final case class Provable extends Product with Serializable
Provable(conclusion, subgoals) is the proof certificate representing certified provability of
conclusion from the premises in subgoals.
If subgoals is an empty list, then conclusion is provable.
Otherwise conclusion is provable from the set of all assumptions in subgoals.
G1 |- D1 ... Gn |- Dn (subgoals)
-----------------------
G |- D (conclusion)Invariant: All Provables ever produced are locally sound, because only the prover kernel can create Provable objects and chooses not to use the globally sound uniform substitution rule.
Provables are stateless and do not themselves remember other provables that they resulted from. The ProofTree data structure outside the kernel provides such proof tree navigation information.
Proofs can be constructed in (backward/tableaux) sequent order using Provables:
import scala.collection.immutable._ val verum = new Sequent(IndexedSeq(), IndexedSeq(True)) // conjecture val provable = Provable.startProof(verum) // construct a proof val proof = provable(CloseTrue(SuccPos(0)), 0) // check if proof successful if (proof.isProved) println("Successfully proved " + proof.proved)
, Multiple Provable objects for subderivations obtained from different sources can also be merged
// ... continuing other example val more = new Sequent(IndexedSeq(), IndexedSeq(Imply(Greater(Variable("x"), Number(5)), True))) // another conjecture val moreProvable = Provable.startProof(more) // construct another (partial) proof val moreProof = moreProvable(ImplyRight(SuccPos(0)), 0)(HideLeft(AntePos(0)), 0) // merge proofs by gluing their Provables together val mergedProof = moreProof(proof, 0) // check if proof successful if (mergedProof.isProved) println("Successfully proved " + mergedProof.proved)
, Proofs in backward tableaux sequent order are straight-forward
import scala.collection.immutable._ val fm = Greater(Variable("x"), Number(5)) // |- x>5 -> x>5 & true val finGoal = new Sequent(IndexedSeq(), IndexedSeq(Imply(fm, And(fm, True)))) // conjecture val finProvable = Provable.startProof(finGoal) // construct a proof val proof = finProvable( ImplyRight(SuccPos(0)), 0)( AndRight(SuccPos(0)), 0)( HideLeft(AntePos(0)), 1)( CloseTrue(SuccPos(0)), 1)( Close(AntePos(0), SuccPos(0)), 0) // proof of finGoal println(proof.proved)
, Proofs in forward Hilbert order are straightforward with merging of branches
import scala.collection.immutable._ val fm = Greater(Variable("x"), Number(5)) // proof of x>5 |- x>5 & true merges left and right branch by AndRight val proof = Provable.startProof(Sequent(IndexedSeq(fm), IndexedSeq(And(fm, True))))( AndRight(SuccPos(0)), 0) ( // left branch: x>5 |- x>5 Provable.startProof(Sequent(IndexedSeq(fm), IndexedSeq(fm)))( Close(AntePos(0), SuccPos(0)), 0), 0) ( //right branch: |- true Provable.startProof(Sequent(IndexedSeq(), IndexedSeq(True)))( CloseTrue(SuccPos(0)), 0)( // x>5 |- true Sequent(IndexedSeq(fm), IndexedSeq(True)), HideLeft(AntePos(0))), 0) ( // |- x>5 -> x>5 & true new Sequent(IndexedSeq(), IndexedSeq(Imply(fm, And(fm, True)))), ImplyRight(SuccPos(0)) ) // proof of finGoal: |- x>5 -> x>5 & true println(proof.proved)
, Proofs in Hilbert-calculus style order can also be based exclusively on subsequent merging
import scala.collection.immutable._ val fm = Greater(Variable("x"), Number(5)) // x>0 |- x>0 val left = Provable.startProof(Sequent(IndexedSeq(fm), IndexedSeq(fm)))( Close(AntePos(0), SuccPos(0)), 0) // |- true val right = Provable.startProof(Sequent(IndexedSeq(), IndexedSeq(True)))( CloseTrue(SuccPos(0)), 0) val right2 = Provable.startProof(Sequent(IndexedSeq(fm), IndexedSeq(True)))( HideLeft(AntePos(0)), 0) (right, 0) // gluing order for subgoals is irrelevant. Could use: (right2, 1)(left, 0)) val merged = Provable.startProof(Sequent(IndexedSeq(fm), IndexedSeq(And(fm, True))))( AndRight(SuccPos(0)), 0) ( left, 0)( right2, 0) // |- x>5 -> x>5 & true val finGoal = new Sequent(IndexedSeq(), IndexedSeq(Imply(fm, And(fm, True)))) val proof = Provable.startProof(finGoal)( ImplyRight(SuccPos(0)), 0) (merged, 0) // proof of finGoal println(proof.proved)
, Branching proofs in backward tableaux sequent order are straight-forward, yet might become more readable when closing branches right-to-left to keep explicit subgoals:
// explicit proof certificate construction of |- !!p() <-> p() val proof = (Provable.startProof( "!!p() <-> p()".asFormula) (EquivRight(SuccPos(0)), 0) // right branch (NotRight(SuccPos(0)), 1) (NotLeft(AntePos(1)), 1) (Close(AntePos(0),SuccPos(0)), 1) // left branch (NotLeft(AntePos(0)), 0) (NotRight(SuccPos(1)), 0) (Close(AntePos(0),SuccPos(0)), 0) )
- Note
soundness-critical logical framework.
,Only private constructor calls for soundness
,For soundness: No reflection should bypass constructor call privacy, nor reflection to bypass immutable val algebraic data types.
- See also
Andre Platzer. A complete uniform substitution calculus for differential dynamic logic. Journal of Automated Reasoning, 59(2), pp. 219-266, 2017.
- Alphabetic
- By Inheritance
- Provable
- Serializable
- Serializable
- Product
- Equals
- AnyRef
- Any
- Hide All
- Show All
- Public
- All
Type Members
-
type
Subgoal = Int
Position types for the subgoals of a Provable.
Value Members
-
final
def
!=(arg0: Any): Boolean
- Definition Classes
- AnyRef → Any
-
final
def
##(): Int
- Definition Classes
- AnyRef → Any
-
final
def
==(arg0: Any): Boolean
- Definition Classes
- AnyRef → Any
-
def
apply(prolongation: Provable): Provable
Substitute Subderivation Forward: Prolong this Provable with the given prolongation.
Substitute Subderivation Forward: Prolong this Provable with the given prolongation. This Provable with conclusion
G |- Dtransforms as followsG1 |- D1 ... Gn |- Dn G1 |- D1 ... Gn |- Dn ------------------------- => ------------------------- G |- D G0 |- D0provided
G |- D ------------------------- prolongation G0 |- D0- prolongation
the subderivation used to prolong this Provable. Where subderivation has a subgoal equaling our conclusion.
- returns
A Provable derivation that proves prolongation's conclusion from our subgoals.
- Note
not soundness-critical derived function since implemented in terms of other apply functions
-
def
apply(newConsequence: Sequent, rule: Rule): Provable
Apply Rule Forward: Apply given proof rule forward in Hilbert style to prolong this Provable to a Provable for concludes.
Apply Rule Forward: Apply given proof rule forward in Hilbert style to prolong this Provable to a Provable for concludes. This Provable with conclusion
G |- Dtransforms as followsG1 |- D1 ... Gn |- Dn G1 |- D1 ... Gn |- Dn ------------------------- => ------------------------- G |- D newConsequenceprovided
G |- D ------------------------- rule newConsequence- newConsequence
the new conclusion that the rule shows to follow from this.conclusion
- rule
the proof rule to apply to concludes to reduce it to this.conclusion.
- returns
A Provable derivation that proves concludes from the same subgoals by using the given proof rule. Will return a Provable with the same subgoals but an updated conclusion.
- Exceptions thrown
CoreExceptionsubtypes if rule raises those exceptions when applied tonewConsequent.- Note
not soundness-critical derived function since implemented in terms of other apply functions
-
final
def
apply(ren: URename): Provable
Apply a (possibly semantic) uniform renaming to a (locally sound!) Provable.
Apply a (possibly semantic) uniform renaming to a (locally sound!) Provable. Uniformly renames by transposition both subgoals and conclusion with the same uniform renaming
ren.G1 |- D1 ... Gn |- Dn r(G1) |- r(D1) ... r(Gn) |- r(Dn) ----------------------- => ----------------------------------- (URen) G |- D r(G) |- r(D)- ren
The uniform renaming to be used on the premises and conclusion of this Provable.
- returns
The Provable resulting from applying
rento our subgoals and conclusion.
- Since
4.7.5
- Exceptions thrown
RenamingClashExceptionif this uniform renaming is not admissible (because a semantic symbol occurs despite !semantic).- Note
soundness-critical: Semantic uniform renaming requires locally sound input provables. The kernel is easier when keeping everything locally sound.
- See also
Andre Platzer. A complete uniform substitution calculus for differential dynamic logic. Journal of Automated Reasoning, 59(2), pp. 219-266, 2017. Theorem 26+27."
Andre Platzer. Uniform substitution at one fell swoop. In Pascal Fontaine, editor, International Conference on Automated Deduction, CADE'19, Natal, Brazil, Proceedings, volume 11716 of LNCS, pp. 425-441. Springer, 2019.
-
final
def
apply(subst: USubst): Provable
Apply a uniform substitution to a (locally sound!) Provable.
Apply a uniform substitution to a (locally sound!) Provable. Substitutes both subgoals and conclusion with the same uniform substitution
subst.G1 |- D1 ... Gn |- Dn s(G1) |- s(D1) ... s(Gn) |- s(Dn) ----------------------- => ----------------------------------- (USR) G |- D s(G) |- s(D)- subst
The uniform substitution (of no free variables) to be used on the premises and conclusion of this Provable.
- returns
The Provable resulting from applying
substto our subgoals and conclusion.
- Exceptions thrown
SubstitutionClashExceptionif this substitution is not admissible for this Provable.- Note
soundness-critical. And soundness-critical that only locally sound Provables can be constructed (otherwise implementation would be more complicated).
- See also
Andre Platzer. A complete uniform substitution calculus for differential dynamic logic. Journal of Automated Reasoning, 59(2), pp. 219-266, 2017. Theorem 26+27."
-
final
def
apply(subderivation: Provable, subgoal: Subgoal): Provable
Substitute subderivation as a proof of subgoal.
Substitute subderivation as a proof of subgoal. Merge: Replace premise subgoal by the given subderivation. Use the given provable derivation in place of the indicated subgoal of this Provable, returning the resulting concatenated Provable.
In particular, if subderivation.isProved, then the given subgoal will disappear, otherwise it will be replaced by the subgoals of subderivation (with the first subgoal of subderivation in place of subgoal and all other subgoals at the end).
This function implements the substitution principle for hypotheses.
G1 |- D1 ... Gi |- Di ... Gn |- Dn G1 |- D1 ... Gr1 |- Dr1 ... Gn |- Dn Gr2 |- Dr2 ... Grk | Drk ---------------------------------- => ------------------------------------------------------------- G |- D G |- Dusing the given subderivation
Gr1 |- Dr1 Gr2 |- Dr2 ... Grk |- Drk ------------------------------------ (subderivation) Gi |- Di- subderivation
the Provable derivation that proves premise subgoal.
- subgoal
the index of our subgoal that the given subderivation concludes.
- returns
A Provable derivation that joins our derivation and subderivation to a joint derivation of our conclusion using subderivation to show our subgoal. Will return a Provable with the same conclusion but an updated set of premises.
- Exceptions thrown
IllegalArgumentExceptionif subgoal is out of range of the subgoals.SubderivationSubstitutionExceptionif the subderivation's conclusion is not equal to the indicated subgoal.- Note
soundness-critical
-
final
def
apply(rule: Rule, subgoal: Subgoal): Provable
Apply Rule: Apply given proof rule to the indicated subgoal of this Provable, returning the resulting Provable
Apply Rule: Apply given proof rule to the indicated subgoal of this Provable, returning the resulting Provable
G1 |- D1 ... Gi |- Di ... Gn |- Dn G1 |- D1 ... Gr1 |- Dr1 ... Gn |- Dn Gr2 |- Dr2 ... Grk | Drk ------------------------------------ => --------------------------------------------------------------- G |- D G |- Dusing the rule instance
Gr1 |- Dr1 Gr2 |- Dr2 ... Grk |- Drk ------------------------------------ (rule) Gi |- Di- rule
the proof rule to apply to the indicated subgoal of this Provable derivation.
- subgoal
which of our subgoals to apply the given proof rule to.
- returns
A Provable derivation that proves the premise subgoal by using the given proof rule. Will return a Provable with the same conclusion but an updated set of premises.
- Exceptions thrown
CoreExceptionsubtypes if rule raises those exceptions when applied to the indicated subgoal.IllegalArgumentExceptionif subgoal is out of range of the subgoals.- Note
soundness-critical. And soundness needs Rule to be sealed.
-
final
def
asInstanceOf[T0]: T0
- Definition Classes
- Any
-
def
clone(): AnyRef
- Attributes
- protected[java.lang]
- Definition Classes
- AnyRef
- Annotations
- @native() @throws( ... )
- val conclusion: Sequent
-
final
def
eq(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef
-
def
finalize(): scala.Unit
- Attributes
- protected[java.lang]
- Definition Classes
- AnyRef
- Annotations
- @throws( classOf[java.lang.Throwable] )
-
final
def
getClass(): Class[_]
- Definition Classes
- AnyRef → Any
- Annotations
- @native()
-
final
def
isInstanceOf[T0]: Boolean
- Definition Classes
- Any
-
final
def
isProved: Boolean
Checks whether this Provable proves its conclusion.
Checks whether this Provable proves its conclusion.
- returns
true if conclusion is proved by this Provable, false if subgoals are missing that need to be proved first.
- Note
soundness-critical
-
final
def
ne(arg0: AnyRef): Boolean
- Definition Classes
- AnyRef
-
final
def
notify(): scala.Unit
- Definition Classes
- AnyRef
- Annotations
- @native()
-
final
def
notifyAll(): scala.Unit
- Definition Classes
- AnyRef
- Annotations
- @native()
- def prettyString: String
-
final
def
proved: Sequent
What conclusion this Provable proves if isProved.
What conclusion this Provable proves if isProved.
- Exceptions thrown
UnprovedExceptionif !isProved so illegally trying to read a proved sequent from a Provable that is not in fact proved.
-
def
sub(subgoal: Subgoal): Provable
Sub-Provable: Get a sub-Provable corresponding to a Provable with the given subgoal as conclusion.
Sub-Provable: Get a sub-Provable corresponding to a Provable with the given subgoal as conclusion. Provables resulting from the returned subgoal can be merged into this Provable to prove said subgoal.
- subgoal
the index of our subgoal for which to return a new open Provable.
- returns
an initial unfinished open Provable for the subgoal
i:Gi |- Di ---------- Gi |- Di
which is suitable for being merged back into this Provable for subgoal
isubsequently.
- Exceptions thrown
IllegalArgumentExceptionif subgoal is out of range of the subgoals.- Note
not soundness-critical only helpful for completeness-critical
- val subgoals: IndexedSeq[Sequent]
-
final
def
synchronized[T0](arg0: ⇒ T0): T0
- Definition Classes
- AnyRef
-
def
toString(): String
- Definition Classes
- Provable → AnyRef → Any
-
final
def
wait(): scala.Unit
- Definition Classes
- AnyRef
- Annotations
- @throws( ... )
-
final
def
wait(arg0: Long, arg1: Int): scala.Unit
- Definition Classes
- AnyRef
- Annotations
- @throws( ... )
-
final
def
wait(arg0: Long): scala.Unit
- Definition Classes
- AnyRef
- Annotations
- @native() @throws( ... )
KeYmaera X: An aXiomatic Tactical Theorem Prover
KeYmaera X is a theorem prover for differential dynamic logic (dL), a logic for specifying and verifying properties of hybrid systems with mixed discrete and continuous dynamics. Reasoning about complicated hybrid systems requires support for sophisticated proof techniques, efficient computation, and a user interface that crystallizes salient properties of the system. KeYmaera X allows users to specify custom proof search techniques as tactics, execute tactics in parallel, and interface with partial proofs via an extensible user interface.
http://keymaeraX.org/
Concrete syntax for input language Differential Dynamic Logic
Package Structure
Main documentation entry points for KeYmaera X API:
edu.cmu.cs.ls.keymaerax.core- KeYmaera X kernel, proof certificates, main data structuresExpression- Differential dynamic logic expressions:Term,Formula,ProgramSequent- Sequents of formulasProvable- Proof certificates transformed by rules/axiomsRule- Proof rules as well asUSubstOnefor (one-pass) uniform substitutions and renaming.StaticSemantics- Static semantics with free and bound variable analysisKeYmaeraXParser.edu.cmu.cs.ls.keymaerax.parser- Parser and pretty printer with concrete syntax and notation for differential dynamic logic.KeYmaeraXPrettyPrinter- Pretty printer producing concrete KeYmaera X syntaxKeYmaeraXParser- Parser reading concrete KeYmaera X syntaxKeYmaeraXArchiveParser- Parser reading KeYmaera X model and proof archive.kyxfilesDLParser- Combinator parser reading concrete KeYmaera X syntaxDLArchiveParser- Combinator parser reading KeYmaera X model and proof archive.kyxfilesedu.cmu.cs.ls.keymaerax.infrastruct- Prover infrastructure outside the kernelUnificationMatch- Unification algorithmRenUSubst- Renaming Uniform Substitution quickly combining kernel's renaming and substitution.Context- Representation for contexts of formulas in which they occur.Augmentors- Augmenting formula and expression data structures with additional functionalityExpressionTraversal- Generic traversal functionality for expressionsedu.cmu.cs.ls.keymaerax.bellerophon- Bellerophon tactic language and tactic interpreterBelleExpr- Tactic language expressionsSequentialInterpreter- Sequential tactic interpreter for Bellerophon tacticsedu.cmu.cs.ls.keymaerax.btactics- Bellerophon tactic library for conducting proofs.TactixLibrary- Main KeYmaera X tactic library including many proof tactics.HilbertCalculus- Hilbert Calculus for differential dynamic logicSequentCalculus- Sequent Calculus for propositional and first-order logicHybridProgramCalculus- Hybrid Program Calculus for differential dynamic logicDifferentialEquationCalculus- Differential Equation Calculus for differential dynamic logicUnifyUSCalculus- Unification-based uniform substitution calculus underlying the other calculi[edu.cmu.cs.ls.keymaerax.btactics.UnifyUSCalculus.ForwardTactic ForwardTactic]- Forward tactic framework for conducting proofs from premises to conclusionsedu.cmu.cs.ls.keymaerax.lemma- Lemma mechanismLemma- Lemmas are Provables stored under a name, e.g., in files.LemmaDB- Lemma database stored in files or database etc.edu.cmu.cs.ls.keymaerax.tools.qe- Real arithmetic back-end solversMathematicaQETool- Mathematica interface for real arithmetic.Z3QETool- Z3 interface for real arithmetic.edu.cmu.cs.ls.keymaerax.tools.ext- Extended back-ends for noncritical ODE solving, counterexamples, algebra, simplifiers, etc.Mathematica- Mathematica interface for ODE solving, algebra, simplification, invariant generation, etc.Z3- Z3 interface for real arithmetic including simplifiers.Entry Points
Additional entry points and usage points for KeYmaera X API:
edu.cmu.cs.ls.keymaerax.launcher.KeYmaeraX- Command-line launcher for KeYmaera X supports command-line argument-helpto obtain usage informationedu.cmu.cs.ls.keymaerax.btactics.AxIndex- Axiom indexing data structures with keys and recursors for canonical proof strategies.edu.cmu.cs.ls.keymaerax.btactics.DerivationInfo- Meta-information on all derivation steps (axioms, derived axioms, proof rules, tactics) with user-interface info.edu.cmu.cs.ls.keymaerax.bellerophon.UIIndex- Index determining which canonical reasoning steps to display on the KeYmaera X User Interface.edu.cmu.cs.ls.keymaerax.btactics.Ax- Registry for derived axioms and axiomatic proof rules that are proved from the core.References
Full references on KeYmaera X are provided at http://keymaeraX.org/. The main references are the following:
1. André Platzer. A complete uniform substitution calculus for differential dynamic logic. Journal of Automated Reasoning, 59(2), pp. 219-265, 2017.
2. Nathan Fulton, Stefan Mitsch, Jan-David Quesel, Marcus Völp and André Platzer. KeYmaera X: An axiomatic tactical theorem prover for hybrid systems. In Amy P. Felty and Aart Middeldorp, editors, International Conference on Automated Deduction, CADE'15, Berlin, Germany, Proceedings, volume 9195 of LNCS, pp. 527-538. Springer, 2015.
3. André Platzer. Logical Foundations of Cyber-Physical Systems. Springer, 2018. Videos