- •Contents
- •Foreword to the first edition
- •Preface to the second edition
- •Our motivation for (re)writing this book
- •What’s new and what’s gone
- •The interdependence of chapters and prerequisites
- •Acknowledgements
- •Added for second edition
- •1 Propositional logic
- •1.1 Declarative sentences
- •1.2 Natural deduction
- •1.2.1 Rules for natural deduction
- •1.2.2 Derived rules
- •1.2.3 Natural deduction in summary
- •1.2.4 Provable equivalence
- •1.2.5 An aside: proof by contradiction
- •1.3 Propositional logic as a formal language
- •1.4 Semantics of propositional logic
- •1.4.1 The meaning of logical connectives
- •1.4.2 Mathematical induction
- •1.4.3 Soundness of propositional logic
- •1.4.4 Completeness of propositional logic
- •1.5 Normal forms
- •1.5.1 Semantic equivalence, satisfiability and validity
- •1.5.2 Conjunctive normal forms and validity
- •1.5.3 Horn clauses and satisfiability
- •1.6 SAT solvers
- •1.6.1 A linear solver
- •1.6.2 A cubic solver
- •1.7 Exercises
- •1.8 Bibliographic notes
- •2 Predicate logic
- •2.1 The need for a richer language
- •2.2 Predicate logic as a formal language
- •2.2.1 Terms
- •2.2.2 Formulas
- •2.2.3 Free and bound variables
- •2.2.4 Substitution
- •2.3 Proof theory of predicate logic
- •2.3.1 Natural deduction rules
- •2.3.2 Quantifier equivalences
- •2.4 Semantics of predicate logic
- •2.4.1 Models
- •2.4.2 Semantic entailment
- •2.4.3 The semantics of equality
- •2.5 Undecidability of predicate logic
- •2.6 Expressiveness of predicate logic
- •2.6.1 Existential second-order logic
- •2.6.2 Universal second-order logic
- •2.7 Micromodels of software
- •2.7.1 State machines
- •2.7.2 Alma – re-visited
- •2.7.3 A software micromodel
- •2.8 Exercises
- •2.9 Bibliographic notes
- •3 Verification by model checking
- •3.1 Motivation for verification
- •3.2 Linear-time temporal logic
- •3.2.1 Syntax of LTL
- •3.2.2 Semantics of LTL
- •3.2.3 Practical patterns of specifications
- •3.2.4 Important equivalences between LTL formulas
- •3.2.5 Adequate sets of connectives for LTL
- •3.3 Model checking: systems, tools, properties
- •3.3.1 Example: mutual exclusion
- •3.3.2 The NuSMV model checker
- •3.3.3 Running NuSMV
- •3.3.4 Mutual exclusion revisited
- •3.3.5 The ferryman
- •3.3.6 The alternating bit protocol
- •3.4 Branching-time logic
- •3.4.1 Syntax of CTL
- •3.4.2 Semantics of computation tree logic
- •3.4.3 Practical patterns of specifications
- •3.4.4 Important equivalences between CTL formulas
- •3.4.5 Adequate sets of CTL connectives
- •3.5.1 Boolean combinations of temporal formulas in CTL
- •3.5.2 Past operators in LTL
- •3.6 Model-checking algorithms
- •3.6.1 The CTL model-checking algorithm
- •3.6.2 CTL model checking with fairness
- •3.6.3 The LTL model-checking algorithm
- •3.7 The fixed-point characterisation of CTL
- •3.7.1 Monotone functions
- •3.7.2 The correctness of SATEG
- •3.7.3 The correctness of SATEU
- •3.8 Exercises
- •3.9 Bibliographic notes
- •4 Program verification
- •4.1 Why should we specify and verify code?
- •4.2 A framework for software verification
- •4.2.1 A core programming language
- •4.2.2 Hoare triples
- •4.2.3 Partial and total correctness
- •4.2.4 Program variables and logical variables
- •4.3 Proof calculus for partial correctness
- •4.3.1 Proof rules
- •4.3.2 Proof tableaux
- •4.3.3 A case study: minimal-sum section
- •4.4 Proof calculus for total correctness
- •4.5 Programming by contract
- •4.6 Exercises
- •4.7 Bibliographic notes
- •5 Modal logics and agents
- •5.1 Modes of truth
- •5.2 Basic modal logic
- •5.2.1 Syntax
- •5.2.2 Semantics
- •Equivalences between modal formulas
- •Valid formulas
- •5.3 Logic engineering
- •5.3.1 The stock of valid formulas
- •5.3.2 Important properties of the accessibility relation
- •5.3.3 Correspondence theory
- •5.3.4 Some modal logics
- •5.4 Natural deduction
- •5.5 Reasoning about knowledge in a multi-agent system
- •5.5.1 Some examples
- •5.5.2 The modal logic KT45n
- •5.5.3 Natural deduction for KT45n
- •5.5.4 Formalising the examples
- •5.6 Exercises
- •5.7 Bibliographic notes
- •6 Binary decision diagrams
- •6.1 Representing boolean functions
- •6.1.1 Propositional formulas and truth tables
- •6.1.2 Binary decision diagrams
- •6.1.3 Ordered BDDs
- •6.2 Algorithms for reduced OBDDs
- •6.2.1 The algorithm reduce
- •6.2.2 The algorithm apply
- •6.2.3 The algorithm restrict
- •6.2.4 The algorithm exists
- •6.2.5 Assessment of OBDDs
- •6.3 Symbolic model checking
- •6.3.1 Representing subsets of the set of states
- •6.3.2 Representing the transition relation
- •6.3.4 Synthesising OBDDs
- •6.4 A relational mu-calculus
- •6.4.1 Syntax and semantics
- •6.5 Exercises
- •6.6 Bibliographic notes
- •Bibliography
- •Index
2.4 Semantics of predicate logic |
129 |
Does the model M satisfy this formula? Well, it does not; for we may choose |
|
a for x and b for y. Since (a, a) |
is in the set lovesM and (b, a) is in the |
set lovesM, we would need that |
the latter does not hold since it is the |
interpretation of loves(y, alma); this cannot be. |
And what changes if we modify |
M |
to |
M |
, where we keep A and almaM, |
||
|
|
|
def |
{(b, a), (c, b)}? Well, |
||
but redefine the interpretation of loves as lovesM |
= |
now there is exactly one lover of Alma’s lovers, namely c; but c is not one of Alma’s lovers. Thus, the formula in (2.8) holds in the model M .
2.4.2 Semantic entailment
In propositional logic, the semantic entailment φ1, φ2, . . . , φn ψ holds i : whenever all φ1, φ2, . . . , φn evaluate to T, the formula ψ evaluates to T as well. How can we define such a notion for formulas in predicate logic, considering that M l φ is indexed with an environment?
Definition 2.20 Let Γ be a (possibly infinite) set of formulas in predicate logic and ψ a formula of predicate logic.
1.Semantic entailment Γ ψ holds i for all models M and look-up tables l, whenever M l φ holds for all φ Γ, then M l ψ holds as well.
2.Formula ψ is satisfiable i there is some model M and some environment l such that M l ψ holds.
3.Formula ψ is valid i M l ψ holds for all models M and environments l in which we can check ψ.
4.The set Γ is consistent or satisfiable i there is a model M and a look-up table l such that M l φ holds for all φ Γ.
In predicate logic, the symbol is overloaded: it denotes model checks ‘M φ’ and semantic entailment ‘φ1, φ2, . . . , φn ψ.’ Computationally, each of these notions means trouble. First, establishing M φ will cause problems, if done on a machine, as soon as the universe of values A of M is infinite. In that case, checking the sentence x ψ, where x is free in ψ, amounts to verifying M [x →a] ψ for infinitely many elements a.
Second, and much more seriously, in trying to verify that φ1, φ2, . . . , φn ψ holds, we have to check things out for all possible models, all models which are equipped with the right structure (i.e. they have functions and predicates with the matching number of arguments). This task is impossible to perform mechanically. This should be contrasted to the situation in propositional logic, where the computation of the truth tables for the propositions involved was the basis for computing this relationship successfully.
130 |
2 Predicate logic |
However, we can sometimes reason that certain semantic entailments are valid. We do this by providing an argument that does not depend on the actual model at hand. Of course, this works only for a very limited number of cases. The most prominent ones are the quantiÞer equivalences which we already encountered in the section on natural deduction. Let us look at a couple of examples of semantic entailment.
Example 2.21 The justification of the semantic entailment
x (P (x) → Q(x)) x P (x) → x Q(x)
is as follows. Let M be a model satisfying x (P (x) → Q(x)). We need to show that M satisfies x P (x) → x Q(x) as well. On inspecting the definition of M ψ1 → ψ2, we see that we are done if not every element of our model satisfies P . Otherwise, every element does satisfy P . But since M satisfies x (P (x) → Q(x)), the latter fact forces every element of our model to satisfy Q as well. By combining these two cases (i.e. either all elements of M satisfy P , or not) we have shown that M satisfies x P (x) → x Q(x).
What about the converse of the above? Is
x P (x) → x Q(x) x (P (x) → Q(x))
valid as well? Hardly! Suppose that M is a model satisfying x P (x) →x Q(x). If A is its underlying set and P M and QM are the corresponding interpretations of P and Q, then M x P (x) → x Q(x) simply says that, if P M equals A , then QM must equal A as well. However, if P M does not equal A , then this implication is vacuously true (remember that F → · = T no matter what · actually is). In this case we do not get any additional
constraints on our model |
M |
. After these observations, it is now easy to |
||||
|
def |
{a, b}, P M |
def |
{a} and QM |
def |
|
construct a counter-example model. Let A = |
= |
= |
{b}. Then M x P (x) → x Q(x) holds, but M x (P (x) → Q(x)) does not.
2.4.3 The semantics of equality
We have already pointed out the open-ended nature of the semantics of predicate logic. Given a predicate logic over a set of function symbols F and a set of predicate symbols P, we need only a non-empty set A equipped with concrete functions or elements f M (for f F) and concrete predicates P M (for P P) in A which have the right arities agreed upon in our specification. Of course, we also stressed that most models have natural interpretations of