## Set Theory for Verification: II - Induction and Recursion (2000)

### Cached

### Download Links

Venue: | Journal of Automated Reasoning |

Citations: | 45 - 23 self |

### BibTeX

@ARTICLE{Paulson00settheory,

author = {Lawrence C. Paulson},

title = {Set Theory for Verification: II - Induction and Recursion},

journal = {Journal of Automated Reasoning},

year = {2000},

volume = {15},

pages = {167--215}

}

### OpenURL

### Abstract

A theory of recursive definitions has been mechanized in Isabelle's Zermelo-Fraenkel (ZF) set theory. The objective is to support the formalization of particular recursive definitions for use in verification, semantics proofs and other computational reasoning.

### Citations

1623 | The Definition of Standard ML
- Milner, Harper, et al.
- 1990
(Show Context)
Citation Context ...p p ⊃ q p q (DN) (MP) Such inference systems are becoming popular for defining the operational semantics of programming languages. They can be extremely large — consider the Definition of Standard ML =-=[17]-=-. The Knaster-Tarski Theorem can express the least set of propositions closed under the axioms and rules, but we must adopt a formalization that scales up to large inference systems. Defining a separa... |

1175 |
Introduction to Lattices and Order
- Davey, Priestley
- 1990
(Show Context)
Citation Context ...size terms. 2.1. The Knaster-Tarski Theorem The Knaster-Tarski Theorem states that every monotone function over a complete lattice has a fixedpoint. (Davey and Priestley discuss and prove the Theorem =-=[7]-=-.) Usually a greatest fixedpoint is exhibited, but a dual argument yields the least fixedpoint. A partially ordered set P is a complete lattice if, for every subset S of P , the least upper bound and ... |

548 |
A Computational Logic
- Boyer, Moore
- 1979
(Show Context)
Citation Context ...ed relations are a general means of justifying recursive definitions and proving termination. They have played a key role in the Boyer/Moore Theorem14 Lawrence C. Paulson Prover since its early days =-=[4]-=-. Manna and Waldinger’s work on deductive program synthesis [12] illustrates the power of well-founded relations; they justify the termination of a unification algorithm using a relation that takes in... |

272 |
Programming in Martin-Lof ’s Type Theory, An Introduction
- Nordstrom, Petersson, et al.
- 1990
(Show Context)
Citation Context ...ive and distinct. A case operation, defined by a description, satisfies two equations: case(c, d, Inl(a)) = c(a) case(c, d, Inr(b)) = d(b) This resembles the when operator of Martin-Löf’s Type Theory =-=[20]-=-. 4.2. A Universe The term universe generally means the class of all sets, but here it refers to the set univ(A), which contains all finitely branching trees over A. The set is defined by univ(A) ≡ V ... |

244 | The lazy lambda calculus
- Abramsky
- 1990
(Show Context)
Citation Context ... by induction. Using the general induction rule for lfp, the following rule can be derived simply: 〈a, b〉 ∈r ∗ [x ∈ field(r)]x [ψ(〈x, y〉) 〈x, y〉 ∈r ∗ 〈y, z〉 ∈r]x,y,z . ψ(〈x, x〉) . ψ(〈x, z〉) ψ(〈a, b〉) =-=(1)-=- This is the natural elimination rule for r ∗ because its minor premises reflect the form of its introduction rules [25]; it is however cumbersome. A simpler rule starts from the idea that if 〈a, b〉 ∈... |

153 |
Naive Set theory, D
- Halmos
- 1960
(Show Context)
Citation Context ...röder-Bernstein Theorem plays a vital role in the theory of cardinal numbers. If there are two injections f : X → Y and g : Y → X, then the Theorem states that there is a bijection h : X → Y . Halmos =-=[11]-=- gives a direct but complicated proof. Simpler is to use the Knaster-Tarski Theorem to prove a key lemma, Banach’s Decomposition Theorem [7]. Recall from §1.2 the image and converse operators. These a... |

149 |
Intuitionistic type theory," Bibliopolis
- Martin-Lof
- 1984
(Show Context)
Citation Context ...ed relations; they justify the termination of a unification algorithm using a relation that takes into account the size of a term and the number of free variables it contains. The rise of type theory =-=[6, 9, 13]-=- has brought a new treatment of recursion. Instead of a single recursion operator justified by well-founded relations, each recursive type comes equipped with a structural recursion operator. For the ... |

115 |
Inductively defined types
- Coquand, Paulin
- 1988
(Show Context)
Citation Context ...ed relations; they justify the termination of a unification algorithm using a relation that takes into account the size of a term and the number of free variables it contains. The rise of type theory =-=[6, 9, 13]-=- has brought a new treatment of recursion. Instead of a single recursion operator justified by well-founded relations, each recursive type comes equipped with a structural recursion operator. For the ... |

85 |
Axiomatic Set Theory
- Suppes
- 1972
(Show Context)
Citation Context ...belle’s ZF set theory are ultimately defined in terms of wfrec. 3.2. Ordinals My treatment of recursion requires a few properties of the set-theoretic ordinals. The development follows standard texts =-=[27]-=- and requires little further discussion. By convention, the Greek letters α, β and γ range over ordinals. A set A is transitive if it is downwards closed under the membership relation: y ∈ x ∈ A impli... |

77 | Automating recursive type definitions in higher order logic
- Melham
- 1989
(Show Context)
Citation Context ...ofs [16]. Recently I have written an ML package to automate recursive definitions in Isabelle ZF [24]. My package is inspired by T. Melham’s inductive definition packages for the Cambridge HOL system =-=[5, 15]-=-. It is unusually flexible because of its explicit use of the Knaster-Tarski Theorem. Monotone operators may occur in the introduction rules, such as the occurrence of list in the definition of term(A... |

60 | Non-resolution theorem proving
- Bledsoe, W
- 1977
(Show Context)
Citation Context ... f‘y. The inverse image r −1 “{x} is the set of all y such that 〈y, x〉 ∈r: the set of all r-predecessors of x. Formally, f is recursive over r if it satisfies the equation f‘x = H(x, f ↾ (r −1 “{x})) =-=(3)-=-16 Lawrence C. Paulson for all x. The binary operation H is the body of f. Restricting f to r −1 “{x} ensures that the argument in each recursive call is r-smaller than x. Justifying well-founded rec... |

48 | Set theory for verification: I. From foundations to functions
- Paulson
- 1993
(Show Context)
Citation Context ... in Isabelle 41 5.5 Completeness 43 6 Related Work and Conclusions 45sSet Theory for Verification: II 1 1. Introduction Recursive definitions pervade theoretical Computer Science. Part I of this work =-=[22]-=- has described the mechanization of a theory of functions within Zermelo-Fraenkel (ZF) set theory using the theorem prover Isabelle. Part II develops a mechanized theory of recursion for ZF: least fix... |

47 | Reasoning with inductively defined relations in the HOL theorem prover
- Camilleri, Melham
- 1992
(Show Context)
Citation Context ...ofs [16]. Recently I have written an ML package to automate recursive definitions in Isabelle ZF [24]. My package is inspired by T. Melham’s inductive definition packages for the Cambridge HOL system =-=[5, 15]-=-. It is unusually flexible because of its explicit use of the Knaster-Tarski Theorem. Monotone operators may occur in the introduction rules, such as the occurrence of list in the definition of term(A... |

47 |
A Fixedpoint Approach to Implementing (Co)Inductive Definitions
- Paulson
- 1994
(Show Context)
Citation Context ...t fixedpoints. These crop up frequently in Computer Science, mainly in connection with bisimulation proofs [16]. Recently I have written an ML package to automate recursive definitions in Isabelle ZF =-=[24]-=-. My package is inspired by T. Melham’s inductive definition packages for the Cambridge HOL system [5, 15]. It is unusually flexible because of its explicit use of the Knaster-Tarski Theorem. Monotone... |

35 |
Deductive synthesis of the unification algorithm
- Manna, Waldinger
- 1981
(Show Context)
Citation Context ...tions and proving termination. They have played a key role in the Boyer/Moore Theorem14 Lawrence C. Paulson Prover since its early days [4]. Manna and Waldinger’s work on deductive program synthesis =-=[12]-=- illustrates the power of well-founded relations; they justify the termination of a unification algorithm using a relation that takes into account the size of a term and the number of free variables i... |

31 | Terminating general recursion
- Nordström
- 1988
(Show Context)
Citation Context ...by repeated subtraction or that sort by recursively sorting shorter lists. Coding such functions using structural recursion requires ingenuity; consider Smith’s treatment of Quicksort [26]. Nordström =-=[19]-=- and I [21] have attempted to re-introduce well-founded relations to type theory, with limited success. In ZF set theory, well-founded relations reclaim their role as the foundation of induction and r... |

22 | Constructing recursion operators in intuitionistic type theory
- Paulson
- 1986
(Show Context)
Citation Context ... subtraction or that sort by recursively sorting shorter lists. Coding such functions using structural recursion requires ingenuity; consider Smith’s treatment of Quicksort [26]. Nordström [19] and I =-=[21]-=- have attempted to re-introduce well-founded relations to type theory, with limited success. In ZF set theory, well-founded relations reclaim their role as the foundation of induction and recursion. T... |

16 | A Concrete Final Coalgebra Theorem for ZF Set Theory
- Paulson
- 1994
(Show Context)
Citation Context ...ono(D, h) lfp(D, h) =h(lfp(D, h)) The second rule above is one form of the Knaster-Tarski Theorem. Another form of the Theorem constructs a greatest fixedpoint; this justifies coinductive definitions =-=[23]-=-, but will not concern us here. 2.2. The Bounding Set When justifying some instance of lfp(D, h), showing that h is monotone is generally easy, if it is true at all. Harder is to exhibit a bounding se... |

15 |
Fundamentals of Contemporary Set Theory
- Devlin
- 1979
(Show Context)
Citation Context ...l trees whose nodes are labelled with an element of A and which have zero or more subtrees. It is natural to regard the subtrees as a list; we solve the recursion equation term(A) =A × list(term(A)). =-=(8)-=- Before using list(···) with the Knaster-Tarski Theorem, we must show that it is monotonic and bounded: A ⊆ B list(A) ⊆ list(B) list(univ(A)) ⊆ univ(A) The proofs are simple using lemmas such as the m... |

15 |
Experimenting with Isabelle in ZF set theory
- Noël
- 1993
(Show Context)
Citation Context ...licable to weaker systems such as intuitionistic second-order logic and intuitionistic ZF set theory. Thus, we have a generic treatment of recursion for generic theorem proving. In related work, Noël =-=[18]-=- has proved many theorems about recursion using Isabelle’s set theory, including well-founded recursion and a definition of lists. But Noël does not develop a general theory of recursion. Ontic [10] p... |

9 |
Generalized rules for quantifiers and the completeness of the intuitionistic operators
- Schroeder-Heister
- 1984
(Show Context)
Citation Context ...ld(r)]x [ψ(〈x, y〉) 〈x, y〉 ∈r ∗ 〈y, z〉 ∈r]x,y,z . ψ(〈x, x〉) . ψ(〈x, z〉) ψ(〈a, b〉) (1) This is the natural elimination rule for r ∗ because its minor premises reflect the form of its introduction rules =-=[25]-=-; it is however cumbersome. A simpler rule starts from the idea that if 〈a, b〉 ∈r ∗ then there exist a0, a1, ..., an such that (writing r as an infix relation) a = a0 ra1 r ··· ran = b. If ψ holds at ... |

7 |
The identification of propositions and types in Martin-Löf’s Type Theory: A programming example
- Smith
- 1983
(Show Context)
Citation Context ...ons that divide by repeated subtraction or that sort by recursively sorting shorter lists. Coding such functions using structural recursion requires ingenuity; consider Smith’s treatment of Quicksort =-=[26]-=-. Nordström [19] and I [21] have attempted to re-introduce well-founded relations to type theory, with limited success. In ZF set theory, well-founded relations reclaim their role as the foundation of... |

5 |
Student use of an interactive theorem prover
- Suppes
- 1984
(Show Context)
Citation Context ...ap(λu.h1(h2(u)),l) (11) map(λu.u,l)=l (12) rev(rev(l)) = l (13) To apply the derived induction rule, we may assume the induction hypothesis and must show map(λu . reflect(reflect(u)),zs)=map(λu.u,zs) =-=(14)-=- reflect(reflect(Apply(x, zs))) = Apply(x, zs). Simplifying the left hand side, we have reflect(reflect(Apply(x, zs))) = reflect(Apply(x, rev(map(reflect,zs)))) by (9) = reflect(Apply(x, map(reflect, ... |

4 |
Proofs and Types Cambridge Univ
- Girard, Lafont, et al.
- 1989
(Show Context)
Citation Context ...ed relations; they justify the termination of a unification algorithm using a relation that takes into account the size of a term and the number of free variables it contains. The rise of type theory =-=[6, 9, 13]-=- has brought a new treatment of recursion. Instead of a single recursion operator justified by well-founded relations, each recursive type comes equipped with a structural recursion operator. For the ... |

3 |
Ontic: Language specification and user’s manual
- Givan, McAllester, et al.
- 1992
(Show Context)
Citation Context ...l [18] has proved many theorems about recursion using Isabelle’s set theory, including well-founded recursion and a definition of lists. But Noël does not develop a general theory of recursion. Ontic =-=[10]-=- provides strong support for recursively defined functions and sets. Ontic’s theory of recursion differs from mine; it treats recursive functions as least fixedpoints, with no use of wellfounded relat... |