Introduction to Isabelle/HOL

Transcription

1 Introduction to Isabelle/HOL 1 Notes on Isabelle/HOL Notation In Isabelle/HOL: [ A 1 ;A 2 ; ;A n ]G can be read as if A 1 and A 2 and and A n then G 3 Note: -Px (P x) stands for P (x) (P(x)) -P(x, y) can be expressed as P x y or (P x) y - recall that in higher order logic: functions, sets and predicates can be identified with each other Jacques Fleuriot x P, x P are quantified sentences (where P may or may not contain x) If and only if is expressed using = eg (P ) = ( P ) Has decision procedures eg linear arithmetic Simplifier does rewriting Has its own connectives and uantifiers: eg Isabelle Isabelle Isabelle/HOL sets Other logic egpropositional, FOL etc 2 Meta-logic has Universal quantifier Implication Conjunction ; Proof tools: blast, auto, etc Forward and backward proofs Natural Deduction - Introduction ules - Elimination ules Isabelle tactics/methods 4 easoning in Isabelle eg rule, drule, auto, We will look at procedural proofs ie proofs will have sequences of Has reasoning methods (based on natural deduction for example) Hierarchy of theories eg sets, natural numbers, real numbers, security protocols apply (methodtheorem_name) 1

2 The ules of the Game So far, we have seen (automatic) refutation proofs mainly Isabelle uses mostly natural deduction Natural deduction aims to capture human reasoning patterns when doing formal logic Each logical connective has two kinds of rules: Introduction ules: allow connective to be inferred Elimination ules: allow consequences from connective to be deduced In general, rules will involve other logical symbols eg user defined ones 5 Conjunction Introduction rule:?p,?: schematic variables can be substituted for 7 Natural Deduction (Cont) Isabelle syntax: premises [?P;? ]?P "? (conji) conjunction fat brackets group premises In procedural style: mainly reason backwards conclusion Natural Deduction Example: Conjunction Introduction enables us to introduce the 6 premises connective A Simple Proof Given that P is true and that is true prove P!$#! P% 8 introduced in conclusion P P! conji conclusion Isabelle name for rule branch is closed P assumption assumption (! P) P! (! P) P assumption conji conji Forward proof: If we have P and we have then we have P Backward proof: To prove P, prove that P is true and prove that is true Assumptions: P 2

3 A Simple Backward Proof in Isabelle Given that P is true and that is true prove P!$#! P% Isabelle keyword Isabelle commands! lemmaa_conj_theorem: [ P ; ] P! ( P) apply (rule conji) apply (rule conji) qed The method/tactic called rule applies its argument (a theorem) backwards 9 name given to resulting theorem P P 11 Other Introduction ules (II) disji1 [P] [] P iffi P= P disji2 [P] false P noti Intuition: P = (P false) Isabelle: [?P?;??P ] P= Common notation: 10 Other Introduction ules (I) [P] P impi Isabelle: (?P & % & P & #impi% or as Note: [P]: assumption local to sub-proof P P impi Forward: If on the the assumption that P is true, can be shown to hold, then we can conclude P Backward: To prove P, assume P is true and prove that follows More rules to come Substitution In Isabelle literature:p[t/x] is result of replacing x by t in P s =t P[t /x] s =t s =s t =s P[s /x] ssubst 12 Note: this is same as P {t / x} that we saw before only positions designated by variable substituted by this rule Substitution rule in Isabelle:[?t =?s ;?P?s ]?P?t (ssubst) Example: prove symmetry of equality predicate ie s = t t = s: Justification: s =t (x =s )[s /x] t =s 3

4 ' ) ) uantifiers, : need substitution and notion of arbitrary variable Universal uantifier: 13 Other Introduction ules (III) P x 0 alli x P x x 0 is arbitrary ie we make no assumptions about it provided x 0 does not occur in P x or any premise on P x 0 which may depend In Isabelle: use underlying formalism of Isabelle, the meta-logic, to express the proviso logically Isabelle s meta-logical universal quantifier enables notion of arbitrary value ( ( x?px) x?px don t confuse this with conjunction Elimination ules Work in opposite direction from introduction rules Conjunction rules: P * P * conjunct1 P 15 conjunct2 In Isabelle:?P +??P?P +?? [P], []local to their subproofs Disjunction rule: P [P] [] haveto prove twice under different assumptions disje [?P? ;?P? ;?? ]? (disje) Existential uantifier: In Isabelle: Example: P a x Px?P?a x?px 14 Other Introduction ules (IV) even 2 x evenx If we can exhibit some a such that P(a) is true then x P(x) is also true 16 Elimination ules (II) Using an elimination rule backwards produces a case-split Example: Assume A B prove B A erule enables this subgoal to be proved immediately from premise of goal A, B B, [A] A A B, assum disji2 A [B] assum B disji2 B, A disje Note: can use erule method, designed to work with elimination rules 4

5 Example: Elimination ules (III) II) A possible Isabelle proof: 17 Assume A B prove B A lemmadisj_swap: A BB A apply (erule disje) apply (rule disji2) could have used apply (rule disje) This need extra step though apply (rule disji1) Try it in Isabelle! qed Isabelle/HOL A Special Elimination ule for Conjunction Isabelle provides an alternative conjunction elimination rule [P][] P conje 19 In Isabelle: [?P? ;[?P ;? ]? ]? (conje) Isabelle/HOL: A Special Elimination ule Isabelle elimination rules for are: P * conjunct1: P * conjunct2: P rules simply return 1 st /2 nd half of conjunct - these are called destruction rules in Isabelle - they break and destroy a premise (we lose info when we apply them) 18 Implication: Elimination ules (IV) Modus Ponens P P Example: mp ProveP ( ) P P * assum 20 In Isabelle: [?P? ;?P ]? 1 P ( ) 2 [P ] 3 [P] 4 [] P ( ) assum P assum assum mp mp conje impi P * 5

6 Negation: 21 More Elimination ules (V) elimination rule deduces any formula in the presence of both P and P P P note Isabelle:[?P;?P ]? (note) In Isabelle, there are many useful proved theorems about negation that can be used in proofs Proof by contradiction often uses theorems involving contrapositives such as: P and P [ P] Example theorem: P Isabelle: [? ;?P? ]?P Elimination ules for uantifiers Existential uantifier: x P x [P x 0 ] exe 23 Provided x 0 does not occur in P x or or any other premises other than P x 0 on which derivation of from P x depends 0 - In Isabelle: [ x?p x ; x?p x? ]? This proviso is part of the rule definition and cannot be omitted (exe) This is (once again) universal quantification in the Isabelle meta-logic (cf alli) It ensures that the proviso is enforced 22 Elimination ules for uantifiers Summary 24 Universal Elimination: x Px Pt Isabelle: ( x?p x )?P?x spec Note: In Isabelle terminology, this is a destruction rule Can provide an alternative non-destructive rule [P x] x P x alle Isabelle: unknown variable can be freely instantiated to any term [ x?p x ;?P?x ] (alle) A first look at theorem proving in Isabelle/HOL Natural Deduction - introduction and elimination rules in Isabelle - some rules have provisos Proofs can be given as a tree for natural deduction ead Chapter 5 of tutorial on Isabelle/HOL - available via A web page More to come 6