[PDF] - HOL Ligh t: A T utorial In tro duction 1 HOL Ligh t: A PDF Document

SLIDE 1 HOL Ligh t: A T utorial In tro duction 1 HOL Ligh t: A T utorial In tro duction John Harrison Univ ersit y

f

Cam bridge (

Ab
Ak

ademi Univ ersit y)

History

and ev

lution
Quic

k rundo wn

f

features

Real

analysis theory

Programming

language seman tics

Mizar

mo de

CORDIC

algorithm example John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 2 HOL Ligh t: A T utorial In tro duction 2 HOL Ligh t's lineage HOL Ligh t has ev

lv

ed via:

Edin

burgh LCF (Milner et al.)

Cam

bridge LCF (P aulson)

HOL

(Gordon, Melham)

hol90

(Slind) Other LCF-st yle systems include:

Nuprl

(Constable et al.)

Co

q (Huet et al.)

Isab

elle (P aulson) John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 3 HOL Ligh t: A T utorial In tro duction 3 The sp ectrum

f

theorem pro v ers A UTOMA TH (de Bruijn) Stanford LCF (Milner) Mizar (T rybulec) . . . . . . PVS (Owre, Rush b y , Shank ar) . . . . . . NQTHM (Bo y er, Mo

re)

Otter (McCune) John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 4 HOL Ligh t: A T utorial In tro duction 4 The LCF approac h The k ey ideas are:

All

theorems created b y lo w-lev el primitiv e rules.

Guaran

teed b y using an abstract t yp e

f

theorems; no need to store pro

fs.
ML

a v ailable for implemen ting deriv ed rules b y arbitrary programming. This giv es adv an tages

f

reliabilit y and extensibilit y . The system's source co de can b e completely

p

en. The user con trols the means

f

pro duction (of theorems). T

impro

v e eciency

ne

can:

Encapsulate

reasoning in single theorems.

Separate

pro

f

searc h and pro

f

c hec king. John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 5 HOL Ligh t: A T utorial In tro duction 5 Some

f

HOL Ligh t's deriv ed rules

Simplier

for (conditional, con textual) rewriting.

T

actic mec hanism for mixed forw ard and bac kw ard pro

fs.
T

autology c hec k er.

Automated

theorem pro v ers for pure logic, based

n

tableaux and mo del elimination.

T
ls

for denition

f

(innitary , m utually) inductiv e relations.

T
ls

for denition

f

(m utually) recursiv e datat yp es

Linear

arithmetic decision pro cedures

v

er R , Z and N .

Dieren

tiator for real functions. John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 6 HOL Ligh t: A T utorial In tro duction 6 Real analysis theory (1)

Denitional

construction

f

real n um b ers

Basic

top

logy
General

limit

p

erations

Sequences

and series

Limits
f

real functions

Dieren

tiation

P
w

er series and T a ylor expansions

T

ranscenden tal functions

Gauge

in tegration John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 7 HOL Ligh t: A T utorial In tro duction 7 Real analysis theory (2) There are lots

f

concrete theorems, e.g. |- abs(abs x

abs

y) <= abs (x

y)

|- sin(x + y) = sin(x) * cos(y) + cos(x) * sin(y) |- tan(&n * pi) = &0 |- &0 < x /\ &0 < y ==> (ln(x / y) = ln(x)

ln(y))

John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 8 HOL Ligh t: A T utorial In tro duction 8 Real analysis theory (3) and man y general

nes:

|- f contl x /\ g contl (f x) ==> (\x. g(f x)) contl x |- a <= b /\ (f(a) <= y /\ y <= f(b)) /\ (!x. a <= x /\ x <= b ==> f contl x) ==> (?x. a <= x /\ x <= b /\ (f(x) = y)) |- (f diffl l)(g x) /\ (g diffl m)(x) ==> ((\x. f(g x)) diffl (l * m))(x) |- a <= b /\ (!x. a <= x /\ x <= b ==> (f diffl f'(x))(x)) ==> Dint(a,b) f' (f(b)

f(a))

John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 9 HOL Ligh t: A T utorial In tro duction 9 Our Programming Language (1) This includes the follo wing constructs: c

mmand

= variable := expr ession | c

mmand

; c

mmand

| if expr ession then c

mmand

else c

mmand

| if expr ession then c

mmand

| while expr ession do c

mmand

| do c

mmand

while expr ession | skip | f expr essiong | [ expr ession] The language is seman tically em b edded in HOL using standard tec hniques. John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 10 HOL Ligh t: A T utorial In tro duction 10 Our Programming Language (2) W e can v erify the total correctness

f

programs according to giv en pre and p

st-conditions.

|- correct p c q corresp

nds

to the standard total correctness assertion [p] c [q ], i.e. a command c, executed in a state satisfying p, will terminate in a state satisfying q . W e can pro v e correctness assertions b y systematically breaking do wn the command according to its structure. In particular, w e can annotate it with `v erication conditions', and so (automatically) reduce the correctness pro

f

to the problem

f

v erifying some assertions ab

ut

the underlying mathematical domains. John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 11 HOL Ligh t: A T utorial In tro duction 11 Mizar Mo de The standard HOL pro

f

st yles (whether forw ard

r

bac kw ard) are highly pr

c

e dur al. They require a certain amoun t

f

`programming' from the user. W e also pro vide a more de clar ative pro

f

st yle, as used in Mizar. The mac hine lls in the gaps in the pro

f

for us with explicit inference steps. F

r

example, here is a pro

f
f

8x:

x

) l n(1 + x)

x:

let x be real; assume &0 <= x; then &0 < &1 + x by arithmetic; so exp(ln(&1 + x)) = &1 + x by EXP_LN; so suffices to show &1 + x <= exp(x) by EXP_MONO_LE; thus thesis by EXP_LE_X John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 12 HOL Ligh t: A T utorial In tro duction 12 Floating p

in

t correctness (1) W e w an t to sp ecify the correctness according to the follo wing diagram: a v (a) S I N (a) sin(v (a)) v (S I N (a))

6

6 S I N sin v v What relationship b et w een v (S I N (a)) and sin(v (a)) should w e require? John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 13 HOL Ligh t: A T utorial In tro duction 13 Floating p

in

t correctness (2) There are v arious plausible

ptions,

all

f

whic h are easy to express formally in HOL Ligh t:

The

answ er is the closest represen table n um b er to the true answ er (with round to ev en in case

f

t w

equally

close answ ers)

The

ab

v

e is true for all but a small prop

rtion
f

p

ssible

inputs.

The

absolute error is small.

The

relativ e error is small.

The

error is commensurate with the lik ely error in the input. John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 14 HOL Ligh t: A T utorial In tro duction 14 The CORDIC program begin var k,x,y,z; x := X; y := 0; k := 1; while k < N do ( z := srl(n) k x; if ult(n) z (neg(n) x) then (x := add(n) x z; y := add(m) y (logs k)); k := k + 1 ) end where add(n), neg(n), ult(n) and srl(n) k are n-bit addition, 2s complemen t negation, unsigned comparison (<) and righ t shift b y k places, resp ectiv ely . The arra y logs con tains pre-stored constan ts. John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 15 HOL Ligh t: A T utorial In tro duction 15 Without the prett yprin ter This sho ws what the underlying seman tic represen tation lo

ks

lik e: Assign (\k,(x,(y,z)). k,(X,(y,z))) Seq Assign (\k,(x,(y,z)). k,(x,(0,z))) Seq Assign (\k,(x,(y,z)). 1,(x,(y,z))) Seq While (\k,(x,(y,z)). k < N) (Assign (\k,(x,(y,z)). k,(x,(y,srl n k x))) Seq If (\k,(x,(y,z)). ult n z (neg n x)) (Assign (\k,(x,(y,z)). k,(add n x z,(y,z))) Seq Assign (\k,(x,(y,z)). k,(x,(add m y (logs k),z)))) Seq Assign (\k,(x,(y,z)). k + 1,(x,(y,z)))) Ho w ev er the user need not normally see this form! John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 16 HOL Ligh t: A T utorial In tro duction 16 The CORDIC program in C int k; unsigned long x,y,z; x = X; y = 0; k = 1; while (k < N) { z = x >> k; if (z <

x)

{ x = x + z; y = y + logs[k]; } k = k + 1; } (Using unsigned longs in place

f

the particular w

rd

sizes, for the sak e

f

familiarit y .) John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 17 HOL Ligh t: A T utorial In tro duction 17 The CORDIC program in V erilog integer k; reg [n:0] x,z; reg [m:0] y; initial; begin x = X; y = 0; k = 1; while (k < N) begin z = x >> k; if (z <

x)

begin x = x + z; y = y + logs[k]; end k = k + 1; end end John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 18 HOL Ligh t: A T utorial In tro duction 18 Annotations for CORDIC program W e can sp ecify in termediate assertions later in the pro

f

b y exploiting meta v ariables. Ho w ev er it is simpler to pro vide annotations. W e assert a lo

p

in v arian t: {mval(n) x < &1 /\ ...} and that N

k

decreases with eac h iteration. The automatic v erication condition generator (w

rking

b y inference) can calculate all the

ther

in termediate assertions for itself. W e are left with four v erication conditions:

The

lo

p

in v arian t is true initially .

The

lo

p

in v arian t is preserv ed if the condition in the if statemen t holds.

The

lo

p

in v arian t is preserv ed if the condition in the if statemen t do es not hold.

The

lo

p

in v arian t together with k

N

implies the nal p

stcondition.

John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 19 HOL Ligh t: A T utorial In tro duction 19 Correctness result (1) The four v erication conditions are pro v ed in HOL Ligh t, with the aid

f

a few lemmas. This pro v es that the annotated program is correct according to the sp ecication. HOL Ligh t then pro v es automatically that the program with the annotations remo v ed is still correct. The precondition

f

the nal sp ecication is: inv(&2) <= mval(n) X /\ mval(n) X < &1 /\ &N + &2 <= &n /\ &N <= &2 pow (PRE n) /\ (!i. &0 < &i /\ &i < &N ==> &2 pow i * &(logs i) <= &2 pow m /\ (abs(&(logs i)

&2

pow m * ln(&1 + inv(&2 pow i))) < &1)) i.e. the input v alue X is in the range 1 2

X

< 1, the stored constan ts are go

d

enough appro ximations to the true logarithms, and a few conditions

n

the parameters hold. John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996

SLIDE 20 HOL Ligh t: A T utorial In tro duction 20 Correctness result (2) and the nal p

stcondition

guaran teed b y

ur

pro

f

is: abs(mval(m) y + ln(mval(n) X)) <= &N * (&6 * inv(&2 pow n) + inv(&2 pow m)) + inv(&2 pow N) That is, the dierence b et w een the calculated logarithm mval(m) y and (the negation

f

) the true mathematical result ln(mval(n) X) is b

unded

b y N (6:2 n + 2 m ) + 2 N . This can b e c hosen as small as desired b y pic king the parameters appropriately . Moreo v er the correct v alues for the stored table

f

logarithms can also b e calculated in an y particular instan t, b y inference (slo wly!) John Harrison Univ ersit y

f

Cam bridge, 7 No v em b er 1996