First Order Predicate Logic

Transcription

1 Wolfgang Schreiner and Wolfgang Windsteiger 1/25 First Order Predicate Logic Formal Definitions and Specifications Wolfgang Schreiner and Wolfgang Windsteiger Wolfgang.(Schreiner Research Institute for Symbolic Computation (RISC) Johannes Kepler University (JKU), Linz, Austria

2 Wolfgang Schreiner and Wolfgang Windsteiger 2/25 Defining and Specifying Specifying problems and domains is a core activity of computer science. Goal: the adequate specification of a certain problem or type. A computation to be performed. A domain of values to be represented. Specification is to be expressed using the notions of some model. Given: a model, i.e., a collection of notions (functions/predicates). For example, the model set with the usual set operations. The interpretation of these notions is universally understood. Issue: the given model is not up to the task. Its notions are on a too low level of abstraction. The specification would become too cumbersome to write and too difficult to understand. We need a model that is on an appropriate level of abstraction.

3 Wolfgang Schreiner and Wolfgang Windsteiger 3/25 Refinement and Abstraction How to overcome the gap between the given model and the intended one? Top-down ( ): refinement. Start with the intended model. Reduce its notions to lower-level notions. Iterate, until the lowest level of the given notions is reached. Bottom-up ( ): abstraction. Start with the given model. Iteratively combine the given notions to higher-level notions. Iterate, until the highest level of the intended notions is reached. Bottom-up and top-down ( ): Combination of refinement and abstraction steps. Iterate, until the refined notions meet the abstracted ones. With the help of newly defined notions, problems and types may be adequately specified.

4 Wolfgang Schreiner and Wolfgang Windsteiger 4/25 Illustration Databases File Systems Text Files XML Documents Character Strings Floating Point Numbers Refinement Arrays Lists Trees Integers Abstraction Natural Numbers Functions Relations Products Sums Sets

5 Wolfgang Schreiner and Wolfgang Windsteiger 5/25 Some Standard Models Products: T 1... T n Let x1 T 1,...,x n T n,t T 1... T n. Tuple construction: (x1,...,x n ) T 1... T n. Element selection: t.1 T1,...,t.n T n (or: t 1 T 1,...,t n T n ). Functions: T 1... T n T Let x1 T 1,...,x n T n,f T 1... T n T. Function definition: see later. Function application: f (x1,...,x n ) T. domain(f ) = T1... T n, range(f ) T. Relations/Predicates: P(T 1... T n ) P(T ) : the powerset (the set of all subsets) of T. Let x1 T 1,...,x n T n,p P(T 1... T n ) (p T 1... T n ). Predicate definition: see later. Predicate application: p(x1,...,x n ) denotes a truth value. domain(p) = T1... T n. Can be reduced to set-theoretic notions.

6 Wolfgang Schreiner and Wolfgang Windsteiger 6/25 Some Standard Models Infinite Sequences: T ω = N T Let s T ω,i N. Element access s(i) T (or: si T ). Sequences of Length n: T n = N n T Index domain: Nn = {i N i < n}. Let s T n,i N n. Element access: s(i) T (or: si T ). Finite Sequences: T = n N T n Let s T, i.e., s T n for some n N, let i N n. Sequence length: length(s) = n. Element access: s(i) T (or: si T ). Sequences (arrays, lists,... ) of arbitrary length can be modeled as functions over an index domain.

7 Wolfgang Schreiner and Wolfgang Windsteiger 7/25 Formal Definitions and Specifications Explicit Function Definitions. Explicit Predicate Definitions. Implicit Function Definitions. Proving with Definitions. Problem Specifications.

8 Explicit Function Definitions A new function my be introduced by describing its value. An explicit function definition consists of f : T 1... T n T f (x 1,...,x n ) := t a new n-ary function constant f, a type signature T1... T n T withs sets T 1,...,T n,t, a list of variables x1,...,x n (the parameters), and a term t (the body) whose free variables occur in x1,...,x n ; case n = 0: the definition of a value constant f : T,f := t. We have to show for the newly introduced function f and then know x 1 T 1,...,x n T n : t T x 1 T 1,...,x n T n : f (x 1,...,x n ) = t The body of an explicit function definition may only refer to previously defined functions (no recursion). Wolfgang Schreiner and Wolfgang Windsteiger 8/25

9 Wolfgang Schreiner and Wolfgang Windsteiger 9/25 Examples sqrtsum : N N R sqrtsum(x,y) := x + y sumsquared : N N N sumsquared(x,y) := let z = x + y in z 2 sqrtsumsquared : N N R sqrtsumsquared(x,y) := sqrtsum(x,y) 2 sqrtsumset : N P(R) sqrtsumset(n) := {sqrtsum(x,y) x,y N 1 x,y n}

10 Wolfgang Schreiner and Wolfgang Windsteiger 10/25 Explicit Predicate Definitions A new predicate my be introduced by describing its truth value. An explicit predicate definition consists of p T 1... T n p(x 1,...,x n ) : F a new n-ary predicate constant p, a type signature T1... T n with sets T 1,...,T n a list of variables x1,...,x n (the parameters), and a formula F (the body) whose free variables occur in x1,...,x n. case n = 0: definition of a truth value constant p : F. We then know for the newly introduced predicate p: x 1 T 1,...,x n T n : p(x 1,...,x n ) F The body of an explicit predicate definition may only refer to previously defined predicates (no recursion).

11 Wolfgang Schreiner and Wolfgang Windsteiger 11/25 Examples N N x y : z N : x z = y isprime N isprime(x) : x 2 y N : 1 < y y < x (y x) isprimefactor N N isprimefactor(p, n) : isprime(p) p n

12 Wolfgang Schreiner and Wolfgang Windsteiger 12/25 Definitions with Side Conditions A definition may occur in the context of a side condition. Let x 1 T 1,...,x n T n be such that c(x 1,...,x n ). We define f (x 1,...,x n ) := t p(x 1,...,x n ) : F We then know for the newly introduced function/predicate x 1 T 1,...,x n T n : c(x 1,...,x n ) f (x 1,...,x n ) = t x 1 T 1,...,x n T n : c(x 1,...,x n ) (p(x 1,...,x n ) F ) Applications of the function/predicate to arguments that violate the side condition are meaningless.

13 Implicit Function Definitions We may also introduce a new function by describing what condition its result must satisfy. An implicit function definition consists of f : T 1... T n T f (x 1,...,x n ) := such y : F a new n-ary function constant f, a type signature T1... T n T withs sets T 1,...,T n,t, a list of variables x1,...,x n (the parameters), a variable y (the result variable), a formula F (the result condition) whose free variables occur in x 1,...,x n,y. We then know for the newly introduced function f x 1 T 1,...,x n T n : ( y T : F ) ( y T : F y = f (x 1,...,x n )) If there is some value that satisfies the result condition, the function result is one such value (otherwise, it is undefined). Wolfgang Schreiner and Wolfgang Windsteiger 13/25

14 Wolfgang Schreiner and Wolfgang Windsteiger 14/25 Examples quotient : N N N // undefined for n=0, otherwise unique quotient(m,n) := such q : r N : m = n q + r r < n root : R R // defined for non-negative x, but not unique root(x) := such r : r 2 = x someprimefactor : N N // may be undefined; if defined, may not be unique someprimefactor(n) := such p : isprimefactor(p, n) maxprime : N N // may be undefined; if defined, it is unique maxprime(n) := such p : isprime(p) p n ( q N : isprime(q) q n q p) The result of an implicitly specified function is not necessarily uniquely defined (and may be also completely undefined).

15 Implicit Unique Function Definitions But sometimes the result is uniquely defined by an implicit definition. An implicit unique function definition f : T 1... T n T f (x 1,...,x n ) := the y : F consists of the same elements as an unique function definition. We have to prove that the function result is defined and unique x 1 T 1,...,x n T n : ( y T : F ) ( y 1 T,y 2 T : F [y 1 /y] F [y 2 /y] y 1 = y 2 ) from which we know for the newly introduced function f x 1 T 1,...,x n T n : ( y T : F y = f (x 1,...,x n )) ( y T : F y = f (x 1,...,x n )) The function result is the only value that satisfies the result condition. Wolfgang Schreiner and Wolfgang Windsteiger 15/25

16 Wolfgang Schreiner and Wolfgang Windsteiger 16/25 Examples quot : R 0 R >0 R 0 // defined and unique quot(a,b) := the q : a = b q posroot : R 0 R 0 // defined and unique posroot(x) := the r : r 2 = x r 0 minimum : P(N)\{/0} N // defined and unique minimum(s) := the m : m S m S : m m

17 Wolfgang Schreiner and Wolfgang Windsteiger 17/25 Predicates versus Functions A predicate gives also rise to functions. A predicate: isprimefactor N N isprimefactor(p, n) : isprime(p) p n An implicitly defined function: someprimefactor : N N someprimefactor(n) := such p : isprime(p) p n A function whose result is a set: allprimefactors : N P(N) allprimefactors(n) := {p N isprime(p) p n} The preferred style of definition is a matter of taste and purpose.

18 Informal Definitions Definition: A tomcat is a male cat. tomcat(x) : cat(x) male(x). Definition: Let x,y be positive integers. Then gcd(x,y) denotes the greatest positive integer that divides both x and y. gcd : Z >0 Z >0 Z >0 gcd(x,y) := the z : z x z y z Z >0 : z x z y z z Definition: A prime factorization of n > 1 is a product p e 1 1 pe l l = n with primes p 1 <... < p l and exponents e i > 0. isprimefactorization N (N N) isprimefactorization(n, p) : let l = length(p) in l 1 n = (p(i).1) (p(i).2) i=0 ( i N l : prime(p(i).1)) ( i N l 1 : p(i).1 < p(i + 1).1) It is important to recognize the formal content of informal definitions. Wolfgang Schreiner and Wolfgang Windsteiger 18/25

19 Wolfgang Schreiner and Wolfgang Windsteiger 19/25 Proving with Definitions Given definitions f : A B, f (x) :=... p A, p(x) : we wish to prove some goal G which involves f,p,... We extract the knowledge provided by the definitions: x A : f (x) =... (K 1 ) x A : p(x)... (K 2 )... We prove (K 1 ),(K 2 ),... G The proof is performed with the knowledge provided by the definitions.

20 Wolfgang Schreiner and Wolfgang Windsteiger 20/25 Example If a divides b then it also divides every multiple of b. Definition: a divides b : t N : b = t a Knowledge (K): a N,b N : a divides b t N : b = t a P- : ValidAssum: P- : P- : P- : G-Def: A-Def: A-, A- : A-=: P- : (K) a,b,s N : a divides b a divides s b (K) ā, b, s N (ā divides b ā divides s b) (K),ā, b, s N ā divides b ā divides s b (K),ā, b, s N,ā divides b ā divides s b (K),ā, b, s N,ā divides b t N : s b = t ā (K),ā, b, s N, t N : b = t ā t N : s b = t ā (K),ā, b, s, t N, b = t ā t N : s b = t ā (K),ā, b, s, t N, b = t ā t N : s t ā = t ā (K),ā, b, s, t N, b = t ā s t N s t ā = s t ā (K),..., s, t N s t N GoalAssum: P-=: (K),... s t ā = s t ā

21 Wolfgang Schreiner and Wolfgang Windsteiger 21/25 Example: Explanation Derivation of G-Def: A- : A- : AnyAssum: (K),ā, b, s N,ā divides b ā divides s b (K),ā, b, s N,ā divides b,ā divides s b t N : s b = t ā ā divides s b (K),ā, b, s N,ā divides b,ā divides s b t N : s b = t ā t N : s b = t ā (K),ā, b, s N,ā divides b t N : s b = t ā Analogous derivation of A-Def. Definitions can be expanded in goal and knowledge.

22 Wolfgang Schreiner and Wolfgang Windsteiger 22/25 Specifying Problems An important role of logic in computer science is to specify problems. The specification of a (computational) problem consists of Input: x 1 T 1,...,x n T n where I Output: y 1 U 1,...,y m U m where O a list of input variables x1,...,x n with types T 1,...,T n, a formula I (the input condition) whose free variables occur in x 1,...,x n, a list of output variables y1,...,y m with types U 1,...,U m, and a formula O (the output condition) whose free variables occur in x 1,...,x n,y 1,...,y m. The specification is expressed with the help of functions and predicates that have been previously defined to describe the problem domain.

23 Wolfgang Schreiner and Wolfgang Windsteiger 23/25 Example Extract from a finite sequence s of natural numbers a subsequence of length n starting at position p. p n s t Input: s N,n N,p N where n + p length(s) Output: t N where length(t) = n i N n : t(i) = s(i + p) The resulting sequence must have appropriate length and content.

24 Implementing Problem Specifications The ultimate goal of computer science is to implement specifications. The specifications demands the definition of a function f : T 1... T n U 1... U m such that x 1 T 1,...,x n T n : I let (y 1,...,y m ) = f (x 1,...,x n ) in O For all arguments x1,...,x n that satisfy the input condition, the result (y1,...,y m ) of f satisfies the output condition. The specification itself already implicitly defines such a function: f (x 1,...,x n ) := such y 1,...,y m : I O However, the specification is actually implemented only by an explicitly defined function (computer program). The correctness of the implementation with respect to the specification has to be verified (e.g. by a formal proof). Our goal is to adequately specify informal problems, to implement formal specifications, and to verify the correctness of the implementations. Wolfgang Schreiner and Wolfgang Windsteiger 24/25

25 Wolfgang Schreiner and Wolfgang Windsteiger 25/25 The Java Modeling Language (JML) A language for specifying the contracts of Java functions. /*@ requires s!= null && 0 <= p && 0 <= n && p+n <= ensures \result!= null && \result.length == n (\forall int i; 0 <= i && i < \result[i] == /*@ static int[] subarray(int[] s, int p, int n) { int[] t = new int[n]; for (int i=0; i<n; i++) t[i] = s[i+p]; return t; } The Java function implements the specified contract.