The Proving Perspective is made of a number of windows: the proof tree, the goal, the selected hypotheses, the proof control, the proof information, and the searched hypotheses. In subsequent sections, we study these windows, but before that let us see how one can load a proof.
== Overview ==
When proof obligations (POs) are not discharged automatically the user can attempt to discharge them interactively using the Proving Perspective. This page provides an overview of the Proving Perspective and its use. If the Proving Perspective is not visible as a tab on the top right-hand corner of the main interface, the user can switch to it via "Window -> Open Perspective".
The Proving Perspective consists of a number of views: the Proof Tree, the Goal, the Selected Hypotheses, the Proof Control, the Search Hypotheses, the Cache Hypotheses and the Proof Information. In the discussion that follows we look at each of these views individually. Below is a screenshot of the Proving Perspective:
[[Image:ProvPers.png|center]]
== Loading a Proof ==
== Loading a Proof ==
To work on an un-discharged PO it is necessary to load the proof into the Proving Perspective. To do this switch to the Proving Perspective; select the project from the Event-B Explorer; select and expand the component (context or machine); and finally select (double-click) the proof obligation of interest. A number of views will be updated with details of the corresponding proof.
[[Image:ExplorerView.png|center]]
In order to load a proof, enter the Proof Obligation window, select the project, select and expand the component, finally select the proof obligation: the corresponding proof will be loaded. As a consequence:
Note that pressing [[Image:Discharged.gif]] button on the top left hand side of the Event-B Explorer will remove all discharged proof obligations (PO's) from the view.
* the proof tree is loaded in the Proof Tree window. As we shall see in section [[User_Manual_The_Proving_Perspective#tree|6.2]], each node of the proof tree is associated with a sequent.
* In case the proof tree has some "pending" nodes (whose sequents are not discharged yet) then the sequent corresponding to the first pending node is decomposed: its goal is loaded in the Goal window (section [[User_Manual_The_Proving_Perspective#goal|6.3]]), whereas parts of its hypotheses (the "selected" ones) are loaded in the Selected Hypotheses window (section [[User_Manual_The_Proving_Perspective#goal|6.3]]).
* In case the proof tree has no pending node, then the sequent of the root node is loaded as explained previously.
== The Proof Tree ==
== The Proof Tree ==
The proof tree view provides a graphical representation of each individual proof step, as seen in the following screenshot:
=== Description of the Proof Tree ===
[[Image:ProTree.png|center]]
The proof tree can be seen in the corresponding window as shown in the following screen shot:
[[Image:um-0095.png|center]]
Each line in the proof tree corresponds to a node which is a sequent. A line is right shifted when the corresponding node is a direct descendant of the node of the previous line. Here is an illustration of the previous tree:
[[Image:Tree.png|center]]
Each node is labelled with a comment explaining how it can be discharged. By selecting a node in the proof tree, the corresponding sequent is decomposed and loaded in the Goal and Selected Hypotheses windows as explained in section [[User_Manual_The_Proving_Perspective#loadproof|6.1]].
Each node in the tree corresponds to a sequent. A line is right shifted when the corresponding node is a direct descendant of the node of the previous line. Each node is labelled with a comment which indicates which rule has been applied, or which prover discharged the proof. By selecting a node in the proof tree, the corresponding sequent is loaded: the hypotheses of the sequent are loaded to the Selected Hypotheses window, and the goal of the sequent is loaded to the Goal view.
=== Decoration ===
=== Decoration===
The leaves of the tree are decorated with one of three icons:
The leaves of the tree are decorated with three kinds of logos:
* [[Image:Discharged.gif]] means that this leaf is discharged,
* [[Image:Pending.gif]] means that this leaf is not discharged,
* [[Image:Reviewed.gif]] means that this leaf has been reviewed.
* a green logo with a "<math>\surd </math>" in it means that this leaf is discharged,
Internal nodes in the proof tree are decorated in reverse colours. Note that a "reviewed" leaf is one that is not discharged yet by the prover. Instead, it has been "seen" by the user who decided to postpone the proof. Marking nodes as "reviewed" is very convenient since the provers will ignore these leaves and focus on specific areas of interest. This allows interactive proof in a gradual fashion. In order to discharge a "reviewed" node, select it and prune the tree at that node: the node will become "brown" again (undischarged) and you can now try to discharge it.
* a red logo with a "?" in it means that this leaf is not discharged,
* a blue logo with a "R" in it means that this leaf has been reviewed.
Internal nodes in the proof tree are decorated in the same (but lighter) way. Note that a "reviewed" leaf is one that is not discharged yet by the prover. Instead, it has been "seen" by the user who decided to have it discharged later. Marking nodes as "reviewed" is very convenient in order to perform an interactive proof in a gradual fashion. In order to discharge a "reviewed" node, select it and prune the tree at that node (section [[User_Manual_The_Proving_Perspective#prune|]]): the node will become "red" again (undischarged) and you can now try to discharge it.
=== Navigation within the Proof Tree===
On top of the proof tree view, one can see three buttons:
=== Navigation within the Proof Tree ===
* the "'''G'''" buttons allows you to see the goal of the sequent corresponding to each node,
* the "'''+'''" button allows you to fully expand the proof tree,
* the "'''-'''" allows you to fully collapse the tree: only the root stays visible.
On top of the proof tree window one can see three buttons:
=== Manipulating the Proof Tree===
* the "G" buttons allows you to see the goal of the sequent corresponding to the node
==== Hiding ====
* the "+" button allows you to fully expand the proof tree
The little square (with a "+" or "-" inside) next to each node in the proof tree allows you to expand or collapse the subtree starting at that node.
* the "-" allows you to fully collapse the tree: only the root stays visible.
=== Hiding ===
The little triangle next to each node in the proof tree allows you to expand or collapse the subtree starting at that node.
=== Pruning ===
The proof tree can be pruned from a node: it means that the subtree starting at that node is eliminated. The node in question becomes a leaf and is red decorated. This allows you to resume the proof from that node. After selecting a sequent in the proof tree, pruning can be performed in two ways:
==== Pruning ====
The proof tree can be pruned at a selected node; the subtree of the selected node is removed from the proof tree. The selected node becomes a leaf and is decorated with [[Image:Pending.gif]] . The proof activity can then be resumed from this node. After selecting a node in the proof tree pruning can be performed in two ways:
* by right-clicking and then selecting "Prune",
* by right-clicking and then selecting "Prune",
* by pressing the "Scissors" button in the proof control window (section [[User_Manual_The_Proving_Perspective#proofcontrol|6.4]]).
* by clicking on the [[Image:Pn_prover.gif]] button in the proof control view.
Note that after pruning, the post-tactic (section [[User_Manual_The_Proving_Perspective#post|6.8]]) is not applied to the new current sequent: if needed you have to press the "post-tactic" button in the Proof Control window (section [[User_Manual_The_Proving_Perspective#proofcontrol|6.4]]). This happens in particular when you want to redo a proof from the beginning: you prune the proof tree from the root node and then you have to press the "post-tactic" button in order to be in exactly the same situation as the one delivered automatically initially.
Note that after pruning, the post-tactic is not applied to the new current sequent. The post-tactic should be applied manually, if required, by clicking on the post-tactic button in the Proof Control view. This is useful, in particular, when you want to redo a proof from the beginning. The proof tree can be pruned at its root node and then the proof can proceed again, with invocation of internal or external provers; or with interactive proof.
When you want to redo a proof from a certain node, it might be advisable to do it after copying the tree so that in case your new proof fails you can still resume the previous situation by pasting the copied version (see next section).
Before pruning a particular node, the node (and its subtree) can be copied to the clipboard. If the new proof strategy subsequently fails, the copied version can be pasted back into the pruned node (see the next section).
=== Copy/Paste ===
==== Copy/Paste ====
By selecting a node in the proof tree and then clicking on the right key of the mouse, you can copy the part of the proof tree starting at that sequent: it can later be pasted in the same way. This allows you to reuse part of a proof tree in the same (or even another) proof.
By selecting a node in the proof tree and then right-clicking with the mouse, you can copy the part of the proof tree starting at that sequent (the node and its subtree). Pasting the node and subtree back in is done in a similar manner, with a right mouse click on a proof node. This allows reuse of part of a proof tree in the same, or even in another, proof.
== Goal and Selected Hypotheses ==
== Goal and Selected Hypotheses ==
The nodes in the proof tree view correspond to sequents. A user will work with one selected node, and thus one sequent, at a time; attempting various strategies in an effort to show that the sequent goal is true. The "Goal" and "Selected Hypotheses" views provide information to the user about the currently selected sequent. Here is an example:
[[Image:GoalHyp.png|center]]
The "Goal" and "Selected Hypotheses" windows display the current sequent you have to prove at a given moment in the proof. Here is an example:
A hypothesis can be removed from the list of selected hypotheses by selecting the check the box situated next to it (you can click on several boxes) and then by clicking on the [[Image:remove.gif]] button at the top of the selected hypotheses window:
[[Image:um-0098.png|center]]
[[Image:GoalHypSelect.png|center]]
A selected hypothesis can be deselected by first clicking in the box situated next to it (you can click on several boxes) and then by pressing the red (-) button at the top of the selected hypothesis window:
[[Image:um-0099.png|center]]
Here is the result:
Here is the result:
[[Image:um-0100.png|center]]
[[Image:GoalHypSelectRes.png|center]]
Notice that the deselected hypotheses are not lost: you can get them back by means of the Searched Hypotheses window (section [[User_Manual_The_Proving_Perspective#srchhyp|6.7]]).
The three other buttons next to the red (-) button allow you to do the reverse operation, namely keeping some hypotheses. The (ct) button next to the goal allows you to do a proof by contradiction: pressing it makes the negation of the goal being a selected hypothesis whereas the goal becomes "false". The (ct) button next to a selected hypothesis allows you to do another kind of proof by contradiction: pressing it makes the negation of the hypothesis the goal whereas the negated goal becomes an hypothesis.
== The Proof Control Window ==
The Proof Control window contains the buttons which you can use to perform an interactive proof. Next is a screen shot where you can see successively from top to bottom:
* some selected hypotheses,
* the goal,
* the "Proof Control" window,
* a small editing area within which you can enter parameters used by some buttons of the Proof Control window
* the smiley (section [[User_Manual_The_Proving_Perspective#smiley|6.5]])
[[Image:um-0101.png|center]]
The Proof Control window offers a number of buttons which we succinctly describe from left to right:
* (p0): the prover PP attempts to prove the goal (other cases in the list)
* (R) review: the user forces the current sequent to be discharged, it is marked as being reviewed (it’s logo is blue-colored)
* (dc) proof by cases: the goal is proved first under the predicate written in the editing area and then under its negation,
* (ah) lemma: the predicate in the editing area is proved and then added as a new selected hypothesis,
* (ae) abstract expression: the expression in the editing area is given a fresh name,
* the auto-prover attempts to discharge the goal. The auto-prover is the one which is applied automatically on all proof obligations (as generated automatically by the proof obligation generator after a "save") without any intervention of the user. With this button, you can call yourself the auto-prover within an interactive proof.
* the post-tactic is executed (see section [[User_Manual_The_Proving_Perspective#post|6.8]]),
* lasso: load in the Selected Hypotheses window those unseen hypotheses containing identifiers which are common with identifiers in the goal and selected hypotheses,
* backtrack form the current node (i.e., prune its parent),
* scissors: prune the proof tree from the node selected in the proof tree,
* show (in the Search Hypotheses window) hypotheses containing the character string as in the editing area,
* show the Cache Hypotheses window,
* load the previous non-discharged proof obligation,
* load the next undischarged proof obligation,
* (i) show information corresponding to the current proof obligation in the corresponding window. This information correspond to the elements that took directly part in the proof obligation generation (events, invariant, etc.),
* goto the next pending node of the current proof tree,
* load the next reviewed node of the current proof tree.
== The Smiley ==
The smiley can take three different colors: (1) red, meaning that the proof tree contains one or more non-discharged sequents, (2) blue, meaning that all non-discharged sequents of the proof tree have been reviewed, (3) green, meaning that all sequents of the proof tree are discharged.
Note that the deselected hypotheses are not lost: you can find them again using the Search Hypotheses [[Image:sh_prover.gif]] button in the Proof Control view. Other buttons are used as follows:
== The Operator "Buttons" ==
In the goal and in the selected, searched, or cache hypotheses some operators are colored in red. It means that they are "buttons" you can press. When doing so, the meaning (sometimes several) is shown in a menu where you can select various options. The operation performed by these options is described in sections [[User_Manual_The_Proving_Perspective#inter rewr|]] and [[User_Manual_The_Proving_Perspective#inter infr|]].
* [[Image:select_all_prover.gif]] select all hypotheses.
== The Search Hypotheses Window ==
A window is provided which contains the hypotheses having a character string in common with the one in the editing area. For example, if we search for hypotheses involving the character string "cr", then after pressing the "search hypothesis" button in the proof control window, we obtain the following:
* [[Image:inv_prover.gif]] invert the selection.
[[Image:um-0102.png|center]]
Such hypotheses can be moved to the "Selected Hypotheses" window (button (+)) or removed from the "Search Hypotheses" window (button (-)). As for the selected hypotheses, other buttons situated next to the previous ones, allow you to move or remove all hypotheses. By pressing the (ct) button the negation of the corresponding hypothesis becomes the new goal.
* [[Image:falsify_prover.gif]] next to the goal - proof by contradiction 1: The negation of the '''goal''' becomes a selected hypothesis and the goal becomes "'''⊥'''".
== The Automatic Post-tactic ==
In this section, we present the various rewrite or inference rules which are applied automatically as a systematic post-tactic after each proof step. Note that the post-tactic can be disabled by using the "'''P'''<math>\! \! \! \! /</math>" button situated on the right of the proof control window.
* [[Image:falsify_prover.gif]] next to a selected hypothesis - proof by contradiction 2: The negation of the '''hypothesis''' becomes the goal and the negated goal becomes a selected hypothesis.
The post-tactic is made of two different rules: rewrite rules, which are applied on any sub-formula of the goal or selected hypotheses (section [[User_Manual_The_Proving_Perspective#auto rewr|]]) and inference rules which are applied on the current sequent (section [[User_Manual_The_Proving_Perspective#auto infer|]]).
=== Rewrite rules ===
=== Applying Proof Rules ===
A user wishing to attempt an interactive proof has a number of proof rules available, and these may be either rewrite rules or inference rules. In the Goal and the Selected Hypotheses views various operators may appear in red coloured font. The red font indicates that some interactive proof rule(s) are applicable and may be applied as a step in the proof attempt. When the mouse hovers over such an operator a number of applicable rules may be displayed; the user may choose to apply one of the rules by clicking on it.
The following rewrite rules are ''applied automatically'' in a systematic fashion from left to right either in the goal or in the selected hypotheses. They all correspond to predicate logical equivalences or expression equalities and result in simplifications. They are sorted according to their main purpose.
Other proof rules can be applied when green buttons appear in the Goal and Selected Hypotheses views. Examples are proof by contradiction [[Image:falsify_prover.gif]], that we have already encountered; and [[Image:ConjI_prover.gif]] for conjunction introduction in the goal.
To instantiate a quantifier the user enters the desired expression in the box behind the quantifier and clicks on the quantifier:
'''Disjunction'''
[[Image:InstQuantifier.png|center]]
<center><math> \begin{array}{l} P \lor \ldots \lor \mathord {\top }\lor \ldots \lor Q \; \; ==\; \; \mathord {\top }\\ P \lor \ldots \lor \mathord {\bot }\lor \ldots \lor Q \; \; ==\; \; P \lor \ldots \lor Q \\ P \lor \ldots \lor Q \lor \ldots \lor \neg \, Q \lor \ldots \lor R \; \; ==\; \; \mathord {\top }\\ P \lor \ldots \lor Q \lor \ldots \lor Q \lor \ldots \lor R \; \; ==\; \; P \lor \ldots \lor Q \lor \ldots \lor R \end{array} </math></center>
==== Rewrite Rules ====
Rewrite rules are one-directional equalities (and equivalences) that can be used to simplify formulas (the goal or a single hypothesis). A rewrite rule is applied from left to right when its ''side condition'' holds; it can be applied either in the goal predicate, or in one of the selected hypotheses.
'''Implication'''
A rewrite rule is applied either automatically ('''A''') or manually ('''M'''):
* automatically, when post-tactics are run.
* automatically, when auto-tactics are run.
* manually, through an interactive command. These rules gather non equivalence laws, definition laws, distributivity laws and derived laws.
<center><math> \begin{array}{l} \mathord {\top }\mathbin \Rightarrow P \; \; ==\; \; P \\ \mathord {\bot }\mathbin \Rightarrow P \; \; ==\; \; \mathord {\top }\\ P \mathbin \Rightarrow \mathord {\top }\; \; ==\; \; \mathord {\top }\\ P \mathbin \Rightarrow \mathord {\bot }\; \; ==\; \; \neg \, P \\ P \mathbin \Rightarrow P \; ==\; \; \mathord {\top }\end{array} </math></center>
Automatic rewrite rules are equivalence simplification laws.
<br />'''Equivalence'''
Each rule name indicates the rule's characteristics according to the following convention:
<center><math> \begin{array}{l} P \mathbin \Leftrightarrow \mathord {\top }\; \; ==\; \; P \\ \mathord {\top }\mathbin \Leftrightarrow P\; \; ==\; \; P \\ P \mathbin \Leftrightarrow \mathord {\bot }\; \; ==\; \; \neg \, P \\ \mathord {\bot }\mathbin \Leftrightarrow P \; \; ==\; \; \neg \, P \\ P \mathbin \Leftrightarrow P\; \; ==\; \; \mathord {\top }\end{array} </math></center>
* the law category: simplification law (SIMP), definition law (DEF), distributivity law (DISTRI), or else derived law (DERIV).
* the root operator of the formula on the left-hand side of the rule, e.g. predicate AND, expression BUNION.
* (optionally) the terminal elements on the left-hand side of the rule: special element (SPECIAL) such as the empty-set, type expression (TYPE), same element occurring more than once (MULTI), literal (LIT). A type expression is either a basic type (<math>\intg, \Bool</math>, any carrier set), or <math>\pow</math>(type expression), or type expression<math>\cprod</math>type expression.
* (optionally) some other description of a characteristic, e.g. left (L), right (R).
'''Negation'''
Rewrite rules having a symmetric operator on the left-hand side may also describe other rules. eg: the rule:
<center><math> \begin{array}{l} \neg \, \mathord {\top }\; \; ==\; \; \mathord {\bot }\\ \neg \, \mathord {\bot }\; \; ==\; \; \mathord {\top }\\ \neg \, \neg \, P \; \; ==\; \; P \\ E\neq F \; \; ==\; \; \neg \, E = F \\ E\notin F \; \; ==\; \; \neg \, E \in F \\ E\not\subset F \; \; ==\; \; \neg \, E \subset F \\ E\not\subseteq F \; \; ==\; \; \neg \, E \subseteq F \\ \neg \, a\leq b \; \; ==\; \; a>b \\ \neg \, a\geq b \; \; ==\; \; a<b \\ \neg \, a> b \; \; ==\; \; a\leq b \\ \neg \, a< b \; \; ==\; \; a \geq b \\ \neg \, (E=\mathord {\mathrm{FALSE}}) \; \; ==\; \; \ (E=\mathord {\mathrm{TRUE}}) \\ \neg \, (E=\mathord {\mathrm{TRUE}}) \; \; ==\; \; \ (E=\mathord {\mathrm{FALSE}}) \\ \neg \, (\mathord {\mathrm{FALSE}}=E) \; \; ==\; \; \ (\mathord {\mathrm{TRUE}}= E) \\ \neg \, (\mathord {\mathrm{TRUE}}=E) \; \; ==\; \; \ (\mathord {\mathrm{FALSE}}= E) \end{array} </math></center>
For associative operators in connection with distributive laws as in:
<center><math> \begin{array}{l} E = E \; \; ==\; \; \mathord {\top }\\ E \neq E \; \; ==\; \; \mathord {\bot }\\ E\mapsto F = G \mapsto H \; \; ==\; \; E = G \; \land \; F = H \\ \end{array} </math></center><center><math> \begin{array}{l} \mathord {\mathrm{TRUE}}=\mathord {\mathrm{FALSE}}\; \; ==\; \; \ \mathord {\bot }\\ \mathord {\mathrm{FALSE}}=\mathord {\mathrm{TRUE}}\; \; ==\; \; \ \mathord {\bot }\end{array} </math></center>
<center><math> P \land (Q~ {\color{red}{\lor}} \ldots \lor R) </math></center>
'''Set Theory'''
it has been decided to highlight the first associative/commutative operator (the <math>{\color{red}{\lor}} </math>). A menu is presented when hovering the mouse over the operator: the first menu option distributes all associative/commutative operators, the second option distributes only the first associative/commutative operator. In order to simplify the explanation we write associative/commutative operators with two parameters only. However, ''we must emphasise here'', that generally we may have a sequence of more than two parameters. So, we write <math> Q \lor R </math> instead of <math> Q \lor \ldots \lor R </math>. Rules are sorted according to their purpose.
Rules marked with a star in the first column are implemented in the current prover. Rules without a star are planned for implementation.
<center><math>\begin{array}{l} \{ E\} = \{ F\} \; \; ==\; \; E = F \ \ \ \ \ \hbox{where $E$ and $F$ are single expressions} \\ \{ x \mapsto a,\ldots , y \mapsto b\} ^{-1} \; \; ==\; \; \{ a \mapsto x,\ldots , b \mapsto y\} \\ Ty = \emptyset \; \; ==\; \; \mathord {\bot }\\ \emptyset = Ty \; \; ==\; \; \mathord {\bot }\\ t \in Ty \; \; ==\; \; \mathord {\top }\end{array} </math></center>
Rewrite rules are split into:
In the three previous rewrite rules, <math>Ty</math> denotes a type expression, that is either a basic type (<math>\mathord {\mathbb Z}, \mathord {\mathrm{BOOL}}</math>, any carrier set), or <math>\mathop {\mathbb P\hbox{}}\nolimits </math>(type expression), or type expression<math>\mathbin \times </math>type expression, and <math>t</math> denotes an expression of type <math>Ty</math>.
* [[Set Rewrite Rules]]
* [[Relation Rewrite Rules]]
* [[Arithmetic Rewrite Rules]]
<center><math> \begin{array}{l} U \setminus U \setminus S \; ==\; S \\ S \mathbin {\mkern 1mu\cup \mkern 1mu}\ldots \mathbin {\mkern 1mu\cup \mkern 1mu}U \mathbin {\mkern 1mu\cup \mkern 1mu}\ldots \mathbin {\mkern 1mu\cup \mkern 1mu}T \; \; ==\; \; U \\ S \mathbin {\mkern 1mu\cap \mkern 1mu}\ldots \mathbin {\mkern 1mu\cap \mkern 1mu}U \mathbin {\mkern 1mu\cap \mkern 1mu}\ldots \mathbin {\mkern 1mu\cap \mkern 1mu}T \; \; ==\; \; S \mathbin {\mkern 1mu\cap \mkern 1mu}\ldots \mathbin {\mkern 1mu\cap \mkern 1mu}T \\ S \setminus U \; \; ==\; \; \emptyset \\ \end{array} </math></center>
They are also available in a single large page [[All Rewrite Rules]].
In the four previous rules, <math>S</math> and <math>T</math> are supposed to be of type <math>\mathop {\mathbb P\hbox{}}\nolimits (U)</math>.
==== Inference Rules ====
Inference rules (see [[Proof Rules]]) are applied either automatically (A) or manually (M).
<center><math> \begin{array}{l} r \mathbin ;\emptyset \; \; ==\; \; \emptyset \\ \emptyset \mathbin ;r \; \; ==\; \; \emptyset \\ f(f^{-1}(E)) \; \; ==\; \; E \\ f^{-1}(f(E)) \; \; ==\; \; E \\ S \; \subseteq \; A \mathbin {\mkern 1mu\cup \mkern 1mu}\ldots \mathbin {\mkern 1mu\cup \mkern 1mu}S \mathbin {\mkern 1mu\cup \mkern 1mu}\ldots \mathbin {\mkern 1mu\cup \mkern 1mu}B \; \; ==\; \; \mathord {\top }\\ A \mathbin {\mkern 1mu\cap \mkern 1mu}\ldots \mathbin {\mkern 1mu\cap \mkern 1mu}S \mathbin {\mkern 1mu\cap \mkern 1mu}\ldots \mathbin {\mkern 1mu\cap \mkern 1mu}B \; \subseteq \; S \; \; ==\; \; \mathord {\top }\\ A \mathbin {\mkern 1mu\cup \mkern 1mu}\ldots \mathbin {\mkern 1mu\cup \mkern 1mu}B \; \subseteq \; S \; \; ==\; \; A\subseteq S \; \land \; \ldots \; \land \; B\subseteq S \\ S \; \subseteq \; A \mathbin {\mkern 1mu\cap \mkern 1mu}\ldots \mathbin {\mkern 1mu\cap \mkern 1mu}B \; \; ==\; \; S \subseteq A \; \land \; \ldots \; \land \; S \subseteq B \\ A \mathbin {\mkern 1mu\cup \mkern 1mu}\ldots \mathbin {\mkern 1mu\cup \mkern 1mu}B \; \subset \; S \; \; ==\; \; A\subset S \; \land \; \ldots \; \land \; B\subset S \\ S \; \subset \; A \mathbin {\mkern 1mu\cap \mkern 1mu}\ldots \mathbin {\mkern 1mu\cap \mkern 1mu}B \; \; ==\; \; S \subset A \; \land \; \ldots \; \land \; S \subset B \\ A \; \setminus B \; \subseteq \; S \; \; ==\; \; A \; \subseteq \; B \mathbin {\mkern 1mu\cup \mkern 1mu}S \end{array} </math></center>
Inference rules applied automatically are applied at the end of each proof step. They have the following possible effects:
<center> <math> \begin{array}{l} (-E)*\ldots *(-F)\; ==\; E*\ldots *F \hspace{5em} \hbox{(if an even number of -)} \\ (-E)*\ldots *(-F)\; ==\; -\, (E*\ldots *F) \hspace{3.4em} \hbox{(if an odd number of -)} E/1 \; \; ==\; \; E \\ 0/E \; \; ==\; \; 0 \\ (-E)/(-F)\; \; ==\; E/F \\ E^1 \; \; ==\; \; E \\ E^0 \; \; ==\; \; 1 \\ 1^ E \; \; ==\; \; 1 \\ -(i) \; \; ==\; \; (-i) \ \ \ \hbox{where $i$ is a literal} \\ -((-i)) \; \; ==\; \; i \ \ \ \hbox{where $i$ is a literal} \\ i=j \; \; ==\; \; \mathord {\top }\; \; \hbox{or}\; \; \mathord {\bot }\; \; \hbox{(computation)}\; \; \ \ \ \hbox{where $i$ and $j$ are literals} \\ i \leq j \; \; ==\; \; \mathord {\top }\; \; \hbox{or}\; \; \mathord {\bot }\; \; \hbox{(computation)}\; \; \ \ \ \hbox{where $i$ and $j$ are literals} \\ i < j \; \; ==\; \; \mathord {\top }\; \; \hbox{or}\; \; \mathord {\bot }\; \; \hbox{(computation)}\; \; \ \ \ \hbox{where $i$ and $j$ are literals} \\ i \geq j \; \; ==\; \; \mathord {\top }\; \; \hbox{or}\; \; \mathord {\bot }\; \; \hbox{(computation)}\; \; \ \ \ \hbox{where $i$ and $j$ are literals} \\ i > j \; \; ==\; \; \mathord {\top }\; \; \hbox{or}\; \; \mathord {\bot }\; \; \hbox{(computation)}\; \; \ \ \ \hbox{where $i$ and $j$ are literals} \\ E \leq E \; \; ==\; \; \mathord {\top }\\ E < E \; \; ==\; \; \mathord {\bot }\\ E \geq E \; \; ==\; \; \mathord {\top }\\ E > E \; \; ==\; \; \mathord {\bot }\\ \end{array} </math></center>
=== Automatic inference rules ===
The following inference rules are ''applied automatically'' in a systematic fashion at the end of each proof step. They have the following possible effects:
* they discharge the goal,
* they discharge the goal,
Line 205:
Line 153:
* they simplify a selected hypothesis by decomposing it into several simpler selected hypotheses.
* they simplify a selected hypothesis by decomposing it into several simpler selected hypotheses.
<br />
Inference rules applied manually are used to perform an interactive proof. They can be invoked by clicking on the red highlighted operators in the goal or the hypotheses. A menu is presented when there are several options.
* ('''nPP''') invokes the new predicate prover, a drop-down list indicates alternative strategies.
* ('''R''') indicates that a node has been reviewed: in an attempt by the user to carry out proofs in a stepwise fashion, they might decide to postpone the task of discharging some proofs until a later stage. To do this the proofs can be marked as reviewed by choosing the proof node and clicking on this button. This indicates that by visually checking the proof the user is convinced that they can discharge it later, but they do not want to do it right now.
* ('''p0''') the PP and ML provers can be invoked from the drop-down list using different forces.
* ('''dc''') do proof by cases: the proof is split into two branches. In the first branch:- the predicate supplied by the user is added to the Selected Hypotheses, and the user attempts to discharge this branch. In the second branch :- the predicate supplied by the user is negated and added to the Selected Hypotheses; the user then attempts to discharge this branch.
'''Implication'''
* ('''ah''') add a new lemma: the predicate in the editing area should be proved by the user. It is then added as a new selected hypothesis.
* ('''ae''') abstract expression: the expression in the editing area is given a fresh name.
* '''the robot''': invokes the auto-prover which attempts to discharge the goal. The auto-prover is applied automatically on all proof obligations after a "save" without any intervention of the user. Using this button, you can invoke the auto-prover within an interactive proof.
* the '''post-tactic''' is executed ,
* '''lasoo''': load into the Selected Hypotheses window those hidden hypotheses that contain identifiers in common with the goal, and with the selected hypotheses.
* '''backtrack''' form the current node (i.e., prune its parent),
* '''scissors''': prune the proof tree from the node selected in the proof tree,
* '''Search Hypotheses''': find hypotheses containing the character string in the editing area, and display in the Search Hypothesis view.
* '''Cache Hypotheses''': press this to display the ''"Cache Hypotheses"'' view. This view displays all hypotheses that are related to the current goal.
* load the '''previous''' undischarged proof obligation,
* load the '''next''' undischarged proof obligation,
* '''(i)''' show information corresponding to the current proof obligation in the corresponding window. This information correspond to the elements that directly took part in the proof obligation generation (events, invariant, etc.),
* goto the next '''pending''' node of the current proof tree,
* load the next '''reviewed''' node of the current proof tree.
* '''Disable/Enable Post-tactics''': allows the user to choose whether post-tactics run after each interactive proof step.
=== The Smiley ===
The smiley can be one of three different colors: (1) red, indicates that the proof tree contains one or more undischarged sequents, (2) blue, indicates that all undischarged sequents of the proof tree have been reviewed, (3) green, indicates that all sequents of the proof tree are discharged.
The editing area allows the user to supply parameters for proof commands. For example, when the user attempts to add a new hypothesis (by clicking on the lemma '''ah''' button), the new hypothesis should have been written by the user in the editing area.
By typing a string in the '''Proof Control''' window and pressing the '''Search Hypotheses''' button a window is provided which contains the hypotheses having a character string in common with the one entered by the user in the editing area. For example, if we search for hypotheses involving the character string "cr", then after pressing the '''Search Hypothesis''' button on the proof control window, we obtain the following:
In these two rules <math>x</math> is a variable which is not free in <math>E</math>
=== Preferences for the Post-tactic ===
The post-tactic can be configured by means of a preference page which can be obtained as follows: press the "Window" button on the top tooolbar. On the coming menu, press the "Preferences" button. On the coming menu, press the "Event-B" menue, then the "Sequent Prover’, and finally the "Post-Tactic" button. This yilds the following window:
[[Image:um-0147.png|center]]
In the left part you can see the ordered sequence of individual tactics composing the post-tactic, whereas the right part contains further tactics you can incorporate in the left part. By selecting a tactic you can move it from on part to the other or change the order in the left part.
== Interactive Tactics ==
In this section, the rewrite rules and inference rules, which you can use to perform an interactive proof, are presented. Each of these rules can be invoked by pressing "buttons" which corresponds to emphasized (red) operators in the goal or the hypotheses. A menu is proposed when there are several options.
=== Interactive Rewrite Rules ===
Most of the rewrite rules correspond to distributive laws. For associative operators in connection with such laws as in:
<center><math> P \land (Q \lor \ldots \lor R) </math></center>
it has been decided to put the "button" on the first associative/commutative operator (here <math>\lor </math>). Pressing that button will generate a menu: the first option of this menu will be to distribute all associative/commutative operators, the second option will be to distribute only the first associative/commutative operator. In the following presentation, to simplify matters, we write associative/commutative operators with two parameters only, but it must always be understood implicitly that we have a sequence of them. For instance, we shall never write <math> Q \lor \ldots \lor R </math> but <math> Q \lor R </math> instead. Rules are sorted according to their purpose.
<center><math> \begin{array}{l} \neg \, (P \land Q) \; \; ==\; \; \neg \, P \lor \neg \, Q \\ \neg \, (P \lor Q) \; \; ==\; \; \neg \, P \land \neg \, Q \\ \neg \, (P \mathbin \Rightarrow Q)\; \; ==\; \; P \land \neg \, Q \\ \neg \, \forall x \, \mathord {\mkern 1mu\cdot \mkern 1mu}\, P \; \; ==\; \; \exists x \, \mathord {\mkern 1mu\cdot \mkern 1mu}\, \neg \, P \\ \neg \, \exists x \, \mathord {\mkern 1mu\cdot \mkern 1mu}\, P \; \; ==\; \; \forall x \, \mathord {\mkern 1mu\cdot \mkern 1mu}\, \neg \, P \\ \neg \, (S = \emptyset ) \; \; ==\; \; \exists x \, \mathord {\mkern 1mu\cdot \mkern 1mu}\, x \in S \end{array} </math></center>
'''Set Theory'''
Most of the rules are concerned with simplifying set membership predicates.
<center><math> \begin{array}{l} E \mapsto F \; \in \; S \mathbin \times T \; \; ==\; \; E \in S \; \land \; F \in T \\ E \in \mathop {\mathbb P\hbox{}}\nolimits (S) \; \; ==\; \; E \subseteq S \\ S \subseteq T \; \; ==\; \; \forall x\, \mathord {\mkern 1mu\cdot \mkern 1mu}\, (\, x\in S \; \mathbin \Rightarrow \; x \in T\, ) \end{array} </math></center>
In the previous rule, <math>x</math> denotes several variables when the type of <math>S</math> and <math>T</math> is a Cartesian product.
This view also integrates a "quick search" area (A), that allows us to search quickly hypotheses involving short character strings such as "cr". A '''search hypothesis button (B)''' that behaves the same as the button of the proving window, a '''refresh button (C)''' that updates the window manually for more control, and a '''drop down menu (D)''' to set the preferences of the view up.
<center><math> \begin{array}{l} E \in S \mathbin {\mkern 1mu\cup \mkern 1mu}T \; \; ==\; \; E \in S \; \lor \; E \in T \\ E \in S \mathbin {\mkern 1mu\cap \mkern 1mu}T \; \; ==\; \; E \in S \; \land \; E \in T \\ E \in S \setminus T \; \; ==\; \; E \in S \; \land \; \neg \, (E \in T) \\ E \in \{ A, \ldots , B\} \; \; \; ==\; \; \; E=A \; \lor \; \ldots \; \lor \; E=B \\ E \in \mathop {\mathrm{union}}\nolimits \, (S)\; \; ==\; \; \exists s \, \mathord {\mkern 1mu\cdot \mkern 1mu}\, s \in S \; \land \; E \in s \\ \; E \in (\bigcup \nolimits \; x \, \mathord {\mkern 1mu\cdot \mkern 1mu}\, x \in S \; \land \; P\; |\; T\, ) \; \; ==\; \; \exists x \, \mathord {\mkern 1mu\cdot \mkern 1mu}\, x \in S \; \land \; P \; \land \; E \in T \\ \; E \; \in \; \mathop {\mathrm{inter}}\nolimits \, (S) \; \; ==\; \; \forall s \, \mathord {\mkern 1mu\cdot \mkern 1mu}\, s \in S \; \mathbin \Rightarrow \; E \in s \\ \; E \; \in \; (\bigcap \nolimits \; x \, \mathord {\mkern 1mu\cdot \mkern 1mu}\, x \in S \; \land \; P\; |\; T\, )\; \; ==\; \; \forall x \, \mathord {\mkern 1mu\cdot \mkern 1mu}\, x \in S \; \land \; P \; \mathbin \Rightarrow \; E \in T \\ E \in \mathop {\mathrm{dom}}\nolimits (r)\; \; ==\; \; \exists y \, \mathord {\mkern 1mu\cdot \mkern 1mu}\, E \mapsto y \; \in \; r \\ F \in \mathop {\mathrm{ran}}\nolimits (r) \; \; ==\; \; \exists x \, \mathord {\mkern 1mu\cdot \mkern 1mu}\, x \mapsto F \; \in \; r \\ E \mapsto F \in r^{-1}\; \; ==\; \; F \mapsto E \in r \\ E \mapsto F \; \in \; S \mathbin \lhd r \; \; ==\; \; E \in S \; \; \land \; \; E \mapsto F \in r \\ E \mapsto F \; \in \; r \mathbin \rhd T \; \; ==\; \; E \mapsto F \in r \; \; \land \; \; F \in T \\ E \mapsto F \; \in \; S \mathbin {\lhd \mkern -14mu-}r \; \; ==\; \; E \notin S \; \; \land \; \; E \mapsto F \in r \\ E \mapsto F \; \in \; r \mathbin {\rhd \mkern -14mu-}T\; \; ==\; \; E \mapsto F \in r \; \; \land \; \; F \notin T \\ F \in r[w]\; \; ==\; \; \exists x \, \mathord {\mkern 1mu\cdot \mkern 1mu}\, x \in w \; \; \land \; \; x \mapsto F \in r \\ E \mapsto F \in (p \mathbin ;q)\; \; ==\; \; \exists x \, \mathord {\mkern 1mu\cdot \mkern 1mu}\, E \mapsto x \in p \; \; \land \; \; x \mapsto F \in q \\ p \mathbin {\lhd \mkern -9mu-}q\; \; ==\; \; (\mathop {\mathrm{dom}}\nolimits \, (q) \mathbin {\lhd \mkern -14mu-}p) \; \mathbin {\mkern 1mu\cup \mkern 1mu}\; q \\ E \mapsto F \in {\sf id}\, (S)\; \; ==\; \; E \in S \; \; \land \; \; F=E \\ E \mapsto (F \mapsto G) \in p \mathbin \otimes q\; \; ==\; \; E \mapsto F \in p \; \; \land \; \; E \mapsto G \in q \\ (E \mapsto G) \mapsto (F \mapsto H) \in p \mathbin \| q\; \; ==\; \; E \mapsto F \in p \; \; \land \; \; G \mapsto H \in q \\ r \in S \mathbin {\leftarrow \mkern -14mu\leftrightarrow }T \; \; ==\; \; r \in S \mathbin \leftrightarrow T \; \land \; \mathop {\mathrm{dom}}\nolimits (r) = S \\ r \in S \mathbin {\leftrightarrow \mkern -14mu\rightarrow }T \; \; ==\; \; r \in S \mathbin \leftrightarrow T \; \land \; \mathop {\mathrm{ran}}\nolimits (r) = T \\ r \in S \mathbin {\leftrightarrow \mkern -14mu\leftrightarrow }T \; \; ==\; \; r \in S \mathbin \leftrightarrow T \; \land \; \mathop {\mathrm{dom}}\nolimits (r) = S \; \land \; \mathop {\mathrm{ran}}\nolimits (r) = T \\ f \in S \mathbin {\mkern 6mu\mapstochar \mkern -6mu\rightarrow } T \; \; ==\; \; f \in S \mathbin \leftrightarrow T \; \land \; \forall x,y,z \mathord {\mkern 1mu\cdot \mkern 1mu}x\mapsto y \in f \; \land \; x \mapsto z \in f \; \mathbin \Rightarrow \; y=z \\ f \in S \mathbin \rightarrow T \; \; ==\; \; f \in S \mathbin {\mkern 6mu\mapstochar \mkern -6mu\rightarrow } T \; \land \; \mathop {\mathrm{dom}}\nolimits (f)=S \\ f \in S \mathbin {\mkern 9mu\mapstochar \mkern -9mu\rightarrowtail } T \; \; ==\; \; f \in S \mathbin {\mkern 6mu\mapstochar \mkern -6mu\rightarrow } T \; \land \; f^{-1} \in T \mathbin {\mkern 6mu\mapstochar \mkern -6mu\rightarrow } S \end{array} </math></center><center><math> \begin{array}{l} f \in S \mathbin \rightarrowtail T \; \; ==\; \; f \in S \mathbin {\mkern 9mu\mapstochar \mkern -9mu\rightarrowtail } T \; \land \; \mathop {\mathrm{dom}}\nolimits (f) = S \\ f \in S \mathbin {\mkern 6mu\mapstochar \mkern -6mu\twoheadrightarrow } T \; \; ==\; \; f \in S \mathbin {\mkern 6mu\mapstochar \mkern -6mu\rightarrow } T \; \land \; \mathop {\mathrm{ran}}\nolimits (f) = T \\ f \in S \mathbin \twoheadrightarrow T \; \; ==\; \; f \in S \mathbin {\mkern 6mu\mapstochar \mkern -6mu\twoheadrightarrow } T \; \land \; \mathop {\mathrm{dom}}\nolimits (f) = S\\ f \in S \mathbin { \rightarrowtail \mkern -18mu\twoheadrightarrow } T \; \; ==\; \; f \in S \mathbin \rightarrowtail T \; \land \; \mathop {\mathrm{ran}}\nolimits (f)=T \\ (p \mathbin {\mkern 1mu\cup \mkern 1mu}q)^{-1} \; \; ==\; \; p^{-1} \mathbin {\mkern 1mu\cup \mkern 1mu}q^{-1} \\ (p \mathbin {\mkern 1mu\cap \mkern 1mu}q)^{-1} \; \; ==\; \; p^{-1} \mathbin {\mkern 1mu\cap \mkern 1mu}q^{-1} \\ (s \mathbin \lhd r)^{-1} \; \; ==\; \; r^{-1} \mathbin \rhd s \\ (s \mathbin {\lhd \mkern -14mu-}r)^{-1} \; \; ==\; \; r^{-1} \mathbin {\rhd \mkern -14mu-}s \\ (r \mathbin \rhd s)^{-1} \; \; ==\; \; s \mathbin \lhd r^{-1} \\ (r \mathbin {\rhd \mkern -14mu-}s)^{-1} \; \; ==\; \; s \mathbin \lhd r^{-1} \\ (p \mathbin ;q)^{-1} \; \; ==\; \; q^{-1} \mathbin ;p^{-1} \\ (s \mathbin {\mkern 1mu\cup \mkern 1mu}t) \mathbin \lhd r \; \; ==\; \; (s \mathbin \lhd r) \mathbin {\mkern 1mu\cup \mkern 1mu}(t \mathbin \lhd r) \\ (s \mathbin {\mkern 1mu\cap \mkern 1mu}t) \mathbin \lhd r \; \; ==\; \; (s \mathbin \lhd r) \mathbin {\mkern 1mu\cap \mkern 1mu}(t \mathbin \lhd r) \\ (s \mathbin {\mkern 1mu\cup \mkern 1mu}t) \mathbin {\lhd \mkern -14mu-}r \; \; ==\; \; (s \mathbin {\lhd \mkern -14mu-}r) \mathbin {\mkern 1mu\cap \mkern 1mu}(t \mathbin {\lhd \mkern -14mu-}r) \\ (s \mathbin {\mkern 1mu\cap \mkern 1mu}t) \mathbin {\lhd \mkern -14mu-}r \; \; ==\; \; (s \mathbin {\lhd \mkern -14mu-}r) \mathbin {\mkern 1mu\cup \mkern 1mu}(t \mathbin {\lhd \mkern -14mu-}r) \\ s \mathbin \lhd (p \mathbin {\mkern 1mu\cup \mkern 1mu}q) \; \; ==\; \; (s \mathbin \lhd p) \mathbin {\mkern 1mu\cup \mkern 1mu}(s \mathbin \lhd q) \\ s \mathbin \lhd (p \mathbin {\mkern 1mu\cap \mkern 1mu}q) \; \; ==\; \; (s \mathbin \lhd p) \mathbin {\mkern 1mu\cap \mkern 1mu}(s \mathbin \lhd q) \\ s \mathbin {\lhd \mkern -14mu-}(p \mathbin {\mkern 1mu\cup \mkern 1mu}q) \; \; ==\; \; (s \mathbin {\lhd \mkern -14mu-}p) \mathbin {\mkern 1mu\cup \mkern 1mu}(s \mathbin {\lhd \mkern -14mu-}q) \\ s \mathbin {\lhd \mkern -14mu-}(p \mathbin {\mkern 1mu\cap \mkern 1mu}q) \; \; ==\; \; (s \mathbin {\lhd \mkern -14mu-}p) \mathbin {\mkern 1mu\cap \mkern 1mu}(s \mathbin {\lhd \mkern -14mu-}q) \\ r \mathbin \rhd (s \mathbin {\mkern 1mu\cup \mkern 1mu}t) \; \; ==\; \; (r \mathbin \rhd s) \mathbin {\mkern 1mu\cup \mkern 1mu}(r \mathbin \rhd t) \\ r \mathbin \rhd (s \mathbin {\mkern 1mu\cap \mkern 1mu}t) \; \; ==\; \; (r \mathbin \rhd s) \mathbin {\mkern 1mu\cap \mkern 1mu}(r \mathbin \rhd t) \\ r \mathbin {\rhd \mkern -14mu-}(s \mathbin {\mkern 1mu\cup \mkern 1mu}t) \; \; ==\; \; (r \mathbin {\rhd \mkern -14mu-}s) \mathbin {\mkern 1mu\cap \mkern 1mu}(r \mathbin {\rhd \mkern -14mu-}t) \\ r \mathbin {\rhd \mkern -14mu-}(s \mathbin {\mkern 1mu\cap \mkern 1mu}t) \; \; ==\; \; (r \mathbin {\rhd \mkern -14mu-}s) \mathbin {\mkern 1mu\cup \mkern 1mu}(r \mathbin {\rhd \mkern -14mu-}t) \\ (p \mathbin {\mkern 1mu\cup \mkern 1mu}q) \mathbin \rhd s \; \; ==\; \; (p \mathbin \rhd s) \mathbin {\mkern 1mu\cup \mkern 1mu}(q \mathbin \rhd s) \\ (p \mathbin {\mkern 1mu\cap \mkern 1mu}q) \mathbin \rhd s \; \; ==\; \; (p \mathbin \rhd s) \mathbin {\mkern 1mu\cap \mkern 1mu}(q \mathbin \rhd s) \\ (p \mathbin {\mkern 1mu\cup \mkern 1mu}q) \mathbin {\rhd \mkern -14mu-}s \; \; ==\; \; (p \mathbin {\rhd \mkern -14mu-}s) \mathbin {\mkern 1mu\cup \mkern 1mu}(q \mathbin {\rhd \mkern -14mu-}s) \\ (p \mathbin {\mkern 1mu\cap \mkern 1mu}q) \mathbin {\rhd \mkern -14mu-}s \; \; ==\; \; (p \mathbin {\rhd \mkern -14mu-}s) \mathbin {\mkern 1mu\cap \mkern 1mu}(q \mathbin {\rhd \mkern -14mu-}s) \\ r[S \mathbin {\mkern 1mu\cup \mkern 1mu}T] \; \; ==\; \; r[S] \mathbin {\mkern 1mu\cup \mkern 1mu}r[T] \end{array} </math></center><center><math> \begin{array}{l} (p \mathbin {\mkern 1mu\cup \mkern 1mu}q)[S] \; \; ==\; \; p[S] \mathbin {\mkern 1mu\cup \mkern 1mu}q[S] \\ \mathop {\mathrm{dom}}\nolimits (p \mathbin {\mkern 1mu\cup \mkern 1mu}q) \; \; ==\; \; \mathop {\mathrm{dom}}\nolimits (p) \mathbin {\mkern 1mu\cup \mkern 1mu}\mathop {\mathrm{dom}}\nolimits (q) \\ \mathop {\mathrm{ran}}\nolimits (p \mathbin {\mkern 1mu\cup \mkern 1mu}q) \; \; ==\; \; \mathop {\mathrm{ran}}\nolimits (p) \mathbin {\mkern 1mu\cup \mkern 1mu}\mathop {\mathrm{ran}}\nolimits (q) \\ S \subseteq T \; \; ==\; \; (U \setminus T) \subseteq (U \setminus S) \end{array} </math></center>
By pressing '''return''' key or the button (B) (once a short string has been given in the input area (A)), hypotheses can be searched quickly as if we used the '''Proof Control''' as described before.
In the previous rule, the type of <math>S</math> and <math>T</math> is <math>\mathop {\mathbb P\hbox{}}\nolimits (U)</math>.
The drop down menu (D) is accessible to set some preferences over the searched hypotheses :
<center><math> \begin{array}{l} S = T \; \; ==\; \; S \subseteq T \; \land \; T \subseteq S \end{array} </math></center>
[[Image:SearchHyp_view_menu.png|center]]
In the previous rule, <math>S</math> and <math>T</math> are sets
If we change preferences for the search, we might need to "update" manually the view with the button (C).
By selecting "Consider hidden hypotheses in search" option, we can review all hypotheses that have been unselected in the selected hypotheses window(more info about[[Rodin_Proving_Perspective#Goal and Selected Hypotheses| selected/hidden hypotheses]]...).
In the three previous rules, <math>S</math> and <math>T</math> are supposed to be of type <math>\mathop {\mathbb P\hbox{}}\nolimits (U)</math>.
To move any of these hypotheses to the '''Selected Hypotheses''' window, select those required (using the check boxes) and press the [[Image:Add.gif]] button. Adding these hypotheses to the selected hypotheses means that they will be visible to the prover. They can then be used during the next interactive proof phase.
'''Cardinality'''
To remove hypotheses from the '''Search Hypotheses''' window use the [[Image:Remove.gif]] button. This button also appears above the selected hypotheses, and allows the user to remove any hypothesis from the '''Selected Hypotheses''' window.
<center><math> \begin{array}{l} \mathop {\mathrm{card}}\nolimits \, (S) \leq \mathop {\mathrm{card}}\nolimits (T) \; \; ==\; \; S \subseteq T \\ \mathop {\mathrm{card}}\nolimits \, (S) \geq \mathop {\mathrm{card}}\nolimits (T) \; \; ==\; \; T \subseteq S \\ \mathop {\mathrm{card}}\nolimits \, (S) < \mathop {\mathrm{card}}\nolimits (T) \; \; ==\; \; S \subset T \\ \mathop {\mathrm{card}}\nolimits \, (S) > \mathop {\mathrm{card}}\nolimits (T) \; \; ==\; \; T \subset S \\ \mathop {\mathrm{card}}\nolimits \, (S) = \mathop {\mathrm{card}}\nolimits (T) \; \; ==\; \; S = T \end{array} </math></center>
The other button, situated to the left each hypotheses, is the [[Image:falsify_prover.gif]] button. clicking on this will attempt a proof by contradiction. The effect is the same as if the hypothesis were in the '''Selected Hypotheses'''.
In the five previous rules, <math>S</math> and <math>T</math> must be of the same type.
== The Cache Hypotheses Window ==
=== Interactive Inference rules ===
This window allows the user to keep track of recently manipulated (e.g., used, removed, selected) hypotheses for any PO. For example, when the user applies a rewrite to an hypothesis, a new hypothesis (after the rewriting) is selected, and the original hypothesis is deselected and put in the '''Cache Hypotheses''' window.
'''Disjunction'''
Similar operations (to that of the '''Selected Hypotheses''' and '''Search Hypotheses''' windows) such as removing, selecting and proof by contradiction ('''ct''') are also available for the cached hypotheses. Interactive proof steps (e.g., rewriting) can also be carried out from the '''Cache Hypotheses''' window as well as the '''Search Hypotheses''' window.
This view displays information so that the user can relate a proof obligation to the model. For example, typical information for an event invariant preservation PO includes the event; as well as the invariant in question. In the following example, the hyperlinks 'CreateToken' and 'inv2' can be used to navigate to the containing machine.
By default, this view is a fast view. A button (identified by the view's icon) is then available at the bottom left of the workbench, to show up this view.
In the four previous rules the <math>\mathbin {\lhd \mkern -9mu-}</math> operator must appear at the "top level"
In the two previous rules, the occurrence of <math>f^{-1}</math> must appear at the "top level". Moreover <math>A</math> and <math>B</math> denote some type. Similar left distribution rules exist
A quick view on the applied rule contents is provided. On the picture above, we display the contents of the rule named "∀ hyp mp" where an input has been used to instantiate an hypothesis.<br> One can see quickly which was the input used by the instanciation (following '''instantiated with'''), and which was the hypothesis considered by this rule (this is given by the hypothesis of '''Input Sequent''').<br>
Furthermore, it is possible to view the antecedents created by this rule in details (i.e. child proof tree nodes) and the actions performed on hypotheses : selection, deselection, etc.
In the previous rule, the occurrence of <math>f</math> must appear at the "top level". A similar left simplification rule exists.
The auto-tactic applies a combination (i.e. ordered list) of ''rewrite'', ''inference'' tactics and ''external provers'' automatically to newly generated proof obligations. However, they can also be invoked by the user by clicking on the [[Image:auto_prover.png]] button in the '''Proof Control''' view. Note that the automatic application of the auto-prover can be quickly toggled with the ''Prove automatically'' menu item available from the ''Project'' menu. See the picture below.
The post-tactic is also a combination of ''rewrite'', ''inference'' tactics and ''external provers'', and is applied <u>automatically after each interactive proof step</u>. However, it can also be invoked manually by clicking on the [[Image:Broom_prover.gif]] button in the '''Proof Control''' view.
In the previous rule, the occurrence of <math>f \mathbin ;g</math> must appear at the "top level". A similar left simplification rule exists.
Note that the post-tactic can be disabled quickly by clicking on the little arrow (marked with an A on the figure below) of the '''Proof Control''' view (right upper corner) and then on "Disable post-tactic" (B):
The ordered list of ''rewrite'', ''inference'' tactics and ''external provers'' that should be applied is called a '''profile'''. There are two default profiles, one for the auto-tactic and one for the post-tactic. These default profiles are immutable in time, but can be duplicated for further modification by the user. Indeed, the user can edit a profile and select it to run as automatic or post tactic. The idea is to have a set of available tactic profiles to be used as needed.
Moreover, these edited profiles are shipped with projects if defined at this scope, or can be imported or exported if defined at a workspace level, which is very useful to share them.
For applying the previous rule, the user has to write the set corresponding to <math>T</math> in the editing area of the Proof Control Window.
There are two ways to run the automatic or post tactics:
* the manual way consists into clicking on the [[Image:auto_prover.png]] button, or the [[Image:Broom_prover.gif]] button in the Proof Control view, to respectively launch the auto-tactic (with the selected auto-tactic profile) and the post-tactic (with the selected post-tactic profile).
* the automatical way if such preference is activated. (Auto-tactic after each proof step, and post-tactic at each step and rebuild) The mandatory condition for post-tactics or auto-tactics to automatically run is that they should be activated from their preference or property.
The user can separately define tactic profiles and assign them to post and auto tactics. Therefore, there are two tabs in the "Auto/Post Tactic" preference page to address these choices. These tabs will be descibed in the two next sections.
For applying the previous rule, the user has to write the set corresponding to <math>S \mathbin \leftrightarrow T</math> in the editing area of the Proof Control Window.
=== Preferences for the selected auto and post tactic profile ===
This section describes the "Auto/Post Tactic" tab of the "Auto/Post Tactic" preference page.
There are two scopes to set up preferences for the auto and post tactics : at workspace level, and at project level.
Note that if the automatic application of tactics (auto or post) is decided only at workspace level, and this choice is held at project level.
For applying the previous rule, the user has to write the set corresponding to <math>S \mathbin {\mkern 6mu\mapstochar \mkern -6mu\rightarrow } T</math> in the editing area of the Proof Control Window.
To access these preferences, one as to go open the "Auto/Post Tactic" preference page that can be found after "Window > Preference > Sequent Prover".
The figure below shows the "Auto/Post Tactic" preference page:
For applying the previous rule, the user has to write the set corresponding to <math>S \mathbin {\mkern 6mu\mapstochar \mkern -6mu\rightarrow } T</math> in the editing area of the Proof Control Window.
The buttons 1 and 2 are activating/deactivating the automatic use of respectively auto and post tactics.
One can also see on this picture the selected profile to be use as auto and post tactic.<br>
'''Note that there is always a profile selected, and this profile can be changed whether the tactic are automatically launched or not, as there is alway a way to manually launch auto and post tactics.'''<br>
On the preference appearing above, the ''Default Auto Tactic Profile'' is used to compose the automatic tactic, and the ''Default Post Tactic Profile'' is used to compose the post-tactic.
For applying the previous rule, the user has to write the set corresponding to <math>S \mathbin {\mkern 6mu\mapstochar \mkern -6mu\rightarrow } T</math> in the editing area of the Proof Control Window.
The figure below shows the "Auto/Post Tactic" Preference page with both auto-tactic and post-tactic to automatically run, and where the user selects the profile "MyFirstTacticProfile" to be used as auto-tactic profile.
For applying the previous rule, the user has to write the set corresponding to <math>S \mathbin {\mkern 6mu\mapstochar \mkern -6mu\rightarrow } T</math> in the editing area of the Proof Control Window.
=== Preferences for available profiles ===
This section describes the "Profile" tab of the "Auto/Post Tactic" preference page.
The figure above shows the contents of the profile tab.
There are two visible lists : a list of profiles on the left the tactics or provers that compose these profiles (Profile Details). Here one can see the contents of the Defaut Auto Tactic Profile.
In the four previous rules, <math>S</math> must not contain any bound variable.
There are 4 buttons available to the user :
*New : to create a new profile "from scratch",
*Edit : to edit an existing (editable) profile,
*Remove : to remove a profile definitively,
*Duplicate : to duplicate a selected profile for further slight modification,
The list of the right represents the available and unselected tactics. The list of the left is the profile contents, and represents the selected tactics to be '''applied from the top to down'''.
The user can select some available tactic from the list of the right using the ">>" button or unselect some tactics from the list of the left using the "<<" button.
The user can re-order contiguous selection of selected tactics using the "Up" and "Down" button.
By clicking on "Finish" the profile will be saved and available for use in the auto and post tactics.
In the two previous rules, <math>\mathop {\mathrm{card}}\nolimits (a \mathbin {.\mkern 1mu.}b)</math> must appear at "top-level".
=== Project specific settings ===
The user can select profiles locally to project.
To do so, one has to select the "Auto/Post Tactic" property page available from '''right-click > Properties''' on a project, or by clicking the '''Configure project specific settings''' link on the "Auto/Post Tactic" preference page. This property page appears on the picture below, opened on the Auto/Post tactic tab.
When proof obligations (POs) are not discharged automatically the user can attempt to discharge them interactively using the Proving Perspective. This page provides an overview of the Proving Perspective and its use. If the Proving Perspective is not visible as a tab on the top right-hand corner of the main interface, the user can switch to it via "Window -> Open Perspective".
The Proving Perspective consists of a number of views: the Proof Tree, the Goal, the Selected Hypotheses, the Proof Control, the Search Hypotheses, the Cache Hypotheses and the Proof Information. In the discussion that follows we look at each of these views individually. Below is a screenshot of the Proving Perspective:
Loading a Proof
To work on an un-discharged PO it is necessary to load the proof into the Proving Perspective. To do this switch to the Proving Perspective; select the project from the Event-B Explorer; select and expand the component (context or machine); and finally select (double-click) the proof obligation of interest. A number of views will be updated with details of the corresponding proof.
Note that pressing button on the top left hand side of the Event-B Explorer will remove all discharged proof obligations (PO's) from the view.
The Proof Tree
The proof tree view provides a graphical representation of each individual proof step, as seen in the following screenshot:
Each node in the tree corresponds to a sequent. A line is right shifted when the corresponding node is a direct descendant of the node of the previous line. Each node is labelled with a comment which indicates which rule has been applied, or which prover discharged the proof. By selecting a node in the proof tree, the corresponding sequent is loaded: the hypotheses of the sequent are loaded to the Selected Hypotheses window, and the goal of the sequent is loaded to the Goal view.
Decoration
The leaves of the tree are decorated with one of three icons:
means that this leaf is discharged,
means that this leaf is not discharged,
means that this leaf has been reviewed.
Internal nodes in the proof tree are decorated in reverse colours. Note that a "reviewed" leaf is one that is not discharged yet by the prover. Instead, it has been "seen" by the user who decided to postpone the proof. Marking nodes as "reviewed" is very convenient since the provers will ignore these leaves and focus on specific areas of interest. This allows interactive proof in a gradual fashion. In order to discharge a "reviewed" node, select it and prune the tree at that node: the node will become "brown" again (undischarged) and you can now try to discharge it.
Navigation within the Proof Tree
On top of the proof tree view, one can see three buttons:
the "G" buttons allows you to see the goal of the sequent corresponding to each node,
the "+" button allows you to fully expand the proof tree,
the "-" allows you to fully collapse the tree: only the root stays visible.
Manipulating the Proof Tree
Hiding
The little square (with a "+" or "-" inside) next to each node in the proof tree allows you to expand or collapse the subtree starting at that node.
Pruning
The proof tree can be pruned at a selected node; the subtree of the selected node is removed from the proof tree. The selected node becomes a leaf and is decorated with . The proof activity can then be resumed from this node. After selecting a node in the proof tree pruning can be performed in two ways:
by right-clicking and then selecting "Prune",
by clicking on the button in the proof control view.
Note that after pruning, the post-tactic is not applied to the new current sequent. The post-tactic should be applied manually, if required, by clicking on the post-tactic button in the Proof Control view. This is useful, in particular, when you want to redo a proof from the beginning. The proof tree can be pruned at its root node and then the proof can proceed again, with invocation of internal or external provers; or with interactive proof.
Before pruning a particular node, the node (and its subtree) can be copied to the clipboard. If the new proof strategy subsequently fails, the copied version can be pasted back into the pruned node (see the next section).
Copy/Paste
By selecting a node in the proof tree and then right-clicking with the mouse, you can copy the part of the proof tree starting at that sequent (the node and its subtree). Pasting the node and subtree back in is done in a similar manner, with a right mouse click on a proof node. This allows reuse of part of a proof tree in the same, or even in another, proof.
Goal and Selected Hypotheses
The nodes in the proof tree view correspond to sequents. A user will work with one selected node, and thus one sequent, at a time; attempting various strategies in an effort to show that the sequent goal is true. The "Goal" and "Selected Hypotheses" views provide information to the user about the currently selected sequent. Here is an example:
A hypothesis can be removed from the list of selected hypotheses by selecting the check the box situated next to it (you can click on several boxes) and then by clicking on the button at the top of the selected hypotheses window:
Here is the result:
Note that the deselected hypotheses are not lost: you can find them again using the Search Hypotheses button in the Proof Control view. Other buttons are used as follows:
select all hypotheses.
invert the selection.
next to the goal - proof by contradiction 1: The negation of the goal becomes a selected hypothesis and the goal becomes "⊥".
next to a selected hypothesis - proof by contradiction 2: The negation of the hypothesis becomes the goal and the negated goal becomes a selected hypothesis.
Applying Proof Rules
A user wishing to attempt an interactive proof has a number of proof rules available, and these may be either rewrite rules or inference rules. In the Goal and the Selected Hypotheses views various operators may appear in red coloured font. The red font indicates that some interactive proof rule(s) are applicable and may be applied as a step in the proof attempt. When the mouse hovers over such an operator a number of applicable rules may be displayed; the user may choose to apply one of the rules by clicking on it.
Other proof rules can be applied when green buttons appear in the Goal and Selected Hypotheses views. Examples are proof by contradiction , that we have already encountered; and for conjunction introduction in the goal.
To instantiate a quantifier the user enters the desired expression in the box behind the quantifier and clicks on the quantifier:
Rewrite Rules
Rewrite rules are one-directional equalities (and equivalences) that can be used to simplify formulas (the goal or a single hypothesis). A rewrite rule is applied from left to right when its side condition holds; it can be applied either in the goal predicate, or in one of the selected hypotheses.
A rewrite rule is applied either automatically (A) or manually (M):
automatically, when post-tactics are run.
automatically, when auto-tactics are run.
manually, through an interactive command. These rules gather non equivalence laws, definition laws, distributivity laws and derived laws.
Automatic rewrite rules are equivalence simplification laws.
Each rule name indicates the rule's characteristics according to the following convention:
the law category: simplification law (SIMP), definition law (DEF), distributivity law (DISTRI), or else derived law (DERIV).
the root operator of the formula on the left-hand side of the rule, e.g. predicate AND, expression BUNION.
(optionally) the terminal elements on the left-hand side of the rule: special element (SPECIAL) such as the empty-set, type expression (TYPE), same element occurring more than once (MULTI), literal (LIT). A type expression is either a basic type (, any carrier set), or (type expression), or type expressiontype expression.
(optionally) some other description of a characteristic, e.g. left (L), right (R).
Rewrite rules having a symmetric operator on the left-hand side may also describe other rules. eg: the rule:
should also produce the rule:
For associative operators in connection with distributive laws as in:
it has been decided to highlight the first associative/commutative operator (the ). A menu is presented when hovering the mouse over the operator: the first menu option distributes all associative/commutative operators, the second option distributes only the first associative/commutative operator. In order to simplify the explanation we write associative/commutative operators with two parameters only. However, we must emphasise here, that generally we may have a sequence of more than two parameters. So, we write instead of . Rules are sorted according to their purpose.
Rules marked with a star in the first column are implemented in the current prover. Rules without a star are planned for implementation.
Inference rules (see Proof Rules) are applied either automatically (A) or manually (M).
Inference rules applied automatically are applied at the end of each proof step. They have the following possible effects:
they discharge the goal,
they simplify the goal and add a selected hypothesis,
they simplify the goal by decomposing it into several simpler goals,
they simplify a selected hypothesis,
they simplify a selected hypothesis by decomposing it into several simpler selected hypotheses.
Inference rules applied manually are used to perform an interactive proof. They can be invoked by clicking on the red highlighted operators in the goal or the hypotheses. A menu is presented when there are several options.
The Proof Control view contains the buttons which you can use to perform an interactive proof.
The Proof Control view offers a number of buttons whose effects we briefly describe next; moving from left to right on the toolbar:
(nPP) invokes the new predicate prover, a drop-down list indicates alternative strategies.
(R) indicates that a node has been reviewed: in an attempt by the user to carry out proofs in a stepwise fashion, they might decide to postpone the task of discharging some proofs until a later stage. To do this the proofs can be marked as reviewed by choosing the proof node and clicking on this button. This indicates that by visually checking the proof the user is convinced that they can discharge it later, but they do not want to do it right now.
(p0) the PP and ML provers can be invoked from the drop-down list using different forces.
(dc) do proof by cases: the proof is split into two branches. In the first branch:- the predicate supplied by the user is added to the Selected Hypotheses, and the user attempts to discharge this branch. In the second branch :- the predicate supplied by the user is negated and added to the Selected Hypotheses; the user then attempts to discharge this branch.
(ah) add a new lemma: the predicate in the editing area should be proved by the user. It is then added as a new selected hypothesis.
(ae) abstract expression: the expression in the editing area is given a fresh name.
the robot: invokes the auto-prover which attempts to discharge the goal. The auto-prover is applied automatically on all proof obligations after a "save" without any intervention of the user. Using this button, you can invoke the auto-prover within an interactive proof.
the post-tactic is executed ,
lasoo: load into the Selected Hypotheses window those hidden hypotheses that contain identifiers in common with the goal, and with the selected hypotheses.
backtrack form the current node (i.e., prune its parent),
scissors: prune the proof tree from the node selected in the proof tree,
Search Hypotheses: find hypotheses containing the character string in the editing area, and display in the Search Hypothesis view.
Cache Hypotheses: press this to display the "Cache Hypotheses" view. This view displays all hypotheses that are related to the current goal.
load the previous undischarged proof obligation,
load the next undischarged proof obligation,
(i) show information corresponding to the current proof obligation in the corresponding window. This information correspond to the elements that directly took part in the proof obligation generation (events, invariant, etc.),
goto the next pending node of the current proof tree,
load the next reviewed node of the current proof tree.
Disable/Enable Post-tactics: allows the user to choose whether post-tactics run after each interactive proof step.
The Smiley
The smiley can be one of three different colors: (1) red, indicates that the proof tree contains one or more undischarged sequents, (2) blue, indicates that all undischarged sequents of the proof tree have been reviewed, (3) green, indicates that all sequents of the proof tree are discharged.
The Editing Area
The editing area allows the user to supply parameters for proof commands. For example, when the user attempts to add a new hypothesis (by clicking on the lemma ah button), the new hypothesis should have been written by the user in the editing area.
ML/PP and Hypotheses
ML
ML (mono-lemma) prover appears in the drop-down list under the button (pp) as M0, M1, M2, M3, ML.
The different configuration (e.g., M0) refer to the proof force of the ML prover. All hypotheses are passed to ML.
PP
PP (predicate prover) appears in the drop-down list under the button (pp) as P0, P1, PP.
P0 uses all selected hypotheses (the ones in Selected Hypotheses window).
P1 employs a lasoo operation to the selected hypotheses and the goal, and uses the resulting hypotheses.
PP uses all hypotheses.
The Search Hypotheses View
By typing a string in the Proof Control window and pressing the Search Hypotheses button a window is provided which contains the hypotheses having a character string in common with the one entered by the user in the editing area. For example, if we search for hypotheses involving the character string "cr", then after pressing the Search Hypothesis button on the proof control window, we obtain the following:
This view also integrates a "quick search" area (A), that allows us to search quickly hypotheses involving short character strings such as "cr". A search hypothesis button (B) that behaves the same as the button of the proving window, a refresh button (C) that updates the window manually for more control, and a drop down menu (D) to set the preferences of the view up.
By pressing return key or the button (B) (once a short string has been given in the input area (A)), hypotheses can be searched quickly as if we used the Proof Control as described before.
The drop down menu (D) is accessible to set some preferences over the searched hypotheses :
If we change preferences for the search, we might need to "update" manually the view with the button (C).
By selecting "Consider hidden hypotheses in search" option, we can review all hypotheses that have been unselected in the selected hypotheses window(more info about selected/hidden hypotheses...).
To move any of these hypotheses to the Selected Hypotheses window, select those required (using the check boxes) and press the button. Adding these hypotheses to the selected hypotheses means that they will be visible to the prover. They can then be used during the next interactive proof phase.
To remove hypotheses from the Search Hypotheses window use the button. This button also appears above the selected hypotheses, and allows the user to remove any hypothesis from the Selected Hypotheses window.
The other button, situated to the left each hypotheses, is the button. clicking on this will attempt a proof by contradiction. The effect is the same as if the hypothesis were in the Selected Hypotheses.
The Cache Hypotheses Window
This window allows the user to keep track of recently manipulated (e.g., used, removed, selected) hypotheses for any PO. For example, when the user applies a rewrite to an hypothesis, a new hypothesis (after the rewriting) is selected, and the original hypothesis is deselected and put in the Cache Hypotheses window.
Similar operations (to that of the Selected Hypotheses and Search Hypotheses windows) such as removing, selecting and proof by contradiction (ct) are also available for the cached hypotheses. Interactive proof steps (e.g., rewriting) can also be carried out from the Cache Hypotheses window as well as the Search Hypotheses window.
Proof Information View
This view displays information so that the user can relate a proof obligation to the model. For example, typical information for an event invariant preservation PO includes the event; as well as the invariant in question. In the following example, the hyperlinks 'CreateToken' and 'inv2' can be used to navigate to the containing machine.
Rule Details View
This view displays the information relative to a given proof tree node, on which a rule was applied.
A command is available when right-clicking on a proof tree node, in order to reveal the Rule Details View (See picture below).
By default, this view is a fast view. A button (identified by the view's icon) is then available at the bottom left of the workbench, to show up this view.
Here is an overview of the Rule details view :
A quick view on the applied rule contents is provided. On the picture above, we display the contents of the rule named "∀ hyp mp" where an input has been used to instantiate an hypothesis. One can see quickly which was the input used by the instanciation (following instantiated with), and which was the hypothesis considered by this rule (this is given by the hypothesis of Input Sequent).
Furthermore, it is possible to view the antecedents created by this rule in details (i.e. child proof tree nodes) and the actions performed on hypotheses : selection, deselection, etc.
Auto-tactic and Post-tactic
The auto-tactic applies a combination (i.e. ordered list) of rewrite, inference tactics and external provers automatically to newly generated proof obligations. However, they can also be invoked by the user by clicking on the button in the Proof Control view. Note that the automatic application of the auto-prover can be quickly toggled with the Prove automatically menu item available from the Project menu. See the picture below.
The post-tactic is also a combination of rewrite, inference tactics and external provers, and is applied automatically after each interactive proof step. However, it can also be invoked manually by clicking on the button in the Proof Control view.
Note that the post-tactic can be disabled quickly by clicking on the little arrow (marked with an A on the figure below) of the Proof Control view (right upper corner) and then on "Disable post-tactic" (B):
Principles
The ordered list of rewrite, inference tactics and external provers that should be applied is called a profile. There are two default profiles, one for the auto-tactic and one for the post-tactic. These default profiles are immutable in time, but can be duplicated for further modification by the user. Indeed, the user can edit a profile and select it to run as automatic or post tactic. The idea is to have a set of available tactic profiles to be used as needed.
Moreover, these edited profiles are shipped with projects if defined at this scope, or can be imported or exported if defined at a workspace level, which is very useful to share them.
There are two ways to run the automatic or post tactics:
the manual way consists into clicking on the button, or the button in the Proof Control view, to respectively launch the auto-tactic (with the selected auto-tactic profile) and the post-tactic (with the selected post-tactic profile).
the automatical way if such preference is activated. (Auto-tactic after each proof step, and post-tactic at each step and rebuild) The mandatory condition for post-tactics or auto-tactics to automatically run is that they should be activated from their preference or property.
The user can separately define tactic profiles and assign them to post and auto tactics. Therefore, there are two tabs in the "Auto/Post Tactic" preference page to address these choices. These tabs will be descibed in the two next sections.
Preferences for the selected auto and post tactic profile
This section describes the "Auto/Post Tactic" tab of the "Auto/Post Tactic" preference page.
There are two scopes to set up preferences for the auto and post tactics : at workspace level, and at project level.
Note that if the automatic application of tactics (auto or post) is decided only at workspace level, and this choice is held at project level.
To access these preferences, one as to go open the "Auto/Post Tactic" preference page that can be found after "Window > Preference > Sequent Prover".
The figure below shows the "Auto/Post Tactic" preference page:
The buttons 1 and 2 are activating/deactivating the automatic use of respectively auto and post tactics.
One can also see on this picture the selected profile to be use as auto and post tactic. Note that there is always a profile selected, and this profile can be changed whether the tactic are automatically launched or not, as there is alway a way to manually launch auto and post tactics.
On the preference appearing above, the Default Auto Tactic Profile is used to compose the automatic tactic, and the Default Post Tactic Profile is used to compose the post-tactic.
The figure below shows the "Auto/Post Tactic" Preference page with both auto-tactic and post-tactic to automatically run, and where the user selects the profile "MyFirstTacticProfile" to be used as auto-tactic profile.
Preferences for available profiles
This section describes the "Profile" tab of the "Auto/Post Tactic" preference page.
The figure above shows the contents of the profile tab.
There are two visible lists : a list of profiles on the left the tactics or provers that compose these profiles (Profile Details). Here one can see the contents of the Defaut Auto Tactic Profile.
There are 4 buttons available to the user :
New : to create a new profile "from scratch",
Edit : to edit an existing (editable) profile,
Remove : to remove a profile definitively,
Duplicate : to duplicate a selected profile for further slight modification,
Default profiles can not be edited nor removed. That is why they are greyed on the image above.
On the picture below appears the dialog available to edit or create a profile. Here we create a profile named 'MyFirstTacticProfile'.
The list of the right represents the available and unselected tactics. The list of the left is the profile contents, and represents the selected tactics to be applied from the top to down.
The user can select some available tactic from the list of the right using the ">>" button or unselect some tactics from the list of the left using the "<<" button.
The user can re-order contiguous selection of selected tactics using the "Up" and "Down" button.
By clicking on "Finish" the profile will be saved and available for use in the auto and post tactics.
Project specific settings
The user can select profiles locally to project.
To do so, one has to select the "Auto/Post Tactic" property page available from right-click > Properties on a project, or by clicking the Configure project specific settings link on the "Auto/Post Tactic" preference page. This property page appears on the picture below, opened on the Auto/Post tactic tab.
Note that the enablement of automatic use of post and auto tactics is decided at a workspace level.
The picture below shows the Profiles tab of the Auto/Post Tactic page for a project specific setting:
At the project level, there is a contextual menu available on right click from the list of defined profiles.
This contextual menu offers two options to the user :
Import Workspace Profiles to retrieve all the defined profiles in the workspace,
Export to Workspace Profiles to push a selected profile up in the list of workspace profiles.