4.1 Abstract Expression

Abstracting an expression

Syntax

  ae(EX,ID)
with:

Use

This command enables to generate the goal Δe(EX) (EX = ID => [EX := ID]G) where Δe(EX) represents the well-definedness lemma of the expression EX (see chapter 2.3 page §) and [EX := ID]G the current goal in which every occurrence of expression EX (appearing in the goal) has been replaced by identifier ID.

It is required to check the well-definedness of expression EX as it might be ill-defined, once taken out of context (i.e., out of the current goal). Let’s assume that under the hypothesis xx + 1 <= 1 we have the goal xx + 1 <= 1 max(1..xx) = xx. This goal is well-defined because xx + 1 <= 1 is well-defined and not(xx + 1 <= 1)   Δp(max(1..xx) = xx) i.e., not(xx + 1 <= 1) => Δe(max(1..xx)), from the well-definedness of and max this yields not(xx + 1 <= 1) => 1..x NAT FIN(NAT) not(1..xx) = . If we perform ae(max(1..xx),MAX) without caring about well-definedness, we get the goal max(1..xx) = MAX => xx + 1 <= 1 MAX = xx. Then a deduction (by dd) raises in hypotheses the formula max(1..xx) = MAX which is now meaningless as we have the hypothesis xx + 1 <= 1 (and thus 1..xx = ).

Let us finally remark that the prover attempts an automatic proof of the lemma of well-definedness of the expression EX, and if the proof fails, the lemma of well-definedness will have to be interactively demonstrated.

Example 1

Consider the following goal to be demonstrated:


 
        1+wr<=p2 => p2+1<=p1 or p1<=wr &  
        1+p2<=wr => p2+1<=p1 & p1<=wr  
        =>  
        p2+1<=p1 or p1<=p3  
 


The user wants to replace the expression p2 + 1 with pp2:


 
        PRI> ae(p2+1,pp2)  
 


The following goal is obtained (the well-definedness lemma of p2 + 1, reduced to btrue, is automatically discharged by the prover):


 
        p2+1=pp2  
        =>  
                (1+wr<=p2 => pp2<=p1 or p1<=wr &  
                1+p2<=wr => pp2<=p1 & p1<=wr  
                =>  
                pp2<=p1 or p1<=p3)  
 


We can then raise in hypothesis the equality pp2 = p2 + 1 (using the deduction dd command) and this is checked with the Search Hypothesis command:


 
        PRI> sh(p2)  
 
        Searching all Hypothesis that  
          contain p2  
          match with a  
        Starting search...  
        Found hypothesis List is  
            pp2=p2+1 &  
            3<=p2 &  
            p2<=2147483647 &  
            0<=p2 &  
            p2: INTEGER  
        End of found hypothesis  
 


Example 2

Given the following goal to be demonstrated:


 
    Hypothesis  
      ...  
      0<=aa &  
      aa <= bb &  
      ...  
    Goal  
      max(aa..bb) = {bb}  
 


The user wants to replace expression max(aa..bb) by MAXI:


 
    ae(max(aa..bb),MAXI)  
 


The well-definedness lemma associated to expression max(aa..bb) is not(aa..bb = ) aa..bb NATURAL : FIN(NATURAL). The automatic prover fails to demonstrate it, it then generates the first following sub-goal:


 
    not(aa..bb = {})  
 


Once this goal has been demonstrated (for example by ah(aa<=bb) & pp(rp.0)), the prover generates the following sub-goal:


 
    aa..bb /\ NATURAL: FIN(NATURAL)  
 


The pr command is sufficient to demonstrate this goal. Then, the well-definedness of expression max(aa..bb) is proved. The prover can perform the substitution of max(aa..bb) by MAXI in the starting goal and generate the new goal:


 
   max(aa..bb) = MAXI => MAXI = {bb}