blanchet@36918
|
1 |
\documentclass[a4paper,12pt]{article}
|
blanchet@36918
|
2 |
\usepackage[T1]{fontenc}
|
blanchet@36918
|
3 |
\usepackage{amsmath}
|
blanchet@36918
|
4 |
\usepackage{amssymb}
|
blanchet@36918
|
5 |
\usepackage[english,french]{babel}
|
blanchet@36918
|
6 |
\usepackage{color}
|
blanchet@36918
|
7 |
\usepackage{footmisc}
|
blanchet@36918
|
8 |
\usepackage{graphicx}
|
blanchet@36918
|
9 |
%\usepackage{mathpazo}
|
blanchet@36918
|
10 |
\usepackage{multicol}
|
blanchet@36918
|
11 |
\usepackage{stmaryrd}
|
blanchet@36918
|
12 |
%\usepackage[scaled=.85]{beramono}
|
wenzelm@43382
|
13 |
\usepackage{../../lib/texinputs/isabelle,../iman,../pdfsetup}
|
blanchet@36918
|
14 |
|
blanchet@36918
|
15 |
%\oddsidemargin=4.6mm
|
blanchet@36918
|
16 |
%\evensidemargin=4.6mm
|
blanchet@36918
|
17 |
%\textwidth=150mm
|
blanchet@36918
|
18 |
%\topmargin=4.6mm
|
blanchet@36918
|
19 |
%\headheight=0mm
|
blanchet@36918
|
20 |
%\headsep=0mm
|
blanchet@36918
|
21 |
%\textheight=234mm
|
blanchet@36918
|
22 |
|
blanchet@36918
|
23 |
\def\Colon{\mathord{:\mkern-1.5mu:}}
|
blanchet@36918
|
24 |
%\def\lbrakk{\mathopen{\lbrack\mkern-3.25mu\lbrack}}
|
blanchet@36918
|
25 |
%\def\rbrakk{\mathclose{\rbrack\mkern-3.255mu\rbrack}}
|
blanchet@36918
|
26 |
\def\lparr{\mathopen{(\mkern-4mu\mid}}
|
blanchet@36918
|
27 |
\def\rparr{\mathclose{\mid\mkern-4mu)}}
|
blanchet@36918
|
28 |
|
blanchet@36918
|
29 |
\def\unk{{?}}
|
blanchet@36918
|
30 |
\def\undef{(\lambda x.\; \unk)}
|
blanchet@36918
|
31 |
%\def\unr{\textit{others}}
|
blanchet@36918
|
32 |
\def\unr{\ldots}
|
blanchet@36918
|
33 |
\def\Abs#1{\hbox{\rm{\flqq}}{\,#1\,}\hbox{\rm{\frqq}}}
|
blanchet@36918
|
34 |
\def\Q{{\smash{\lower.2ex\hbox{$\scriptstyle?$}}}}
|
blanchet@36918
|
35 |
|
blanchet@36918
|
36 |
\urlstyle{tt}
|
blanchet@36918
|
37 |
|
blanchet@36918
|
38 |
\begin{document}
|
blanchet@36918
|
39 |
|
blanchet@36918
|
40 |
\selectlanguage{english}
|
blanchet@36918
|
41 |
|
blanchet@36918
|
42 |
\title{\includegraphics[scale=0.5]{isabelle_sledgehammer} \\[4ex]
|
blanchet@36918
|
43 |
Hammering Away \\[\smallskipamount]
|
blanchet@36918
|
44 |
\Large A User's Guide to Sledgehammer for Isabelle/HOL}
|
blanchet@36918
|
45 |
\author{\hbox{} \\
|
blanchet@36918
|
46 |
Jasmin Christian Blanchette \\
|
blanchet@43843
|
47 |
{\normalsize Institut f\"ur Informatik, Technische Universit\"at M\"unchen} \\[4\smallskipamount]
|
blanchet@43843
|
48 |
{\normalsize with contributions from} \\[4\smallskipamount]
|
blanchet@43843
|
49 |
Lawrence C. Paulson \\
|
blanchet@43843
|
50 |
{\normalsize Computer Laboratory, University of Cambridge} \\
|
blanchet@36918
|
51 |
\hbox{}}
|
blanchet@36918
|
52 |
|
blanchet@36918
|
53 |
\maketitle
|
blanchet@36918
|
54 |
|
blanchet@36918
|
55 |
\tableofcontents
|
blanchet@36918
|
56 |
|
blanchet@36918
|
57 |
\setlength{\parskip}{.7em plus .2em minus .1em}
|
blanchet@36918
|
58 |
\setlength{\parindent}{0pt}
|
blanchet@36918
|
59 |
\setlength{\abovedisplayskip}{\parskip}
|
blanchet@36918
|
60 |
\setlength{\abovedisplayshortskip}{.9\parskip}
|
blanchet@36918
|
61 |
\setlength{\belowdisplayskip}{\parskip}
|
blanchet@36918
|
62 |
\setlength{\belowdisplayshortskip}{.9\parskip}
|
blanchet@36918
|
63 |
|
blanchet@36918
|
64 |
% General-purpose enum environment with correct spacing
|
blanchet@36918
|
65 |
\newenvironment{enum}%
|
blanchet@36918
|
66 |
{\begin{list}{}{%
|
blanchet@36918
|
67 |
\setlength{\topsep}{.1\parskip}%
|
blanchet@36918
|
68 |
\setlength{\partopsep}{.1\parskip}%
|
blanchet@36918
|
69 |
\setlength{\itemsep}{\parskip}%
|
blanchet@36918
|
70 |
\advance\itemsep by-\parsep}}
|
blanchet@36918
|
71 |
{\end{list}}
|
blanchet@36918
|
72 |
|
blanchet@36918
|
73 |
\def\pre{\begingroup\vskip0pt plus1ex\advance\leftskip by\leftmargin
|
blanchet@36918
|
74 |
\advance\rightskip by\leftmargin}
|
blanchet@36918
|
75 |
\def\post{\vskip0pt plus1ex\endgroup}
|
blanchet@36918
|
76 |
|
blanchet@36918
|
77 |
\def\prew{\pre\advance\rightskip by-\leftmargin}
|
blanchet@36918
|
78 |
\def\postw{\post}
|
blanchet@36918
|
79 |
|
blanchet@36918
|
80 |
\section{Introduction}
|
blanchet@36918
|
81 |
\label{introduction}
|
blanchet@36918
|
82 |
|
blanchet@43805
|
83 |
Sledgehammer is a tool that applies automatic theorem provers (ATPs)
|
blanchet@41190
|
84 |
and satisfiability-modulo-theories (SMT) solvers on the current goal. The
|
blanchet@43805
|
85 |
supported ATPs are E \cite{schulz-2002}, LEO-II \cite{leo2}, Satallax
|
blanchet@43805
|
86 |
\cite{satallax}, SInE-E \cite{sine}, SNARK \cite{snark}, SPASS
|
blanchet@43805
|
87 |
\cite{weidenbach-et-al-2009}, ToFoF-E \cite{tofof}, Vampire
|
blanchet@43786
|
88 |
\cite{riazanov-voronkov-2002}, and Waldmeister \cite{waldmeister}. The ATPs are
|
blanchet@43786
|
89 |
run either locally or remotely via the System\-On\-TPTP web service
|
blanchet@43781
|
90 |
\cite{sutcliffe-2000}. In addition to the ATPs, the SMT solvers Z3 \cite{z3} is
|
blanchet@43786
|
91 |
used by default, and you can tell Sledgehammer to try CVC3 \cite{cvc3} and Yices
|
blanchet@43786
|
92 |
\cite{yices} as well; these are run either locally or on a server at the TU
|
blanchet@43786
|
93 |
M\"unchen.
|
blanchet@36918
|
94 |
|
blanchet@40254
|
95 |
The problem passed to the automatic provers consists of your current goal
|
blanchet@40254
|
96 |
together with a heuristic selection of hundreds of facts (theorems) from the
|
blanchet@40254
|
97 |
current theory context, filtered by relevance. Because jobs are run in the
|
blanchet@40254
|
98 |
background, you can continue to work on your proof by other means. Provers can
|
blanchet@40254
|
99 |
be run in parallel. Any reply (which may arrive half a minute later) will appear
|
blanchet@40254
|
100 |
in the Proof General response buffer.
|
blanchet@37517
|
101 |
|
blanchet@40254
|
102 |
The result of a successful proof search is some source text that usually (but
|
blanchet@40254
|
103 |
not always) reconstructs the proof within Isabelle. For ATPs, the reconstructed
|
blanchet@40254
|
104 |
proof relies on the general-purpose Metis prover \cite{metis}, which is fully
|
blanchet@40254
|
105 |
integrated into Isabelle/HOL, with explicit inferences going through the kernel.
|
blanchet@40254
|
106 |
Thus its results are correct by construction.
|
blanchet@36918
|
107 |
|
blanchet@39566
|
108 |
In this manual, we will explicitly invoke the \textbf{sledgehammer} command.
|
blanchet@39566
|
109 |
Sledgehammer also provides an automatic mode that can be enabled via the
|
blanchet@39566
|
110 |
``Auto Sledgehammer'' option from the ``Isabelle'' menu in Proof General. In
|
blanchet@39566
|
111 |
this mode, Sledgehammer is run on every newly entered theorem. The time limit
|
blanchet@39566
|
112 |
for Auto Sledgehammer and other automatic tools can be set using the ``Auto
|
blanchet@39566
|
113 |
Tools Time Limit'' option.
|
blanchet@39566
|
114 |
|
blanchet@36918
|
115 |
\newbox\boxA
|
blanchet@36918
|
116 |
\setbox\boxA=\hbox{\texttt{nospam}}
|
blanchet@36918
|
117 |
|
blanchet@43628
|
118 |
\newcommand\authoremail{\texttt{blan{\color{white}nospam}\kern-\wd\boxA{}chette@\allowbreak
|
blanchet@43628
|
119 |
in.\allowbreak tum.\allowbreak de}}
|
blanchet@43628
|
120 |
|
blanchet@40937
|
121 |
To run Sledgehammer, you must make sure that the theory \textit{Sledgehammer} is
|
blanchet@40937
|
122 |
imported---this is rarely a problem in practice since it is part of
|
blanchet@40937
|
123 |
\textit{Main}. Examples of Sledgehammer use can be found in Isabelle's
|
blanchet@36918
|
124 |
\texttt{src/HOL/Metis\_Examples} directory.
|
blanchet@36918
|
125 |
Comments and bug reports concerning Sledgehammer or this manual should be
|
blanchet@43752
|
126 |
directed to the author at \authoremail.
|
blanchet@36918
|
127 |
|
blanchet@36918
|
128 |
\vskip2.5\smallskipamount
|
blanchet@36918
|
129 |
|
blanchet@36918
|
130 |
%\textbf{Acknowledgment.} The author would like to thank Mark Summerfield for
|
blanchet@36918
|
131 |
%suggesting several textual improvements.
|
blanchet@36918
|
132 |
|
blanchet@36918
|
133 |
\section{Installation}
|
blanchet@36918
|
134 |
\label{installation}
|
blanchet@36918
|
135 |
|
blanchet@36918
|
136 |
Sledgehammer is part of Isabelle, so you don't need to install it. However, it
|
blanchet@43628
|
137 |
relies on third-party automatic theorem provers (ATPs) and SMT solvers.
|
blanchet@43628
|
138 |
|
blanchet@43628
|
139 |
\subsection{Installing ATPs}
|
blanchet@43628
|
140 |
|
blanchet@40254
|
141 |
Currently, E, SPASS, and Vampire can be run locally; in addition, E, Vampire,
|
blanchet@43805
|
142 |
LEO-II, Satallax, SInE-E, SNARK, ToFoF-E, and Waldmeister are available remotely
|
blanchet@43805
|
143 |
via System\-On\-TPTP \cite{sutcliffe-2000}. If you want better performance, you
|
blanchet@43781
|
144 |
should at least install E and SPASS locally.
|
blanchet@36918
|
145 |
|
blanchet@38289
|
146 |
There are three main ways to install ATPs on your machine:
|
blanchet@36918
|
147 |
|
blanchet@36918
|
148 |
\begin{enum}
|
blanchet@36918
|
149 |
\item[$\bullet$] If you installed an official Isabelle package with everything
|
blanchet@36918
|
150 |
inside, it should already include properly setup executables for E and SPASS,
|
blanchet@38289
|
151 |
ready to use.%
|
blanchet@38289
|
152 |
\footnote{Vampire's license prevents us from doing the same for this otherwise
|
blanchet@38289
|
153 |
wonderful tool.}
|
blanchet@36918
|
154 |
|
blanchet@38289
|
155 |
\item[$\bullet$] Alternatively, you can download the Isabelle-aware E and SPASS
|
blanchet@36918
|
156 |
binary packages from Isabelle's download page. Extract the archives, then add a
|
blanchet@42618
|
157 |
line to your \texttt{\$ISABELLE\_HOME\_USER/etc/components}%
|
blanchet@42618
|
158 |
\footnote{The variable \texttt{\$ISABELLE\_HOME\_USER} is set by Isabelle at
|
blanchet@42618
|
159 |
startup. Its value can be retrieved by invoking \texttt{isabelle}
|
blanchet@42618
|
160 |
\texttt{getenv} \texttt{ISABELLE\_HOME\_USER} on the command line.}
|
blanchet@42618
|
161 |
file with the absolute
|
blanchet@40444
|
162 |
path to E or SPASS. For example, if the \texttt{components} does not exist yet
|
blanchet@40444
|
163 |
and you extracted SPASS to \texttt{/usr/local/spass-3.7}, create the
|
blanchet@40444
|
164 |
\texttt{components} file with the single line
|
blanchet@36918
|
165 |
|
blanchet@36918
|
166 |
\prew
|
blanchet@36918
|
167 |
\texttt{/usr/local/spass-3.7}
|
blanchet@36918
|
168 |
\postw
|
blanchet@36918
|
169 |
|
blanchet@38289
|
170 |
in it.
|
blanchet@38289
|
171 |
|
blanchet@38289
|
172 |
\item[$\bullet$] If you prefer to build E or SPASS yourself, or obtained a
|
blanchet@38289
|
173 |
Vampire executable from somewhere (e.g., \url{http://www.vprover.org/}),
|
blanchet@38289
|
174 |
set the environment variable \texttt{E\_HOME}, \texttt{SPASS\_HOME}, or
|
blanchet@38289
|
175 |
\texttt{VAMPIRE\_HOME} to the directory that contains the \texttt{eproof},
|
blanchet@38309
|
176 |
\texttt{SPASS}, or \texttt{vampire} executable. Sledgehammer has been tested
|
blanchet@43714
|
177 |
with E 1.0 and 1.2, SPASS 3.5 and 3.7, and Vampire 0.6 and 1.0%
|
blanchet@38309
|
178 |
\footnote{Following the rewrite of Vampire, the counter for version numbers was
|
blanchet@43714
|
179 |
reset to 0; hence the (new) Vampire versions 0.6 and 1.0 are more recent than,
|
blanchet@43714
|
180 |
say, Vampire 11.5.}%
|
blanchet@38309
|
181 |
. Since the ATPs' output formats are neither documented nor stable, other
|
blanchet@43628
|
182 |
versions of the ATPs might or might not work well with Sledgehammer. Ideally,
|
blanchet@43628
|
183 |
also set \texttt{E\_VERSION}, \texttt{SPASS\_VERSION}, or
|
blanchet@43628
|
184 |
\texttt{VAMPIRE\_VERSION} to the ATP's version number (e.g., ``1.2'').
|
blanchet@36918
|
185 |
\end{enum}
|
blanchet@36918
|
186 |
|
blanchet@43628
|
187 |
To check whether E and SPASS are successfully installed, follow the example in
|
blanchet@43628
|
188 |
\S\ref{first-steps}. If the remote versions of E and SPASS are used (identified
|
blanchet@43628
|
189 |
by the prefix ``\emph{remote\_}''), or if the local versions fail to solve the
|
blanchet@43628
|
190 |
easy goal presented there, this is a sign that something is wrong with your
|
blanchet@43628
|
191 |
installation.
|
blanchet@36918
|
192 |
|
blanchet@37517
|
193 |
Remote ATP invocation via the SystemOnTPTP web service requires Perl with the
|
blanchet@39388
|
194 |
World Wide Web Library (\texttt{libwww-perl}) installed. If you must use a proxy
|
blanchet@39388
|
195 |
server to access the Internet, set the \texttt{http\_proxy} environment variable
|
blanchet@39389
|
196 |
to the proxy, either in the environment in which Isabelle is launched or in your
|
blanchet@42618
|
197 |
\texttt{\char`\~/\$ISABELLE\_HOME\_USER/etc/settings} file. Here are a few examples:
|
blanchet@39388
|
198 |
|
blanchet@39388
|
199 |
\prew
|
blanchet@39389
|
200 |
\texttt{http\_proxy=http://proxy.example.org} \\
|
blanchet@39389
|
201 |
\texttt{http\_proxy=http://proxy.example.org:8080} \\
|
blanchet@39389
|
202 |
\texttt{http\_proxy=http://joeblow:pAsSwRd@proxy.example.org}
|
blanchet@39388
|
203 |
\postw
|
blanchet@37517
|
204 |
|
blanchet@43628
|
205 |
\subsection{Installing SMT Solvers}
|
blanchet@43628
|
206 |
|
blanchet@43786
|
207 |
CVC3, Yices, and Z3 can be run locally or (for CVC3 and Z3) remotely on a TU
|
blanchet@43786
|
208 |
M\"unchen server. If you want better performance and get the ability to replay
|
blanchet@43786
|
209 |
proofs that rely on the \emph{smt} proof method, you should at least install Z3
|
blanchet@43786
|
210 |
locally.
|
blanchet@43628
|
211 |
|
blanchet@43628
|
212 |
There are two main ways of installing SMT solvers locally.
|
blanchet@43628
|
213 |
|
blanchet@43628
|
214 |
\begin{enum}
|
blanchet@43628
|
215 |
\item[$\bullet$] If you installed an official Isabelle package with everything
|
blanchet@43628
|
216 |
inside, it should already include properly setup executables for CVC3 and Z3,
|
blanchet@43628
|
217 |
ready to use.%
|
blanchet@43628
|
218 |
\footnote{Yices's license prevents us from doing the same for this otherwise
|
blanchet@43628
|
219 |
wonderful tool.}
|
blanchet@43628
|
220 |
For Z3, you additionally need to set the environment variable
|
blanchet@43628
|
221 |
\texttt{Z3\_NON\_COMMERCIAL} to ``yes'' to confirm that you are a noncommercial
|
blanchet@43628
|
222 |
user.
|
blanchet@43628
|
223 |
|
blanchet@43628
|
224 |
\item[$\bullet$] Otherwise, follow the instructions documented in the \emph{SMT}
|
blanchet@43628
|
225 |
theory (\texttt{\$ISABELLE\_HOME/src/HOL/SMT.thy}).
|
blanchet@43628
|
226 |
\end{enum}
|
blanchet@43628
|
227 |
|
blanchet@36918
|
228 |
\section{First Steps}
|
blanchet@36918
|
229 |
\label{first-steps}
|
blanchet@36918
|
230 |
|
blanchet@36918
|
231 |
To illustrate Sledgehammer in context, let us start a theory file and
|
blanchet@36918
|
232 |
attempt to prove a simple lemma:
|
blanchet@36918
|
233 |
|
blanchet@36918
|
234 |
\prew
|
blanchet@36918
|
235 |
\textbf{theory}~\textit{Scratch} \\
|
blanchet@36918
|
236 |
\textbf{imports}~\textit{Main} \\
|
blanchet@36918
|
237 |
\textbf{begin} \\[2\smallskipamount]
|
blanchet@36918
|
238 |
%
|
blanchet@43786
|
239 |
\textbf{lemma} ``$[a] = [b] \,\Longrightarrow\, a = b$'' \\
|
blanchet@36918
|
240 |
\textbf{sledgehammer}
|
blanchet@36918
|
241 |
\postw
|
blanchet@36918
|
242 |
|
blanchet@37517
|
243 |
Instead of issuing the \textbf{sledgehammer} command, you can also find
|
blanchet@37517
|
244 |
Sledgehammer in the ``Commands'' submenu of the ``Isabelle'' menu in Proof
|
blanchet@37517
|
245 |
General or press the Emacs key sequence C-c C-a C-s.
|
blanchet@37517
|
246 |
Either way, Sledgehammer produces the following output after a few seconds:
|
blanchet@36918
|
247 |
|
blanchet@36918
|
248 |
\prew
|
blanchet@36918
|
249 |
\slshape
|
blanchet@40241
|
250 |
Sledgehammer: ``\textit{e}'' for subgoal 1: \\
|
blanchet@43786
|
251 |
$[a] = [b] \,\Longrightarrow\, a = b$ \\
|
blanchet@43786
|
252 |
Try this command: \textbf{by} (\textit{metis last\_ConsL}). \\
|
blanchet@43786
|
253 |
To minimize the number of lemmas, try this: \\
|
blanchet@43786
|
254 |
\textbf{sledgehammer} \textit{minimize} [\textit{prover} = \textit{e}] (\textit{last\_ConsL}). \\[3\smallskipamount]
|
blanchet@43786
|
255 |
%
|
blanchet@43786
|
256 |
Sledgehammer: ``\textit{vampire}'' for subgoal 1: \\
|
blanchet@43786
|
257 |
$[a] = [b] \,\Longrightarrow\, a = b$ \\
|
blanchet@36918
|
258 |
Try this command: \textbf{by} (\textit{metis hd.simps}). \\
|
blanchet@38289
|
259 |
To minimize the number of lemmas, try this: \\
|
blanchet@43786
|
260 |
\textbf{sledgehammer} \textit{minimize} [\textit{prover} = \textit{vampire}] (\textit{hd.simps}). \\[3\smallskipamount]
|
blanchet@36918
|
261 |
%
|
blanchet@40241
|
262 |
Sledgehammer: ``\textit{spass}'' for subgoal 1: \\
|
blanchet@43786
|
263 |
$[a] = [b] \,\Longrightarrow\, a = b$ \\
|
blanchet@43786
|
264 |
Try this command: \textbf{by} (\textit{metis list.inject}). \\
|
blanchet@38289
|
265 |
To minimize the number of lemmas, try this: \\
|
blanchet@43786
|
266 |
\textbf{sledgehammer} \textit{minimize} [\textit{prover} = \textit{spass}]~(\textit{list.inject}). \\[3\smallskipamount]
|
blanchet@36918
|
267 |
%
|
blanchet@43805
|
268 |
%Sledgehammer: ``\textit{remote\_waldmeister}'' for subgoal 1: \\
|
blanchet@43805
|
269 |
%$[a] = [b] \,\Longrightarrow\, a = b$ \\
|
blanchet@43805
|
270 |
%Try this command: \textbf{by} (\textit{metis hd.simps insert\_Nil}). \\
|
blanchet@43805
|
271 |
%To minimize the number of lemmas, try this: \\
|
blanchet@43805
|
272 |
%\textbf{sledgehammer} \textit{minimize} [\textit{prover} = \textit{remote\_waldmeister}] \\
|
blanchet@43805
|
273 |
%\phantom{\textbf{sledgehammer}~}(\textit{hd.simps insert\_Nil}). \\[3\smallskipamount]
|
blanchet@40254
|
274 |
%
|
blanchet@40254
|
275 |
Sledgehammer: ``\textit{remote\_sine\_e}'' for subgoal 1: \\
|
blanchet@43786
|
276 |
$[a] = [b] \,\Longrightarrow\, a = b$ \\
|
blanchet@43715
|
277 |
Try this command: \textbf{by} (\textit{metis hd.simps}). \\
|
blanchet@40254
|
278 |
To minimize the number of lemmas, try this: \\
|
blanchet@43715
|
279 |
\textbf{sledgehammer} \textit{minimize} [\textit{prover} = \textit{remote\_sine\_e}]~(\textit{hd.simps}). \\[3\smallskipamount]
|
blanchet@41190
|
280 |
%
|
blanchet@41190
|
281 |
Sledgehammer: ``\textit{remote\_z3}'' for subgoal 1: \\
|
blanchet@43786
|
282 |
$[a] = [b] \,\Longrightarrow\, a = b$ \\
|
blanchet@43715
|
283 |
Try this command: \textbf{by} (\textit{metis hd.simps}). \\
|
blanchet@41190
|
284 |
To minimize the number of lemmas, try this: \\
|
blanchet@43786
|
285 |
\textbf{sledgehammer} \textit{minimize} [\textit{prover} = \textit{remote\_z3}]~(\textit{hd.simps}).
|
blanchet@36918
|
286 |
\postw
|
blanchet@36918
|
287 |
|
blanchet@43805
|
288 |
Sledgehammer ran E, SInE-E, SPASS, Vampire, %Waldmeister,
|
blanchet@43805
|
289 |
and Z3 in parallel.
|
blanchet@43786
|
290 |
Depending on which provers are installed and how many processor cores are
|
blanchet@43786
|
291 |
available, some of the provers might be missing or present with a
|
blanchet@43805
|
292 |
\textit{remote\_} prefix.
|
blanchet@43805
|
293 |
%Waldmeister is run only for unit equational problems,
|
blanchet@43805
|
294 |
%where the goal's conclusion is a (universally quantified) equation.
|
blanchet@36918
|
295 |
|
blanchet@40254
|
296 |
For each successful prover, Sledgehammer gives a one-liner proof that uses the
|
blanchet@40254
|
297 |
\textit{metis} or \textit{smt} method. You can click the proof to insert it into
|
blanchet@40254
|
298 |
the theory text. You can click the ``\textbf{sledgehammer} \textit{minimize}''
|
blanchet@40254
|
299 |
command if you want to look for a shorter (and probably faster) proof. But here
|
blanchet@40254
|
300 |
the proof found by E looks perfect, so click it to finish the proof.
|
blanchet@36918
|
301 |
|
blanchet@36918
|
302 |
You can ask Sledgehammer for an Isar text proof by passing the
|
blanchet@43752
|
303 |
\textit{isar\_proof} option (\S\ref{output-format}):
|
blanchet@36918
|
304 |
|
blanchet@36918
|
305 |
\prew
|
blanchet@36918
|
306 |
\textbf{sledgehammer} [\textit{isar\_proof}]
|
blanchet@36918
|
307 |
\postw
|
blanchet@36918
|
308 |
|
blanchet@36918
|
309 |
When Isar proof construction is successful, it can yield proofs that are more
|
blanchet@36918
|
310 |
readable and also faster than the \textit{metis} one-liners. This feature is
|
blanchet@40254
|
311 |
experimental and is only available for ATPs.
|
blanchet@36918
|
312 |
|
blanchet@37517
|
313 |
\section{Hints}
|
blanchet@37517
|
314 |
\label{hints}
|
blanchet@37517
|
315 |
|
blanchet@43753
|
316 |
This section presents a few hints that should help you get the most out of
|
blanchet@43753
|
317 |
Sledgehammer and Metis. Frequently (and infrequently) asked questions are
|
blanchet@43753
|
318 |
answered in \S\ref{frequently-asked-questions}.
|
blanchet@43753
|
319 |
|
blanchet@43786
|
320 |
\newcommand\point[1]{\medskip\par{\sl\bfseries#1}\par\nopagebreak}
|
blanchet@43628
|
321 |
|
blanchet@43628
|
322 |
\point{Presimplify the goal}
|
blanchet@43628
|
323 |
|
blanchet@37517
|
324 |
For best results, first simplify your problem by calling \textit{auto} or at
|
blanchet@43786
|
325 |
least \textit{safe} followed by \textit{simp\_all}. The SMT solvers provide
|
blanchet@43786
|
326 |
arithmetic decision procedures, but the ATPs typically do not (or if they do,
|
blanchet@43786
|
327 |
Sledgehammer does not use it yet). Apart from Waldmeister, they are not
|
blanchet@43786
|
328 |
especially good at heavy rewriting, but because they regard equations as
|
blanchet@43786
|
329 |
undirected, they often prove theorems that require the reverse orientation of a
|
blanchet@43786
|
330 |
\textit{simp} rule. Higher-order problems can be tackled, but the success rate
|
blanchet@43786
|
331 |
is better for first-order problems. Hence, you may get better results if you
|
blanchet@43786
|
332 |
first simplify the problem to remove higher-order features.
|
blanchet@37517
|
333 |
|
blanchet@43628
|
334 |
\point{Make sure at least E, SPASS, Vampire, and Z3 are installed}
|
blanchet@43628
|
335 |
|
blanchet@43628
|
336 |
Locally installed provers are faster and more reliable than those running on
|
blanchet@43628
|
337 |
servers. See \S\ref{installation} for details on how to install them.
|
blanchet@43628
|
338 |
|
blanchet@43628
|
339 |
\point{Familiarize yourself with the most important options}
|
blanchet@43628
|
340 |
|
blanchet@43628
|
341 |
Sledgehammer's options are fully documented in \S\ref{command-syntax}. Many of
|
blanchet@43628
|
342 |
the options are very specialized, but serious users of the tool should at least
|
blanchet@43628
|
343 |
familiarize themselves with the following options:
|
blanchet@43628
|
344 |
|
blanchet@43628
|
345 |
\begin{enum}
|
blanchet@43753
|
346 |
\item[$\bullet$] \textbf{\textit{provers}} (\S\ref{mode-of-operation}) specifies
|
blanchet@43753
|
347 |
the automatic provers (ATPs and SMT solvers) that should be run whenever
|
blanchet@43753
|
348 |
Sledgehammer is invoked (e.g., ``\textit{provers}~= \textit{e spass
|
blanchet@43753
|
349 |
remote\_vampire}'').
|
blanchet@43628
|
350 |
|
blanchet@43753
|
351 |
\item[$\bullet$] \textbf{\textit{timeout}} (\S\ref{mode-of-operation}) controls
|
blanchet@43753
|
352 |
the provers' time limit. It is set to 30 seconds, but since Sledgehammer runs
|
blanchet@43753
|
353 |
asynchronously you should not hesitate to raise this limit to 60 or 120 seconds
|
blanchet@43753
|
354 |
if you are the kind of user who can think clearly while ATPs are active.
|
blanchet@43628
|
355 |
|
blanchet@43753
|
356 |
\item[$\bullet$] \textbf{\textit{full\_types}} (\S\ref{problem-encoding})
|
blanchet@43753
|
357 |
specifies whether type-sound encodings should be used. By default, Sledgehammer
|
blanchet@43753
|
358 |
employs a mixture of type-sound and type-unsound encodings, occasionally
|
blanchet@43753
|
359 |
yielding unsound ATP proofs. (SMT solver proofs should always be sound, although
|
blanchet@43753
|
360 |
we occasionally find soundness bugs in the solvers.)
|
blanchet@43628
|
361 |
|
blanchet@43753
|
362 |
\item[$\bullet$] \textbf{\textit{max\_relevant}} (\S\ref{relevance-filter})
|
blanchet@43753
|
363 |
specifies the maximum number of facts that should be passed to the provers. By
|
blanchet@43753
|
364 |
default, the value is prover-dependent but varies between about 150 and 1000. If
|
blanchet@43753
|
365 |
the provers time out, you can try lowering this value to, say, 100 or 50 and see
|
blanchet@43753
|
366 |
if that helps.
|
blanchet@43628
|
367 |
|
blanchet@43753
|
368 |
\item[$\bullet$] \textbf{\textit{isar\_proof}} (\S\ref{output-format}) specifies
|
blanchet@43753
|
369 |
that Isar proofs should be generated, instead of one-liner Metis proofs. The
|
blanchet@43753
|
370 |
length of the Isar proofs can be controlled by setting
|
blanchet@43753
|
371 |
\textit{isar\_shrink\_factor} (\S\ref{output-format}).
|
blanchet@43628
|
372 |
\end{enum}
|
blanchet@43628
|
373 |
|
blanchet@43753
|
374 |
Options can be set globally using \textbf{sledgehammer\_params}
|
blanchet@43753
|
375 |
(\S\ref{command-syntax}). Fact selection can be influenced by specifying
|
blanchet@43753
|
376 |
``$(\textit{add}{:}~\textit{my\_facts})$'' after the \textbf{sledgehammer}
|
blanchet@43753
|
377 |
call to ensure that certain facts are included, or simply
|
blanchet@43753
|
378 |
``$(\textit{my\_facts})$'' to force Sledgehammer to run only with
|
blanchet@43753
|
379 |
$\textit{my\_facts}$.
|
blanchet@43628
|
380 |
|
blanchet@43628
|
381 |
\section{Frequently Asked Questions}
|
blanchet@43628
|
382 |
\label{frequently-asked-questions}
|
blanchet@43628
|
383 |
|
blanchet@43786
|
384 |
This sections answers frequently (and infrequently) asked questions about
|
blanchet@43786
|
385 |
Sledgehammer. It is a good idea to skim over it now even if you don't have any
|
blanchet@43786
|
386 |
questions at this stage. And if you have any further questions not listed here,
|
blanchet@43786
|
387 |
send them to the author at \authoremail.
|
blanchet@43786
|
388 |
|
blanchet@43628
|
389 |
\point{Why does Metis fail to reconstruct the proof?}
|
blanchet@43628
|
390 |
|
blanchet@43752
|
391 |
There are many reasons. If Metis runs seemingly forever, that is a sign that the
|
blanchet@43752
|
392 |
proof is too difficult for it. Metis is complete, so it should eventually find
|
blanchet@43752
|
393 |
it, but that's little consolation. There are several possible solutions:
|
blanchet@43628
|
394 |
|
blanchet@43628
|
395 |
\begin{enum}
|
blanchet@43752
|
396 |
\item[$\bullet$] Try the \textit{isar\_proof} option (\S\ref{output-format}) to
|
blanchet@43752
|
397 |
obtain a step-by-step Isar proof where each step is justified by Metis. Since
|
blanchet@43752
|
398 |
the steps are fairly small, Metis is more likely to be able to replay them.
|
blanchet@43628
|
399 |
|
blanchet@43628
|
400 |
\item[$\bullet$] Try the \textit{smt} proof method instead of \textit{metis}. It
|
blanchet@43628
|
401 |
is usually stronger, but you need to have Z3 available to replay the proofs,
|
blanchet@43628
|
402 |
trust the SMT solver, or use certificates. See the documentation in the
|
blanchet@43628
|
403 |
\emph{SMT} theory (\texttt{\$ISABELLE\_HOME/src/HOL/SMT.thy}) for details.
|
blanchet@43628
|
404 |
|
blanchet@43628
|
405 |
\item[$\bullet$] Try the \textit{blast} or \textit{auto} proof methods, passing
|
blanchet@43628
|
406 |
facts via \textbf{unfolding}, \textbf{using}, \textit{intro}{:},
|
blanchet@43628
|
407 |
\textit{elim}{:}, \textit{dest}{:}, or \textit{simp}{:}, as appropriate.
|
blanchet@43628
|
408 |
\end{enum}
|
blanchet@43628
|
409 |
|
blanchet@43752
|
410 |
In some rare cases, Metis fails fairly quickly. This usually indicates that
|
blanchet@43752
|
411 |
Sledgehammer found a type-incorrect proof. Sledgehammer erases some type
|
blanchet@43752
|
412 |
information to speed up the search. Try Sledgehammer again with full type
|
blanchet@43752
|
413 |
information: \textit{full\_types} (\S\ref{problem-encoding}), or choose a
|
blanchet@43752
|
414 |
specific type encoding with \textit{type\_sys} (\S\ref{problem-encoding}). Older
|
blanchet@43752
|
415 |
versions of Sledgehammer were frequent victims of this problem. Now this should
|
blanchet@43752
|
416 |
very seldom be an issue, but if you notice many unsound proofs, contact the
|
blanchet@43752
|
417 |
author at \authoremail.
|
blanchet@43628
|
418 |
|
blanchet@43752
|
419 |
\point{How can I tell whether a Sledgehammer proof is sound?}
|
blanchet@43752
|
420 |
|
blanchet@43752
|
421 |
First, if \emph{metis} (or \emph{metisFT}) can reconstruct it, the proof is
|
blanchet@43752
|
422 |
sound (modulo soundness of Isabelle's inference kernel). If it fails or runs
|
blanchet@43752
|
423 |
seemingly forever, you can try
|
blanchet@43752
|
424 |
|
blanchet@43752
|
425 |
\prew
|
blanchet@43752
|
426 |
\textbf{apply}~\textbf{--} \\
|
blanchet@43752
|
427 |
\textbf{sledgehammer} [\textit{type\_sys} = \textit{poly\_tags}] (\textit{metis\_facts})
|
blanchet@43752
|
428 |
\postw
|
blanchet@43752
|
429 |
|
blanchet@43752
|
430 |
where \textit{metis\_facts} is the list of facts appearing in the suggested
|
blanchet@43752
|
431 |
Metis call. The automatic provers should be able to refind the proof very
|
blanchet@43752
|
432 |
quickly if it is sound, and the \textit{type\_sys} $=$ \textit{poly\_tags}
|
blanchet@43752
|
433 |
option (\S\ref{problem-encoding}) ensures that no unsound proofs are found.
|
blanchet@43752
|
434 |
|
blanchet@43752
|
435 |
The \textit{full\_types} option (\S\ref{problem-encoding}) can also be used
|
blanchet@43752
|
436 |
here, but it is unsound in extremely rare degenerate cases such as the
|
blanchet@43752
|
437 |
following:
|
blanchet@43752
|
438 |
|
blanchet@43752
|
439 |
\prew
|
blanchet@43786
|
440 |
\textbf{lemma} ``$\forall x\> y\Colon{'}\!a.\ x = y \,\Longrightarrow \exists f\> g\Colon\mathit{nat} \Rightarrow {'}\!a.\ f \not= g$'' \\
|
blanchet@43752
|
441 |
\textbf{sledgehammer} [\textit{full\_types}] (\textit{nat.distinct\/}(1))
|
blanchet@43752
|
442 |
\postw
|
blanchet@43752
|
443 |
|
blanchet@43752
|
444 |
\point{How does Sledgehammer select the facts that should be passed to the
|
blanchet@43752
|
445 |
automatic provers?}
|
blanchet@43752
|
446 |
|
blanchet@43752
|
447 |
Briefly, the relevance filter assigns a score to every available fact (lemma,
|
blanchet@43752
|
448 |
theorem, definition, or axiom)\ based upon how many constants that fact shares
|
blanchet@43786
|
449 |
with the conjecture. This process iterates to include facts relevant to those
|
blanchet@43752
|
450 |
just accepted, but with a decay factor to ensure termination. The constants are
|
blanchet@43752
|
451 |
weighted to give unusual ones greater significance. The relevance filter copes
|
blanchet@43752
|
452 |
best when the conjecture contains some unusual constants; if all the constants
|
blanchet@43752
|
453 |
are common, it is unable to discriminate among the hundreds of facts that are
|
blanchet@43752
|
454 |
picked up. The relevance filter is also memoryless: It has no information about
|
blanchet@43752
|
455 |
how many times a particular fact has been used in a proof, and it cannot learn.
|
blanchet@43752
|
456 |
|
blanchet@43752
|
457 |
The number of facts included in a problem varies from prover to prover, since
|
blanchet@43752
|
458 |
some provers get overwhelmed quicker than others. You can show the number of
|
blanchet@43752
|
459 |
facts given using the \textit{verbose} option (\S\ref{output-format}) and the
|
blanchet@43752
|
460 |
actual facts using \textit{debug} (\S\ref{output-format}).
|
blanchet@43752
|
461 |
|
blanchet@43752
|
462 |
Sledgehammer is good at finding short proofs combining a handful of existing
|
blanchet@43752
|
463 |
lemmas. If you are looking for longer proofs, you must typically restrict the
|
blanchet@43753
|
464 |
number of facts, by setting the \textit{max\_relevant} option
|
blanchet@43753
|
465 |
(\S\ref{relevance-filter}) to, say, 50 or 100.
|
blanchet@43752
|
466 |
|
blanchet@43837
|
467 |
You can also influence which facts are actually selected in a number of ways. If
|
blanchet@43837
|
468 |
you simply want to ensure that a fact is included, you can specify it using the
|
blanchet@43837
|
469 |
``$(\textit{add}{:}~\textit{my\_facts})$'' syntax. For example:
|
blanchet@43837
|
470 |
%
|
blanchet@43837
|
471 |
\prew
|
blanchet@43837
|
472 |
\textbf{sledgehammer} (\textit{add}: \textit{hd.simps} \textit{tl.simps})
|
blanchet@43837
|
473 |
\postw
|
blanchet@43837
|
474 |
%
|
blanchet@43837
|
475 |
The specified facts then replace the least relevant facts that would otherwise be
|
blanchet@43837
|
476 |
included; the other selected facts remain the same.
|
blanchet@43837
|
477 |
If you want to direct the selection in a particular direction, you can specify
|
blanchet@43837
|
478 |
the facts via \textbf{using}:
|
blanchet@43837
|
479 |
%
|
blanchet@43837
|
480 |
\prew
|
blanchet@43837
|
481 |
\textbf{using} \textit{hd.simps} \textit{tl.simps} \\
|
blanchet@43837
|
482 |
\textbf{sledgehammer}
|
blanchet@43837
|
483 |
\postw
|
blanchet@43837
|
484 |
%
|
blanchet@43837
|
485 |
The facts are then more likely to be selected than otherwise, and if they are
|
blanchet@43837
|
486 |
selected at iteration $j$ they also influence which facts are selected at
|
blanchet@43837
|
487 |
iterations $j + 1$, $j + 2$, etc. To give them even more weight, try
|
blanchet@43837
|
488 |
%
|
blanchet@43837
|
489 |
\prew
|
blanchet@43837
|
490 |
\textbf{using} \textit{hd.simps} \textit{tl.simps} \\
|
blanchet@43837
|
491 |
\textbf{apply}~\textbf{--} \\
|
blanchet@43837
|
492 |
\textbf{sledgehammer}
|
blanchet@43837
|
493 |
\postw
|
blanchet@43837
|
494 |
|
blanchet@43752
|
495 |
\point{Why are the Isar proofs generated by Sledgehammer so ugly?}
|
blanchet@43752
|
496 |
|
blanchet@43752
|
497 |
The current implementation is experimental and explodes exponentially in the
|
blanchet@43752
|
498 |
worst case. Work on a new implementation has begun. There is a large body of
|
blanchet@43752
|
499 |
research into transforming resolution proofs into natural deduction proofs (such
|
blanchet@43752
|
500 |
as Isar proofs), which we hope to leverage. In the meantime, a workaround is to
|
blanchet@43752
|
501 |
set the \textit{isar\_shrink\_factor} option (\S\ref{output-format}) to a larger
|
blanchet@43752
|
502 |
value or to try several provers and keep the nicest-looking proof.
|
blanchet@43752
|
503 |
|
blanchet@43752
|
504 |
\point{Should I let Sledgehammer minimize the number of lemmas?}
|
blanchet@43752
|
505 |
|
blanchet@43752
|
506 |
In general, minimization is a good idea, because proofs involving fewer lemmas
|
blanchet@43752
|
507 |
tend to be shorter as well, and hence easier to re-find by Metis. But the
|
blanchet@43752
|
508 |
opposite is sometimes the case.
|
blanchet@43752
|
509 |
|
blanchet@43752
|
510 |
\point{Why does the minimizer sometimes starts of its own?}
|
blanchet@43752
|
511 |
|
blanchet@43837
|
512 |
There are two scenarios in which this can happen. First, some provers (notably
|
blanchet@43837
|
513 |
CVC3, Satallax, and Yices) do not provide proofs or sometimes provide incomplete
|
blanchet@43837
|
514 |
proofs. The minimizer is then invoked to find out which facts are actually
|
blanchet@43837
|
515 |
needed from the (large) set of facts that was initinally given to the prover.
|
blanchet@43837
|
516 |
Second, if a prover returns a proof with lots of facts, the minimizer is invoked
|
blanchet@43752
|
517 |
automatically since Metis is unlikely to refind the proof.
|
blanchet@43752
|
518 |
|
blanchet@43752
|
519 |
\point{What is metisFT?}
|
blanchet@43752
|
520 |
|
blanchet@43752
|
521 |
The \textit{metisFT} proof method is the fully-typed version of Metis. It is
|
blanchet@43752
|
522 |
much slower than \textit{metis}, but the proof search is fully typed, and it
|
blanchet@43752
|
523 |
also includes more powerful rules such as the axiom ``$x = \mathit{True}
|
blanchet@43752
|
524 |
\mathrel{\lor} x = \mathit{False}$'' for reasoning in higher-order places (e.g.,
|
blanchet@43752
|
525 |
in set comprehensions). The method kicks in automatically as a fallback when
|
blanchet@43752
|
526 |
\textit{metis} fails, and it is sometimes generated by Sledgehammer instead of
|
blanchet@43752
|
527 |
\textit{metis} if the proof obviously requires type information.
|
blanchet@43752
|
528 |
|
blanchet@43752
|
529 |
If you see the warning
|
blanchet@43752
|
530 |
|
blanchet@43752
|
531 |
\prew
|
blanchet@43752
|
532 |
\textsl
|
blanchet@43752
|
533 |
Metis: Falling back on ``\textit{metisFT}''.
|
blanchet@43752
|
534 |
\postw
|
blanchet@43752
|
535 |
|
blanchet@43752
|
536 |
in a successful Metis proof, you can advantageously replace the \textit{metis}
|
blanchet@43752
|
537 |
call with \textit{metisFT}.
|
blanchet@43719
|
538 |
|
blanchet@43628
|
539 |
\point{I got a strange error from Sledgehammer---what should I do?}
|
blanchet@43628
|
540 |
|
blanchet@43628
|
541 |
Sledgehammer tries to give informative error messages. Please report any strange
|
blanchet@43752
|
542 |
error to the author at \authoremail. This applies double if you get the message
|
blanchet@43628
|
543 |
|
blanchet@43752
|
544 |
\prew
|
blanchet@43628
|
545 |
\slshape
|
blanchet@43746
|
546 |
The prover found a type-unsound proof involving ``\textit{foo}'',
|
blanchet@43846
|
547 |
``\textit{bar}'', and ``\textit{baz}'' even though a supposedly type-sound
|
blanchet@43846
|
548 |
encoding was used (or, less likely, your axioms are inconsistent). You might
|
blanchet@43846
|
549 |
want to report this to the Isabelle developers.
|
blanchet@43752
|
550 |
\postw
|
blanchet@43628
|
551 |
|
blanchet@43628
|
552 |
\point{Auto can solve it---why not Sledgehammer?}
|
blanchet@43628
|
553 |
|
blanchet@43628
|
554 |
Problems can be easy for \textit{auto} and difficult for automatic provers, but
|
blanchet@43628
|
555 |
the reverse is also true, so don't be discouraged if your first attempts fail.
|
blanchet@39566
|
556 |
Because the system refers to all theorems known to Isabelle, it is particularly
|
blanchet@39566
|
557 |
suitable when your goal has a short proof from lemmas that you don't know about.
|
blanchet@37517
|
558 |
|
blanchet@43752
|
559 |
\point{Why are there so many options?}
|
blanchet@43752
|
560 |
|
blanchet@43752
|
561 |
Sledgehammer's philosophy should work out of the box, without user guidance.
|
blanchet@43752
|
562 |
Many of the options are meant to be used mostly by the Sledgehammer developers
|
blanchet@43752
|
563 |
for experimentation purposes. Of course, feel free to experiment with them if
|
blanchet@43752
|
564 |
you are so inclined.
|
blanchet@43752
|
565 |
|
blanchet@36918
|
566 |
\section{Command Syntax}
|
blanchet@36918
|
567 |
\label{command-syntax}
|
blanchet@36918
|
568 |
|
blanchet@36918
|
569 |
Sledgehammer can be invoked at any point when there is an open goal by entering
|
blanchet@36918
|
570 |
the \textbf{sledgehammer} command in the theory file. Its general syntax is as
|
blanchet@36918
|
571 |
follows:
|
blanchet@36918
|
572 |
|
blanchet@36918
|
573 |
\prew
|
blanchet@36918
|
574 |
\textbf{sledgehammer} \textit{subcommand\/$^?$ options\/$^?$ facts\_override\/$^?$ num\/$^?$}
|
blanchet@36918
|
575 |
\postw
|
blanchet@36918
|
576 |
|
blanchet@36918
|
577 |
For convenience, Sledgehammer is also available in the ``Commands'' submenu of
|
blanchet@36918
|
578 |
the ``Isabelle'' menu in Proof General or by pressing the Emacs key sequence C-c
|
blanchet@36918
|
579 |
C-a C-s. This is equivalent to entering the \textbf{sledgehammer} command with
|
blanchet@36918
|
580 |
no arguments in the theory text.
|
blanchet@36918
|
581 |
|
blanchet@36918
|
582 |
In the general syntax, the \textit{subcommand} may be any of the following:
|
blanchet@36918
|
583 |
|
blanchet@36918
|
584 |
\begin{enum}
|
blanchet@40444
|
585 |
\item[$\bullet$] \textbf{\textit{run} (the default):} Runs Sledgehammer on
|
blanchet@40444
|
586 |
subgoal number \textit{num} (1 by default), with the given options and facts.
|
blanchet@36918
|
587 |
|
blanchet@36918
|
588 |
\item[$\bullet$] \textbf{\textit{minimize}:} Attempts to minimize the provided facts
|
blanchet@36918
|
589 |
(specified in the \textit{facts\_override} argument) to obtain a simpler proof
|
blanchet@36918
|
590 |
involving fewer facts. The options and goal number are as for \textit{run}.
|
blanchet@36918
|
591 |
|
blanchet@40444
|
592 |
\item[$\bullet$] \textbf{\textit{messages}:} Redisplays recent messages issued
|
blanchet@40444
|
593 |
by Sledgehammer. This allows you to examine results that might have been lost
|
blanchet@40444
|
594 |
due to Sledgehammer's asynchronous nature. The \textit{num} argument specifies a
|
blanchet@36918
|
595 |
limit on the number of messages to display (5 by default).
|
blanchet@36918
|
596 |
|
blanchet@42591
|
597 |
\item[$\bullet$] \textbf{\textit{supported\_provers}:} Prints the list of
|
blanchet@42588
|
598 |
automatic provers supported by Sledgehammer. See \S\ref{installation} and
|
blanchet@42588
|
599 |
\S\ref{mode-of-operation} for more information on how to install automatic
|
blanchet@42588
|
600 |
provers.
|
blanchet@36918
|
601 |
|
blanchet@40240
|
602 |
\item[$\bullet$] \textbf{\textit{running\_provers}:} Prints information about
|
blanchet@40240
|
603 |
currently running automatic provers, including elapsed runtime and remaining
|
blanchet@40240
|
604 |
time until timeout.
|
blanchet@36918
|
605 |
|
blanchet@40240
|
606 |
\item[$\bullet$] \textbf{\textit{kill\_provers}:} Terminates all running
|
blanchet@40240
|
607 |
automatic provers.
|
blanchet@36918
|
608 |
|
blanchet@36918
|
609 |
\item[$\bullet$] \textbf{\textit{refresh\_tptp}:} Refreshes the list of remote
|
blanchet@36918
|
610 |
ATPs available at System\-On\-TPTP \cite{sutcliffe-2000}.
|
blanchet@36918
|
611 |
\end{enum}
|
blanchet@36918
|
612 |
|
blanchet@36918
|
613 |
Sledgehammer's behavior can be influenced by various \textit{options}, which can
|
blanchet@36918
|
614 |
be specified in brackets after the \textbf{sledgehammer} command. The
|
blanchet@36918
|
615 |
\textit{options} are a list of key--value pairs of the form ``[$k_1 = v_1,
|
blanchet@36918
|
616 |
\ldots, k_n = v_n$]''. For Boolean options, ``= \textit{true}'' is optional. For
|
blanchet@36918
|
617 |
example:
|
blanchet@36918
|
618 |
|
blanchet@36918
|
619 |
\prew
|
blanchet@36918
|
620 |
\textbf{sledgehammer} [\textit{isar\_proof}, \,\textit{timeout} = 120$\,s$]
|
blanchet@36918
|
621 |
\postw
|
blanchet@36918
|
622 |
|
blanchet@36918
|
623 |
Default values can be set using \textbf{sledgehammer\_\allowbreak params}:
|
blanchet@36918
|
624 |
|
blanchet@36918
|
625 |
\prew
|
blanchet@36918
|
626 |
\textbf{sledgehammer\_params} \textit{options}
|
blanchet@36918
|
627 |
\postw
|
blanchet@36918
|
628 |
|
blanchet@36918
|
629 |
The supported options are described in \S\ref{option-reference}.
|
blanchet@36918
|
630 |
|
blanchet@36918
|
631 |
The \textit{facts\_override} argument lets you alter the set of facts that go
|
blanchet@36918
|
632 |
through the relevance filter. It may be of the form ``(\textit{facts})'', where
|
blanchet@36918
|
633 |
\textit{facts} is a space-separated list of Isabelle facts (theorems, local
|
blanchet@36918
|
634 |
assumptions, etc.), in which case the relevance filter is bypassed and the given
|
blanchet@39566
|
635 |
facts are used. It may also be of the form ``(\textit{add}:\ \textit{facts}$_1$)'',
|
blanchet@39566
|
636 |
``(\textit{del}:\ \textit{facts}$_2$)'', or ``(\textit{add}:\ \textit{facts}$_1$\
|
blanchet@39566
|
637 |
\textit{del}:\ \textit{facts}$_2$)'', where the relevance filter is instructed to
|
blanchet@36918
|
638 |
proceed as usual except that it should consider \textit{facts}$_1$
|
blanchet@36918
|
639 |
highly-relevant and \textit{facts}$_2$ fully irrelevant.
|
blanchet@36918
|
640 |
|
blanchet@39566
|
641 |
You can instruct Sledgehammer to run automatically on newly entered theorems by
|
blanchet@39566
|
642 |
enabling the ``Auto Sledgehammer'' option from the ``Isabelle'' menu in Proof
|
blanchet@40240
|
643 |
General. For automatic runs, only the first prover set using \textit{provers}
|
blanchet@43601
|
644 |
(\S\ref{mode-of-operation}) is considered, fewer facts are passed to the prover,
|
blanchet@43601
|
645 |
\textit{slicing} (\S\ref{mode-of-operation}) is disabled, \textit{timeout}
|
blanchet@40254
|
646 |
(\S\ref{mode-of-operation}) is superseded by the ``Auto Tools Time Limit'' in
|
blanchet@43601
|
647 |
Proof General's ``Isabelle'' menu, \textit{full\_types}
|
blanchet@43601
|
648 |
(\S\ref{problem-encoding}) is enabled, and \textit{verbose}
|
blanchet@43601
|
649 |
(\S\ref{output-format}) and \textit{debug} (\S\ref{output-format}) are disabled.
|
blanchet@43601
|
650 |
Sledgehammer's output is also more concise.
|
blanchet@39566
|
651 |
|
blanchet@36918
|
652 |
\section{Option Reference}
|
blanchet@36918
|
653 |
\label{option-reference}
|
blanchet@36918
|
654 |
|
blanchet@36918
|
655 |
\def\flushitem#1{\item[]\noindent\kern-\leftmargin \textbf{#1}}
|
blanchet@36918
|
656 |
\def\qty#1{$\left<\textit{#1}\right>$}
|
blanchet@36918
|
657 |
\def\qtybf#1{$\mathbf{\left<\textbf{\textit{#1}}\right>}$}
|
blanchet@36918
|
658 |
\def\optrue#1#2{\flushitem{\textit{#1} $\bigl[$= \qtybf{bool}$\bigr]$\quad [\textit{true}]\hfill (neg.: \textit{#2})}\nopagebreak\\[\parskip]}
|
blanchet@36918
|
659 |
\def\opfalse#1#2{\flushitem{\textit{#1} $\bigl[$= \qtybf{bool}$\bigr]$\quad [\textit{false}]\hfill (neg.: \textit{#2})}\nopagebreak\\[\parskip]}
|
blanchet@36918
|
660 |
\def\opsmart#1#2{\flushitem{\textit{#1} $\bigl[$= \qtybf{bool\_or\_smart}$\bigr]$\quad [\textit{smart}]\hfill (neg.: \textit{#2})}\nopagebreak\\[\parskip]}
|
blanchet@36918
|
661 |
\def\opsmartx#1#2{\flushitem{\textit{#1} $\bigl[$= \qtybf{bool\_or\_smart}$\bigr]$\quad [\textit{smart}]\hfill\\\hbox{}\hfill (neg.: \textit{#2})}\nopagebreak\\[\parskip]}
|
blanchet@36918
|
662 |
\def\opnodefault#1#2{\flushitem{\textit{#1} = \qtybf{#2}} \nopagebreak\\[\parskip]}
|
blanchet@36918
|
663 |
\def\opdefault#1#2#3{\flushitem{\textit{#1} = \qtybf{#2}\quad [\textit{#3}]} \nopagebreak\\[\parskip]}
|
blanchet@36918
|
664 |
\def\oparg#1#2#3{\flushitem{\textit{#1} \qtybf{#2} = \qtybf{#3}} \nopagebreak\\[\parskip]}
|
blanchet@36918
|
665 |
\def\opargbool#1#2#3{\flushitem{\textit{#1} \qtybf{#2} $\bigl[$= \qtybf{bool}$\bigr]$\hfill (neg.: \textit{#3})}\nopagebreak\\[\parskip]}
|
blanchet@36918
|
666 |
\def\opargboolorsmart#1#2#3{\flushitem{\textit{#1} \qtybf{#2} $\bigl[$= \qtybf{bool\_or\_smart}$\bigr]$\hfill (neg.: \textit{#3})}\nopagebreak\\[\parskip]}
|
blanchet@36918
|
667 |
|
blanchet@36918
|
668 |
Sledgehammer's options are categorized as follows:\ mode of operation
|
blanchet@39228
|
669 |
(\S\ref{mode-of-operation}), problem encoding (\S\ref{problem-encoding}),
|
blanchet@39228
|
670 |
relevance filter (\S\ref{relevance-filter}), output format
|
blanchet@39228
|
671 |
(\S\ref{output-format}), and authentication (\S\ref{authentication}).
|
blanchet@36918
|
672 |
|
blanchet@36918
|
673 |
The descriptions below refer to the following syntactic quantities:
|
blanchet@36918
|
674 |
|
blanchet@36918
|
675 |
\begin{enum}
|
blanchet@36918
|
676 |
\item[$\bullet$] \qtybf{string}: A string.
|
blanchet@36918
|
677 |
\item[$\bullet$] \qtybf{bool\/}: \textit{true} or \textit{false}.
|
blanchet@40444
|
678 |
\item[$\bullet$] \qtybf{bool\_or\_smart\/}: \textit{true}, \textit{false}, or
|
blanchet@40444
|
679 |
\textit{smart}.
|
blanchet@36918
|
680 |
\item[$\bullet$] \qtybf{int\/}: An integer.
|
blanchet@43589
|
681 |
%\item[$\bullet$] \qtybf{float\/}: A floating-point number (e.g., 2.5).
|
blanchet@40584
|
682 |
\item[$\bullet$] \qtybf{float\_pair\/}: A pair of floating-point numbers
|
blanchet@40584
|
683 |
(e.g., 0.6 0.95).
|
blanchet@38814
|
684 |
\item[$\bullet$] \qtybf{int\_or\_smart\/}: An integer or \textit{smart}.
|
blanchet@40584
|
685 |
\item[$\bullet$] \qtybf{float\_or\_none\/}: An integer (e.g., 60) or
|
blanchet@40584
|
686 |
floating-point number (e.g., 0.5) expressing a number of seconds, or the keyword
|
blanchet@40584
|
687 |
\textit{none} ($\infty$ seconds).
|
blanchet@36918
|
688 |
\end{enum}
|
blanchet@36918
|
689 |
|
blanchet@36918
|
690 |
Default values are indicated in square brackets. Boolean options have a negated
|
blanchet@39228
|
691 |
counterpart (e.g., \textit{blocking} vs.\ \textit{non\_blocking}). When setting
|
blanchet@36918
|
692 |
Boolean options, ``= \textit{true}'' may be omitted.
|
blanchet@36918
|
693 |
|
blanchet@36918
|
694 |
\subsection{Mode of Operation}
|
blanchet@36918
|
695 |
\label{mode-of-operation}
|
blanchet@36918
|
696 |
|
blanchet@36918
|
697 |
\begin{enum}
|
blanchet@40240
|
698 |
\opnodefault{provers}{string}
|
blanchet@40240
|
699 |
Specifies the automatic provers to use as a space-separated list (e.g.,
|
blanchet@43786
|
700 |
``\textit{e}~\textit{spass}''). The following local provers are supported:
|
blanchet@36918
|
701 |
|
blanchet@36918
|
702 |
\begin{enum}
|
blanchet@43786
|
703 |
\item[$\bullet$] \textbf{\textit{cvc3}:} CVC3 is an SMT solver developed by
|
blanchet@43786
|
704 |
Clark Barrett, Cesare Tinelli, and their colleagues \cite{cvc3}. To use CVC3,
|
blanchet@43786
|
705 |
set the environment variable \texttt{CVC3\_SOLVER} to the complete path of the
|
blanchet@43786
|
706 |
executable, including the file name. Sledgehammer has been tested with version
|
blanchet@43786
|
707 |
2.2.
|
blanchet@43786
|
708 |
|
blanchet@43805
|
709 |
\item[$\bullet$] \textbf{\textit{e}:} E is a first-order resolution prover
|
blanchet@43805
|
710 |
developed by Stephan Schulz \cite{schulz-2002}. To use E, set the environment
|
blanchet@43805
|
711 |
variable \texttt{E\_HOME} to the directory that contains the \texttt{eproof}
|
blanchet@43805
|
712 |
executable, or install the prebuilt E package from Isabelle's download page. See
|
blanchet@36918
|
713 |
\S\ref{installation} for details.
|
blanchet@36918
|
714 |
|
blanchet@43805
|
715 |
\item[$\bullet$] \textbf{\textit{spass}:} SPASS is a first-order resolution
|
blanchet@43805
|
716 |
prover developed by Christoph Weidenbach et al.\ \cite{weidenbach-et-al-2009}.
|
blanchet@43805
|
717 |
To use SPASS, set the environment variable \texttt{SPASS\_HOME} to the directory
|
blanchet@43805
|
718 |
that contains the \texttt{SPASS} executable, or install the prebuilt SPASS
|
blanchet@43805
|
719 |
package from Isabelle's download page. Sledgehammer requires version 3.5 or
|
blanchet@43805
|
720 |
above. See \S\ref{installation} for details.
|
blanchet@36918
|
721 |
|
blanchet@43786
|
722 |
\item[$\bullet$] \textbf{\textit{yices}:} Yices is an SMT solver developed at
|
blanchet@43786
|
723 |
SRI \cite{yices}. To use Yices, set the environment variable
|
blanchet@43786
|
724 |
\texttt{YICES\_SOLVER} to the complete path of the executable, including the
|
blanchet@43786
|
725 |
file name. Sledgehammer has been tested with version 1.0.
|
blanchet@43786
|
726 |
|
blanchet@43805
|
727 |
\item[$\bullet$] \textbf{\textit{vampire}:} Vampire is a first-order resolution
|
blanchet@43805
|
728 |
prover developed by Andrei Voronkov and his colleagues
|
blanchet@43805
|
729 |
\cite{riazanov-voronkov-2002}. To use Vampire, set the environment variable
|
blanchet@43805
|
730 |
\texttt{VAMPIRE\_HOME} to the directory that contains the \texttt{vampire}
|
blanchet@43805
|
731 |
executable. Sledgehammer has been tested with versions 11, 0.6, and 1.0.
|
blanchet@36918
|
732 |
|
blanchet@42611
|
733 |
\item[$\bullet$] \textbf{\textit{z3}:} Z3 is an SMT solver developed at
|
blanchet@42611
|
734 |
Microsoft Research \cite{z3}. To use Z3, set the environment variable
|
blanchet@42611
|
735 |
\texttt{Z3\_SOLVER} to the complete path of the executable, including the file
|
blanchet@43786
|
736 |
name, and set \texttt{Z3\_NON\_COMMERCIAL=yes} to confirm that you are a
|
blanchet@43786
|
737 |
noncommercial user. Sledgehammer has been tested with versions 2.7 to 2.18.
|
blanchet@42611
|
738 |
|
blanchet@42611
|
739 |
\item[$\bullet$] \textbf{\textit{z3\_atp}:} This version of Z3 pretends to be an
|
blanchet@42611
|
740 |
ATP, exploiting Z3's undocumented support for the TPTP format. It is included
|
blanchet@43313
|
741 |
for experimental purposes. It requires version 2.18 or above.
|
blanchet@43786
|
742 |
\end{enum}
|
blanchet@43786
|
743 |
|
blanchet@43786
|
744 |
In addition, the following remote provers are supported:
|
blanchet@43786
|
745 |
|
blanchet@43786
|
746 |
\begin{enum}
|
blanchet@43786
|
747 |
\item[$\bullet$] \textbf{\textit{remote\_cvc3}:} The remote version of CVC3 runs
|
blanchet@43786
|
748 |
on servers at the TU M\"unchen (or wherever \texttt{REMOTE\_SMT\_URL} is set to
|
blanchet@43786
|
749 |
point).
|
blanchet@40254
|
750 |
|
blanchet@38824
|
751 |
\item[$\bullet$] \textbf{\textit{remote\_e}:} The remote version of E runs
|
blanchet@36918
|
752 |
on Geoff Sutcliffe's Miami servers \cite{sutcliffe-2000}.
|
blanchet@36918
|
753 |
|
blanchet@43805
|
754 |
\item[$\bullet$] \textbf{\textit{remote\_leo2}:} LEO-II is an automatic
|
blanchet@43805
|
755 |
higher-order prover developed by Christoph Benzm\"uller et al. \cite{leo2}. The
|
blanchet@43805
|
756 |
remote version of LEO-II runs on Geoff Sutcliffe's Miami servers. In the current
|
blanchet@43805
|
757 |
setup, the problems given to LEO-II are only mildly higher-order.
|
blanchet@43805
|
758 |
|
blanchet@43805
|
759 |
\item[$\bullet$] \textbf{\textit{remote\_satallax}:} Satallax is an automatic
|
blanchet@43805
|
760 |
higher-order prover developed by Chad Brown et al. \cite{satallax}. The remote
|
blanchet@43805
|
761 |
version of Satallax runs on Geoff Sutcliffe's Miami servers. In the current
|
blanchet@43805
|
762 |
setup, the problems given to Satallax are only mildly higher-order.
|
blanchet@43805
|
763 |
|
blanchet@38824
|
764 |
\item[$\bullet$] \textbf{\textit{remote\_sine\_e}:} SInE-E is a metaprover
|
blanchet@38824
|
765 |
developed by Kry\v stof Hoder \cite{sine} based on E. The remote version of
|
blanchet@38824
|
766 |
SInE runs on Geoff Sutcliffe's Miami servers.
|
blanchet@38824
|
767 |
|
blanchet@43805
|
768 |
\item[$\bullet$] \textbf{\textit{remote\_snark}:} SNARK is a first-order
|
blanchet@43805
|
769 |
resolution prover developed by Stickel et al.\ \cite{snark}. The remote version
|
blanchet@43805
|
770 |
of SNARK runs on Geoff Sutcliffe's Miami servers.
|
blanchet@40254
|
771 |
|
blanchet@43786
|
772 |
\item[$\bullet$] \textbf{\textit{remote\_tofof\_e}:} ToFoF-E is a metaprover
|
blanchet@43786
|
773 |
developed by Geoff Sutcliffe \cite{tofof} based on E running on his Miami
|
blanchet@43786
|
774 |
servers. This ATP supports a fragment of the TPTP many-typed first-order format
|
blanchet@43786
|
775 |
(TFF). It is supported primarily for experimenting with the
|
blanchet@43786
|
776 |
\textit{type\_sys} $=$ \textit{simple} option (\S\ref{problem-encoding}).
|
blanchet@43786
|
777 |
|
blanchet@43786
|
778 |
\item[$\bullet$] \textbf{\textit{remote\_vampire}:} The remote version of
|
blanchet@43786
|
779 |
Vampire runs on Geoff Sutcliffe's Miami servers. Version 9 is used.
|
blanchet@43786
|
780 |
|
blanchet@43781
|
781 |
\item[$\bullet$] \textbf{\textit{remote\_waldmeister}:} Waldmeister is a unit
|
blanchet@43786
|
782 |
equality prover developed by Hillenbrand et al.\ \cite{waldmeister}. It can be
|
blanchet@43786
|
783 |
used to prove universally quantified equations using unconditional equations.
|
blanchet@43786
|
784 |
The remote version of Waldmeister runs on Geoff Sutcliffe's Miami servers.
|
blanchet@42609
|
785 |
|
blanchet@41190
|
786 |
\item[$\bullet$] \textbf{\textit{remote\_z3}:} The remote version of Z3 runs on
|
blanchet@41190
|
787 |
servers at the TU M\"unchen (or wherever \texttt{REMOTE\_SMT\_URL} is set to
|
blanchet@41190
|
788 |
point).
|
blanchet@40254
|
789 |
|
blanchet@42611
|
790 |
\item[$\bullet$] \textbf{\textit{remote\_z3\_atp}:} The remote version of ``Z3
|
blanchet@42611
|
791 |
as an ATP'' runs on Geoff Sutcliffe's Miami servers.
|
blanchet@36918
|
792 |
\end{enum}
|
blanchet@36918
|
793 |
|
blanchet@41190
|
794 |
By default, Sledgehammer will run E, SPASS, Vampire, SInE-E, and Z3 (or whatever
|
blanchet@43089
|
795 |
the SMT module's \textit{smt\_solver} configuration option is set to) in
|
blanchet@40254
|
796 |
parallel---either locally or remotely, depending on the number of processor
|
blanchet@40254
|
797 |
cores available. For historical reasons, the default value of this option can be
|
blanchet@40254
|
798 |
overridden using the option ``Sledgehammer: Provers'' from the ``Isabelle'' menu
|
blanchet@40254
|
799 |
in Proof General.
|
blanchet@36918
|
800 |
|
blanchet@40240
|
801 |
It is a good idea to run several provers in parallel, although it could slow
|
blanchet@43805
|
802 |
down your machine. Running E, SPASS, and Vampire for 5~seconds yields a similar
|
blanchet@43805
|
803 |
success rate to running the most effective of these for 120~seconds
|
blanchet@43805
|
804 |
\cite{boehme-nipkow-2010}.
|
blanchet@40240
|
805 |
|
blanchet@40240
|
806 |
\opnodefault{prover}{string}
|
blanchet@40240
|
807 |
Alias for \textit{provers}.
|
blanchet@40240
|
808 |
|
blanchet@43753
|
809 |
%\opnodefault{atps}{string}
|
blanchet@43753
|
810 |
%Legacy alias for \textit{provers}.
|
blanchet@36918
|
811 |
|
blanchet@43753
|
812 |
%\opnodefault{atp}{string}
|
blanchet@43753
|
813 |
%Legacy alias for \textit{provers}.
|
blanchet@36918
|
814 |
|
blanchet@40584
|
815 |
\opdefault{timeout}{float\_or\_none}{\upshape 30}
|
blanchet@40582
|
816 |
Specifies the maximum number of seconds that the automatic provers should spend
|
blanchet@43719
|
817 |
searching for a proof. This excludes problem preparation and is a soft limit.
|
blanchet@43719
|
818 |
For historical reasons, the default value of this option can be overridden using
|
blanchet@43719
|
819 |
the option ``Sledgehammer: Time Limit'' from the ``Isabelle'' menu in Proof
|
blanchet@43719
|
820 |
General.
|
blanchet@39228
|
821 |
|
blanchet@39227
|
822 |
\opfalse{blocking}{non\_blocking}
|
blanchet@39227
|
823 |
Specifies whether the \textbf{sledgehammer} command should operate
|
blanchet@39227
|
824 |
synchronously. The asynchronous (non-blocking) mode lets the user start proving
|
blanchet@39227
|
825 |
the putative theorem manually while Sledgehammer looks for a proof, but it can
|
blanchet@43836
|
826 |
also be more confusing. Irrespective of the value of this option, Sledgehammer
|
blanchet@43836
|
827 |
is always run synchronously for the new jEdit-based user interface or if
|
blanchet@43836
|
828 |
\textit{debug} (\S\ref{output-format}) is enabled.
|
blanchet@39227
|
829 |
|
blanchet@43314
|
830 |
\optrue{slicing}{no\_slicing}
|
blanchet@43314
|
831 |
Specifies whether the time allocated to a prover should be sliced into several
|
blanchet@43314
|
832 |
segments, each of which has its own set of possibly prover-dependent options.
|
blanchet@43317
|
833 |
For SPASS and Vampire, the first slice tries the fast but incomplete
|
blanchet@43314
|
834 |
set-of-support (SOS) strategy, whereas the second slice runs without it. For E,
|
blanchet@43317
|
835 |
up to three slices are tried, with different weighted search strategies and
|
blanchet@43314
|
836 |
number of facts. For SMT solvers, several slices are tried with the same options
|
blanchet@43317
|
837 |
each time but fewer and fewer facts. According to benchmarks with a timeout of
|
blanchet@43317
|
838 |
30 seconds, slicing is a valuable optimization, and you should probably leave it
|
blanchet@43317
|
839 |
enabled unless you are conducting experiments. This option is implicitly
|
blanchet@43314
|
840 |
disabled for (short) automatic runs.
|
blanchet@43314
|
841 |
|
blanchet@43314
|
842 |
\nopagebreak
|
blanchet@43314
|
843 |
{\small See also \textit{verbose} (\S\ref{output-format}).}
|
blanchet@43314
|
844 |
|
blanchet@36918
|
845 |
\opfalse{overlord}{no\_overlord}
|
blanchet@36918
|
846 |
Specifies whether Sledgehammer should put its temporary files in
|
blanchet@36918
|
847 |
\texttt{\$ISA\-BELLE\_\allowbreak HOME\_\allowbreak USER}, which is useful for
|
blanchet@36918
|
848 |
debugging Sledgehammer but also unsafe if several instances of the tool are run
|
blanchet@36918
|
849 |
simultaneously. The files are identified by the prefix \texttt{prob\_}; you may
|
blanchet@36918
|
850 |
safely remove them after Sledgehammer has run.
|
blanchet@36918
|
851 |
|
blanchet@36918
|
852 |
\nopagebreak
|
blanchet@36918
|
853 |
{\small See also \textit{debug} (\S\ref{output-format}).}
|
blanchet@36918
|
854 |
\end{enum}
|
blanchet@36918
|
855 |
|
blanchet@36918
|
856 |
\subsection{Problem Encoding}
|
blanchet@36918
|
857 |
\label{problem-encoding}
|
blanchet@36918
|
858 |
|
blanchet@36918
|
859 |
\begin{enum}
|
blanchet@36918
|
860 |
\opfalse{explicit\_apply}{implicit\_apply}
|
blanchet@36918
|
861 |
Specifies whether function application should be encoded as an explicit
|
blanchet@40254
|
862 |
``apply'' operator in ATP problems. If the option is set to \textit{false}, each
|
blanchet@40254
|
863 |
function will be directly applied to as many arguments as possible. Enabling
|
blanchet@40254
|
864 |
this option can sometimes help discover higher-order proofs that otherwise would
|
blanchet@40254
|
865 |
not be found.
|
blanchet@36918
|
866 |
|
blanchet@36918
|
867 |
\opfalse{full\_types}{partial\_types}
|
blanchet@43551
|
868 |
Specifies whether full type information is encoded in ATP problems. Enabling
|
blanchet@43601
|
869 |
this option prevents the discovery of type-incorrect proofs, but it can slow
|
blanchet@43601
|
870 |
down the ATP slightly. This option is implicitly enabled for automatic runs. For
|
blanchet@43601
|
871 |
historical reasons, the default value of this option can be overridden using the
|
blanchet@43601
|
872 |
option ``Sledgehammer: Full Types'' from the ``Isabelle'' menu in Proof General.
|
blanchet@43089
|
873 |
|
blanchet@43089
|
874 |
\opdefault{type\_sys}{string}{smart}
|
blanchet@43756
|
875 |
Specifies the type system to use in ATP problems. Some of the type systems are
|
blanchet@43756
|
876 |
unsound, meaning that they can give rise to spurious proofs (unreconstructible
|
blanchet@43756
|
877 |
using Metis). The supported type systems are listed below, with an indication of
|
blanchet@43756
|
878 |
their soundness in parentheses:
|
blanchet@43089
|
879 |
|
blanchet@43089
|
880 |
\begin{enum}
|
blanchet@43756
|
881 |
\item[$\bullet$] \textbf{\textit{erased} (very unsound):} No type information is
|
blanchet@43756
|
882 |
supplied to the ATP. Types are simply erased.
|
blanchet@43453
|
883 |
|
blanchet@43756
|
884 |
\item[$\bullet$] \textbf{\textit{poly\_preds} (sound):} Types are encoded using
|
blanchet@43756
|
885 |
a predicate \textit{has\_\allowbreak type\/}$(\tau, t)$ that restricts the range
|
blanchet@43756
|
886 |
of bound variables. Constants are annotated with their types, supplied as extra
|
blanchet@43756
|
887 |
arguments, to resolve overloading.
|
blanchet@43555
|
888 |
|
blanchet@43756
|
889 |
\item[$\bullet$] \textbf{\textit{poly\_tags} (sound):} Each term and subterm is
|
blanchet@43843
|
890 |
tagged with its type using a function $\mathit{type\_info\/}(\tau, t)$. This
|
blanchet@43843
|
891 |
coincides with the encoding used by the \textit{metisFT} command.
|
blanchet@43756
|
892 |
|
blanchet@43756
|
893 |
\item[$\bullet$] \textbf{\textit{poly\_args} (unsound):}
|
blanchet@43756
|
894 |
Like for \textit{poly\_preds} constants are annotated with their types to
|
blanchet@43843
|
895 |
resolve overloading, but otherwise no type information is encoded. This
|
blanchet@43843
|
896 |
coincides with the encoding used by the \textit{metis} command (before it falls
|
blanchet@43843
|
897 |
back on \textit{metisFT}).
|
blanchet@43555
|
898 |
|
blanchet@43587
|
899 |
\item[$\bullet$]
|
blanchet@43587
|
900 |
\textbf{%
|
blanchet@43756
|
901 |
\textit{mono\_preds}, \textit{mono\_tags} (sound);
|
blanchet@43756
|
902 |
\textit{mono\_args} (unsound):} \\
|
blanchet@43587
|
903 |
Similar to \textit{poly\_preds}, \textit{poly\_tags}, and \textit{poly\_args},
|
blanchet@43587
|
904 |
respectively, but the problem is additionally monomorphized, meaning that type
|
blanchet@43587
|
905 |
variables are instantiated with heuristically chosen ground types.
|
blanchet@43587
|
906 |
Monomorphization can simplify reasoning but also leads to larger fact bases,
|
blanchet@43587
|
907 |
which can slow down the ATPs.
|
blanchet@43453
|
908 |
|
blanchet@43587
|
909 |
\item[$\bullet$]
|
blanchet@43587
|
910 |
\textbf{%
|
blanchet@43587
|
911 |
\textit{mangled\_preds},
|
blanchet@43756
|
912 |
\textit{mangled\_tags} (sound); \\
|
blanchet@43756
|
913 |
\textit{mangled\_args} (unsound):} \\
|
blanchet@43587
|
914 |
Similar to
|
blanchet@43587
|
915 |
\textit{mono\_preds}, \textit{mono\_tags}, and \textit{mono\_args},
|
blanchet@43587
|
916 |
respectively but types are mangled in constant names instead of being supplied
|
blanchet@43587
|
917 |
as ground term arguments. The binary predicate $\mathit{has\_type\/}(\tau, t)$
|
blanchet@43587
|
918 |
becomes a unary predicate $\mathit{has\_type\_}\tau(t)$, and the binary function
|
blanchet@43460
|
919 |
$\mathit{type\_info\/}(\tau, t)$ becomes a unary function
|
blanchet@43460
|
920 |
$\mathit{type\_info\_}\tau(t)$.
|
blanchet@43453
|
921 |
|
blanchet@43756
|
922 |
\item[$\bullet$] \textbf{\textit{simple} (sound):} Use the prover's support for
|
blanchet@43805
|
923 |
simple types if available; otherwise, fall back on \textit{mangled\_preds}. The
|
blanchet@43805
|
924 |
problem is monomorphized.
|
blanchet@43551
|
925 |
|
blanchet@43551
|
926 |
\item[$\bullet$]
|
blanchet@43551
|
927 |
\textbf{%
|
blanchet@43756
|
928 |
\textit{poly\_preds}?, \textit{poly\_tags}?, \textit{mono\_preds}?, \textit{mono\_tags}?, \\
|
blanchet@43756
|
929 |
\textit{mangled\_preds}?, \textit{mangled\_tags}?, \textit{simple}? (quasi-sound):} \\
|
blanchet@43608
|
930 |
The type systems \textit{poly\_preds}, \textit{poly\_tags},
|
blanchet@43756
|
931 |
\textit{mono\_preds}, \textit{mono\_tags}, \textit{mangled\_preds},
|
blanchet@43756
|
932 |
\textit{mangled\_tags}, and \textit{simple} are fully typed and sound. For each
|
blanchet@43756
|
933 |
of these, Sledgehammer also provides a lighter, virtually sound variant
|
blanchet@43756
|
934 |
identified by a question mark (`{?}')\ that detects and erases monotonic types,
|
blanchet@43756
|
935 |
notably infinite types. (For \textit{simple}, the types are not actually erased
|
blanchet@43725
|
936 |
but rather replaced by a shared uniform type of individuals.)
|
blanchet@43460
|
937 |
|
blanchet@43756
|
938 |
\item[$\bullet$]
|
blanchet@43756
|
939 |
\textbf{%
|
blanchet@43756
|
940 |
\textit{poly\_preds}!, \textit{poly\_tags}!, \textit{mono\_preds}!, \textit{mono\_tags}!, \\
|
blanchet@43756
|
941 |
\textit{mangled\_preds}!, \textit{mangled\_tags}!, \textit{simple}! \\
|
blanchet@43756
|
942 |
(mildly unsound):} \\
|
blanchet@43756
|
943 |
The type systems \textit{poly\_preds}, \textit{poly\_tags},
|
blanchet@43756
|
944 |
\textit{mono\_preds}, \textit{mono\_tags}, \textit{mangled\_preds},
|
blanchet@43756
|
945 |
\textit{mangled\_tags}, and \textit{simple} also admit a mildly unsound (but
|
blanchet@43756
|
946 |
very efficient) variant identified by an exclamation mark (`{!}') that detects
|
blanchet@43756
|
947 |
and erases erases all types except those that are clearly finite (e.g.,
|
blanchet@43756
|
948 |
\textit{bool}). (For \textit{simple}, the types are not actually erased but
|
blanchet@43756
|
949 |
rather replaced by a shared uniform type of individuals.)
|
blanchet@43756
|
950 |
|
blanchet@43098
|
951 |
\item[$\bullet$] \textbf{\textit{smart}:} If \textit{full\_types} is enabled,
|
blanchet@43756
|
952 |
uses a sound or virtually sound encoding; otherwise, uses any encoding. The actual
|
blanchet@43756
|
953 |
encoding used depends on the ATP and should be the most efficient for that ATP.
|
blanchet@43089
|
954 |
\end{enum}
|
blanchet@43089
|
955 |
|
blanchet@43725
|
956 |
In addition, all the \textit{preds} and \textit{tags} type systems are available
|
blanchet@43725
|
957 |
in two variants, a lightweight and a heavyweight variant. The lightweight
|
blanchet@43725
|
958 |
variants are generally more efficient and are the default; the heavyweight
|
blanchet@43725
|
959 |
variants are identified by a \textit{\_heavy} suffix (e.g.,
|
blanchet@43725
|
960 |
\textit{mangled\_preds\_heavy}{?}).
|
blanchet@43394
|
961 |
|
blanchet@43725
|
962 |
For SMT solvers and ToFoF-E, the type system is always \textit{simple},
|
blanchet@43725
|
963 |
irrespective of the value of this option.
|
blanchet@43757
|
964 |
|
blanchet@43757
|
965 |
\nopagebreak
|
blanchet@43757
|
966 |
{\small See also \textit{max\_new\_mono\_instances} (\S\ref{relevance-filter})
|
blanchet@43757
|
967 |
and \textit{max\_mono\_iters} (\S\ref{relevance-filter}).}
|
blanchet@38814
|
968 |
\end{enum}
|
blanchet@36918
|
969 |
|
blanchet@38814
|
970 |
\subsection{Relevance Filter}
|
blanchet@38814
|
971 |
\label{relevance-filter}
|
blanchet@38814
|
972 |
|
blanchet@38814
|
973 |
\begin{enum}
|
blanchet@40584
|
974 |
\opdefault{relevance\_thresholds}{float\_pair}{\upshape 0.45~0.85}
|
blanchet@38985
|
975 |
Specifies the thresholds above which facts are considered relevant by the
|
blanchet@38985
|
976 |
relevance filter. The first threshold is used for the first iteration of the
|
blanchet@38985
|
977 |
relevance filter and the second threshold is used for the last iteration (if it
|
blanchet@38985
|
978 |
is reached). The effective threshold is quadratically interpolated for the other
|
blanchet@40584
|
979 |
iterations. Each threshold ranges from 0 to 1, where 0 means that all theorems
|
blanchet@40584
|
980 |
are relevant and 1 only theorems that refer to previously seen constants.
|
blanchet@36918
|
981 |
|
blanchet@40584
|
982 |
\opsmart{max\_relevant}{int\_or\_smart}
|
blanchet@38985
|
983 |
Specifies the maximum number of facts that may be returned by the relevance
|
blanchet@38985
|
984 |
filter. If the option is set to \textit{smart}, it is set to a value that was
|
blanchet@40240
|
985 |
empirically found to be appropriate for the prover. A typical value would be
|
blanchet@40240
|
986 |
300.
|
blanchet@43051
|
987 |
|
blanchet@43753
|
988 |
\opdefault{max\_new\_mono\_instances}{int}{\upshape 400}
|
blanchet@43753
|
989 |
Specifies the maximum number of monomorphic instances to generate beyond
|
blanchet@43753
|
990 |
\textit{max\_relevant}. The higher this limit is, the more monomorphic instances
|
blanchet@43753
|
991 |
are potentially generated. Whether monomorphization takes place depends on the
|
blanchet@43753
|
992 |
type system used.
|
blanchet@43753
|
993 |
|
blanchet@43753
|
994 |
\nopagebreak
|
blanchet@43753
|
995 |
{\small See also \textit{type\_sys} (\S\ref{problem-encoding}).}
|
blanchet@43753
|
996 |
|
blanchet@43753
|
997 |
\opdefault{max\_mono\_iters}{int}{\upshape 3}
|
blanchet@43753
|
998 |
Specifies the maximum number of iterations for the monomorphization fixpoint
|
blanchet@43753
|
999 |
construction. The higher this limit is, the more monomorphic instances are
|
blanchet@43753
|
1000 |
potentially generated. Whether monomorphization takes place depends on the
|
blanchet@43753
|
1001 |
type system used.
|
blanchet@43753
|
1002 |
|
blanchet@43753
|
1003 |
\nopagebreak
|
blanchet@43753
|
1004 |
{\small See also \textit{type\_sys} (\S\ref{problem-encoding}).}
|
blanchet@36918
|
1005 |
\end{enum}
|
blanchet@36918
|
1006 |
|
blanchet@36918
|
1007 |
\subsection{Output Format}
|
blanchet@36918
|
1008 |
\label{output-format}
|
blanchet@36918
|
1009 |
|
blanchet@36918
|
1010 |
\begin{enum}
|
blanchet@36918
|
1011 |
|
blanchet@36918
|
1012 |
\opfalse{verbose}{quiet}
|
blanchet@36918
|
1013 |
Specifies whether the \textbf{sledgehammer} command should explain what it does.
|
blanchet@41456
|
1014 |
This option is implicitly disabled for automatic runs.
|
blanchet@36918
|
1015 |
|
blanchet@36918
|
1016 |
\opfalse{debug}{no\_debug}
|
blanchet@40444
|
1017 |
Specifies whether Sledgehammer should display additional debugging information
|
blanchet@40444
|
1018 |
beyond what \textit{verbose} already displays. Enabling \textit{debug} also
|
blanchet@41456
|
1019 |
enables \textit{verbose} and \textit{blocking} (\S\ref{mode-of-operation})
|
blanchet@41456
|
1020 |
behind the scenes. The \textit{debug} option is implicitly disabled for
|
blanchet@41456
|
1021 |
automatic runs.
|
blanchet@36918
|
1022 |
|
blanchet@36918
|
1023 |
\nopagebreak
|
blanchet@36918
|
1024 |
{\small See also \textit{overlord} (\S\ref{mode-of-operation}).}
|
blanchet@36918
|
1025 |
|
blanchet@36918
|
1026 |
\opfalse{isar\_proof}{no\_isar\_proof}
|
blanchet@36918
|
1027 |
Specifies whether Isar proofs should be output in addition to one-liner
|
blanchet@36918
|
1028 |
\textit{metis} proofs. Isar proof construction is still experimental and often
|
blanchet@36918
|
1029 |
fails; however, they are usually faster and sometimes more robust than
|
blanchet@36918
|
1030 |
\textit{metis} proofs.
|
blanchet@36918
|
1031 |
|
blanchet@40584
|
1032 |
\opdefault{isar\_shrink\_factor}{int}{\upshape 1}
|
blanchet@36918
|
1033 |
Specifies the granularity of the Isar proof. A value of $n$ indicates that each
|
blanchet@36918
|
1034 |
Isar proof step should correspond to a group of up to $n$ consecutive proof
|
blanchet@36918
|
1035 |
steps in the ATP proof.
|
blanchet@36918
|
1036 |
|
blanchet@36918
|
1037 |
\end{enum}
|
blanchet@36918
|
1038 |
|
blanchet@39228
|
1039 |
\subsection{Authentication}
|
blanchet@39228
|
1040 |
\label{authentication}
|
blanchet@36918
|
1041 |
|
blanchet@36918
|
1042 |
\begin{enum}
|
blanchet@39228
|
1043 |
\opnodefault{expect}{string}
|
blanchet@39228
|
1044 |
Specifies the expected outcome, which must be one of the following:
|
blanchet@39228
|
1045 |
|
blanchet@39228
|
1046 |
\begin{enum}
|
blanchet@40444
|
1047 |
\item[$\bullet$] \textbf{\textit{some}:} Sledgehammer found a (potentially
|
blanchet@40444
|
1048 |
unsound) proof.
|
blanchet@39228
|
1049 |
\item[$\bullet$] \textbf{\textit{none}:} Sledgehammer found no proof.
|
blanchet@40444
|
1050 |
\item[$\bullet$] \textbf{\textit{unknown}:} Sledgehammer encountered some
|
blanchet@40444
|
1051 |
problem.
|
blanchet@39228
|
1052 |
\end{enum}
|
blanchet@39228
|
1053 |
|
blanchet@39228
|
1054 |
Sledgehammer emits an error (if \textit{blocking} is enabled) or a warning
|
blanchet@39228
|
1055 |
(otherwise) if the actual outcome differs from the expected outcome. This option
|
blanchet@39228
|
1056 |
is useful for regression testing.
|
blanchet@39228
|
1057 |
|
blanchet@39228
|
1058 |
\nopagebreak
|
blanchet@39228
|
1059 |
{\small See also \textit{blocking} (\S\ref{mode-of-operation}).}
|
blanchet@36918
|
1060 |
\end{enum}
|
blanchet@36918
|
1061 |
|
blanchet@36918
|
1062 |
\let\em=\sl
|
blanchet@36918
|
1063 |
\bibliography{../manual}{}
|
blanchet@36918
|
1064 |
\bibliographystyle{abbrv}
|
blanchet@36918
|
1065 |
|
blanchet@36918
|
1066 |
\end{document}
|