr and classical not derivable from other rules They make the logic ”classical”, i.e. non-constructive A ! B A B mp :A ) False A ccontr :A ) A A classical

8. Proof by Assumption Implicit in Isabelle’s metalogic «A 1 ;... ; A n ¬ ) A i provable for any i: 1· i· n In isabelle: apply assumption proves 1. «B 1 ;... ; B n ¬ ) C by unifying C with some B i, 1 · i · n Note: This may cause backtracking!

9. Rule Application Rule: « A 1 ;... ; A n ¬ ) A Subgoal: 1. « B 1 ;... ; B m ¬ ) C Substitution:  (A) ==  (C) (recall: == means ”same term as”) New subgoals: 1.  (« B 1 ;... ; B m ¬ ) A 1 )... n.  (« B 1 ;... ; B m ¬ ) A n ) Command: apply (rule )

10. Exercises Exercise 2: Prove the following in HOL. Pen and paper is fine. If you use Isabelle, use only basic HOL rules corresponding to rules given in previous slides – no simplifiers 1.A Ç (B Ç C) ! (A Ç B) Ç C 2.(A ! (B ! C)) ! (A Æ B) ! C 3.A Ç A ! A Æ A 4.A Ç B ! : A ! B 5.A Æ (B Ç C) ! (A Æ B) Ç C 6.(A Æ :B) Ç (B Æ :A) = (A = :B) 7. :(A Æ B) ! (:A) Ç (:B)

11. Elimination Rules in Isabelle Tactic erule assumes that first rule premise is assumption to be eliminated: apply (erule ): Example: Rule: « ?P Æ ?Q ; « ?P; ?Q ¬ ) ?R¬ ) ?R Subgoal: « X ; A Æ B ; Y ¬ ) Z Unifier: ?R == Z, ?P == A, ?Q == B New subgoal: « X; Y ¬ ) « A; B ¬ ) Z Same as: « X; Y; A; B ¬ ) Z

12. Safe and Unsafe Rules Recall: Rules applied bottom up Safe rules: Provability is preserved (in bottom up direction) Examples: ÆI, !I, :I, iffI, refl, ccontr, classical, ÆE, ÇE Unsafe rules: Can turn provable goal into unprovable one: Examples: ÇI1, ÇI2, !E, iffD1, iffD2, :E

13. ) vs. ! Theorems should be written as ¬ A 1 ;... ; A n ¬ ) A Not as A 1 Æ... Æ A n ! A Exception: Induction variable must not occur in premises Example: « A; B(x)¬ ) C(x), not good Use instead: A ) B(x) ! C(x)

14. Predicate Logic - Parameters Subgoal: 1. Æ x 1... x n. Formula The x i are parameters of the subgoal Intuition: Local constants, arbitrary, fixed values Rules automatically lifted over Æ x 1... x n and applied directly to Formula

15. Scope Scope of parameters: Whole subgoal Scope of HOL connectives: Never extend to meta-level I.e. ends with ; or ) Æ x y. « 8y. P y ! Q z y; Q x y¬ ) 9x. Q x y means Æ x y.« (8y 1. P y 1 ! Q z y 1 ); Q x y¬ ) 9x 1. Q x 1 y

16. Natural Deduction, Predicate Logic 8I and 9E introduce new parameters (Æx) 9I and 8E introduce new unknowns (?x) Æx.(P x) 8x.(P x) 8I8I 8x.(P x) (P ?x) ) R R 8E8E (P ?x) 9x.(P x) 9I9I 9 x.(P x) Æ x.(P x) ) R R 9E9E

17. Instantiating Rules apply (rule tac x = t in ) Acts as, but ?x in is instantiated to t before application erule tac is similar So: x is in, not in the goal

18. Two Successful Proofs 1. 8x. 9y. x = y apply (rule 8I) 1. Æx. 9y. x = y Best practice apply (rule tac x = ”x” in 9I) 1. Æx. x = x apply (rule refl) Exploration apply (rule 9I) 1. Æx. x = ?y x apply (rule refl) Simpler and clearer ?y  z.z Shorter and trickier

19. Two Unsuccessful Proofs 1. 9 y. 8 x. x = y apply (rule tac x = ??? in 9I) ??? apply (rule 9I) 1. 8x. x = ?y apply (rule 8I) 1. Æ x. x = ?y apply (rule refl) ?y  x yields Æx’. x’ = x ???

20. Safe and Unsafe Rules Safe: 8I, 9E Unsafe: 8E, 9I Create parameters first, unknowns later

21. Exercises, Predicate Logic Exercise 3. Prove or disprove the following formulas. If you prove the formulas, use Isabelle, as in exercise 2. For a disproof it is sufficient to show that the formulas are false in ordinary first-order logic. 1. 8x.8y. R x y = 8y.8x. R x y 2.(9x. P x) Ç (9y. Q y) = 9z. (P z) Ç (Q z) 3. : 8x. P x ) 9y.:(P y) 4. 9x.(P x ! 8y.P y)

22. Renaming Parameters Careful with Isabelle-generated names 1. 8 x. 9 y. x = y apply (rule 8I) 1. Æx. 9y. x = y apply (rule tac x = ”x” in 9I) What if the above used in context which already knows some x? Instead: apply (rename tac xxx) 1. Æxxx. 9y. x = y apply (rule tac x = ”xxx” in 9I)

23. Forward Proof ”Forward” rule:A 1 ) A Subgoal:1. « B 1 ;... ; B m ¬ ) C Substitution:  (B i ) ==  (A 1 ) New subgoal:1.  (« B 1 ;... ; B n ; A ¬ ) C) Command: apply (frule ) Like frule but deletes B i : apply (drule )