|
1 | 1 | # Scripting Interactive Proofs |
2 | 2 |
|
3 | | -To persist interactions performed during proof contsruction in KeY and to replay these |
4 | | -interactions, KeY allows users to use proof scripts. |
5 | 3 |
|
6 | | -In this documentation the scripts that allow for branching statements are eplained. (see [Explanation |
7 | | -of linear scripts](./linearScripts.md) for the other version of scripts in KeY) |
| 4 | +### Motivation for Proof Scripts in KeY |
8 | 5 |
|
9 | | -The three main building blocks of the scripting language are mutators, control-flow |
10 | | -structures, and selectors for proof goals. We describe the general concepts in the |
11 | | -following. |
| 6 | +Formal verification in KeY often requires revisiting and refining |
| 7 | +intermediate specifications like loop invariants through a highly |
| 8 | +iterative process. However, even small adjustments to the program or |
| 9 | +its specification can invalidate entire proofs, necessitating complete |
| 10 | +reconstruction. Although KeY's current mechanism can replay proofs |
| 11 | +from fine-grained rule applications, it is brittle and vulnerable to |
| 12 | +minor changes. Especially in low-automation contexts, where many steps |
| 13 | +are performed manually, repeating those steps is time-consuming and |
| 14 | +error-prone. |
12 | 15 |
|
13 | | -##Mutators. |
14 | | -Mutators are the most basic building blocks of the proof |
15 | | -script. When executed a mutator may change the proof script state by changing |
16 | | -variables and the underlying proof state by adding nodes to the proof tree. |
| 16 | +**Proof scripts offer a solution** by capturing the essential and complex reasoning steps, while delegating routine proof search tasks to the automatic engine. This significantly improves maintainability and usability of proofs as code or specifications evolve. |
| 17 | + |
| 18 | +### Benefits of Proof Scripts in KeY |
| 19 | + |
| 20 | +- **Robustness to Changes**: Scripts focus on core proof decisions rather than low-level steps, making them resilient to small changes in the code or specification. |
| 21 | +- **Increases Comprehensibility**: Proof scripts can convey the high-level proof ideas that allow users to understand the reasoning. |
| 22 | +- **Maintains Manual Effort**: Records manual proof actions (e.g., quantifier instantiations or definition expansions) so that they don't need to be repeated after specification changes. |
| 23 | +- **Improved Automation Synergy**: Proof scripts guide the prover through the difficult parts while letting the automated search handle simpler steps. |
| 24 | +- **Scalability to Complex Proofs**: Handles proof branching more effectively, applying scripts only where user interaction is needed. |
| 25 | +- **Better Usability over Previous Scripting**: Avoids complex top-level goal selection required in earlier global script mechanisms. |
| 26 | +- **Facilitates Proof Reuse**: Allows key insights and strategies to persist across code revisions, supporting iterative verification workflows. |
| 27 | + |
| 28 | +Proof scripts are textual representations of rule applications, |
| 29 | +settings changes and macro invocations. They are notated in linear |
| 30 | +order. The target of a script command is usually the first open goal |
| 31 | +in the proof tree, i.e., the first reached when traversing the proof |
| 32 | +tree (not necessarily the first in the Goal pane in the GUI). |
| 33 | + |
| 34 | +## Proof Script Languages |
| 35 | + |
| 36 | +There are two flavours of proof script languages. One more low-level |
| 37 | +for the interaction on the level of JavaDL and one for more high-level |
| 38 | +interaction on the level of JML annotated to Java code. |
| 39 | + |
| 40 | +### Linear Proof Scripts[^1] |
| 41 | + |
| 42 | +[Documentation of Linear Proof Scripts](linearScripts) |
| 43 | + |
| 44 | +Linear scripts are added to entire JavaDL proof obligations. They can |
| 45 | +be loaded interactively or stored in `.key` files. |
| 46 | + |
| 47 | +### JML Proof Scripts |
| 48 | + |
| 49 | +[Documentation of JML Proof Scripts](jml) |
| 50 | + |
| 51 | +JML scripts are added to individual assertions of a Java method. They |
| 52 | +are annotated as JML comments in `.java` files. |
| 53 | + |
| 54 | +[^1]: That is a working title name – might be subject to change. |
0 commit comments