HOL Light Tutorial John Harrison Intel Corporation, RA2-406 2501 NW 229th Avenue Hillsboro, OR 97124 USA [email protected] January 14, 2017 Abstract The HOL Light theorem prover can be difficult to get started with. While the manual is fairly detailed and comprehensive, the large amount of background information that has to be absorbed before the user can do anything interesting is intimidating. Here we give an alternative ‘quick start’ guide, aimed at teaching basic use of the system quickly by means of a graded set of examples. Some readers may find it easier to absorb; those who do not are referred after all to the standard manual. “Shouldn’t we read the instructions?” “Do I look like a sissy?” Calvin & Hobbes, 19th April 1988 1 Contents 1 Installation 5 1.1 Cygwin . .5 1.2 OCaml . .5 1.3 HOL Light . .5 1.4 Checkpointing . .8 1.5 Other versions of HOL . .9 2 OCaml toplevel basics 10 3 HOL basics 12 3.1 Terms . 12 3.2 Types . 13 3.3 Theorems . 14 3.4 Derived rules . 16 4 Propositional logic 17 4.1 Proving tautologies . 19 4.2 Low-level logical rules . 21 4.3 Logic design and verification . 22 5 Equations and functions 24 5.1 Curried functions . 26 5.2 Pairing . 27 5.3 Equational reasoning . 28 5.4 Definitions . 31 6 Abstractions and quantifiers 31 6.1 Quantifiers . 33 6.2 First-order reasoning . 35 7 Conversions and rewriting 37 7.1 Conversionals . 38 7.2 Depth conversions . 39 7.3 Matching . 40 7.4 Rewriting . 42 8 Tactics and tacticals 44 8.1 The goalstack . 45 8.2 Inductive proofs about summations . 52 9 HOL’s number systems 54 9.1 Arithmetical decision procedures . 56 9.2 Nonlinear reasoning . 58 9.3 Quantifier elimination . 61 2 10 Inductive definitions 62 10.1 The bug puzzle . 64 10.2 Verification of concurrent programs . 68 11 Wellfounded inductionp 71 11.1 Irrationality of 2 ............................ 73 11.2 Wellfoundedness . 75 12 Changing proof style 75 12.1 Towards more readable proofs . 76 12.2 Example . 78 12.3 The right style? . 81 13 Recursive definitions 82 13.1 Binomial coefficients . 85 13.2 The binomial theorem . 87 14 Sets and functions 90 14.1 Choice and the select operator . 92 14.2 Function calculus . 93 14.3 Some cardinal arithmetic . 96 15 Inductive datatypes 100 15.1 Enumerated types . 100 15.2 Recursive types . 101 15.3 The Fano plane . 105 16 Semantics of programming languages 109 16.1 Semantics of the language . 110 16.2 Determinism . 112 16.3 Weakest preconditions . 114 16.4 Axiomatic semantics . 115 17 Shallow embedding 116 17.1 State and expressions . 116 17.2 Commands . 117 17.3 Hoare rules . 121 17.4 Verification conditions . 125 17.5 Refinement . 129 18 Number theory 131 18.1 Congruences . 133 18.2 Fermat’s Little Theorem . 134 18.3 RSA encryption . 140 3 19 Real analysis 143 19.1 Chebyshev polynomials . 143 19.2 A trivial part of Sarkovskii’s theorem . 148 19.3 Derivatives . 151 20 Embedding of logics 152 20.1 Modal logic . 152 20.2 Deep embedding . 152 20.3 Modal schemas . 154 20.4 Shallow embedding . 162 21 HOL as a functional programming language 163 21.1 Normalizing if-then-else expressions . 164 21.2 Proving properties . 167 21.3 A theorem prover . 172 21.4 Execution . 175 22 Vectors 178 22.1 3-dimensional vectors . 182 22.2 Cross products . 183 23 Custom tactics 185 23.1 The Kochen-Specker paradox . 185 23.2 Formalization in HOL . 186 24 Defining new types 191 24.1 Nonzero 3-vectors . 191 24.2 The projective plane again . 193 24.3 Quotient types . 195 25 Custom inference rules 198 25.1 Ordered rewriting using the LPO . 199 25.2 Critical pairs . 201 25.3 Examples of completion . 205 26 Linking external tools 208 26.1 Maxima . 208 26.2 Interfacing HOL and Maxima . 209 26.3 Factoring . 212 26.4 Antiderivatives and integrals . 213 A The evolution of HOL Light 216 A.1 LCF . 216 A.2 HOL . 218 A.3 Development and applications . 219 A.4 hol90, ProofPower and HOL Light . 220 4 1 Installation HOL Light can fairly easily be made to work on most modern computers. Since the first version (Harrison 1996a), the build process has been simplified considerably. In what follows, we will sometimes assume a Unix-like environment such as Linux. If the reader has access to a Linux machine and feels comfortable with it, its use is rec- ommended. However, users of Windows need not despair, because all the Unix tools needed, and many more useful ones besides, are freely available as part of Cygwin. Non-Windows users, or Windows users determined to work “natively”, can skip the next subsection. 1.1 Cygwin Cygwin is a Linux-like environment that can be run within Windows, without interfer- ing with normal Windows usage. Among other things, it provides a traditional shell from which the usual Unix/Linux software tools are available. Cygwin can be freely downloaded from http://www.cygwin.com/. It is a large system, particularly if you select all the package installation options, so the download and installation can take some time. However it usually seems to be straightforward and unproblematic. After installing Cygwin, simply start a ’Bash shell’. On my Windows machine, for example, I follow the menu sequence Start ! All Programs ! Cygwin ! Cygwin bash shell. This application is a ‘shell’ (Unix jargon for something analogous to a Windows command prompt) from which the later commands below can be invoked as if you were within Linux. We will hereinafter say ‘Linux’ when we mean Linux, some other version of Unix, or Cygwin inside Windows. 1.2 OCaml HOL Light is built on top of the functional programming language Objective CAML (‘OCaml’). To be more precise, HOL Light is written in OCaml and the OCaml read- eval-print loop is the usual means of interacting with HOL Light. So installing OCaml is a prerequisite for using HOL Light. Besides, it is a powerful modern programming language with much to recommend it for a wide range of other applications. OCaml can be installed on a wide range of architectures by following the instruc- tions on the Web site http://caml.inria.fr/ocaml/english.en.html. I normally rebuild the system from sources, even under Cygwin (it only requires a few short commands) but precompiled binaries are available for many platforms. 1.3 HOL Light Finally we are ready to install HOL Light itself. You can download the system by following the link from the HOL Light homepage http://www.cl.cam.ac.uk/ ˜jrh13/hol-light/index.html. The downloaded file can easily be unpacked into its constituent parts by doing the following, assuming the downloaded file is called hol_light.tar.gz in the current directory of the shell: 5 tar xvfz hol_light.tar.gz This will create a directory (folder) called hol_light containing the constituent source files. In a pure Windows environment, when you download the hol_light.tar.gz file, or click on it after first saving it, you will automatically be confronted with the Windows WinZip utility, which will display the list of constituent files. By selecting Extract you can save them all to a folder of your choice, say hol_light. Either at the shell prompt (Linux) or the command prompt (in Windows, usually available via the Accessories menu), move into the appropriate directory by: cd hol_light The first step is to create a special file used by HOL Light to handle parsing and printing within OCaml. In Linux you can just do: make In Windows, you need to issue by hand some commands contained in the Makefile. First check the version of OCaml that you have (e.g. by typing ocaml and observing the version number in the startup banner, then exiting it). Copy the appropriately numbered file pa_j_XXX.ml into the bare pa_j.ml. For example, if running Ocaml version 3.08.2, do copy pa_j_3.08.2.ml pa_j.ml If there isn’t a pa_j_XXX.ml that precisely matches your OCaml version number, pick the closest one; it will probably work. However, versions older than 3.04 have not been tried. Next, issue this command: ocamlc -c -pp "camlp4r pa_extend.cmo q_MLast.cmo" -I +camlp4 pa_j.ml There should now be a file called pa_j.cmo in the current directory. (You can check that it’s there by a directory listing, ls in Linux or dir in Windows.) Now start up an interactive OCaml session by: ocaml or under Cygwin and any other systems where the OCaml num library for arbitrary- precision rational cannot be dynamically loaded: ocamlnum You should see something like this (though the precise OCaml version number may well be a little different). /home/johnh/hol_light$ ocaml Objective Caml version 3.08.2 # 6 This is what it feels like to.