NICTA Advanced Course. Theorem Proving Principles, Techniques, Applications. Gerwin Klein Formal Methods

Transcription

1 NICTA Advanced Course Theorem Proving Principles, Techniques, Applications Gerwin Klein Formal Methods 1

2 ORGANISATORIALS When Mon 14:00 15:30 Wed 10:30 12:00 7 weeks ends Mon, Exceptions Mon 6.9., 13.9., at 15:00 16:30 Web page: kleing/teaching/thprv-04/ free no credits no assigments ORGANISATORIALS 2

3 WHAT YOU WILL LEARN how to use a theorem prover WHAT YOU WILL LEARN 3

4 WHAT YOU WILL LEARN how to use a theorem prover background, how it works WHAT YOU WILL LEARN 3-A

5 WHAT YOU WILL LEARN how to use a theorem prover background, how it works how to prove and specify WHAT YOU WILL LEARN 3-B

6 WHAT YOU WILL LEARN how to use a theorem prover background, how it works how to prove and specify Health Warning Theorem Proving is addictive WHAT YOU WILL LEARN 3-C

7 WHAT YOU WILL NOT LEARN semantics / model theory WHAT YOU WILL NOT LEARN 4

8 WHAT YOU WILL NOT LEARN semantics / model theory soundness / completeness proofs WHAT YOU WILL NOT LEARN 4-A

9 WHAT YOU WILL NOT LEARN semantics / model theory soundness / completeness proofs decision procedures WHAT YOU WILL NOT LEARN 4-B

10 CONTENT Intro & motivation, getting started with Isabelle (today) CONTENT 5

11 CONTENT Intro & motivation, getting started with Isabelle (today) Foundations & Principles Lambda Calculus Higher Order Logic, natural deduction Term rewriting CONTENT 5-A

12 CONTENT Intro & motivation, getting started with Isabelle (today) Foundations & Principles Lambda Calculus Higher Order Logic, natural deduction Term rewriting Proof & Specification Techniques Datatypes, recursion, induction Inductively defined sets, rule induction Calculational reasoning, mathematics style proofs Hoare logic, proofs about programs CONTENT 5-B

13 CREDITS material (in part) shamelessly stolen from Tobias Nipkow, Larry Paulson, Markus Wenzel David Basin, Burkhardt Wolff Don t blame them, errors are mine CREDITS 6

14 WHAT IS A PROOF? to prove WHAT IS A PROOF? 7

15 WHAT IS A PROOF? to prove (Marriam-Webster) from Latin probare (test, approve, prove) WHAT IS A PROOF? 7-A

16 WHAT IS A PROOF? to prove (Marriam-Webster) from Latin probare (test, approve, prove) to learn or find out by experience (archaic) WHAT IS A PROOF? 7-B

17 WHAT IS A PROOF? to prove (Marriam-Webster) from Latin probare (test, approve, prove) to learn or find out by experience (archaic) to establish the existence, truth, or validity of (by evidence or logic) prove a theorem, the charges were never proved in court WHAT IS A PROOF? 7-C

18 WHAT IS A PROOF? to prove (Marriam-Webster) from Latin probare (test, approve, prove) to learn or find out by experience (archaic) to establish the existence, truth, or validity of (by evidence or logic) prove a theorem, the charges were never proved in court pops up everywhere politics (weapons of mass destruction) courts (beyond reasonable doubt) religion (god exists) science (cold fusion works) WHAT IS A PROOF? 7-D

19 WHAT IS A MATHEMATICAL PROOF? In mathematics, a proof is a demonstration that, given certain axioms, some statement of interest is necessarily true. (Wikipedia) Example: 2 is not rational. Proof: WHAT IS A MATHEMATICAL PROOF? 8

20 WHAT IS A MATHEMATICAL PROOF? In mathematics, a proof is a demonstration that, given certain axioms, some statement of interest is necessarily true. (Wikipedia) Example: 2 is not rational. Proof: assume there is r Q such that r 2 = 2. Hence there are mutually prime p and q with r = p q. Thus 2q 2 = p 2, i.e. p 2 is divisible by 2. 2 is prime, hence it also divides p, i.e. p = 2s. Substituting this into 2q 2 = p 2 and dividing by 2 gives q 2 = 2s 2. Hence, q is also divisible by 2. Contradiction. Qed. WHAT IS A MATHEMATICAL PROOF? 8-A

21 NICE, BUT.. still not rigorous enough for some what are the rules? what are the axioms? how big can the steps be? what is obvious or trivial? informal language, easy to get wrong easy to miss something, easy to cheat NICE, BUT.. 9

22 NICE, BUT.. still not rigorous enough for some what are the rules? what are the axioms? how big can the steps be? what is obvious or trivial? informal language, easy to get wrong easy to miss something, easy to cheat Theorem. A cat has nine tails. Proof. No cat has eight tails. Since one cat has one more tail than no cat, it must have nine tails. NICE, BUT.. 9-A

23 WHAT IS A FORMAL PROOF? A derivation in a formal calculus WHAT IS A FORMAL PROOF? 10

24 WHAT IS A FORMAL PROOF? A derivation in a formal calculus Example: A B B A derivable in the following system Rules: X S S X (assumption) S X S Y S X Y (conji) S {X} Y S X Y (impi) S {X, Y } Z S {X Y } Z (conje) WHAT IS A FORMAL PROOF? 10-A

25 WHAT IS A FORMAL PROOF? A derivation in a formal calculus Example: A B B A derivable in the following system Rules: Proof: X S S X (assumption) S X S Y S X Y (conji) S {X} Y S X Y (impi) S {X, Y } Z S {X Y } Z (conje) 1. {A, B} B (by assumption) 2. {A, B} A (by assumption) 3. {A, B} B A (by conji with 1 and 2) 4. {A B} B A (by conje with 3) 5. {} A B B A (by impi with 4) WHAT IS A FORMAL PROOF? 10-B

26 WHAT IS A THEOREM PROVER? Implementation of a formal logic on a computer. fully automated (propositional logic) automated, but not necessarily terminating (first order logic) with automation, but mainly interactive (higher order logic) WHAT IS A THEOREM PROVER? 11

27 WHAT IS A THEOREM PROVER? Implementation of a formal logic on a computer. fully automated (propositional logic) automated, but not necessarily terminating (first order logic) with automation, but mainly interactive (higher order logic) based on rules and axioms can deliver proofs WHAT IS A THEOREM PROVER? 11-A

28 WHAT IS A THEOREM PROVER? Implementation of a formal logic on a computer. fully automated (propositional logic) automated, but not necessarily terminating (first order logic) with automation, but mainly interactive (higher order logic) based on rules and axioms can deliver proofs There are other (algorithmic) verification tools: model checking, static analysis,... usually do not deliver proofs WHAT IS A THEOREM PROVER? 11-B

29 WHY THEOREM PROVING? Analysing systems/programs thoroughly WHY THEOREM PROVING? 12

30 WHY THEOREM PROVING? Analysing systems/programs thoroughly Finding design and specification errors early WHY THEOREM PROVING? 12-A

31 WHY THEOREM PROVING? Analysing systems/programs thoroughly Finding design and specification errors early High assurance (mathematical, machine checked proof) WHY THEOREM PROVING? 12-B

32 WHY THEOREM PROVING? Analysing systems/programs thoroughly Finding design and specification errors early High assurance (mathematical, machine checked proof) it s not always easy it s fun WHY THEOREM PROVING? 12-C

33 Main theorem proving system for this course: = Isabelle λ β α 13

34 WHAT IS ISABELLE? A generic interactive proof assistant WHAT IS ISABELLE? 14

35 WHAT IS ISABELLE? A generic interactive proof assistant generic: not specialised to one particular logic (two large developments: HOL and ZF, will mainly use HOL) WHAT IS ISABELLE? 14-A

36 WHAT IS ISABELLE? A generic interactive proof assistant generic: not specialised to one particular logic (two large developments: HOL and ZF, will mainly use HOL) interactive: more than just yes/no, you can interactively guide the system WHAT IS ISABELLE? 14-B

37 WHAT IS ISABELLE? A generic interactive proof assistant generic: not specialised to one particular logic (two large developments: HOL and ZF, will mainly use HOL) interactive: more than just yes/no, you can interactively guide the system proof assistant: helps to explore, find, and maintain proofs WHAT IS ISABELLE? 14-C

38 WHY ISABELLE? free widely used system active development high expressiveness and automation reasonably easy to use WHY ISABELLE? 15

39 WHY ISABELLE? free widely used system active development high expressiveness and automation reasonably easy to use (and because I know it best ;-)) WHY ISABELLE? 15-A

40 WHY ISABELLE? free widely used system active development high expressiveness and automation reasonably easy to use (and because I know it best ;-)) We will see other systems, too: HOL4, Coq, Waldmeister WHY ISABELLE? 15-B

41 If I prove it on the computer, it is correct, right? 16

42 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? No, because: IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 17

43 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? No, because: ➀ hardware could be faulty IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 17-A

44 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? No, because: ➀ hardware could be faulty ➁ operating system could be faulty IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 17-B

45 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? No, because: ➀ hardware could be faulty ➁ operating system could be faulty ➂ implementation runtime system could be faulty IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 17-C

46 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? No, because: ➀ hardware could be faulty ➁ operating system could be faulty ➂ implementation runtime system could be faulty ➃ compiler could be faulty IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 17-D

47 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? No, because: ➀ hardware could be faulty ➁ operating system could be faulty ➂ implementation runtime system could be faulty ➃ compiler could be faulty ➄ implementation could be faulty IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 17-E

48 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? No, because: ➀ hardware could be faulty ➁ operating system could be faulty ➂ implementation runtime system could be faulty ➃ compiler could be faulty ➄ implementation could be faulty ➅ logic could be inconsistent IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 17-F

49 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? No, because: ➀ hardware could be faulty ➁ operating system could be faulty ➂ implementation runtime system could be faulty ➃ compiler could be faulty ➄ implementation could be faulty ➅ logic could be inconsistent ➆ theorem could mean something else IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 17-G

50 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? No, but: IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 18

51 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? No, but: probability for 1 and 2 reduced by using different systems IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 18-A

52 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? No, but: probability for 1 and 2 reduced by using different systems 3 and 4 reduced by using different compilers IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 18-B

53 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? No, but: probability for 1 and 2 reduced by using different systems 3 and 4 reduced by using different compilers faulty implementation reduced by right architecture IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 18-C

54 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? No, but: probability for 1 and 2 reduced by using different systems 3 and 4 reduced by using different compilers faulty implementation reduced by right architecture inconsistent logic reduced by implementing and analysing it IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 18-D

55 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? No, but: probability for 1 and 2 reduced by using different systems 3 and 4 reduced by using different compilers faulty implementation reduced by right architecture inconsistent logic reduced by implementing and analysing it wrong theorem reduced by expressive/intuitive logics IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 18-E

56 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? No, but: probability for 1 and 2 reduced by using different systems 3 and 4 reduced by using different compilers faulty implementation reduced by right architecture inconsistent logic reduced by implementing and analysing it wrong theorem reduced by expressive/intuitive logics No guarantees, but assurance way higher than manual proof IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 18-F

57 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? Soundness architectures careful implementation PVS IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 19

58 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? Soundness architectures careful implementation LCF approach, small proof kernel PVS HOL4 Isabelle IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 19-A

59 IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? Soundness architectures careful implementation LCF approach, small proof kernel explicit proofs + proof checker PVS HOL4 Isabelle Coq Twelf Isabelle IF I PROVE IT ON THE COMPUTER, IT IS CORRECT, RIGHT? 19-B

60 META LOGIC Meta language: The language used to talk about another language. META LOGIC 20

61 META LOGIC Meta language: The language used to talk about another language. Examples: English in a Spanish class, English in an English class META LOGIC 20-A

62 META LOGIC Meta language: The language used to talk about another language. Examples: English in a Spanish class, English in an English class Meta logic: The logic used to formalize another logic Example: Mathematics used to formalize derivations in formal logic META LOGIC 20-B

63 META LOGIC EXAMPLE Syntax: Formulae: F ::= V F F F F F alse V ::= [A Z] Derivable: S X X a formula, S a set of formulae META LOGIC EXAMPLE 21

64 META LOGIC EXAMPLE Syntax: Formulae: F ::= V F F F F F alse V ::= [A Z] Derivable: S X X a formula, S a set of formulae logic / meta logic X S S X S X S Y S X Y S {X} Y S X Y S {X, Y } Z S {X Y } Z META LOGIC EXAMPLE 21-A

65 ISABELLE S META LOGIC = λ ISABELLE S META LOGIC 22

66 Syntax: in ASCII: x. F!!x. F (F another meta level formula) 23

67 Syntax: in ASCII: x. F!!x. F (F another meta level formula) universial quantifier on the meta level used to denote parameters example and more later 23-A

68 = Syntax: A = B (A, B other meta level formulae) in ASCII: A ==> B = 24

69 = Syntax: A = B (A, B other meta level formulae) in ASCII: A ==> B Binds to the right: A = B = C = A = (B = C) Abbreviation: [A; B ] = C = A = B = C read: A and B implies C used to write down rules, theorems, and proof states = 24-A

70 EXAMPLE: A THEOREM mathematics: if x < 0 and y < 0, then x + y < 0 EXAMPLE: A THEOREM 25

71 EXAMPLE: A THEOREM mathematics: if x < 0 and y < 0, then x + y < 0 formal logic: x < 0 y < 0 x + y < 0 variation: x < 0; y < 0 x + y < 0 EXAMPLE: A THEOREM 25-A

72 EXAMPLE: A THEOREM mathematics: if x < 0 and y < 0, then x + y < 0 formal logic: x < 0 y < 0 x + y < 0 variation: x < 0; y < 0 x + y < 0 Isabelle: lemma x < 0 y < 0 x + y < 0 variation: lemma [x < 0; y < 0] = x + y < 0 EXAMPLE: A THEOREM 25-B

73 EXAMPLE: A THEOREM mathematics: if x < 0 and y < 0, then x + y < 0 formal logic: x < 0 y < 0 x + y < 0 variation: x < 0; y < 0 x + y < 0 Isabelle: lemma x < 0 y < 0 x + y < 0 variation: lemma [x < 0; y < 0] = x + y < 0 variation: lemma assumes x < 0 and y < 0 shows x + y < 0 EXAMPLE: A THEOREM 25-C

74 EXAMPLE: A RULE logic: X Y X Y EXAMPLE: A RULE 26

75 EXAMPLE: A RULE logic: X Y X Y variation: S X S Y S X Y EXAMPLE: A RULE 26-A

76 EXAMPLE: A RULE logic: X Y X Y variation: S X S Y S X Y Isabelle: [X; Y ] = X Y EXAMPLE: A RULE 26-B

77 EXAMPLE: A RULE WITH NESTED IMPLICATION X... logic: X Y Z Z Ỵ.. Z EXAMPLE: A RULE WITH NESTED IMPLICATION 27

78 EXAMPLE: A RULE WITH NESTED IMPLICATION X... logic: X Y Z Z Ỵ.. Z variation: S {X} Z S {Y } Z S {X Y } Z EXAMPLE: A RULE WITH NESTED IMPLICATION 27-A

79 EXAMPLE: A RULE WITH NESTED IMPLICATION X... logic: X Y Z Z Ỵ.. Z variation: S {X} Z S {Y } Z S {X Y } Z Isabelle: [X Y ; X = Z; Y = Z ] = Z EXAMPLE: A RULE WITH NESTED IMPLICATION 27-B

80 λ Syntax: λx. F (F another meta level formula) in ASCII: %x. F λ 28

81 λ Syntax: λx. F (F another meta level formula) in ASCII: %x. F lambda abstraction used to for functions in object logics used to encode bound variables in object logics more about this in the next lecture λ 28-A

82 ENOUGH THEORY! GETTING STARTED WITH ISABELLE 29

83 SYSTEM ARCHITECTURE Isabelle generic, interactive theorem prover SYSTEM ARCHITECTURE 30

84 SYSTEM ARCHITECTURE Isabelle generic, interactive theorem prover Standard ML logic implemented as ADT SYSTEM ARCHITECTURE 30-A

85 SYSTEM ARCHITECTURE HOL, ZF object-logics Isabelle generic, interactive theorem prover Standard ML logic implemented as ADT SYSTEM ARCHITECTURE 30-B

86 SYSTEM ARCHITECTURE Proof General user interface HOL, ZF object-logics Isabelle generic, interactive theorem prover Standard ML logic implemented as ADT SYSTEM ARCHITECTURE 30-C

87 SYSTEM ARCHITECTURE Proof General user interface HOL, ZF object-logics Isabelle generic, interactive theorem prover Standard ML logic implemented as ADT User can access all layers! SYSTEM ARCHITECTURE 30-D

88 SYSTEM REQUIREMENTS Linux, MacOS X or Solaris Standard ML (PolyML fastest, SML/NJ supports more platforms) XEmacs or Emacs (for ProofGeneral) If you do not have Linux, MacOS X or Solaris, try IsaMorph: SYSTEM REQUIREMENTS 31

89 DOCUMENTATION Available from Learning Isabelle Tutorial on Isabelle/HOL (LNCS 2283) Tutorial on Isar Tutorial on Locales Reference Manuals Isabelle/Isar Reference Manual Isabelle Reference Manual Isabelle System Manual Reference Manuals for Object-Logics DOCUMENTATION 32

90 PROOFGENERAL User interface for Isabelle Runs under XEmacs or Emacs Isabelle process in background Interaction via Basic editing in XEmacs (with highlighting etc) Buttons (tool bar) Key bindings ProofGeneral Menu (lots of options, try them) PROOFGENERAL 33

91 X-SYMBOL CHEAT SHEET Input of funny symbols in ProofGeneral via menu ( X-Symbol ) via ASCII encoding (similar to L A T E X): \<and>, \<or>,... via abbreviation: /\, \/, -->,... via rotate: l C-. = λ (cycles through variations of letter) λ ➀ \<forall> \<exists> \<lambda> \<not> /\ \/ --> => ➁ ALL EX % & ➀ converted to X-Symbol ➁ stays ASCII X-SYMBOL CHEAT SHEET 34

92 DEMO 35

93 EXERCISES Download and install Isabelle from or Switch on X-Symbol in ProofGeneral Step through the demo file from the lecture web page Write an own theory file, look at some theorems, try find theorem EXERCISES 36