General Computer Science 320201 GenCS I & II Lecture ... - Kwarc

A
∀X.A ∀I∗
[B/X](A)
∃X.A ∃I
∃X.A
∀X.A
[B/X](A) ∀E
[[c/X](A)] 1
C
.
C
∃E 1
∗ means that A does not depend on any hypothesis in which X is free.
c○: Michael Kohlhase 198
The intuition behind the rule ∀I is that a formula A with a (free) variable X can be generalized to
∀X.A, if X stands for an arbitrary object, i.e. there are no restricting assumptions about X. The
∀E rule is just a substitution rule that allows to instantiate arbitrary terms B for X in A. The
∃I rule says if we have a witness B for X in A (i.e. a concrete term B that makes A true), then
we can existentially close A. The ∃E rule corresponds to the common mathematical practice,
where we give objects we know exist a new name c and continue the proof by reasoning about this
concrete object c. Anything we can prove from the assumption [c/X](A) we can prove outright if
∃X.A is known.
With the ND calculus we have given a set of inference rules that are (empirically) complete for
all the proof we need for the General Computer Science courses. Indeed Mathematicians are
convinced that (if pressed hard enough) they could transform all (informal but rigorous) proofs
into (formal) ND proofs. This is however seldom done in practice because it is extremely tedious,
and mathematicians are sure that peer review of mathematical proofs will catch all relevant errors.
In some areas however, this quality standard is not safe enough, e.g. for programs that control nuclear
power plants. The field of “Formal Methods” which is at the intersection of mathematics and
Computer Science studies how the behavior of programs can be specified formally in special logics
and how fully formal proofs of safety properties of programs can be developed semi-automatically.
Note that given the discussion in Subsection 2.6.2 fully formal proofs (in sound calculi) can be
that can be checked by machines since their soundness only depends on the form of the formulae
in them.
105