View source for The Proving Perspective (Rodin User Manual)

{{Navigation|Previous= [[The_Proof_Obligation_Explorer_(Rodin_User_Manual)|The Proof Obligation Explorer]]|Next= [[The_Mathematical_Language_(Rodin_User_Manual)|The Mathematical Language]]|Up= [[index_(Rodin_User_Manual)|User_Manual_index]]}}<div>


The Proving Perspective is made of a number of windows: the proof tree, the goal, the selected hypotheses, the proof control, the proof information, and the searched hypotheses. In subsequent sections, we study these windows, but before that let us see how one can load a proof.

== Loading a Proof ==

In order to load a proof, enter the Proof Obligation window, select the project, select and expand the component, finally select the proof obligation: the corresponding proof will be loaded. As a consequence:

* the proof tree is loaded in the Proof Tree window. As we shall see in section [[The_Proving_Perspective_(Rodin_User_Manual)#The_Proof_Tree|6.2]], each node of the proof tree is associated with a sequent.
* In case the proof tree has some "pending" nodes (whose sequents are not discharged yet) then the sequent corresponding to the first pending node is decomposed: its goal is loaded in the Goal window (section [[The_Proving_Perspective_(Rodin_User_Manual)#Goal and Selected Hypotheses|6.3]]), whereas parts of its hypotheses (the "selected" ones) are loaded in the Selected Hypotheses window (section [[The_Proving_Perspective_(Rodin_User_Manual)#Goal and Selected Hypotheses|6.3]]).
* In case the proof tree has no pending node, then the sequent of the root node is loaded as explained previously.

== The Proof Tree ==

=== Description of the Proof Tree ===

The proof tree can be seen in the corresponding window as shown in the following screen shot:

[[Image:um-0095.png|center]]

Each line in the proof tree corresponds to a node which is a sequent. A line is right shifted when the corresponding node is a direct descendant of the node of the previous line. Here is an illustration of the previous tree:

[[Image:Tree.png|center]]

Each node is labelled with a comment explaining how it can be discharged. By selecting a node in the proof tree, the corresponding sequent is decomposed and loaded in the Goal and Selected Hypotheses windows as explained in section [[The_Proving_Perspective_(Rodin_User_Manual)#Loading a Proof|6.1]].

=== Decoration ===

The leaves of the tree are decorated with three kinds of logos:

* a green logo with a "<math>\surd </math>" in it means that this leaf is discharged,
* a red logo with a "?" in it means that this leaf is not discharged,
* a blue logo with a "R" in it means that this leaf has been reviewed.

Internal nodes in the proof tree are decorated in the same (but lighter) way. Note that a "reviewed" leaf is one that is not discharged yet by the prover. Instead, it has been "seen" by the user who decided to have it discharged later. Marking nodes as "reviewed" is very convenient in order to perform an interactive proof in a gradual fashion. In order to discharge a "reviewed" node, select it and prune the tree at that node (section [[The_Proving_Perspective_(Rodin_User_Manual)#Pruning|6.2.5]]): the node will become "red" again (undischarged) and you can now try to discharge it.

=== Navigation within the Proof Tree ===

On top of the proof tree window one can see three buttons:

* the "G" buttons allows you to see the goal of the sequent corresponding to the node
* the "+" button allows you to fully expand the proof tree
* the "-" allows you to fully collapse the tree: only the root stays visible.

=== Hiding ===

The little triangle next to each node in the proof tree allows you to expand or collapse the subtree starting at that node.

=== Pruning ===

The proof tree can be pruned from a node: it means that the subtree starting at that node is eliminated. The node in question becomes a leaf and is red decorated. This allows you to resume the proof from that node. After selecting a sequent in the proof tree, pruning can be performed in two ways:

* by right-clicking and then selecting "Prune",
* by pressing the "Scissors" button in the proof control window (section [[The_Proving_Perspective_(Rodin_User_Manual)#The Proof Control Window|6.4]]).

Note that after pruning, the post-tactic (section [[The_Proving_Perspective_(Rodin_User_Manual)#The Automatic Post-tactic|6.8]]) is not applied to the new current sequent: if needed you have to press the "post-tactic" button in the Proof Control window (section [[The_Proving_Perspective_(Rodin_User_Manual)#The Proof Control Window|6.4]]). This happens in particular when you want to redo a proof from the beginning: you prune the proof tree from the root node and then you have to press the "post-tactic" button in order to be in exactly the same situation as the one delivered automatically initially.

When you want to redo a proof from a certain node, it might be advisable to do it after copying the tree so that in case your new proof fails you can still resume the previous situation by pasting the copied version (see next section).

=== Copy/Paste ===

By selecting a node in the proof tree and then clicking on the right key of the mouse, you can copy the part of the proof tree starting at that sequent: it can later be pasted in the same way. This allows you to reuse part of a proof tree in the same (or even another) proof.

== Goal and Selected Hypotheses ==

The "Goal" and "Selected Hypotheses" windows display the current sequent you have to prove at a given moment in the proof. Here is an example:

[[Image:um-0098.png|center]]

A selected hypothesis can be deselected by first clicking in the box situated next to it (you can click on several boxes) and then by pressing the red (-) button at the top of the selected hypothesis window:

[[Image:um-0099.png|center]]

Here is the result:

[[Image:um-0100.png|center]]

Notice that the deselected hypotheses are not lost: you can get them back by means of the Searched Hypotheses window (section [[The_Proving_Perspective_(Rodin_User_Manual)#srchhyp|6.7]]).

The three other buttons next to the red (-) button allow you to do the reverse operation, namely keeping some hypotheses. The (ct) button next to the goal allows you to do a proof by contradiction: pressing it makes the negation of the goal being a selected hypothesis whereas the goal becomes "false". The (ct) button next to a selected hypothesis allows you to do another kind of proof by contradiction: pressing it makes the negation of the hypothesis the goal whereas the negated goal becomes an hypothesis.

== The Proof Control Window ==

The Proof Control window contains the buttons which you can use to perform an interactive proof. Next is a screen shot where you can see successively from top to bottom:

* some selected hypotheses,
* the goal,
* the "Proof Control" window,
* a small editing area within which you can enter parameters used by some buttons of the Proof Control window
* the smiley (section [[The_Proving_Perspective_(Rodin_User_Manual)#The Simley|6.5]])

[[Image:um-0101.png|center]]

The Proof Control window offers a number of buttons which we succinctly describe from left to right:

* (p0): the prover PP attempts to prove the goal (other cases in the list)
* (R) review: the user forces the current sequent to be discharged, it is marked as being reviewed (it’s logo is blue-colored)
* (dc) proof by cases: the goal is proved first under the predicate written in the editing area and then under its negation,
* (ah) lemma: the predicate in the editing area is proved and then added as a new selected hypothesis,
* (ae) abstract expression: the expression in the editing area is given a fresh name,
* the auto-prover attempts to discharge the goal. The auto-prover is the one which is applied automatically on all proof obligations (as generated automatically by the proof obligation generator after a "save") without any intervention of the user. With this button, you can call yourself the auto-prover within an interactive proof.
* the post-tactic is executed (see section [[The_Proving_Perspective_(Rodin_User_Manual)#The Automatic Post-tactic|6.8]]),
* lasso: load in the Selected Hypotheses window those unseen hypotheses containing identifiers which are common with identifiers in the goal and selected hypotheses,
* backtrack form the current node (i.e., prune its parent),
* scissors: prune the proof tree from the node selected in the proof tree,
* show (in the Search Hypotheses window) hypotheses containing the character string as in the editing area,
* show the Cache Hypotheses window,
* load the previous non-discharged proof obligation,
* load the next undischarged proof obligation,
* (i) show information corresponding to the current proof obligation in the corresponding window. This information correspond to the elements that took directly part in the proof obligation generation (events, invariant, etc.),
* goto the next pending node of the current proof tree,
* load the next reviewed node of the current proof tree.

== The Smiley ==

The smiley can take three different colors: (1) red, meaning that the proof tree contains one or more non-discharged sequents, (2) blue, meaning that all non-discharged sequents of the proof tree have been reviewed, (3) green, meaning that all sequents of the proof tree are discharged.

== The Operator "Buttons" ==

In the goal and in the selected, searched, or cache hypotheses some operators are colored in red. It means that they are "buttons" you can press. When doing so, the meaning (sometimes several) is shown in a menu where you can select various options. The operation performed by these options is described in sections [[The_Proving_Perspective_(Rodin_User_Manual)#Interactive Rewrite Rules|6.9.1]] and [[The_Proving_Perspective_(Rodin_User_Manual)#Interactive Inference Rules|6.9.2]].

== The Search Hypotheses Window ==

A window is provided which contains the hypotheses having a character string in common with the one in the editing area. For example, if we search for hypotheses involving the character string "cr", then after pressing the "search hypothesis" button in the proof control window, we obtain the following:

[[Image:um-0102.png|center]]

Such hypotheses can be moved to the "Selected Hypotheses" window (button (+)) or removed from the "Search Hypotheses" window (button (-)). As for the selected hypotheses, other buttons situated next to the previous ones, allow you to move or remove all hypotheses. By pressing the (ct) button the negation of the corresponding hypothesis becomes the new goal.

== The Automatic Post-tactic ==

In this section, we present the various rewrite or inference rules which are applied automatically as a systematic post-tactic after each proof step. Note that the post-tactic can be disabled by using the "'''P'''<math>\! \! \! \! /</math>" button situated on the right of the proof control window.

The post-tactic is made of two different rules: rewrite rules, which are applied on any sub-formula of the goal or selected hypotheses (section [[The_Proving_Perspective_(Rodin_User_Manual)#Rewrite Rules|6.8.1]]) and inference rules which are applied on the current sequent (section [[The_Proving_Perspective_(Rodin_User_Manual)#Automatic Inference Rules|6.8.2]]).

=== Rewrite Rules ===

The following rewrite rules are ''applied automatically'' in a systematic fashion from left to right either in the goal or in the selected hypotheses. They all correspond to predicate logical equivalences or expression equalities and result in simplifications. They are sorted according to their main purpose.

'''Conjunction'''

<center><math>

\begin{array}{l}
P \land \ldots \land \btrue  \land \ldots \land Q \;\;==\;\; P \land \ldots \land  Q \\
P \land \ldots \land \bfalse  \land \ldots \land Q \;\;==\;\;\bfalse  \\
P \land \ldots \land Q \land \ldots \land \neg\,Q  \land \ldots \land R \;\;==\;\; \bfalse \\
P \land \ldots \land Q \land \ldots \land Q  \land \ldots \land R \;\;==\;\; P \land \ldots \land Q \land \ldots \land R\\
\end{array}
</math></center>

'''Disjunction'''

<center><math>
\begin{array}{l}
P \lor \ldots \lor \btrue  \lor \ldots \lor Q \;\;==\;\; \btrue \\
P \lor \ldots \lor \bfalse  \lor \ldots \lor Q \;\;==\;\; P \lor \ldots \lor  Q \\
P \lor \ldots \lor  Q \lor \ldots \lor \neg\,Q  \lor \ldots \lor R \;\;==\;\; \btrue \\
P \lor \ldots \lor Q \lor \ldots \lor Q  \lor \ldots \lor R \;\;==\;\; P \lor \ldots \lor Q \lor \ldots \lor R
\end{array}
</math></center>

'''Implication'''

<center><math>
\begin{array}{l}
\btrue \limp P \;\;==\;\; P \\
\bfalse \limp P \;\;==\;\; \btrue \\
P \limp \btrue \;\;==\;\; \btrue \\
P \limp \bfalse \;\;==\;\; \neg\, P \\
P \limp P \;==\;\; \btrue %\\
%P \;\limp\; Q \land R \;\;==\;\; (P \limp Q) \;\land\; (P \limp R) \\
%P \lor Q \;\limp\; R \;\;==\;\;  (P \limp Q) \;\land\; (P \limp R)
\end{array}
</math></center>

'''Equivalence'''

<center><math>
\begin{array}{l}
P \leqv \btrue \;\;==\;\; P \\
\btrue \leqv P\;\;==\;\; P \\
P \leqv \bfalse \;\;==\;\; \neg\, P \\
\bfalse \leqv P \;\;==\;\; \neg\, P \\
P \leqv P\;\;==\;\; \btrue
\end{array}
</math></center>

'''Negation'''

<center><math>
\begin{array}{l}
\neg\,\btrue \;\;==\;\; \bfalse \\
\neg\,\bfalse \;\;==\;\; \btrue \\
\neg\,\neg\,P \;\;==\;\; P \\
E\neq F \;\;==\;\; \neg\, E = F \\
E\notin F \;\;==\;\; \neg\, E \in F \\
E\not\subset F \;\;==\;\; \neg\, E \subset F \\
E\not\subseteq F \;\;==\;\; \neg\, E \subseteq F \\
\neg\, a\leq b \;\;==\;\; a>b \\
\neg\, a\geq b \;\;==\;\; a<b \\
\neg\, a> b \;\;==\;\; a\leq b \\
\neg\, a< b \;\;==\;\; a \geq b \\
\neg\,(E=\False) \;\;==\;\;\ (E=\True) \\
\neg\,(E=\True) \;\;==\;\;\ (E=\False) \\
\neg\,(\False=E) \;\;==\;\;\ (\True = E) \\
\neg\,(\True=E) \;\;==\;\;\ (\False = E)
\end{array}
</math></center>

'''Quantification'''

<center><math>
\begin{array}{l}
\forall x \,\qdot\,(\,P \land Q)  \;\;==\;\; (\forall x \,\qdot\,P) \;\land\; (\forall x \,\qdot\,Q)  \\
\exists x \,\qdot\,(\,P \lor Q)  \;\;==\;\; (\exists x \,\qdot\,P) \;\lor\; (\exists x \,\qdot\,Q) \\
\forall \ldots,z,\ldots \,\qdot\,P(z) \;\;==\;\;\forall z\,\qdot\,P(z) \\
\exists \ldots,z,\ldots \,\qdot\,P(z) \;\;==\;\;\exists z\,\qdot\,P(z) \\
\end{array}
</math></center>

'''Equality'''

<center><math>
\begin{array}{l}
E = E \;\;==\;\; \btrue \\
E \neq E \;\;==\;\; \bfalse \\
E\mapsto F = G \mapsto H \;\;==\;\; E = G \;\land\; F = H \\
\end{array}
</math></center>

<center><math>
\begin{array}{l}
\True=\False \;\;==\;\;\ \bfalse \\
\False=\True \;\;==\;\;\ \bfalse 
\end{array}
</math></center>


'''Set Theory'''

<center><math>
\begin{array}{l}
S \binter \ldots \binter \emptyset \binter \ldots \binter T \;\;==\;\; \emptyset \\
S \binter \ldots \binter T \binter \ldots \binter T  \binter \ldots \binter U \;\;==\;\; S \binter \ldots \binter T \binter \ldots \binter U \\
S \bunion \ldots \bunion \emptyset \bunion \ldots \bunion T \;\;==\;\; S \bunion \ldots \bunion T \\
S \bunion \ldots \bunion T \bunion \ldots \bunion T  \bunion \ldots \bunion U \;\;==\;\; S \bunion \ldots \bunion T \bunion \ldots \bunion U  \\
\emptyset \;\subseteq\; S \;\;==\;\; \btrue \\
S \;\subseteq\; S \;\;==\;\; \btrue \\
E \;\in\; \emptyset \;\;==\;\; \bfalse \\
B \;\in\; \{A, \ldots, B, \ldots,C\} \;\;==\;\;\btrue \\
\{A, \ldots, B, \ldots,B, \ldots,C\}\;\;==\;\;\{A, \ldots, B, \ldots,C\} \\
E \;\in\; \{\,x\,|\, P(x)\,\} \;\;==\;\; P(E) \\
S \setminus S \;\;==\;\; \emptyset \\
S \setminus \emptyset \;\;==\;\; S \\
\emptyset \setminus S \;\;==\;\; \emptyset \\
r^{-1-1} \;\;==\;\; r \\
\dom(\{x\mapsto a, \ldots, y \mapsto b\} \;\;==\;\; \{x, \ldots, y\} \\
\ran(\{x\mapsto a, \ldots, y \mapsto b\} \;\;==\;\; \{a, \ldots, b\} \\
(f \ovl \ldots \ovl \{E \mapsto F\})(E) \;\;==\;\; F \\
E \in \{F\}  \;\;==\;\; E = F \ \ \ \ \ 
\end{array}
</math></center>
where <math>F</math> is a single expression.

<center><math>
\begin{array}{l}
\{E\} = \{F\}  \;\;==\;\; E = F \ \ \ \ \ \\
\{x \mapsto a,\ldots, y \mapsto b\}^{-1} \;\;==\;\;\{a \mapsto x,\ldots, b \mapsto y\} \\
Ty = \emptyset \;\;==\;\; \bfalse \\
\emptyset = Ty \;\;==\;\; \bfalse \\
t \in Ty \;\;==\;\; \btrue
\end{array}
</math></center>
where <math>E</math> and <math>F</math> are single expressions.

In the three previous rewrite rules, <math>Ty</math> denotes a type 
expression, that is either a basic type (<math>\intg, \Bool</math>, any 
carrier set), or <math>\pow</math>(type expression), or type 
expression<math>\cprod</math>type expression, and <math>t</math> denotes an 
expression of type <math>Ty</math>.

<center><math>
\begin{array}{l}
U \setminus U \setminus S \;==\; S \\
S \bunion \ldots \bunion U \bunion \ldots \bunion  T \;\;==\;\; U \\
S \binter \ldots \binter U \binter \ldots \binter  T \;\;==\;\; S \binter \ldots \binter  T \\
S \setminus U  \;\;==\;\; \emptyset  \\
\end{array}
</math></center>

In the four previous rules, <math>S</math> and <math>T</math> are supposed to be of type <math>\pow(U)</math>.

<center><math>
\begin{array}{l}
r  \fcomp  \emptyset \;\;==\;\; \emptyset \\
\emptyset \fcomp r \;\;==\;\; \emptyset \\
f(f^{-1}(E)) \;\;==\;\; E \\
f^{-1}(f(E)) \;\;==\;\; E \\
S \;\subseteq\; A \bunion \ldots \bunion S \bunion \ldots \bunion B  \;\;==\;\; \btrue \\
A \binter \ldots \binter S \binter \ldots \binter B  \;\subseteq\; S \;\;==\;\; \btrue \\
A \bunion \ldots \bunion B \;\subseteq \; S \;\;==\;\; A\subseteq S \;\land\; \ldots \;\land\; B\subseteq S  \\
S \;\subseteq\;A \binter \ldots \binter B  \;\;==\;\; S \subseteq A \;\land\; \ldots \;\land\; S \subseteq B \\
A \bunion \ldots \bunion B \;\subset \; S \;\;==\;\; A\subset S \;\land\; \ldots \;\land\; B\subset S  \\
S \;\subset\;A \binter \ldots \binter B  \;\;==\;\; S \subset A \;\land\; \ldots \;\land\; S \subset B \\
A \;\setminus B \;\subseteq\; S \;\;==\;\; A \;\subseteq\; B \bunion S
\end{array}
</math></center>

'''Finiteness'''

<center><math>
\begin{array}{l}
\finite\,(\emptyset) \;\;==\;\; \btrue \\
\finite\,(\{a, \ldots, b\}) \;\;==\;\;\btrue  \\
\finite\,(S \bunion T) \;\;==\;\; \finite\,(S) \;\land\;  \finite\,(T)
\end{array}
</math></center>

<center><math>
\begin{array}{l}
\finite\,(\pow(S)) \;\;==\;\; \finite\,(S) \\
\finite\,(S \cprod T) \;\;==\;\; S = \emptyset \;\;\lor\;\; T = \emptyset \;\;\lor\;\; (\finite\,(S) \;\land\;  \finite\,(T)) \\
\finite\,(r^{-1}) \;\;==\;\; \finite\,(r) \\
\finite\,(a \upto b) == \btrue \\
\end{array}
</math></center>


'''Cardinality'''

<center><math>
\begin{array}{l}
\card(\emptyset) \;\;==\;\; 0 \\
\card\,(\{E\}) \;\;==\;\; 1  \\
\card\,(\pow(S)) \;\;==\;\; 2^{\card(S)} \\
\card\,(S \cprod T) \;\;==\;\; \card(S) * \card(T)  \\
\card\,(S \setminus T) \;\;==\;\; \card(S)-\card\,(S \binter T) \\
\card\,(S \bunion T) \;\;==\;\; \card(S)+\card(T)-\card\,(S \binter T) \\
\card\,(S) = 0 \;\;==\;\; S = \emptyset \\
0 = \card\,(S) \;\;==\;\; S = \emptyset \\
\neg\, \card\,(S) = 0 \;\;==\;\; \neg\, S = \emptyset \\
\neg\, 0 = \card\,(S) \;\;==\;\; \neg\, S = \emptyset \\
\card\,(S) > 0 \;\;==\;\; \neg\, S = \emptyset \\
0 < \card\,(S) \;\;==\;\; \neg\, S = \emptyset \\
\card\,(S) = 1 \;\;==\;\; \exists x \,\qdot\, S = \{x\} \\
1 = \card\,(S) \;\;==\;\; \exists x \,\qdot\, S = \{x\}
\end{array}
</math></center>

'''Arithmetic'''

<center><math>
\begin{array}{l}
E+\ldots+0+\ldots+F \;\;==\;\; E+\ldots+F \\
E-0 \;\;==\;\; E \\
0-E \;\;==\;\; -E \\
-(-E) \;\;==\;\; E \\
E*\ldots*1*\ldots*F \;\;==\;\; E*\ldots*F \\
E*\ldots*0*\ldots*F \;\;==\;\; 0\end{array}
</math></center>

<center>
{|
|<math>(-E)*\ldots*(-F)\;==\; E*\ldots*F   </math> (if an even number of -)
|-
|<math>(-E)*\ldots*(-F)\;==\; -\,(E*\ldots*F)   </math> (if an odd number of -)
|-
|<math>E/1 \;\;==\;\; E </math>
|-
|<math>0/E \;\;==\;\; 0 </math>
|-
|<math>(-E)/(-F)\;\;==\; E/F </math>
|-
|<!--
|<math>%\hbox{\bf not done} \ \ \ \ \ \ E/E \;\;==\;\; 1 </math>
|-
|<math>%\hbox{\bf not done} \ \ \ \ \ \ (X*\ldots*E*\ldots*Y)/E \;\;==\;\; X*\ldots*Y </math>
-->
|-
|<math>E^1 \;\;==\;\; E </math>
|-
|<math>E^0 \;\;==\;\; 1 </math>
|-
|<math>1^E \;\;==\;\; 1 </math>
|-
|<!-- <math>%\hbox{\bf not done} \ \ \ \ \ \  E^{n+m} \;\;==\;\; E^n * E^m 
|</math>(if <math>n \geq 0</math> and <math>m \geq 0</math>) -->
|-
|<math> -(i) \;\;==\;\; (-i) \ \ \  </math> where <math>i</math> is a literal
|-
|<math> -((-i)) \;\;==\;\; i \ \ \  </math> where <math>i</math> is a literal
|-
|<math> i=j \;\;==\;\; \btrue \;\;\hbox{or}\;\; \bfalse 
\;\;\hbox{(computation)}\;\;  \ \ \ </math> where <math>i</math> and <math>j</math> are literals
|-
|<math> i \leq j \;\;==\;\; \btrue \;\;\hbox{or}\;\; \bfalse 
\;\;\hbox{(computation)}\;\;  \ \ \  </math> where <math>i</math> and <math>j</math> are literals
|-
|<math> i < j \;\;==\;\; \btrue \;\;\hbox{or}\;\; \bfalse 
\;\;\hbox{(computation)}\;\;  \ \ \  </math> where <math>i</math> and <math>j</math> are literals
|-
|<math> i \geq j \;\;==\;\; \btrue \;\;\hbox{or}\;\; \bfalse 
\;\;\hbox{(computation)}\;\;  \ \ \  </math> where <math>i</math> and <math>j</math> are literals
|-
|<math> i > j \;\;==\;\; \btrue \;\;\hbox{or}\;\; \bfalse \;\;\hbox{(computation)}\;\;  \ \ \  </math> where <math>i</math> and <math>j</math> are literals
|-
|<math> E \leq E \;\;==\;\; \btrue </math>
|-
|<math> E < E \;\;==\;\; \bfalse </math>
|-
<!--
|<math>%\hbox{\bf postponed} \ \ \ \ \ \  E \leq E+i \;\;==\;\; \btrue  \ \ \ \ \hbox{where $i$ is a positive literal}</math>
|<math>%\hbox{\bf postponed} \ \ \ \ \ \  E-i \leq E \;\;==\;\; \btrue  \ \ \ \ \hbox{where $i$ is a positive literal} </math>
-->
|<math> E \geq E \;\;==\;\; \btrue </math>
|-
|<math> E > E \;\;==\;\; \bfalse </math>
<!--
|<math>%\hbox{\bf postponed} \ \ \ \ \ \  E+i \geq E \;\;==\;\; \btrue  \ \ \ \ \hbox{where $i$ is a positive literal}</math>
|<math>%\hbox{\bf postponed} \ \ \ \ \ \  E \geq E-i \;\;==\;\; \btrue  \ \ \ \ \hbox{where $i$ is a positive literal}</math>
|<math>%\hbox{\bf postponed} \ \ \ \ \ \  E+F = E+G \;\;==\;\; F=G  \ \ \ \ </math>
-->
|}
</center>

<!--There are other useful automatic arithmetic simplifications, but this 
requires further thoughts. Here are a few examples, which have to be 
generalized:


The last rule will be generalized to more arithmetic relational operators 
($\leq,>$, etc.) and more arithmetic operators (-,*).
-->

=== Automatic Inference Rules ===

The following inference rules are ''applied automatically'' in a systematic fashion at the end of each proof step. They have the following possible effects:

* they discharge the goal,
* they simplify the goal and add a selected hypothesis,
* they simplify the goal by decomposing it into several simpler goals,
* they simplify a selected hypothesis,
* they simplify a selected hypothesis by decomposing it into several simpler selected hypotheses.

<br />

'''Axioms'''

<center>
{{InfRule|HYP|<math>\frac{}{\textbf{H},\textbf{P} \;\;\vdash \;\; \textbf{P}}</math>}}
{{InfRule|HYP_OR|<math>\frac{}{\textbf{H},\textbf{Q} \;\;\vdash \;\; 
\textbf{P} \lor \ldots \lor  \textbf{Q} \lor \ldots \lor \textbf{R}}</math>}}
{{InfRule|CNTR|<math>\frac{}{\textbf{H},\;\textbf{P},\;\neg\,\textbf{P}  
\;\;\vdash \;\; \textbf{Q}}</math>}}
{{InfRule|FALSE_HYP|<math>\frac{}{\textbf{H},\bfalse \;\;\vdash \;\; \textbf{P}}</math>}}
{{InfRule|TRUE_GOAL|<math>\frac{}{\textbf{H} \;\;\vdash \;\; \btrue}</math>}}
</center>


'''Simplification'''

<center>

{{InfRule|DBL_HYP|<math>\frac{\textbf{H},\;\textbf{P} \;\;\vdash \;\; 
\textbf{Q}}{\textbf{H},\;\textbf{P},\;\textbf{P}  \;\;\vdash \;\; 
\textbf{Q}}</math>}}
</center>

'''Conjunction'''
<center>
{{InfRule|AND_L|<math>\frac{\textbf{H},\textbf{P},\textbf{Q} \; \; \vdash \; 
\;  \textbf{R}}{\textbf{H},\; \textbf{P} \land \textbf{Q} \; \; \vdash \; \;  
\textbf{R}}</math>}}
{{InfRule|AND_R|<math>\frac{\textbf{H} \; \; 
\vdash \; \;  \textbf{P} \qquad \textbf{H} \; \; \vdash \; \;  
\textbf{Q}}{\textbf{H} \; \; \vdash \; \;  \textbf{P} \; \land \;  
\textbf{Q}}</math>}}
</center>

'''Implication'''
<center>
{{InfRule|IMP_L1|<math>\frac{\textbf{H},\; \textbf{Q},\; \textbf{P} \land \ldots \land \textbf{R} \limp \textbf{S} \;\;\vdash \;\; \textbf{T}}{\textbf{H},\; \textbf{Q},\; \textbf{P} \land \ldots \land \textbf{Q} \land \ldots \land \textbf{R} \limp \textbf{S} \;\;\vdash \;\; \textbf{T} }</math>}}
{{InfRule|IMP_R|<math>\frac{\textbf{H}, \textbf{P} \;\;\vdash \;\; \textbf{Q}}{\textbf{H} \;\;\vdash \;\; \textbf{P} \limp \textbf{Q}}</math>}}
</center>


<center>
{{InfRule|IMP_AND_L|<math>\frac{\textbf{H},\textbf{P} \limp \textbf{Q},  \textbf{P} \limp \textbf{R}\;\;\vdash \;\; \textbf{S}}{\textbf{H},\;\textbf{P} \limp  \textbf{Q} \land \textbf{R}  \;\;\vdash \;\; \textbf{S}}</math>}}
{{InfRule|IMP_OR_L|<math>\frac{
\textbf{H},\textbf{P} \limp \textbf{R},  \textbf{Q} \limp \textbf{R}\;\;\vdash \;\; \textbf{S} 
}{
\textbf{H},\;\textbf{P} \lor  \textbf{Q} \limp \textbf{R}  \;\;\vdash \;\; \textbf{S}
}</math>}}
</center>

'''Negation'''

<center>
{{InfRule| |<math>\frac{\textbf{H},\; E \in \{ a,\ldots , c\}  \; \; \vdash \; \;  \; \;  \textbf{P} }{\textbf{H},\; E \in \{ a,\ldots , b, \ldots , c\} , \neg \, (E=b) \; \; \vdash \; \;  \textbf{P} }</math>}}
{{InfRule| |<math>\frac{\textbf{H},\; E \in \{ a,\ldots , c\}  \; \; \vdash \; \;  \; \;  \textbf{P} }{\textbf{H},\; E \in \{ a,\ldots , b, \ldots , c\} , \neg \, (b=E) \; \; \vdash \; \;  \textbf{P} }</math>}}
</center>

'''Quantification'''

<!-- template
{{InfRule||<math>\frac{}{}</math>}}
-->

<center>
{{InfRule|XST_L|<math>\frac{\textbf{H},\;  \textbf{P(x)} \; \; \vdash \; \;  \textbf{Q}
}{
\textbf{H},\;  \exists \, \textbf{x}\, \qdot\, \textbf{P(x)} \; \; \vdash \; \;  \textbf{Q}
}</math>}}
'''x''' not free in '''H''' and  '''Q'''

{{InfRule|ALL_R|<math>\frac{\textbf{H}\; \; \vdash \; \;  \textbf{P(x)} 
}{
\textbf{H} \; \; \vdash \; \;  \forall \textbf{x}\, \qdot\, \textbf{P(x)}
}</math>}}
'''x''' not free in '''H''' and '''Q'''
</center>

'''Equality'''

<center>
{{InfRule| EQL\_ LR|<math>\frac{\textbf{H(E)} \; \; \vdash \; \;  \; \;  \textbf{P(E)} }{\textbf{H(x)},\; x=E \; \; \vdash \; \;  \textbf{P(x)} }</math>}}
{{InfRule| EQL\_ RL|<math>\frac{\textbf{H(E)} \; \; \vdash \; \;  \; \;  \textbf{P(E)} }{\textbf{H(x)},\; E=x \; \; \vdash \; \;  \textbf{P(x)} }</math>}}
</center>

In these two rules <math>x</math> is a variable which is not free in <math>E</math>

=== Preferences for the Post-tactic ===

The post-tactic can be configured by means of a preference page which can be obtained as follows: press the "Window" button on the top tooolbar. On the coming menu, press the "Preferences" button. On the coming menu, press the "Event-B" menue, then the "Sequent Prover’, and finally the "Post-Tactic" button. This yilds the following window:

[[Image:um-0147.png|center]]

In the left part you can see the ordered sequence of individual tactics composing the post-tactic, whereas the right part contains further tactics you can incorporate in the left part. By selecting a tactic you can move it from on part to the other or change the order in the left part.

== Interactive Tactics ==

In this section, the rewrite rules and inference rules, which you can use to perform an interactive proof, are presented. Each of these rules can be invoked by pressing "buttons" which corresponds to emphasized (red) operators in the goal or the hypotheses. A menu is proposed when there are several options.

=== Interactive Rewrite Rules ===

Most of the rewrite rules correspond to distributive laws. For associative operators in connection with such laws as in:

<center><math>
P \land (Q \lor \ldots \lor R) 
</math></center>

it has been decided to put the "button" on the first associative/commutative operator (here <math>\lor </math>). Pressing that button will generate a menu: the first option of this menu will be to distribute all associative/commutative operators, the second option will be to distribute only the first associative/commutative operator. In the following presentation, to simplify matters, we write associative/commutative operators with two parameters only, but it must always be understood implicitly that we have a sequence of them. For instance, we shall never write <math> Q \lor \ldots \lor R </math> but <math> Q \lor R </math> instead. Rules are sorted according to their purpose.

<br />

'''Conjunction'''

<center><math>
\begin{array}{l} P \land (Q \lor R) \; \; ==\; \;  (P \land Q) \lor (P \land R) \end{array} 
</math></center>

'''Disjunction'''


<!--
%\hbox{\bf canceled} \ \ \ \ \ \ P \lor \ldots \lor  Q \lor \ldots \land 
\fbox{R} \lor \ldots \lor S \;\;==\;\; %P \lor \ldots \lor  Q \lor R \land 
\ldots \lor S \\ \\
%\hbox{\bf canceled} \ \ \ \ \ \ P \lor \ldots \lor \fbox{Q}  \lor \ldots \lor R \;\;==\;\; 
%\neg\, Q \;\limp\; P \lor \ldots \lor  R  \\ \\
-->
<center><math>
\begin{array}{l}
P \lor (Q \land R) \;\;==\;\; (P \lor Q) \land (P \lor R) \\ \\
P \lor Q \lor \ldots \lor R \;\;==\;\; \neg\, P \limp (Q \lor \ldots \lor R)
\end{array}
</math></center>

'''Implication'''

<center><math>
\begin{array}{l}
P \limp Q \;\;==\;\; \neg\,Q \limp \neg P \\ \\
P \limp (Q \limp R) \;\;==\;\; P \land Q \limp R \\ \\
P \limp (Q \land R) \;\;==\;\; (P \limp Q) \;\land\;  (P \limp R) \\ \\
P \lor Q \;\limp\; R\;\;==\;\; (P \limp R)  \;\land\;  (Q \limp R)
\end{array}
</math></center>
<!--
%\hbox{\bf canceled} \ \ \ \ \ \ P \limp (Q \lor \ldots \lor \fbox{R} \lor 
\ldots \lor S) \;\;==\;\; P \land \neg\,R \;\limp\; (Q \lor \ldots \lor S) \\ 
\\
-->

'''Equivalence'''

<center><math>
\begin{array}{l}
P \leqv Q \;\;==\;\; (P \limp Q) \;\land\; (Q \limp P)
\end{array}
</math></center>

'''Negation'''

<center><math>
\begin{array}{l}
\neg\,(P \land Q) \;\;==\;\; \neg\,P \lor \neg\,Q \\ \\
\neg\,(P \lor Q) \;\;==\;\; \neg\,P \land \neg\,Q \\ \\
\neg\,(P \limp Q)\;\;==\;\; P \land \neg\,Q \\ \\
\neg\,\forall x \,\qdot\, P \;\;==\;\; \exists x \,\qdot\, \neg\,P \\ \\
\neg\,\exists x \,\qdot\, P \;\;==\;\; \forall x \,\qdot\, \neg\,P \\ \\
\neg \,(S = \emptyset) \;\;==\;\; \exists x \,\qdot\, x \in S
\end{array}
</math></center>

'''Set Theory'''

Most of the rules are concerned with simplifying set membership predicates.

<center><math>
\begin{array}{l}
E \mapsto F \;\in\; S \cprod T \;\;==\;\; E \in S \;\land\; F \in T \\ \\
E \in \pow(S) \;\;==\;\; E \subseteq S \\ \\
S \subseteq T \;\;==\;\; \forall x\,\qdot\,(\, x\in S \;\limp\; x \in T\,)
\end{array}
</math></center>

In the previous rule, <math>x</math> denotes several variables when the type of <math>S</math> and <math>T</math> is a Cartesian product.

<center><math>
\begin{array}{l}
E \in S \bunion T \;\;==\;\; E \in S \;\lor\; E \in T \\ \\
E \in S \binter T \;\;==\;\; E \in S \;\land\; E \in T \\ \\
E \in S \setminus T \;\;==\;\; E \in S \;\land\; \neg\, (E \in T) \\ \\
E \in \{A, \ldots, B\} \;\;\;==\;\;\; E=A \;\lor\;  \ldots \;\lor\; E=B \\ \\
E \in \union\,(S)\;\;==\;\; \exists s \,\qdot\, s \in S \;\land\; E \in s \\ \\
\;E \in (\Union\; x \,\qdot\,x \in S \;\land\; P\;|\; T\,) \;\;==\;\; \exists x \,\qdot\,x \in S \;\land\; P \;\land\; E \in T \\ \\
\;E \;\in\;  \inter\,(S) \;\;==\;\;  \forall s \,\qdot\, s \in S \;\limp\; E \in s \\ \\
\;E \;\in\;  (\Inter\; x \,\qdot \,x \in S \;\land\; P\;|\; T\,)\;\;==\;\;    \forall x \,\qdot\,x \in S \;\land\; P \;\limp\; E \in T \\ \\
E \in \dom(r)\;\;==\;\; \exists y \,\qdot \, E \mapsto y \;\in\; r \\ \\
F \in \ran(r) \;\;==\;\;\exists x \,\qdot \, x \mapsto F \;\in\; r \\ \\
E \mapsto F \in r^{-1}\;\;==\;\;  F \mapsto E \in r
\\ \\
E \mapsto F \;\in\; S \domres r \;\;==\;\; E \in S \;\;\land\;\;  E \mapsto F \in r  \\ \\
E \mapsto F \;\in\; r \ranres T \;\;==\;\;  E \mapsto F \in r \;\;\land\;\; F \in T   \\ \\
E \mapsto F \;\in\; S \domsub r \;\;==\;\; E \notin S \;\;\land\;\;  E \mapsto F \in r \\ \\
E \mapsto F \;\in\; r \ransub T\;\;==\;\;  E \mapsto F \in r \;\;\land\;\; F \notin T \\ \\
F \in r[w]\;\;==\;\; \exists x \,\qdot\,  x \in w \;\;\land\;\;  x \mapsto F \in r \\ \\
E \mapsto F \in (p \fcomp q)\;\;==\;\; \exists x \,\qdot \, E \mapsto x \in p \;\;\land\;\;  x \mapsto F \in q \\ \\
p \ovl q\;\;==\;\; (\dom\,(q) \domsub p) \;\bunion\; q \\ \\
E \mapsto F \in \id(S)\;\;==\;\; E \in S  \;\;\land\;\; F=E \\ \\
E \mapsto (F \mapsto G)  \in p \dprod q\;\;==\;\; E \mapsto F \in p \;\;\land\;\; E \mapsto G \in q \\ \\
(E \mapsto G) \mapsto (F \mapsto H)  \in p \pprod q\;\;==\;\; E \mapsto F \in p \;\;\land\;\; G \mapsto H \in q \\ \\
r \in S \trel T \;\;==\;\; r \in S \rel T \;\land\; \dom(r) = S \\ \\
 r \in S \srel T \;\;==\;\; r \in S \rel T \;\land\; \ran(r) = T \\ \\
 r \in S \strel T \;\;==\;\; r \in S \rel T \;\land\;  \dom(r) = S \;\land\; \ran(r) = T
\\ \\
 f \in S \pfun T \;\;==\;\; f \in S \rel T \;\land\; \forall x,y,z \qdot x\mapsto y \in f \;\land\; x \mapsto z  \in f \;\limp\; y=z \\ \\
 f \in S \tfun T \;\;==\;\; f \in S \pfun T \;\land\; \dom(f)=S \\ \\
 f \in S \pinj T \;\;==\;\; f \in S \pfun T \;\land\; f^{-1} \in T \pfun S
\end{array}
</math></center><center><math>
\begin{array}{l}
 f \in S \tinj T \;\;==\;\; f \in S \pinj T \;\land\; \dom(f) = S \\ \\
 f \in S \psur T \;\;==\;\; f \in S \pfun T \;\land\; \ran(f) = T  \\ \\
 f \in S \tsur T \;\;==\;\; f \in S \psur T \;\land\; \dom(f) = S\\ \\
 f \in S \tbij T \;\;==\;\; f \in S \tinj T \;\land\; \ran(f)=T \\ \\
(p \bunion q)^{-1} \;\;==\;\; p^{-1} \bunion q^{-1} \\ \\
(p \binter q)^{-1} \;\;==\;\; p^{-1} \binter q^{-1} \\ \\
(s \domres r)^{-1} \;\;==\;\; r^{-1} \ranres s \\ \\
(s \domsub r)^{-1} \;\;==\;\; r^{-1} \ransub s \\ \\
(r \ranres s)^{-1} \;\;==\;\; s \domres r^{-1} \\ \\
(r \ransub s)^{-1} \;\;==\;\; s \domres r^{-1} \\ \\
(p \fcomp q)^{-1} \;\;==\;\; q^{-1} \fcomp p^{-1} \\ \\
 (s \bunion t) \domres r \;\;==\;\; (s \domres r) \bunion (t \domres r) \\ \\
(s \binter t) \domres r \;\;==\;\; (s \domres r) \binter (t \domres r) \\ \\
(s \bunion t) \domsub r \;\;==\;\; (s \domsub r) \binter (t \domsub r) \\ \\
(s \binter t) \domsub r \;\;==\;\; (s \domsub r) \bunion (t \domsub r) \\ \\
s \domres (p \bunion q) \;\;==\;\; (s \domres p) \bunion (s \domres q) \\ \\
s \domres (p \binter q) \;\;==\;\; (s \domres p) \binter (s \domres q) \\ \\
s \domsub (p \bunion q) \;\;==\;\; (s \domsub p) \bunion (s \domsub q) \\ \\
s \domsub (p \binter q) \;\;==\;\; (s \domsub p) \binter (s \domsub q) \\ \\
r \ranres (s \bunion t) \;\;==\;\; (r \ranres s) \bunion (r \ranres t) \\ \\
r \ranres (s \binter t) \;\;==\;\; (r \ranres s) \binter (r \ranres t) \\ \\
r \ransub (s \bunion t) \;\;==\;\; (r \ransub s) \binter (r \ransub t) \\ \\
r \ransub (s \binter t) \;\;==\;\; (r \ransub s) \bunion (r \ransub t) \\ \\
(p \bunion q) \ranres s \;\;==\;\; (p \ranres s) \bunion (q \ranres s) \\ \\
(p \binter q) \ranres s \;\;==\;\; (p \ranres s) \binter (q \ranres s) \\ \\
(p \bunion q) \ransub s \;\;==\;\; (p \ransub s) \bunion (q \ransub s) \\ \\
(p \binter q) \ransub s \;\;==\;\; (p \ransub s) \binter (q \ransub s) \\ \\
r[S \bunion T] \;\;==\;\; r[S] \bunion r[T]
\end{array}
</math></center><center><math>
\begin{array}{l}
(p \bunion q)[S] \;\;==\;\; p[S] \bunion q[S] \\ \\
\dom(p \bunion q) \;\;==\;\; \dom(p) \bunion \dom(q) \\ \\
\ran(p \bunion q) \;\;==\;\; \ran(p) \bunion \ran(q) \\ \\
S \subseteq T \;\;==\;\; (U \setminus T) \subseteq (U \setminus S)
\end{array}
</math></center>

In the previous rule, the type of <math>S</math> and <math>T</math> is 
<math>\pow(U)</math>.

<center><math>
\begin{array}{l} S = T \; \; ==\; \;  S \subseteq T \; \land \;  T \subseteq S \end{array} 
</math></center>

In the previous rule, <math>S</math> and <math>T</math> are sets

<center><math>
\begin{array}{l}
S \;\subseteq\; A \setminus B \;\;==\;\; S \subseteq A \;\,\land\;\, S \binter B = \emptyset  \\ \\
p \fcomp (q \bunion r) \;\;==\;\; (p \fcomp q) \bunion (p \fcomp r) \\ \\
(q \bunion r) \fcomp p \;\;==\;\; (q \fcomp p) \bunion (r \fcomp p) \\ \\
(p \fcomp q)[s] \;\;==\;\; q[p[s]] \\ \\
(s \domres p) \fcomp q \;\;==\;\; s \domres (p \fcomp q)  \\ \\
(s \domsub p) \fcomp q \;\;==\;\; s \domsub (p \fcomp q)  \\ \\
p \fcomp (q \ranres s) \;\;==\;\; (p \fcomp q) \ranres s  \\ \\
p \fcomp (q \ransub s) \;\;==\;\; (p \fcomp q) \ransub s \\ \\
U \setminus (S \binter T) \;\;==\;\; (U\setminus S) \bunion (U \setminus T) \\ \\
U \setminus (S \bunion T) \;\;==\;\; (U\setminus S) \binter (U \setminus T) \\ \\
U \setminus (S \setminus T) \;\;==\;\; (U\setminus S) \bunion T \\ \\
\end{array}
</math></center>

In the three previous rules, <math>S</math> and <math>T</math> are supposed to 
be of type <math>\pow(U)</math>.

'''Cardinality'''

<center><math>
\begin{array}{l}
\card\,(S) \leq \card(T) \;\;==\;\; S \subseteq T \\ \\
\card\,(S) \geq \card(T) \;\;==\;\; T \subseteq S \\ \\
\card\,(S) < \card(T) \;\;==\;\; S \subset T \\ \\
\card\,(S) > \card(T) \;\;==\;\; T \subset S \\ \\
\card\,(S) = \card(T) \;\;==\;\; S = T
\end{array}
</math></center>

In the five previous rules, <math>S</math> and <math>T</math> must be of the same type.

=== Interactive Inference Rules ===

'''Disjunction'''

<center><math>
\begin{array}{|l|}\; \; \; \begin{array}{c} \hbox{\bf H}, \; \hbox{\bf P} \; \; \vdash \; \;  \hbox{\bf R} \  \  \  \  \ldots \  \  \  \   \hbox{\bf H}, \; \hbox{\bf Q} \; \; \vdash \; \;  \hbox{\bf R} \\[.5ex] \hbox{\bf H},\; \hbox{\bf P} \lor \ldots \lor \hbox{\bf Q} \; \; \vdash \; \;  \hbox{\bf R} \end{array} \  \  \  \  \  {\sf CASE} \; \;  \\
\end{array} 
</math></center>

'''Implication'''

<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash\;\;\hbox{\bf P} \hspace{3em} \hbox{\bf H},\;\hbox{\bf P},\; \hbox{\bf Q} \;\;\vdash \;\; \hbox{\bf R} \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H},\;\hbox{\bf P} \limp \hbox{\bf Q} \;\;\vdash \;\; \hbox{\bf R}
\end{array}
\ \ \ \ \ {\sf MH} \;\; \\ \\ \hline
\end{array}
</math></center><center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash\;\;\neg\,\hbox{\bf Q} \hspace{3em} \hbox{\bf H},\;\neg\,\hbox{\bf Q},\; \neg\,\hbox{\bf P} \;\;\vdash \;\; \hbox{\bf R} \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H},\;\hbox{\bf P} \limp \hbox{\bf Q} \;\;\vdash \;\; \hbox{\bf R}
\end{array}
\ \ \ \ \ {\sf HM} \;\; \\ \\ \hline
\end{array}
</math></center>

'''Equivalence'''

<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H(Q)}, \hbox{\bf P} \leqv \hbox{\bf Q} \;\;\vdash\;\; \hbox{\bf G(Q)}\\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H(P)},\;\hbox{\bf P} \leqv \hbox{\bf Q} \;\;\vdash \;\; \hbox{\bf G(P)}
\end{array}
\ \ \ \ \ {\sf EQV} \hbox{ \ \ \ \bf postponed}\;\;\; \\ \\ \hline
\end{array}
</math></center>

'''Set Theory'''

<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H},\; G=E  ,\;\hbox{\bf P}(F)\;\;\vdash\;\;\hbox{\bf Q} \hspace{3em} \hbox{\bf H},\; \neg\,(G=E)  ,\;\hbox{\bf P}(f(G))\;\;\vdash\;\;\hbox{\bf Q}\\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H},\;\hbox{\bf P}((f\ovl\{E \mapsto F\})(G)) \;\;\vdash \;\; \hbox{\bf Q}
\end{array}
\ \ \ \ \ {\sf OV\_L} \;\; \\ \\ \hline
\end{array}
</math></center><center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H},\; G=E \;\;\vdash\;\;\hbox{\bf Q}(F) \hspace{3em} \hbox{\bf H},\; \neg\,(G=E)  \;\;\vdash\;\;\hbox{\bf Q}(f(G))\\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \hbox{\bf Q}((f\ovl\{E \mapsto F\})(G))
\end{array}
\ \ \ \ \ {\sf OV\_R} \;\; \\ \\ \hline
\end{array}
</math></center><center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H},\; G \in \dom(g)  ,\;\hbox{\bf P}(g(G))\;\;\vdash\;\;\hbox{\bf Q} \hspace{3em} \hbox{\bf H},\; \neg\,G \in \dom(g)  ,\;\hbox{\bf P}(f(G))\;\;\vdash\;\;\hbox{\bf Q}\\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H},\;\hbox{\bf P}((f\ovl g)(G)) \;\;\vdash \;\; \hbox{\bf Q}
\end{array}
\ \ \ \ \ {\sf OV\_L} \;\; \\ \\ \hline
\end{array}
</math></center><center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H},\; G \in \dom(g) \;\;\vdash\;\;\hbox{\bf Q}(g(G)) \hspace{3em} \hbox{\bf H},\; \neg\, G \in \dom(g) \;\;\vdash\;\;\hbox{\bf Q}(f(G))\\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \hbox{\bf Q}((f\ovl g)(G))
\end{array}
\ \ \ \ \ {\sf OV\_R} \;\; \\ \\ \hline
\end{array}
</math></center>

In the four previous rules the <math>\ovl</math> operator must appear at the 
"top level"

<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash\;\; f^{-1} \in A \pfun B    \hspace{3em}\hbox{\bf H} \;\;\vdash\;\;\hbox{\bf Q}(f[S] \binter f[T]) \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \hbox{\bf Q}(f[S \binter T])
\end{array}
\ \ \ \ \ \hbox{\sf $\binter$DIS\_R} \;\; \\ \\ \hline
\end{array}
</math></center>
<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash\;\; f \in A \pfun B    \hspace{3em}\hbox{\bf H} \;\;\vdash\;\;\hbox{\bf Q}(f^{-1}[S] \setminus f^{-1}[T]) \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \hbox{\bf Q}(f^{-1}[S \setminus T])
\end{array}
\ \ \ \ \ \hbox{\sf $\setminus$DIS\_R} \;\; \\ \\ \hline
\end{array}
</math></center>

In the two previous rules, the occurrence of <math>f^{-1}</math> must appear at the "top level". Moreover <math>A</math> and <math>B</math> denote some type. Similar left distribution rules exist

<center><math>
\begin{array}{|l|}\; \; \; \begin{array}{c} \hbox{\bf H} \; \; \vdash \; \; \hbox{WD}(\hbox{\bf Q}(\{ f(E)\} )) \hspace{3em}\hbox{\bf H} \; \; \vdash \; \; \hbox{\bf Q}(\{ f(E)\} ) \\[.5ex] \hbox{\bf H} \; \; \vdash \; \;  \hbox{\bf Q}(f[\{ E\} ]) \end{array} \  \  \  \  \  \hbox{\sf SIM\_ R} \; \;  \\
\end{array} 
</math></center>

In the previous rule, the occurrence of <math>f</math> must appear at the "top level". A similar left simplification rule exists.

<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash\;\;\hbox{WD}(\hbox{\bf Q}(g(f(x))))    \hspace{3em}\hbox{\bf H} \;\;\vdash\;\;\hbox{\bf Q}(g(f(x))) \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \hbox{\bf Q}((f \fcomp g)(x))
\end{array}
\ \ \ \ \ \hbox{\sf SIM\_R} \;\; \\ \\ \hline
\end{array}
</math></center>

In the previous rule, the occurrence of <math>f \fcomp g</math> must appear at 
the "top level". A similar left simplification rule exists.

'''Finiteness'''

<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\; S \subseteq T \hspace{4em} \hbox{\bf H} \;\;\vdash \;\; \finite\,(T)\\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \finite\,(S)
\end{array}
\ \ \ \ \ \ \ \hbox{\sf fin$\subseteq$\_R} \;\;\; \\ \\ \hline
\end{array}
</math></center>

For applying the previous rule, the user has to write the set corresponding to <math>T</math> in the editing area of the Proof Control Window.

<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\;\finite\,(S) \;\lor\;\ldots \;\lor\; \finite\,(T)\\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \finite\,(S \;\binter\;\ldots \;\binter\; T)
\end{array}
\ \ \ \ \ \ \ \hbox{\sf fin$\binter$\_R} \;\;\; \\ \\ \hline
\end{array}
</math></center>
<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\;\finite\,(S)\\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \finite\,(S \;\setminus\; T)
\end{array}
\ \ \ \ \ \ \ \hbox{\sf fin$\setminus$\_R} \;\;\; \\ \\ \hline
\end{array}
</center><center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\; r \;\in\; S \rel T \hspace{3em} \hbox{\bf H} \;\;\vdash \;\; \finite\,(S) \hspace{3em} \hbox{\bf H} \;\;\vdash \;\; \finite\,(T)\\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \finite\,(r)
\end{array}
\ \ \ \ \ \ \ \hbox{\sf fin\_rel\_R} \;\;\; \\ \\ \hline
\end{array}
</math></center>

For applying the previous rule, the user has to write the set corresponding to 
<math>S \rel T</math> in the editing area of the Proof Control Window.

<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\; \finite\,(r) \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \finite\,(r[s])
\end{array}
\ \ \ \ \ \ \ \hbox{\sf fin\_rel\_img\_R} \;\;\; \\ \\ \hline
\end{array}
</math></center><center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\; \finite\,(r) \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \finite\,(\ran(r))
\end{array}
\ \ \ \ \ \ \ \hbox{\sf fin\_rel\_ran\_R} \;\;\; \\ \\ \hline
\end{array}
</math></center><center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\; \finite\,(r) \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \finite\,(\dom(r))
\end{array}
\ \ \ \ \ \ \ \hbox{\sf fin\_rel\_dom\_R} \;\;\; \\ \\ \hline
\end{array}
</math></center><center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\; f \;\in\; S \pfun T \hspace{3em} \hbox{\bf H} \;\;\vdash \;\; \finite\,(S) \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \finite\,(f)
\end{array}
\ \ \ \ \ \ \ \hbox{\sf fin\_fun1\_R} \;\;\; \\ \\ \hline
\end{array}
</math></center>

For applying the previous rule, the user has to write the set corresponding to 
<math>S  \pfun T</math> in the editing area of the Proof Control Window.

<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\; f^{-1} \;\in\; S \pfun T \hspace{3em} \hbox{\bf H} \;\;\vdash \;\; \finite\,(S) \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \finite\,(f)
\end{array}
\ \ \ \ \ \ \ \hbox{\sf fin\_fun2\_R} \;\;\; \\ \\ \hline
\end{array}
</math></center>

For applying the previous rule, the user has to write the set corresponding to 
<math>S  \pfun T</math> in the editing area of the Proof Control Window.

<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\; f \;\in\; S \pfun T \hspace{3em} \hbox{\bf H} \;\;\vdash \;\; \finite\,(s) \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \finite\,(f[s])
\end{array}
\ \ \ \ \ \ \ \hbox{\sf fin\_fun\_img\_R} \;\;\; \\ \\ \hline
\end{array}
</math></center><center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\; f \;\in\; S \pfun T \hspace{3em} \hbox{\bf H} \;\;\vdash \;\; \finite\,(S) \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \finite\,(\ran(f))
\end{array}
\ \ \ \ \ \ \ \hbox{\sf fin\_fun\_ran\_R} \;\;\; \\ \\ \hline
\end{array}
</math></center>

For applying the previous rule, the user has to write the set corresponding to 
<math>S  \pfun T</math> in the editing area of the Proof Control Window.

<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\; f^{-1} \;\in\; S \pfun T \hspace{3em} \hbox{\bf H} \;\;\vdash \;\; \finite\,(S) \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \finite\,(\dom(f))
\end{array}
\ \ \ \ \ \ \ \hbox{\sf fin\_fun\_dom\_R} \;\;\; \\ \\ \hline
\end{array}
</math></center>

For applying the previous rule, the user has to write the set corresponding to 
<math>S  \pfun T</math> in the editing area of the Proof Control Window.

<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\; \finite(S)  \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \exists n\,\qdot\, (\forall x \,\qdot\, x \in S \;\limp\; n \leq x)
\end{array}\;\;\; \\ \\ \hline
\end{array}
</math></center><center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\; \finite(S)  \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \exists n\,\qdot\, (\forall x \,\qdot\, x \in S \;\limp\; x \geq n)
\end{array}\;\;\; \\ \\ \hline
\end{array}
</math></center><center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\; \finite(S)  \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \exists n\,\qdot\, (\forall x \,\qdot\, x \in S \;\limp\; n \geq x)
\end{array}\;\;\; \\ \\ \hline
\end{array}
</math></center><center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\; \finite(S)  \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \exists n\,\qdot\, (\forall x \,\qdot\, x \in S \;\limp\; x \leq n)
\end{array}\;\;\; \\ \\ \hline
\end{array}
</math></center>

In the four previous rules, <math>S</math> must not contain any bound variable.

<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\; \exists n\,\qdot\, (\forall x \,\qdot\, x \in S \;\limp\; n \leq x)  \hspace{3em} \hbox{\bf H} \;\;\vdash \;\; S \subseteq \intg \setminus \natn \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \finite(S)
\end{array}\;\;\; \\ \\ \hline
\end{array}
</math></center><center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H} \;\;\vdash \;\; \exists n\,\qdot\, (\forall x \,\qdot\, x \in S \;\limp\; x \leq n)  \hspace{3em} \hbox{\bf H} \;\;\vdash \;\; S \subseteq \nat \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash \;\; \finite(S)
\end{array}\;\;\; \\ \\ \hline
\end{array}
</math></center>

'''Cardinality'''

<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H},\, a \leq b \;\;\vdash \;\; \hbox{\bf Q}(b-a+1) \hspace{3em} \hbox{\bf H},\, b < a \;\;\vdash \;\; \hbox{\bf Q}(0) \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash\;\; \hbox{\bf Q}(\card\,(a\upto b))
\end{array}\;\;\; \\ \\ \hline
\end{array}
</math></center><center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H},\, a \leq b,\,\hbox{\bf P}(a-b+1)  \;\;\vdash \;\; \hbox{\bf Q} \hspace{3em} \hbox{\bf H},\, b < a ,\, \hbox{\bf P}(0)\;\;\vdash \;\; \hbox{\bf Q} \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H},\,\hbox{\bf P}(\card\,(a\upto b))  \;\;\vdash\;\; \hbox{\bf Q}
\end{array}\;\;\; \\ \\ \hline
\end{array}
</math></center>

In the two previous rules, <math>\card (a \upto b)</math> must appear at 
"top-level".

<center><math>
\begin{array}{|l|} \hline \\
\;\;\;\begin{array}{c}
\hbox{\bf H}  \;\;\vdash \;\; \hbox{\bf P}(S \subseteq T)  \\ [.5ex] \hline \\ [-1.5ex] 
\hbox{\bf H} \;\;\vdash\;\; \hbox{\bf P}(\card\,(S) \leq \card(T))
\end{array}\;\;\; \\ \\ \hline
\end{array}
</math></center>

There are similar rules for other cases

</div>{{Navigation|Previous= [[The_Proof_Obligation_Explorer_(Rodin_User_Manual)|The Proof Obligation Explorer]]|Next= [[The_Mathematical_Language_(Rodin_User_Manual)|The Mathematical Language]]|Up= [[index_(Rodin_User_Manual)|User_Manual_index]]}}

[[Category:User Documentation|The Proving Perspective]]
[[Category:Rodin Platform|The Proving Perspective]]
[[Category:User Manual|The Proving Perspective]]