final case class Provable extends Product with Serializable
Provable(conclusion, subgoals) is the proof certificate representing certified provability of
conclusion
from the premises in subgoals
.
If subgoals
is an empty list, then conclusion
is provable.
Otherwise conclusion
is provable from the set of all assumptions in subgoals
.
G1  D1 ... Gn  Dn (subgoals)  G  D (conclusion)
Invariant: All Provables ever produced are locally sound, because only the prover kernel can create Provable objects and chooses not to use the globally sound uniform substitution rule.
Provables are stateless and do not themselves remember other provables that they resulted from. The ProofTree data structure outside the kernel provides such proof tree navigation information.
Proofs can be constructed in (backward/tableaux) sequent order using Provables:
import scala.collection.immutable._ val verum = new Sequent(IndexedSeq(), IndexedSeq(True)) // conjecture val provable = Provable.startProof(verum) // construct a proof val proof = provable(CloseTrue(SuccPos(0)), 0) // check if proof successful if (proof.isProved) println("Successfully proved " + proof.proved)
, Multiple Provable objects for subderivations obtained from different sources can also be merged
// ... continuing other example val more = new Sequent(IndexedSeq(), IndexedSeq(Imply(Greater(Variable("x"), Number(5)), True))) // another conjecture val moreProvable = Provable.startProof(more) // construct another (partial) proof val moreProof = moreProvable(ImplyRight(SuccPos(0)), 0)(HideLeft(AntePos(0)), 0) // merge proofs by gluing their Provables together val mergedProof = moreProof(proof, 0) // check if proof successful if (mergedProof.isProved) println("Successfully proved " + mergedProof.proved)
, Proofs in backward tableaux sequent order are straightforward
import scala.collection.immutable._ val fm = Greater(Variable("x"), Number(5)) //  x>5 > x>5 & true val finGoal = new Sequent(IndexedSeq(), IndexedSeq(Imply(fm, And(fm, True)))) // conjecture val finProvable = Provable.startProof(finGoal) // construct a proof val proof = finProvable( ImplyRight(SuccPos(0)), 0)( AndRight(SuccPos(0)), 0)( HideLeft(AntePos(0)), 1)( CloseTrue(SuccPos(0)), 1)( Close(AntePos(0), SuccPos(0)), 0) // proof of finGoal println(proof.proved)
, Proofs in forward Hilbert order are straightforward with merging of branches
import scala.collection.immutable._ val fm = Greater(Variable("x"), Number(5)) // proof of x>5  x>5 & true merges left and right branch by AndRight val proof = Provable.startProof(Sequent(IndexedSeq(fm), IndexedSeq(And(fm, True))))( AndRight(SuccPos(0)), 0) ( // left branch: x>5  x>5 Provable.startProof(Sequent(IndexedSeq(fm), IndexedSeq(fm)))( Close(AntePos(0), SuccPos(0)), 0), 0) ( //right branch:  true Provable.startProof(Sequent(IndexedSeq(), IndexedSeq(True)))( CloseTrue(SuccPos(0)), 0)( // x>5  true Sequent(IndexedSeq(fm), IndexedSeq(True)), HideLeft(AntePos(0))), 0) ( //  x>5 > x>5 & true new Sequent(IndexedSeq(), IndexedSeq(Imply(fm, And(fm, True)))), ImplyRight(SuccPos(0)) ) // proof of finGoal:  x>5 > x>5 & true println(proof.proved)
, Proofs in Hilbertcalculus style order can also be based exclusively on subsequent merging
import scala.collection.immutable._ val fm = Greater(Variable("x"), Number(5)) // x>0  x>0 val left = Provable.startProof(Sequent(IndexedSeq(fm), IndexedSeq(fm)))( Close(AntePos(0), SuccPos(0)), 0) //  true val right = Provable.startProof(Sequent(IndexedSeq(), IndexedSeq(True)))( CloseTrue(SuccPos(0)), 0) val right2 = Provable.startProof(Sequent(IndexedSeq(fm), IndexedSeq(True)))( HideLeft(AntePos(0)), 0) (right, 0) // gluing order for subgoals is irrelevant. Could use: (right2, 1)(left, 0)) val merged = Provable.startProof(Sequent(IndexedSeq(fm), IndexedSeq(And(fm, True))))( AndRight(SuccPos(0)), 0) ( left, 0)( right2, 0) //  x>5 > x>5 & true val finGoal = new Sequent(IndexedSeq(), IndexedSeq(Imply(fm, And(fm, True)))) val proof = Provable.startProof(finGoal)( ImplyRight(SuccPos(0)), 0) (merged, 0) // proof of finGoal println(proof.proved)
, Branching proofs in backward tableaux sequent order are straightforward, yet might become more readable when closing branches righttoleft to keep explicit subgoals:
// explicit proof certificate construction of  !!p() <> p() val proof = (Provable.startProof( "!!p() <> p()".asFormula) (EquivRight(SuccPos(0)), 0) // right branch (NotRight(SuccPos(0)), 1) (NotLeft(AntePos(1)), 1) (Close(AntePos(0),SuccPos(0)), 1) // left branch (NotLeft(AntePos(0)), 0) (NotRight(SuccPos(1)), 0) (Close(AntePos(0),SuccPos(0)), 0) )
 Note
soundnesscritical logical framework.
,Only private constructor calls for soundness
,For soundness: No reflection should bypass constructor call privacy, nor reflection to bypass immutable val algebraic data types.
 See also
Andre Platzer. A complete uniform substitution calculus for differential dynamic logic. Journal of Automated Reasoning, 59(2), pp. 219266, 2017.
 Alphabetic
 By Inheritance
 Provable
 Serializable
 Serializable
 Product
 Equals
 AnyRef
 Any
 Hide All
 Show All
 Public
 All
Type Members

type
Subgoal = Int
Position types for the subgoals of a Provable.
Value Members

final
def
!=(arg0: Any): Boolean
 Definition Classes
 AnyRef → Any

final
def
##(): Int
 Definition Classes
 AnyRef → Any

final
def
==(arg0: Any): Boolean
 Definition Classes
 AnyRef → Any

def
apply(prolongation: Provable): Provable
Substitute Subderivation Forward: Prolong this Provable with the given prolongation.
Substitute Subderivation Forward: Prolong this Provable with the given prolongation. This Provable with conclusion
G  D
transforms as followsG1  D1 ... Gn  Dn G1  D1 ... Gn  Dn  =>  G  D G0  D0
provided
G  D  prolongation G0  D0
 prolongation
the subderivation used to prolong this Provable. Where subderivation has a subgoal equaling our conclusion.
 returns
A Provable derivation that proves prolongation's conclusion from our subgoals.
 Note
not soundnesscritical derived function since implemented in terms of other apply functions

def
apply(newConsequence: Sequent, rule: Rule): Provable
Apply Rule Forward: Apply given proof rule forward in Hilbert style to prolong this Provable to a Provable for concludes.
Apply Rule Forward: Apply given proof rule forward in Hilbert style to prolong this Provable to a Provable for concludes. This Provable with conclusion
G  D
transforms as followsG1  D1 ... Gn  Dn G1  D1 ... Gn  Dn  =>  G  D newConsequence
provided
G  D  rule newConsequence
 newConsequence
the new conclusion that the rule shows to follow from this.conclusion
 rule
the proof rule to apply to concludes to reduce it to this.conclusion.
 returns
A Provable derivation that proves concludes from the same subgoals by using the given proof rule. Will return a Provable with the same subgoals but an updated conclusion.
 Exceptions thrown
CoreException
subtypes if rule raises those exceptions when applied tonewConsequent
. Note
not soundnesscritical derived function since implemented in terms of other apply functions

final
def
apply(ren: URename): Provable
Apply a (possibly semantic) uniform renaming to a (locally sound!) Provable.
Apply a (possibly semantic) uniform renaming to a (locally sound!) Provable. Uniformly renames by transposition both subgoals and conclusion with the same uniform renaming
ren
.G1  D1 ... Gn  Dn r(G1)  r(D1) ... r(Gn)  r(Dn)  =>  (URen) G  D r(G)  r(D)
 ren
The uniform renaming to be used on the premises and conclusion of this Provable.
 returns
The Provable resulting from applying
ren
to our subgoals and conclusion.
 Since
4.7.5
 Exceptions thrown
RenamingClashException
if this uniform renaming is not admissible (because a semantic symbol occurs despite !semantic). Note
soundnesscritical: Semantic uniform renaming requires locally sound input provables. The kernel is easier when keeping everything locally sound.
 See also
Andre Platzer. A complete uniform substitution calculus for differential dynamic logic. Journal of Automated Reasoning, 59(2), pp. 219266, 2017. Theorem 26+27."
Andre Platzer. Uniform substitution at one fell swoop. In Pascal Fontaine, editor, International Conference on Automated Deduction, CADE'19, Natal, Brazil, Proceedings, volume 11716 of LNCS, pp. 425441. Springer, 2019.

final
def
apply(subst: USubst): Provable
Apply a uniform substitution to a (locally sound!) Provable.
Apply a uniform substitution to a (locally sound!) Provable. Substitutes both subgoals and conclusion with the same uniform substitution
subst
.G1  D1 ... Gn  Dn s(G1)  s(D1) ... s(Gn)  s(Dn)  =>  (USR) G  D s(G)  s(D)
 subst
The uniform substitution (of no free variables) to be used on the premises and conclusion of this Provable.
 returns
The Provable resulting from applying
subst
to our subgoals and conclusion.
 Exceptions thrown
SubstitutionClashException
if this substitution is not admissible for this Provable. Note
soundnesscritical. And soundnesscritical that only locally sound Provables can be constructed (otherwise implementation would be more complicated).
 See also
Andre Platzer. A complete uniform substitution calculus for differential dynamic logic. Journal of Automated Reasoning, 59(2), pp. 219266, 2017. Theorem 26+27."

final
def
apply(subderivation: Provable, subgoal: Subgoal): Provable
Substitute subderivation as a proof of subgoal.
Substitute subderivation as a proof of subgoal. Merge: Replace premise subgoal by the given subderivation. Use the given provable derivation in place of the indicated subgoal of this Provable, returning the resulting concatenated Provable.
In particular, if subderivation.isProved, then the given subgoal will disappear, otherwise it will be replaced by the subgoals of subderivation (with the first subgoal of subderivation in place of subgoal and all other subgoals at the end).
This function implements the substitution principle for hypotheses.
G1  D1 ... Gi  Di ... Gn  Dn G1  D1 ... Gr1  Dr1 ... Gn  Dn Gr2  Dr2 ... Grk  Drk  =>  G  D G  D
using the given subderivation
Gr1  Dr1 Gr2  Dr2 ... Grk  Drk  (subderivation) Gi  Di
 subderivation
the Provable derivation that proves premise subgoal.
 subgoal
the index of our subgoal that the given subderivation concludes.
 returns
A Provable derivation that joins our derivation and subderivation to a joint derivation of our conclusion using subderivation to show our subgoal. Will return a Provable with the same conclusion but an updated set of premises.
 Exceptions thrown
IllegalArgumentException
if subgoal is out of range of the subgoals.SubderivationSubstitutionException
if the subderivation's conclusion is not equal to the indicated subgoal. Note
soundnesscritical

final
def
apply(rule: Rule, subgoal: Subgoal): Provable
Apply Rule: Apply given proof rule to the indicated subgoal of this Provable, returning the resulting Provable
Apply Rule: Apply given proof rule to the indicated subgoal of this Provable, returning the resulting Provable
G1  D1 ... Gi  Di ... Gn  Dn G1  D1 ... Gr1  Dr1 ... Gn  Dn Gr2  Dr2 ... Grk  Drk  =>  G  D G  D
using the rule instance
Gr1  Dr1 Gr2  Dr2 ... Grk  Drk  (rule) Gi  Di
 rule
the proof rule to apply to the indicated subgoal of this Provable derivation.
 subgoal
which of our subgoals to apply the given proof rule to.
 returns
A Provable derivation that proves the premise subgoal by using the given proof rule. Will return a Provable with the same conclusion but an updated set of premises.
 Exceptions thrown
CoreException
subtypes if rule raises those exceptions when applied to the indicated subgoal.IllegalArgumentException
if subgoal is out of range of the subgoals. Note
soundnesscritical. And soundness needs Rule to be sealed.

final
def
asInstanceOf[T0]: T0
 Definition Classes
 Any

def
clone(): AnyRef
 Attributes
 protected[java.lang]
 Definition Classes
 AnyRef
 Annotations
 @native() @throws( ... )
 val conclusion: Sequent

final
def
eq(arg0: AnyRef): Boolean
 Definition Classes
 AnyRef

def
finalize(): scala.Unit
 Attributes
 protected[java.lang]
 Definition Classes
 AnyRef
 Annotations
 @throws( classOf[java.lang.Throwable] )

final
def
getClass(): Class[_]
 Definition Classes
 AnyRef → Any
 Annotations
 @native()

final
def
isInstanceOf[T0]: Boolean
 Definition Classes
 Any

final
def
isProved: Boolean
Checks whether this Provable proves its conclusion.
Checks whether this Provable proves its conclusion.
 returns
true if conclusion is proved by this Provable, false if subgoals are missing that need to be proved first.
 Note
soundnesscritical

final
def
ne(arg0: AnyRef): Boolean
 Definition Classes
 AnyRef

final
def
notify(): scala.Unit
 Definition Classes
 AnyRef
 Annotations
 @native()

final
def
notifyAll(): scala.Unit
 Definition Classes
 AnyRef
 Annotations
 @native()
 def prettyString: String

final
def
proved: Sequent
What conclusion this Provable proves if isProved.
What conclusion this Provable proves if isProved.
 Exceptions thrown
UnprovedException
if !isProved so illegally trying to read a proved sequent from a Provable that is not in fact proved.

def
sub(subgoal: Subgoal): Provable
SubProvable: Get a subProvable corresponding to a Provable with the given subgoal as conclusion.
SubProvable: Get a subProvable corresponding to a Provable with the given subgoal as conclusion. Provables resulting from the returned subgoal can be merged into this Provable to prove said subgoal.
 subgoal
the index of our subgoal for which to return a new open Provable.
 returns
an initial unfinished open Provable for the subgoal
i
:Gi  Di  Gi  Di
which is suitable for being merged back into this Provable for subgoal
i
subsequently.
 Exceptions thrown
IllegalArgumentException
if subgoal is out of range of the subgoals. Note
not soundnesscritical only helpful for completenesscritical
 val subgoals: IndexedSeq[Sequent]

final
def
synchronized[T0](arg0: ⇒ T0): T0
 Definition Classes
 AnyRef

def
toString(): String
 Definition Classes
 Provable → AnyRef → Any

final
def
wait(): scala.Unit
 Definition Classes
 AnyRef
 Annotations
 @throws( ... )

final
def
wait(arg0: Long, arg1: Int): scala.Unit
 Definition Classes
 AnyRef
 Annotations
 @throws( ... )

final
def
wait(arg0: Long): scala.Unit
 Definition Classes
 AnyRef
 Annotations
 @native() @throws( ... )
KeYmaera X: An aXiomatic Tactical Theorem Prover
KeYmaera X is a theorem prover for differential dynamic logic (dL), a logic for specifying and verifying properties of hybrid systems with mixed discrete and continuous dynamics. Reasoning about complicated hybrid systems requires support for sophisticated proof techniques, efficient computation, and a user interface that crystallizes salient properties of the system. KeYmaera X allows users to specify custom proof search techniques as tactics, execute tactics in parallel, and interface with partial proofs via an extensible user interface.
http://keymaeraX.org/
Concrete syntax for input language Differential Dynamic Logic
Package Structure
Main documentation entry points for KeYmaera X API:
edu.cmu.cs.ls.keymaerax.core
 KeYmaera X kernel, proof certificates, main data structuresExpression
 Differential dynamic logic expressions:Term
,Formula
,Program
Sequent
 Sequents of formulasProvable
 Proof certificates transformed by rules/axiomsRule
 Proof rules as well asUSubstOne
for (onepass) uniform substitutions and renaming.StaticSemantics
 Static semantics with free and bound variable analysisKeYmaeraXParser
.edu.cmu.cs.ls.keymaerax.parser
 Parser and pretty printer with concrete syntax and notation for differential dynamic logic.KeYmaeraXPrettyPrinter
 Pretty printer producing concrete KeYmaera X syntaxKeYmaeraXParser
 Parser reading concrete KeYmaera X syntaxKeYmaeraXArchiveParser
 Parser reading KeYmaera X model and proof archive.kyx
filesDLParser
 Combinator parser reading concrete KeYmaera X syntaxDLArchiveParser
 Combinator parser reading KeYmaera X model and proof archive.kyx
filesedu.cmu.cs.ls.keymaerax.infrastruct
 Prover infrastructure outside the kernelUnificationMatch
 Unification algorithmRenUSubst
 Renaming Uniform Substitution quickly combining kernel's renaming and substitution.Context
 Representation for contexts of formulas in which they occur.Augmentors
 Augmenting formula and expression data structures with additional functionalityExpressionTraversal
 Generic traversal functionality for expressionsedu.cmu.cs.ls.keymaerax.bellerophon
 Bellerophon tactic language and tactic interpreterBelleExpr
 Tactic language expressionsSequentialInterpreter
 Sequential tactic interpreter for Bellerophon tacticsedu.cmu.cs.ls.keymaerax.btactics
 Bellerophon tactic library for conducting proofs.TactixLibrary
 Main KeYmaera X tactic library including many proof tactics.HilbertCalculus
 Hilbert Calculus for differential dynamic logicSequentCalculus
 Sequent Calculus for propositional and firstorder logicHybridProgramCalculus
 Hybrid Program Calculus for differential dynamic logicDifferentialEquationCalculus
 Differential Equation Calculus for differential dynamic logicUnifyUSCalculus
 Unificationbased uniform substitution calculus underlying the other calculi[edu.cmu.cs.ls.keymaerax.btactics.UnifyUSCalculus.ForwardTactic ForwardTactic]
 Forward tactic framework for conducting proofs from premises to conclusionsedu.cmu.cs.ls.keymaerax.lemma
 Lemma mechanismLemma
 Lemmas are Provables stored under a name, e.g., in files.LemmaDB
 Lemma database stored in files or database etc.edu.cmu.cs.ls.keymaerax.tools.qe
 Real arithmetic backend solversMathematicaQETool
 Mathematica interface for real arithmetic.Z3QETool
 Z3 interface for real arithmetic.edu.cmu.cs.ls.keymaerax.tools.ext
 Extended backends for noncritical ODE solving, counterexamples, algebra, simplifiers, etc.Mathematica
 Mathematica interface for ODE solving, algebra, simplification, invariant generation, etc.Z3
 Z3 interface for real arithmetic including simplifiers.Entry Points
Additional entry points and usage points for KeYmaera X API:
edu.cmu.cs.ls.keymaerax.launcher.KeYmaeraX
 Commandline launcher for KeYmaera X supports commandline argumenthelp
to obtain usage informationedu.cmu.cs.ls.keymaerax.btactics.AxIndex
 Axiom indexing data structures with keys and recursors for canonical proof strategies.edu.cmu.cs.ls.keymaerax.btactics.DerivationInfo
 Metainformation on all derivation steps (axioms, derived axioms, proof rules, tactics) with userinterface info.edu.cmu.cs.ls.keymaerax.bellerophon.UIIndex
 Index determining which canonical reasoning steps to display on the KeYmaera X User Interface.edu.cmu.cs.ls.keymaerax.btactics.Ax
 Registry for derived axioms and axiomatic proof rules that are proved from the core.References
Full references on KeYmaera X are provided at http://keymaeraX.org/. The main references are the following:
1. André Platzer. A complete uniform substitution calculus for differential dynamic logic. Journal of Automated Reasoning, 59(2), pp. 219265, 2017.
2. Nathan Fulton, Stefan Mitsch, JanDavid Quesel, Marcus Völp and André Platzer. KeYmaera X: An axiomatic tactical theorem prover for hybrid systems. In Amy P. Felty and Aart Middeldorp, editors, International Conference on Automated Deduction, CADE'15, Berlin, Germany, Proceedings, volume 9195 of LNCS, pp. 527538. Springer, 2015.
3. André Platzer. Logical Foundations of CyberPhysical Systems. Springer, 2018. Videos