cs4004/cs4504: formal verification

Transcription

1 cs4004/cs4504: formal verification Lecture 11: Proofs in First Order Logic and classical vs. intuitionistic logic Vasileios Koutavas School of Computer Science and Statistics Trinity College Dublin

2 Proofs in First Order Logic

3 first order logic rules (1/2) A 1 A 2 i A 1 A 2 A 1 A 2 A 1 e 1 A 1 A 2 A 2 e 2 A 1 A 1 A 2 i 1 A 2 A 1 A 2 i 2 A 1 A 2 A A e A B A B i A A B B A A i A e e A 1 B B A 2 B A e* A e *Only in classical FOL 2

4 first order logic rules (2/2) t = t =i (reflexivity) t 1 = t 2 A[t 1 /x] A[t 2 /x] =e t 1 = t 2 t 2 = t 1 =sym t 1 = t 2 t 2 = t 3 t 1 = t 3 =trans A[t/x] x.a i x.a A[t/x] e x.a x 0 A[x 0 /x] x 0 x.a C i A[x 0 /x] C e 3

5 useful theorems from propositional logic When we prove first order logic sequents we often use known theorems to shorten our proofs. Some of these theorems we express as derived rules. Theorem (Law of Excluded Middle ) A A or equivalently A A LEM * Only in classical logic (stay tuned). 4

6 useful theorems in first-order logic Theorem x.a x. A x.a x. A 5

7 more theorems let x not appear free in B. Then x.b B x.b B 6

8 more theorems let x not appear free in B. Then x.b B x.b B ( x.a) B x.(a B) ( x.a) B x.(a B) ( x.a) B x.(a B) ( x.a) B x.(a B) 6

9 more theorems let x not appear free in B. Then x.b B x.b B ( x.a) B x.(a B) ( x.a) B x.(a B) ( x.a) B x.(a B) ( x.a) B x.(a B) x.(b A) B ( x.a) x.(a B) ( x.a) B x.(b A) B ( x.a) x.(a B) ( x.a) B 6

10 even more theorems ( x.a) ( x.b) x.(a B) ( x.a) ( x.b) x.(a B) 7

11 even more theorems ( x.a) ( x.b) x.(a B) ( x.a) ( x.b) x.(a B) x. y.a y. x.a x. y.a y. x.a 7

12 even more theorems ( x.a) ( x.b) x.(a B) ( x.a) ( x.b) x.(a B) x. y.a y. x.a x. y.a y. x.a wrong: x. y.a y. x.a wrong: x. y.a y. x.a 7

13 Classical vs. Constructive logic

14 first order logic rules (1/2) A 1 A 2 i A 1 A 2 A 1 A 2 A 1 e 1 A 1 A 2 A 2 e 2 A 1 A 1 A 2 i 1 A 2 A 1 A 2 i 2 A 1 A 2 A A e A B A B i A A B B A A i A e e A 1 B B A 2 B A e A e Only in classical FOL 9

15 first order logic rules (2/2) t = t =i (reflexivity) t 1 = t 2 A[t 1 /x] A[t 2 /x] =e t 1 = t 2 t 2 = t 1 =sym t 1 = t 2 t 2 = t 3 t 1 = t 3 =trans A[t/x] x.a i x.a A[t/x] e x.a x 0 A[x 0 /x] x 0 x.a C i A[x 0 /x] C e 10

16 classical logic Consider the sequent x.(p(x) y.p(y)) To prove this we need use rule i and provide a term t for which we can show (P(t) y.p(y)) 11

17 classical logic Consider the sequent x.(p(x) y.p(y)) To prove this we need use rule i and provide a term t for which we can show (P(t) y.p(y)) Classically this is a tautology: If y.p(y) holds then we can pick arbitrarily term t 0 and show P(t 0 ) y.p(y) using rule i (also see truth table of implication). 11

18 classical logic Consider the sequent x.(p(x) y.p(y)) To prove this we need use rule i and provide a term t for which we can show (P(t) y.p(y)) Classically this is a tautology: If y.p(y) holds then we can pick arbitrarily term t 0 and show P(t 0 ) y.p(y) using rule i (also see truth table of implication). If y.p(y) then there exists a term t 1 such that P(t 1 ), which we can use to show P(t 1 ) y.p(y) 11

19 classical logic However notice how we didn t have to provide any concrete term t 1 in the second case to complete the proof of x.(p(x) y.p(y)) Let s see this again: If y.p(y) then there exists a term t 1 such that P(t 1 ), which we can use to show P(t 1 ) y.p(y) 12

20 classical logic However notice how we didn t have to provide any concrete term t 1 in the second case to complete the proof of x.(p(x) y.p(y)) Let s see this again: If y.p(y) then there exists a term t 1 such that P(t 1 ), which we can use to show P(t 1 ) y.p(y) 12

21 classical logic However notice how we didn t have to provide any concrete term t 1 in the second case to complete the proof of x.(p(x) y.p(y)) Let s see this again: If y.p(y) then there exists a term t 1 such that P(t 1 ), which we can use to show P(t 1 ) y.p(y) Assume logic s terms F contain natural numbers and predicates P standard predicates over them. if P(x) = even(x) then t 1 can be 3 12

22 classical logic However notice how we didn t have to provide any concrete term t 1 in the second case to complete the proof of x.(p(x) y.p(y)) Let s see this again: If y.p(y) then there exists a term t 1 such that P(t 1 ), which we can use to show P(t 1 ) y.p(y) Assume logic s terms F contain natural numbers and predicates P standard predicates over them. if P(x) = even(x) then t 1 can be 3 if P(x) = odd(x) then t 1 can be 4 12

23 classical logic However notice how we didn t have to provide any concrete term t 1 in the second case to complete the proof of x.(p(x) y.p(y)) Let s see this again: If y.p(y) then there exists a term t 1 such that P(t 1 ), which we can use to show P(t 1 ) y.p(y) Assume logic s terms F contain natural numbers and predicates P standard predicates over them. if P(x) = even(x) then t 1 can be 3 if P(x) = odd(x) then t 1 can be 4 if P(x) = (x 1000) then t 1 can be

24 classical logic However notice how we didn t have to provide any concrete term t 1 in the second case to complete the proof of x.(p(x) y.p(y)) Let s see this again: If y.p(y) then there exists a term t 1 such that P(t 1 ), which we can use to show P(t 1 ) y.p(y) Assume logic s terms F contain natural numbers and predicates P standard predicates over them. if P(x) = even(x) then t 1 can be 3 if P(x) = odd(x) then t 1 can be 4 if P(x) = (x 1000) then t 1 can be

25 classical logic However notice how we didn t have to provide any concrete term t 1 in the second case to complete the proof of x.(p(x) y.p(y)) Let s see this again: If y.p(y) then there exists a term t 1 such that P(t 1 ), which we can use to show P(t 1 ) y.p(y) Assume logic s terms F contain natural numbers and predicates P standard predicates over them. if P(x) = even(x) then t 1 can be 3 if P(x) = odd(x) then t 1 can be 4 if P(x) = (x 1000) then t 1 can be 1001 we can t provide a t 1 if we don t know P and the parameters F, P 12

26 classical logic However notice how we didn t have to provide any concrete term t 1 in the second case to complete the proof of x.(p(x) y.p(y)) Let s see this again: If y.p(y) then there exists a term t 1 such that P(t 1 ), which we can use to show P(t 1 ) y.p(y) Assume logic s terms F contain natural numbers and predicates P standard predicates over them. if P(x) = even(x) then t 1 can be 3 if P(x) = odd(x) then t 1 can be 4 if P(x) = (x 1000) then t 1 can be 1001 we can t provide a t 1 if we don t know P and the parameters F, P but there is always one. 12

27 classical logic However notice how we didn t have to provide any concrete term t 1 in the second case to complete the proof of x.(p(x) y.p(y)) Let s see this again: If y.p(y) then there exists a term t 1 such that P(t 1 ), which we can use to show P(t 1 ) y.p(y) Assume logic s terms F contain natural numbers and predicates P standard predicates over them. if P(x) = even(x) then t 1 can be 3 if P(x) = odd(x) then t 1 can be 4 if P(x) = (x 1000) then t 1 can be 1001 we can t provide a t 1 if we don t know P and the parameters F, P but there is always one. Classical logic is OK with that! 12

28 classical logic However notice how we didn t have to provide any concrete term t 1 in the second case to complete the proof of x.(p(x) y.p(y)) Let s see this again: If y.p(y) then there exists a term t 1 such that P(t 1 ), which we can use to show P(t 1 ) y.p(y) Assume logic s terms F contain natural numbers and predicates P standard predicates over them. if P(x) = even(x) then t 1 can be 3 if P(x) = odd(x) then t 1 can be 4 if P(x) = (x 1000) then t 1 can be 1001 we can t provide a t 1 if we don t know P and the parameters F, P but there is always one. Classical logic is OK with that! Constructive logic is not! It requires us to give a concrete t 1, before we know what P is. 12

29 example classical proof Theorem There are irrational a and b for which a b is rational. Proof. We know that 2 is irrational (known theorem of arithmetic which we will not prove here). Suppose 2 2 is rational. Then pick a = b = 2 and we re done. Otherwise 2 2 is irrational. Pick a = 2 2 and b = 2. which is rational. ( 2 ) 2 a b 2 = = = 2 = 2 13

30 example classical proof Theorem There are irrational a and b for which a b is rational. Proof. We know that 2 is irrational (known theorem of arithmetic which we will not prove here). Suppose 2 2 is rational. Then pick a = b = 2 and we re done. Otherwise 2 2 is irrational. Pick a = 2 2 and b = 2. which is rational. ( 2 ) 2 a b 2 = = = 2 = 2 Correct but we never identified two definitely irrational numbers a and b. 13

31 example classical proof Theorem There are irrational a and b for which a b is rational. Proof. We know that 2 is irrational (known theorem of arithmetic which we will not prove here). Suppose 2 2 is rational. Then pick a = b = 2 and we re done. Otherwise 2 2 is irrational. Pick a = 2 2 and b = 2. which is rational. ( 2 ) 2 a b 2 = = = 2 = 2 Correct but we never identified two definitely irrational numbers a and b. In fact knowing whether 2 2 is rational is a difficult problem! 13

32 example classical proof Consider the predicate A(n, m) = def (({n}(n) ) (m = 0)) ((m = 0) ({n}(n) )) where {n}(n) means the n th turing machine given n as an input terminates. Prove: x. y.a(x, y) Proof. We need to use rule i, and prove for arbitrary n: y.a(n, y) 14

33 example classical proof Consider the predicate A(n, m) = def (({n}(n) ) (m = 0)) ((m = 0) ({n}(n) )) where {n}(n) means the n th turing machine given n as an input terminates. Prove: x. y.a(x, y) Proof. We need to use rule i, and prove for arbitrary n: y.a(n, y) If {n}(n) then pick y = 0. Otherwise pick y = 1. 14

34 example classical proof Consider the predicate A(n, m) = def (({n}(n) ) (m = 0)) ((m = 0) ({n}(n) )) where {n}(n) means the n th turing machine given n as an input terminates. Prove: x. y.a(x, y) Proof. We need to use rule i, and prove for arbitrary n: y.a(n, y) If {n}(n) then pick y = 0. Otherwise pick y = 1. Here we can think of the two cases as appealing to some oracle that knows the truth of turing machine termination. Our proof works by case analysis on what the oracle would answer. Constructive logic does not want to have proofs involving appealing to an oracle. Constructive proofs can be translated into programs! 14

35 classical rule The rule that allows us to do classical proofs is this: A A e This rule is in fact equivalent to the following rules: LEM(Law of Excluded Middle) A A A A PBC(Proof by contradictio ((A B) A) A In fact from any of the 3 we can derive the other two. 15

36 classical proof 1 Prove LEM using e A A A A e 16

37 classical proof 2 Prove using e ((A B) A) A A A e 17

38 classical proof 3 Prove using LEM ((A B) A) A A A LEM 18

39 classical proof 4 Prove using PBC ((A B) A) A A A PBC 19

40 classical proof 5 Prove the following using PBC x.a x. A A A PBC 20

41 classical proof 6 Prove the following using e x.a x. A A A e 21

42 classical proof 7 Prove the following using LEM x.a x. A A A LEM 22

43 FOL English

44 fol example 1 Let F be the set of terms containing people s names; e.g., alice 0, bob 0, carol 0, etc. It also contains the term function m 1 which returns the mother of any person. Moreover consider the set of predicates P which contains the predicate P 1, which means that a person is poor. Express in FOL: If there is a rich person, and every poor person has a rich mother, then there exists a rich person with a rich grandmonther. Prove the above statement. 24

45 fol example 2 Consider the following sentences: 1. All actors and journalists invited to the party are late. 2. There is at least a person who is on time. 3. There is at least an invited person who is neither a journalist nor an actor. Formalize the sentences. Prove that (3) is not a logical consequence of (1) and (2). 25