Verifikation reaktiver Systeme - Universität Kaiserslautern

229
in
out
0
1
1
1 REG
0
REG
1
Fig. 3. Schematic diagram of the parity checker
This is proved in two steps: At first, the PARITY LEMMA lemma shows how the
output is calculated from the previous time step and the input, provided that
inp and out are related as in the schematic diagram.
g‘!inp out. PARITY_IMP(inp,out) ==>
(out 0 = T) /\ !t. out(SUC t) = if inp(SUC t) then ~(out t) else out t‘;
e(PURE_REWRITE_TAC [PARITY_IMP_def, ONE_def, NOT_def, MUX_def, REG_def]);
e(REPEAT STRIP_TAC);
e(PROVE_TAC[]);
e(PAT_ASSUM ‘‘!t. out t = X t‘‘ (fn th => REWRITE_TAC [SPEC ‘‘SUC t‘‘ th]));
e(RW_TAC arith_ss []);
val PARITY_LEMMA = top_thm();
To prove this lemma, rewriting with definitions is used in the initial step,
followed by decomposing the resulting goal by applying STRIP TAC. The first part
can then be proven mechanically. For the second subgoal a specialised version
of the assumption !t. out t = X f is used before the final simplification step.
Having proven this lemma, it remains for the second part of the verification:
g‘!inp out. (out 0 = T) /\ (!t. out (SUC t) =
if inp (SUC t) then ~out t else out t) ==>
!t. out t = PARITY t inp‘;
e(REPEAT GEN_TAC);
e(STRIP_TAC);
e(Induct);
e(ASM_REWRITE_TAC[PARITY_def]);
e(ASM_REWRITE_TAC[PARITY_def]);
val UNIQUELESS_LEMMA = top_thm();
This proof illustrates the use of induction in the HOL system: After the
quantifiers and the left part of the implication have been removed from the
goal, the right part is split up by an induction on t (which is the outermost
universally quantified variable at that moment). The subgoals can be proved,
simply by rewriting with the assumptions.