4.37 Predicate prover

Calling the predicate prover

Syntax

  pp
  pp(t)
  pp(rp.n)
  pp(rt.n)
  pp(rp.n|t)
  pp(rp(f))

with:

Alias

  p0 is equivalent to pp(rp.0)
  p0(t) is equivalent to pp(rp.1|t)
  p1 is equivalent to pp(rp.1)
  p1(t) is equivalent to pp(rp.1|t)

  t0 is equivalent to pp(rt.0)
  t0(t) is equivalent to pp(rt.1|t)
  t1 is equivalent to pp(rt.1)
  t1(t) is equivalent to pp(rt.1|t)

Use

This command allows the predicate prover to be used on the current goal.

This has three modes of functioning:

  1. The first mode calls the predicate prover to the goal and to all the current hypotheses. This mode is not suitable for a large number of hypotheses.
  2. The second mode calls the predicate prover to the goal and the hypotheses of reduced proof obligation. The hypotheses selected are the same as for the rp(see chapter 4.42 page §) function.
  3. Third mode applies the predicate prover to the goal and to the hypotheses that meet the criteria given by parameter f. For instance, ml(rp(sees+loc+inv)) enables to proceed the goal proof under the assertions and invariants of seen and used machines, the local hypotheses and the component invariant.

In the three modes, the predicate prover is launched with a time-out. If the user does not define it, the time-out is of 60 seconds.

When the proof is replayed automatically, the calls to the predicate prover are made with a time-out specified by the Time_Out resource given in the resource file of Atelier B (300 seconds by default). This margin allows a successful recall of the predicate prover, on a less powerful machine.

Example

The predicate prover can be used on the complete proof obligation:


 
PRI> pp  
Starting Prover Predicate Call  
Proved by the Predicate Prover  
 


or on the reduced proof obligation. This option is used when the proof obligation has many hypotheses:


 
PRI> pp(rp.1 | 5)  
Starting Prover Predicate Call  
Proved by the Predicate Prover  
 


The proof can be tried with more selected hypotheses, but success is no longer guaranteed.


 
PRI> pp(rp.5 | 10)  
Starting Prover Predicate Call  
The Predicate Prover don’t prove the current goal  
 


The predicate prover can be used to prove a specific proof obligation, or to prove a sub-goal. It can thus be part of a proof strategy, being used in the command body te (see chapter 4.54 page §).

Here it is used on reduced proof obligations (1 iteration) with a time-out of 10 seconds.


 
PRI> te(pp(rp.1 | 10), Replace.Gen.All)  
Begin TryEveryWhere  
 


The work done by the predicate prover is then displayed:


 
+--+  
Summary  
Initialisation.1 transformed   Unproved --> Proved,   pp(rp.1)  
Initialisation.4 transformed   Unproved --> Proved,   pp(rp.1)  
End TryEveryWhere  
 


Two proof obligations (Initialisation.1 and Initialisation.4) have been discharged.