A Computational Logic This Is a Volume in the ACM MONOGRAPH SERIES
Total Page:16
File Type:pdf, Size:1020Kb
A Computational Logic This is a volume in the ACM MONOGRAPH SERIES Editor: THOMAS A. STANDISH, University of California at Irvine A complete list of titles in this series appears at the end of this volume. A Computational Logic Robert S. Boyer and J Strother Moore SRI International Menlo Park, California ACADEMIC PRESS A subsidiary of Harcourt Brace Jovanovich, Publishers New York London Toronto Sydney San Francisco Copyright (C) 1979 by Academic Press no part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocoppy, recording, or any information storage and retrieval system, without permission in writing from the publisher. ACADEMIC PRESS, INC. 111 Fifth Avenue, New York, New York 10003 United Kindom Edition published by ACADEMIC PRESS, INC. (LONDON) LTD. 24/28 Oval Road, London NW1 7DX Library of Congress Cataloging in Publication Data Boyer, Robert S. A Computational Logic (ACM monographs series) Includes bibliographic references and index. 1. Automatic theorem proving. I. Moore, J Strother, Date joint author. II. Title. III. Series: Association of Computing Machinery. ACM monograph series. QA76.9.A96B68 519.4 79-51693 ISBN 0-12-122950-5 printed in the united states of america 79 81 81 82 9 8 7 6 5 4 3 2 1 To our wives, Anne and Liz Contents Preface vii 1 Introduction 1 1.1 Motivation . 2 1.2 Our Formal Theory . 3 1.3 Proof Techniques . 3 1.4 Examples . 3 1.5 Our Mechanical Theorem Prover . 5 1.6 Artificial Intelligence or Logic? . 6 1.7 Organization . 7 2 A Sketch of the Theory and Two Simple Examples 9 2.1 An Informal Sketch of the Theory . 9 2.2 A Simple Inductive Proof . 18 2.3 A More Difficult Problem . 20 2.4 A More Difficult Proof . 23 2.5 Summary . 26 2.6 Notes . 27 3 A Precise Definition of the Theory 29 3.1 Syntax . 29 v vi CONTENTS 3.2 The Theory of If and Equal . 31 3.3 Well-founded Relations . 32 3.4 Induction . 34 3.5 Shells . 37 3.6 Natural Numbers . 41 3.7 Literal Atoms . 42 3.8 Ordered Pairs . 44 3.9 Definitions . 45 3.10 Lexicographic Relations . 53 3.11 Lessp and Count . 54 3.12 Conclusion . 57 4 The Correctness of a Tautology Checker 59 4.1 Informal Development . 60 4.2 Formal Specification of the Problem . 63 4.3 The Formal Definition of Tautology.checker 66 4.4 The Mechanical Proofs . 71 4.5 Summary . 88 4.6 Notes . 90 5 An Overview of How We Prove Theo- rems 91 5.1 The Role of the User . 91 5.2 Clausal Representation of Conjectures 92 5.3 The Organization of our Heuristics . 93 5.4 The Organization of our Presentation . 95 6 Using Type Information to Simplify For- mulas 97 6.1 Type Sets . 97 6.2 Assuming Expressions True or False . 100 CONTENTS vii 6.3 Computing Type Sets . 101 6.4 Type Prescriptions . 103 6.5 Summary . 107 6.6 Notes . 107 7 Using Axioms and Lemmas as Rewrite Rules 109 7.1 Directed Equalities . 109 7.2 Infinite Looping . 110 7.3 More General Rewrite Rules . 111 7.4 An Example of Using Rewrite Rules . 113 7.5 Infinite Backwards Chaining . 115 7.6 Free Variables In Hypotheses . 117 8 Using Definitions 119 8.1 Nonrecursive Functions . 120 8.2 Computing Values . 120 8.3 Diving In to See . 122 9 Rewriting Terms and Simplifying Clauses127 9.1 Rewriting Terms . 127 9.2 Simplifying Clauses . 131 9.3 The Reverse Example . 134 9.4 Simplification In the Reverse Example 134 10 Eliminating Destructors 139 10.1 Trading Bad Terms for Good Terms . 139 10.2 The Form of Elimination Lemmas . 142 10.3 The Precise Use of Elimination Lemmas 143 10.4 A Nontrivial Example . 144 viii CONTENTS 10.5 Multiple Destructors and Infinite Loop- ing . 148 10.6 When Elimination Is Risky . 149 10.7 Destructor Elimination In the Reverse Example . 151 11 Using Equalities 155 11.1 Using and Throwing Away Equalities . 155 11.2 Cross-fertilization . 156 11.3 A Simple Example of Cross-fertilization 157 11.4 The Precise Use of Equalities . 159 11.5 Cross-fertilization In the Reverse Ex- ample . 160 12 Generalization 163 12.1 A Simple Generalization Heuristic . 163 12.2 Restricting Generalizations . 165 12.3 Examples of Generalizations . 167 12.4 The Precise Statement of the General- ization Heuristic . 168 12.5 Generalization In the Reverse Example 170 13 Eliminating Irrelevance 173 13.1 Two Simple Checks for Irrelevance . 173 13.2 The Reason for Eliminating Isolated Hypotheses . 174 13.3 Elimination of Irrelevance In the Re- verse Example . 176 14 Induction and the Analysis of Recursive Definitions 177 CONTENTS ix 14.1 Satisfying the Principle of Definition . 179 14.2 Induction Schemes Suggested By Re- cursive Functions . 186 14.3 The Details of the Definition-time Anal- ysis . 196 14.4 Recursion In the Reverse Example . 200 15 Formulating an Induction Scheme for a Conjecture 201 15.1 Collecting the Induction Candidates . 201 15.2 The Heuristic Manipulation of Induc- tion Schemes . 206 15.3 Examples of Induction . 214 15.4 The Entire Reverse Example . 219 16 Illustrations of our Techniques Via Ele- mentary Number Theory 225 16.1 Plus.right.id . 226 16.2 Commutativity2.of.plus . 227 16.3 Commutativity.of.plus . 231 16.4 Associativity.of.plus . 235 16.5 Times . 235 16.6 Times.zero . 235 16.7 Times.add1 . 236 16.8 Associativity.of.times . 239 16.9 Difference . 243 16.10Recursion.by.difference . 244 16.11Remainder . 251 16.12Quotient . 251 16.13Remainder.quotient.elim . 252 x CONTENTS 17 The Correctness of a Simple Optimizing Expression Compiler 259 17.1 Informal Development . 261 17.2 Formal Specification of the Problem . 265 17.3 Formal Definition of the Compiler . 271 17.4 The Mechanical Proof of Correctness . 274 17.5 Notes . 287 18 The Correctness of a Fast String Search- ing Algorithm 291 18.1 Informal Development . 292 18.2 Formal Specification of the Problem . 301 18.3 Developing the Verification Conditions for the Algorithm . 302 18.4 The Mechanical Proofs of the Verifica- tion Conditions . 312 18.5 Notes . 317 19 The Unique Prime Factorization Theo- rem 321 19.1 The Context . 321 19.2 Formal Development of the Unique Prime Factorization Theorem . 323 19.3 The Mechanical Proofs . 327 A Definitions Accepted and Theorems Proved By our System 341 B The Implementation of the Shell Princi- ple 391 CONTENTS xi C Clauses for our Theory 395 C.1 Logical Definitions . 395 C.2 Axioms for Natural Numbers . 396 C.3 Axioms for Literal Atoms . 396 C.4 Axioms for Ordered Pairs . 397 C.5 A Sample Theorem In Clausal Form . 397 Index 399 Bibliography 415 xii CONTENTS Preface Mechanical theorem-proving is crucial to the automation of rea- soning about computer programs. Today, few computer pro- grams can be mechanically certified to be free of “bugs.” The principal reason is the lack of mechanical theorem-proving power. In current research on automating program analysis, a com- mon approach to overcoming the lack of mechanical theorem- proving power has been to require that the user direct a proof- checking program. That is, the user is required to construct a formal proof employing only the simplest rules of inference, such as modus ponens, instantiation of variables, or substitution of equals for equals. The proof-checking program guarantees the correctness of the formal proof. We have found proof-checking programs too frustrating to use because they require too much direction. Another approach to overcoming the lack of mechanical theorem- proving power is to use a weak theorem-proving program and to introduce axioms freely. Often these axioms are called “lem- mas,” but they are usually not proved. While using a proof checker is only frustrating, introducing axioms freely is deplorable. This approach has been abused so far as to be ludicrous: we have seen researchers “verify” a program by first obtaining for- mulas that imply the program’s correctness, then running the formulas through a simplifier, and finally assuming the resulting slightly simplified formulas as axioms. Some researchers admit that these “lemmas” ought to be proved, but never get around to proving them because they lack the mechanical theorem-proving power. Others, however, believe that it is reasonable to assume lots of “lemmas” and never try to prove them. We are strongly opposed to this latter attitude because it so completely under- xiii xiv PREFACE mines the spirit of proof, and we therefore reply to the arguments we have heard in its defense. 1. It is argued that the axioms assumed are obvious facts about the concepts involved. We say that a great number of mistakes in computer programs arise from false “obvi- ous” observations, and we have already seen researchers present proofs based on false lemmas. Furthermore, the concepts involved in the complicated computer systems one hopes eventually to certify are so insufficiently canonized that one man’s “obvious” is another man’s “difficult” and a third man’s “false.” 2. It is argued that one must assume some axioms. We agree, but observe that mathematicians do not contrive their ax- ioms to solve the problem at hand. Yet often the “lemmas” assumed in program verification are remarkably close to the main idea or trick in the program being checked. 3. It is argued that mathematicians use lemmas. We agree. In fact, our theorem-proving system relies heavily on lem- mas. But no proof is complete until the lemmas have been proved, too.