Proof checking with PVS Book: Chapter 3 1

A Theory Name: THEORY BEGIN Definitions (types, variables, constants) Axioms Lemmas (conjectures, theorems) END Name 2

Group theory (*, e), where * is the operator and e the unity element. Associativity (G1): (x*y)*z=x*(y*z). Unity (G2): (x*e)=x Right complement (G3): x y x*y=e. Want to prove: x y y*x=e. 3

Informal proof =y*(x*(y*z)) (by G1) Choose x arbitrarily. By G3, there exists y s.t. (1) x*y=e. By G3, we have z s.t. (2) y*z=e. y*x=(y*x)*e (by G2) =(y*x)*(y*z) (by (2)) =y*(x*(y*z)) (by G1) =y*((x*y)*z) (by G1) =y*(e*z) (by (1)) =(y*e)*z (by G1) =y*z (by (G2)) =e (by (2)) 4

Example: groups Group: THEORY BEGIN element: TYPE unit: element *: [element, element-> element] < some axioms> left:CONJECTURE FORALL (x: element): EXISTS (y: element): y*x=unit END Group 5

Axioms associativity: AXIOM FORALL (x, y, z:element): (x*y)*z=x*(y*z) unity: AXIOM FORALL (x:element): x*unit=x complement: AXIOM FORALL(x:element): EXISTS (y:element): x*y=unity 6

Skolemization Corresponds to choosing some arbitrary constant and proving “without loss of generality”. Want to prove (…/\…)->(…\/x(x)\/…). Choose a new constant x’. Prove (…/\…)-->(…\/(x’)\/…). 7

Skolemization Corresponds to choosing some unconstrained arbitrary constant when one is known to exist. Want to prove (…/\x(x)/\…)-->(…\/…). Choose a new constant x’. Prove (…/\(x’)/\…)-->(…\/…). 8

Skolem in PVS (skolem 2 (“a1” “b2” “c7”)) (skolem -3 (“a1” “_” “c7”)) (skolem! -3) invents new constants, e.g., for x will invent x!1, x!2, … when applied repeatedly. 9

Instantiation Corresponds to restricting the generality. Want to prove (…/\x(x)/\…)-->(…\/…). Choose a some term t. Prove (…/\(t)/\…)-->(…\/…). 10

Instantiation Corresponds to proving the existence of an element by showing an evidence. Want to prove (…/\…)-->(…\/x(x)\/…). Choose some term t. Prove (…/\…)-->(…\/(t)\/…). 11

Instantiating in PVS (inst -1 “x*y” “a” “b+c”) (inst 2 “a” “_” “x”) 12

Other useful rules (replace -1 (-1 2 3)) Formula -1 is of the form le=ri. Replace any occurrence of le by ri in lines -1, 2, 3. (replace -1 (-1 2 3) RL) Similar, but replace ri by le instead. (assert), (assert -) (assert +) (assert 7) Apply algebraic simplification. (lemma “<axiom-name>”) - add axiom as additional antecedent. 13