Abella : A System for Reasoning about Relational Specifications

Concrete Precedence/ Associativity Types (τ) Atomic types prop, nat, list, . Arrow types τ1 → τ2 T1 -> T2 right Terms (m,n) Variables x, y, . x, y, . Constants c, d, . c, d, . Nominal constants n1, n2, . n1, n2, . (n followed by at least one digit) Abstractions λx. m x\ M 0, right λx:τ. m x:T\ M 0, right Applications m n M N 5, left Formulas (A,B) Logical constants >,⊥ true, false m = n M = N 4, none Atomic formulas p m1 · · · mn p M1 . Mn 5, left Connectives A ∧B A /\ B 3, left A ∨B A \/ B 2, left A ⊃ B A -> B 1, right Quantifiers ∀x. ∀y:τ. A forall x (y:T) . , A 0 ∃x. ∃y:τ. A exists x (y:T) . , A 0 ∇x. ∇y:τ. A nabla x (y:T) . , A 0 (parentheses required for type-annotations) The Abella user manual [71] gives details on the lexical structure of identifiers. Parentheses may be used to explicitly indicate groupings, which is otherwise inferred using the precedence and associativity rules in the fourth column. Fig. 1: Concrete Syntax for G in Abella. Formulas in Abella are written using the standard syntax as shown in Figure 1. Formulas are actually terms of type prop. Atomic formulas are formulas whose top-level constructor is not a logical symbol (i.e., a logical constant, connective, or quantifier). In other words, the top-level constructor of an atomic formula must be a user defined constant with the target type prop. Such a constant is called a predicate or relational symbol. Predicate symbols can be introduced through Type declarations or through the Define or CoDefine commands explained in Sections 4.1 and 5. The scoping rules for the quantifiers of G are similar to those for λ-abstractions, and the types of such quantified variables may also be omitted when they can be inferred uniquely. Note that Abella does not allow quantification over variables whose types contain the type prop. In particular, quantification is not permitted over predicate variables, i.e., variables that have prop as their target type. In the next several sections, we will not make explicit use of λ-abstractions in terms: as a result, these sections will view Abella as being based on a fairly standard first-order logic. Starting in Section 6, the treatment of λ-bindings will play an important role in our examples. It is also from that section on that we will allow formulas to contain the ∇ quantifier and terms and formulas to contain nominal constants. Journal of Formalized Reasoning Vol. 7, No. 2, 2014. Abella: A System for Reasoning about Relational Specifications · 7 2.2 Some top-level commands Interacting with Abella involves issuing a sequence of commands: such commands declare kinds and types, introduce definitions, state theorems and develop their proofs. All such commands end with a full-stop. We can also intersperse commands with comments. Comments take the form of line-comments that begin with the character % that causes the rest of the line to be ignored, or with arbitrary text delimited by a balanced pair of /* and */ (supporting nesting). Declarations come in two varieties: declarations of new atomic types, and declarations of new constants. To declare a new atomic type, one uses a Kind declaration that has the general form: Kind b1 , . , bn type. where the b1, . , bn are pairwise distinct valid identifiers that are not already atomic types declared earlier. Each of b1, . , bn is then added to the collection of atomic types that may be used to form other types. The final keyword type is used to indicate that these atomic types have kind type; this is somewhat redundant for the simple type system of Abella, but allows for future extensions to the type system with higher kinded atomic types. To declare a collection of constants c1, . , cn of a particular type T, one uses a Type declaration that has the general form: Type c1 , . , cn T. The type T must be formed out of atomic types that have been declared earlier by means of Kind declarations. Further, the constants c1, . , cn must be pairwise distinct valid identifiers that are not already declared using Type or defined using the Define or CoDefine commands that we discuss later. Every Abella development begins with a standard collection of type and constant declarations preloaded, shown in Figure 9 in the appendix. As an example, here is how we would define a new atomic type nat of natural numbers, constants z and s to construct such numbers, and a type list of natural numbers with constants empty and cons to construct them. Kind nat type. Type z nat. Type s nat -> nat. Kind list type. Type empty list. Type cons nat -> list -> list. It is important to note that the collection of constants of any type may be extended at any time with new declarations. Thus, there is no guarantee that all terms of type nat, for instance, are constructed using just z and s. Another command in Abella is the one that proposes a formula to be considered for proof. This command has the following general form: Theorem thm_name : A. where thm_name is any valid identifier that is distinct from other constants declared or defined earlier, and A is a formula. Abella uses the same keyword Theorem for all Journal of Formalized Reasoning Vol. 7, No. 2, 2014. 8 · Baelde, Chaudhuri, Gacek, Miller, Nadathur, Tiu, & Wang flavors of provable formulas – lemmas, propositions, corollaries, etc. Every theorem must be followed by its proof, which is a series of tactics: we start introducing tactics in Section 2.3. Interactions with Abella are often called developments. Such developments can be entered either interactively or via batch files: in the latter case, the files are given names with the suffix . thm. Such files can be piped directly to the abella program or can be given as the first command line argument to the program. Abella processes the file and outputs its interaction history to standard output until it encounters an error (which causes an immediate abort of the program except in the interactive top-level) or it finishes processing all the commands in the file. In the interactive top-level, Abella uses the prompt