On the Mechanisation of the Logic of Partial Functions

Transcription

1 School of Computing Scinc On th Mchanisation of th Logic of Partial Functions Thsis by Matthw Jams Lovrt In partial fulfillmnt of th rquirmnts for th Dgr of Doctor of Philosophy. July 2013

2 Abstract It is wll known that partial functions aris frquntly in formal rasoning about programs. A partial function may not yild a valu for vry mmbr of its domain. Trms that apply partial functions thus may not dnot, and coping with such trms is problmatic in two-valud classical logic. A qustion is raisd: how can rasoning about logical formula that can contain rfrncs to trms that may fail to dnot (partial trms) b conductd formally? Ovr th yars a numbr of approachs to coping with partial trms hav bn documntd. Som of ths approachs attmpt to stay within th ralm of two-valud classical logic, whil othrs ar basd on non-classical logics. Howvr, as yt thr is no consnsus on which approach is th bst on to us. A comparison of numrous approachs to coping with partial trms is prsntd basd upon formal smantic dfinitions. On approach to coping with partial trms that has rcivd attntion ovr th yars is th Logic of Partial Functions (LPF), which is th logic undrlying th Vinna Dvlopmnt Mthod. LPF is a non-classical thr-valud logic dsignd to cop with partial trms, whr both trms and propositions may fail to dnot. As opposd to using concrt undfind valus, undfindnss is tratd as a gap, that is, th absnc of a dfind valu. LPF is basd upon Strong Kln logic, whr th intrprtations of th logical oprators ar xtndd to cop with truth valu gaps. Ovr th yars a larg body of rsarch and nginring has gon into th dvlopmnt of proof basd tool support for two-valud classical logic. This has cratd a major obstacl that affcts th adoption of LPF, sinc such proof support cannot b carrid ovr dirctly to LPF. Prsntly, thr is a lack of dirct proof support for LPF. An aim of this work is to invstigat th applicability of mchanisd (automatd) proof support for rasoning about logical formula that can contain rfrncs to partial trms in LPF. Th focus of th invstigation is on th basic but fundamntal two-valud classical logic proof procdur: rsolution and th associatd tchniqu proof by contradiction. Advancd proof tchniqus ar built on th foundation that is providd by ths basic fundamntal proof tchniqus. Looking at th impact of ths basic fundamntal proof tchniqus in LPF is thus th ssntial and obvious starting point for invstigating proof support for LPF. Th work highlights th issus that aris whn applying ths basic tchniqus in LPF, and invstigats th xtnt of th modifications

3 ii ndd to carry thm ovr to LPF. This work provids th ssntial foundation on which to facilitat rsarch into th modification of advancd proof tchniqus for LPF.

4 Acknowldgmnts I would lik to thank both of my suprvisors Cliff Jons and Jason Stggls for thir advic and support throughout. I would lik to thank Lo Fritas and Andrius Vlykis for discussions that took plac. I would also lik to thank Gudmund Grov for hlping m to gt startd with using Isabll. Additionally, I also want to thank th numrous anonymous rfrs of paprs that hav bn submittd on som of this work for thir commnts. This work was supportd by an EPSRC Studntship.

5 Publications Som parts of this thsis hav alrady bn publishd: Som of th contnt on smantic dfinitions prsntd in Sctions 3.1, 3.2, and is prsntd in [Lov10], but has bn xtndd for this thsis. Som of th contnt on smantic dfinitions prsntd in Sctions (similar to th contnt in [Lov10]) and 3.4 is prsntd in [JL11]. Th contnt has again bn thoroughly xtndd and modifid in this thsis. This papr also prsnts proofs about a partial prdicat don by Cliff Jons which forms no part of this thsis. A prliminary draft of a small subst of Sction 4.1 appard in [JLS12b]. Such smantic dfinitions hav bn ovrhauld with significant modifications and xtnsions in this thsis. Numrous othr smantic dfinitions alongsid comparisons on th smantic dfinitions ar prsntd in this thsis. Som of th rsults from Chaptr 6 ar publishd in [JLS12a]. Th work has bn xtndd for this thsis. Ths paprs ar rfrncd and discussd furthr in th rlvant chaptrs of this thsis.

6 Contnts 1 Introduction Stting th Scn Mathmatical Logic Formal Mthods Proofs Th Issus that Aris Whn Rasoning About Partial Functions Aims Contributions Structur of th Thsis Background Catgorising th Diffrnt Approachs to Coping with Partial Trms Approachs to Coping with Partial Trms Rformulating Exprssions and Function Dfinitions Classical Approachs Smi-Classical Approachs Non-Classical Logic Approachs Squnt Intrprtations Summary of th Justifications for LPF Prvious Attmpts at Mchanisation Support for LPF Th VDM Toolst and th Ovrtur Toolst mural Utilising Existing Thorm Provrs Conclusions Smantic Dfinitions for LPF Exprssion Constructs Contxt Conditions Oprational Smantics Big-Stp Structural Oprational Smantics Dfinition Small-Stp Structural Oprational Smantics Dfinition Dnotational Smantics Rlationships btwn th Smantic Dfinitions

7 CONTENTS vi 3.6 Conclusions Comparison of Approachs to Coping with Partial Trms Altrnativ Smantic Dfinitions Rlations Forcing all Trms to Dnot Smi-Classical Approachs Wak Kln Logic McCarthy s Conditional Oprators Lukasiwicz s Logic Bochvar s Extrnal Logic Concluding Rmarks Comparing th Squnt Intrprtations SS SW WW WS Comparisons btwn th Diffrnt Approachs to Coping with Partial Trms Comparison 1: Th Valus Dnotd in th Diffrnt Approachs Comparison 2: Non-classical Logic Comparisons Rlationships btwn th Diffrnt Approachs to Coping with Partial Trms and LPF Rlationship with Two-Valud Classical Logic using Ovrspcification Rlationship with th Wll-Dfindnss Approach Rlationship with Two-Valud Classical Logic using Strong Equality Rlationship with th Wak Kln Approach Rlationship with th McCarthy Conditional Oprator Approach Rlationship with Lukasiwicz s Approach Rlationship with Bochvar s Extrnal Approach Concluding Rmarks Conclusions Mchanising LPF Smantic Dfinitions Maud Mchanisation An Introduction to Maud

8 CONTENTS vii Mchanising th SOS Dfinitions Isabll Mchanisation Conclusions Invstigating Proof Procdurs in LPF Validity and Satisfiability Two-Valud Classical Logic Rcap LPF Th Mthod of Truth Tabls Clausal Form Two-Valud Classical Logic Rcap LPF Unification Rsolution Two-Valud Classical Logic Rcap LPF Rfutation Procdurs Two-Valud Classical Logic Rcap LPF Conclusions Concluding Rmarks Summary and Conclusions Futur Work Furthr Comparison Rsults Furthr Prformanc Rsults Implmnting th Proof Tchniqus Considrd Invstigating th Applicability of Furthr Proof Tchniqus for LPF Bibliography 231 A Full LPF Smantic Dfinitions 240 A.1 Abstract Syntax A.1.1 Exprssion Constructs A.1.2 Syntactic Dfinitions A.1.3 Function Dfinitions and Prdicat Dfinitions A.2 Contxt Conditions A.2.1 Typ Map A.2.2 Exprssions

9 CONTENTS viii A.2.3 Function Dfinitions and Prdicat Dfinitions A.3 Structural Oprational Smantics A.3.1 Smantic Objct A.3.2 Big-Stp Structural Oprational Smantics Dfinition A.3.3 Small-Stp Structural Oprational Smantics Dfinition. 249 A.4 Dnotational Smantics A.4.1 Exprssions A.4.2 Contxt Conditions A.4.3 Smantic Objct A.4.4 Dnotational Smantic Dfinition A.4.5 Dnotational Smantic Dfinition B Slctd Mathmatical VDM-SL Notation 259 B.1 Typ Dfinitions B.1.1 Rcord Typ B.1.2 Th Boolan Data Typ B.1.3 Th Numric Data Typs B.1.4 Th St Typ B.1.5 Th Squnc Typ B.1.6 Th Map Typ B.1.7 Th Union Typ B.1.8 Pairs B.2 Exprssions B.2.1 Quantifid Exprssions B.2.2 Th Conditional Exprssion B.2.3 Th Cass Exprssion B.2.4 Th Lt Exprssion B.3 Function Dfinitions B.4 Infrnc Ruls B.5 Proofs C Glossary 266

10 List of Figurs 2.1 Th truth tabl for wak quality Th truth tabl for xistntial quality Th truth tabl for strong quality Th wak Kln truth tabls for disjunction, conjunction, implication and ngation Th McCarthy truth tabls for disjunction, conjunction, implication and ngation An ordring on truth valus Th LPF truth tabls for disjunction, conjunction, implication and ngation Th LPF truth tabl for th dfindnss oprators Th Lukasiwicz truth tabls for disjunction, conjunction, implication and ngation Th Bochvar xtrnal truth tabls for disjunction, conjunction, implication and ngation Th Bochvar xtrnal truth tabls for th assrtion oprator and for th dnial oprator A proof of a zro function proprty A proof of a zro function proprty Th xprssion contxt conditions (part 1) Th xprssion contxt conditions (part 2) Th function dfinitions contxt conditions Th prdicat dfinitions contxt conditions A sampl small-stp SOS xprssion valuation A sampl small-stp SOS gap xprssion valuation A furthr sampl small-stp SOS xprssion valuation Th E smantic function dfinition Th E R smantic function dfinition Th E C smantic function dfinition Th E D smantic function dfinition Th E smantic function dfinition (part 1) Th E smantic function dfinition (part 2) Th E == smantic function dfinition (part 1)

11 LIST OF FIGURES x 4.7 Th E == smantic function dfinition (part 1) Th E W smantic function dfinition Th E M smantic function dfinition Th E L smantic function dfinition (part 1) Th E L smantic function dfinition (part 2) Th E B smantic function dfinition (part 1) Th E B smantic function dfinition (part 2) Th xprssions usd for th SOS rwrit rul comparison An illustrativ rsolution rfutation attmpt An illustrativ rsolution rfutation subproof (part 1) An illustrativ rsolution rfutation proof stablishing dfindnss (part 2) An illustrativ (optimisd) rsolution rfutation proof stablishing dfindnss An illustrativ rsolution rfutation proof stablishing dfindnss An illustrativ rsolution rfutation proof whr dfindnss obligations do not nd introducing

12 List of Tabls 4.1 An outlin of th changs mad to th LPF smantic function dfinition to dfin th othr smantic function dfinitions A comparison of numrous approachs to coping with partial trms A comparison of thr-valud logic approachs to coping with partial trms A numbr of rwrit comparisons btwn th big-stp Structural Oprational Smantic and th small-stp Structural Oprational Smantic dfinitions

13 Chaptr 1 Introduction Contnts 1.1 Stting th Scn Mathmatical Logic Formal Mthods Proofs Th Issus that Aris Whn Rasoning About Partial Functions Aims Contributions Structur of th Thsis An aim of this thsis is to invstigat th applicability of mchanisd proof support for rasoning in th Logic of Partial Functions about logical formula that can contain rfrncs to trms that may fail to dnot propr valus (partial trms), for instanc, arising from th application of partial functions. In this chaptr th scn is first st by brifly introducing som rlvant background information, as wll as highlighting th issus that aris whn rasoning about partial functions, which provids th motivation for this work. Th aims of this thsis ar thn discussd, which is followd by an ovrviw of how thy will b addrssd ovr th cours of this thsis. 1.1 Stting th Scn In this sction th scn is st by brifly introducing th topics of mathmatical logic, formal mthods, and proofs. Thn th issus that aris whn facd with rasoning about partial functions ar introducd, which provids th motivation for th aims of this thsis Mathmatical Logic Th study of logic was bgun by th ancint Grks... whr it was usd to formaliz dduction: th drivation of tru statmnts from statmnts that ar assumd to b tru [BA01]. At a latr dat mathmaticians startd

14 Introduction 2 using logic to study th foundations of mathmatics [BA01]. Mathmatical logic is usd xtnsivly today in computr scinc. A dtaild history of mathmatical logic is not prsntd hr as th radr can rfr to othr txts, such as [BA01, Bun10, Wal97]. In propositional logic, formula ar built up from th constant truth valus tru and fals, and from propositional variabls. Ths can b combind using logical oprators (connctivs) which ar givn a prcis formal maning [BA01]. Formula ar traditionally two-valud, that is, thy tak on of two truth valus ithr tru or fals. First-ordr (prdicat) logic xtnds from propositional logic. In first-ordr logic formula can also b built up from non-propositional variabls and constants using functions and prdicats, and non-propositional variabls can b quantifid [Har09]. This provids a logic which is much mor xprssiv than propositional logic Formal Mthods Softwar is bcoming mor complx, which mans that thr is a gratr chanc of rrors bing prsnt. Furthrmor, softwar is incrasingly bing usd in situations whr th failur of th softwar can put livs at risk, for xampl, in onboard aircraft systms and in mdical systms. Th failur of softwar can also lad to hug financial ramifications tc. Thus it is of no big surpris that softwar corrctnss is an important rsarch topic in computr scinc. Formal mthods ar an approach to incrasing confidnc in computr systms. Formal mthods ar mathmatical tchniqus usd in th dvlopmnt of computr systms [WLBF09], for spcifying and vrifying systms [CW96]. Th us of formal mthods is warrantd by th xpctation that mathmatical analysis can contribut to th rliability and to th robustnss of a dsign [Hol97]. Th complxity of such mathmatical proofs, and th tim that it can tak to discharg such proofs lads to limiting th xtnt to which formal mthods ar applid in practic [JJLM91]. Th trm formal mthods can b usd to dscrib: writing a formal spcification; proving proprtis about th spcification; constructing a program by mathmatically manipulating th spcification; and vrifying a program by mathmatical argumnt [Hal90]. Formal mthods for instanc, can rfr to mathmatically proving that proprtis of a systm hold bfor it is implmntd [JJLM91]. A formal spcification is usd to provid a prcis dfinition of what a systm should do and th systm proprtis that ar dsird. Writing such spcifications nsurs that proprtis and rquirmnts of a systm ar writtn

15 Introduction 3 down formally. Such spcifications can lad to uncovring inconsistncis and dsign flaws tc. [CW96, Jon90]. Formal spcifications mploy a mathmatical (logic) notation. Mathmatical logic is usd to vrify programs. Two approachs to formal vrification ar modl chcking and thorm proving. Such tchniqus ar usd to chck whthr a systm has th dsird proprtis [CW96]. Givn a modl of a systm, modl chcking is usd to chck whthr a proprty holds in that modl [CW96]. Thorm proving is th procss of finding a proof of a proprty, whr th diffrnt stps in a proof ar justifid by rfrring to known facts [CW96]. Numrous formal mthods xist such as VDM [Jon90] and Z [Spi92]. Thy hav bn usd succssfully in industry, for instanc in spcifying safty critical softwar and in vrifying hardwar dsigns [CW96]. For an ovrviw of th us of formal mthods in industry th radr is rfrrd to [CW96] and to [WLBF09] Proofs A mathmatical proof is an argumnt that som statmnt/claim is tru, whnvr som assumd statmnts ar tru. Proofs ar usd frquntly in th contxt of formal spcifications, for instanc in discharging proof obligations about formal spcifications, and for showing that xpctd proprtis of a formal spcification hold [BFL + 94]. A formal languag allowing statmnts to b writtn, along with an intrprtation giving a maning to statmnts, and a st of infrnc ruls and axioms which ar ruls stating how statmnts can b infrrd from othr statmnts, (whr an axiom is an infrnc rul whos truth is takn without qustion), ar ndd as a basis for conducting proofs [BFL + 94]. Dpnding on th purpos of th proofs, thy can b conductd (writtn) with diffrnt lvls of formality [BFL + 94]. At on xtrm is informal proofs. Informal proofs gnrally put forth a high-lvl argumnt that attmpts to convinc a radr that a claim holds. Th lack of formality in such informal proofs mans that thy cannot b chckd by tools, and thus thr is a rlianc on th radr to chck that thy ar corrct. Additionally, in informal proofs it could b th cas that larg stps ar mad without dtaild justification. Thus such proofs ar suscptibl to rrors. At th othr xtrm ar formal proofs. In formal proofs th lvl of dtail in th proofs is gratr than in informal proofs. Such proofs ar gnrally conductd a stp at a tim, whr ach stp is justifid by rfrring to known ruls, whr gnrally no big jumps ar mad (crtain tools may though allow

16 Introduction 4 for a numbr of stps to b mad in a singl stp, for instanc, stps that simplify formula). Tool assistanc can b usd to aid in th dvlopmnt of such proofs, and for chcking that such proofs ar corrct. Exampls of such tools includ PVS [ORS92], Isabll/HOL [NWP02], and CVC [BT07]. Formal proofs can b chckd for corrctnss by a tool, as th task can gnrally just b rducd to an xrcis in symbol manipulation. Chcking th corrctnss of stps in a formal proof can b don by pattrn matching against ruls [BFL + 94]. A proof must srv th purpos of liminating any doubt about th claim bing mad not following. Proofs that lack a lot of formality cannot gnrally liminat such doubt. Th highst lvl of confidnc in proofs can b gaind by constructing formal proofs, sinc thir dtaild stps man that tools can b usd to chck such proofs for corrctnss. Undrtaking mathmatical proofs is gnrally a hard task, and as a rsult tool support is availabl to hlp in writing formal proofs (thorm provrs). In thorm proving a usr gnrally provids a st of ruls takn to b tru, as wll as a formula to b provd. It is th purpos of th thorm provr to attmpt to construct a proof, or at last to hlp th usr to find a proof that th formula undr considration holds. Such tools can b aidd by proof tchniqus such as rsolution, paramodulation, and smantic tablauxs [BA01, Har09, Bun10]. In intractiv thorm proving th onus is on th usr to complt th proof but givn th aid of a tool. Th usr could, for instanc, hav to provid a proof stp by stp, but significant proof tasks could still b prformd automatically by th tool. Such a tool may only chck ach stp of a usr s proof for corrctnss. At anothr xtrm of thorm proving ar automatd thorm provrs, which will attmpt to prov a formula, for instanc by following pr-programmd stratgis to attmpt to find a proof of a formula undr considration automatically. Howvr, such tools may still rquir usr assistanc/guidanc [GMW79, BA01] Th Issus that Aris Whn Rasoning About Partial Functions Th intrst in this thsis is rasoning about logical formula that can contain rfrnc to trms that may fail to dnot, for xampl, arising from th application of partial functions. Th trms total function and partial function will first b introducd, followd a discussion of th issus that aris whn rasoning about partial functions with xampls which provids motivation for this work. This sction lads into th aims and th contributions of this thsis. A total function is a function that will yild a rsult (valu) for vry mmbr of its domain. Th domain is th st of valus to which a function

17 Introduction 5 may b applid. A total function is dfind on all valus that ar within its domain. No mattr what argumnts ar passd into a total function, a trm that applis a total function will always dnot a valu, that is, th trm will b dfind. A partial function may not yild a rsult for vry mmbr of its domain. Thus rasoning about partial functions is mor problmatic as a trm that applis a partial function can fail to dnot, as a partial function may not yild a propr dfind valu for som or possibly all of th argumnts in its domain that it can b applid to. A dfind domain is th st of valus to which a function may b applid, whr th function will yild a dfind rsult. Ths two domains ar th sam for total functions, but for partial functions ths two domains ar diffrnt from ach othr. For instanc, th domain of th partial intgr division function is Z Z, but th dfind domain of th partial intgr division function is Z (Z \ {0}). Rasoning about partial functions is ncssary sinc thy aris frquntly in computing, s.g. [CJ91, Jon06, Far96, Ow97]. Partial functions aris for xampl in th spcification of computr programs (for instanc in VDM and Z), whr thy can aris from rcursiv function dfinitions which ar only dfind whn th rcursion trminats and yilds a dfind valu. Program spcifications also mploy a numbr of data typs, such as squncs and maps which hav associatd oprators that ar partial, such xampls includ taking th had of a squnc (th squnc could b mpty) and map lookup (th valu may not xist in th map). Othr xampls whr partiality can aris includs from array indxing (an invalid array indx), division by zro, and taking th log of zro. Such partial oprators ar usd frquntly in program spcifications, and thr is a grat nd for rcursiv functions. A trm that applis a partial function with argumnt(s) from outsid of th partial function s dfind domain will not dnot (th trm dnots no valu) and this is known as a partial trm, or an undfind trm, or a non-dnoting trm. Th trms partial trm, undfind trm, and non-dnoting trm ar usd intrchangably throughout this thsis. Allowing partial functions (and partial oprators) to occur lads on to having to rason about potntial partial trms in proofs. Formula lik i/i = 1, log(i) = 0, and A[i] = 5, can all b tru, fals or undfind, dpnding on th valu assignd to th fr variabl i. Also considr a sntnc such as i is tall. This is tru for som i, fals for som i, and nithr tru or fals for som i; th sntnc is vagu. Undfindnss can propagat, sinc th trm 1/0 is undfind, th trm 1 + (1/0) is undfind. Popl hav also argud (rfr to [Sid10] for an introduction as wll [Pri53]

18 Introduction 6 and [But55]) that propositions about th futur also pos problms in classical logic, sinc propositions about th futur ar nithr tru nor fals whn statd. A sntnc such as it will rain nxt Wdnsday is nithr tru nor fals at this momnt in tim, sinc it is not yt dtrmind that it will rain nxt Wdnsday, (cf. th argumnts about Aristotl s sa battl argumnt [Pri53, But55]). It is illustratd blow that rasoning about logical formula that can contain rfrncs to partial trms, for instanc, arising from th application of partial functions, is problmatic in two-valud classical logic. Numrous approachs to rasoning about logical formula that can contain rfrncs to partial trms though hav bn proposd, for instanc in [Kl52, McC67, CJ91, Ow97, FFL97, Far96, MS97, Mh08, GS95, Jon06, SB99, Art96, Häh05, WF08, Fit07, JL11, Sch11]. A rviw of ths diffrnt approachs is prsntd in Chaptr 2. Th issus that aris du to partial trms aros a long tim ago du to th us of dfinit dscriptors [SDG99]. Russll [Rus05] in th arly 1900s discusss such issus using th infamous xampl of th prsnt King of Franc among othrs, and introducs his own thory, whr partial trms stand for no objct (sinc Franc is a rpublic now th phras th prsnt King of Franc rfrs to no objct), but assrtions lik th King of Franc is bald ar fals), as wll as outlining th thoris of Minong and Frg, which ar thoris whr th King of Franc would stand for som objct. Rfr to [SDG99] for such an historical prspctiv. Som of ths idas can b sn undrlying th approachs that ar considrd in Chaptr 2. Th focus in this thsis is on partial trms that aris through th application of partial functions in program spcifications. Approachs to coping with partial trms ar considrd in Chaptr 2. In [Häh05] thr diffrnt kinds of undfindnss/partiality that can b ncountrd in program spcifications ar discussd: Non-trmination: A subcomputation ndd for th valuation of an xprssion dos not trminat [Häh05]; Error valu: A computation has an rronous rsult, bcaus it was calld with an illgal valu... an illgal valu is not intndd to occur, but if it dos, on has to handl it [Häh05]; and Non-dtrminism: In contrast to rror valus, indtrminat valus typically ar intntional... An xprssion could b an rror, but it could just as wll b loosly spcifid: it has a dfind valu, but it is lft to an implmntation to fix that valu [Häh05].

19 Introduction 7 To furthr illustrat th problms with partial trms considr th following formula whr hd s xtracts th first lmnt from th squnc s: s = [] hd s = 5 Whn s is an mpty squnc th trm hd s fails to dnot a propr valu; it is known as a partial trm. Th scond disjunct will contain a partial trm whnvr th first disjunct is tru. Furthrmor, considr th following formula whr j is an intgr and m is a map from Z to Z: j dom (m) m(j ) = 3 Notic that th map lookup in th scond conjunct givs ris to a partial trm whn th first conjunct is fals. In ths two xampls th qustion is raisd as to what maning is to b givn to th logical formula givn th xistnc of partial trms. To furthr illustrat th issu of partial trms considr th zro function which is dlibratly partial and was first prsntd in [CJ91]: zro : Z Z zro(i) if i = 0 thn 0 ls zro(i 1) This function is dfind to rturn 0 whn i 0. Howvr, whn i < 0, th trm zro(i) will fail to dnot an intgr valu, it will b a partial trm. 1 For xampl, zro(5) rturns an intgr valu notably 0, but zro( 1) is a partial trm (it dnots no valu). Th zro function has bn chosn primarily bcaus it allows for th issus surrounding undfindnss to b illustratd through such a simpl dfinition. This zro function and a rlatd subp function (s Chaptr 2) hav bn promotd by Cliff Jons [Jon90, CJ91, Jon06] as a way of tsting approachs to coping with partial trms. In th following it is bing considrd that functions ar valuatd according to a strict smantics, that is, if an argumnt passd into a function is undfind thn th function itslf is undfind. Of cours, functions can also b undfind 1 Th domain could b rstrictd to N sinc th domain is just a singl st and thrfor th rstrictd st N can b usd whr all of th lmnts satisfy th prcondition that is prsntd. That is, th zro function will b total ovr this rstrictd st N. Howvr, taking such an approach is not always this straightforward. Considr that th prcondition is a rlation btwn multipl domain lmnts. Taking this approach is considrd in Sction 2.2.

20 Introduction 8 vn if only dfind argumnts ar passd into thm. Th following proprty of th zro function attmpts to captur th dfind domain of th zro function, and furthr illustrats how th issus of partial trms can b manifstd into logical formula: i: Z i 0 zro(i) = 0 (1.1) it should b clar that th truth of this proprty rlis on th truth of implications such as: 1 0 zro(1) = 0 which valuats to: tru 0 = 0 and furthr to: tru tru which is clarly tru. Howvr, th truth of this proprty also rlis on th truth of implications such as: 1 0 zro( 1) = 0 whr th trm zro( 1) dos not dnot an intgr valu. Thr is a gap, that is, an absnc of a dfind valu. Blamy usd th notion of gaps in th valu spac/in truth valus, as opposd to an xplicit undfind valu [Bla80]. Th trm gap will b usd irrspctiv of th typ of undfindnss from th thr typs of undfindnss that can aris and that wr listd abov, so no distinction will b mad btwn th diffrnt typs of undfindnss in what follows. It is, howvr, convnint to illustrat th difficultis by writing Z and B to stand for missing intgr valus ( gaps ) and missing Boolan valus ( gaps ) rspctivly. Thus this xampl valuats to: fals Z = 0 whn considring wak (strict) quality (which fails to dnot if ithr oprand fails to dnot) mans that this formula furthr valuats to:

21 Introduction 9 fals B whr a non-dnoting truth valu (a gap, that is, th absnc of a truth valu) has arisn. A partial trm from th application of th zro function has propagatd up. This dos not mak any formal sns in two-valud classical logic sinc th truth tabls only dfin th logical oprators for propr Boolan valus (B, {tru, fals}), and no mntion is mad of formula that fail to dnot a Boolan valu. Rfrring again to Proprty 1.1 th radr may want to intrprt th implication as a guard, that is, whnvr th antcdnt is fals thn th implication is tru. In othr words intrprting th antcdnt of th implication as guarding th implication from th possibl partial trm (a gap ) in th consqunt, but thr is no formal sns in two-valud classical logic in which th antcdnt bing fals ovrcoms th problm of a gap in th consqunt. Furthrmor, it is not at all wis to rly on such a guard bing prsnt. A standard law in two-valud classical logic is that th contrapositiv ( q p) of an implication is quivalnt to th implication (p q): whr th so calld guard is lss obvious. i: Z (zro(i) = 0) i < 0 (1.2) A mor problmatic proprty of th zro function is: i: Z zro(i) = 0 zro( i) = 0 (1.3) whr it is clar that with th xcption of th cas whn i dnots 0 on of th disjuncts will fail to dnot a propr valu. Dpnding on th valu of i ithr of th oprands can fail to dnot a propr valu. It should b clar that th truth of Proprty 1.3 rlis on th truth of disjunctions such as: zro(1) = 0 zro( 1) = 0 which again sinc th trm zro( 1) dos not dnot an intgr valu valuats to: 0 = 0 Z = 0 and du to th notion of wak quality this furthr valuats to:

22 Introduction 10 tru B which again maks no sns in two-valud classical logic, sinc th truth tabls of two-valud classical logic ar only dfind for propr Boolan valus. In [Far90] Farmr stats that rasoning about partial functions in classical logic is problmatic as thy can lad to a violation of th xistnc assumption, that is, that all trms hav a dnotation. Exampls can b constructd that srv th sam illustration purpos as th zro function did but using division instad: i: Z i 0 i/i = 1 (1.4) i: Z (i/i = 1) ((i 1)/(i 1) = 1) (1.5) Spcification languags in particular must handl partial trms, sinc partial trms aris frquntly, and thy pos problms. At ZUM97 (th Z Usr Mting), it was rportd by Mark Saaltink (th author of th Z Evs proof tool), that not on of 400 publishd Z spcifications analysd was fr of rrors causd by undfind trms [SDG99]. Th big qustion that is raisd du to th prsnc of partial trms is how can rasoning about logical formula that can contain rfrncs to partial trms b conductd formally. Approachs to coping with partial trms must provid an answr to this qustion. Thy must also addrss th issu of what trms lik zro( 1) and 0/0 dnot (thy could just b lft as a gap to b dalt with by othr constructs), or liminat such trms compltly. Chaptr 2 outlins numrous approachs that hav bn proposd ovr th yars to handl logical formula that can contain rfrncs to partial trms. As yt thr is no consnsus on which is th bst approach to cop with partial trms. Approachs includ thos that attmpt to provid workarounds to rmain within th ralm of two-valud classical logic, and thos approachs that mak us of non-classical (thr-valud) logics. Non-classical logics hav long bn usd to modl undfindnss in formal spcification languags [BCJ84]. Th approach that th main body of this thsis is basd on is known as th Logic of Partial Functions (LPF for short) [BCJ84, Ch86, CJ91, JM94, Jon06], which is a non-classical (thrvalud) logic, whr a formula can b tru, fals, or undfind (a gap ), and th intrprtations of th logical oprators ar xtndd to cop with such

23 Introduction 11 gaps. LPF is on of th approachs discussd in Chaptr 2. Sction 2.3 prsnts justifications for using LPF ovr othr approachs that hav bn proposd ovr th yars that allow for rasoning about logical formula that can includ rfrncs to partial trms. LPF is usd in th Vinna Dvlopmnt Mthod (VDM). A big obstacl to th us of LPF (and of non-classical logics in gnral) is that it is an unfamiliar logic. For instanc, th availabl proof ruls in LPF, diffr from thos of two-valud classical logic. In particular th law of th xcludd middl dos not hold in LPF. Thus mor ffort is rquird from a usr who may b familiar with two-valud classical logic to larn how to rason in LPF. Th fact that LPF dviats from th world of two-valud classical logic lads to anothr big obstacl against th adoption of LPF, that bing, that a larg body of rsarch and nginring has gon into two-valud classical logic, which has ld to a wid rang of proof procdurs and to th dvlopmnt of (intractiv/automatd) proof basd tool support for two-valud classical logic. All of this proof support cannot b rusd without chang for LPF du to its thr-valud natur to cop with th occurrnc of partial trms. Thus, it is th cas that mchanisd (automatd) proof support for LPF rquirs additional ffort. Proof support for LPF rmains a subjct of dbat and rsarch [Fit07]. Appropriat proof support to aid rasoning in LPF can go a long way to addrssing this obstacl against th adoption of LPF, and invstigating this topic is a major aim of this thsis. 1.2 Aims LPF is a non-classical logic, which has for a long tim bn considrd a viabl candidat solution within which to conduct rasoning about logical formula that can contain rfrncs to partial trms. A major obstacl affcting th adoption of LPF is that thr is a distinct lack of dirct proof support availabl for LPF. An aim of this work is to: LPF. Rsarch into th applicability of mchanisd (automatd) proof support for Th thsis argus that th basic idas of th two-valud classical logic proof procdur rsolution and th associatd tchniqu of proof by contradiction [Bun10, BA01] can b rusd for rasoning in LPF whn supplmntd with vital modifications to covr LPF. Furthrmor, it argus that ths pro-

24 Introduction 12 cdurs can b modifid fficintly for LPF. Bing abl to r-us th basis of two-valud classical logic proof procdurs to b abl to rason in LPF is ssntial. This nsurs that xisting idas and work can b xtndd for LPF, rathr than having to start from scratch. For instanc, xisting cod bass and tool support can b adaptd for LPF. Thr is a qustion ovr whthr th us of LPF will lad to a substantial incras in th work ndd whn applying proof procdurs, compard to in two-valud classical logic. An fficint mchanisation of proof procdurs is ssntial to support any futur us of and futur work on LPF. An aim of this work as alrady mntiond is concrnd with work on th mchanisation of LPF. In this thsis providing a formal comparison of approachs to coping with partial trms is also an aim. This is usd to argu for th us of LPF for rasoning about logical formula that can contain rfrnc to partial trms. 1.3 Contributions This work prsnts an invstigation into th applicability of mchanisd proof support for LPF. Ovr th yars thr has bn a lack of dirct proof support for LPF. This work is aimd at addrssing this. Rlatd work will b discussd in th appropriat placs in th main body of this thsis. This work focuss on invstigating th basic but fundamntal two-valud classical logic proof procdur: rsolution and th associatd tchniqu of proof by contradiction [Rob65, BA01]. Ths basic fundamntal proof tchniqus ar th basis on which advancd proof tchniqus such as paramodulation [RW69] and suprposition [BG94] ar built. Thus invstigating ths basic proof tchniqus is th ssntial and obvious starting point for addrssing th dvlopmnt of proof support for LPF. An invstigation into th issus that aris in applying ths basic tchniqus to LPF, and an invstigation into th xtnt of th modifications ndd to b mad to ths basic proof tchniqus for LPF is undrtakn. This provids ky insights into providing mchanisd proof support for a non-classical logic lik LPF, for instanc into th amount of xtra work that ariss in a mchanisation of such tchniqus for LPF. This work provids th ssntial foundation on which to facilitat rsarch into th modification of advancd proof tchniqus for LPF, and for providing tool support in th futur. Smantic dfinitions of LPF ar dfind. Ths smantic dfinitions provid th undrlying basis of this work. Th smantic dfinitions prcisly and succinctly captur how LPF cops with logical formula that can contain rfrncs to partial trms. A smantic dfinition allows for concpts rquird for

25 Introduction 13 th invstigation of proof tchniqus to b prsntd unambiguously, and for issus that aris du to partial trms whn applying ths tchniqus to LPF to b illustratd prcisly. Proofs of modifications rquird to carry th proof tchniqus ovr to LPF ar also provd with rspct to a smantic dfinition. It is also shown how intractiv tool support for LPF in addition to th work on modifying rsolution and th associatd tchniqu of proof by contradiction can b dvlopd from smantic dfinitions for LPF. Earlir publications (.g. thos citd at th nd of Sction 1.1.4) hav discussd th us of LPF for rasoning about logical formula that can contain rfrncs to partial trms. This thsis argus for th us of LPF for such a purpos, but instad of just prsnting informal comparisons this thsis also provids formal comparisons basd upon formal smantic dfinitions, providing a clar divid btwn this and arlir work. A wid rang of approachs ar compard in this thsis. A smantic dfinition of LPF is modifid to formally captur th smantics of othr approachs to coping with partial trms. This is usd to facilitat comparisons and to undrtak a vital task of idntifying ways of bing abl to mov thorms btwn th diffrnt approachs. Th comparisons alongsid th mchanisation work for LPF gratly aid in justifying th us of LPF for rasoning about logical formula that can contain rfrnc to partial trms. 1.4 Structur of th Thsis Chaptr 2 provids an ovrviw of diffrnt approachs to coping with logical formula that can contain rfrncs to partial trms. Justifications for th us of LPF, and prior work on mchanising LPF ar thn discussd in this chaptr. Chaptr 3 formally capturs th smantics of LPF with both Structural Oprational Smantics (SOS) dfinitions and dnotational smantic (DS) dfinitions bing dfind. On of th purposs of th DS dfinitions is to provid a mans to undrtak formal comparisons of th diffrnt approachs to coping with logical formula that can contain rfrncs to partial trms. An LPF DS dfinition is modifid to formally captur th smantics of diffrnt approachs, and ths dfinitions ar prsntd in Chaptr 4. This is followd by th comparisons that ar mad btwn th diffrnt approachs basd upon ths dfinitions, and th idntification of rlationships to allow for thorms to b movd btwn th diffrnt approachs. A DS dfinition for LPF is also th undrlying basis with which to conduct proofs in Chaptr 6. Th focus of Chaptr 5 is on illustrating how SOS dfinitions that formally

26 Introduction 14 captur th smantics of LPF can giv ris to mchanisations of LPF, in both a trm-rwriting systm and in a thorm provr. Chaptr 6 dfins th concpts of satisfiability and validity, as wll as rlatd dfinitions in LPF. An invstigation into th applicability of mchanisd proof support for LPF is thn prsntd, focusing on th rsolution proof procdur. Th issus that aris whn applying it in LPF ar highlightd with illustrativ xampls, followd by an invstigation into dtrmining how to modify it to covr LPF and into th xtnt of th modifications ndd, which ar prsntd alongsid supplmntary proofs. Chaptr 7 contains a summary of this thsis, and futur work of intrst is discussd. Full smantic dfinitions from Chaptr 3 ar prsntd in Appndix A. This includs full abstract syntax dfinitions, full contxt conditions as wll as th full SOS dfinitions, and th full DS dfinitions. Th notation usd throughout this thsis in numrous xampls is basd on th mathmatical VDM-SL notation. Appndix B prsnts th notation of slctd VDM-SL data typs and thir associatd oprations tc. for rfrnc. Any radr who is not familiar with th mathmatical VDM-SL notation is advisd to rfr to this appndix first. A glossary consisting of dfinitions of many trms usd widly throughout this thsis is prsntd in Appndix C.

27 Chaptr 2 Background Contnts 2.1 Catgorising th Diffrnt Approachs to Coping with Partial Trms Approachs to Coping with Partial Trms Rformulating Exprssions and Function Dfinitions Classical Approachs Smi-Classical Approachs Non-Classical Logic Approachs Squnt Intrprtations Summary of th Justifications for LPF Prvious Attmpts at Mchanisation Support for LPF Th VDM Toolst and th Ovrtur Toolst mural Utilising Existing Thorm Provrs Conclusions Partial functions aris frquntly in computr scinc, for instanc in program spcifications. Th application of partial functions can giv ris to partial trms, that is, trms that fail to dnot a propr valu. Th prsnc of partial functions lads to complications whn rasoning about logical formula that can includ rfrncs to partial trms. Rasoning about such logical formula is ndd for instanc, whn discharging proofs about proprtis of program spcifications that ar xpctd to hold. As illustratd in th prvious chaptr, two-valud classical logic cannot dirctly cop with undfind truth valus (truth valu gaps, that is, th absnc of a dfind truth valu tru or fals), as th two-valud classical logic truth tabls ar only dfind for propr Boolan valus. Thr is a history of rsarch that has gon into logics that can cop with partial trms. Numrous approachs to rasoning about logical formula that

28 Background 16 can contain rfrncs to partial trms hav bn proposd ovr th yars. Th qustions that must b addrssd by approachs to coping with trms partial trms ar: what maning is to b givn to th trm f (i) whn th valu i is outsid of th dfind domain of a partial function f, how undfindnss is to propagat through th various languag constructs, and how can rasoning about logical formula that can contain rfrncs to partial trms b conductd formally. Howvr, thr is as yt no consnsus on which is th bst way of rasoning about logical formula that can contain rfrncs to partial trms. This chaptr survys a numbr of diffrnt approachs to rasoning about such logical formula. Chaptr 4 thn gos furthr by prsnting a formal comparison btwn th approachs. Th diffrnt approachs can b classifid into catgoris; ths ar outlind in Sction 2.1. Th diffrnt approachs ar thn considrd in mor dtail in Sction 2.2. Justifications for LPF thn follow in Sction 2.3. A discussion on prior mchanisation work that has bn undrtakn for LPF is prsntd in Sction Catgorising th Diffrnt Approachs to Coping with Partial Trms Th diffrnt approachs to coping with partial trms can b classifid into two catgoris. Th first catgory compriss of thos approachs that attmpt to continu using two-valud classical logic, and th scond catgory compriss of thos approachs that accpt th nd for a non-classical logic. Th approachs in th first catgory prsrv th two-valud classical logic oprators. Howvr, th approachs in th scond catgory ssntially giv up on two-valud classical logic in favour of th us of a non-classical logic. In a non-classical logic, proof ruls that ar sound in two-valud classical logic ar no longr sound and thus thy nd modifying with dfindnss conditions, and additional (non-classical) proof ruls may b ndd for compltnss. Ths complications can affct mchanisd proof procdurs, and ths modifications and xtnsions can lad to a non-classical logic bing too unfamiliar for a usr, and thus difficult not only to larn but to us in practic. Th approachs to handling partial trms can b furthr catgorisd by dscribing whr thy attmpt to cop with undfindnss, so what languag constructs is undfindnss allowd to propagat through and whr ar th attmpts mad to catch undfindnss. It is this catgorisation that will b usd to structur Sction 2.2: 1. Forc th rformulation of formula and/or function dfinitions to avoid

29 Background 17 th introduction of partial trms; 2. Forc all trms to dnot; 3. Allow trms to fail to dnot propr valus, but still guard th logical oprators from th rsulting undfindnss by catching undfindnss at th prdicat lvl; and 4. Adopt non-classical logics. Catgory 1 includs thos approachs that forc th rformulation of any xprssions containing rfrncs to partial functions, and thos approachs that forc th rformulation of th domain of partial functions to mak partial functions total (i.. rstricting th typs of argumnts). S Sction Catgory 2 attmpts to dal with undfindnss by forcing all trms to dnot propr valus, for instanc, through undr/ovr-spcifying partial functions on argumnts from outsid of thir dfind domain. Approachs whr th considration of partial trms ar liminatd from validity proofs by forcing xtra wll-dfindnss (WD) conditions to b provd ar also considrd in this catgory. S Sction Catgory 3 attmpts to dal with undfindnss by allowing trms such as zro( 1) to fail to dnot propr valus, but to forc prdicats such as zro( 1) = 0 to dnot, vn whn thir oprands ar trms that fail to dnot propr valus. This approach is rfrrd to as th smi-classical approach. S Sction Catgory 4 allows undfindnss from partial trms to propagat up to th logical oprators. Approachs in this catgory ar th non-classical (nonstandard) logics, sinc th intrprtations that ar givn to th logical oprators ar r-intrprtd as undfindnss is incorporatd into th logic itslf, whil th approachs in th thr othr catgoris attmpt to catch undfindnss bfor it collids with th logical oprators. Th logics that ar considrd in this chaptr ar commonly rfrrd to as thr-valud logics; undfindnss is liftd to formula by xtnding th truth valus formula can dnot from {tru, fals} to {tru, fals, B }. Hr th logics ar not considrd to hav an xplicit undfind valu, it is just rgardd as a gap, that is, an absnc of a (dfind) valu [Bla80, Fit07], (thr is not an additional truth valu, it is just rgardd as th absnc of a truth valu). S Sction Two-valud classical logic is bivalnt, that is, thr ar two truth valus, and vry proposition has a truth valu that is ithr tru or fals. Th nonclassical (thr-valud) logics that ar considrd hr ar trivalnt, that is,

30 Background 18 thy can b ithr tru, fals, or undfind (but rcall again thr is no concrt undfind valu, undfindnss is just tratd hr as a gap ). Th major bnfit of approachs in both Catgory 1 and Catgory 2 is that two-valud classical logic can b still usd. Additionally, th approachs in Catgory 3 prsrv th us of th two-valud classical logic oprators. Th approachs in Catgory 4 us non-classical logics in favour of two-valud classical logic. For an ovrviw of many valud logics rfr to [Got05]. Four-valud logics also xist (s [Got05] for an ovrviw), but for rasoning about logical formula that can contain rfrncs to partial trms, a thr-valud logical tratmnt suffics. 2.2 Approachs to Coping with Partial Trms Each of th following four subsctions corrspond to on of th four catgoris for coping with partial trms outlind in Sction 2.1. Numrous diffrnt approachs ar discussd for ach catgory. Th final subsction in this sction outlins diffrnt intrprtations that can b givn to a squnt in a nonclassical (thr-valud) logic approach Rformulating Exprssions and Function Dfinitions Rlations This approach forcs rasoning about partial functions in trms of th corrsponding graph of th functions. Th graph of an n-ary function is an (n + 1)- ary rlation. So a partial function f : Z Z is to b viwd as a rlation Z Z. So, instad of writing a function application in th styl of f (x) = y it is to b writtn as (x, y) f, that is, is (x, y) a mmbr of th graph of f. Th ky ida is that (x, y) f is fals whn x / dom f, for all y [Far90, CJ91, Jon06]. Rasoning about partial functions in this way forcs formula to b writtn in a non-standard way, and can lad to vrbos dfinitions. As an xampl Proprty 1.3 bcoms: i: Z (i, 0) zro ( i, 0) zro whn writtn in trms of th mmbrship of th graph of th zro function. Whn thr is no xplicit rsult xprssion it is ncssary to us xistntial quantifirs [Jon06]. Rstricting th Bounds on Quantifirs On solution is to rstrict quantification to ovr sts that do not contain any valus from outsid of th dfind domains of any partial functions usd. Th