Practical proof reconstruction for first-order logic and - PowerPoint PPT Presentation

Practical proof reconstruction for first-order logic and set-theoretical constructions Cl´ ement Hurlin January 25, 2007

Outline 1 Introduction Two different worlds Proof reconstruction General procedure Targeted languages 2 Quantifier free first-order logic 3 First-order logic without existential quantifiers 4 Full first-order logic 5 Set-theoretical constructions Tactic-style Reflection Performances 6 Conclusion and further work 2

1 Introduction Two different worlds Interactive tools Automatic tools Higher order logic. First-order logic (FOL). A few automatic tactics. Very efficient. Yet, does not handle big Large piece of code: formulas. difficult to prove High degree of confidence soundness. ( e.g. Isabelle or Coq). 3

1 Introduction Proof reconstruction Proof search in a tool and verification in another one. Combination of an automatic and an interactive tool. Advantages: ◮ automation of the first. ◮ soundness and expressiveness of the latter. Very generic approach. In our work: integration of haRVey within Isabelle. 4

� � � 1 Introduction General procedure haRVey Isabelle � ¬ F F proof certified � proof search proof trace proof trace Procedure 5

� � � � 1 Introduction General procedure F (validity) Isabelle haRVey ¬ F (satisfiability) � � �������������� � � � � � � � � � � � � ¬ F unsatisfiable ¬ F satisfiable Isabelle reconstruction failure The proof is entirely certified by the Isabelle kernel. The proof trace must be expressive enough for an automatic certification. Thus, no user interaction at all. 6

1 Introduction Targeted languages First-order logic. Set-theoretical constructions: ( X ∩ Y = ∅ ) ∧ ( X \ Z = X ) ∧ ( Y ∩ Z � = ∅ ) − → X ∩ ( Y ∪ Z ) = ∅ , With a few restrictions, set-theoretical constructions can be reduced to first-order logic. They are encountered when using B or TLA+. 7

1 Introduction Targeted languages A ⊂ ( { a, b } ∩ D ) (SET) ∀ x. [ A ( x ) − → ( x = a ∨ x = b ) ∧ D ( x )] ∧ ∃ x. [ ¬ A ( x ) ∧ ( x = a ∨ x = b ) ∧ D ( x )] (FOL) ∀ x. [ A ( x ) − → ( x = a ∨ x = b ) ∧ D ( x )] ∧ � � ¬ A ( c ) ∧ ( c = a ∨ c = b ) ∧ D ( c ) ( ∀ FOL) � � A ( a ) − → ( a = a ∨ a = b ) ∧ D ( a ) ∧ � � A ( b ) − → ( b = a ∨ b = b ) ∧ D ( b ) ∧ � � A ( c ) − → ( c = a ∨ c = b ) ∧ D ( c ) ∧ � � ¬ A ( c ) ∧ ( c = a ∨ c = b ) ∧ D ( c ) (QF-FOL) 8

2 Quantifier free first-order logic Previous work by Pascal Fontaine, Stephan Merz et al . Uses a congruence closure algorithm. This algorithm decide satisfiability of formulas containing uninterpreted symbols and equalities. It builds equivalence classes between equal terms. 9

2 Quantifier free first-order logic Previous work by Pascal Fontaine, Stephan Merz et al . Uses a congruence closure algorithm. This algorithm decide satisfiability of formulas containing uninterpreted symbols and equalities. It builds equivalence classes between equal terms. Given the following hypotheses : a = b, f ( b ) = f ( c ). a c b f ( a ) f ( b ) f ( c ) 9

2 Quantifier free first-order logic Previous work by Pascal Fontaine, Stephan Merz et al . Uses a congruence closure algorithm. This algorithm decide satisfiability of formulas containing uninterpreted symbols and equalities. It builds equivalence classes between equal terms. Given the following hypotheses : a = b, f ( b ) = f ( c ). a c b f ( a ) f ( b ) f ( c ) 9

2 Quantifier free first-order logic Previous work by Pascal Fontaine, Stephan Merz et al . Uses a congruence closure algorithm. This algorithm decide satisfiability of formulas containing uninterpreted symbols and equalities. It builds equivalence classes between equal terms. Given the following hypotheses : a = b, f ( b ) = f ( c ). a c b C f ( a ) f ( b ) f ( c ) 9

2 Quantifier free first-order logic Properties Reasoning is reconstructed by following the path between terms. This allows to reconstruct the proof in a straight-forward way. Reasoning can be decomposed into 4 simple rules: 10

2 Quantifier free first-order logic Properties Reasoning is reconstructed by following the path between terms. This allows to reconstruct the proof in a straight-forward way. Reasoning can be decomposed into 4 simple rules: 1 substitution and contradiction [ [ s = t ; P ( s ); ¬ P ( t )] ] = ⇒ False. 10

2 Quantifier free first-order logic Properties Reasoning is reconstructed by following the path between terms. This allows to reconstruct the proof in a straight-forward way. Reasoning can be decomposed into 4 simple rules: 1 substitution and contradiction [ [ s = t ; P ( s ); ¬ P ( t )] ] = ⇒ False. 2 contradiction [ [ s = t ; s � = t ] ] = ⇒ False. 10

2 Quantifier free first-order logic Properties Reasoning is reconstructed by following the path between terms. This allows to reconstruct the proof in a straight-forward way. Reasoning can be decomposed into 4 simple rules: 1 substitution and contradiction [ [ s = t ; P ( s ); ¬ P ( t )] ] = ⇒ False. 2 contradiction [ [ s = t ; s � = t ] ] = ⇒ False. 3 congruence [ [ f = g ; x = y ] ] = ⇒ f ( x ) = g ( y ) . 10

2 Quantifier free first-order logic Properties Reasoning is reconstructed by following the path between terms. This allows to reconstruct the proof in a straight-forward way. Reasoning can be decomposed into 4 simple rules: 1 substitution and contradiction [ [ s = t ; P ( s ); ¬ P ( t )] ] = ⇒ False. 2 contradiction [ [ s = t ; s � = t ] ] = ⇒ False. 3 congruence [ [ f = g ; x = y ] ] = ⇒ f ( x ) = g ( y ) . 4 reflexivity, symmetry and transitivity of equality [ [ a = b ; c = b ] ] = ⇒ a = c. 10

� � � 2 Quantifier free first-order logic haRVey Isabelle � ¬ F F ∈ QF-FOL CC certified � proof search proof trace proof trace Procedure for QF-FOL 11

3 First-order logic without existential quantifiers Brute force instantiation of universal quantifiers: � � ∀ x.P ( x ) − → P ( a 1 ) ∧ · · · ∧ P ( a n ) where { a 1 , . . . , a n } is the Herbrand universe. Terminates if: (i) Instantiations are selected in a fair way. (ii) Formula is unsatisfiable. 12

3 First-order logic without existential quantifiers Brute force instantiation of universal quantifiers: � � ∀ x.P ( x ) − → P ( a 1 ) ∧ · · · ∧ P ( a n ) where { a 1 , . . . , a n } is the Herbrand universe. Terminates if: (i) Instantiations are selected in a fair way. (ii) Formula is unsatisfiable. Efficiency: certifying instantiations does not deal with the logical structure of the formula. � � a � = b ∧ ( P ∧ ¬ Q ) ∨ ∀ x.x = a 12

3 First-order logic without existential quantifiers Brute force instantiation of universal quantifiers: � � ∀ x.P ( x ) − → P ( a 1 ) ∧ · · · ∧ P ( a n ) where { a 1 , . . . , a n } is the Herbrand universe. Terminates if: (i) Instantiations are selected in a fair way. (ii) Formula is unsatisfiable. Efficiency: certifying instantiations does not deal with the logical structure of the formula. � � a � = b ∧ ( P ∧ ¬ Q ) ∨ ∀ x.x = a becomes � � a � = b ∧ ( P ∧ ¬ Q ) ∨ ∀ x.x = a ∧ ∧ ( ∀ x. [ x = a ] − → a = a ) ∧ ( ∀ x. [ x = a ] − → b = a ) 12

3 First-order logic without existential quantifiers A boolean abstraction mechanism is used to handle the boolean structure of the formula This stage is reconstructed by calling a SAT solver (previous work by Tjark Weber): � � a � = b ∧ ( P ∧ ¬ Q ) ∨ ∀ x.x = a becomes � � a � = b ∧ ( P ∧ ¬ Q ) ∨ ∀ x.x = a ∧ ( ∀ x. [ x = a ] − → a = a ) ∧ ( ∀ x. [ x = a ] − → b = a ) 13

3 First-order logic without existential quantifiers A boolean abstraction mechanism is used to handle the boolean structure of the formula This stage is reconstructed by calling a SAT solver (previous work by Tjark Weber): � � a � = b ∧ ( P ∧ ¬ Q ) ∨ ∀ x.x = a becomes � � a � = b ∧ ( P ∧ ¬ Q ) ∨ ∀ x.x = a ∧ � �� � � �� � B ¬ A ( ∀ x. [ x = a ] − → a = a ) ∧ ( ∀ x. [ x = a ] − → b = a ) � �� � � �� � � �� � � �� � C A B B 13

� � � � � 3 First-order logic without existential quantifiers haRVey Isabelle ′ ∈ ∀ FOL � ¬ F ′ F CC certified � instantiations F ∈ QF-FOL F instantiations certified CC proof trace proof trace Procedure for ∀ FOL 14

3 First-order logic without existential quantifiers With a proof trace consisting solely of strings, most of the time was spent parsing the trace! The proof trace is now written in ML. example However formulas are still strings (thus frequent calls to the Isabelle parser) Currently, arguing between Nancy and Munich to switch to a proof trace completely in ML or in XML format. 15

4 Full first-order logic Universal and existential quantifiers. Pre-processing: existential quantifiers removed by skolemization. haRVey’s implements inner skolemization. 16