A Verified Prover Based on Ordered Resolution Anders Schlichtkrull, Jasmin Christian Blanchette, Dmitriy Traytel
Total Page:16
File Type:pdf, Size:1020Kb
A Verified Prover Based on Ordered Resolution Anders Schlichtkrull, Jasmin Christian Blanchette, Dmitriy Traytel To cite this version: Anders Schlichtkrull, Jasmin Christian Blanchette, Dmitriy Traytel. A Verified Prover Based on Ordered Resolution. CPP 2019 - The 8th ACM SIGPLAN International Conference on Certified Programs and Proofs, Jan 2019, Cascais, Portugal. 10.1145/3293880.3294100. hal-01937141 HAL Id: hal-01937141 https://hal.archives-ouvertes.fr/hal-01937141 Submitted on 27 Nov 2018 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. A Verified Prover Based on Ordered Resolution Anders Schlichtkrull Jasmin Christian Blanchette Dmitriy Traytel DTU Compute Department of Computer Science Department of Computer Science Technical University of Denmark Vrije Universiteit Amsterdam ETH Zürich Kongens Lyngby, Denmark Amsterdam, the Netherlands Zürich, Switzerland [email protected] [email protected] [email protected] Abstract interpreted universally. Each literal is either an atom A or The superposition calculus, which underlies first-order the- its negation :A. An atom is a symbol applied to a tuple of orem provers such as E, SPASS, and Vampire, combines or- terms—e.g., prime¹nº. The empty clause is denoted by ?. dered resolution and equality reasoning. As a step towards Resolution works by refutation: Conceptually, the calculus verifying modern provers, we specify, using Isabelle/HOL, proves a conjecture x¯:C from a set of axioms D by deriving 8 a purely functional first-order ordered resolution prover ? from D [ f x¯: :Cg, indicating its unsatisfiability. As an 9 and establish its soundness and refutational completeness. optimization, it uses a redundancy criterion to discard tau- Methodologically, we apply stepwise refinement to obtain, tologies, subsumed clauses, and other unnecessary clauses; from an abstract nondeterministic specification, a verified de- for example, p¹xº _ q¹xº and p¹5º are both subsumed by p¹xº. terministic program, written in a subset of Isabelle/HOL from Compared with plain resolution, ordered resolution relies on which we extract purely functional Standard ML code that an order on the atoms to further prune the search space. constitutes a semidecision procedure for first-order logic. Modern superposition provers are highly optimized pro- grams that rely on sophisticated calculi, with a rich metathe- CCS Concepts • Theory of computation → Logic and ory. In this paper, we propose to verify, using Isabelle/HOL verification; Automated reasoning; [30], a purely functional prover based on ordered resolution. Keywords automatic theorem provers, proof assistants, Although our primary interest is in metatheory per se, there first-order logic, stepwise refinement are of course applications for verified provers [50]. The verification relies on stepwise refinement [55]. Four ACM Reference Format: layers are connected by three refinement steps. Anders Schlichtkrull, Jasmin Christian Blanchette, and Dmitriy Our starting point, layer 1 (Section3), is an abstract Prolog- Traytel. 2019. A Verified Prover Based on Ordered Resolution. In Proceedings of the 8th ACM SIGPLAN International Conference on style nondeterministic resolution prover in a highly general Certified Programs and Proofs (CPP ’19), January 14–15, 2019, Cascais, form, as presented by Bachmair and Ganzinger [2] and as Portugal. ACM, New York, NY, USA, 14 pages. https://doi.org/10. formalized in our earlier work [39, 40]. It operates on pos- 1145/3293880.3294100 sibly infinite sets of clauses. Its soundness and refutational completeness are inherited by the other layers. 1 Introduction Layer 2 (Section4) operates on finite multisets of clauses Automatic theorem provers based on superposition, such as and introduces a priority queue to ensure that inferences E[42], SPASS [53], and Vampire [21], are often employed are performed in a fair manner, guaranteeing completeness: as backends in proof assistants and program verification Given a valid conjecture, the prover will eventually derive ?. tools [7, 20, 32]. Superposition is a highly successful calculus Layer 3 (Section5) is a deterministic program that works for first-order logic with equality, which generalizes both on finite lists, committing to a strategy for assigning priori- ordered resolution [2] and ordered completion [1]. ties to clauses. However, it is not fully executable: It abstracts Resolution operates on sets of clauses. A clause is an n- over operations on atoms and employs logical specifications ary disjunction of literals L1 _···_ Ln whose variables are instead of executable functions for auxiliary notions. Finally, layer 4 (Section6) is a fully executable program. Permission to make digital or hard copies of all or part of this work for It provides a concrete datatype for atoms and executable personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that definitions for all auxiliary notions, including unifiers, clause copies bear this notice and the full citation on the first page. Copyrights subsumption, and the order on atoms. for components of this work owned by others than the author(s) must From layer 4, we can extract Standard ML code by in- be honored. Abstracting with credit is permitted. To copy otherwise, or voking Isabelle’s code generator [11]. The resulting prover republish, to post on servers or to redistribute to lists, requires prior specific constitutes a proof of concept: It uses an efficient calculus permission and/or a fee. Request permissions from [email protected]. (layer 1) and a reasonable strategy to ensure fairness (layers CPP ’19, January 14–15, 2019, Cascais, Portugal © 2019 Copyright held by the owner/author(s). Publication rights licensed 2 and 3), but depends on inefficient list-based data structures. to ACM. Further refinement steps will be required to obtain a prover ACM ISBN 978-1-4503-6222-1/19/01...$15.00 that is competitive with the state of the art. https://doi.org/10.1145/3293880.3294100 CPP ’19, January 14–15, 2019, Cascais, Portugal A. Schlichtkrull, J. C. Blanchette, and D. Traytel The refinement steps connect vastly different levels of multisets behave more naturally under substitution. For ex- abstraction. The most abstract level is occupied by an infini- ample, applying fy 7! xg to the two-literal clause p¹xº_p¹yº tary logical calculus and the semantics of first-order logic. results in p¹xº _ p¹xº, which preserves the clause’s structure. Soundness and completeness relate these two notions. At The truth value of ground (i.e., variable-free) atoms is the functional programming level, soundness amounts to given by a Herbrand interpretation: a set I, of type 0a set, of all a safety property: Whenever the program terminates nor- true ground atoms. The “models” predicate j= is defined as mally, its outcome is correct, whether it is a proof or a finite I j= A () A 2 I. This definition is lifted to literals, clauses, saturation witnessing unprovability. Correspondingly, refu- and sets of clauses in the usual way. A set of clauses D is tational completeness is a liveness property: If the conjecture satisfiable if there exists an interpretation I such that I j= D. is valid, the program will always terminate normally. We Resolution depends on a notion of substitution and of most find that, far from being academic exercises, Bachmair and general unifier (MGU). These auxiliary concepts are provided Ganzinger’s framework [2] and its formalization [39, 40] by a third-party library, IsaFoR (Isabelle Formalization of adequately capture the metatheory of actual provers. Rewriting) [51]. To reduce our dependency on external li- To our knowledge, our program is the first verified prover braries, we hide them behind abstract locales parameterized for first-order logic implementing an optimized calculus. It by a type of atoms 0a and a type of substitutions 0s. is also the first example of the application of refinement ina We start by defining a locale substitution_ops that declares first-order context. This methodology has been used to verify application (·), identity (id), and composition (◦): SAT solvers [6, 29], which decide the satisfiability of proposi- locale substitution_ops = tional formulas, but first-order logic is semidecidable—sound fixes id :: 0s and ◦ :: 0s ) 0s ) 0s and · :: 0a ) 0s ) 0a and complete provers are guaranteed to terminate only for Within the locale’s scope, we introduce a number of derived unsatisfiable (i.e., provable) clause sets. This complicates the concepts. Ground atoms are defined as those atoms that transfer of completeness results across refinement layers. are left unchanged by substitutions: is_ground A () σ: The present work is part of the IsaFoL (Isabelle Formaliza- · 8 1 A = A σ. A ground substitution is a substitution whose tion of Logic) project, which aims at developing a library of application always results in ground atoms. Nonstrict and results about logic and automated reasoning [3]. The Isabelle strict generalization are defined as files are available in the Archive of Formal Proofs [38, 39] and in the IsaFoL repository. 2 The parts specific to the functional generalizes AB () σ: A · σ = B 9 prover refinement amount to about 4000 lines of source text. strictly_generalizes AB () generalizes AB A convenient way to study the files is to open them in Isa- ^ : generalizes BA belle/jEdit [54], as explained in the repository’s readme file. The operators on atoms are lifted to literals, clauses, and sets The files were created using Isabelle version 2018, but the of clauses. The grounding of a clause is defined as repositories will be updated to follow Isabelle’s evolution.