1. Course announcement Software Reliability Methods –Spring 06, Tu Th 9:30am-11:00am –Instructors: Ingolf Krueger, Ranjit Jhala, Sorin Lerner Topics: –Model checking –Program analysis –Type systems –Theorem proving

2. Administrative stuff On Tuesday –very brief overview of loop invariant inference –constructive logic –conclusion A week from today –final project presentations –from 11 to 11:50 (because of prospective student lunch, which I have to attend)

3. Inductionless induction Technique introduced by Musser in 1980 for proving properties of inductive structures Latter became known as inductionless induction, because it allows one to prove, without using induction, properties that look as though they would require induction

4. Inductionless induction The general idea is to prove statements by consistency checking –add the statement to be proven as an axiom to the base theory, and see if the resulting theory is consistent. –If it is, then conclude that the statement holds; if it doesn’t, then conclude that the statement doesn’t hold This approach is not sound in general, but it works in restricted cases

5. Inductionless induction Musser showed that this approach works for equality theories in the following sense: –if (1) A is a set of equality axioms about some abstract data type, one is which are booleans (with true and false) –(2) these abstract data types are fully specified by A (exact definition not important here, but essentially this guarantees a certain form of modularity between the defined types) –(3) A [ {t 1 = t 2 } is consisten, then A ² t 1 = t 2 so why are we seeing this today with rewrite systems, and not next class, with induction?

6. Use Knuth-Bendix Show that A [ { t 1 = t 2 } consistent or inconsistent using the Knuth-Bendix completion procedure Suppose A has already been converted to a canonical rewrite system (using Knuth-Bendix, for example), and that A has been shown to fully specify the abstract data types it mentions (there are automatic ways of doing this) To attempt to prove t 1 = t 2, one adds either t 1 ! t 2 or t 2 ! t 1 to the system, and then we run Knuth-Bendix

7. Three possible outcomes If the completion procedure finishes with a rewrite system that does not contain the rule true ! false, then t 1 = t 2 is entailed by A If the completion procedure finishes with a rewrite system that contains the rule true ! false, then t 1 = t 2 is not entailed by A If the completion procedure fails or runs forever, nothing can be concluded

8. Example Types: –x : character, s : string, s’ : string –null : string (empty string) –s::x : string (s with character x added at the end) –x::s : string (s with character x added to the front) –s + s’ : string (concatentation of s and s’) –isNull(s) : boolean

9. Example Axioms (axioms for booleans not shown) (s = s) = true (null = s::x) = false (s::x = null) = false (s::x = s’::x’) = (x = x’) and (s = s’) x::null = null::x x::(s::x’) = (x::s)::x’ null + s = s (s::x’) + s’ = s + (x’::s’) isnull(null) = true isnull(s::x) = false

10. Example Show: s + (s’::x) = (s+s’)::x One would usually prove this by induction on the size of s Using inductionless induction: –add s + (s’::x) ! (s+s’)::x as a rewrite rule –Knuth-Bendix doesn’t add any new rules (trust me…) –So s + (s’::x) = (s+s’)::x holds

11. Example Try to show: s :: null = null Add s :: null ! null Critical pair with: (s::x = null) ! false

12. Example Try to show: s :: null = null Add s :: null ! null Critical pair with: (s::x = null) ! false In this case, Knuth-Bendix derives true ! false: s + null = null does not hold

13. Going back to techniques Proof-system search ( ` ) Interpretation search ( ² ) Quantifiers Equality Decision procedures Induction Cross-cutting aspectsMain search strategy E-graph Rewrite rules Communication between decision procedures and between prover and decision procedures DPLL Backtracking Incremental SAT Matching Natural deduction Sequents Tactics & Tacticals Resolution Today

14. Induction Is just another way of proving universal quantifiers Important technique for proving properties of inductively defined structures, such as recursive data structures, recursive programs, and derivations

15. Principle of induction Induction over natural numbers P(0) 8 i:Nat P(i) ) P(i+1) 8 i:Nat. P(i)

16. Principle of induction More generally: well-founded induction Well founded order: for every non-empty subset, there is a minimal element (an element such that no other element is smaller than it) Equivalently: there are no infinite descending chains [ 8 i < j. P(i)] ) P(j) (<, N) is a well-founded order 8 i:N. P(i)

17. Principle of induction Structural induction: well-founded induction where the induction is done on the structure of (usually syntactic) structure of elements of N

18. Automating induction Automating induction is hard –not many theorem provers do it automatically Difficulties –determine when to apply induction –determine what variables to apply induction on –derive a strong enough hypothesis

19. Induction in ACL2 Similarity between recursive definitions and induction A recursive function calls itself with arguments that are “smaller” (by some measure) than the original arguments A proof of P(x) by induction consists of proving P(x) by assuming that P holds for terms “smaller” (by some measure) than x

20. Induction in ACL2 ACL2 proves theorems about recursive functions, and so the similarity mentioned leads to a scheme for applying induction Suppose that a formula P to be proven contains a call to a function f that is defined recursively, and suppose each recursive call drives down the measure Then we can apply induction on the structure of the recursive definition of f

21. Simple example (sum N) = (IF (<= N 0) 0 (sum (- N 1))) (defthm (IMPLIES (>= N 0) (= (sum N) (/ (* N (+ N 1)) 2))))

22. Two parts First part: identify possible measures –done when a recursive function is defined Second part: apply induction during a proof –use the analysis done during the first part to guide the application

23. Identifying measures Suppose we have (f x 1 … x n ) = body, where the body contains recursive calls to f. We are looking for a measure function m that satisfies the following: –for every sub-term of the form (f y 1 … y n ), we must have (r (m y 1 … y n ) (m x 1 … x n )) –where r is a well-founded relation

24. Example (funny-fact n i) = (IF (<= n 0) 1 (IF (= i 0) (* n (funny-fact (- n 1) i)) (IF (> i 0) (* n (funny-fact (- n i) i)) (* n (funny-fact (+ n i) i))))))

25. Refine: identifying measures Suppose we have (f x 1 … x n ) = body, where the body contains recursive calls to f. We are looking for a measure function m that satisfies the following: –for every sub-term of the form (f y 1 … y n ), we must have: (IMPLIES (AND t 1 … t k ) (r (m y 1 … y n ) (m x 1 … x n ))) –where r is a well-founded relation

26. Build the “machine” for a function casetestrecursive calls 1 (funny-fact (- n 1) i) 2 (funny-fact (- n i) i) 3 (funny-fact (+ n i) i) (funny-fact n i) = (IF (<= n 0) 1 (IF (= i 0) (* n (funny-fact (- n 1) i)) (IF (> i 0) (* n (funny-fact (- n i) i)) (* n (funny-fact (+ n i) i))))))

27. Build the “machine” for a function casetestrecursive calls 1 (AND (NOT (<= n 0)) (= i 0)) (funny-fact (- n 1) i) 2 (AND (NOT (<= n 0)) (NOT (= i 0) (> i 0)) (funny-fact (- n i) i) 3 (AND (NOT (<= n 0)) (NOT (= i 0) (NOT (> i 0) (< i 0)) (funny-fact (+ n i) i) (funny-fact n i) = (IF (<= n 0) 1 (IF (= i 0) (* n (funny-fact (- n 1) i)) (IF (> i 0) (* n (funny-fact (- n i) i)) (* n (funny-fact (+ n i) i))))))

28. Use machine to test measure For example, for case 3: (IMPLIES (AND (NOT (<= n 0)) (NOT (= i 0) (NOT (> i 0) (< i 0)) (< (+ n i) n))

29. How do you guess measure? Rely on lemmas that have been labeled with the “induction” hint These so-called induction lemmas state under what conditions certain measures decrease For example: (IMPLIES (is-cons-cell X) (< (length (cdr X) (length X)))

30. How do you guess measure? Suppose we have a function append: (append L1 L2) = (IF (is-cons-cell L1) (cons (car L1) (append (cdr L1) L2)) L2)) (IMPLIES (is-cons-cell X) (< (length (cdr X) (length X))) casetestrecursive calls 1

31. How do you guess measure? Suppose we have a function append: (append L1 L2) = (IF (is-cons-cell L1) (cons (car L1) (append (cdr L1) L2)) L2)) (IMPLIES (is-cons-cell X) (< (length (cdr X) (length X))) casetestrecursive calls 1 (is-cons-cell L1)(append (cdr L1) L2)) Table and induction lemma immediately point out that length works as the measure and < works as the order

32. Another example (ACK M N) = (IF (= M 0) (+ N 1) (IF (= N 0) (ACK (- M 1) 1) (ACK (- M 1) (ACK M (- N 1))))) casetestrecursive calls 1 2

33. Another example (ACK M N) = (IF (= M 0) (+ N 1) (IF (= N 0) (ACK (- M 1) 1) (ACK (- M 1) (ACK M (- N 1))))) casetestrecursive calls 1 (AND (NOT (= M 0)) (= N 0)) (ACK (- M 1) 1) 2 (AND (NOT (= M 0)) (NOT (= N 0))) (ACK (- M 1) (ACK M (- N 1))) (ACK M (- N 1)) Measure?

34. Another example Lexicographical order of (M, N) (LEX-< (cons (- M 1) N) (cons M N)) (LEX-< (cons (- M 1) (ACK...)) (cons M N)) (LEX-< (cons M (- N 1)) (cons M N))

35. First part summary When the function is defined, try to find measure Use induction lemmas to guide search Also allow programmer to provide the measure Once a measure has been found, the function is “admitted” As a side benefit, guarantees termination

36. Second part: applying induction Suppose term (f t 1 … t n ) appears in the goal G Assume t 1 … t n are all variables –if they are not, things get more complicated Assume “machine” for f looks like this: casetestrecursive calls 1 q1q1 r 1 1... r 1 h1 2 q2q2 r 2 1... r 2 h2 … …… k qkqk r k 1... r k hk Also, assume  i h is subst such that  i h applied to (f t 1 … t n ) gives r i h

37. Second part: applying induction casetestrecursive calls 1 q1q1 r 1 1... r 1 h1 2 q2q2 r 2 1... r 2 h2 … …… k qkqk r k 1... r k hk Also, assume  i h is subst such that  i h applied to (f t 1 … t n ) gives r i h Goal G with sub-term (f t 1 … t n )

38. Second part: applying induction casetestrecursive calls 1 q1q1 r 1 1... r 1 h1 2 q2q2 r 2 1... r 2 h2 … …… k qkqk r k 1... r k hk Also, assume  i h is subst such that  i h applied to (f t 1 … t n ) gives r i h Goal G with sub-term (f t 1 … t n )

39. Simple example from before (sum N) = (IF (<= N 0) 0 (sum (- N 1))) (defthm (IMPLIES (>= N 0) (= (sum N) (/ (* N (+ N 1)) 2)))) casetestrecursive calls 1 == G

40. Simple example from before (sum N) = (IF (<= N 0) 0 (sum (- N 1))) (defthm (IMPLIES (>= N 0) (= (sum N) (/ (* N (+ N 1)) 2)))) casetestrecursive calls 1 (NOT (= N 0)) (sum (- N 1))) (IMPLIES (AND G[N ! (- N 1)] (NOT (= N 0))) G)  = [ N ! (- N 1) ] (IMPLIES (= N 0) G) G

41. Strengthening It is often advantageous, and sometimes even necessary to strengthen a conjecture before attempting an inductive proof ACL2 does this with a generalization process, which runs before induction is applied Tries to replace certain non-variable terms by fresh variables, which are implicitly universally quantified

42. Strengthening example Suppose we want to prove (all free vars universally quantified): (append (reverse A) nil) = (reverse A) This conjecture is generalized –by replacing (reverse A) with L (append L nil) = L

43. Strengthening gone wrong The problem with generalization is that the generalized conjecture may be “too strong” –and in fact may not hold even though the original conjecture did! Example: (= (sum (fib N)) (/ (* (fib N) (+ (fib N) 1)) 2))))

44. Strengthening gone wrong The problem with generalization is that the generalized conjecture may be “too strong” –and in fact may not hold even though the original conjecture did! Example: (= (sum (fib N)) (/ (* (fib N) (+ (fib N) 1)) 2)))) Generalize: (= (sum M) (/ (* M (+ M 1)) 2)))) This does not hold! We need to know that M is positive!

45. Strengthening fixed The generalization process constrains the newly introduced variables using theorems that have been labeled “generalize” by the user In the previous case, the following theorem could be used: (>= (fib N) 0) Once this theorem has been proven and labeled “generalize”, subsequent generalizations of (fib N) to M will include the hypothesis (>= M 0). –Generalized conjecture in example becomes: (IMPLIES (>= M 0) (= (sum M) (/ (* M (+ M 1)) 2))))

46. Induction in ACL2: summary The three difficulties, again When to apply induction –as a last resort What variables to apply induction on –analyze function at definition time to find decreasing measures How to strengthen induction hypothesis –replace certain terms with fresh vars

47. Similar ideas, but elsewhere Using recursive definitions to drive the application of induction appears in other theorem provers, for example Twelf Twelf is a theorem prover based on the LF logical framework, which can be used to encode logics, programming languages, and deductive systems Properties of such systems can then be proven by induction

48. Natural deduction  ` A  ` B  ` A Æ B  ` A  ` A Æ B  ` B  ` B  ` A ) B  ` A  ` A ) B  ` B  ` A ÆIÆI ÆE1ÆE1 ÆE2ÆE2 Assume )I)I )E)E  ` A  ` A Ç B ÇI1ÇI1  ` B  ` A Ç B ÇI2ÇI2  ` C ÇEÇE  ` C  ` C

49. Proving properties of derivations Say we want to prove a property: –for every derivation D, P(D) holds

50. Proving properties of derivations Say we want to prove a property: –for every derivation D, P(D) holds

51. Twelf Twelf can performs these kinds of proofs automatically The application of induction is interspersed with case splitting and the backward application of Twelf’s sequent inference rules