Membership in Goal

Objective

This page describes the design of the reasoner MembershipGoal and its associated tactic MembershipGoalTac.

This reasoner discharges sequents whose goal denotes a membership which can be inferred from hypotheses, such as the following:

$H,\quad x\in S,\quad S\subset T,\quad T\subseteq U \quad\vdash\quad x\in U$

Analysis

Usually, such sequents are proved by the external provers PP or ML. But, these provers have several drawbacks :

• They do not report needed hypotheses, so that a conservative choice is made to depend on all hypotheses.
• They take substantial time to prove them (even with the basic example given above, the difference in time execution is noticeable).
• If there are too many hypotheses, or if the expression of the $x$ or the intermediate sets $S, T, \dots$ is too complicated, they may get lost into details and not discharge.

This is particularly true when in the set expressions of each side of relations are not equal, such as in:

$H,\quad a\in S,\quad S\subset T_1\cap T_2,\quad T_1\cup T_3\subseteq  U\quad\vdash a\in U$

Such a reasoner thus increases the rate of automated proof, faster and with fewer needed hypotheses which makes proof rules more legible and proof replay less sensitive to modifications of the models.

Design Decision

Tactic

This part explains how the tactic (MembershipGoalTac) associated to the reasoner MembershipGoal is working.

Goal

The tactic (as the reasoner) works only on goals of the form :

• $\cdots~\in~\cdots$

For example:

• $f(x)\in g\otimes h$
• $x\in A\cprod\left(B\cup C\right)$
• $x\mapsto y\in A\cprod B$

In the last example, the reasoner will not try to prove that $x$ belongs to $A$ and $y$ belongs to $B$, but that the maplet $x\mapsto y$ belongs to the Cartesian product $A\cprod B$.

Hypotheses

Now we have to find hypotheses leading to discharge the sequent. To do so, the tactic recovers two kinds of hypotheses :

1. the ones related to the left member of the goal $\left( x\in S\right)$ (this is the start point):
   • $x\in \cdots$
   • $\cdots\mapsto x\mapsto\cdots\in\cdots$
   • $\left\{\cdots, x,\cdots\right\}=/\subset/\subseteq\cdots$
   • $\left\{\cdots, \cdots\mapsto x\mapsto\cdots,\cdots\right\}=/\subset/\subseteq\cdots$
   • $f\ovl\left\{\cdots, x, \cdots\right\}=/\subset/\subseteq\cdots$
2. the ones denoting inclusion (all but the ones matching the description of the first point) :
   • $\cdots\subset\cdots$
   • $\cdots\subseteq\cdots$
   • $\cdots=\cdots$

Then, it will search a link between those hypotheses so that the sequent can be discharged.

Find a path

Now that we recovered all the hypotheses that could be useful for the reasoner, it remains to find a path among the hypotheses leading to discharge the sequent. Depending on the relations on each side of the inclusion, we will act differently. $f$ always represent an expression (may be a domain, a range, etc.).

1. The following sequent is provable because $f\subseteq \varphi (f)$.
   • $x\in f,\quad \varphi (f)\subseteq g\quad\vdash\quad x\in g$
   • $\varphi (f) = f\quad\mid\quad f\cup h \quad\mid\quad h\cup f \quad\mid\quad h\ovl f$
   • $f=g\bunion h\quad\mid\quad \varphi(f)=g\bunion k\bunion h\bunion l$
   • $f=i\ovl j\quad\mid\quad\varphi(f)=g\ovl h\ovl i\ovl j$
2. The following sequent is provable because $\psi (f)\subseteq f$.
   • $x\in \psi (f),\quad f\subseteq g\quad\vdash\quad x\in g$
   • $\psi (f) = f\quad\mid\quad f\cap h \quad\mid\quad h\cap f \quad\mid\quad f\setminus h \quad\mid\quad f\ransub A \quad\mid\quad f\ranres A \quad\mid\quad A\domsub f \quad\mid\quad A\domres f$
   • $\psi(f)=g\binter h\binter k\binter l\quad\mid\quad f=g\binter k$
3. By keeping the notation $\psi(f)\subseteq f\subseteq\varphi(f)$ we also deduce that :
   • $\psi(A)\domres\psi(f)\subseteq\varphi(A)\domres\varphi(f)$
   • $\psi(f)\ranres\psi(A)\subseteq\varphi(f)\ranres\varphi(A)$
   • $\varphi(A)\domsub\psi(f)\subseteq\psi(A)\domres\varphi(f)$
   • $\psi(f)\ransub\varphi(A)\subseteq\varphi(f)\ransub\psi(A)$
   • $\psi(f)\setminus\varphi(g)\subseteq\varphi(f)\setminus\psi(g)$
4. For some relations, positions are needed to be known to continue to find hypotheses, but it is not always necessary.
   • $x\mapsto y\in f,\quad f\subseteq A\cprod B\quad\vdash\quad x\in A$
   • $x\in dom(f),\quad f\subseteq A\cprod B\quad\vdash\quad x\in A$
   • $x\in ran(f),\quad f\subseteq A\cprod B\quad\vdash\quad x\in B$

By using these inclusions the tactic tries to find a path among the recovered hypotheses. Every one of them should only be used once, avoiding possible infinite loop $\left(A\subseteq B,\; B\subseteq A\right)$.

Since Rodin 3.0, the path search is delegated to the Sat4j solver. The problem encoding to SAT is done by representing each inclusion of the form $A\subseteq B$ into the clause $\{\lnot x\in A,\; x\in B\}$ and feeding the solver with all clauses that derive from the hypotheses and the negation of the goal. As soon as the solver reports the problem as unsatisfiable, the tactic obtains an unsat core and traces it back to the corresponding hypotheses.

Reasoner

This part describe how the reasoner MembershipGoal works.

Goal

First, it checks that the goal matches the description made in the part tactic : $x\in S$. Thus, we record the member x as well as the set S

Input

Then, it checks that the input is a hypothesesReasonerInput (an input with an array of predicates). Every given predicates must be a hypothesis of the sequent. Only one must be a membership with the same member as the goal so that there are no ambiguity. All the other ones must denote set inclusion or equality.

Find a path

With the same reasoning as for the tactic, we try to find a path leading to discharge the goal.

Trusted Base

At that point, the reasoner performs the same jobs as the tactic which is quite complicated. That poses one problem : it is hard to prove the reasoner to be sound (only doing what it was meant to, not discharging sequents that cannot be proved). Because the reasoner is in the trusted base, we should be absolutely sure of what it performs. How to validate the found path ?

As we know, the reasoner condense several inferences rules in only one proof rule. To validate the found path, we have to validate every single inference rule. To achieve it, we create, internally to the reasoner, a small proof tree built from internal proof rules (implemented in class Rules). Each rule contains one predicate and an array of rules (its antecedents). When the path is searched, the corresponding rule is created. When the path is found, we check that the predicate of the root rule is the same as the goal. If not, it means the found path was incorrect, so the reasoner fails, else the sequent is discharged.

Example of rules :

$name\;of\;the\;rule\quad\frac{predicate\;of\;first\;antecedent\cdots predicate\;of\;last\;antecedent}{consequent\;of\;that\;rule}\left[parameters\right]$

$Hypothesis\quad\frac{}{predicate}\left[predicate\right]$

$IncludeBunion\quad\frac{A\bunion B\bunion C\bunion D\subseteq Z}{B\bunion C\subseteq Z}\left[B,~C\right]$

$Composition\quad\frac{x\in A,~A\subseteq B}{x\in B}\left[~\right]$

Implementation

This section explain how the reasoner has been implemented.

Find a path

Let's consider the following sequent : $x \in B,\quad f \ovl \{ x \mapsto y \} \in A \rel B,\quad dom(A \cprod B) \subseteq C,\quad A \binter B\binter C \subseteq D \quad\vdash\quad x\in D$

From the hypothesis "$f \ovl \{ x \mapsto y \} \in A \rel B$" the reasoner deduct the following predicates: $\{ x \in A , \quad x \in dom(A \cprod B) \}$

The reasoner encodes the new hypotheses derived from the hypotheses and the negation of the goal, to SAT clauses. For this purpose, it encodes all new hypotheses in SAT proposition by extracting all set contained into the predicate. And then, its encodes the proposition SAT in Dimacs CNF format. The clauses encoded are inserted one by one into the SAT problem until the solver reports the problem as unsatisfiable in order to obtain a minimal solution to the SAT core.

SAT problem encoding

Sequent	SAT proposition	Dimacs CNF format
$x \in B$	$x \in B$	$2$
$x \in A$	$x \in A$	$3$
$x \in dom(A \cprod B)$	$x \in dom(A \cprod B)$	$4$
$dom(A \cprod B) \subseteq C$	$\lnot x \in dom(A \cprod B),\quad x \in C$	$-4 \quad 5$
$A \binter B \binter C \subseteq D$	$\lnot x \in A, \quad \lnot x \in B, \quad \lnot x \in C, \quad x \in D$	$-3 \quad -2 \quad -5 \quad 1$
$\vdash\quad x \in D$	$\lnot x \in D$	$-1$

Afterwards, the clauses in the sat core sorted by their insertion order, are then reordered by using topological sorting. The reasonner traces each clause back to the corresponding hypotheses.

For each hypothesis into the list, a rationale is built and saved into an array at the index of the list. If the hypothesis denotes a membership, the rationale is directly saved into the array. Else it retrevies the array all rationales wich allow to prove that the member is in each set contained into the intersection and then from these rationales it builds a new Rationale and saves it into the array. However, the path building is unidirectionnal, it works with a sat core wich contains only clause contains with at most one positive literals.

Indeed, the current version finds a path with hypotheses in the following form :

• $x \in ... \binter / \bunion ...$
• $... \subseteq ... \binter / \bunion ...$

Finally, the reasoner checks that the generated rule is equal to the goal. If so, the sequent is discharged. Else, a failure is returned

We see that the tactic may not find the most simple path to discharge the sequent. Moreover, there are some cases where the tactic is able to find a path but the reasoner is unable to prove it due to a weakness in the rules (see all the untreated cases). Example :

$x\in dom(f\bunion g)\binter A,~A\subseteq B,~dom(f)\bunion dom(g)\subseteq B~\vdash~x\in B$

Depending on whether the tactic returns $\left\{x\in dom(f\bunion g)\binter A,~dom(f)\bunion dom(g)\subseteq B\right\}$ or $\left\{x\in dom(f\bunion g)\binter A,~A\subseteq B\right\}$, the reasoner will fail or succeed. To prevent such hazardous behavior, re-writing should be proceeded.

Unimplemented cases

Some cases are not yet implemented. Further enhancements may be provided for some.

• $x\in f,\quad f\in A\;op\;B\quad\vdash\quad x\in A\cprod B$
• $x\in f\otimes g,\quad f\subseteq A\cprod B,\quad g\subseteq C\cprod D\quad\vdash\quad x\in (A\cprod C)\cprod(B\cprod D)$ as well as all the possibles re-writing.
• $x\in f\otimes g,\quad f\subseteq h\quad\vdash\quad x\in h\otimes g$
• $x\in \left\{a,~b,~c\right\},\quad\left\{a,~b,~c,~d,~e,~f\right\}\subseteq D\quad\vdash\quad x\in D$
• $x\in A\cprod B,\quad A\subseteq C\quad\vdash\quad x\in C\cprod B$
• $x\in dom(f)\cap A\quad\vdash\quad x\in dom(A\domres f)$
• $x\in ran(f)\cap A\quad\vdash\quad x\in ran(f\ranres A)$
• $x\in dom(A\domres f)\quad\vdash\quad x\in dom(f)\cap A$
• $x\in ran(f\ranres A)\quad\vdash\quad x\in ran(f)\cap A$
• $x\in dom(f\bunion g)\quad\vdash\quad x\in dom(f)\bunion dom(g)$
• $x\in dom(f)\bunion dom(g)\quad\vdash\quad x\in dom(f\bunion g)$
• $x\in dom(f\binter g)\quad\vdash\quad x\in dom(f)\binter dom(g)$
• $x\in dom(f)\binter dom(g)\quad\vdash\quad x\in dom(f\binter g)$
• $x\in ran(f\bunion g)\quad\vdash\quad x\in ran(f)\bunion ran(g)$
• $x\in ran(f)\bunion ran(g)\quad\vdash\quad x\in ran(f\bunion g)$
• $x\in ran(f\binter g)\quad\vdash\quad x\in ran(f)\binter ran(g)$
• $x\in ran(f)\binter ran(g)\quad\vdash\quad x\in ran(f\binter g)$
• $x\in (f\bunion g)^{-1}\quad\vdash\quad x\in f^{-1}\bunion g^{-1}$
• $x\in f^{-1}\bunion g^{-1}\quad\vdash\quad x\in (f\bunion g)^{-1}$
• $x\in (f\binter g)^{-1}\quad\vdash\quad x\in f^{-1}\binter g^{-1}$
• $x\in f^{-1}\binter g^{-1}\quad\vdash\quad x\in (f\binter g)^{-1}$

  the last 12 examples fails because the Rules have some weakness. This show that some re-writing should be performed.

• $x\in A\bunion dom(f\binter g),A\bunion dom(f)\subseteq B\quad\vdash\quad x\in B$
• $x\in A\binter dom(f),A\binter dom(f\bunion g)\subseteq B\quad\vdash\quad x\in B$

  the reason for the failure of the two last examples is that when union or intersection are compared, we should take all the expression containing each member, but we don't.

• $x\in A\cprod dom(B\cprod C)\quad\vdash\quad x\in A\cprod B$

  it fails because when we get equivalent expression of the Cartesian product, we don't go further enough.

  $\bigl($ where $op_1$ and $op_2$ are ones of :$\quad\rel, \trel, \srel, \strel, \pfun, \tfun, \pinj, \tinj, \psur, \tsur, \tbij\bigr)$