doc-src/Nitpick/nitpick.tex
author blanchet
Wed, 28 Oct 2009 17:43:43 +0100
changeset 33561 ab01b72715ef
parent 33559 63925777ccf9
child 33564 75ce0f60617a
permissions -rw-r--r--
introduced Auto Nitpick in addition to Auto Quickcheck; this required generalizing the theorem hook used by Quickcheck, following a suggestion by Florian
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
     1
\documentclass[a4paper,12pt]{article}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
     2
\usepackage[T1]{fontenc}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
     3
\usepackage{amsmath}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
     4
\usepackage{amssymb}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
     5
\usepackage[french,english]{babel}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
     6
\usepackage{color}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
     7
\usepackage{graphicx}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
     8
%\usepackage{mathpazo}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
     9
\usepackage{multicol}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    10
\usepackage{stmaryrd}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    11
%\usepackage[scaled=.85]{beramono}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    12
\usepackage{../iman,../pdfsetup}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    13
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    14
%\oddsidemargin=4.6mm
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    15
%\evensidemargin=4.6mm
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    16
%\textwidth=150mm
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    17
%\topmargin=4.6mm
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    18
%\headheight=0mm
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    19
%\headsep=0mm
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    20
%\textheight=234mm
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    21
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    22
\def\Colon{\mathord{:\mkern-1.5mu:}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    23
%\def\lbrakk{\mathopen{\lbrack\mkern-3.25mu\lbrack}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    24
%\def\rbrakk{\mathclose{\rbrack\mkern-3.255mu\rbrack}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    25
\def\lparr{\mathopen{(\mkern-4mu\mid}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    26
\def\rparr{\mathclose{\mid\mkern-4mu)}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    27
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    28
\def\undef{\textit{undefined}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    29
\def\unk{{?}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    30
%\def\unr{\textit{others}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    31
\def\unr{\ldots}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    32
\def\Abs#1{\hbox{\rm{\flqq}}{\,#1\,}\hbox{\rm{\frqq}}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    33
\def\Q{{\smash{\lower.2ex\hbox{$\scriptstyle?$}}}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    34
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    35
\hyphenation{Mini-Sat size-change First-Steps grand-parent nit-pick
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    36
counter-example counter-examples data-type data-types co-data-type 
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    37
co-data-types in-duc-tive co-in-duc-tive}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    38
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    39
\urlstyle{tt}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    40
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    41
\begin{document}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    42
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    43
\title{\includegraphics[scale=0.5]{isabelle_nitpick} \\[4ex]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    44
Picking Nits \\[\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    45
\Large A User's Guide to Nitpick for Isabelle/HOL 2010}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    46
\author{\hbox{} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    47
Jasmin Christian Blanchette \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    48
{\normalsize Fakult\"at f\"ur Informatik, Technische Universit\"at M\"unchen} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    49
\hbox{}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    50
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    51
\maketitle
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    52
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    53
\tableofcontents
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    54
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    55
\setlength{\parskip}{.7em plus .2em minus .1em}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    56
\setlength{\parindent}{0pt}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    57
\setlength{\abovedisplayskip}{\parskip}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    58
\setlength{\abovedisplayshortskip}{.9\parskip}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    59
\setlength{\belowdisplayskip}{\parskip}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    60
\setlength{\belowdisplayshortskip}{.9\parskip}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    61
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    62
% General-purpose enum environment with correct spacing
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    63
\newenvironment{enum}%
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    64
    {\begin{list}{}{%
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    65
        \setlength{\topsep}{.1\parskip}%
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    66
        \setlength{\partopsep}{.1\parskip}%
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    67
        \setlength{\itemsep}{\parskip}%
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    68
        \advance\itemsep by-\parsep}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    69
    {\end{list}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    70
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    71
\def\pre{\begingroup\vskip0pt plus1ex\advance\leftskip by\leftmargin
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    72
\advance\rightskip by\leftmargin}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    73
\def\post{\vskip0pt plus1ex\endgroup}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    74
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    75
\def\prew{\pre\advance\rightskip by-\leftmargin}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    76
\def\postw{\post}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    77
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    78
\section{Introduction}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    79
\label{introduction}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    80
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    81
Nitpick \cite{blanchette-nipkow-2009} is a counterexample generator for
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    82
Isabelle/HOL \cite{isa-tutorial} that is designed to handle formulas
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    83
combining (co)in\-duc\-tive datatypes, (co)in\-duc\-tively defined predicates, and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    84
quantifiers. It builds on Kodkod \cite{torlak-jackson-2007}, a highly optimized
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    85
first-order relational model finder developed by the Software Design Group at
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    86
MIT. It is conceptually similar to Refute \cite{weber-2008}, from which it
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    87
borrows many ideas and code fragments, but it benefits from Kodkod's
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    88
optimizations and a new encoding scheme. The name Nitpick is shamelessly
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    89
appropriated from a now retired Alloy precursor.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    90
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    91
Nitpick is easy to use---you simply enter \textbf{nitpick} after a putative
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    92
theorem and wait a few seconds. Nonetheless, there are situations where knowing
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    93
how it works under the hood and how it reacts to various options helps
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    94
increase the test coverage. This manual also explains how to install the tool on
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    95
your workstation. Should the motivation fail you, think of the many hours of
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    96
hard work Nitpick will save you. Proving non-theorems is \textsl{hard work}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    97
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    98
Another common use of Nitpick is to find out whether the axioms of a locale are
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
    99
satisfiable, while the locale is being developed. To check this, it suffices to
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   100
write
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   101
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   102
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   103
\textbf{lemma}~``$\textit{False}$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   104
\textbf{nitpick}~[\textit{show\_all}]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   105
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   106
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   107
after the locale's \textbf{begin} keyword. To falsify \textit{False}, Nitpick
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   108
must find a model for the axioms. If it finds no model, we have an indication
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   109
that the axioms might be unsatisfiable.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   110
33195
0efe26262e73 updated Nitpick manual to reflect the latest Stand der Dinge
blanchet
parents: 33193
diff changeset
   111
Nitpick requires the Kodkodi package for Isabelle as well as a Java 1.5 virtual
0efe26262e73 updated Nitpick manual to reflect the latest Stand der Dinge
blanchet
parents: 33193
diff changeset
   112
machine called \texttt{java}. The examples presented in this manual can be found
0efe26262e73 updated Nitpick manual to reflect the latest Stand der Dinge
blanchet
parents: 33193
diff changeset
   113
in Isabelle's \texttt{src/HOL/Nitpick\_Examples/Manual\_Nits.thy} theory.
0efe26262e73 updated Nitpick manual to reflect the latest Stand der Dinge
blanchet
parents: 33193
diff changeset
   114
33561
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
   115
Throughout this manual, we will explicitly invoke the \textbf{nitpick} command.
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
   116
Nitpick also provides an automatic mode that can be enabled using the
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
   117
``Auto Nitpick'' option from the ``Isabelle'' menu in Proof General. In this
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
   118
mode, Nitpick is run on every newly entered theorem, much like Auto Quickcheck.
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
   119
The collective time limit for Auto Nitpick and Auto Quickcheck can be set using
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
   120
the ``Auto Counterexample Time Limit'' option.
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
   121
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   122
\newbox\boxA
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   123
\setbox\boxA=\hbox{\texttt{nospam}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   124
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   125
The known bugs and limitations at the time of writing are listed in
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   126
\S\ref{known-bugs-and-limitations}. Comments and bug reports concerning Nitpick
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   127
or this manual should be directed to
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   128
\texttt{blan{\color{white}nospam}\kern-\wd\boxA{}chette@\allowbreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   129
in.\allowbreak tum.\allowbreak de}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   130
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   131
\vskip2.5\smallskipamount
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   132
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   133
\textbf{Acknowledgment.} The author would like to thank Mark Summerfield for
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   134
suggesting several textual improvements.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   135
% and Perry James for reporting a typo.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   136
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   137
\section{First Steps}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   138
\label{first-steps}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   139
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   140
This section introduces Nitpick by presenting small examples. If possible, you
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   141
should try out the examples on your workstation. Your theory file should start
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   142
the standard way:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   143
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   144
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   145
\textbf{theory}~\textit{Scratch} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   146
\textbf{imports}~\textit{Main} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   147
\textbf{begin}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   148
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   149
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   150
The results presented here were obtained using the JNI version of MiniSat and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   151
with multithreading disabled to reduce nondeterminism. This was done by adding
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   152
the line
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   153
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   154
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   155
\textbf{nitpick\_params} [\textit{sat\_solver}~= \textit{MiniSatJNI}, \,\textit{max\_threads}~= 1]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   156
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   157
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   158
after the \textbf{begin} keyword. The JNI version of MiniSat is bundled with
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   159
Kodkodi and is precompiled for the major platforms. Other SAT solvers can also
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   160
be installed, as explained in \S\ref{optimizations}. If you have already
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   161
configured SAT solvers in Isabelle (e.g., for Refute), these will also be
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   162
available to Nitpick.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   163
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   164
\subsection{Propositional Logic}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   165
\label{propositional-logic}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   166
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   167
Let's start with a trivial example from propositional logic:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   168
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   169
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   170
\textbf{lemma}~``$P \longleftrightarrow Q$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   171
\textbf{nitpick}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   172
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   173
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   174
You should get the following output:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   175
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   176
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   177
\slshape
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   178
Nitpick found a counterexample: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   179
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   180
\hbox{}\qquad\qquad $P = \textit{True}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   181
\hbox{}\qquad\qquad $Q = \textit{False}$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   182
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   183
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   184
Nitpick can also be invoked on individual subgoals, as in the example below:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   185
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   186
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   187
\textbf{apply}~\textit{auto} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   188
{\slshape goal (2 subgoals): \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   189
\ 1. $P\,\Longrightarrow\, Q$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   190
\ 2. $Q\,\Longrightarrow\, P$} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   191
\textbf{nitpick}~1 \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   192
{\slshape Nitpick found a counterexample: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   193
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   194
\hbox{}\qquad\qquad $P = \textit{True}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   195
\hbox{}\qquad\qquad $Q = \textit{False}$} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   196
\textbf{nitpick}~2 \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   197
{\slshape Nitpick found a counterexample: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   198
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   199
\hbox{}\qquad\qquad $P = \textit{False}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   200
\hbox{}\qquad\qquad $Q = \textit{True}$} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   201
\textbf{oops}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   202
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   203
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   204
\subsection{Type Variables}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   205
\label{type-variables}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   206
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   207
If you are left unimpressed by the previous example, don't worry. The next
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   208
one is more mind- and computer-boggling:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   209
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   210
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   211
\textbf{lemma} ``$P~x\,\Longrightarrow\, P~(\textrm{THE}~y.\;P~y)$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   212
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   213
\pagebreak[2] %% TYPESETTING
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   214
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   215
The putative lemma involves the definite description operator, {THE}, presented
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   216
in section 5.10.1 of the Isabelle tutorial \cite{isa-tutorial}. The
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   217
operator is defined by the axiom $(\textrm{THE}~x.\; x = a) = a$. The putative
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   218
lemma is merely asserting the indefinite description operator axiom with {THE}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   219
substituted for {SOME}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   220
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   221
The free variable $x$ and the bound variable $y$ have type $'a$. For formulas
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   222
containing type variables, Nitpick enumerates the possible domains for each type
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   223
variable, up to a given cardinality (8 by default), looking for a finite
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   224
countermodel:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   225
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   226
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   227
\textbf{nitpick} [\textit{verbose}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   228
\slshape
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   229
Trying 8 scopes: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   230
\hbox{}\qquad \textit{card}~$'a$~= 1; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   231
\hbox{}\qquad \textit{card}~$'a$~= 2; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   232
\hbox{}\qquad $\qquad\vdots$ \\[.5\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   233
\hbox{}\qquad \textit{card}~$'a$~= 8. \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   234
Nitpick found a counterexample for \textit{card} $'a$~= 3: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   235
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   236
\hbox{}\qquad\qquad $P = \{a_2,\, a_3\}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   237
\hbox{}\qquad\qquad $x = a_3$ \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   238
Total time: 580 ms.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   239
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   240
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   241
Nitpick found a counterexample in which $'a$ has cardinality 3. (For
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   242
cardinalities 1 and 2, the formula holds.) In the counterexample, the three
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   243
values of type $'a$ are written $a_1$, $a_2$, and $a_3$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   244
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   245
The message ``Trying $n$ scopes: {\ldots}''\ is shown only if the option
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   246
\textit{verbose} is enabled. You can specify \textit{verbose} each time you
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   247
invoke \textbf{nitpick}, or you can set it globally using the command
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   248
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   249
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   250
\textbf{nitpick\_params} [\textit{verbose}]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   251
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   252
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   253
This command also displays the current default values for all of the options
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   254
supported by Nitpick. The options are listed in \S\ref{option-reference}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   255
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   256
\subsection{Constants}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   257
\label{constants}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   258
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   259
By just looking at Nitpick's output, it might not be clear why the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   260
counterexample in \S\ref{type-variables} is genuine. Let's invoke Nitpick again,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   261
this time telling it to show the values of the constants that occur in the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   262
formula:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   263
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   264
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   265
\textbf{lemma}~``$P~x\,\Longrightarrow\, P~(\textrm{THE}~y.\;P~y)$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   266
\textbf{nitpick}~[\textit{show\_consts}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   267
\slshape
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   268
Nitpick found a counterexample for \textit{card} $'a$~= 3: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   269
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   270
\hbox{}\qquad\qquad $P = \{a_2,\, a_3\}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   271
\hbox{}\qquad\qquad $x = a_3$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   272
\hbox{}\qquad Constant: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   273
\hbox{}\qquad\qquad $\textit{The}~\textsl{fallback} = a_1$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   274
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   275
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   276
We can see more clearly now. Since the predicate $P$ isn't true for a unique
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   277
value, $\textrm{THE}~y.\;P~y$ can denote any value of type $'a$, even
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   278
$a_1$. Since $P~a_1$ is false, the entire formula is falsified.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   279
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   280
As an optimization, Nitpick's preprocessor introduced the special constant
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   281
``\textit{The} fallback'' corresponding to $\textrm{THE}~y.\;P~y$ (i.e.,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   282
$\mathit{The}~(\lambda y.\;P~y)$) when there doesn't exist a unique $y$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   283
satisfying $P~y$. We disable this optimization by passing the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   284
\textit{full\_descrs} option:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   285
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   286
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   287
\textbf{nitpick}~[\textit{full\_descrs},\, \textit{show\_consts}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   288
\slshape
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   289
Nitpick found a counterexample for \textit{card} $'a$~= 3: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   290
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   291
\hbox{}\qquad\qquad $P = \{a_2,\, a_3\}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   292
\hbox{}\qquad\qquad $x = a_3$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   293
\hbox{}\qquad Constant: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   294
\hbox{}\qquad\qquad $\hbox{\slshape THE}~y.\;P~y = a_1$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   295
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   296
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   297
As the result of another optimization, Nitpick directly assigned a value to the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   298
subterm $\textrm{THE}~y.\;P~y$, rather than to the \textit{The} constant. If we
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   299
disable this second optimization by using the command
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   300
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   301
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   302
\textbf{nitpick}~[\textit{dont\_specialize},\, \textit{full\_descrs},\,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   303
\textit{show\_consts}]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   304
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   305
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   306
we finally get \textit{The}:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   307
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   308
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   309
\slshape Constant: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   310
\hbox{}\qquad $\mathit{The} = \undef{}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   311
    (\!\begin{aligned}[t]%
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   312
    & \{\} := a_3,\> \{a_3\} := a_3,\> \{a_2\} := a_2, \\[-2pt] %% TYPESETTING
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   313
    & \{a_2, a_3\} := a_1,\> \{a_1\} := a_1,\> \{a_1, a_3\} := a_3, \\[-2pt]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   314
    & \{a_1, a_2\} := a_3,\> \{a_1, a_2, a_3\} := a_3)\end{aligned}$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   315
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   316
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   317
Notice that $\textit{The}~(\lambda y.\;P~y) = \textit{The}~\{a_2, a_3\} = a_1$,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   318
just like before.\footnote{The \undef{} symbol's presence is explained as
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   319
follows: In higher-order logic, any function can be built from the undefined
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   320
function using repeated applications of the function update operator $f(x :=
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   321
y)$, just like any list can be built from the empty list using $x \mathbin{\#}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   322
xs$.}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   323
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   324
Our misadventures with THE suggest adding `$\exists!x{.}$' (``there exists a
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   325
unique $x$ such that'') at the front of our putative lemma's assumption:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   326
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   327
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   328
\textbf{lemma}~``$\exists {!}x.\; P~x\,\Longrightarrow\, P~(\textrm{THE}~y.\;P~y)$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   329
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   330
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   331
The fix appears to work:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   332
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   333
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   334
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   335
\slshape Nitpick found no counterexample.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   336
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   337
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   338
We can further increase our confidence in the formula by exhausting all
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   339
cardinalities up to 50:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   340
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   341
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   342
\textbf{nitpick} [\textit{card} $'a$~= 1--50]\footnote{The symbol `--'
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   343
can be entered as \texttt{-} (hyphen) or
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   344
\texttt{\char`\\\char`\<midarrow\char`\>}.} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   345
\slshape Nitpick found no counterexample.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   346
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   347
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   348
Let's see if Sledgehammer \cite{sledgehammer-2009} can find a proof:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   349
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   350
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   351
\textbf{sledgehammer} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   352
{\slshape Sledgehammer: external prover ``$e$'' for subgoal 1: \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   353
$\exists{!}x.\; P~x\,\Longrightarrow\, P~(\hbox{\slshape THE}~y.\; P~y)$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   354
Try this command: \textrm{apply}~(\textit{metis~the\_equality})} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   355
\textbf{apply}~(\textit{metis~the\_equality\/}) \nopagebreak \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   356
{\slshape No subgoals!}% \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   357
%\textbf{done}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   358
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   359
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   360
This must be our lucky day.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   361
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   362
\subsection{Skolemization}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   363
\label{skolemization}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   364
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   365
Are all invertible functions onto? Let's find out:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   366
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   367
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   368
\textbf{lemma} ``$\exists g.\; \forall x.~g~(f~x) = x
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   369
 \,\Longrightarrow\, \forall y.\; \exists x.~y = f~x$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   370
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   371
\slshape
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   372
Nitpick found a counterexample for \textit{card} $'a$~= 2 and \textit{card} $'b$~=~1: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   373
\hbox{}\qquad Free variable: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   374
\hbox{}\qquad\qquad $f = \undef{}(b_1 := a_1)$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   375
\hbox{}\qquad Skolem constants: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   376
\hbox{}\qquad\qquad $g = \undef{}(a_1 := b_1,\> a_2 := b_1)$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   377
\hbox{}\qquad\qquad $y = a_2$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   378
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   379
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   380
Although $f$ is the only free variable occurring in the formula, Nitpick also
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   381
displays values for the bound variables $g$ and $y$. These values are available
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   382
to Nitpick because it performs skolemization as a preprocessing step.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   383
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   384
In the previous example, skolemization only affected the outermost quantifiers.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   385
This is not always the case, as illustrated below:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   386
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   387
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   388
\textbf{lemma} ``$\exists x.\; \forall f.\; f~x = x$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   389
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   390
\slshape
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   391
Nitpick found a counterexample for \textit{card} $'a$~= 2: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   392
\hbox{}\qquad Skolem constant: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   393
\hbox{}\qquad\qquad $\lambda x.\; f =
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   394
    \undef{}(\!\begin{aligned}[t]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   395
    & a_1 := \undef{}(a_1 := a_2,\> a_2 := a_1), \\[-2pt]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   396
    & a_2 := \undef{}(a_1 := a_1,\> a_2 := a_1))\end{aligned}$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   397
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   398
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   399
The variable $f$ is bound within the scope of $x$; therefore, $f$ depends on
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   400
$x$, as suggested by the notation $\lambda x.\,f$. If $x = a_1$, then $f$ is the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   401
function that maps $a_1$ to $a_2$ and vice versa; otherwise, $x = a_2$ and $f$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   402
maps both $a_1$ and $a_2$ to $a_1$. In both cases, $f~x \not= x$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   403
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   404
The source of the Skolem constants is sometimes more obscure:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   405
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   406
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   407
\textbf{lemma} ``$\mathit{refl}~r\,\Longrightarrow\, \mathit{sym}~r$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   408
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   409
\slshape
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   410
Nitpick found a counterexample for \textit{card} $'a$~= 2: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   411
\hbox{}\qquad Free variable: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   412
\hbox{}\qquad\qquad $r = \{(a_1, a_1),\, (a_2, a_1),\, (a_2, a_2)\}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   413
\hbox{}\qquad Skolem constants: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   414
\hbox{}\qquad\qquad $\mathit{sym}.x = a_2$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   415
\hbox{}\qquad\qquad $\mathit{sym}.y = a_1$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   416
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   417
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   418
What happened here is that Nitpick expanded the \textit{sym} constant to its
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   419
definition:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   420
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   421
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   422
$\mathit{sym}~r \,\equiv\,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   423
 \forall x\> y.\,\> (x, y) \in r \longrightarrow (y, x) \in r.$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   424
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   425
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   426
As their names suggest, the Skolem constants $\mathit{sym}.x$ and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   427
$\mathit{sym}.y$ are simply the bound variables $x$ and $y$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   428
from \textit{sym}'s definition.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   429
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   430
Although skolemization is a useful optimization, you can disable it by invoking
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   431
Nitpick with \textit{dont\_skolemize}. See \S\ref{optimizations} for details.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   432
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   433
\subsection{Natural Numbers and Integers}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   434
\label{natural-numbers-and-integers}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   435
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   436
Because of the axiom of infinity, the type \textit{nat} does not admit any
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   437
finite models. To deal with this, Nitpick considers prefixes $\{0,\, 1,\,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   438
\ldots,\, K - 1\}$ of \textit{nat} (where $K = \textit{card}~\textit{nat}$) and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   439
maps all other numbers to the undefined value ($\unk$). The type \textit{int} is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   440
handled in a similar way: If $K = \textit{card}~\textit{int}$, the subset of
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   441
\textit{int} known to Nitpick is $\{-\lceil K/2 \rceil + 1,\, \ldots,\, +\lfloor
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   442
K/2 \rfloor\}$. Undefined values lead to a three-valued logic.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   443
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   444
Here is an example involving \textit{int}:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   445
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   446
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   447
\textbf{lemma} ``$\lbrakk i \le j;\> n \le (m{\Colon}\mathit{int})\rbrakk \,\Longrightarrow\, i * n + j * m \le i * m + j * n$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   448
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   449
\slshape Nitpick found a counterexample: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   450
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   451
\hbox{}\qquad\qquad $i = 0$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   452
\hbox{}\qquad\qquad $j = 1$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   453
\hbox{}\qquad\qquad $m = 1$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   454
\hbox{}\qquad\qquad $n = 0$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   455
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   456
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   457
With infinite types, we don't always have the luxury of a genuine counterexample
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   458
and must often content ourselves with a potential one. The tedious task of
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   459
finding out whether the potential counterexample is in fact genuine can be
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   460
outsourced to \textit{auto} by passing the option \textit{check\_potential}. For
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   461
example:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   462
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   463
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   464
\textbf{lemma} ``$\forall n.\; \textit{Suc}~n \mathbin{\not=} n \,\Longrightarrow\, P$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   465
\textbf{nitpick} [\textit{card~nat}~= 100,\, \textit{check\_potential}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   466
\slshape Nitpick found a potential counterexample: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   467
\hbox{}\qquad Free variable: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   468
\hbox{}\qquad\qquad $P = \textit{False}$ \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   469
Confirmation by ``\textit{auto}'': The above counterexample is genuine.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   470
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   471
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   472
You might wonder why the counterexample is first reported as potential. The root
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   473
of the problem is that the bound variable in $\forall n.\; \textit{Suc}~n
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   474
\mathbin{\not=} n$ ranges over an infinite type. If Nitpick finds an $n$ such
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   475
that $\textit{Suc}~n \mathbin{=} n$, it evaluates the assumption to
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   476
\textit{False}; but otherwise, it does not know anything about values of $n \ge
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   477
\textit{card~nat}$ and must therefore evaluate the assumption to $\unk$, not
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   478
\textit{True}. Since the assumption can never be satisfied, the putative lemma
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   479
can never be falsified.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   480
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   481
Incidentally, if you distrust the so-called genuine counterexamples, you can
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   482
enable \textit{check\_\allowbreak genuine} to verify them as well. However, be
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   483
aware that \textit{auto} will often fail to prove that the counterexample is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   484
genuine or spurious.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   485
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   486
Some conjectures involving elementary number theory make Nitpick look like a
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   487
giant with feet of clay:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   488
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   489
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   490
\textbf{lemma} ``$P~\textit{Suc}$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   491
\textbf{nitpick} [\textit{card} = 1--6] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   492
\slshape
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   493
Nitpick found no counterexample.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   494
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   495
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   496
For any cardinality $k$, \textit{Suc} is the partial function $\{0 \mapsto 1,\,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   497
1 \mapsto 2,\, \ldots,\, k - 1 \mapsto \unk\}$, which evaluates to $\unk$ when
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   498
it is passed as argument to $P$. As a result, $P~\textit{Suc}$ is always $\unk$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   499
The next example is similar:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   500
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   501
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   502
\textbf{lemma} ``$P~(\textit{op}~{+}\Colon
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   503
\textit{nat}\mathbin{\Rightarrow}\textit{nat}\mathbin{\Rightarrow}\textit{nat})$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   504
\textbf{nitpick} [\textit{card nat} = 1] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   505
{\slshape Nitpick found a counterexample:} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   506
\hbox{}\qquad Free variable: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   507
\hbox{}\qquad\qquad $P = \{\}$ \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   508
\textbf{nitpick} [\textit{card nat} = 2] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   509
{\slshape Nitpick found no counterexample.}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   510
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   511
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   512
The problem here is that \textit{op}~+ is total when \textit{nat} is taken to be
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   513
$\{0\}$ but becomes partial as soon as we add $1$, because $1 + 1 \notin \{0,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   514
1\}$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   515
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   516
Because numbers are infinite and are approximated using a three-valued logic,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   517
there is usually no need to systematically enumerate domain sizes. If Nitpick
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   518
cannot find a genuine counterexample for \textit{card~nat}~= $k$, it is very
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   519
unlikely that one could be found for smaller domains. (The $P~(\textit{op}~{+})$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   520
example above is an exception to this principle.) Nitpick nonetheless enumerates
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   521
all cardinalities from 1 to 8 for \textit{nat}, mainly because smaller
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   522
cardinalities are fast to handle and give rise to simpler counterexamples. This
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   523
is explained in more detail in \S\ref{scope-monotonicity}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   524
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   525
\subsection{Inductive Datatypes}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   526
\label{inductive-datatypes}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   527
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   528
Like natural numbers and integers, inductive datatypes with recursive
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   529
constructors admit no finite models and must be approximated by a subterm-closed
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   530
subset. For example, using a cardinality of 10 for ${'}a~\textit{list}$,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   531
Nitpick looks for all counterexamples that can be built using at most 10
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   532
different lists.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   533
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   534
Let's see with an example involving \textit{hd} (which returns the first element
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   535
of a list) and $@$ (which concatenates two lists):
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   536
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   537
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   538
\textbf{lemma} ``$\textit{hd}~(\textit{xs} \mathbin{@} [y, y]) = \textit{hd}~\textit{xs}$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   539
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   540
\slshape Nitpick found a counterexample for \textit{card} $'a$~= 3: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   541
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   542
\hbox{}\qquad\qquad $\textit{xs} = []$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   543
\hbox{}\qquad\qquad $\textit{y} = a_3$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   544
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   545
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   546
To see why the counterexample is genuine, we enable \textit{show\_consts}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   547
and \textit{show\_\allowbreak datatypes}:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   548
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   549
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   550
{\slshape Datatype:} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   551
\hbox{}\qquad $'a$~\textit{list}~= $\{[],\, [a_3, a_3],\, [a_3],\, \unr\}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   552
{\slshape Constants:} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   553
\hbox{}\qquad $\lambda x_1.\; x_1 \mathbin{@} [y, y] = \undef([] := [a_3, a_3],\> [a_3, a_3] := \unk,\> [a_3] := \unk)$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   554
\hbox{}\qquad $\textit{hd} = \undef([] := a_2,\> [a_3, a_3] := a_3,\> [a_3] := a_3)$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   555
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   556
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   557
Since $\mathit{hd}~[]$ is undefined in the logic, it may be given any value,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   558
including $a_2$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   559
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   560
The second constant, $\lambda x_1.\; x_1 \mathbin{@} [y, y]$, is simply the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   561
append operator whose second argument is fixed to be $[y, y]$. Appending $[a_3,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   562
a_3]$ to $[a_3]$ would normally give $[a_3, a_3, a_3]$, but this value is not
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   563
representable in the subset of $'a$~\textit{list} considered by Nitpick, which
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   564
is shown under the ``Datatype'' heading; hence the result is $\unk$. Similarly,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   565
appending $[a_3, a_3]$ to itself gives $\unk$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   566
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   567
Given \textit{card}~$'a = 3$ and \textit{card}~$'a~\textit{list} = 3$, Nitpick
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   568
considers the following subsets:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   569
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   570
\kern-.5\smallskipamount %% TYPESETTING
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   571
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   572
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   573
\begin{multicols}{3}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   574
$\{[],\, [a_1],\, [a_2]\}$; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   575
$\{[],\, [a_1],\, [a_3]\}$; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   576
$\{[],\, [a_2],\, [a_3]\}$; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   577
$\{[],\, [a_1],\, [a_1, a_1]\}$; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   578
$\{[],\, [a_1],\, [a_2, a_1]\}$; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   579
$\{[],\, [a_1],\, [a_3, a_1]\}$; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   580
$\{[],\, [a_2],\, [a_1, a_2]\}$; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   581
$\{[],\, [a_2],\, [a_2, a_2]\}$; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   582
$\{[],\, [a_2],\, [a_3, a_2]\}$; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   583
$\{[],\, [a_3],\, [a_1, a_3]\}$; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   584
$\{[],\, [a_3],\, [a_2, a_3]\}$; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   585
$\{[],\, [a_3],\, [a_3, a_3]\}$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   586
\end{multicols}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   587
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   588
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   589
\kern-2\smallskipamount %% TYPESETTING
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   590
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   591
All subterm-closed subsets of $'a~\textit{list}$ consisting of three values
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   592
are listed and only those. As an example of a non-subterm-closed subset,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   593
consider $\mathcal{S} = \{[],\, [a_1],\,\allowbreak [a_1, a_3]\}$, and observe
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   594
that $[a_1, a_3]$ (i.e., $a_1 \mathbin{\#} [a_3]$) has $[a_3] \notin
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   595
\mathcal{S}$ as a subterm.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   596
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   597
Here's another m\"ochtegern-lemma that Nitpick can refute without a blink:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   598
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   599
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   600
\textbf{lemma} ``$\lbrakk \textit{length}~\textit{xs} = 1;\> \textit{length}~\textit{ys} = 1
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   601
\rbrakk \,\Longrightarrow\, \textit{xs} = \textit{ys}$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   602
\\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   603
\textbf{nitpick} [\textit{show\_datatypes}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   604
\slshape Nitpick found a counterexample for \textit{card} $'a$~= 3: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   605
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   606
\hbox{}\qquad\qquad $\textit{xs} = [a_2]$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   607
\hbox{}\qquad\qquad $\textit{ys} = [a_3]$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   608
\hbox{}\qquad Datatypes: \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   609
\hbox{}\qquad\qquad $\textit{nat} = \{0,\, 1,\, 2,\, \unr\}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   610
\hbox{}\qquad\qquad $'a$~\textit{list} = $\{[],\, [a_3],\, [a_2],\, \unr\}$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   611
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   612
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   613
Because datatypes are approximated using a three-valued logic, there is usually
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   614
no need to systematically enumerate cardinalities: If Nitpick cannot find a
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   615
genuine counterexample for \textit{card}~$'a~\textit{list}$~= 10, it is very
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   616
unlikely that one could be found for smaller cardinalities.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   617
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   618
\subsection{Typedefs, Records, Rationals, and Reals}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   619
\label{typedefs-records-rationals-and-reals}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   620
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   621
Nitpick generally treats types declared using \textbf{typedef} as datatypes
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   622
whose single constructor is the corresponding \textit{Abs\_\kern.1ex} function.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   623
For example:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   624
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   625
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   626
\textbf{typedef}~\textit{three} = ``$\{0\Colon\textit{nat},\, 1,\, 2\}$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   627
\textbf{by}~\textit{blast} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   628
\textbf{definition}~$A \mathbin{\Colon} \textit{three}$ \textbf{where} ``\kern-.1em$A \,\equiv\, \textit{Abs\_\allowbreak three}~0$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   629
\textbf{definition}~$B \mathbin{\Colon} \textit{three}$ \textbf{where} ``$B \,\equiv\, \textit{Abs\_three}~1$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   630
\textbf{definition}~$C \mathbin{\Colon} \textit{three}$ \textbf{where} ``$C \,\equiv\, \textit{Abs\_three}~2$'' \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   631
\textbf{lemma} ``$\lbrakk P~A;\> P~B\rbrakk \,\Longrightarrow\, P~x$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   632
\textbf{nitpick} [\textit{show\_datatypes}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   633
\slshape Nitpick found a counterexample: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   634
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   635
\hbox{}\qquad\qquad $P = \{\Abs{1},\, \Abs{0}\}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   636
\hbox{}\qquad\qquad $x = \Abs{2}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   637
\hbox{}\qquad Datatypes: \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   638
\hbox{}\qquad\qquad $\textit{nat} = \{0,\, 1,\, 2,\, \unr\}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   639
\hbox{}\qquad\qquad $\textit{three} = \{\Abs{2},\, \Abs{1},\, \Abs{0},\, \unr\}$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   640
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   641
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   642
%% MARK
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   643
In the output above, $\Abs{n}$ abbreviates $\textit{Abs\_three}~n$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   644
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   645
%% MARK
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   646
Records, which are implemented as \textbf{typedef}s behind the scenes, are
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   647
handled in much the same way:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   648
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   649
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   650
\textbf{record} \textit{point} = \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   651
\hbox{}\quad $\textit{Xcoord} \mathbin{\Colon} \textit{int}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   652
\hbox{}\quad $\textit{Ycoord} \mathbin{\Colon} \textit{int}$ \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   653
\textbf{lemma} ``$\textit{Xcoord}~(p\Colon\textit{point}) = \textit{Xcoord}~(q\Colon\textit{point})$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   654
\textbf{nitpick} [\textit{show\_datatypes}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   655
\slshape Nitpick found a counterexample: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   656
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   657
\hbox{}\qquad\qquad $p = \lparr\textit{Xcoord} = 0,\> \textit{Ycoord} = 0\rparr$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   658
\hbox{}\qquad\qquad $q = \lparr\textit{Xcoord} = 1,\> \textit{Ycoord} = 1\rparr$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   659
\hbox{}\qquad Datatypes: \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   660
\hbox{}\qquad\qquad $\textit{int} = \{0,\, 1,\, \unr\}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   661
\hbox{}\qquad\qquad $\textit{point} = \{\lparr\textit{Xcoord} = 1,\>
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   662
\textit{Ycoord} = 1\rparr,\> \lparr\textit{Xcoord} = 0,\> \textit{Ycoord} = 0\rparr,\, \unr\}$\kern-1pt %% QUIET
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   663
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   664
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   665
Finally, Nitpick provides rudimentary support for rationals and reals using a
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   666
similar approach:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   667
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   668
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   669
\textbf{lemma} ``$4 * x + 3 * (y\Colon\textit{real}) \not= 1/2$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   670
\textbf{nitpick} [\textit{show\_datatypes}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   671
\slshape Nitpick found a counterexample: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   672
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   673
\hbox{}\qquad\qquad $x = 1/2$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   674
\hbox{}\qquad\qquad $y = -1/2$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   675
\hbox{}\qquad Datatypes: \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   676
\hbox{}\qquad\qquad $\textit{nat} = \{0,\, 1,\, 2,\, 3,\, 4,\, 5,\, 6,\, 7,\, \unr\}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   677
\hbox{}\qquad\qquad $\textit{int} = \{0,\, 1,\, 2,\, 3,\, 4,\, -3,\, -2,\, -1,\, \unr\}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   678
\hbox{}\qquad\qquad $\textit{real} = \{1,\, 0,\, 4,\, -3/2,\, 3,\, 2,\, 1/2,\, -1/2,\, \unr\}$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   679
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   680
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   681
\subsection{Inductive and Coinductive Predicates}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   682
\label{inductive-and-coinductive-predicates}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   683
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   684
Inductively defined predicates (and sets) are particularly problematic for
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   685
counterexample generators. They can make Quickcheck~\cite{berghofer-nipkow-2004}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   686
loop forever and Refute~\cite{weber-2008} run out of resources. The crux of
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   687
the problem is that they are defined using a least fixed point construction.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   688
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   689
Nitpick's philosophy is that not all inductive predicates are equal. Consider
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   690
the \textit{even} predicate below:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   691
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   692
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   693
\textbf{inductive}~\textit{even}~\textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   694
``\textit{even}~0'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   695
``\textit{even}~$n\,\Longrightarrow\, \textit{even}~(\textit{Suc}~(\textit{Suc}~n))$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   696
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   697
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   698
This predicate enjoys the desirable property of being well-founded, which means
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   699
that the introduction rules don't give rise to infinite chains of the form
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   700
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   701
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   702
$\cdots\,\Longrightarrow\, \textit{even}~k''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   703
       \,\Longrightarrow\, \textit{even}~k'
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   704
       \,\Longrightarrow\, \textit{even}~k.$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   705
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   706
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   707
For \textit{even}, this is obvious: Any chain ending at $k$ will be of length
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   708
$k/2 + 1$:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   709
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   710
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   711
$\textit{even}~0\,\Longrightarrow\, \textit{even}~2\,\Longrightarrow\, \cdots
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   712
       \,\Longrightarrow\, \textit{even}~(k - 2)
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   713
       \,\Longrightarrow\, \textit{even}~k.$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   714
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   715
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   716
Wellfoundedness is desirable because it enables Nitpick to use a very efficient
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   717
fixed point computation.%
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   718
\footnote{If an inductive predicate is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   719
well-founded, then it has exactly one fixed point, which is simultaneously the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   720
least and the greatest fixed point. In these circumstances, the computation of
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   721
the least fixed point amounts to the computation of an arbitrary fixed point,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   722
which can be performed using a straightforward recursive equation.}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   723
Moreover, Nitpick can prove wellfoundedness of most well-founded predicates,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   724
just as Isabelle's \textbf{function} package usually discharges termination
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   725
proof obligations automatically.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   726
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   727
Let's try an example:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   728
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   729
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   730
\textbf{lemma} ``$\exists n.\; \textit{even}~n \mathrel{\land} \textit{even}~(\textit{Suc}~n)$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   731
\textbf{nitpick}~[\textit{card nat}~= 100,\, \textit{verbose}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   732
\slshape The inductive predicate ``\textit{even}'' was proved well-founded.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   733
Nitpick can compute it efficiently. \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   734
Trying 1 scope: \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   735
\hbox{}\qquad \textit{card nat}~= 100. \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   736
Nitpick found a potential counterexample for \textit{card nat}~= 100: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   737
\hbox{}\qquad Empty assignment \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   738
Nitpick could not find a better counterexample. \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   739
Total time: 2274 ms.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   740
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   741
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   742
No genuine counterexample is possible because Nitpick cannot rule out the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   743
existence of a natural number $n \ge 100$ such that both $\textit{even}~n$ and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   744
$\textit{even}~(\textit{Suc}~n)$ are true. To help Nitpick, we can bound the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   745
existential quantifier:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   746
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   747
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   748
\textbf{lemma} ``$\exists n \mathbin{\le} 99.\; \textit{even}~n \mathrel{\land} \textit{even}~(\textit{Suc}~n)$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   749
\textbf{nitpick}~[\textit{card nat}~= 100] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   750
\slshape Nitpick found a counterexample: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   751
\hbox{}\qquad Empty assignment
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   752
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   753
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   754
So far we were blessed by the wellfoundedness of \textit{even}. What happens if
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   755
we use the following definition instead?
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   756
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   757
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   758
\textbf{inductive} $\textit{even}'$ \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   759
``$\textit{even}'~(0{\Colon}\textit{nat})$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   760
``$\textit{even}'~2$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   761
``$\lbrakk\textit{even}'~m;\> \textit{even}'~n\rbrakk \,\Longrightarrow\, \textit{even}'~(m + n)$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   762
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   763
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   764
This definition is not well-founded: From $\textit{even}'~0$ and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   765
$\textit{even}'~0$, we can derive that $\textit{even}'~0$. Nonetheless, the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   766
predicates $\textit{even}$ and $\textit{even}'$ are equivalent.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   767
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   768
Let's check a property involving $\textit{even}'$. To make up for the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   769
foreseeable computational hurdles entailed by non-wellfoundedness, we decrease
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   770
\textit{nat}'s cardinality to a mere 10:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   771
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   772
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   773
\textbf{lemma}~``$\exists n \in \{0, 2, 4, 6, 8\}.\;
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   774
\lnot\;\textit{even}'~n$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   775
\textbf{nitpick}~[\textit{card nat}~= 10,\, \textit{verbose},\, \textit{show\_consts}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   776
\slshape
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   777
The inductive predicate ``$\textit{even}'\!$'' could not be proved well-founded.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   778
Nitpick might need to unroll it. \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   779
Trying 6 scopes: \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   780
\hbox{}\qquad \textit{card nat}~= 10 and \textit{iter} $\textit{even}'$~= 0; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   781
\hbox{}\qquad \textit{card nat}~= 10 and \textit{iter} $\textit{even}'$~= 1; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   782
\hbox{}\qquad \textit{card nat}~= 10 and \textit{iter} $\textit{even}'$~= 2; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   783
\hbox{}\qquad \textit{card nat}~= 10 and \textit{iter} $\textit{even}'$~= 4; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   784
\hbox{}\qquad \textit{card nat}~= 10 and \textit{iter} $\textit{even}'$~= 8; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   785
\hbox{}\qquad \textit{card nat}~= 10 and \textit{iter} $\textit{even}'$~= 9. \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   786
Nitpick found a counterexample for \textit{card nat}~= 10 and \textit{iter} $\textit{even}'$~= 2: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   787
\hbox{}\qquad Constant: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   788
\hbox{}\qquad\qquad $\lambda i.\; \textit{even}'$ = $\undef(\!\begin{aligned}[t]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   789
& 2 := \{0, 2, 4, 6, 8, 1^\Q, 3^\Q, 5^\Q, 7^\Q, 9^\Q\}, \\[-2pt]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   790
& 1 := \{0, 2, 4, 1^\Q, 3^\Q, 5^\Q, 6^\Q, 7^\Q, 8^\Q, 9^\Q\}, \\[-2pt]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   791
& 0 := \{0, 2, 1^\Q, 3^\Q, 4^\Q, 5^\Q, 6^\Q, 7^\Q, 8^\Q, 9^\Q\})\end{aligned}$ \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   792
Total time: 1140 ms.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   793
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   794
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   795
Nitpick's output is very instructive. First, it tells us that the predicate is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   796
unrolled, meaning that it is computed iteratively from the empty set. Then it
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   797
lists six scopes specifying different bounds on the numbers of iterations:\ 0,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   798
1, 2, 4, 8, and~9.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   799
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   800
The output also shows how each iteration contributes to $\textit{even}'$. The
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   801
notation $\lambda i.\; \textit{even}'$ indicates that the value of the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   802
predicate depends on an iteration counter. Iteration 0 provides the basis
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   803
elements, $0$ and $2$. Iteration 1 contributes $4$ ($= 2 + 2$). Iteration 2
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   804
throws $6$ ($= 2 + 4 = 4 + 2$) and $8$ ($= 4 + 4$) into the mix. Further
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   805
iterations would not contribute any new elements.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   806
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   807
Some values are marked with superscripted question
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   808
marks~(`\lower.2ex\hbox{$^\Q$}'). These are the elements for which the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   809
predicate evaluates to $\unk$. Thus, $\textit{even}'$ evaluates to either
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   810
\textit{True} or $\unk$, never \textit{False}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   811
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   812
When unrolling a predicate, Nitpick tries 0, 1, 2, 4, 8, 12, 16, and 24
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   813
iterations. However, these numbers are bounded by the cardinality of the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   814
predicate's domain. With \textit{card~nat}~= 10, no more than 9 iterations are
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   815
ever needed to compute the value of a \textit{nat} predicate. You can specify
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   816
the number of iterations using the \textit{iter} option, as explained in
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   817
\S\ref{scope-of-search}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   818
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   819
In the next formula, $\textit{even}'$ occurs both positively and negatively:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   820
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   821
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   822
\textbf{lemma} ``$\textit{even}'~(n - 2) \,\Longrightarrow\, \textit{even}'~n$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   823
\textbf{nitpick} [\textit{card nat} = 10,\, \textit{show\_consts}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   824
\slshape Nitpick found a counterexample: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   825
\hbox{}\qquad Free variable: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   826
\hbox{}\qquad\qquad $n = 1$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   827
\hbox{}\qquad Constants: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   828
\hbox{}\qquad\qquad $\lambda i.\; \textit{even}'$ = $\undef(\!\begin{aligned}[t]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   829
& 0 := \{0, 2, 1^\Q, 3^\Q, 4^\Q, 5^\Q, 6^\Q, 7^\Q, 8^\Q, 9^\Q\})\end{aligned}$  \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   830
\hbox{}\qquad\qquad $\textit{even}' \subseteq \{0, 2, 4, 6, 8, \unr\}$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   831
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   832
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   833
Notice the special constraint $\textit{even}' \subseteq \{0,\, 2,\, 4,\, 6,\,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   834
8,\, \unr\}$ in the output, whose right-hand side represents an arbitrary
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   835
fixed point (not necessarily the least one). It is used to falsify
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   836
$\textit{even}'~n$. In contrast, the unrolled predicate is used to satisfy
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   837
$\textit{even}'~(n - 2)$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   838
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   839
Coinductive predicates are handled dually. For example:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   840
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   841
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   842
\textbf{coinductive} \textit{nats} \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   843
``$\textit{nats}~(x\Colon\textit{nat}) \,\Longrightarrow\, \textit{nats}~x$'' \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   844
\textbf{lemma} ``$\textit{nats} = \{0, 1, 2, 3, 4\}$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   845
\textbf{nitpick}~[\textit{card nat} = 10,\, \textit{show\_consts}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   846
\slshape Nitpick found a counterexample:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   847
\\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   848
\hbox{}\qquad Constants: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   849
\hbox{}\qquad\qquad $\lambda i.\; \textit{nats} = \undef(0 := \{\!\begin{aligned}[t]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   850
& 0^\Q, 1^\Q, 2^\Q, 3^\Q, 4^\Q, 5^\Q, 6^\Q, 7^\Q, 8^\Q, 9^\Q, \\[-2pt]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   851
& \unr\})\end{aligned}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   852
\hbox{}\qquad\qquad $nats \supseteq \{9, 5^\Q, 6^\Q, 7^\Q, 8^\Q, \unr\}$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   853
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   854
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   855
As a special case, Nitpick uses Kodkod's transitive closure operator to encode
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   856
negative occurrences of non-well-founded ``linear inductive predicates,'' i.e.,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   857
inductive predicates for which each the predicate occurs in at most one
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   858
assumption of each introduction rule. For example:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   859
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   860
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   861
\textbf{inductive} \textit{odd} \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   862
``$\textit{odd}~1$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   863
``$\lbrakk \textit{odd}~m;\>\, \textit{even}~n\rbrakk \,\Longrightarrow\, \textit{odd}~(m + n)$'' \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   864
\textbf{lemma}~``$\textit{odd}~n \,\Longrightarrow\, \textit{odd}~(n - 2)$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   865
\textbf{nitpick}~[\textit{card nat} = 10,\, \textit{show\_consts}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   866
\slshape Nitpick found a counterexample:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   867
\\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   868
\hbox{}\qquad Free variable: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   869
\hbox{}\qquad\qquad $n = 1$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   870
\hbox{}\qquad Constants: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   871
\hbox{}\qquad\qquad $\textit{even} = \{0, 2, 4, 6, 8, \unr\}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   872
\hbox{}\qquad\qquad $\textit{odd}_{\textsl{base}} = \{1, \unr\}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   873
\hbox{}\qquad\qquad $\textit{odd}_{\textsl{step}} = \!
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   874
\!\begin{aligned}[t]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   875
  & \{(0, 0), (0, 2), (0, 4), (0, 6), (0, 8), (1, 1), (1, 3), (1, 5), \\[-2pt]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   876
  & \phantom{\{} (1, 7), (1, 9), (2, 2), (2, 4), (2, 6), (2, 8), (3, 3),
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   877
       (3, 5), \\[-2pt]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   878
  & \phantom{\{} (3, 7), (3, 9), (4, 4), (4, 6), (4, 8), (5, 5), (5, 7), (5, 9), \\[-2pt]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   879
  & \phantom{\{} (6, 6), (6, 8), (7, 7), (7, 9), (8, 8), (9, 9), \unr\}\end{aligned}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   880
\hbox{}\qquad\qquad $\textit{odd} \subseteq \{1, 3, 5, 7, 9, 8^\Q, \unr\}$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   881
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   882
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   883
\noindent
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   884
In the output, $\textit{odd}_{\textrm{base}}$ represents the base elements and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   885
$\textit{odd}_{\textrm{step}}$ is a transition relation that computes new
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   886
elements from known ones. The set $\textit{odd}$ consists of all the values
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   887
reachable through the reflexive transitive closure of
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   888
$\textit{odd}_{\textrm{step}}$ starting with any element from
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   889
$\textit{odd}_{\textrm{base}}$, namely 1, 3, 5, 7, and 9. Using Kodkod's
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   890
transitive closure to encode linear predicates is normally either more thorough
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   891
or more efficient than unrolling (depending on the value of \textit{iter}), but
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   892
for those cases where it isn't you can disable it by passing the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   893
\textit{dont\_star\_linear\_preds} option.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   894
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   895
\subsection{Coinductive Datatypes}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   896
\label{coinductive-datatypes}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   897
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   898
While Isabelle regrettably lacks a high-level mechanism for defining coinductive
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   899
datatypes, the \textit{Coinductive\_List} theory provides a coinductive ``lazy
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   900
list'' datatype, $'a~\textit{llist}$, defined the hard way. Nitpick supports
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   901
these lazy lists seamlessly and provides a hook, described in
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   902
\S\ref{registration-of-coinductive-datatypes}, to register custom coinductive
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   903
datatypes.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   904
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   905
(Co)intuitively, a coinductive datatype is similar to an inductive datatype but
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   906
allows infinite objects. Thus, the infinite lists $\textit{ps}$ $=$ $[a, a, a,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   907
\ldots]$, $\textit{qs}$ $=$ $[a, b, a, b, \ldots]$, and $\textit{rs}$ $=$ $[0,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   908
1, 2, 3, \ldots]$ can be defined as lazy lists using the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   909
$\textit{LNil}\mathbin{\Colon}{'}a~\textit{llist}$ and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   910
$\textit{LCons}\mathbin{\Colon}{'}a \mathbin{\Rightarrow} {'}a~\textit{llist}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   911
\mathbin{\Rightarrow} {'}a~\textit{llist}$ constructors.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   912
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   913
Although it is otherwise no friend of infinity, Nitpick can find counterexamples
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   914
involving cyclic lists such as \textit{ps} and \textit{qs} above as well as
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   915
finite lists:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   916
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   917
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   918
\textbf{lemma} ``$\textit{xs} \not= \textit{LCons}~a~\textit{xs}$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   919
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   920
\slshape Nitpick found a counterexample for {\itshape card}~$'a$ = 1: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   921
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   922
\hbox{}\qquad\qquad $\textit{a} = a_1$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   923
\hbox{}\qquad\qquad $\textit{xs} = \textsl{THE}~\omega.\; \omega = \textit{LCons}~a_1~\omega$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   924
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   925
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   926
The notation $\textrm{THE}~\omega.\; \omega = t(\omega)$ stands
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   927
for the infinite term $t(t(t(\ldots)))$. Hence, \textit{xs} is simply the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   928
infinite list $[a_1, a_1, a_1, \ldots]$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   929
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   930
The next example is more interesting:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   931
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   932
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   933
\textbf{lemma}~``$\lbrakk\textit{xs} = \textit{LCons}~a~\textit{xs};\>\,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   934
\textit{ys} = \textit{iterates}~(\lambda b.\> a)~b\rbrakk \,\Longrightarrow\, \textit{xs} = \textit{ys}$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   935
\textbf{nitpick} [\textit{verbose}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   936
\slshape The type ``\kern1pt$'a$'' passed the monotonicity test. Nitpick might be able to skip
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   937
some scopes. \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   938
Trying 8 scopes: \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   939
\hbox{}\qquad \textit{card} $'a$~= 1, \textit{card} ``\kern1pt$'a~\textit{list}$''~= 1,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   940
and \textit{bisim\_depth}~= 0. \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   941
\hbox{}\qquad $\qquad\vdots$ \\[.5\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   942
\hbox{}\qquad \textit{card} $'a$~= 8, \textit{card} ``\kern1pt$'a~\textit{list}$''~= 8,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   943
and \textit{bisim\_depth}~= 7. \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   944
Nitpick found a counterexample for {\itshape card}~$'a$ = 2,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   945
\textit{card}~``\kern1pt$'a~\textit{list}$''~= 2, and \textit{bisim\_\allowbreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   946
depth}~= 1:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   947
\\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   948
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   949
\hbox{}\qquad\qquad $\textit{a} = a_2$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   950
\hbox{}\qquad\qquad $\textit{b} = a_1$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   951
\hbox{}\qquad\qquad $\textit{xs} = \textsl{THE}~\omega.\; \omega = \textit{LCons}~a_2~\omega$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   952
\hbox{}\qquad\qquad $\textit{ys} = \textit{LCons}~a_1~(\textsl{THE}~\omega.\; \omega = \textit{LCons}~a_2~\omega)$ \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   953
Total time: 726 ms.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   954
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   955
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   956
The lazy list $\textit{xs}$ is simply $[a_2, a_2, a_2, \ldots]$, whereas
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   957
$\textit{ys}$ is $[a_1, a_2, a_2, a_2, \ldots]$, i.e., a lasso-shaped list with
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   958
$[a_1]$ as its stem and $[a_2]$ as its cycle. In general, the list segment
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   959
within the scope of the {THE} binder corresponds to the lasso's cycle, whereas
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   960
the segment leading to the binder is the stem.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   961
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   962
A salient property of coinductive datatypes is that two objects are considered
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   963
equal if and only if they lead to the same observations. For example, the lazy
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   964
lists $\textrm{THE}~\omega.\; \omega =
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   965
\textit{LCons}~a~(\textit{LCons}~b~\omega)$ and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   966
$\textit{LCons}~a~(\textrm{THE}~\omega.\; \omega =
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   967
\textit{LCons}~b~(\textit{LCons}~a~\omega))$ are identical, because both lead
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   968
to the sequence of observations $a$, $b$, $a$, $b$, \hbox{\ldots} (or,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   969
equivalently, both encode the infinite list $[a, b, a, b, \ldots]$). This
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   970
concept of equality for coinductive datatypes is called bisimulation and is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   971
defined coinductively.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   972
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   973
Internally, Nitpick encodes the coinductive bisimilarity predicate as part of
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   974
the Kodkod problem to ensure that distinct objects lead to different
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   975
observations. This precaution is somewhat expensive and often unnecessary, so it
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   976
can be disabled by setting the \textit{bisim\_depth} option to $-1$. The
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   977
bisimilarity check is then performed \textsl{after} the counterexample has been
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   978
found to ensure correctness. If this after-the-fact check fails, the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   979
counterexample is tagged as ``likely genuine'' and Nitpick recommends to try
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   980
again with \textit{bisim\_depth} set to a nonnegative integer. Disabling the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   981
check for the previous example saves approximately 150~milli\-seconds; the speed
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   982
gains can be more significant for larger scopes.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   983
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   984
The next formula illustrates the need for bisimilarity (either as a Kodkod
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   985
predicate or as an after-the-fact check) to prevent spurious counterexamples:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   986
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   987
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   988
\textbf{lemma} ``$\lbrakk xs = \textit{LCons}~a~\textit{xs};\>\, \textit{ys} = \textit{LCons}~a~\textit{ys}\rbrakk
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   989
\,\Longrightarrow\, \textit{xs} = \textit{ys}$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   990
\textbf{nitpick} [\textit{bisim\_depth} = $-1$,\, \textit{show\_datatypes}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   991
\slshape Nitpick found a likely genuine counterexample for $\textit{card}~'a$ = 2: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   992
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   993
\hbox{}\qquad\qquad $a = a_2$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   994
\hbox{}\qquad\qquad $\textit{xs} = \textsl{THE}~\omega.\; \omega =
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   995
\textit{LCons}~a_2~\omega$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   996
\hbox{}\qquad\qquad $\textit{ys} = \textsl{THE}~\omega.\; \omega = \textit{LCons}~a_2~\omega$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   997
\hbox{}\qquad Codatatype:\strut \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   998
\hbox{}\qquad\qquad $'a~\textit{llist} =
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
   999
\{\!\begin{aligned}[t]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1000
  & \textsl{THE}~\omega.\; \omega = \textit{LCons}~a_2~\omega, \\[-2pt]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1001
  & \textsl{THE}~\omega.\; \omega = \textit{LCons}~a_2~\omega,\> \unr\}\end{aligned}$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1002
\\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1003
Try again with ``\textit{bisim\_depth}'' set to a nonnegative value to confirm
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1004
that the counterexample is genuine. \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1005
{\upshape\textbf{nitpick}} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1006
\slshape Nitpick found no counterexample.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1007
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1008
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1009
In the first \textbf{nitpick} invocation, the after-the-fact check discovered 
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1010
that the two known elements of type $'a~\textit{llist}$ are bisimilar.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1011
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1012
A compromise between leaving out the bisimilarity predicate from the Kodkod
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1013
problem and performing the after-the-fact check is to specify a lower
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1014
nonnegative \textit{bisim\_depth} value than the default one provided by
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1015
Nitpick. In general, a value of $K$ means that Nitpick will require all lists to
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1016
be distinguished from each other by their prefixes of length $K$. Be aware that
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1017
setting $K$ to a too low value can overconstrain Nitpick, preventing it from
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1018
finding any counterexamples.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1019
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1020
\subsection{Boxing}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1021
\label{boxing}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1022
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1023
Nitpick normally maps function and product types directly to the corresponding
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1024
Kodkod concepts. As a consequence, if $'a$ has cardinality 3 and $'b$ has
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1025
cardinality 4, then $'a \times {'}b$ has cardinality 12 ($= 4 \times 3$) and $'a
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1026
\Rightarrow {'}b$ has cardinality 64 ($= 4^3$). In some circumstances, it pays
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1027
off to treat these types in the same way as plain datatypes, by approximating
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1028
them by a subset of a given cardinality. This technique is called ``boxing'' and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1029
is particularly useful for functions passed as arguments to other functions, for
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1030
high-arity functions, and for large tuples. Under the hood, boxing involves
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1031
wrapping occurrences of the types $'a \times {'}b$ and $'a \Rightarrow {'}b$ in
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1032
isomorphic datatypes, as can be seen by enabling the \textit{debug} option.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1033
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1034
To illustrate boxing, we consider a formalization of $\lambda$-terms represented
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1035
using de Bruijn's notation:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1036
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1037
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1038
\textbf{datatype} \textit{tm} = \textit{Var}~\textit{nat}~$\mid$~\textit{Lam}~\textit{tm} $\mid$ \textit{App~tm~tm}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1039
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1040
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1041
The $\textit{lift}~t~k$ function increments all variables with indices greater
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1042
than or equal to $k$ by one:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1043
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1044
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1045
\textbf{primrec} \textit{lift} \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1046
``$\textit{lift}~(\textit{Var}~j)~k = \textit{Var}~(\textrm{if}~j < k~\textrm{then}~j~\textrm{else}~j + 1)$'' $\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1047
``$\textit{lift}~(\textit{Lam}~t)~k = \textit{Lam}~(\textit{lift}~t~(k + 1))$'' $\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1048
``$\textit{lift}~(\textit{App}~t~u)~k = \textit{App}~(\textit{lift}~t~k)~(\textit{lift}~u~k)$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1049
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1050
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1051
The $\textit{loose}~t~k$ predicate returns \textit{True} if and only if
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1052
term $t$ has a loose variable with index $k$ or more:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1053
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1054
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1055
\textbf{primrec}~\textit{loose} \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1056
``$\textit{loose}~(\textit{Var}~j)~k = (j \ge k)$'' $\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1057
``$\textit{loose}~(\textit{Lam}~t)~k = \textit{loose}~t~(\textit{Suc}~k)$'' $\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1058
``$\textit{loose}~(\textit{App}~t~u)~k = (\textit{loose}~t~k \mathrel{\lor} \textit{loose}~u~k)$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1059
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1060
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1061
Next, the $\textit{subst}~\sigma~t$ function applies the substitution $\sigma$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1062
on $t$:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1063
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1064
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1065
\textbf{primrec}~\textit{subst} \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1066
``$\textit{subst}~\sigma~(\textit{Var}~j) = \sigma~j$'' $\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1067
``$\textit{subst}~\sigma~(\textit{Lam}~t) = {}$\phantom{''} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1068
\phantom{``}$\textit{Lam}~(\textit{subst}~(\lambda n.\> \textrm{case}~n~\textrm{of}~0 \Rightarrow \textit{Var}~0 \mid \textit{Suc}~m \Rightarrow \textit{lift}~(\sigma~m)~1)~t)$'' $\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1069
``$\textit{subst}~\sigma~(\textit{App}~t~u) = \textit{App}~(\textit{subst}~\sigma~t)~(\textit{subst}~\sigma~u)$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1070
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1071
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1072
A substitution is a function that maps variable indices to terms. Observe that
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1073
$\sigma$ is a function passed as argument and that Nitpick can't optimize it
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1074
away, because the recursive call for the \textit{Lam} case involves an altered
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1075
version. Also notice the \textit{lift} call, which increments the variable
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1076
indices when moving under a \textit{Lam}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1077
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1078
A reasonable property to expect of substitution is that it should leave closed
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1079
terms unchanged. Alas, even this simple property does not hold:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1080
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1081
\pre
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1082
\textbf{lemma}~``$\lnot\,\textit{loose}~t~0 \,\Longrightarrow\, \textit{subst}~\sigma~t = t$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1083
\textbf{nitpick} [\textit{verbose}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1084
\slshape
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1085
Trying 8 scopes: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1086
\hbox{}\qquad \textit{card~nat}~= 1, \textit{card tm}~= 1, and \textit{card} ``$\textit{nat} \Rightarrow \textit{tm}$'' = 1; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1087
\hbox{}\qquad \textit{card~nat}~= 2, \textit{card tm}~= 2, and \textit{card} ``$\textit{nat} \Rightarrow \textit{tm}$'' = 2; \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1088
\hbox{}\qquad $\qquad\vdots$ \\[.5\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1089
\hbox{}\qquad \textit{card~nat}~= 8, \textit{card tm}~= 8, and \textit{card} ``$\textit{nat} \Rightarrow \textit{tm}$'' = 8. \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1090
Nitpick found a counterexample for \textit{card~nat}~= 6, \textit{card~tm}~= 6,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1091
and \textit{card}~``$\textit{nat} \Rightarrow \textit{tm}$''~= 6: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1092
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1093
\hbox{}\qquad\qquad $\sigma = \undef(\!\begin{aligned}[t]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1094
& 0 := \textit{Var}~0,\>
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1095
  1 := \textit{Var}~0,\>
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1096
  2 := \textit{Var}~0, \\[-2pt]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1097
& 3 := \textit{Var}~0,\>
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1098
  4 := \textit{Var}~0,\>
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1099
  5 := \textit{Var}~0)\end{aligned}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1100
\hbox{}\qquad\qquad $t = \textit{Lam}~(\textit{Lam}~(\textit{Var}~1))$ \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1101
Total time: $4679$ ms.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1102
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1103
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1104
Using \textit{eval}, we find out that $\textit{subst}~\sigma~t =
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1105
\textit{Lam}~(\textit{Lam}~(\textit{Var}~0))$. Using the traditional
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1106
$\lambda$-term notation, $t$~is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1107
$\lambda x\, y.\> x$ whereas $\textit{subst}~\sigma~t$ is $\lambda x\, y.\> y$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1108
The bug is in \textit{subst}: The $\textit{lift}~(\sigma~m)~1$ call should be
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1109
replaced with $\textit{lift}~(\sigma~m)~0$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1110
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1111
An interesting aspect of Nitpick's verbose output is that it assigned inceasing
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1112
cardinalities from 1 to 8 to the type $\textit{nat} \Rightarrow \textit{tm}$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1113
For the formula of interest, knowing 6 values of that type was enough to find
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1114
the counterexample. Without boxing, $46\,656$ ($= 6^6$) values must be
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1115
considered, a hopeless undertaking:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1116
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1117
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1118
\textbf{nitpick} [\textit{dont\_box}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1119
{\slshape Nitpick ran out of time after checking 4 of 8 scopes.}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1120
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1121
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1122
{\looseness=-1
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1123
Boxing can be enabled or disabled globally or on a per-type basis using the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1124
\textit{box} option. Moreover, setting the cardinality of a function or
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1125
product type implicitly enables boxing for that type. Nitpick usually performs
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1126
reasonable choices about which types should be boxed, but option tweaking
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1127
sometimes helps.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1128
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1129
}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1130
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1131
\subsection{Scope Monotonicity}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1132
\label{scope-monotonicity}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1133
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1134
The \textit{card} option (together with \textit{iter}, \textit{bisim\_depth},
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1135
and \textit{max}) controls which scopes are actually tested. In general, to
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1136
exhaust all models below a certain cardinality bound, the number of scopes that
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1137
Nitpick must consider increases exponentially with the number of type variables
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1138
(and \textbf{typedecl}'d types) occurring in the formula. Given the default
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1139
cardinality specification of 1--8, no fewer than $8^4 = 4096$ scopes must be
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1140
considered for a formula involving $'a$, $'b$, $'c$, and $'d$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1141
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1142
Fortunately, many formulas exhibit a property called \textsl{scope
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1143
monotonicity}, meaning that if the formula is falsifiable for a given scope,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1144
it is also falsifiable for all larger scopes \cite[p.~165]{jackson-2006}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1145
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1146
Consider the formula
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1147
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1148
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1149
\textbf{lemma}~``$\textit{length~xs} = \textit{length~ys} \,\Longrightarrow\, \textit{rev}~(\textit{zip~xs~ys}) = \textit{zip~xs}~(\textit{rev~ys})$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1150
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1151
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1152
where \textit{xs} is of type $'a~\textit{list}$ and \textit{ys} is of type
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1153
$'b~\textit{list}$. A priori, Nitpick would need to consider 512 scopes to
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1154
exhaust the specification \textit{card}~= 1--8. However, our intuition tells us
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1155
that any counterexample found with a small scope would still be a counterexample
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1156
in a larger scope---by simply ignoring the fresh $'a$ and $'b$ values provided
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1157
by the larger scope. Nitpick comes to the same conclusion after a careful
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1158
inspection of the formula and the relevant definitions:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1159
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1160
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1161
\textbf{nitpick}~[\textit{verbose}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1162
\slshape
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1163
The types ``\kern1pt$'a$'' and ``\kern1pt$'b$'' passed the monotonicity test.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1164
Nitpick might be able to skip some scopes.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1165
 \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1166
Trying 8 scopes: \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1167
\hbox{}\qquad \textit{card} $'a$~= 1, \textit{card} $'b$~= 1,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1168
\textit{card} \textit{nat}~= 1, \textit{card} ``$('a \times {'}b)$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1169
\textit{list}''~= 1, \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1170
\hbox{}\qquad\quad \textit{card} ``\kern1pt$'a$ \textit{list}''~= 1, and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1171
\textit{card} ``\kern1pt$'b$ \textit{list}''~= 1. \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1172
\hbox{}\qquad \textit{card} $'a$~= 2, \textit{card} $'b$~= 2,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1173
\textit{card} \textit{nat}~= 2, \textit{card} ``$('a \times {'}b)$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1174
\textit{list}''~= 2, \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1175
\hbox{}\qquad\quad \textit{card} ``\kern1pt$'a$ \textit{list}''~= 2, and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1176
\textit{card} ``\kern1pt$'b$ \textit{list}''~= 2. \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1177
\hbox{}\qquad $\qquad\vdots$ \\[.5\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1178
\hbox{}\qquad \textit{card} $'a$~= 8, \textit{card} $'b$~= 8,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1179
\textit{card} \textit{nat}~= 8, \textit{card} ``$('a \times {'}b)$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1180
\textit{list}''~= 8, \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1181
\hbox{}\qquad\quad \textit{card} ``\kern1pt$'a$ \textit{list}''~= 8, and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1182
\textit{card} ``\kern1pt$'b$ \textit{list}''~= 8.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1183
\\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1184
Nitpick found a counterexample for
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1185
\textit{card} $'a$~= 5, \textit{card} $'b$~= 5,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1186
\textit{card} \textit{nat}~= 5, \textit{card} ``$('a \times {'}b)$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1187
\textit{list}''~= 5, \textit{card} ``\kern1pt$'a$ \textit{list}''~= 5, and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1188
\textit{card} ``\kern1pt$'b$ \textit{list}''~= 5:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1189
\\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1190
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1191
\hbox{}\qquad\qquad $\textit{xs} = [a_4, a_5]$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1192
\hbox{}\qquad\qquad $\textit{ys} = [b_3, b_3]$ \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1193
Total time: 1636 ms.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1194
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1195
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1196
In theory, it should be sufficient to test a single scope:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1197
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1198
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1199
\textbf{nitpick}~[\textit{card}~= 8]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1200
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1201
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1202
However, this is often less efficient in practice and may lead to overly complex
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1203
counterexamples.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1204
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1205
If the monotonicity check fails but we believe that the formula is monotonic (or
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1206
we don't mind missing some counterexamples), we can pass the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1207
\textit{mono} option. To convince yourself that this option is risky,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1208
simply consider this example from \S\ref{skolemization}:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1209
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1210
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1211
\textbf{lemma} ``$\exists g.\; \forall x\Colon 'b.~g~(f~x) = x
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1212
 \,\Longrightarrow\, \forall y\Colon {'}a.\; \exists x.~y = f~x$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1213
\textbf{nitpick} [\textit{mono}] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1214
{\slshape Nitpick found no counterexample.} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1215
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1216
\slshape
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1217
Nitpick found a counterexample for \textit{card} $'a$~= 2 and \textit{card} $'b$~=~1: \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1218
\hbox{}\qquad $\vdots$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1219
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1220
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1221
(It turns out the formula holds if and only if $\textit{card}~'a \le
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1222
\textit{card}~'b$.) Although this is rarely advisable, the automatic
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1223
monotonicity checks can be disabled by passing \textit{non\_mono}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1224
(\S\ref{optimizations}).
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1225
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1226
As insinuated in \S\ref{natural-numbers-and-integers} and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1227
\S\ref{inductive-datatypes}, \textit{nat}, \textit{int}, and inductive datatypes
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1228
are normally monotonic and treated as such. The same is true for record types,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1229
\textit{rat}, \textit{real}, and some \textbf{typedef}'d types. Thus, given the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1230
cardinality specification 1--8, a formula involving \textit{nat}, \textit{int},
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1231
\textit{int~list}, \textit{rat}, and \textit{rat~list} will lead Nitpick to
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1232
consider only 8~scopes instead of $32\,768$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1233
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1234
\section{Case Studies}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1235
\label{case-studies}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1236
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1237
As a didactic device, the previous section focused mostly on toy formulas whose
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1238
validity can easily be assessed just by looking at the formula. We will now
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1239
review two somewhat more realistic case studies that are within Nitpick's
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1240
reach:\ a context-free grammar modeled by mutually inductive sets and a
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1241
functional implementation of AA trees. The results presented in this
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1242
section were produced with the following settings:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1243
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1244
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1245
\textbf{nitpick\_params} [\textit{max\_potential}~= 0,\, \textit{max\_threads} = 2]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1246
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1247
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1248
\subsection{A Context-Free Grammar}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1249
\label{a-context-free-grammar}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1250
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1251
Our first case study is taken from section 7.4 in the Isabelle tutorial
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1252
\cite{isa-tutorial}. The following grammar, originally due to Hopcroft and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1253
Ullman, produces all strings with an equal number of $a$'s and $b$'s:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1254
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1255
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1256
\begin{tabular}{@{}r@{$\;\,$}c@{$\;\,$}l@{}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1257
$S$ & $::=$ & $\epsilon \mid bA \mid aB$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1258
$A$ & $::=$ & $aS \mid bAA$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1259
$B$ & $::=$ & $bS \mid aBB$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1260
\end{tabular}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1261
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1262
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1263
The intuition behind the grammar is that $A$ generates all string with one more
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1264
$a$ than $b$'s and $B$ generates all strings with one more $b$ than $a$'s.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1265
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1266
The alphabet consists exclusively of $a$'s and $b$'s:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1267
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1268
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1269
\textbf{datatype} \textit{alphabet}~= $a$ $\mid$ $b$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1270
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1271
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1272
Strings over the alphabet are represented by \textit{alphabet list}s.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1273
Nonterminals in the grammar become sets of strings. The production rules
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1274
presented above can be expressed as a mutually inductive definition:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1275
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1276
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1277
\textbf{inductive\_set} $S$ \textbf{and} $A$ \textbf{and} $B$ \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1278
\textit{R1}:\kern.4em ``$[] \in S$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1279
\textit{R2}:\kern.4em ``$w \in A\,\Longrightarrow\, b \mathbin{\#} w \in S$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1280
\textit{R3}:\kern.4em ``$w \in B\,\Longrightarrow\, a \mathbin{\#} w \in S$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1281
\textit{R4}:\kern.4em ``$w \in S\,\Longrightarrow\, a \mathbin{\#} w \in A$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1282
\textit{R5}:\kern.4em ``$w \in S\,\Longrightarrow\, b \mathbin{\#} w \in S$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1283
\textit{R6}:\kern.4em ``$\lbrakk v \in B;\> v \in B\rbrakk \,\Longrightarrow\, a \mathbin{\#} v \mathbin{@} w \in B$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1284
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1285
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1286
The conversion of the grammar into the inductive definition was done manually by
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1287
Joe Blow, an underpaid undergraduate student. As a result, some errors might
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1288
have sneaked in.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1289
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1290
Debugging faulty specifications is at the heart of Nitpick's \textsl{raison
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1291
d'\^etre}. A good approach is to state desirable properties of the specification
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1292
(here, that $S$ is exactly the set of strings over $\{a, b\}$ with as many $a$'s
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1293
as $b$'s) and check them with Nitpick. If the properties are correctly stated,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1294
counterexamples will point to bugs in the specification. For our grammar
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1295
example, we will proceed in two steps, separating the soundness and the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1296
completeness of the set $S$. First, soundness:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1297
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1298
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1299
\textbf{theorem}~\textit{S\_sound}: \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1300
``$w \in S \longrightarrow \textit{length}~[x\mathbin{\leftarrow} w.\; x = a] =
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1301
  \textit{length}~[x\mathbin{\leftarrow} w.\; x = b]$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1302
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1303
\slshape Nitpick found a counterexample: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1304
\hbox{}\qquad Free variable: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1305
\hbox{}\qquad\qquad $w = [b]$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1306
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1307
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1308
It would seem that $[b] \in S$. How could this be? An inspection of the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1309
introduction rules reveals that the only rule with a right-hand side of the form
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1310
$b \mathbin{\#} {\ldots} \in S$ that could have introduced $[b]$ into $S$ is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1311
\textit{R5}:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1312
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1313
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1314
``$w \in S\,\Longrightarrow\, b \mathbin{\#} w \in S$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1315
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1316
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1317
On closer inspection, we can see that this rule is wrong. To match the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1318
production $B ::= bS$, the second $S$ should be a $B$. We fix the typo and try
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1319
again:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1320
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1321
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1322
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1323
\slshape Nitpick found a counterexample: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1324
\hbox{}\qquad Free variable: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1325
\hbox{}\qquad\qquad $w = [a, a, b]$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1326
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1327
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1328
Some detective work is necessary to find out what went wrong here. To get $[a,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1329
a, b] \in S$, we need $[a, b] \in B$ by \textit{R3}, which in turn can only come
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1330
from \textit{R6}:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1331
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1332
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1333
``$\lbrakk v \in B;\> v \in B\rbrakk \,\Longrightarrow\, a \mathbin{\#} v \mathbin{@} w \in B$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1334
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1335
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1336
Now, this formula must be wrong: The same assumption occurs twice, and the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1337
variable $w$ is unconstrained. Clearly, one of the two occurrences of $v$ in
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1338
the assumptions should have been a $w$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1339
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1340
With the correction made, we don't get any counterexample from Nitpick. Let's
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1341
move on and check completeness:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1342
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1343
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1344
\textbf{theorem}~\textit{S\_complete}: \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1345
``$\textit{length}~[x\mathbin{\leftarrow} w.\; x = a] =
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1346
   \textit{length}~[x\mathbin{\leftarrow} w.\; x = b]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1347
  \longrightarrow w \in S$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1348
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1349
\slshape Nitpick found a counterexample: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1350
\hbox{}\qquad Free variable: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1351
\hbox{}\qquad\qquad $w = [b, b, a, a]$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1352
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1353
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1354
Apparently, $[b, b, a, a] \notin S$, even though it has the same numbers of
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1355
$a$'s and $b$'s. But since our inductive definition passed the soundness check,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1356
the introduction rules we have are probably correct. Perhaps we simply lack an
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1357
introduction rule. Comparing the grammar with the inductive definition, our
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1358
suspicion is confirmed: Joe Blow simply forgot the production $A ::= bAA$,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1359
without which the grammar cannot generate two or more $b$'s in a row. So we add
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1360
the rule
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1361
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1362
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1363
``$\lbrakk v \in A;\> w \in A\rbrakk \,\Longrightarrow\, b \mathbin{\#} v \mathbin{@} w \in A$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1364
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1365
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1366
With this last change, we don't get any counterexamples from Nitpick for either
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1367
soundness or completeness. We can even generalize our result to cover $A$ and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1368
$B$ as well:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1369
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1370
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1371
\textbf{theorem} \textit{S\_A\_B\_sound\_and\_complete}: \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1372
``$w \in S \longleftrightarrow \textit{length}~[x \mathbin{\leftarrow} w.\; x = a] = \textit{length}~[x \mathbin{\leftarrow} w.\; x = b]$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1373
``$w \in A \longleftrightarrow \textit{length}~[x \mathbin{\leftarrow} w.\; x = a] = \textit{length}~[x \mathbin{\leftarrow} w.\; x = b] + 1$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1374
``$w \in B \longleftrightarrow \textit{length}~[x \mathbin{\leftarrow} w.\; x = b] = \textit{length}~[x \mathbin{\leftarrow} w.\; x = a] + 1$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1375
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1376
\slshape Nitpick found no counterexample.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1377
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1378
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1379
\subsection{AA Trees}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1380
\label{aa-trees}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1381
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1382
AA trees are a kind of balanced trees discovered by Arne Andersson that provide
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1383
similar performance to red-black trees, but with a simpler implementation
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1384
\cite{andersson-1993}. They can be used to store sets of elements equipped with
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1385
a total order $<$. We start by defining the datatype and some basic extractor
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1386
functions:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1387
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1388
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1389
\textbf{datatype} $'a$~\textit{tree} = $\Lambda$ $\mid$ $N$ ``\kern1pt$'a\Colon \textit{linorder}$'' \textit{nat} ``\kern1pt$'a$ \textit{tree}'' ``\kern1pt$'a$ \textit{tree}''  \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1390
\textbf{primrec} \textit{data} \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1391
``$\textit{data}~\Lambda = \undef$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1392
``$\textit{data}~(N~x~\_~\_~\_) = x$'' \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1393
\textbf{primrec} \textit{dataset} \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1394
``$\textit{dataset}~\Lambda = \{\}$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1395
``$\textit{dataset}~(N~x~\_~t~u) = \{x\} \cup \textit{dataset}~t \mathrel{\cup} \textit{dataset}~u$'' \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1396
\textbf{primrec} \textit{level} \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1397
``$\textit{level}~\Lambda = 0$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1398
``$\textit{level}~(N~\_~k~\_~\_) = k$'' \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1399
\textbf{primrec} \textit{left} \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1400
``$\textit{left}~\Lambda = \Lambda$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1401
``$\textit{left}~(N~\_~\_~t~\_) = t$'' \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1402
\textbf{primrec} \textit{right} \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1403
``$\textit{right}~\Lambda = \Lambda$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1404
``$\textit{right}~(N~\_~\_~\_~u) = u$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1405
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1406
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1407
The wellformedness criterion for AA trees is fairly complex. Wikipedia states it
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1408
as follows \cite{wikipedia-2009-aa-trees}:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1409
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1410
\kern.2\parskip %% TYPESETTING
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1411
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1412
\pre
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1413
Each node has a level field, and the following invariants must remain true for
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1414
the tree to be valid:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1415
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1416
\raggedright
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1417
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1418
\kern-.4\parskip %% TYPESETTING
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1419
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1420
\begin{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1421
\item[]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1422
\begin{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1423
\item[1.] The level of a leaf node is one.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1424
\item[2.] The level of a left child is strictly less than that of its parent.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1425
\item[3.] The level of a right child is less than or equal to that of its parent.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1426
\item[4.] The level of a right grandchild is strictly less than that of its grandparent.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1427
\item[5.] Every node of level greater than one must have two children.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1428
\end{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1429
\end{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1430
\post
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1431
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1432
\kern.4\parskip %% TYPESETTING
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1433
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1434
The \textit{wf} predicate formalizes this description:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1435
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1436
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1437
\textbf{primrec} \textit{wf} \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1438
``$\textit{wf}~\Lambda = \textit{True}$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1439
``$\textit{wf}~(N~\_~k~t~u) =$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1440
\phantom{``}$(\textrm{if}~t = \Lambda~\textrm{then}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1441
\phantom{``$(\quad$}$k = 1 \mathrel{\land} (u = \Lambda \mathrel{\lor} (\textit{level}~u = 1 \mathrel{\land} \textit{left}~u = \Lambda \mathrel{\land} \textit{right}~u = \Lambda))$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1442
\phantom{``$($}$\textrm{else}$ \\
33193
6f6baa3ef4dd wrap line correctly in Nitpick documentation
blanchet
parents: 33191
diff changeset
  1443
\hbox{}\phantom{``$(\quad$}$\textit{wf}~t \mathrel{\land} \textit{wf}~u
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1444
\mathrel{\land} u \not= \Lambda \mathrel{\land} \textit{level}~t < k
33193
6f6baa3ef4dd wrap line correctly in Nitpick documentation
blanchet
parents: 33191
diff changeset
  1445
\mathrel{\land} \textit{level}~u \le k$ \\
6f6baa3ef4dd wrap line correctly in Nitpick documentation
blanchet
parents: 33191
diff changeset
  1446
\hbox{}\phantom{``$(\quad$}${\land}\; \textit{level}~(\textit{right}~u) < k)$''
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1447
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1448
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1449
Rebalancing the tree upon insertion and removal of elements is performed by two
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1450
auxiliary functions called \textit{skew} and \textit{split}, defined below:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1451
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1452
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1453
\textbf{primrec} \textit{skew} \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1454
``$\textit{skew}~\Lambda = \Lambda$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1455
``$\textit{skew}~(N~x~k~t~u) = {}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1456
\phantom{``}$(\textrm{if}~t \not= \Lambda \mathrel{\land} k =
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1457
\textit{level}~t~\textrm{then}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1458
\phantom{``(\quad}$N~(\textit{data}~t)~k~(\textit{left}~t)~(N~x~k~
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1459
(\textit{right}~t)~u)$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1460
\phantom{``(}$\textrm{else}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1461
\phantom{``(\quad}$N~x~k~t~u)$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1462
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1463
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1464
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1465
\textbf{primrec} \textit{split} \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1466
``$\textit{split}~\Lambda = \Lambda$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1467
``$\textit{split}~(N~x~k~t~u) = {}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1468
\phantom{``}$(\textrm{if}~u \not= \Lambda \mathrel{\land} k =
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1469
\textit{level}~(\textit{right}~u)~\textrm{then}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1470
\phantom{``(\quad}$N~(\textit{data}~u)~(\textit{Suc}~k)~
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1471
(N~x~k~t~(\textit{left}~u))~(\textit{right}~u)$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1472
\phantom{``(}$\textrm{else}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1473
\phantom{``(\quad}$N~x~k~t~u)$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1474
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1475
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1476
Performing a \textit{skew} or a \textit{split} should have no impact on the set
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1477
of elements stored in the tree:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1478
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1479
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1480
\textbf{theorem}~\textit{dataset\_skew\_split}:\\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1481
``$\textit{dataset}~(\textit{skew}~t) = \textit{dataset}~t$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1482
``$\textit{dataset}~(\textit{split}~t) = \textit{dataset}~t$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1483
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1484
{\slshape Nitpick ran out of time after checking 7 of 8 scopes.}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1485
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1486
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1487
Furthermore, applying \textit{skew} or \textit{split} to a well-formed tree
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1488
should not alter the tree:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1489
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1490
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1491
\textbf{theorem}~\textit{wf\_skew\_split}:\\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1492
``$\textit{wf}~t\,\Longrightarrow\, \textit{skew}~t = t$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1493
``$\textit{wf}~t\,\Longrightarrow\, \textit{split}~t = t$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1494
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1495
{\slshape Nitpick found no counterexample.}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1496
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1497
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1498
Insertion is implemented recursively. It preserves the sort order:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1499
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1500
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1501
\textbf{primrec}~\textit{insort} \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1502
``$\textit{insort}~\Lambda~x = N~x~1~\Lambda~\Lambda$'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1503
``$\textit{insort}~(N~y~k~t~u)~x =$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1504
\phantom{``}$({*}~(\textit{split} \circ \textit{skew})~{*})~(N~y~k~(\textrm{if}~x < y~\textrm{then}~\textit{insort}~t~x~\textrm{else}~t)$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1505
\phantom{``$({*}~(\textit{split} \circ \textit{skew})~{*})~(N~y~k~$}$(\textrm{if}~x > y~\textrm{then}~\textit{insort}~u~x~\textrm{else}~u))$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1506
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1507
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1508
Notice that we deliberately commented out the application of \textit{skew} and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1509
\textit{split}. Let's see if this causes any problems:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1510
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1511
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1512
\textbf{theorem}~\textit{wf\_insort}:\kern.4em ``$\textit{wf}~t\,\Longrightarrow\, \textit{wf}~(\textit{insort}~t~x)$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1513
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1514
\slshape Nitpick found a counterexample for \textit{card} $'a$ = 4: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1515
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1516
\hbox{}\qquad\qquad $t = N~a_3~1~\Lambda~\Lambda$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1517
\hbox{}\qquad\qquad $x = a_4$ \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1518
Hint: Maybe you forgot a type constraint?
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1519
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1520
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1521
It's hard to see why this is a counterexample. The hint is of no help here. To
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1522
improve readability, we will restrict the theorem to \textit{nat}, so that we
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1523
don't need to look up the value of the $\textit{op}~{<}$ constant to find out
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1524
which element is smaller than the other. In addition, we will tell Nitpick to
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1525
display the value of $\textit{insort}~t~x$ using the \textit{eval} option. This
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1526
gives
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1527
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1528
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1529
\textbf{theorem} \textit{wf\_insort\_nat}:\kern.4em ``$\textit{wf}~t\,\Longrightarrow\, \textit{wf}~(\textit{insort}~t~(x\Colon\textit{nat}))$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1530
\textbf{nitpick} [\textit{eval} = ``$\textit{insort}~t~x$''] \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1531
\slshape Nitpick found a counterexample: \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1532
\hbox{}\qquad Free variables: \nopagebreak \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1533
\hbox{}\qquad\qquad $t = N~1~1~\Lambda~\Lambda$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1534
\hbox{}\qquad\qquad $x = 0$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1535
\hbox{}\qquad Evaluated term: \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1536
\hbox{}\qquad\qquad $\textit{insort}~t~x = N~1~1~(N~0~1~\Lambda~\Lambda)~\Lambda$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1537
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1538
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1539
Nitpick's output reveals that the element $0$ was added as a left child of $1$,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1540
where both have a level of 1. This violates the second AA tree invariant, which
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1541
states that a left child's level must be less than its parent's. This shouldn't
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1542
come as a surprise, considering that we commented out the tree rebalancing code.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1543
Reintroducing the code seems to solve the problem:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1544
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1545
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1546
\textbf{theorem}~\textit{wf\_insort}:\kern.4em ``$\textit{wf}~t\,\Longrightarrow\, \textit{wf}~(\textit{insort}~t~x)$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1547
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1548
{\slshape Nitpick ran out of time after checking 6 of 8 scopes.}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1549
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1550
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1551
Insertion should transform the set of elements represented by the tree in the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1552
obvious way:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1553
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1554
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1555
\textbf{theorem} \textit{dataset\_insort}:\kern.4em
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1556
``$\textit{dataset}~(\textit{insort}~t~x) = \{x\} \cup \textit{dataset}~t$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1557
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1558
{\slshape Nitpick ran out of time after checking 5 of 8 scopes.}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1559
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1560
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1561
We could continue like this and sketch a complete theory of AA trees without
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1562
performing a single proof. Once the definitions and main theorems are in place
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1563
and have been thoroughly tested using Nitpick, we could start working on the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1564
proofs. Developing theories this way usually saves time, because faulty theorems
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1565
and definitions are discovered much earlier in the process.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1566
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1567
\section{Option Reference}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1568
\label{option-reference}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1569
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1570
\def\flushitem#1{\item[]\noindent\kern-\leftmargin \textbf{#1}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1571
\def\qty#1{$\left<\textit{#1}\right>$}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1572
\def\qtybf#1{$\mathbf{\left<\textbf{\textit{#1}}\right>}$}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1573
\def\optrue#1#2{\flushitem{\textit{#1} $\bigl[$= \qtybf{bool}$\bigr]$\quad [\textit{true}]\hfill (neg.: \textit{#2})}\nopagebreak\\[\parskip]}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1574
\def\opfalse#1#2{\flushitem{\textit{#1} $\bigl[$= \qtybf{bool}$\bigr]$\quad [\textit{false}]\hfill (neg.: \textit{#2})}\nopagebreak\\[\parskip]}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1575
\def\opsmart#1#2{\flushitem{\textit{#1} $\bigl[$= \qtybf{bool\_or\_smart}$\bigr]$\quad [\textit{smart}]\hfill (neg.: \textit{#2})}\nopagebreak\\[\parskip]}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1576
\def\ops#1#2{\flushitem{\textit{#1} = \qtybf{#2}} \nopagebreak\\[\parskip]}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1577
\def\opt#1#2#3{\flushitem{\textit{#1} = \qtybf{#2}\quad [\textit{#3}]} \nopagebreak\\[\parskip]}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1578
\def\opu#1#2#3{\flushitem{\textit{#1} \qtybf{#2} = \qtybf{#3}} \nopagebreak\\[\parskip]}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1579
\def\opusmart#1#2#3{\flushitem{\textit{#1} \qtybf{#2} $\bigl[$= \qtybf{bool\_or\_smart}$\bigr]$\hfill (neg.: \textit{#3})}\nopagebreak\\[\parskip]}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1580
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1581
Nitpick's behavior can be influenced by various options, which can be specified
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1582
in brackets after the \textbf{nitpick} command. Default values can be set
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1583
using \textbf{nitpick\_\allowbreak params}. For example:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1584
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1585
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1586
\textbf{nitpick\_params} [\textit{verbose}, \,\textit{timeout} = 60$\,s$]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1587
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1588
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1589
The options are categorized as follows:\ mode of operation
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1590
(\S\ref{mode-of-operation}), scope of search (\S\ref{scope-of-search}), output
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1591
format (\S\ref{output-format}), automatic counterexample checks
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1592
(\S\ref{authentication}), optimizations
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1593
(\S\ref{optimizations}), and timeouts (\S\ref{timeouts}).
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1594
33561
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1595
You can instruct Nitpick to run automatically on newly entered theorems by
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1596
enabling the ``Auto Nitpick'' option from the ``Isabelle'' menu in Proof
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1597
General. For automatic runs, \textit{user\_axioms} (\S\ref{mode-of-operation})
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1598
and \textit{assms} (\S\ref{mode-of-operation}) are implicitly enabled,
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1599
\textit{blocking} (\S\ref{mode-of-operation}), \textit{verbose}
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1600
(\S\ref{output-format}), and \textit{debug} (\S\ref{output-format}) are
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1601
disabled, \textit{max\_potential} (\S\ref{output-format}) is taken to be 0, and
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1602
\textit{timeout} (\S\ref{timeouts}) is superseded by the ``Auto Counterexample
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1603
Time Limit'' in Proof General's ``Isabelle'' menu. Nitpick's output is also more
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1604
concise.
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1605
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1606
The number of options can be overwhelming at first glance. Do not let that worry
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1607
you: Nitpick's defaults have been chosen so that it almost always does the right
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1608
thing, and the most important options have been covered in context in
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1609
\S\ref{first-steps}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1610
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1611
The descriptions below refer to the following syntactic quantities:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1612
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1613
\begin{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1614
\item[$\bullet$] \qtybf{string}: A string.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1615
\item[$\bullet$] \qtybf{bool}: \textit{true} or \textit{false}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1616
\item[$\bullet$] \qtybf{bool\_or\_smart}: \textit{true}, \textit{false}, or \textit{smart}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1617
\item[$\bullet$] \qtybf{int}: An integer. Negative integers are prefixed with a hyphen.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1618
\item[$\bullet$] \qtybf{int\_or\_smart}: An integer or \textit{smart}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1619
\item[$\bullet$] \qtybf{int\_range}: An integer (e.g., 3) or a range
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1620
of nonnegative integers (e.g., $1$--$4$). The range symbol `--' can be entered as \texttt{-} (hyphen) or \texttt{\char`\\\char`\<midarrow\char`\>}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1621
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1622
\item[$\bullet$] \qtybf{int\_seq}: A comma-separated sequence of ranges of integers (e.g.,~1{,}3{,}\allowbreak6--8).
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1623
\item[$\bullet$] \qtybf{time}: An integer followed by $\textit{min}$ (minutes), $s$ (seconds), or \textit{ms}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1624
(milliseconds), or the keyword \textit{none} ($\infty$ years).
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1625
\item[$\bullet$] \qtybf{const}: The name of a HOL constant.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1626
\item[$\bullet$] \qtybf{term}: A HOL term (e.g., ``$f~x$'').
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1627
\item[$\bullet$] \qtybf{term\_list}: A space-separated list of HOL terms (e.g.,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1628
``$f~x$''~``$g~y$'').
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1629
\item[$\bullet$] \qtybf{type}: A HOL type.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1630
\end{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1631
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1632
Default values are indicated in square brackets. Boolean options have a negated
33561
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1633
counterpart (e.g., \textit{blocking} vs.\ \textit{no\_blocking}). When setting
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1634
Boolean options, ``= \textit{true}'' may be omitted.
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1635
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1636
\subsection{Mode of Operation}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1637
\label{mode-of-operation}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1638
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1639
\begin{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1640
\optrue{blocking}{non\_blocking}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1641
Specifies whether the \textbf{nitpick} command should operate synchronously.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1642
The asynchronous (non-blocking) mode lets the user start proving the putative
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1643
theorem while Nitpick looks for a counterexample, but it can also be more
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1644
confusing. For technical reasons, automatic runs currently always block.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1645
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1646
\optrue{falsify}{satisfy}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1647
Specifies whether Nitpick should look for falsifying examples (countermodels) or
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1648
satisfying examples (models). This manual assumes throughout that
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1649
\textit{falsify} is enabled.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1650
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1651
\opsmart{user\_axioms}{no\_user\_axioms}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1652
Specifies whether the user-defined axioms (specified using 
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1653
\textbf{axiomatization} and \textbf{axioms}) should be considered. If the option
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1654
is set to \textit{smart}, Nitpick performs an ad hoc axiom selection based on
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1655
the constants that occur in the formula to falsify. The option is implicitly set
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1656
to \textit{true} for automatic runs.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1657
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1658
\textbf{Warning:} If the option is set to \textit{true}, Nitpick might
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1659
nonetheless ignore some polymorphic axioms. Counterexamples generated under
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1660
these conditions are tagged as ``likely genuine.'' The \textit{debug}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1661
(\S\ref{output-format}) option can be used to find out which axioms were
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1662
considered.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1663
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1664
\nopagebreak
33561
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1665
{\small See also \textit{assms} (\S\ref{mode-of-operation}) and \textit{debug}
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1666
(\S\ref{output-format}).}
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1667
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1668
\optrue{assms}{no\_assms}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1669
Specifies whether the relevant assumptions in structured proof should be
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1670
considered. The option is implicitly enabled for automatic runs.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1671
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1672
\nopagebreak
33561
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1673
{\small See also \textit{user\_axioms} (\S\ref{mode-of-operation}).}
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1674
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1675
\opfalse{overlord}{no\_overlord}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1676
Specifies whether Nitpick should put its temporary files in
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1677
\texttt{\$ISABELLE\_\allowbreak HOME\_\allowbreak USER}, which is useful for
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1678
debugging Nitpick but also unsafe if several instances of the tool are run
33196
5fe67e108651 updated Nitpick documentation to remove weird default for "overlord"
blanchet
parents: 33195
diff changeset
  1679
simultaneously.
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1680
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1681
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1682
{\small See also \textit{debug} (\S\ref{output-format}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1683
\end{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1684
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1685
\subsection{Scope of Search}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1686
\label{scope-of-search}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1687
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1688
\begin{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1689
\opu{card}{type}{int\_seq}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1690
Specifies the sequence of cardinalities to use for a given type. For
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1691
\textit{nat} and \textit{int}, the cardinality fully specifies the subset used
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1692
to approximate the type. For example:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1693
%
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1694
$$\hbox{\begin{tabular}{@{}rll@{}}%
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1695
\textit{card nat} = 4 & induces & $\{0,\, 1,\, 2,\, 3\}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1696
\textit{card int} = 4 & induces & $\{-1,\, 0,\, +1,\, +2\}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1697
\textit{card int} = 5 & induces & $\{-2,\, -1,\, 0,\, +1,\, +2\}.$%
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1698
\end{tabular}}$$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1699
%
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1700
In general:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1701
%
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1702
$$\hbox{\begin{tabular}{@{}rll@{}}%
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1703
\textit{card nat} = $K$ & induces & $\{0,\, \ldots,\, K - 1\}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1704
\textit{card int} = $K$ & induces & $\{-\lceil K/2 \rceil + 1,\, \ldots,\, +\lfloor K/2 \rfloor\}.$%
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1705
\end{tabular}}$$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1706
%
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1707
For free types, and often also for \textbf{typedecl}'d types, it usually makes
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1708
sense to specify cardinalities as a range of the form \textit{$1$--$n$}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1709
Although function and product types are normally mapped directly to the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1710
corresponding Kodkod concepts, setting
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1711
the cardinality of such types is also allowed and implicitly enables ``boxing''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1712
for them, as explained in the description of the \textit{box}~\qty{type}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1713
and \textit{box} (\S\ref{scope-of-search}) options.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1714
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1715
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1716
{\small See also \textit{mono} (\S\ref{scope-of-search}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1717
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1718
\opt{card}{int\_seq}{$\mathbf{1}$--$\mathbf{8}$}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1719
Specifies the default sequence of cardinalities to use. This can be overridden
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1720
on a per-type basis using the \textit{card}~\qty{type} option described above.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1721
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1722
\opu{max}{const}{int\_seq}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1723
Specifies the sequence of maximum multiplicities to use for a given
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1724
(co)in\-duc\-tive datatype constructor. A constructor's multiplicity is the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1725
number of distinct values that it can construct. Nonsensical values (e.g.,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1726
\textit{max}~[]~$=$~2) are silently repaired. This option is only available for
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1727
datatypes equipped with several constructors.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1728
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1729
\ops{max}{int\_seq}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1730
Specifies the default sequence of maximum multiplicities to use for
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1731
(co)in\-duc\-tive datatype constructors. This can be overridden on a per-constructor
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1732
basis using the \textit{max}~\qty{const} option described above.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1733
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1734
\opusmart{wf}{const}{non\_wf}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1735
Specifies whether the specified (co)in\-duc\-tively defined predicate is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1736
well-founded. The option can take the following values:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1737
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1738
\begin{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1739
\item[$\bullet$] \textbf{\textit{true}}: Tentatively treat the (co)in\-duc\-tive
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1740
predicate as if it were well-founded. Since this is generally not sound when the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1741
predicate is not well-founded, the counterexamples are tagged as ``likely
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1742
genuine.''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1743
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1744
\item[$\bullet$] \textbf{\textit{false}}: Treat the (co)in\-duc\-tive predicate
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1745
as if it were not well-founded. The predicate is then unrolled as prescribed by
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1746
the \textit{star\_linear\_preds}, \textit{iter}~\qty{const}, and \textit{iter}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1747
options.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1748
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1749
\item[$\bullet$] \textbf{\textit{smart}}: Try to prove that the inductive
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1750
predicate is well-founded using Isabelle's \textit{lexicographic\_order} and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1751
\textit{sizechange} tactics. If this succeeds (or the predicate occurs with an
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1752
appropriate polarity in the formula to falsify), use an efficient fixed point
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1753
equation as specification of the predicate; otherwise, unroll the predicates
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1754
according to the \textit{iter}~\qty{const} and \textit{iter} options.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1755
\end{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1756
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1757
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1758
{\small See also \textit{iter} (\S\ref{scope-of-search}),
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1759
\textit{star\_linear\_preds} (\S\ref{optimizations}), and \textit{tac\_timeout}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1760
(\S\ref{timeouts}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1761
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1762
\opsmart{wf}{non\_wf}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1763
Specifies the default wellfoundedness setting to use. This can be overridden on
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1764
a per-predicate basis using the \textit{wf}~\qty{const} option above.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1765
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1766
\opu{iter}{const}{int\_seq}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1767
Specifies the sequence of iteration counts to use when unrolling a given
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1768
(co)in\-duc\-tive predicate. By default, unrolling is applied for inductive
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1769
predicates that occur negatively and coinductive predicates that occur
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1770
positively in the formula to falsify and that cannot be proved to be
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1771
well-founded, but this behavior is influenced by the \textit{wf} option. The
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1772
iteration counts are automatically bounded by the cardinality of the predicate's
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1773
domain.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1774
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1775
{\small See also \textit{wf} (\S\ref{scope-of-search}) and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1776
\textit{star\_linear\_preds} (\S\ref{optimizations}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1777
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1778
\opt{iter}{int\_seq}{$\mathbf{1{,}2{,}4{,}8{,}12{,}16{,}24{,}32}$}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1779
Specifies the sequence of iteration counts to use when unrolling (co)in\-duc\-tive
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1780
predicates. This can be overridden on a per-predicate basis using the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1781
\textit{iter} \qty{const} option above.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1782
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1783
\opt{bisim\_depth}{int\_seq}{$\mathbf{7}$}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1784
Specifies the sequence of iteration counts to use when unrolling the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1785
bisimilarity predicate generated by Nitpick for coinductive datatypes. A value
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1786
of $-1$ means that no predicate is generated, in which case Nitpick performs an
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1787
after-the-fact check to see if the known coinductive datatype values are
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1788
bidissimilar. If two values are found to be bisimilar, the counterexample is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1789
tagged as ``likely genuine.'' The iteration counts are automatically bounded by
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1790
the sum of the cardinalities of the coinductive datatypes occurring in the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1791
formula to falsify.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1792
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1793
\opusmart{box}{type}{dont\_box}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1794
Specifies whether Nitpick should attempt to wrap (``box'') a given function or
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1795
product type in an isomorphic datatype internally. Boxing is an effective mean
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1796
to reduce the search space and speed up Nitpick, because the isomorphic datatype
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1797
is approximated by a subset of the possible function or pair values;
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1798
like other drastic optimizations, it can also prevent the discovery of
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1799
counterexamples. The option can take the following values:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1800
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1801
\begin{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1802
\item[$\bullet$] \textbf{\textit{true}}: Box the specified type whenever
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1803
practicable.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1804
\item[$\bullet$] \textbf{\textit{false}}: Never box the type.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1805
\item[$\bullet$] \textbf{\textit{smart}}: Box the type only in contexts where it
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1806
is likely to help. For example, $n$-tuples where $n > 2$ and arguments to
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1807
higher-order functions are good candidates for boxing.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1808
\end{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1809
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1810
Setting the \textit{card}~\qty{type} option for a function or product type
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1811
implicitly enables boxing for that type.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1812
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1813
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1814
{\small See also \textit{verbose} (\S\ref{output-format})
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1815
and \textit{debug} (\S\ref{output-format}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1816
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1817
\opsmart{box}{dont\_box}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1818
Specifies the default boxing setting to use. This can be overridden on a
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1819
per-type basis using the \textit{box}~\qty{type} option described above.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1820
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1821
\opusmart{mono}{type}{non\_mono}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1822
Specifies whether the specified type should be considered monotonic when
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1823
enumerating scopes. If the option is set to \textit{smart}, Nitpick performs a
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1824
monotonicity check on the type. Setting this option to \textit{true} can reduce
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1825
the number of scopes tried, but it also diminishes the theoretical chance of
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1826
finding a counterexample, as demonstrated in \S\ref{scope-monotonicity}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1827
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1828
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1829
{\small See also \textit{card} (\S\ref{scope-of-search}),
33556
cba22e2999d5 renamed Nitpick option "coalesce_type_vars" to "merge_type_vars" (shorter) and cleaned up old hacks that are no longer necessary
blanchet
parents: 33232
diff changeset
  1830
\textit{merge\_type\_vars} (\S\ref{scope-of-search}), and \textit{verbose}
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1831
(\S\ref{output-format}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1832
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1833
\opsmart{mono}{non\_box}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1834
Specifies the default monotonicity setting to use. This can be overridden on a
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1835
per-type basis using the \textit{mono}~\qty{type} option described above.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1836
33556
cba22e2999d5 renamed Nitpick option "coalesce_type_vars" to "merge_type_vars" (shorter) and cleaned up old hacks that are no longer necessary
blanchet
parents: 33232
diff changeset
  1837
\opfalse{merge\_type\_vars}{dont\_merge\_type\_vars}
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1838
Specifies whether type variables with the same sort constraints should be
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1839
merged. Setting this option to \textit{true} can reduce the number of scopes
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1840
tried and the size of the generated Kodkod formulas, but it also diminishes the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1841
theoretical chance of finding a counterexample.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1842
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1843
{\small See also \textit{mono} (\S\ref{scope-of-search}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1844
\end{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1845
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1846
\subsection{Output Format}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1847
\label{output-format}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1848
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1849
\begin{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1850
\opfalse{verbose}{quiet}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1851
Specifies whether the \textbf{nitpick} command should explain what it does. This
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1852
option is useful to determine which scopes are tried or which SAT solver is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1853
used. This option is implicitly disabled for automatic runs.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1854
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1855
\opfalse{debug}{no\_debug}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1856
Specifies whether Nitpick should display additional debugging information beyond
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1857
what \textit{verbose} already displays. Enabling \textit{debug} also enables
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1858
\textit{verbose} and \textit{show\_all} behind the scenes. The \textit{debug}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1859
option is implicitly disabled for automatic runs.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1860
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1861
\nopagebreak
33561
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1862
{\small See also \textit{overlord} (\S\ref{mode-of-operation}) and
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1863
\textit{batch\_size} (\S\ref{optimizations}).}
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1864
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1865
\optrue{show\_skolems}{hide\_skolem}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1866
Specifies whether the values of Skolem constants should be displayed as part of
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1867
counterexamples. Skolem constants correspond to bound variables in the original
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1868
formula and usually help us to understand why the counterexample falsifies the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1869
formula.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1870
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1871
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1872
{\small See also \textit{skolemize} (\S\ref{optimizations}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1873
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1874
\opfalse{show\_datatypes}{hide\_datatypes}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1875
Specifies whether the subsets used to approximate (co)in\-duc\-tive datatypes should
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1876
be displayed as part of counterexamples. Such subsets are sometimes helpful when
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1877
investigating whether a potential counterexample is genuine or spurious, but
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1878
their potential for clutter is real.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1879
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1880
\opfalse{show\_consts}{hide\_consts}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1881
Specifies whether the values of constants occurring in the formula (including
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1882
its axioms) should be displayed along with any counterexample. These values are
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1883
sometimes helpful when investigating why a counterexample is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1884
genuine, but they can clutter the output.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1885
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1886
\opfalse{show\_all}{dont\_show\_all}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1887
Enabling this option effectively enables \textit{show\_skolems},
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1888
\textit{show\_datatypes}, and \textit{show\_consts}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1889
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1890
\opt{max\_potential}{int}{$\mathbf{1}$}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1891
Specifies the maximum number of potential counterexamples to display. Setting
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1892
this option to 0 speeds up the search for a genuine counterexample. This option
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1893
is implicitly set to 0 for automatic runs. If you set this option to a value
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1894
greater than 1, you will need an incremental SAT solver: For efficiency, it is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1895
recommended to install the JNI version of MiniSat and set \textit{sat\_solver} =
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1896
\textit{MiniSatJNI}. Also be aware that many of the counterexamples may look
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1897
identical, unless the \textit{show\_all} (\S\ref{output-format}) option is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1898
enabled.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1899
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1900
\nopagebreak
33561
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1901
{\small See also \textit{check\_potential} (\S\ref{authentication}) and
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1902
\textit{sat\_solver} (\S\ref{optimizations}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1903
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1904
\opt{max\_genuine}{int}{$\mathbf{1}$}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1905
Specifies the maximum number of genuine counterexamples to display. If you set
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1906
this option to a value greater than 1, you will need an incremental SAT solver:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1907
For efficiency, it is recommended to install the JNI version of MiniSat and set
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1908
\textit{sat\_solver} = \textit{MiniSatJNI}. Also be aware that many of the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1909
counterexamples may look identical, unless the \textit{show\_all}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1910
(\S\ref{output-format}) option is enabled.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1911
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1912
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1913
{\small See also \textit{check\_genuine} (\S\ref{authentication}) and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1914
\textit{sat\_solver} (\S\ref{optimizations}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1915
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1916
\ops{eval}{term\_list}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1917
Specifies the list of terms whose values should be displayed along with
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1918
counterexamples. This option suffers from an ``observer effect'': Nitpick might
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1919
find different counterexamples for different values of this option.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1920
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1921
\opu{format}{term}{int\_seq}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1922
Specifies how to uncurry the value displayed for a variable or constant.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1923
Uncurrying sometimes increases the readability of the output for high-arity
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1924
functions. For example, given the variable $y \mathbin{\Colon} {'a}\Rightarrow
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1925
{'b}\Rightarrow {'c}\Rightarrow {'d}\Rightarrow {'e}\Rightarrow {'f}\Rightarrow
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1926
{'g}$, setting \textit{format}~$y$ = 3 tells Nitpick to group the last three
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1927
arguments, as if the type had been ${'a}\Rightarrow {'b}\Rightarrow
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1928
{'c}\Rightarrow {'d}\times {'e}\times {'f}\Rightarrow {'g}$. In general, a list
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1929
of values $n_1,\ldots,n_k$ tells Nitpick to show the last $n_k$ arguments as an
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1930
$n_k$-tuple, the previous $n_{k-1}$ arguments as an $n_{k-1}$-tuple, and so on;
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1931
arguments that are not accounted for are left alone, as if the specification had
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1932
been $1,\ldots,1,n_1,\ldots,n_k$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1933
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1934
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1935
{\small See also \textit{uncurry} (\S\ref{optimizations}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1936
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1937
\opt{format}{int\_seq}{$\mathbf{1}$}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1938
Specifies the default format to use. Irrespective of the default format, the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1939
extra arguments to a Skolem constant corresponding to the outer bound variables
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1940
are kept separated from the remaining arguments, the \textbf{for} arguments of
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1941
an inductive definitions are kept separated from the remaining arguments, and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1942
the iteration counter of an unrolled inductive definition is shown alone. The
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1943
default format can be overridden on a per-variable or per-constant basis using
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1944
the \textit{format}~\qty{term} option described above.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1945
\end{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1946
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1947
%% MARK: Authentication
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1948
\subsection{Authentication}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1949
\label{authentication}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1950
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1951
\begin{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1952
\opfalse{check\_potential}{trust\_potential}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1953
Specifies whether potential counterexamples should be given to Isabelle's
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1954
\textit{auto} tactic to assess their validity. If a potential counterexample is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1955
shown to be genuine, Nitpick displays a message to this effect and terminates.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1956
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1957
\nopagebreak
33561
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1958
{\small See also \textit{max\_potential} (\S\ref{output-format}).}
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1959
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1960
\opfalse{check\_genuine}{trust\_genuine}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1961
Specifies whether genuine and likely genuine counterexamples should be given to
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1962
Isabelle's \textit{auto} tactic to assess their validity. If a ``genuine''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1963
counterexample is shown to be spurious, the user is kindly asked to send a bug
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1964
report to the author at
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1965
\texttt{blan{\color{white}nospam}\kern-\wd\boxA{}chette@in.tum.de}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1966
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1967
\nopagebreak
33561
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  1968
{\small See also \textit{max\_genuine} (\S\ref{output-format}).}
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1969
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1970
\ops{expect}{string}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1971
Specifies the expected outcome, which must be one of the following:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1972
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1973
\begin{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1974
\item[$\bullet$] \textbf{\textit{genuine}}: Nitpick found a genuine counterexample.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1975
\item[$\bullet$] \textbf{\textit{likely\_genuine}}: Nitpick found a ``likely
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1976
genuine'' counterexample (i.e., a counterexample that is genuine unless
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1977
it contradicts a missing axiom or a dangerous option was used inappropriately).
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1978
\item[$\bullet$] \textbf{\textit{potential}}: Nitpick found a potential counterexample.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1979
\item[$\bullet$] \textbf{\textit{none}}: Nitpick found no counterexample.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1980
\item[$\bullet$] \textbf{\textit{unknown}}: Nitpick encountered some problem (e.g.,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1981
Kodkod ran out of memory).
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1982
\end{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1983
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1984
Nitpick emits an error if the actual outcome differs from the expected outcome.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1985
This option is useful for regression testing.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1986
\end{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1987
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1988
\subsection{Optimizations}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1989
\label{optimizations}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1990
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1991
\def\cpp{C\nobreak\raisebox{.1ex}{+}\nobreak\raisebox{.1ex}{+}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1992
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1993
\sloppy
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1994
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1995
\begin{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1996
\opt{sat\_solver}{string}{smart}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1997
Specifies which SAT solver to use. SAT solvers implemented in C or \cpp{} tend
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1998
to be faster than their Java counterparts, but they can be more difficult to
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  1999
install. Also, if you set the \textit{max\_potential} (\S\ref{output-format}) or
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2000
\textit{max\_genuine} (\S\ref{output-format}) option to a value greater than 1,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2001
you will need an incremental SAT solver, such as \textit{MiniSatJNI}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2002
(recommended) or \textit{SAT4J}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2003
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2004
The supported solvers are listed below:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2005
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2006
\begin{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2007
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2008
\item[$\bullet$] \textbf{\textit{MiniSat}}: MiniSat is an efficient solver
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2009
written in \cpp{}. To use MiniSat, set the environment variable
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2010
\texttt{MINISAT\_HOME} to the directory that contains the \texttt{minisat}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2011
executable. The \cpp{} sources and executables for MiniSat are available at
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2012
\url{http://minisat.se/MiniSat.html}. Nitpick has been tested with versions 1.14
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2013
and 2.0 beta (2007-07-21).
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2014
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2015
\item[$\bullet$] \textbf{\textit{MiniSatJNI}}: The JNI (Java Native Interface)
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2016
version of MiniSat is bundled in \texttt{nativesolver.\allowbreak tgz}, which
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2017
you will find on Kodkod's web site \cite{kodkod-2009}. Unlike the standard
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2018
version of MiniSat, the JNI version can be used incrementally.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2019
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2020
\item[$\bullet$] \textbf{\textit{PicoSAT}}: PicoSAT is an efficient solver
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2021
written in C. It is bundled with Kodkodi and requires no further installation or
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2022
configuration steps. Alternatively, you can install a standard version of
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2023
PicoSAT and set the environment variable \texttt{PICOSAT\_HOME} to the directory
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2024
that contains the \texttt{picosat} executable. The C sources for PicoSAT are
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2025
available at \url{http://fmv.jku.at/picosat/} and are also bundled with Kodkodi.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2026
Nitpick has been tested with version 913.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2027
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2028
\item[$\bullet$] \textbf{\textit{zChaff}}: zChaff is an efficient solver written
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2029
in \cpp{}. To use zChaff, set the environment variable \texttt{ZCHAFF\_HOME} to
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2030
the directory that contains the \texttt{zchaff} executable. The \cpp{} sources
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2031
and executables for zChaff are available at
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2032
\url{http://www.princeton.edu/~chaff/zchaff.html}. Nitpick has been tested with
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2033
versions 2004-05-13, 2004-11-15, and 2007-03-12.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2034
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2035
\item[$\bullet$] \textbf{\textit{zChaffJNI}}: The JNI version of zChaff is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2036
bundled in \texttt{native\-solver.\allowbreak tgz}, which you will find on
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2037
Kodkod's web site \cite{kodkod-2009}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2038
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2039
\item[$\bullet$] \textbf{\textit{RSat}}: RSat is an efficient solver written in
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2040
\cpp{}. To use RSat, set the environment variable \texttt{RSAT\_HOME} to the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2041
directory that contains the \texttt{rsat} executable. The \cpp{} sources for
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2042
RSat are available at \url{http://reasoning.cs.ucla.edu/rsat/}. Nitpick has been
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2043
tested with version 2.01.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2044
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2045
\item[$\bullet$] \textbf{\textit{BerkMin}}: BerkMin561 is an efficient solver
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2046
written in C. To use BerkMin, set the environment variable
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2047
\texttt{BERKMIN\_HOME} to the directory that contains the \texttt{BerkMin561}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2048
executable. The BerkMin executables are available at
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2049
\url{http://eigold.tripod.com/BerkMin.html}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2050
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2051
\item[$\bullet$] \textbf{\textit{BerkMinAlloy}}: Variant of BerkMin that is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2052
included with Alloy 4 and calls itself ``sat56'' in its banner text. To use this
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2053
version of BerkMin, set the environment variable
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2054
\texttt{BERKMINALLOY\_HOME} to the directory that contains the \texttt{berkmin}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2055
executable.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2056
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2057
\item[$\bullet$] \textbf{\textit{Jerusat}}: Jerusat 1.3 is an efficient solver
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2058
written in C. To use Jerusat, set the environment variable
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2059
\texttt{JERUSAT\_HOME} to the directory that contains the \texttt{Jerusat1.3}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2060
executable. The C sources for Jerusat are available at
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2061
\url{http://www.cs.tau.ac.il/~ale1/Jerusat1.3.tgz}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2062
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2063
\item[$\bullet$] \textbf{\textit{SAT4J}}: SAT4J is a reasonably efficient solver
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2064
written in Java that can be used incrementally. It is bundled with Kodkodi and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2065
requires no further installation or configuration steps. Do not attempt to
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2066
install the official SAT4J packages, because their API is incompatible with
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2067
Kodkod.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2068
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2069
\item[$\bullet$] \textbf{\textit{SAT4JLight}}: Variant of SAT4J that is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2070
optimized for small problems. It can also be used incrementally.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2071
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2072
\item[$\bullet$] \textbf{\textit{HaifaSat}}: HaifaSat 1.0 beta is an
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2073
experimental solver written in \cpp. To use HaifaSat, set the environment
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2074
variable \texttt{HAIFASAT\_\allowbreak HOME} to the directory that contains the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2075
\texttt{HaifaSat} executable. The \cpp{} sources for HaifaSat are available at
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2076
\url{http://cs.technion.ac.il/~gershman/HaifaSat.htm}.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2077
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2078
\item[$\bullet$] \textbf{\textit{smart}}: If \textit{sat\_solver} is set to
33229
fba7527c3ef1 made Nitpick aware of the KODKODI_JAVA_LIBRARY_PATH, for detecting and properly invoking JNI-based SAT solvers
blanchet
parents: 33196
diff changeset
  2079
\textit{smart}, Nitpick selects the first solver among MiniSatJNI, MiniSat,
fba7527c3ef1 made Nitpick aware of the KODKODI_JAVA_LIBRARY_PATH, for detecting and properly invoking JNI-based SAT solvers
blanchet
parents: 33196
diff changeset
  2080
PicoSAT, zChaffJNI, zChaff, RSat, BerkMin, BerkMinAlloy, and Jerusat that is
fba7527c3ef1 made Nitpick aware of the KODKODI_JAVA_LIBRARY_PATH, for detecting and properly invoking JNI-based SAT solvers
blanchet
parents: 33196
diff changeset
  2081
recognized by Isabelle. If none is found, it falls back on SAT4J, which should
fba7527c3ef1 made Nitpick aware of the KODKODI_JAVA_LIBRARY_PATH, for detecting and properly invoking JNI-based SAT solvers
blanchet
parents: 33196
diff changeset
  2082
always be available. If \textit{verbose} is enabled, Nitpick displays which SAT
fba7527c3ef1 made Nitpick aware of the KODKODI_JAVA_LIBRARY_PATH, for detecting and properly invoking JNI-based SAT solvers
blanchet
parents: 33196
diff changeset
  2083
solver was chosen.
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2084
\end{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2085
\fussy
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2086
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2087
\opt{batch\_size}{int\_or\_smart}{smart}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2088
Specifies the maximum number of Kodkod problems that should be lumped together
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2089
when invoking Kodkodi. Each problem corresponds to one scope. Lumping problems
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2090
together ensures that Kodkodi is launched less often, but it makes the verbose
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2091
output less readable and is sometimes detrimental to performance. If
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2092
\textit{batch\_size} is set to \textit{smart}, the actual value used is 1 if
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2093
\textit{debug} (\S\ref{output-format}) is set and 64 otherwise.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2094
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2095
\optrue{destroy\_constrs}{dont\_destroy\_constrs}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2096
Specifies whether formulas involving (co)in\-duc\-tive datatype constructors should
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2097
be rewritten to use (automatically generated) discriminators and destructors.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2098
This optimization can drastically reduce the size of the Boolean formulas given
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2099
to the SAT solver.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2100
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2101
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2102
{\small See also \textit{debug} (\S\ref{output-format}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2103
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2104
\optrue{specialize}{dont\_specialize}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2105
Specifies whether functions invoked with static arguments should be specialized.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2106
This optimization can drastically reduce the search space, especially for
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2107
higher-order functions.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2108
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2109
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2110
{\small See also \textit{debug} (\S\ref{output-format}) and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2111
\textit{show\_consts} (\S\ref{output-format}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2112
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2113
\optrue{skolemize}{dont\_skolemize}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2114
Specifies whether the formula should be skolemized. For performance reasons,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2115
(positive) $\forall$-quanti\-fiers that occur in the scope of a higher-order
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2116
(positive) $\exists$-quanti\-fier are left unchanged.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2117
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2118
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2119
{\small See also \textit{debug} (\S\ref{output-format}) and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2120
\textit{show\_skolems} (\S\ref{output-format}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2121
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2122
\optrue{star\_linear\_preds}{dont\_star\_linear\_preds}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2123
Specifies whether Nitpick should use Kodkod's transitive closure operator to
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2124
encode non-well-founded ``linear inductive predicates,'' i.e., inductive
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2125
predicates for which each the predicate occurs in at most one assumption of each
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2126
introduction rule. Using the reflexive transitive closure is in principle
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2127
equivalent to setting \textit{iter} to the cardinality of the predicate's
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2128
domain, but it is usually more efficient.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2129
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2130
{\small See also \textit{wf} (\S\ref{scope-of-search}), \textit{debug}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2131
(\S\ref{output-format}), and \textit{iter} (\S\ref{scope-of-search}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2132
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2133
\optrue{uncurry}{dont\_uncurry}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2134
Specifies whether Nitpick should uncurry functions. Uncurrying has on its own no
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2135
tangible effect on efficiency, but it creates opportunities for the boxing 
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2136
optimization.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2137
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2138
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2139
{\small See also \textit{box} (\S\ref{scope-of-search}), \textit{debug}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2140
(\S\ref{output-format}), and \textit{format} (\S\ref{output-format}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2141
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2142
\optrue{fast\_descrs}{full\_descrs}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2143
Specifies whether Nitpick should optimize the definite and indefinite
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2144
description operators (THE and SOME). The optimized versions usually help
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2145
Nitpick generate more counterexamples or at least find them faster, but only the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2146
unoptimized versions are complete when all types occurring in the formula are
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2147
finite.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2148
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2149
{\small See also \textit{debug} (\S\ref{output-format}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2150
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2151
\optrue{peephole\_optim}{no\_peephole\_optim}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2152
Specifies whether Nitpick should simplify the generated Kodkod formulas using a
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2153
peephole optimizer. These optimizations can make a significant difference.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2154
Unless you are tracking down a bug in Nitpick or distrust the peephole
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2155
optimizer, you should leave this option enabled.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2156
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2157
\opt{sym\_break}{int}{20}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2158
Specifies an upper bound on the number of relations for which Kodkod generates
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2159
symmetry breaking predicates. According to the Kodkod documentation
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2160
\cite{kodkod-2009-options}, ``in general, the higher this value, the more
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2161
symmetries will be broken, and the faster the formula will be solved. But,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2162
setting the value too high may have the opposite effect and slow down the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2163
solving.''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2164
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2165
\opt{sharing\_depth}{int}{3}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2166
Specifies the depth to which Kodkod should check circuits for equivalence during
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2167
the translation to SAT. The default of 3 is the same as in Alloy. The minimum
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2168
allowed depth is 1. Increasing the sharing may result in a smaller SAT problem,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2169
but can also slow down Kodkod.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2170
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2171
\opfalse{flatten\_props}{dont\_flatten\_props}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2172
Specifies whether Kodkod should try to eliminate intermediate Boolean variables.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2173
Although this might sound like a good idea, in practice it can drastically slow
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2174
down Kodkod.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2175
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2176
\opt{max\_threads}{int}{0}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2177
Specifies the maximum number of threads to use in Kodkod. If this option is set
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2178
to 0, Kodkod will compute an appropriate value based on the number of processor
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2179
cores available.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2180
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2181
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2182
{\small See also \textit{batch\_size} (\S\ref{optimizations}) and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2183
\textit{timeout} (\S\ref{timeouts}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2184
\end{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2185
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2186
\subsection{Timeouts}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2187
\label{timeouts}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2188
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2189
\begin{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2190
\opt{timeout}{time}{$\mathbf{30}$ s}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2191
Specifies the maximum amount of time that the \textbf{nitpick} command should
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2192
spend looking for a counterexample. Nitpick tries to honor this constraint as
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2193
well as it can but offers no guarantees. For automatic runs,
33561
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  2194
\textit{timeout} is ignored; instead, Auto Quickcheck and Auto Nitpick share
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  2195
a time slot whose length is specified by the ``Auto Counterexample Time
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  2196
Limit'' option in Proof General.
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2197
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2198
\nopagebreak
33561
ab01b72715ef introduced Auto Nitpick in addition to Auto Quickcheck;
blanchet
parents: 33559
diff changeset
  2199
{\small See also \textit{max\_threads} (\S\ref{optimizations}).}
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2200
33556
cba22e2999d5 renamed Nitpick option "coalesce_type_vars" to "merge_type_vars" (shorter) and cleaned up old hacks that are no longer necessary
blanchet
parents: 33232
diff changeset
  2201
\opt{tac\_timeout}{time}{$\mathbf{500}$\,ms}
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2202
Specifies the maximum amount of time that the \textit{auto} tactic should use
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2203
when checking a counterexample, and similarly that \textit{lexicographic\_order}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2204
and \textit{sizechange} should use when checking whether a (co)in\-duc\-tive
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2205
predicate is well-founded. Nitpick tries to honor this constraint as well as it
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2206
can but offers no guarantees.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2207
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2208
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2209
{\small See also \textit{wf} (\S\ref{scope-of-search}),
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2210
\textit{check\_potential} (\S\ref{authentication}),
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2211
and \textit{check\_genuine} (\S\ref{authentication}).}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2212
\end{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2213
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2214
\section{Attribute Reference}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2215
\label{attribute-reference}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2216
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2217
Nitpick needs to consider the definitions of all constants occurring in a
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2218
formula in order to falsify it. For constants introduced using the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2219
\textbf{definition} command, the definition is simply the associated
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2220
\textit{\_def} axiom. In contrast, instead of using the internal representation
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2221
of functions synthesized by Isabelle's \textbf{primrec}, \textbf{function}, and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2222
\textbf{nominal\_primrec} packages, Nitpick relies on the more natural
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2223
equational specification entered by the user.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2224
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2225
Behind the scenes, Isabelle's built-in packages and theories rely on the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2226
following attributes to affect Nitpick's behavior:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2227
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2228
\begin{itemize}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2229
\flushitem{\textit{nitpick\_def}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2230
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2231
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2232
This attribute specifies an alternative definition of a constant. The
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2233
alternative definition should be logically equivalent to the constant's actual
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2234
axiomatic definition and should be of the form
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2235
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2236
\qquad $c~{?}x_1~\ldots~{?}x_n \,\equiv\, t$,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2237
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2238
where ${?}x_1, \ldots, {?}x_n$ are distinct variables and $c$ does not occur in
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2239
$t$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2240
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2241
\flushitem{\textit{nitpick\_simp}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2242
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2243
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2244
This attribute specifies the equations that constitute the specification of a
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2245
constant. For functions defined using the \textbf{primrec}, \textbf{function},
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2246
and \textbf{nominal\_\allowbreak primrec} packages, this corresponds to the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2247
\textit{simps} rules. The equations must be of the form
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2248
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2249
\qquad $c~t_1~\ldots\ t_n \,=\, u.$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2250
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2251
\flushitem{\textit{nitpick\_psimp}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2252
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2253
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2254
This attribute specifies the equations that constitute the partial specification
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2255
of a constant. For functions defined using the \textbf{function} package, this
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2256
corresponds to the \textit{psimps} rules. The conditional equations must be of
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2257
the form
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2258
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2259
\qquad $\lbrakk P_1;\> \ldots;\> P_m\rbrakk \,\Longrightarrow\, c\ t_1\ \ldots\ t_n \,=\, u$.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2260
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2261
\flushitem{\textit{nitpick\_intro}}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2262
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2263
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2264
This attribute specifies the introduction rules of a (co)in\-duc\-tive predicate.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2265
For predicates defined using the \textbf{inductive} or \textbf{coinductive}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2266
command, this corresponds to the \textit{intros} rules. The introduction rules
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2267
must be of the form
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2268
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2269
\qquad $\lbrakk P_1;\> \ldots;\> P_m;\> M~(c\ t_{11}\ \ldots\ t_{1n});\>
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2270
\ldots;\> M~(c\ t_{k1}\ \ldots\ t_{kn})\rbrakk \,\Longrightarrow\, c\ u_1\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2271
\ldots\ u_n$,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2272
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2273
where the $P_i$'s are side conditions that do not involve $c$ and $M$ is an
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2274
optional monotonic operator. The order of the assumptions is irrelevant.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2275
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2276
\end{itemize}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2277
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2278
When faced with a constant, Nitpick proceeds as follows:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2279
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2280
\begin{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2281
\item[1.] If the \textit{nitpick\_simp} set associated with the constant
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2282
is not empty, Nitpick uses these rules as the specification of the constant.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2283
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2284
\item[2.] Otherwise, if the \textit{nitpick\_psimp} set associated with
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2285
the constant is not empty, it uses these rules as the specification of the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2286
constant.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2287
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2288
\item[3.] Otherwise, it looks up the definition of the constant:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2289
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2290
\begin{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2291
\item[1.] If the \textit{nitpick\_def} set associated with the constant
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2292
is not empty, it uses the latest rule added to the set as the definition of the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2293
constant; otherwise it uses the actual definition axiom.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2294
\item[2.] If the definition is of the form
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2295
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2296
\qquad $c~{?}x_1~\ldots~{?}x_m \,\equiv\, \lambda y_1~\ldots~y_n.\; \textit{lfp}~(\lambda f.\; t)$,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2297
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2298
then Nitpick assumes that the definition was made using an inductive package and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2299
based on the introduction rules marked with \textit{nitpick\_\allowbreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2300
ind\_\allowbreak intros} tries to determine whether the definition is
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2301
well-founded.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2302
\end{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2303
\end{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2304
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2305
As an illustration, consider the inductive definition
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2306
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2307
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2308
\textbf{inductive}~\textit{odd}~\textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2309
``\textit{odd}~1'' $\,\mid$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2310
``\textit{odd}~$n\,\Longrightarrow\, \textit{odd}~(\textit{Suc}~(\textit{Suc}~n))$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2311
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2312
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2313
Isabelle automatically attaches the \textit{nitpick\_intro} attribute to
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2314
the above rules. Nitpick then uses the \textit{lfp}-based definition in
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2315
conjunction with these rules. To override this, we can specify an alternative
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2316
definition as follows:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2317
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2318
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2319
\textbf{lemma} $\mathit{odd\_def}'$ [\textit{nitpick\_def}]: ``$\textit{odd}~n \,\equiv\, n~\textrm{mod}~2 = 1$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2320
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2321
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2322
Nitpick then expands all occurrences of $\mathit{odd}~n$ to $n~\textrm{mod}~2
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2323
= 1$. Alternatively, we can specify an equational specification of the constant:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2324
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2325
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2326
\textbf{lemma} $\mathit{odd\_simp}'$ [\textit{nitpick\_simp}]: ``$\textit{odd}~n = (n~\textrm{mod}~2 = 1)$''
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2327
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2328
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2329
Such tweaks should be done with great care, because Nitpick will assume that the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2330
constant is completely defined by its equational specification. For example, if
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2331
you make ``$\textit{odd}~(2 * k + 1)$'' a \textit{nitpick\_simp} rule and neglect to provide rules to handle the $2 * k$ case, Nitpick will define
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2332
$\textit{odd}~n$ arbitrarily for even values of $n$. The \textit{debug}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2333
(\S\ref{output-format}) option is extremely useful to understand what is going
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2334
on when experimenting with \textit{nitpick\_} attributes.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2335
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2336
\section{Standard ML Interface}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2337
\label{standard-ml-interface}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2338
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2339
Nitpick provides a rich Standard ML interface used mainly for internal purposes
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2340
and debugging. Among the most interesting functions exported by Nitpick are
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2341
those that let you invoke the tool programmatically and those that let you
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2342
register and unregister custom coinductive datatypes.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2343
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2344
\subsection{Invocation of Nitpick}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2345
\label{invocation-of-nitpick}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2346
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2347
The \textit{Nitpick} structure offers the following functions for invoking your
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2348
favorite counterexample generator:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2349
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2350
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2351
$\textbf{val}\,~\textit{pick\_nits\_in\_term} : \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2352
\hbox{}\quad\textit{Proof.state} \rightarrow \textit{params} \rightarrow \textit{bool} \rightarrow \textit{term~list} \rightarrow \textit{term} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2353
\hbox{}\quad{\rightarrow}\; \textit{string} * \textit{Proof.state}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2354
$\textbf{val}\,~\textit{pick\_nits\_in\_subgoal} : \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2355
\hbox{}\quad\textit{Proof.state} \rightarrow \textit{params} \rightarrow \textit{bool} \rightarrow \textit{int} \rightarrow \textit{string} * \textit{Proof.state}$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2356
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2357
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2358
The return value is a new proof state paired with an outcome string
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2359
(``genuine'', ``likely\_genuine'', ``potential'', ``none'', or ``unknown''). The
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2360
\textit{params} type is a large record that lets you set Nitpick's options. The
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2361
current default options can be retrieved by calling the following function
33232
f93390060bbe internal renaming in Nitpick and fixed Kodkodi invokation on Linux;
blanchet
parents: 33229
diff changeset
  2362
defined in the \textit{Nitpick\_Isar} structure:
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2363
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2364
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2365
$\textbf{val}\,~\textit{default\_params} :\,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2366
\textit{theory} \rightarrow (\textit{string} * \textit{string})~\textit{list} \rightarrow \textit{params}$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2367
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2368
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2369
The second argument lets you override option values before they are parsed and
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2370
put into a \textit{params} record. Here is an example:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2371
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2372
\prew
33232
f93390060bbe internal renaming in Nitpick and fixed Kodkodi invokation on Linux;
blanchet
parents: 33229
diff changeset
  2373
$\textbf{val}\,~\textit{params} = \textit{Nitpick\_Isar.default\_params}~\textit{thy}~[(\textrm{``}\textrm{timeout}\textrm{''},\, \textrm{``}\textrm{none}\textrm{''})]$ \\
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2374
$\textbf{val}\,~(\textit{outcome},\, \textit{state}') = \textit{Nitpick.pick\_nits\_in\_subgoal}~\begin{aligned}[t]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2375
& \textit{state}~\textit{params}~\textit{false} \\[-2pt]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2376
& \textit{subgoal}\end{aligned}$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2377
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2378
33557
107f3df799f6 clean Nitpick's wellfoundedness cache once in a while, to avoid potential memory leak
blanchet
parents: 33556
diff changeset
  2379
\let\antiq=\textrm
107f3df799f6 clean Nitpick's wellfoundedness cache once in a while, to avoid potential memory leak
blanchet
parents: 33556
diff changeset
  2380
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2381
\subsection{Registration of Coinductive Datatypes}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2382
\label{registration-of-coinductive-datatypes}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2383
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2384
If you have defined a custom coinductive datatype, you can tell Nitpick about
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2385
it, so that it can use an efficient Kodkod axiomatization similar to the one it
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2386
uses for lazy lists. The interface for registering and unregistering coinductive
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2387
datatypes consists of the following pair of functions defined in the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2388
\textit{Nitpick} structure:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2389
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2390
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2391
$\textbf{val}\,~\textit{register\_codatatype} :\,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2392
\textit{typ} \rightarrow \textit{string} \rightarrow \textit{styp~list} \rightarrow \textit{theory} \rightarrow \textit{theory}$ \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2393
$\textbf{val}\,~\textit{unregister\_codatatype} :\,
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2394
\textit{typ} \rightarrow \textit{theory} \rightarrow \textit{theory}$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2395
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2396
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2397
The type $'a~\textit{llist}$ of lazy lists is already registered; had it
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2398
not been, you could have told Nitpick about it by adding the following line
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2399
to your theory file:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2400
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2401
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2402
$\textbf{setup}~\,\{{*}\,~\!\begin{aligned}[t]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2403
& \textit{Nitpick.register\_codatatype} \\[-2pt]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2404
& \qquad @\{\antiq{typ}~``\kern1pt'a~\textit{llist}\textrm{''}\}~@\{\antiq{const\_name}~ \textit{llist\_case}\} \\[-2pt] %% TYPESETTING
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2405
& \qquad (\textit{map}~\textit{dest\_Const}~[@\{\antiq{term}~\textit{LNil}\},\, @\{\antiq{term}~\textit{LCons}\}])\,\ {*}\}\end{aligned}$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2406
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2407
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2408
The \textit{register\_codatatype} function takes a coinductive type, its case
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2409
function, and the list of its constructors. The case function must take its
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2410
arguments in the order that the constructors are listed. If no case function
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2411
with the correct signature is available, simply pass the empty string.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2412
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2413
On the other hand, if your goal is to cripple Nitpick, add the following line to
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2414
your theory file and try to check a few conjectures about lazy lists:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2415
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2416
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2417
$\textbf{setup}~\,\{{*}\,~\textit{Nitpick.unregister\_codatatype}~@\{\antiq{typ}~``
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2418
\kern1pt'a~\textit{list}\textrm{''}\}\ \,{*}\}$
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2419
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2420
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2421
\section{Known Bugs and Limitations}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2422
\label{known-bugs-and-limitations}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2423
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2424
Here are the known bugs and limitations in Nitpick at the time of writing:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2425
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2426
\begin{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2427
\item[$\bullet$] Underspecified functions defined using the \textbf{primrec},
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2428
\textbf{function}, or \textbf{nominal\_\allowbreak primrec} packages can lead
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2429
Nitpick to generate spurious counterexamples for theorems that refer to values
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2430
for which the function is not defined. For example:
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2431
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2432
\prew
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2433
\textbf{primrec} \textit{prec} \textbf{where} \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2434
``$\textit{prec}~(\textit{Suc}~n) = n$'' \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2435
\textbf{lemma} ``$\textit{prec}~0 = \undef$'' \\
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2436
\textbf{nitpick} \\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2437
\quad{\slshape Nitpick found a counterexample for \textit{card nat}~= 2: 
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2438
\nopagebreak
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2439
\\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2440
\hbox{}\qquad Empty assignment} \nopagebreak\\[2\smallskipamount]
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2441
\textbf{by}~(\textit{auto simp}: \textit{prec\_def})
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2442
\postw
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2443
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2444
Such theorems are considered bad style because they rely on the internal
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2445
representation of functions synthesized by Isabelle, which is an implementation
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2446
detail.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2447
33559
63925777ccf9 fix typo in Nitpick manual
blanchet
parents: 33557
diff changeset
  2448
\item[$\bullet$] Nitpick maintains a global cache of wellfoundedness conditions,
33556
cba22e2999d5 renamed Nitpick option "coalesce_type_vars" to "merge_type_vars" (shorter) and cleaned up old hacks that are no longer necessary
blanchet
parents: 33232
diff changeset
  2449
which can become invalid if you change the definition of an inductive predicate
cba22e2999d5 renamed Nitpick option "coalesce_type_vars" to "merge_type_vars" (shorter) and cleaned up old hacks that are no longer necessary
blanchet
parents: 33232
diff changeset
  2450
that is registered in the cache. To clear the cache,
cba22e2999d5 renamed Nitpick option "coalesce_type_vars" to "merge_type_vars" (shorter) and cleaned up old hacks that are no longer necessary
blanchet
parents: 33232
diff changeset
  2451
run Nitpick with the \textit{tac\_timeout} option set to a new value (e.g.,
cba22e2999d5 renamed Nitpick option "coalesce_type_vars" to "merge_type_vars" (shorter) and cleaned up old hacks that are no longer necessary
blanchet
parents: 33232
diff changeset
  2452
501$\,\textit{ms}$).
cba22e2999d5 renamed Nitpick option "coalesce_type_vars" to "merge_type_vars" (shorter) and cleaned up old hacks that are no longer necessary
blanchet
parents: 33232
diff changeset
  2453
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2454
\item[$\bullet$] Nitpick produces spurious counterexamples when invoked after a
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2455
\textbf{guess} command in a structured proof.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2456
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2457
\item[$\bullet$] The \textit{nitpick\_} attributes and the
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2458
\textit{Nitpick.register\_} functions can cause havoc if used improperly.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2459
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2460
\item[$\bullet$] Local definitions are not supported and result in an error.
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2461
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2462
\item[$\bullet$] All constants and types whose names start with
33195
0efe26262e73 updated Nitpick manual to reflect the latest Stand der Dinge
blanchet
parents: 33193
diff changeset
  2463
\textit{Nitpick}{.} are reserved for internal use.
33191
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2464
\end{enum}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2465
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2466
\let\em=\sl
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2467
\bibliography{../manual}{}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2468
\bibliographystyle{abbrv}
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2469
fe3c65d9c577 Added Nitpick manual.
blanchet
parents:
diff changeset
  2470
\end{document}