Verification of predicate validity using the comprehensive list of its free variable values
mc
mc(l)
with:
this command allows to perform demonstration by cases of the current goal: it divides the proof according to every value of the resolution variables of list L (the variable domains should be bounded, they are, if it is possible, inferred from the hypotheses).
If the initial goal is H ⇒ G, then it is transformed by mc(x1,x2,...,xn) into:
x1 = a1 & x2 = b1 & ... & xn = v1 => ([x1, x2, ..., xn := a1, b1, ..., v1]H => [x1, x2, ..., xn := a1, b1, ..., v1]G) & ... & x1 = ai & x2 = bj & ... & xn = vk => ([x1, x2, ..., xn := ai, bj, ..., vk]H => [x1, x2, ..., xn := ai, bj, ..., vk]G) & ... & x1 = ap & x2 = bq & ... & xn = vr => ([x1, x2, ..., xn := ap, bq, ..., vr]H => [x1, x2, ..., xn := ap, bq, ..., vr]G)
|
With (ai,bj,...,vk) taking all possible values of the cartesian product of the domains of variation of the variables x1, x2, ..., xn which are respectively {a1, ..., ap}, {b1, ..., bq}, ..., {v1, ..., vr}.
Domains of variables have been inferred from the available hypotheses involving the resolution variables and have been represented by sets in extension. It should be noted that the domain inferer does not perform constraint resolution between variables and it is limited by the variables domain size: for instance, ModelChecking will fail if it is applied to a variable of the INT type whose domain cannot be further constrained by any other available hypothesis.
Hypotheses used by the domain inferer are typically predicates of membership to predefined enumerated sets like BOOL or to enumerated sets defined in the SET clause, predicates of membership to interval or set of integers given in extension, equalities or inequalities between variables and values, etc.
Two options are availables:
Let us consider the proof obligation: bool(xx = 1) = yy, with xx: {0,2} and yy = FALSE among the hypotheses.
The command mc(_Step|xx,yy) makes the goal transform into:
Hypothesis ... xx: {0,2} yy = FALSE Goal xx = 2 & yy = FALSE => bool(2=1) = FALSE
|
The user proves it using pr and the prover generates the second case:
Hypothesis ... xx: {0,2} yy = FALSE Goal xx = 0 & yy = FALSE => bool(0=1) = FALSE
|
The command mc(_Auto) proves the two cases in a totally automatic way:
Starting Model Checking in Automatic mode Case xx=2 & yy=FALSE proved Case xx=0 & yy=FALSE proved Proved by Model Checking
|
Finally, the command mc(xx|_Step|Tac(None)|3) would have generated the following goal in the first place:
Hypothesis ... xx: {0,2} yy = FALSE Goal xx = 2 => bool(2=1) = yy
|
then, after using the command pr:
Hypothesis ... xx: {0,2} yy = FALSE Goal xx = 0 => bool(0=1) = yy
|
To finish with, the user may wish to apply the command ModelChecking on a variable whose domain is too large. Consider the following goal:
Hypothesis ... xx: -15..25 Goal toto(xx) = MTP
|
Using mc(_Step | 22 | xx), where we specified 22 as the maximum variable values, produces the display of the following message:
Failure in Model Checking
|
The domain of the variable contains more than 22 elements indeed.