Table Of ContentEditors:
Werner Rheinboldt
University of Pittsburgh
Pittsburgh, Pennsylvania
Daniel Siewiorek
Carnegie-Mellon University
Pittsburgh, Pennsylvania
Editorial Advisory Board:
Kazuhiro Fuchi, Director
Institute for New Generation Computer Technology (ICOT)
Tokyo, Japan
Makoto Nagao
Kyoto University
Kyoto, Japan
PERSPECTIVES IN COMPUTING, Vol. 23
(Formerly "Notes and Reports in Computer Science
and Applied Mathematics")
A Computational Logic Handbook
Robert S. Boyer
J Strother Moore
Department of Computer Science
University of Texas at Austin
Austin, Texas
and
Computational bogie Incorporated
Austin, Texas
ACADEMIC PRESS, INC.
Harcourt Brace Jovanovich, Publishers
Boston San Diego New York
Berkeley London Sydney
Tokyo Toronto
Copyright © 1988 by Academic Press, Inc.
All rights reserved.
No part ot this publication may be reproduced or
transmitted in any form or by any means, electronic
or mechanical, including photocopy, recording, or
any information storage and retrieval system, without
permission in writing from the publisher.
ACADEMIC PRESS, INC.
1250 Sixth Avenue, San Diego, CA 92101
United Kingdom Edition published by
ACADEMIC PRESS INC. (LONDON) LTD
24-28 Oval Road, London NW1 7DX
Symbolics, Symbolics 3640, and Zetalisp® are trademarks
of Symbolics, Inc.
Sun, Sun 3/280, and Sun 3/60 are trademarks of Sun Microsystems, Inc.
Lucid and Lucid Common Lisp are trademarks of Lucid, Inc.
Unix® is a trademark of AT&T Information Systems, Inc.
Library of Congress Cataloging-in-Publication Data
Boyer, Robert S.
A computational logic handbook / Robert S. Boyer, J Strother
Moore
p. cm.
Bibliography: p.
Includes index.
ISBN 0-12-122952-1
1. Automatic theorem proving. 2. Logic, Symbolic and
mathematical. I. Moore, J Strother, Date II. Title.
QA76.9.A96B684 1988
511.3-dc19 88-22175
CIP
Printed in the United States of America
88 89 90 91 9 8 7 6 5 4 3 2 1
Preface
This book is a user's guide to a computational logic. A ''computational logic"
is a mathematical logic that is both oriented towards discussion of computation
and mechanized so that proofs can be checked by computation. The computa
tional logic discussed in this handbook is that developed by Boyer and Moore.
This handbook contains a precise and complete description of our logic and a
detailed reference guide to the associated mechanical theorem proving system.
In addition, the handbook includes a primer for the logic as a functional pro
gramming language, an introduction to proofs in the logic, a primer for the
mechanical theorem prover, stylistic advice on how to use the logic and theorem
prover effectively, and many examples.
The logic was last described completely in our book A Computational
Logic, [4], published in 1979. The main purpose of the book was to describe in
detail how the theorem prover worked, its organization, proof techniques,
heuristics, etc. One measure of the success of the book is that we know of three
independent successful efforts to construct the theorem prover from the book.
In the eight years since A Computational Logic was published, the logic and
the theorem prover have changed. On two occasions we changed the logic, both
times concerned with the problem of axiomatizing an interpreter for the logic as
a function in the logic but motivated by different applications. The first attempt
was motivated by the desire to permit metatheoretic extensibility: the efficient
use of functions in the logic as new proof procedures once they have been
proved sound. This work was completely described in [5] and resulted in minor
changes to the formalization of literal atoms, the introduction of QUOTE nota
tion, and axioms defining a weak interpreter for a fragment of the logic. The
XI
xii A Computational Logic Handbook
second attempt was motivated by the desire to permit bounded quantification
and the introduction of partial recursive functions. This work was described
in [11]. It scrapped the previously added axioms for an interpreter and added
axioms defining a more powerful one.
In both [5] and [11] we described accompanying changes in the theorem
prover itself, most notably in the heuristics for expanding recursive functions
(where we no longer always expand a function when its controlling arguments
are explicit constants) and new heuristics for simplifying calls of the interpreter
on constants representing terms.
There have been two truly important changes to the theorem prover since
1979, neither of which has had to do with additions to the logic. One was the
integration of a linear arithmetic decision procedure. The other was the addition
of a rather primitive facility permitting the user to give hints to the theorem
prover.
During the period 1980-1984 we integrated into the rewrite-driven simplifier
a linear arithmetic decision procedure. The goal—which was not entirely
achieved—was to free the heuristic component of the simplifier from having to
deduce the consequences of a decidable fragment of its theory, permitting the
axioms for that fragment to be ignored. In the case of linear arithmetic this
meant we could eliminate from the simplifier's view such troublesome facts as
the transitivity of less than and the monotonicity of the Peano addition function.
However, to achieve the intended goal it was necessary to make the decision
procedure serve the simplifier in all the roles that the omitted axioms had
previously. This was very difficult because of the complexity of the simplifier.
We eventually adopted a decision procedure for the rationals which gave good
performance and coverage in the integer case but which is not complete for the
integer case. The resulting "linear arithmetic package" has proved to be very
robust and useful. The entire history of our experiment and the final arrange
ment of heuristics and the decision procedure is completely described in [12].
The second important change was the addition of a primitive hint facility.
The two most commonly used hints can be paraphrased as "consider the follow
ing instance of the previously proved theorem n" and "do not consider using
the previously proved theorem m." Prior to the implementation of the hint
facility, the user could guide the system to a proof—as we did for the prime
factorization theorem in [4]—by the proper statement of lemmas to be proved
before the main theorem. The hint facility just made it less difficult to lead the
theorem prover when that was necessary. Because our hint facility contributed
no new ideas to the literature of automatic theorem proving we have not
documented it previously.
The most important changes have occurred not in the logic or the code but in
our understanding and use of them. The past eight years have seen the heavy
use of the logic and theorem prover. They have been pushed into successful
Preface xiií
applications far beyond those we reported in A Computational Logic. The most
impressive number theoretic result proved in 1979 was the existence and
uniqueness of prime factorizations; it is now Gauss's law of quadratic
reciprocity. The most impressive metamathematical result was the soundness
and completeness of a propositional calculus decision procedure; it is now
Goder s incompleteness theorem. These results are not isolated peaks on a plain
but just the highest ones in ranges explored with the system. Among others are
Fermat's theorem and Wilson's theorem, the unsolvability of the halting
problem, the tautology theorem, and the Church-Rosser theorem. In program
verification it is now hardly meaningful to choose a single peak. In 1979 it was
the correctness of the Boyer-Moore fast string searching algorithm; among the
many we are now proud of are the invertibility of the RSA public key encryption
algorithm, the equivalence of sequential and parallel executions of a bitonic sort
algorithm, the correctness of a gate-level design of a microprocessor, the cor
rectness of a simple multitasking operating system, and the correctness of a
compiler and link-assembler for a nontrivial programming langugage. An an
notated list of references to the important results proved by the system is given
on page 5.
The improvements to the logic and theorem prover, especially linear arith
metic and the hint facility, have certainly helped make these conquests possible.
But perhaps the most important change since the publication of A Computa
tional Logic was that in 1981 we moved from SRI International, where we were
involved exclusively in research, to the University of Texas at Austin. Our
research home at the University of Texas was the Institute for Computing
Science. However, as professors in the Department of Computer Sciences, we
teach. In 1981 we began teaching a graduate course, now called Recursion and
Induction, on how to prove theorems in our logic, and we initiated a weekly
logic seminar attended by graduate students, other faculty members, and
logicians from local research organizations. These efforts dramatically in
creased the number of people familiar with our work. In addition, we began
using the theorem prover to check the proofs of theorems we wanted to present
in class (e.g., the unsolvability of the halting problem).
Almost all of the results we are now most proud of were carried out under the
direction of former students who saw our mechanically checked proofs of the
simpler theorems (unsolvability or RSA) and came to us believing they could
lead the expeditions to the harder theorems. Almost invariably we thought they
were wrong—they simply didn't understand how obstinate the theorem prover
is, how weak the logic is, how many hacks and kludges there are inside. And
almost invariably we were right about their naivete but wrong about their talent
and persistence. Time and time again our students came forth with impressive
results. We haven't revised our opinion of our system—it is obstinate, the logic
is weak, and there are many hacks. But we have nothing but praise for the
xiv A Computational Logic Handbook
graduate students who have used our system with such success: David Rus-
sinoff, Warren Hunt, Natarajan Shankar, C.-H. Huang, Bill Bevier, Bill Young,
David Goldschlag, Jimi Crawford, and Michael Vose.
In summary, there have been comparatively minor changes to the logic and
theorem prover since the publication of A Computational Logic, but there have
been dramatic increases in both the difficulty of the problems to which the
system has been applied and the number of people who use the system. We
believe that the theorem prover as it stands today (except for the provisions for
hints) is adequately described by the combination of [4, 5, 12, 11]. We describe
the hint facility here and do not otherwise attempt the thorough documentation
of our techniques. What was lacking, in our view, was a thorough treatment of
how to use the logic and the theorem prover. That is the main objective of the
current work.
To make this volume self-contained we present a complete description of the
current logic and as much information about how the system works as is neces
sary to describe how to use it. That said, however, we think of this book as a
continuation of A Computational Logic rather than a replacement for it.
The decision to document the logic and system now should not be taken as a
declaration that it is ''fixed." In particular, we still have serious misgivings
about the pragmatics of our new interpreter for the logic, V&C$, and the
bounded quantifier, FOR. We will, undoubtedly, either improve the system's
handling of these functions or we will replace them entirely with new and
hopefully better formal constructs. Our decision to document the current system
stems in part from our perceived scientific duty to tell the community exactly
what we are doing and in part from the realization that the user community has
grown sufficiently large that written documentation will save us the time we
otherwise spend telling people how to use the system.
As previously noted, it is to our user community that we owe our biggest debt.
The contributions of the graduate students of the University of Texas, especially
those that we supervised, cannot be overemphasized. In particular, we acknowl
edge the contributions of Bill Bevier, S.C. Chou, Ernie Cohen, Jimi Crawford,
David Goldschlag, C.H. Huang, Warren Hunt, Myung Kim, David Russinoff,
Natarajan Shankar, and Bill Young. In addition, we have profited enormously
from our association with Hans Kamp, Chris Lengauer, Norman Martin, John
Nagle, Carl Pixley, and Bill Schelter. Topher Cooper has the distinction of
being the only person to have ever found an unsoundness in a released version
of our system.
Many people have contributed to this handbook, including all of the users
named above. We would like to especially thank Natarajan Shankar, who
helped write part of Chapter 4 and some of the proofs in Chapter 5. In addition,
many errors in the handbook were found by students who took our courses. We
especially thank Tom Verhoeff and Sam Dooley, who read the handbook very
Preface XV
carefully.
Finally, special note must be made of the contributions of Matt Kaufmann.
Matt has used the theorem prover to do several interesting proofs, including the
correctness of a unification algorithm and the correctness of a Towers of Hanoi
solution. In addition, Matt undertook the careful scrutiny of the preliminary
version of the code implementing bounded quantification and partial functions.
His months of study uncovered several subtle bugs and led to many clarifying
comments and helpful suggestions. In addition, he went over the handbook with
a fine-tooth comb.
We also most gratefully acknowledge the support of our colleagues at the
Institute for Computing Science, especially Don Good and Sandy Olmstead who
created and maintained at the Institute a creative and relaxed research atmo
sphere with excellent computing facilities. In 1986 we moved our entire
verification research group off campus and established Computational Logic,
Inc.
Notwithstanding the contributions of all our friends and supporters, we would
like to make clear that ours is a very large and complicated system that was
written entirely by the two of us. Not a single line of Lisp in our system was
written by a third party. Consequently, every bug in it is ours alone. Soundness
is the most important property of a theorem prover, and we urge any user who
finds such a bug to report it to us at once.
The development of our logic and theorem prover has been an ongoing effort
for the last 15 years. During that period we have received financial support
from many sources. Our work has been supported for over a decade by the
National Science Foundation and the Office of Naval Research. Of the many
different grants and contracts involved we list only the latest: NSF Grant
DCR-8202943, NSF Grant DCR81-22039, and ONR Contract N00014-81-
K-0634. We are especially grateful to NSF, ONR, and our technical monitors
there, Tom Keenan, Bob Grafton, and Ralph Wächter, for years of steady sup
port and encouragement.
We have received additional support over the years from the following
sources, listed chronologically: Science Research Council (now the Science and
Engineering Research Council) of the United Kingdom, Xerox, SRI Inter
national, NASA, Air Force Office of Scientific Research, Digital Equipment
Corporation, the University of Texas at Austin, the Venture Research Unit of
British Petroleum, Ltd., IBM, National Computer Security Center, and Space
and Naval Warfare Systems Command.
Since 1984 the major part of our funding has come from the Defense Ad
vanced Research Projects Agency. At UT we were supported by ARPA Order
Number 5246. At Computational Logic, Inc., we are supported by ARPA Order
Numbers 9151 and 6082. The research described here was supported in part by
the U.S. Government. The views and conclusions contained in this book are
xvi A Computational Logic Handbook
those of the authors and should not be interpreted as representing the official
policies, either expressed or implied, of the Defense Advanced Research
Projects Agency or the U.S. Government.
The first draft of this handbook was written entirely by Moore and required
slightly over a year to write. During that time his wife, Miren, and their
children, Lisa, Nicolas, Jonathan, and Natalie, made many sacrifices so that he
could work with few interruptions. We are especially grateful to them for their
understanding and patience.
1 Introduction
By a "computational logic," we mean a logic that is both oriented towards
discussion of computation and mechanized so that proofs can be checked by
computation. We are the authors of one such logic and its associated mechani
cal theorem prover. This book explains how to use the logic and the theorem
prover.
The book is divided into two parts. In Part I we discuss the logic, without
regard for its mechanization. In Part II we discuss its mechanization. Part I
answers the questions "what are the axioms and rules of inference?" and "how
does one use the logic to state and prove theorems?" Part II answers the
question "how does one use the Boyer-Moore theorem prover to prove
theorems?"
Do not be put off by the size of the documentation. Much of the verbiage
here is devoted to spoon-fed introductions and primers, examples, and stylistic
advice on how to use the logic and its implementation effectively.
Two chapters have been designed as reference guides.
• Chapter 4 is the technical heart of Part I and is a detailed description
of the syntax, axioms, and rules of inference of the logic. In ad
dition to defining the logic, we carefully define many metalinguistic
and metatheoretical notions used in the description of the logic.
• Chapter 12 is the technical heart of Part II and is a reference guide
to the theorem prover. It is organized so that you can read only the
parts relevant to a given command or concept and cross-referenced
so that you can track down unfamiliar notions.
Having tried to allay your fears of the book itself, we now give a brief
3
