Mathematical Logic and its Applications to Computer Science

Transcription

1 Mathematical Logic and its Applications to Computer Science Eitan Farchi Yochai Ben-Chaim April 1,

2 Contents I Lecture Notes 6 1 Lecture Notes Knaves and Knights Inductive Definitions of Sets Induction Example The Set I(A,P) The Induction Principle Prepositional Calculus Syntax A Ruling Function from the Talmud II Lecture Transcripts 12 2 Lecture 1 - March 04, Inductive Sets Example Example Example Exercise An Exercise to Think about at Home Example Claim Example Sub-example Let s Look for an Example in the Program Lecture Summary In the Next Lecture Lecture 2 - March 11, Inductive Sets - Continued Propositional Calculus syntax Example Example Meaning

3 4 Lecture 3 - March 18, What We ve Done so Far Example Example Our Main Running Example Hierarchy of Dictionaries Lecture 4 - March 25, In this and Upcoming Lectures Hierarchy of Continued Rules for Glossary Design Lecture 5 - April 01, In this and upcoming lectures: Continued Design of Glossaries Hierarchy A ruling function from the Talmud III Exercises 44 7 Exercise 1 - March 05, Introduction Predicate Calculus Semantics What is a proof? Logics Sets Basic Terms Actions between Sets Example # Example # Example # Truth Tables Example # Logical Equivalence Example # Logical Quantifiers Example # A More Complicated Example Inductive Definition Example Examples

4 7.5.3 Proving Using Induction Exercise 2 - March 12, In the Previous Exercise (1) Inductive Definition Example Examples Proving Using Induction Example Program # Exercise 3 - March 17, In the previous Exercise (2) Example Program # Differences between Syntax and Semantics Power Set example example example Exercise 4 - March 24, In the previous Exercise (3) Homework Exercise # Induction - MI MU Example The Elements of I(A, P) Prove that MU / I(A,P) Propositional Calculus Simple Program Exercise 5 - March 31, In the previous Exercise (4) : Go Over Home Exercise # Z Language Specification - Dictionaries Purpose Specification of Well-Formed Pairs of Words Operations Invariants Error Handling Total Operations IV References 72 4

5 Abstract The objective of the course is to introduce mathematical logic and explore its applications in computer science, with an emphasis on formal specifications. Proposition calculus, structured induction, partial orders, and first order logic will be introduced. Formal specification using the Z language will be introduced, including some background in set theory, relation, functions and schemes. Applications of mathematical logic to formal verification or program analysis will be explored. 5

6 Part I Lecture Notes 1 Lecture Notes 1.1 Knaves and Knights An island is inhibited by two types of people - knaves - who always lie, and knights - who always tell the truth. The Problem A and B are from that Island. A says, at least one of us is a knave. What types of people are A and B? The Solution If A is a knave, then there are either one or two knaves. As a result, the statement that at least one of us is a knave is true. However, this contradicts the fact that A is a knave because knaves always lie. If A is a knight, then the statement that at least one of us is a knave is true if and only if B is a knave. As A is a knight, he is telling the truth, and for the statement to be true, B has to be a knave. 1.2 Inductive Definitions of Sets Induction I(A,P) is the inductive set created from the atoms, A, using the operation P. We are interested in the set obtained from the atoms by repeatedly applying the operations. Let s begin with an example Example The set of atoms is A = {MI}. The operations, P, are detailed below. XI XIU - add U at the end MX MXX - for a word that starts with M, whatever follows the M, in this case, X, is added at the end III U - a sequence of three consecutive Is can be changed to a U UU nothing - two consecutive Us can be omitted The elements MI MII MIIII MIIIIU MIU are all in I(A,P). Check why each step in the derivation is correct. Next, we want to prove that MU / I(A,P). In other words, starting from MI, you cannot 6

7 get to MU by applying the operations in P. Thus, MU is not a member of the inductive set I(A,P) that was obtained from A by using the operations, P. To prove this claim, we proceed by induction. The claim we are going to prove is that for any member of w I(A,P), the number of Is in w is not a multiple of three. This will prove that MU is not in I(A,P), MU / I(A,P), as the number of Is in MU is zero and thus a multiple of three. The inductive proof includes showing that the claim is true for the atoms and then showing that if the claim is true for a word and you apply one of the operations to that word, the claim stays true. Next, let s follow the details of the proof. The number of Is in MI is 1 and thus not a multiple of three. Assume that for some w in I(A,P), w I(A,P), the number of Is in w is not a multiple of three. For the first rule, XI XIU, adding a U at the end does not change the number of Is and it thus remains not a multiple of three. For the second rule, MX MXX, the number of Is was multiplied by two. Thus, if before the application of the operation the number of Is in w was 3 k + 1 or 3 k 1 (not a multiple of three), then the number of Is after applying the operation is 2(3 k + 1) = 6 k + 2 or 2(3 k 1) = 6 k 2 - neither of which is a multiple of three. For the third rule, III U, the number of Is was reduced by three, and thus remained not a multiple of three. For the last rule, UU nothing, the number of Is did not change and thus remains not a multiple of three. This completes the induction step and the proof The Set I(A,P) Next, we make the notion of I(A,P) precise. Given a set of atoms, A, and a set of operations, P, an inductive set of A and P is a set that: Contains A Is closed under operations in P. In other words, if we know that X 1,...,andX k are in the inductive set and Z is obtained from X 1,...,X k by one of the operations in P, then Z is in the inductive set. Consider the following example. If A = {1} and P = +1, then {1, 2, 3,...} is an inductive set but so are {..., 3, 2, 1, 0, 1, 2,,3,...} - the real numbers and the complex numbers, as all of them contain {1} and adding one to any of the members of these sets results in a member of these sets. We realize that we have too many options, that is the two rules above do not define a unique set. To correct this situation, we add a third rule. We define the set I(A,P) to be the set that meets the above two rules and an additional third rule: the set is the minimal (under inclusion), that meets these rules. 7

8 {1, 2, 3,...} is contained in {..., 3, 2, 1, 0, 1, 2,,3,...} - the real and the complex numbers. It is also true that I({1}, +1) = {1, 2, 3,...}. We will be ready to prove this once we characterize I(A,P) using a bottom-up. The bottom-up definition includes starting from A, applying the operations to A in any way possible to obtain I 1. We then apply the operations once more in any way possible on the elements obtained thus far, obtaining I 2. We continue in this manner and finally take the union of all the elements that we obtained. We call this set I 1 (A,P). Let s make sure that the definition of I 1 (A,P) is clear using our running example: Applying the operations in any way on MI results in MII and MIU. Applying the operations in anyway to MI, MII and MIU results in MII, MIUIU, and MIIU, and so on. Reviewing the claim that I({1}, +1) = {1, 2, 3,...}, one clearly notices that I 1 (A,P) = {1, 2, 3,...}. If we prove that I 1 (A,P) = I(A,P) then we reach the conclusion that I({1}, +1) = {1, 2, 3,...}. So this is what we aim to prove next. By definition, I 1 (A,P) contains the atoms A. In addition, if any X 1,...,X K are in I 1 (A,P), then they are also in some I n (A,P). The application of any operation in P on X 1,...,X K will result in I n+1. Thus, I 1 (A,P) is an inductive set, and I(A,P) is contained in I 1 (A,P). On the other hand, any element of I 1 (A,P) was obtained by a finite application of the operations starting in an element of A, which means that this element is in I(A,P), and the proof is completed. 1.3 The Induction Principle In the example above, we proved that MU is not in the set I(A,P), created from the atom A = {MI} by the following operations: XI XIU - add U at the end MX MXX - for a word that starts with M, whatever follows M, in this case, X, is added at the end III U - a sequence of three consecutive Is can be changed to a U UU nothing - two consecutive Us can be omitted Our method of proving this was to show that a certain claim, T, is true for the atom A and that whenever we assume it is true before applying an operation from P, it remains true after applying that operation. We then deduced that T is true for I(A,P), but why? The fact is that the set of 8

9 elements for which T is true is an inductive set. By abuse of notation, we will denote the set of elements for which the claim T is true by T. Thus, T I(A,P) (as I(A,P) is the minimal inductive set for the atoms A and operations P). This means that for every element of I(A,P), the claim T holds. 1.4 Prepositional Calculus 1.5 Syntax We define the syntax of the prepositional calculus. Atoms are letters or indexed letters, (e.g., p A and p i A). In addition, if P and Q are in I(A,P), then so are: ( P) (P Q) (P Q) (P Q) We will refer to I(A,P) as the set of sentences of prepositional logic. The intended meaning of,,, and are not, or, and, and imply respectively. However, this is just an intended meaning at this point of the discussion. The situation is similar to a programming language that has no compiler yet. Thus, in our hypo-statical programming language, we might have intended that if x = 5; t = 3; (g(x, x + +) 0); g(x, f(t)); means some sort of calculation. However, if we do not define the calculation, it is just a string of characters devoid of meaning. As a string of characters, it could be a legal string or not. Thus, I(A,P) defines the legal strings of prepositional calculus (or the programs that will compile and have correct syntax, though that does not mean they will do something sensible). Next, we further investigate the syntax. We claim that a sentence, if it s not an atom, begins with (. Indeed, if we assume that P and Q begin with (, then clearly, so does ( P), (P Q), (P Q), and (P Q). Thus, (p q) is not a sentence. Also, the number of opening parentheses ( and closing parentheses ) in a sentence is equal. Proof: This holds true for the atoms, since the number of opening and closing parentheses is zero. If the number of parentheses is equal for P and Q, it is equal for ( P), (P Q), (P Q), and (P Q), as one ( and one ) were added, ensuring that equality was kept. 9

10 We next define the sentences that are always correct (at least this is the intended meaning) inductively. The atoms A are sentences of the form: (A (B A)) ((A (B C)) ((A B) (A C))) (( A B) (B A)) where A, B, and C are any legal sentences in propositional language. We will also call the above atoms axioms. Note that for any truth values of A, B, and C, the sentences above are intuitively true. We will give a more precise explanation to this once we define an interpretation of prepositional language sentences. We will only have one operation in P; if (A B) and A are already in the set of always correct, then so is B (this operation will be referred to as separation ). Thus, I(A,P) defines a set of sentences that are intended to be always true. Note that at this stage, this is only our intention and has no bearing on the formalism. One last element of notation: if a I(A,P), we will say that a. In this case, there is a sequence by which a is obtained from the atoms of I(A,P). We will refer to that sequence as a proof for a - a. Next, let s examine a proof for (a a) (a a), which is indeed, intuitively, always true. a (a a) (axiom) (a (a a)) ((a a) (a a)) (a a) (a a) (separation) 1.6 A Ruling Function from the Talmud Rules: If a bull never attacked before and then attacks and kills another bull, then the owner of the first bull pays the owner of the second bull half the value of the second bull, but up to the value of the first. Example: If the first bull is worth 500 and the second is worth 2000 and the first bull kills the second bull, then the owner of the first bull pays the owner of the second bull 500. If the first bull is worth 1000, then 1000 is paid. If the first bull is worth 1500, then 1000 is paid. 10

11 Now assume that one of two bulls, owned by one person, killed a third bull owned by another person. The third bull is worth 2000 while the first and second bulls are worth 500 and 1000 respectively. If the first bull killed the third bull, then the owner of the bull that was killed should get 500, while if the second bull killed the third bull, the owner of the third bull should get But we don t know which of the two bulls killed the third bull! We ask the owner of the first bull and simultaneously ask the owner of the second bull. Each one answers in one of three ways: I don t know (ignorant). The first bull did it (first). The second bull did it (second). We model this by Answer = {ignorant, f irst, second}. The set of possible responses of the first and second is modeled by the Cartesian product Answer Answer. We are looking for a ruling function such that ruling : A A {0, 500, 1000}. One ruling function that appears in the Talmud is that if there is agreement, or at least no disagreement, on who killed the third bull, we go by the undisputed claim and apply the rule that we describe above. Thus, the ruling function is defined as follows: {(ignorant, ignorant, 0), (ignorant, f irst, 500), (ignorant, second, 1000), (f irst, ignorant, 500), (f irst, f irst, 500), (f irst, second, 0), (second, ignorant, 1000), (second, f irst, 0), (second, second, 1000)} For those familiar with Game Theory - notice that this function defines a matrix Game. Does it have a Nash equilibrium point in pure strategies? 11

12 Part II Lecture Transcripts 2 Lecture 1 - March 04, Inductive Sets An inductive set is a collection of members - called atoms - that are defined in a certain way. We start from the collection of members, on which we activate actions. Once we receive the results, we reactivate the actions, and so on. The set is the result of what we receive by activating the actions Example I(0, +1) The atom is 0 The action is +1 When activating +1 on 0, we receive 1. We then reactivate +1 and get 2, and then reactivate +1 and get 3, and so on , etc. We quickly realize that the result is N - the set of natural numbers: N = {0, 1, 2, 3,...} 1, for instance, is not in the group {} marks a set So how does all of this relate to software engineering? What is the connection between logic tools and computer science? The relation will be through software requirements for computer science Example Let s examine the following program: x = 0; while(true){ x + +; print(x); 12

13 } This program describes (prints) the natural numbers: I(0, +1) We claim that N = I(0, +1) The claim is that the set deduced from the action +1, starting from atom 0, is the set of natural numbers. Another claim: The program P will print the set N. Actually, both claims are the same and this is the same claim. This is the connection between the logical tool (the inductive set) and the claim about what the program does (a computer science requirement). During the course, we will use logics to define what artifacts are supposed to do. In this case, we performed a logical jump from program P to the definition of the inductive set I(0, +1) without proof. Let s now try to prove and explain what this inductive set is using as a different definition to the inductive set I(A,P), where A is the atoms and P is the actions. I(A,P) is the set that maintains that all the atoms are in the set (that is, all the members of A are in the set). If x 1, x 2,... x y are in A and if action o is in P, then o(x 1,x 2,...,x y ) is also in A. In other words, the result of activating the action o on the members of the set is also in the set Example The Atom: A = {MI} The actions (P) are: O1 : XI XIU O2 : MX MXX O3 : III U O4 : UU nothing We start with {MI} - a member of A. Since {MI} is a member of A, it is an atom. According to action O2, O2(MI) = MII is also a member of A. 13

14 Next, we activate action O1 on MII. O1(MII) = MIIU Then we activate action O2 on MIIU. O2(MIIU) = MIIUIIU Exercise We would like to be able to reach a point where we can activate action O3. By activating O2 twice on MI, we receive: O2(MI) = MII O2(MII) = MIIII O3(MIII) = MUI An Exercise to Think about at Home We would like to be able to reach a point where we can activate action O4. Let s return to the definition. We define closure : Activating an action on members of the set leaves us in the set. But, the definitions that we gave (all the atoms are in the set and closure) are not good enough definitions because there are many sets that pertain to these conditions Example Suppose that: I(0, +1) According to the definition of atoms that are members of the set and the definition of closure, we would have liked to see the result that these are the natural numbers N. But, the set of all numbers Z, which includes the negative numbers, also pertains to these conditions because 0 is in the set, and for every member in the set, the member +1 is also in the set. The set of all real numbers R - which includes fractions, also maintains both claims. -We deduce that our definition is not enough, and we need to add a third condition: If we look at the example, we see that N is contained in Z, which is contained in R, which we mark: N Z R What is the additional condition we need to add? How do we characterize the desired set? We want the smallest set that maintains all conditions; we want the smallest 14

15 set under the subset relation. In other words, the set is contained in any other set that maintains both conditions. I(A,P) will be the set contained in any other set B that maintains both conditions (all the atoms are in the set and closure). We found a second definition for the inductive set: I(A,P) Where A is in the set A = A 0 A 1 is the set of all members that result from members of A 0 and are activating all the actions in any legal way. A 2 is the set of all members that result from members of A 1 and are activating all the actions, and so on. Then, I(A,P) is the unity from 1 through infinity of A is From the previous example: The atom was A = {MI} and the actions (P) were: O1 : XI XIU O2 : MX MXX O3 : III U O4 : UU nothing A 0 = {MI} O1(MI) = MIU O2(MI) = MII We cannot activate O3 and O4 on MI. So A 1 is {MI, MIU, MII}. To reach A 2 we need to activate the four possible actions on MIU and MII. The legal actions are: O2(MIU) = MIUIU We cannot activate the rest of the actions (O1, O3, O4) on MIU. As for activating the actions on MII: O1(MII) = MIIU O2(MII) = MIIII We cannot activate O3 and O4 on MII. So, each member in the group can be described by the list of actions that created it. For instance, MIUIU was created from MI by activating O1 and then O2. 15

16 We call this the creation series of MIUIU. It is sometimes referred to as the derivation or proof Claim I (A,P) = I(A,P) Why is this true? The idea of the proof is to start and show that the set created by activating the actions is the set that maintains both conditions - that the atoms are contained and closure. To show that I (A,P) contains the atoms and maintains closure over the actions, we will also need to show that this is the minimal set that maintains these two conditions. Why does I (A,P) contain the atoms? Because I (A,P) was initially derived from them, since according to the proof - A = A 0. Why is I (A,P) closed over the actions? To prove this, we need to take the members, activate the actions, and show that the results are in the set. We take two members: x, y from I (A,P) and activate on them an action o from P. We need to show that o(x,y) is still in I (A,P). This is true because x was derived from a creation series of activating actions and y was derived from a creation series of activating actions, so when we activate the action o on x and y, we have a creation series that results in x and we have a creation series that results in x, and so we have a creation series to reach o(x,y), and therefore o(x,y) I (A,P) We showed that I(A,P) I (A,P) because I (A,P) contains the atoms and is closed over the actions, and we know that I(A,P) is the minimal set that maintains these two conditions. To prove that they are equal - I(A,P) = I (A,P) - we need to show the subset in the other way: I (A,P) I(A,P). For each member x in I (A,P), there is a creation series: x 1 x 2... x k = x for any x in I(A,P). So, according to closure, I (A,P) I(A,P). Therefore, we proved that I(A,P) = I (A,P). We notice that there are operative definitions and there are declarative definitions: I - is a declarative definition. I - is an operative definition. 16

17 2.1.8 Example I({(1, 0), (0, 1)},v,w av + bw} Where v and w are points in the plane and a and b are numbers in the set of real numbers R. For instance: v(0, 1) w(1, 0) a = 1 b = 3 We receive: ( 1 (0, 1)) + (3 (1, 0)) = (3, 1) What does this produce? I is all in the plane R 2. I is all in the plane, and the whole plane is the minimal set that defines the actions in I Sub-example If we only look at I({(1, 0)},v av), we would have received only the x axis. If we remember the concepts of basis and span from linear algebra, then according to the linear algebra language, if we take a vector space and a set of vectors and we look at the span of the vectors: SPAN(v 1,v 2,...v k ), which is all linear combinations, then a different definition of the span of the vectors is the minimal sub-vector space closed under the linear combinations, and thus contains the vectors. Or, if we translate into the language of induction sets: Our atoms A are the vectors. The actions P are the linear combinations. In other words, we multiply each vector with a scalar and add the resulting vectors. We are looking for the minimal sub-vector space that is closed under the linear combinations and is minimal under the subset relation Let s Look for an Example in the Program if(a < b){ x = b a; 17

18 y = a b; }else{ } z = b a; t = a b; How can we make this program more efficient? By doing the subtraction actions only once and then setting their values: r = b a; f = a b; if(a < b){ x = r; y = f; }else{ } z = r; t = f; We would like to have been able to write an automatic computer program that finds and makes this change. Purpose: Write a computer program that automatically finds and suggests this change. In fact, this is what computer compilers do - efficiency actions by compilers. So how do inductive sets help with the process of creating effective compilers? For instance, there are optimization options when activating the compiler so that the compiler actually changes the assembly code. Let s try and perform an abstraction of the inductive set to characterize the change in the program: 1.if(a < b){ 2. x = b a; 3. y = a b; 18

19 }else{ 4. z = b a; 5. t = a b; } We mark the rows as actions. We start with the set of atoms: A = {1,ø}, {2,ø}, {3,ø}, {4,ø}, {5,ø} Our goal: To define I(A,P) so that it contains: {1, {b a,a b}} That is, to associate the expressions a b,b a to action 1. What are the actions? Each action i means that if I am in the command line {i,x}: a) {2, Y}, {4, Z}, {1, X} {1, Y Z X} b) {2, X}, {3, Y} {2, X Y {b a}} c) {5, X}, {4, Y} {4, X Y {b a}} d) {3, X} {3, X {a b}} e) {5, X} {5, X {a b}} The possible flows of the program are from command line 1 to either 2 and then 3 and then end, or 4 and then 5 and then end. To spell out rule a: with regard to the expressions used in the past: 1, 2 and 4 - don t forget them and don t add any new knowledge to them. Rule b says that to the knowledge received from the past from 2 and 3 - don t forget them, and add b a, because this is the expression used in 2. When activating rule b on: {2,ø}, {3,ø} we receive: {2,ø}, {3,ø} ruleb {2,ø ø {b a}} = {2, {b a}} Our goal is to deduce from the set of rules what I(A,P) is. We start with the set of atoms: A = {1,ø}, {2,ø}, {3,ø}, {4,ø}, {5,ø} We quickly see that {5,a b} and {3,a b} are also in the set. How do we prove things for inductive sets? We start by proving that if something is true for the atoms, then it s also true for the actions. 19

20 Claim: If {5, X} is in the inductive set, then it s either {5,ø} or {5, {a b}}. Proof: For the atoms this holds true, since {5,ø} is in the atoms. Now, let s assume that {5, X} fulfills that X is øor a b. We need to show that activating the actions maintains this condition, that what we receive is either $ or a b. It is obvious that we can only activate actions that start with {5 and then something, which are: {5, {b a}} {5, {b a} {b a}} = {5, {b a}} {5,ø} {5,ø {b a}} = {5, {b a}} We showed that activating the actions maintained the claim. Therefore the claim is true. Next, if we start with {4,ø}:newline and we activate the rules that include {4, we can receive: {4, {b a}}and{4, {a b,b a}} From all the options that we receive from all the possible activations, the most interesting one is: {1, {a b,b a}} From the calculation of I(A,P), we show that maintaining the results of the expressions, a b and b a, is efficient for saving time. How did we deduce that this is the interesting option? By selecting the largest members: {1, {a b,b a}} contains {1, {a b}} and {1, {b a}} It s possible to deduce the largest members automatically. We can intuitively see that the most interesting place for us is the entrance to the loop. 2.2 Lecture Summary 1. The concept of inductive set 2. We showed how to use the inductive set 3. Operative and declarative definitions of inductive set 4. We showed that it s interesting to try to characterize the inductive set 5. We showed how to use the inductive set in the context of computer programs 20

21 2.2.1 In the Next Lecture Prepositional calculus Also from the inductive set point of view From the point of view of the relationship between programming languages and their meaning 21

22 3 Lecture 2 - March 11, Inductive Sets - Continued In the previous section, we discussed the definition of the inductive set: I(A, P) We discussed the set created by the atoms A and actions P: A - atoms P - actions We gave two definitions: 1. An operational definition ( we say how to create the set ): Start with atoms A and activate actions P repeatedly 2. A declarative definition: ( without saying how to create the set, we define it ): The minimal set (in terms of inclusion) that maintain two conditions: (a) All the atoms A are in the set (b) Closure over the actions: If there are k members in the set: x 1,x 2,...,x k are in the set and you activate an action p P on them, then p(x 1,x 2,...,x k ) is also in the set We showed that both definitions are equivalent. Later, when we want to define a programming language, we will apply the uses of operational and declarative definitions. We will also talk about denotation semantics (with regard to declarative definitions). Given the definitions, we want to try and use denotation semantics to define the first type of logic that we will use: propositional calculus Later, we will also discuss and learn first-order logic. 3.2 Propositional Calculus We will learn the idea of leads to: if x then y Or: x or y And: x and y 22

23 Not: not x Where x and y are types of sentences. For instance, x is it is raining now. The result can either be true or false according to the condition if x and y are true. What we will see is that we distinguish between syntax and semantic and between the rules that create the sentences and the meaning of the sentences. Syntax: (( p q) r) In terms of semantics, this has meaning: Not p leads to q or not r, where p, q, and r are sentences in the language, and each sentence is either true or false. So where do we stand? syntax Let s start with the world of syntax. We put aside the meaning. Our purpose is to create a language that will use Or, And, and so on, a language that will also allow us to characterize tautologies: the sentences that are always true. For instance: p p We start with the purpose of how to define all the sentences in the language. After defining all the sentences, we will want to define all the true sentences. 23

24 Temporal logic - which we don t necessarily cover in this course - also adds the definition of time. The idea is that the same tools that we use today are the same tools that we use for all logic types. Our purpose: To define all the sentences in the language. If we use an analogy from the computer world - a program that we can compile. A program that can compile means that the syntax is correct and not necessarily that the program will do anything logical or effective. We use the technique of the inductive set: What are the atoms? The letters in the English alphabet, along with the option to use indexes. For instance: p, q, r p 1,r 7 The actions: If X and Y are sentences then: ( X) is also a sentence (X Y) is also a sentence (X Y) is also a sentence (X Y) is also a sentence 24

25 3.2.2 Example Sentences: (( p q) r) is a sentence (is in I(A, P)) Why is this true? p, q, and r are atoms. Therefore, ( p) is a sentence according to our previous base definition. Therefore, (( p) q) is a sentence according to our previous base definition. Therefore, ((( p) q) r) is a sentence, again according to the base definition. Are the following sentences? 1. p q 2. ( p q) 3. p 4. (q p Answers: 1. is not a sentence since there are no parentheses. 2. is not a sentence since there are no parentheses around the p. 3. is not a sentence since there are no parentheses around the p. 4. is not a sentence since there are no closing parentheses. Question: Can we claim that the number of opening and closing parentheses in every valid sentence will be the same? Claim: The number of opening ( and closing parentheses ) in every valid sentence in I(A, P) will be the same. Proof - using induction: 1. Check for the atoms: For the atoms: p, q, r, p 1 there are no parentheses; we have zero and zero opening and closing parentheses, which are equal. 25

26 2. Check for the actions: Assume that the number of opening and closing parentheses are equal in X and Y and are equal to n. How many opening and closing parentheses will we have after activating the actions? (a) In ( X), we will have n+1 opening and closing parentheses. (b) We show the same for the rest of the actions: (X Y), (X Y), (X Y) - n+1 opening and closing parentheses. Why is use of the technique of proof using induction correct? This type of induction is called: induction on the structure. What is this proof technique? We prove that it is true on the atoms, and that if it is true before activating the actions, it is also true after activating the actions. Therefore, the claim is true. Why is the use of this technique correct? Later, we may use axiom techniques to prove things, but in this case, we can actually prove our claim. Assume we have a claim T. Let s look at the set over which the claim T is true. What does this set maintain? This set T maintains that all the atoms are in T, A T, and it maintains closure over the actions. If X, Y T and you activate an action p and the result p(x, Y) is also in T, therefore - T is an inductive set over the atoms A and the actions P. What can we say about the relationship between T and I(A, P)? I(A, P) is the minimal set so I(A,P) T, meaning that for every member in I(A, P), the claim is true. This proves why the use of the induction technique is valid So far, the main purpose of this lecture has been to define sentences in terms of syntax, and now we want to define the syntax of all valid sentences: The atoms are: For sentences: X, Y and Z, the following are sentences: 1. (X (Y X)) 2. ((X (Y Z)) ((X Y) (X Z))) 3. ((( X) Y) (Y X)) We term these as axioms. For instance, if X is (p q) and Y is ( p q), then our atom axiom is: ((p q) (((( p) q) (p q)))). 26

27 Actually, we wrote an infinite number of atoms, because each X, Y and Z represents an infinite number of sentences/axioms/atoms. Later, we will see that by using just the and, we can represent all the sentences. The actions - there is only one: If X is always true, and (X Y) is always true, then Y is always true. This is the only action Example In the example, we want to see an axiom and a list of actions, to visualize the formal system. (p ((p p) p)) is an axiom because: X is p Y is (p p) X and Y are sentences Therefore, this is an axiom of the sort: (X (Y X)) ((p ((p p) p)) ((p (p p)) (p p))) is also an axiom according to the second axiom (((X (Y Z)) ((X Y) (X Z)))) X is p Y is (p p) Z is p Now, let s activate the action: If something is true and leads to (something leads to something is true), then (something leads to something) is true. By activating the action on the previous two lines: ((p (p )) (p p)) The following is also an axiom: (p (p p)) is an axiom according to the first axiom X is p Y is p We can perform separation here, -meaning that we deactivate the axiom again. (p p) We defined the claim that: (p p) (p p) So, why did we play this weird game? 27

28 3.2.4 Meaning We will use induction to prove the true values of every sentence. What we want to do is to define a function. The function takes input sentences, and output is true/false. At this stage, we can t do this since we need more infrastructure. Instead, let s define the truth values for sentences: X Y (X Y) T T T T F T F T T F F F X Y (X Y) T T T T F F F T F F F F X Y (X Y) T T T T F F F T T F F T X T F ( X) F T Next, note that we have things here that we don t need. For instance, if we look at: X Y ( X) (( X) Y) T T F T T F F F F T T T F F T T So, this is equivalent with (X Y) (( X) Y) (X Y) We can live without the, which we can replace with, and. 28

29 We can look for a minimal list of signs that will be enough for all the truth tables. Claim: Using (Or), (And) and (Not), we can express any truth table. For instance, let s look for the meaning of: using, and : X Y (X Y) T T F T F T F T T F F F ((X ( Y)) (( X) Y)) Claim: Using leads to and Not, we can denote any other action. For now, we do not prove this claim. Claim: Anything we can deduce from the axiomatic system is always true. In other words, the axiomatic system is a tautology. We will prove using induction: For the atoms - the axioms - we need to show that this is true: (X (Y X)) For this to be false, X needs to be true Therefore, Y X is true (according to the truth table), and therefore, according to the truth table: (X (Y X)) is true. A B (A B) T T T T F F F T T F F T As for the second axiom: ((X (Y Z)) ((X Y) (X Z))) So, (X Y) must be true and (X Z) must be false. (X Z) must be false denotes that X is true and Z is false. From ((X (Y Z)) is true denotes that: (Y Z) is true, and therefore, Y is true. According to the truth table, (Y Z) is false, in contradiction to our assumption that (Y Z) is true. Another option for proof: (Y Z is false 29

30 denotes that (X (Y Z)) is false in contradiction. Now, let s look at: (( X Y) (Y X)) Convince yourself that this is always true. End of proof (for the action): If X is always true and (X Y) is always true, denotes that Y is always true. The only situation where X is true and (X Y) is true in the truth table is where Y is also true. We introduce a new symbol: = X means that X is always true. So, what did we prove? = X X 30

31 4 Lecture 3 - March 18, What We ve Done so Far So far, we talked about the inductive set I(A, P) and characterized it using two options: Bottom-Up - from atoms you activate the actions. Top-Down (also known as declarative) - you see that the set includes the atoms and is closed over the actions, and then you take the minimal set. We discussed propositional calculus - We defined a sentence using induction - We took the letters p, q, r,... - and then defined that if α,β,... sentences, then (α β) is also a sentence, and ( β) is also a sentence, and so on. We defined a proof system. We showed that if we can prove a sentence denoted by α, then the sentence is always true = α. We used the axioms: (β (α β)) ((β (α δ)) ((β δ) (β δ))) ((( α) ( β)) (β α)) Note that all of the axioms are tautologic That is - they have the same values in truth tables α β (α β) β (α β) T T T T T F F T F T T T F F T T Action: α β α Separation β Example α = p q β = p q 31

32 Using Axiom 1: ((p q) ((( p) q) (p q))) Using Axiom 2: (((p q) ((( p) q) (p q))) (((p q)) (( p) q)) ((p q) (( p) q)))) Separation: (((p q) (( p) q)) (((p q) (( p) ))) The second characteristic that is complementary in this sense: If something is true, it can be proved. = α α Semantics and syntax are the same in propositional calculus: JAVA Syntax Sentence Axioms Proof α α = α The meaning of the program Semantics Sentences True-False Tautology = α Example One of the main purposes of this course is learning how to define what a software system does. This is known as specification or defining a software requirement. The system will perform the action quickly. Is this a satisfactory requirement? This is an undefined requirement and can cause the project to fail. Bad requirements cause projects by contract to fail. Another problematic requirement: The system should always be available. What is always and what is available? The system should respond to user requirements within two thousands of a second. The system should never lose data. These are all problematic requirements. Our purpose is a very distinct definition of system requirements. To do so, - we will use the Z language. The Z language uses: 32

33 Set theory + relational calculus + types of sets (for example, universe, needed for checking consistency) This means that we will only have members of the same type so that we can check consistency. We won t, for instance, have a group: {Subaru, Volvo, University of Haifa} 4.2 Our Main Running Example We would like to create a system of glossaries (dictionaries) with specific relationships between the glossaries. The system will maintain consistency between hierarchies of glossaries. Why do we need this system? And why do we need consistency? Many times, when you look at a series of written documents, each document is maintained at a certain level. At a certain level, you can use the dictionary of the language in which it was written. But then, at a more specific level, the dictionary of the language is okay only as a starting point. In addition, you also need a glossary of specific terms, which may contain terms that are used and defined differently than the way they are defined in the language. New terms may also be added to the glossary. For instance: CSP - Constraints Satisfaction Problem It is not in the English Language, but it will appear in the specific glossary. We might also have the term: Thread, which in the dictionary is a string, but in the glossary will be overwritten by a type of execution process - something that has a control flow, but with no heap memory (something like a light-process ). We need to use the most relevant glossary for the term. When defining terms, we have a problem. We don t want to use words that are too specific - words that will limit the implementation. For instance, if we define a communication protocol and don t want to use the term: byte. Why? Because we want to leave an option to implement the protocol using bytes or words (2 bytes) or any other implementation. Observation: One of the interesting aspects is that if you are able to choose the correct consistent set of terms, your requirements and definitions are much more accurate and productive (in the process of software development). Next, we are going to try to define the hierarchy of the glossaries in the 33

34 Z language: This is not instead of the definition in words - it is complementary. For the definition, we first need to define some infrastructure: We start by defining: AlephBet = {a, b,..., z, A, B,..., Z} The set of letters: We need the AlephBet and the punctuation signs to define what strings are and to define what dictionary/glossary entries are. We further define: Punctuation = {,,,!,?,...} We define a sign: sign = AlephBet Punctuation Next, we will want to be able to define a word (term) and a sentence (which will be used later as the definition of the term). A word in a dictionary (we allow words without a logical meaning): Words = i=1a i Where: A i = X i j=1 AlephBet i, -in this case, is the length of the word. X is the Cartesian Product. A Cartesian Product of order i is all the possible permutations of a string containing i letters from the AlephBet. = {(a 1,a 2,...,a i ) a j AlephBet 1 j i } Example: For i = 3 3 i=1 AlephBet = AlephBet x AlephBet x AlephBet = {aaa, aab, aac, abc, zaa, zab, zac,..., ZZZ} a 1 a 2 a 3 3 i=1 AlephBet if and only if a 1 AlephBet a 2 AlephBet a 3 AlephBet We further define sentences: Sentences = i=1p i Where: P i = X i j=1 sign We define the length of the strings #: #W = i W A i #S = i S P i For example: #(aaa) = 3 #(abc) = 3 A glossary/dictionary will be a set of couples - terms (words) and sentences that make up the definition. For instance: {( dog, an animal with four legs ), ( cat, an animal with four legs that does not bark )} 34

35 We continue by defining the substring function: substring(w, S) : Words X Sentences {True, False} W Words, S Sentence substring(w, S) = True i N, #W + i > j i, W(j-i) = S(j) Meaning: substring(w, S) : Words X Sentences {True, False} Which means a function from the Cartesian Product of Words and Sentences to {True, False} A function is something that creates a connection between each member of the source to a single member in the destination. Our source is the Cartesian Product of words and sentences Our destination is: {True, False}. We define our function as: W Words, S Sentence substring(w, S) = True i N, #W + i > j i, W(j-i) = S(j) means if and only if W(j) means the j th character in the word Examples: substring(abc, atzbc) = False substring(abc, ztabcr) = True #W = #(abc) = 3 We look at j, which is the indexes between i=3 to #w+i = 3+3 = 6, not including 6. W(j-i) = S(j) For j=3 - W(0) = S(3) = a For j=4 - W(1) = S(4) = b For j=5 - W(2) = S(5) = c Another example: S = I m going home W = home Starting with index zero S(0) = I i = 10 #W = 4 i + #W > j i So j is between 10 (inclusive) and smaller than 14 (up to 13 inclusive). S(10) = W(0) = h S(11) = W(1) = o S(12) = W(2) = m and S(13) = W(3) = e And therefore, the word home is a substring of the sentence I m going home. 35

36 4.3 Hierarchy of Dictionaries k Dictionaries (Glossaries): D 1,..,D k P( Words X Sentences ) Each D i i = 1, 2,... k - is a dictionary (Glossary) where X is the Cartesian Product. P is the Power Set - the whole set of subsets. Each glossary, D i, in the hierarchy will maintain a relationship between its words and their meanings (as a pair (W, S) of words and their meanings). For example: D 1 = { ( dog, something that barks ), ( cat, something my wife keeps at home ) } First Rule: i {1,..,k} (W 1,S 1 ) D i (W 2,S 2 ) D j such that j > i W 2 W 1 substring(w 2,S 1 ) k - is the same k as above Explanation in words: in glossary I, you can t use a word either as a Word or as a Sentence. -This means that in the sentence in S 1, we can t use words that we will define later in D j j>i. Note that the following is a tautology: = ( a b) (a b) You can convince yourself using the truth table: if and only if relationship: p q: p q p q t t t t f f f t f f f t Next time we will start by adding additional rules to the Hierarchy of Glossaries. 36

37 5 Lecture 4 - March 25, In this and Upcoming Lectures Hierarchy of Continued Rules for Glossary Design Sets Type Cartesian Product Sets Functions Bijective Function Equivalence Classes Fixed Point Theorem 5.2 Hierarchy of Continued Rules for Glossary Design Another rule: (W 1,S 1 ) D i (W 2,S 2 ) D i W 1 W 2 S 1 S 2 We define: result = { OK, OKDup, FailedAbstract, FailedDup} i = 1,..., k We define: completed i = { (W, S) such that 1 j i such that (W, S) D j ( r > j (W,S) D r ) } Where (W, S) P(Words X Sentences) These are the terms that are allowed for use in the i th level Action: Adding a word and a definition: (W?, S?) (Words X Sentences) to D i D i is termed Schema (in Z language) The? in Z Language is input i? : N, (W?, S?) : Words X Sentences res! : Result We want to return a result from the Result type that we defined before. (! is the output of the action in Z) ( k j > i?, (W1,S1) D j such that W1 = W? substring(w1, s?)) 37

38 which means that the result is: res! = FailedAbstract ( (W1,S1) D i such that W1 = W?) res! = FailedDup ( 1 =< j =< i(w1,s1) D j and W1 = W?) D i - the situation of the dictionary after the action D i = D i {(W?,S?)} res! = OKDup OKDup - we can define again a term that we defined in a previous level D i = D i {(W?,S?)} res! = OK Next, we prove by induction on the action that if we start with the dictionary D i = ø(the atom), and define the action as the schema, then we can use the inductive set proof method to prove that all resulting dictionaries maintain the same rules. Intuitively - this is clear - since our only action adds - without breaking the rule 38

39 Part III Exercises 6 Exercise 1 - March 05, Introduction We will start with predicate calculus From the predicate calculus, we derive the semantics From the semantics, we will derive Verification using Invariants Predicate Calculus Predicate Calculus is, in essence, a proving system. If you want to use it, you choose a language (basic terms such as + or period ) and a collection of axioms, and then you can start deriving formal conclusions from the axioms. Prepositional Calculus will describe what a valid conclusion is Semantics Semantics are used to investigate the meaning associated with the syntax. To derive semantically means that something is true in any model in which the axioms are true What is a proof? A proof must be based on axioms. Otherwise, proving that 1 plus 1 equals 2 takes more than 200 pages. 6.2 Logics Sets Different ways to mark sets: 1. curly parentheses, {}, with the group members inside (a) An explicit list of members in parentheses For instance: {1, 2, 70} 39

40 (b) Using a list that explains a rule For instance: {0, 1, 2, 3,...} (c) Using a common attribute For instance: {i: where i is an even number} 2. By giving the set a name, using a known letter For instance: N the natural numbers Basic Terms In: x A - the member x belongs to set A Subset: A B - set A is a subset of set B if for every x A, it also holds that x B A B, then it is said that A is a subset of B Note: The empty set {}, also known as ø, is a subset of any other set A true subset: A B, if for every x A, it also holds that x B and there exists at least one x 0 B, such that x 0 / A Equality among sets: Two sets, A and B, are equal A = B, if A and B have the same members Equality between sets is proved using two-way containment Actions between Sets Unity: A B = {x : x A or x B} Intersection: A B = {x : x A and x B} Subtraction: A\B = {x : x A and x / B} Complementary: A c = x : x / A Note that in the complementary set, you have to know over what world you are working. Foreign Sets: where A B =ø 40