[Paper Review] I/O Logic in HOL --- First Steps

Christoph Benzmüller, Xavier Parent|arXiv (Cornell University)|Mar 26, 2018

Logic, programming, and type systems7 references3 citations

TL;DR

This paper presents a sound semantical embedding of input/output logic's $out_1$ operator into classical higher-order logic (HOL), overcoming flaws in a prior unsound embedding by encoding propositional validity via universal quantification over possible worlds. The key contribution is a robust, formally verified foundation for mechanizing I/O logic reasoning using off-the-shelf HOL theorem provers, with correctness confirmed via countermodel generation.

ABSTRACT

A semantical embedding of input/output logic in classical higher-order logic is presented. This embedding enables the mechanisation and automation of reasoning tasks in input/output logic with off-the-shelf higher-order theorem provers and proof assistants. The key idea for the solution presented here results from the analysis of an inaccurate previous embedding attempt, which we will discuss as well.

Motivation & Objective

• To address the unsoundness of a prior naive embedding of I/O logic in HOL, which incorrectly validated conclusions due to misuse of the law of excluded middle.
• To develop a semantically correct embedding of the $out_1$ operator in classical higher-order logic (HOL) that supports mechanized reasoning and automation.
• To ensure that logical validity ($\models$) is properly encoded in HOL so that nested formulas do not trigger unintended consequences from classical tautologies.
• To enable formal verification of I/O logic reasoning tasks using existing HOL-based theorem provers and proof assistants.
• To lay the groundwork for extending the embedding to other I/O operations and for formalizing the proof theory of I/O logic in HOL.

Proposed method

• Represent propositional formulas of I/O logic as HOL predicates of type $i \to o$, where $i$ denotes a set of possible worlds (states), to decouple validity from truth-functional semantics.
• Define $\text{valid}\ \varphi$ as $\forall w.\, \varphi\, w$, which encodes $\models \varphi$ and allows safe nesting in complex formulas.
• Reformulate the $out_{1}$ semantics using the lifted validity operator: $outpre := \lambda G\lambda a\lambda y\, \exists f\, (\text{valid}(a \boldsymbol{\supset} f) \land G(f,y))$.
• Use the standard proof rules of I/O logic (e.g., SO, WI) as a basis for embedding the proof theory into HOL, enabling backward reasoning.
• Leverage the model finder Nitpick to automatically generate countermodels, demonstrating the correctness of the embedding by falsifying invalid inferences.
• Avoid approximations in $out_1$ by using full existential quantification over consequences, rather than limiting to three formulas as in earlier attempts.

Experimental results

Research questions

• RQ1 Why did the initial naive embedding of I/O logic in HOL fail, and what specific logical flaw caused unsoundness?
• RQ2 How can propositional validity ($\models$) be correctly encoded in HOL to prevent unintended consequences from the law of excluded middle?
• RQ3 Can a semantically faithful embedding of $out_1$ be constructed in HOL that preserves the intended deontic semantics of I/O logic?
• RQ4 Is it possible to mechanize I/O logic reasoning using off-the-shelf HOL theorem provers while ensuring soundness and completeness?
• RQ5 How can the proof theory of I/O logic be embedded and verified within HOL, and what are the practical implications for automation and countermodel generation?

Key findings

• The initial naive embedding failed because it mapped $a \models s$ to $a \supset s$, allowing the law of excluded middle to incorrectly validate $a \vee b \models s$ even when $s$ is not derivable from $a$ or $b$ alone.
• By encoding validity as $\forall w.\, \varphi\, w$, the new embedding blocks such spurious inferences, as demonstrated by countermodels for invalid inferences like $e \in outpre(G, a \vee b)$.
• Countermodels for $e \in outpre(G, a \vee b)$ were automatically generated by Nitpick, confirming that the formula is not valid under the new semantics.
• The corrected embedding correctly validates $e \in outpre(G, a)$ by instantiating $f$ as $\lambda x.\, ax$, which satisfies $a \supset f$ in all worlds.
• The embedding supports full mechanization of I/O logic reasoning, with the proof theory of $out_1$ now formally embeddable in HOL.
• The approach avoids ad hoc approximations (e.g., limiting to three consequences) by using a fully quantified, sound definition of $out_1$.