Lecture Notes in Computer Science 3472

328 Levi Lúcio and Marko Samer
[Pau94, NPW02], a generic theorem prover which supports proof tactics 3 .Set
operations, predicate logic, and Cartesian products in Z can be directly translated
into Isabelle. The representation of schemas in Isabelle can be done in
several ways; Helke et al. [HNS97] chose a predicate representation (cf. Kolyang
et al. [KSW96]). For instance, the schema Counter resp. Increment in Sec. 12.2.1
is translated into the predicate Counter resp. Increment as shown below, where
λ identifies the free variables:
Counter ≡ λ ctr. [ ctr : N | 0 ≤ ctr < 4]
Increment ≡ λ(ctr, ctr ′ ). [ Counter(ctr) ∧ Counter(ctr ′ ) |
((ctr < 3) ∧ (ctr ′ = ctr +1))∨ ((ctr =3)∧ (ctr ′ =0))]
With this encoding of Z specifications, Isabelle can be applied to construct
test cases in such a way as described in the following. The approach of Helke
et al. [HNS97] is based on disjunctive normal form partitioning [DF93]. That
is, the predicate part of a schema is transformed into disjunctive normal form,
where the disjuncts are pairwise disjoint (i.e., the disjunction is equivalent to
the exclusive or of its disjuncts). Each of the resulting disjuncts is assumed to
define a equivalence class concerning the test behavior, and can therefore be
interpreted as a test case. The pairwise disjointness allows us to treat each test
case entirely independently. To obtain disjunctive normal form, the usual logical
transformation rules can be applied. To obtain pairwise disjointness, however,
disjunction, implication, and bi-implication have to be transformed according
to:
A ∨ B ≡ (A ∧¬B) ∨ (¬A ∧ B) ∨ (A ∧ B) (12.1)
A ⇒ B ≡ ¬A∨ (A ∧ B) (12.2)
A ⇔ B ≡ (A ∧ B) ∨ (¬A ∧¬B) (12.3)
The schemas of our example above are already in such a normal form (cf.
Sec. 12.2.1). The schema Counter consists of only one disjunct in the predicate
part and is therefore trivially in disjunctive normal form. Furthermore, the
schema Increment is also in disjunctive normal form. In this simple example,
it is easy to see that the disjuncts are pairwise disjoint because ctr < 3and
ctr = 3 are mutually exclusive. Nevertheless, for demonstration purposes, we ignore
our knowledge of the disjointness of the disjuncts and apply transformation
rule (12.1) to the schema Increment. Thus, we obtain the equivalent schema:
3 Proof tactics are “subroutines” written in a metalanguage for the purpose of supporting
the proof search procedure. For instance, they can be used to transform
proofs or to justify proof steps by autonomously performing detailed proof steps.