Wolfgang Ahrendt, Bernhard Beckert, Richard Bubel, Reiner Hähnle, Peter H. Schmitt, Mattias Ulbrich (Editors) Deductive Software Verification— The KeY Book From Theory to Practice Springer Chapter 2 First-Order Logic Peter H. Schmitt 2.1 Introduction The ultimate goal of first-order logic in the context of this book, and this applies to a great extent also to Computer Science in general, is the formalization of and reasoning with natural language specifications of systems and programs. This chapter provides the logical foundations for doing so in three steps. In Section 2.2 basic first-order logic (FOL) is introduced much in the tradition of Mathematical Logic as it evolved during the 20th century as a universal theory not tailored towards a particular application area. Already this section goes beyond what is usually found in textbooks on logic for computer science in that type hierarchies are included from the start. In the short Section 2.3 two features will be added to the basic logic, that did not interest the mathematical logicians very much but are indispensable for practical reasoning. In Section 2.4 the extended basic logic will be instantiated to Java first-order logic (JFOL), tailored for the particular task of reasoning about Java programs. The focus in the present chapter is on statements; programs themselves and formulas talking about more than one program state at once will enter the scene in Chapter3. 2.2 Basic First-Order Logic 2.2.1 Syntax Definition 2.1. A type hierarchy is a pair T = (TSym;v), where 1. TSym is a set of type symbols; 2. v is a reflexive, transitive relation on TSym, called the subtype relation; 3. there are two designated type symbols, the empty type ? 2 TSym and the universal type > 2 TSym with ? v A v > for all A 2 TSym. 23 24 2 First-Order Logic We point out that no restrictions are placed on type hierarchies in contrast to other approaches requiring the existence of unique lower bounds. Two types A, B in T are called incomparable if neither A v B nor B v A. Definition 2.2. A signature, which is sometimes also called vocabulary, S = (FSym;PSym;VSym) for a given type hierarchy T is made up of 1. a set FSym of typed function symbols, by f : A1 × ::: × An ! A we declare the argument types of f 2 FSym to be A1;:::;An in the given order and its result type to be A, 2. a set PSym of typed predicate symbols, by p(A1;:::;An) we declare the argument types of p 2 PSym to be A1;:::;An in the given order, : PSym obligatory contains the binary dedicated symbol =(>;>) for equality. and the two 0-place predicate symbols true and false. 3. a set VSym of typed variable symbols, by v : A for v 2 VSym we declare v to be a variable of type A. All types A, Ai in this definition must be different from ?.A 0-ary function symbol c : ! A is called a constant symbol of type A.A 0-ary predicate symbol p() is called a propositional variable or propositional atom. We do not allow overloading: The same symbol may not occur in FSym [ PSym [ VSym with different typing. The next two definitions define by mutual induction the syntactic categories of terms and formulas of typed first-order logic. Definition 2.3. Let T be a type hierarchy, and S a signature for T . The set TrmA of terms of type A, for A 6= ?, is inductively defined by 1. v 2 TrmA for each variable symbol v : A 2 VSym of type A. 2. f (t1;:::;tn) 2 TrmA for each f : A1 × ::: × An ! A 2 FSym and all terms ti 2 TrmBi with Bi v Ai for 1 ≤ i ≤ n. 3. (if f then t1 else t2) 2 TrmA for f 2 Fml and ti 2 TrmAi such that A2 v A1 = A or A1 v A2 = A. If t 2 TrmA we say that t is of (static) type A and write a(t) = A. Note, that item (2) in Definition3 entails c 2 TrmA for each constant symbol c : ! A 2 FSym. Since we do not allow overloading there is for every term only one type A with t 2 TrmA. This justifies the use of the function symbol a. Terms of the form defined in item (3) are called conditional terms. They are a mere convenience. For every formula with conditional terms there is an equivalent formula without them. More liberal typing rules are possible. The theoretically most satisfying solution would be to declare the type of (if f then t1 else t2) to be the least common supertype A1 t A2 of A1 and A2. But, the assumption that A1 t A2 always exists would lead to strange consequences in the program verification setting. Definition 2.4. The set Fml of formulas of first-order logic for a given type hierar- chy T and signature S is inductively defined as: 2.2. Basic First-Order Logic 25 1. p(t1;:::;tn) 2 Fml for p(A1;:::;An) 2 PSym, and ti 2 TrmBi with Bi v Ai for all 1 ≤ i ≤ n. As a consequence of item2 in Definition 2.2 we know : t1 = t2 2 Fml for arbitrary terms ti and true and false are in Fml. 2. (:f), (f ^ y), (f _ y), (f ! y), (f $ y) are in Fml for arbitrary f;y 2 Fml. 3. 8v;f, 9v;f are in Fml for f 2 Fml and v : A 2 VSym. As an inline footnote we remark that the notation for conditional terms can also be used for formulas. The conditional formula (if f1 then f2 else f3) is equivalent to (f1 ^ f2) _ (:f1 ^ f3). If need arises we will make dependence of these definitions on S and T explicit by writing TrmA;S , FmlS or TrmA;T ;S , FmlT ;S . When convenient we will also use the redundant notation 8 A v;f, 9 A v;f for a variable v : A 2 VSym. Formulas built by clause (1) only are called atomic formulas. Definition 2.5. For terms t and formulas f we define the sets var(t), var(f) of all variables occurring in t or f and the sets fv(t), fv(f) of all variables with at least one free occurrence in t or f: var(v) = fvg fv(v) = fvg for v 2 VSym Sn Sn var(t) = i=1 var(ti) fv(t) = 1=i fv(ti) for t = f (t1;:::;tn) var(t) = var(f) [ fv(t) = fv(f) [ for t = var(t1) [ var(t2) fv(t1) [ fv(t2) (if f then t1 else t2) Sn Sn var(f) = i=1 var(ti) fv(f) = i=1 fv(ti) for f = p(t1;:::;tn) var(:f) = var(f) fv(:f) = fv(f) var(f) = var(f1) [ var(f2) fv(f) = fv(f1) [ fv(f2) for f = f1 ◦ f2 where ◦ is any binary Boolean operation var(Q v:f) = var(f) fv(Q v:f) = var(f) n fvg where Q 2 f8;9g A term without free variables is called a ground term, a formula without free variables a ground formula or closed formula. It is an obvious consequence of this definition that every occurrence of a variable v in a term or formula with empty set of free variables is within the scope of a quantifier Q v. One of the most important syntactical manipulations of terms and formulas are substitutions, that replace variables by terms. They will play a crucial role in proofs of quantified formulas as well as equations. Definition 2.6. A substitution t is a function that associates with every variable v a type compatible term t(v), i.e., if v is of type A then t(v) is a term of type A0 such that A0 v A. We write t = [u1=t1;:::;un=tn] to denote the substitution defined by dom(t) = fu1;:::;ung and t(ui) = ti. A substitution t is called a ground substitution if t(v) is a ground term for all v 2 dom(t). 26 2 First-Order Logic We will only encounter substitutions t such that t(v) = v for all but finitely many variables v. The set fv 2 VSym j t(v) 6= vg is called the domain of t. It remains to make precise how a substitution t is applied to terms and formulas. Definition 2.7. Let t be a substitution and t a term, then t(t) is recursively defined by: 1. t(x) = x if x 62 dom(t) 2. t(x) as in the definition of t if x 2 dom(t) 3. t( f (t1;:::;tk)) = f (t(t1);:::;t(tk)) if t = f (t1;:::;tk) Let t be a ground substitution and f a formula, then t(f) is recursive defined 4. t(true) = true, t(false) = false 5. t(p(t ;:::;t )) = p(t(t );:::;t(t )) if f is the atomic formula p(t ;:::;t ) :1 k : 1 k 1 k 6. t(t1 = tk) = t(t1) = t(tk) 7. t(:f) = :t(f) 8. t(f1 ◦ f2) = t(f1) ◦ t(f2) for propositional operators ◦ 2 f^;_;!;$g 9. t(Qv:f) = Qv:tv(f) for Q 2 f9;8g and dom(tv) = dom(t) n fvg with tv(x) = t(x) for x 2 dom(tv). There are some easy conclusions from these definitions: 0 0 • If t 2 TrmA then t(t) is a term of type A with A v A.