Isabelle/Isar: from Primitive Natural Deduction to Structured Mathematical Reasoning Makarius 27-June-2005 1. Representing Proofs 2. Isabelle/Isar Foundations 3. The Isar Proof Language 4. Advanced Techniques 1. Representing Proofs Primitive Natural Deduction (1) AB (∧I ) A ∧ B (∧E ) A ∧ B (∧E ) A ∧ B A 1 B 2 [A. ] [B. ] . A (∨I ) B (∨I ) A ∨ B C C (∨E) A ∨ B 1 A ∨ B 2 C [A. ] . B (−→I ) A −→ BA (−→E) A −→ B B [x. ] . B(x) ∀ x. B(x) (∀ I ) (∀ E) ∀ x. B(x) B(t) 1. Representing Proofs 2 Primitive Natural Deduction (2) Observations: • nice in theory • cute in small teaching tools • cumbersome in realistic applications • not quite natural after all . [x, B. (x)] . B(t) ∃ x. B(x) C (∃ I ) (∃ E) ∃ x. B(x) C 1. Representing Proofs 3 Mathematical vernacular Example: [Davey and Priestley, 1990, pages 93–94] The Knaster-Tarski Fixpoint Theorem. Let L be a complete lattice and f : L → L an order-preserving map. Then d {x ∈ L | f (x) ≤ x} is a fixpoint of f. Proof. Let H = {x ∈ L | f (x) ≤ x} and a = d H. For all x ∈ H we have a ≤ x, so f (a) ≤ f (x) ≤ x. Thus f (a) is a lower bound of H, whence f (a) ≤ a. We now use this inequality to prove the reverse one (!) and thereby complete the proof that a is a fixpoint. Since f is order-preserving, f (f (a)) ≤ f (a). This says f (a) ∈ H, so a ≤ f (a). Question: How can we do actual formalized mathematics? 1. Representing Proofs 4 The Mizar system Mizar [A. Trybulec et al., since ≈ 1973] • Original motivation: verification environment for ALGOL programs (the name MIZAR is a pun on that) • Large library of formalized mathematics — ”Journal of Formalized Mathematics” [Vol. 1–12, 1990–2004] • Mathematical proof language (!) • Logical foundations: – classical first-order logic – builtin classical reasoning (decomposition and terminal steps) – some special support for ”schemes” (e.g. induction) – typed set-theory (Tarski-Grothendieck) – builtin concept of abstract mathematical structures • Main problem: monolithic system (no formal record on derivations, no interfaces for extensions, program sources not generally available) 1. Representing Proofs 5 The Isabelle/Isar system Isabelle [L.C. Paulson and T. Nipkow, since ≈ 1986] • Generic logical framework for higher-order Natural Deduction • Syntax: simply-typed λ-calculus with αβη-conversion, builtin support for higher-order unification • Deduction: minimal higher-order logic with implication A =⇒ B, quantifi- cation Vx. B(x), and equality t ≡ u Isar [M. Wenzel, since ≈ 1999] • “Intelligible semi-automated reasoning” • simple logical foundations, inherited from Isabelle/Pure • generic – common object-logics may benefit from Isar immediately • succinct language design, few basic principles, several derived concepts • incremental proof processing, interactive development and debugging • final proof texts intelligible without replay on the machine (requires some care of the author) 1. Representing Proofs 6 Example: Isabelle/Isar proof text theorem Knaster-Tarski: assumes mono: Vx y. x ≤ y =⇒ f x ≤ f y shows f (d {x. f x ≤ x}) = d {x. f x ≤ x} (is f ?a = ?a) proof − have ∗: f ?a ≤ ?a (is - ≤ d ?H ) proof fix x assume H : x ∈ ?H then have ?a ≤ x .. also from H have f ... ≤ x .. moreover note mono finally show f ?a ≤ x . qed also have ?a ≤ f ?a proof from mono and ∗ have f (f ?a) ≤ f ?a . then show f ?a ∈ ?H .. qed finally show f ?a = ?a . qed 1. Representing Proofs 7 Example: Isabelle/Pure proof term Knaster-Tarski ≡ λH : -. order-antisym · - · - · (Inter-greatest · - · - · (λX Ha: -. order-subst2 · - · - · f · - · (Inter-lower · - · - · Ha) · (iffD1 · - · - · (mem-Collect-eq · - · (λx. f x ≤ x)) · Ha) · H )) · (Inter-lower · - · - · (iffD2 · - · - · (mem-Collect-eq · - · (λu. f u ≤ u)) · (H · f (d {x. f x ≤ x}) · d {x. f x ≤ x} · (Inter-greatest · - · - · (λX Ha: -. order-subst2 · - · - · f · - · (Inter-lower · - · - · Ha) · (iffD1 · - · - · (mem-Collect-eq · - · (λx. f x ≤ x)) · Ha) · H ))))) 1. Representing Proofs 8 2. Isabelle/Isar Foundations Isabelle/Pure syntax and rules prop type of propositions =⇒ :: prop ⇒ prop ⇒ prop implication (right-associative infix) V :: (α ⇒ prop) ⇒ prop universal quantifier (binder) ≡ :: α ⇒ α ⇒ prop equality relation (infix) [A. ] . B (=⇒I ) A =⇒ BA (=⇒E) A =⇒ B B [x. ] . B(x) Vx. B(x) (VI ) (VE) Vx. B(x) B(t) Axioms for t ≡ u: α, β, η, refl, subst, ext, iff 2. Isabelle/Isar Foundations 10 Pure formulae vs. inferences (1) Define the following sets: x variables A atomic formulae, i.e. no outermost =⇒/V Vx∗. A∗ =⇒ A Horn Clauses def H = Vx∗. H∗ =⇒ A Harrop Formulas def G = H ∪ #H Goal Clauses (# ≡ λA. A) Notes: • Outermost quantification Vx. B x is always represented via schematic variables B ?x • (A =⇒ (Vx. B x)) ≡ (Vx. A =⇒ B x) holds, i.e. every Pure formula may be put into Harrop Form • the goal marker # makes any Harrop Formula appear atomic 2. Isabelle/Isar Foundations 11 Pure formulae vs. inferences (2) Examples: AB Horn: A =⇒ B =⇒ A ∧ B A ∧ B [A. ] . B Harrop: (A =⇒ B) =⇒ A −→ B A −→ B [n, P. n] . P 0 P (Suc n) Harrop: P 0 =⇒ (Vn. P n =⇒ P (Suc n)) =⇒ P n P n Goal: (A =⇒ B =⇒ B) =⇒ (A =⇒ B =⇒ A) =⇒ #(A ∧ B −→ B ∧ A) 2. Isabelle/Isar Foundations 12 Rules for goal directed proof (1) #A (init) (conclude) A =⇒ #A A rule: A~ ~a =⇒ B ~a goal:(V~x. H~ ~x =⇒ B 0 ~x) =⇒ C goal unifier:(λ~x. B (~a~x)) θ = B 0θ (resolve) (V~x. H~ ~x =⇒ A~ (~a~x)) θ =⇒ C θ goal:(V~x. H~ ~x =⇒ A ~x) =⇒ C assm unifier: A θ = H θ (for some H ) i i (assumption) C θ 2. Isabelle/Isar Foundations 13 Example: tactical proving in Isabelle lemma A ∧ B −→ B ∧ A apply (rule impI ) apply (erule conjE) apply (rule conjI ) apply assumption apply assumption done lemma (∃ x. ∀ y. R x y) −→ (∀ y. ∃ x. R x y) apply (rule impI ) apply (erule exE) apply (rule allI ) apply (erule allE) apply (rule exI ) apply assumption done 2. Isabelle/Isar Foundations 14 Rules for goal directed proof (2) The key rule for Isar: subproof : G~ ~a =⇒ B ~a goal:(V~x. H~ ~x =⇒ B 0 ~x) =⇒ C goal unifier:(λ~x. B (~a~x)) θ = B 0θ assm unifiers:(λ~x. G (~a~x)) θ = #H θ (for marked G some #H ) j i j i (refine) (V~x. H~ ~x =⇒ G~ 0 (~a~x)) θ =⇒ C θ Corresponds to canonical proof decomposition: have Vx. A x =⇒ B x proof − fix x assume A x show B x hproof i qed 2. Isabelle/Isar Foundations 15 3. The Isar Proof Language Isar primitives apply meth unstructured refinement done unstructured ending proof meth? structured refinement qed meth? structured ending { open block } close block next switch block let pat = t term abbreviation note a = bs reconsidered facts fix ~x universal parameters assm rule a: A~ generic assumptions then indicate forward-chaining of facts have a: A local claim show a: A local claim, result refines goal 3. The Isar Proof Language 17 Derived elements assume = assm discharge# presume = assm discharge def x ≡ t = fix x assm expand x ≡ t hence = then have thus = then show from a = note a then with a = from a and this by meth1 meth2 = proof meth1 qed meth2 .. = by rule . = by this Γ ∪ A~ ` C Γ ∪ A~ ` C (discharge#) (discharge) Γ ` #A~ =⇒ C Γ ` A~ =⇒ C Γ ∪ x ≡ t ` C t (expand) Γ ` C x 3. The Isar Proof Language 18 The Isar/VM interpretation process Isar/VM = much book-keeping + some Isabelle/Pure inferences Important fields in the machine state (block-structured): fixes context of locally fixed variables assms context of local assumptions, each with discharge rule facts environment of local facts goal (optional) enclosing problem to be worked on Some notable facts: “prems” current assumptions “this” most recently established fact “calculation” scratch-pad for calculational reasoning 3. The Isar Proof Language 19 Example: structured proofs in Isar lemma (∃ x. ∀ y. R x y) −→ (∀ y. ∃ x. R x y) proof assume ∃ x. ∀ y. R x y then show ∀ y. ∃ x. R x y proof lemma A ∧ B −→ B ∧ A fix a proof assume ∗: ∀ y. R a y assume A ∧ B show ∀ y. ∃ x. R x y then show B ∧ A proof proof fix y assume B and A show ∃ x. R x y then show B ∧ A .. proof qed fix b qed from ∗ show R a b .. qed qed qed qed 3. The Isar Proof Language 20 4. Advanced Techniques Generalized elimination def obtain ~x where B~ ~x hproof i = have reduction: Vthesis. (V~x. B~ ~x =⇒ thesis) =⇒ thesis hproof i fix ~x assm eliminate reduction B~ ~x Γ ` Vthesis. (V~x. B~ ~x =⇒ thesis) =⇒ thesis Γ ∪ B~ ~y ` C (eliminate) Γ ` C Canonical proof patterns: assume ∃ x. B x then obtain x where B x .. assume A ∧ B then obtain A and B .. 4. Advanced Techniques 22 Example: forward elimination lemma A ∧ B −→ B ∧ A proof assume A ∧ B then obtain B and A .. then show B ∧ A .. qed lemma (∃ x. ∀ y. R x y) −→ (∀ y. ∃ x. R x y) proof assume ∃ x. ∀ y. R x y then obtain a where ∗: ∀ y. R a y .. { fix b from ∗ have R a b .. then have ∃ x. R x b .. } then show ∀ y. ∃ x. R x y .. qed 4. Advanced Techniques 23 Calculational reasoning also = note calculation = this initially also = note calculation = r · (calculation @ this) for r ∈ T finally = also from calculation moreover = note calculation = calculation @ this ultimately = moreover from calculation def T = {x = y =⇒ y = z =⇒ x = z, x ≤ y =⇒ y ≤ z =⇒ x ≤ z,...} Canonical proof pattern: have a = b hproof i also have ..