Verifikation reaktiver Systeme - Universität Kaiserslautern

224
Proofs For a logician, a formal proof is a sequence, each of whose elements
is either an axiom or follows from earlier members of the sequence by a rule of
inference. A theorem is the last element of a proof. In HOL (following LCF), this
consists in applying ML functions representing rules of inference to axioms or
previously generated theorems. Thus, every value of type thm in the HOL system
can be obtained by repeatedly applying primitive inference rules to axioms. Some
examples are:
– Undischarging (UNDISCH):
– Symmetry of equality (SMY):
Γ ⊢ t 1 ⇒ t 2
Γ, t 1 ⊢ t 2
– Transitivity of equality (TRANS):
Γ ⊢ t 1 = t 2
Γ ⊢ t 2 = t 1
Γ 1 ⊢ t 1 = t 2 Γ 2 ⊢ t 2 = t 3
Γ 1 ∪ Γ 2 ⊢ t 1 = t 3
One of the most important and most powerful inference rules is rewriting
(REWRITE_RULE) which does a limited amount of automatic theorem-proving. It
uses a list of equational theorems (Γ ⊢ t 1 = t 2 ) to replace any subterms of an
object theorem that match t 1 by the corresponding instance of t 2 . Conditional
and recursive rewriting is supported, too.
Tactics A forward proof (the style that is described in the last paragraph) is
quite unnatural and too low level for many applications (possibly consisting of
millions of steps). In the early 1970s, Robin Milner invented the notion of tactics,
which was an important advance in proof generating methodology. In short, a
tactic is a function that does two things: it splits a goal into subgoals and keeps
track of the reason why solving the subgoals will solve the goal. Consider, for
example, the rule of ∧ introduction:
Γ 1 ⊢ t 1 Γ 2 ⊢ t 2
Γ 1 ∪ Γ 2 ⊢ t 1 ∧ t 2
Suppose the goal is to prove A ∧ B. Thus, it is sufficient to prove A and B.
The justification for the reduction of the goal A ∧ B to the two subgoals A and
B is the rule of ∧-introduction. The specified HOL tactic CONJ_TAC is:
t 1 /\ t 2
t 1 t 2
The following examples illustrates the use of tactics in the HOL system. A
goal specified by g is reduced to two subgoals by applying the tactic CONJ_TAC.