\chapter{The \why API}
\label{chap:api}\index{API}

This chapter is a tutorial for the users who want to link their own
OCaml code with the \why library. We progressively introduce the way
one can use the library to build terms, formulas, theories, proof
tasks, call external provers on tasks, and apply transformations on
tasks. The complete documentation for API calls is given
at URL~\url{http://why3.lri.fr/api/}.

We assume the reader has a fair knowledge of the OCaml
language. Notice that the \why library must be installed, see
Section~\ref{sec:installlib}. The OCaml code given below is available in
the source distribution as \url{examples/use_api/use_api.ml}.


\section{Building Propositional Formulas}

The first step is to know how to build propositional formulas. The
module \texttt{Term} gives a few functions for building these. Here is
a piece of OCaml code for building the formula $true \lor false$.
\begin{ocamlcode}
(* opening the Why3 library *)
open Why3

(* a ground propositional goal: true or false *)
let fmla_true : Term.term = Term.t_true
let fmla_false : Term.term = Term.t_false
let fmla1 : Term.term = Term.t_or fmla_true fmla_false
\end{ocamlcode}
The library uses the common type \texttt{term} both for terms
(\ie expressions that produce a value of some particular type)
and formulas (\ie boolean-valued expressions).
% To distinguish terms from formulas, one can look at the
% \texttt{t_ty} field of the \texttt{term} record: in formulas,
% this field has the value \texttt{None}, and in terms,
% \texttt{Some t}, where \texttt{t} is of type \texttt{Ty.ty}.

Such a formula can be printed using the module \texttt{Pretty}
providing pretty-printers.
\begin{ocamlcode}
(* printing it *)
open Format
let () = printf "@[formula 1 is:@ %a@]@." Pretty.print_term fmla1
\end{ocamlcode}

Assuming the lines above are written in a file \texttt{f.ml}, it can
be compiled using
\begin{verbatim}
ocamlc str.cma unix.cma nums.cma dynlink.cma \
        -I +ocamlgraph -I +why3 graph.cma why.cma f.ml -o f
\end{verbatim}
Running the generated executable \texttt{f} results in the following output.
\begin{verbatim}
formula 1 is: true \/ false
\end{verbatim}

Let's now build a formula with propositional variables: $A \land B
\rightarrow A$. Propositional variables must be declared first before
using them in formulas. This is done as follows.
\begin{ocamlcode}
let prop_var_A : Term.lsymbol =
  Term.create_psymbol (Ident.id_fresh "A") []
let prop_var_B : Term.lsymbol =
  Term.create_psymbol (Ident.id_fresh "B") []
\end{ocamlcode}
The type \texttt{lsymbol} is the type of function and predicate symbols (which
we call logic symbols for brevity). Then the atoms $A$ and $B$ must be built
by the general function for applying a predicate symbol to a list of terms.
Here we just need the empty list of arguments.
\begin{ocamlcode}
let atom_A : Term.term = Term.ps_app prop_var_A []
let atom_B : Term.term = Term.ps_app prop_var_B []
let fmla2 : Term.term =
  Term.t_implies (Term.t_and atom_A atom_B) atom_A
let () = printf "@[formula 2 is:@ %a@]@." Pretty.print_term fmla2
\end{ocamlcode}

As expected, the output is as follows.
\begin{verbatim}
formula 2 is: A /\ B -> A
\end{verbatim}
Notice that the concrete syntax of \why forbids function and predicate
names to start with a capital letter (except for the algebraic type
constructors which must start with one). This constraint is not enforced
when building those directly using library calls.

\section{Building Tasks}

Let's see how we can call a prover to prove a formula. As said in
previous chapters, a prover must be given a task, so we need to build
tasks from our formulas. Task can be build incrementally from an empty
task by adding declaration to it, using the functions
\texttt{add\_*\_decl} of module \texttt{Task}. For the formula $true \lor
false$ above, this is done as follows.
\begin{ocamlcode}
let task1 : Task.task = None (* empty task *)
let goal_id1 : Decl.prsymbol =
  Decl.create_prsymbol (Ident.id_fresh "goal1")
let task1 : Task.task =
  Task.add_prop_decl task1 Decl.Pgoal goal_id1 fmla1
\end{ocamlcode}
To make the formula a goal, we must give a name to it, here ``goal1''. A
goal name has type \texttt{prsymbol}, for identifiers denoting
propositions in a theory or a task. Notice again that the concrete
syntax of \why requires these symbols to be capitalized, but it is not
mandatory when using the library. The second argument of
\texttt{add\_prop\_decl} is the kind of the proposition:
\texttt{Paxiom}, \texttt{Plemma} or \texttt{Pgoal}
(notice, however, that lemmas are not allowed in tasks
and can only be used in theories).


Once a task is built, it can be printed.
\begin{ocamlcode}
(* printing the task *)
let () = printf "@[task 1 is:@\n%a@]@." Pretty.print_task task1
\end{ocamlcode}

The task for our second formula is a bit more complex to build, because
the variables A and B must be added as abstract (\ie not defined)
propositional symbols in the task.
\begin{ocamlcode}
(* task for formula 2 *)
let task2 = None
let task2 = Task.add_param_decl task2 prop_var_A
let task2 = Task.add_param_decl task2 prop_var_B
let goal_id2 = Decl.create_prsymbol (Ident.id_fresh "goal2")
let task2 = Task.add_prop_decl task2 Decl.Pgoal goal_id2 fmla2
let () = printf "@[task 2 is:@\n%a@]@." Pretty.print_task task2
\end{ocamlcode}

Execution of our OCaml program now outputs:
\begin{verbatim}
task 1 is:
theory Task
  goal Goal1 : true \/ false
end

task 2 is:
theory Task
  predicate A

  predicate B

  goal Goal2 : A /\ B -> A
end
\end{verbatim}

\section{Calling External Provers}

To call an external prover, we need to access the Why configuration
file \texttt{why3.conf}, as it was built using the \texttt{why3config}
command line tool or the \textsf{Detect Provers} menu of the graphical
IDE. The following API calls allow to access the content of this
configuration file.
\begin{ocamlcode}
(* reads the config file *)
let config : Whyconf.config = Whyconf.read_config None
(* the [main] section of the config file *)
let main : Whyconf.main = Whyconf.get_main config
(* all the provers detected, from the config file *)
let provers : Whyconf.config_prover Whyconf.Mprover.t =
  Whyconf.get_provers config
\end{ocamlcode}
The type \texttt{'a Whyconf.Mprover.t} is a map indexed by provers. A
provers is a record with a name, a version and an alternative description
(if someone want to compare different command line options of the same
provers for example). It's definition is in the module
\texttt{Whyconf} :
\begin{ocamlcode}
type prover =
    { prover_name : string; (* "Alt-Ergo" *)
      prover_version : string; (* "2.95" *)
      prover_altern : string; (* "special" *)
    }
\end{ocamlcode}
The map \texttt{provers} provides the set of existing provers.
In the following, we directly
attempt to access the prover Alt-Ergo, which is known to be identified
with id \texttt{"alt-ergo"}.
\begin{ocamlcode}
(* the [prover alt-ergo] section of the config file *)
let alt_ergo : Whyconf.config_prover =
  try
    Whyconf.prover_by_id config "alt-ergo"
  with Whyconf.ProverNotFound _ ->
    eprintf "Prover alt-ergo not installed or not configured@.";
    exit 0
\end{ocamlcode}
We could also get a specific version with :
\begin{ocamlcode}
let alt_ergo : Whyconf.config_prover =
  try
    let prover = {Whyconf.prover_name = "Alt-Ergo";
                  prover_version = "0.92.3";
                  prover_altern = ""} in
    Whyconf.Mprover.find prover provers
  with Not_found ->
    eprintf "Prover alt-ergo not installed or not configured@.";
    exit 0
\end{ocamlcode}

The next step is to obtain the driver associated to this prover. A
driver typically depends on the standard theories so these should be
loaded first.
\begin{ocamlcode}
(* builds the environment from the [loadpath] *)
let env : Env.env =
  Env.create_env (Whyconf.loadpath main)
(* loading the Alt-Ergo driver *)
let alt_ergo_driver : Driver.driver =
  try
    Driver.load_driver env alt_ergo.Whyconf.driver
  with e ->
    eprintf "Failed to load driver for alt-ergo: %a@."
      Exn_printer.exn_printer e;
    exit 1
\end{ocamlcode}

We are now ready to call the prover on the tasks. This is done by a
function call that launches the external executable and waits for its
termination. Here is a simple way to proceed:
\begin{ocamlcode}
(* calls Alt-Ergo *)
let result1 : Call_provers.prover_result =
  Call_provers.wait_on_call
    (Driver.prove_task ~command:alt_ergo.Whyconf.command
    alt_ergo_driver task1 ()) ()
(* prints Alt-Ergo answer *)
let () = printf "@[On task 1, alt-ergo answers %a@]@."
  Call_provers.print_prover_result result1
\end{ocamlcode}
This way to call a prover is in general too naive, since it may never
return if the prover runs without time limit. The function
\texttt{prove\_task} has two optional parameters: \texttt{timelimit}
is the maximum allowed running time in seconds, and \texttt{memlimit}
is the maximum allowed memory in megabytes.  The type
\texttt{prover\_result} is a record with three fields:
\begin{itemize}
\item \texttt{pr\_answer}: the prover answer, explained below;
\item \texttt{pr\_output}: the output of the prover, \ie both
  standard output and the standard error of the process
  (a redirection in \texttt{why3.conf} is required);
\item \texttt{pr\_time} : the time taken by the prover, in seconds.
\end{itemize}
A \texttt{pr\_answer} is a sum of several kind of answers:
\begin{itemize}
\item \texttt{Valid}: the task is valid according to the prover.
\item \texttt{Invalid}: the task is invalid.
\item \texttt{Timeout}: the prover exceeds the time or memory limit.
\item \texttt{Unknown} $msg$: the prover can't determine if the task
  is valid; the string parameter $msg$ indicates some extra
  information.
\item \texttt{Failure} $msg$: the prover reports a failure, \ie it
  was unable to read correctly its input task.
\item \texttt{HighFailure}: an error occurred while trying to call the
  prover, or the prover answer was not understood (\ie none of the
  given regular expressions in the driver file matches the output
  of the prover).
\end{itemize}
Here is thus another way of calling the Alt-Ergo prover, on our second
task.
\begin{ocamlcode}
let result2 : Call_provers.prover_result =
   Call_provers.wait_on_call
    (Driver.prove_task ~command:alt_ergo.Whyconf.command
    ~timelimit:10
    alt_ergo_driver task2 ()) ()

let () =
  printf "@[On task 2, alt-ergo answers %a in %5.2f seconds@."
    Call_provers.print_prover_answer
    result1.Call_provers.pr_answer
    result1.Call_provers.pr_time
\end{ocamlcode}
The output of our program is now as follows.
\begin{verbatim}
On task 1, alt-ergo answers Valid (0.01s)
On task 2, alt-ergo answers Valid in  0.01 seconds
\end{verbatim}

\section{Building Terms}

An important feature of the functions for building terms and formulas
is that they statically guarantee that only well-typed terms can be
constructed.

Here is the way we build the formula $2+2=4$. The main difficulty is to
access the internal identifier for addition: it must be retrieved from
the standard theory \texttt{Int} of the file \texttt{int.why} (see
Chap~\ref{chap:library}).
\begin{ocamlcode}
let two : Term.term = 
  Term.t_const (Number.ConstInt (Number.int_const_dec "2"))
let four : Term.term = 
  Term.t_const (Number.ConstInt (Number.int_const_dec "4"))
let int_theory : Theory.theory =
  Env.find_theory env ["int"] "Int"
let plus_symbol : Term.lsymbol =
  Theory.ns_find_ls int_theory.Theory.th_export ["infix +"]
let two_plus_two : Term.term =
  Term.t_app_infer plus_symbol [two;two]
let fmla3 : Term.term = Term.t_equ two_plus_two four
\end{ocamlcode}
An important point to notice as that when building the application of
$+$ to the arguments, it is checked that the types are correct. Indeed
the constructor \texttt{t\_app\_infer} infers the type of the resulting
term. One could also provide the expected type as follows.
\begin{ocamlcode}
let two_plus_two : Term.term =
  Term.fs_app plus_symbol [two;two] Ty.ty_int
\end{ocamlcode}

When building a task with this formula, we need to declare that we use
theory \texttt{Int}:
\begin{ocamlcode}
let task3 = None
let task3 = Task.use_export task3 int_theory
let goal_id3 = Decl.create_prsymbol (Ident.id_fresh "goal3")
let task3 = Task.add_prop_decl task3 Decl.Pgoal goal_id3 fmla3
\end{ocamlcode}

\section{Building Quantified Formulas}

To illustrate how to build quantified formulas, let us consider
the formula $\forall x:int. x*x \geq 0$. The first step is to
obtain the symbols from \texttt{Int}.
\begin{ocamlcode}
let zero : Term.term = 
  Term.t_const (Number.ConstInt (Number.int_const_dec "0"))
let mult_symbol : Term.lsymbol =
  Theory.ns_find_ls int_theory.Theory.th_export ["infix *"]
let ge_symbol : Term.lsymbol =
  Theory.ns_find_ls int_theory.Theory.th_export ["infix >="]
\end{ocamlcode}
The next step is to introduce the variable $x$ with the type int.
\begin{ocamlcode}
let var_x : Term.vsymbol =
  Term.create_vsymbol (Ident.id_fresh "x") Ty.ty_int
\end{ocamlcode}
The formula $x*x \geq 0$ is obtained as in the previous example.
\begin{ocamlcode}
let x : Term.term = Term.t_var var_x
let x_times_x : Term.term = Term.t_app_infer mult_symbol [x;x]
let fmla4_aux : Term.term = Term.ps_app ge_symbol [x_times_x;zero]
\end{ocamlcode}
To quantify on $x$, we use the appropriate smart constructor as follows.
\begin{ocamlcode}
let fmla4 : Term.term = Term.t_forall_close [var_x] [] fmla4_aux
\end{ocamlcode}

\section{Building Theories}

We illustrate now how one can build theories. Building a theory must
be done by a sequence of calls:
\begin{itemize}
\item creating a theory ``under construction'', of type \verb|Theory.theory_uc| ;
\item adding declarations, one at a time ;
\item closing the theory under construction, obtaining something of type \verb|Theory.theory|.
\end{itemize}

Creation of a theory named \verb|My_theory| is done by:
\begin{ocamlcode}
let my_theory : Theory.theory_uc = 
  Theory.create_theory (Ident.id_fresh "My_theory")
\end{ocamlcode}

First let's add the formula 1 above as a goal:
\begin{ocamlcode}
let decl_goal1 : Decl.decl =
  Decl.create_prop_decl Decl.Pgoal goal_id1 fmla1 
let my_theory : Theory.theory_uc =
  Theory.add_decl my_theory decl_goal1
\end{ocamlcode}
Note that we reused the goal identifier \verb|goal_id1| that we
already defined to create task 1 above.

Adding formula 2 needs to add the declarations of predicate variables A
and B first:
\begin{ocamlcode}
let my_theory : Theory.theory_uc = 
  Theory.add_param_decl my_theory prop_var_A 
let my_theory : Theory.theory_uc = 
  Theory.add_param_decl my_theory prop_var_B 
let decl_goal2 : Decl.decl =
  Decl.create_prop_decl Decl.Pgoal goal_id2 fmla2 
let my_theory : Theory.theory_uc = Theory.add_decl my_theory decl_goal2
\end{ocamlcode}

Adding formula 3 is a bit more complex since it uses integers, thus it
requires to ``use'' the theory \verb|int.Int|. Using a theory is
indeed not a primitive operation in the API: it must be done by a
combination of an ``export'' and the creation of a namespace. We
provide a helper function for that:
\begin{ocamlcode}
(* [use th1 th2] insert the equivalent of a "use import th2" in
  theory th1 under construction *) 
let use th1 th2 = 
  let name = th2.Theory.th_name in 
  Theory.close_namespace 
    (Theory.use_export 
      (Theory.open_namespace th1 name.Ident.id_string) th2) true
\end{ocamlcode}
Addition of formula 3 is then
\begin{ocamlcode}
let my_theory : Theory.theory_uc = use my_theory int_theory
let decl_goal3 : Decl.decl = 
  Decl.create_prop_decl Decl.Pgoal goal_id3 fmla3
let my_theory : Theory.theory_uc = 
  Theory.add_decl my_theory decl_goal3  
\end{ocamlcode}

Addition of goal 4 is nothing more complex:
\begin{ocamlcode}
let decl_goal4 : Decl.decl = 
  Decl.create_prop_decl Decl.Pgoal goal_id4 fmla4
let my_theory : 
  Theory.theory_uc = Theory.add_decl my_theory decl_goal4  
\end{ocamlcode}

Finally, we close our theory under construction as follows.
\begin{ocamlcode}
let my_theory : Theory.theory = Theory.close_theory my_theory  
\end{ocamlcode}

We can inspect what we did for example by printing that theory:
\begin{ocamlcode}
let () = printf "@[theory is:@\n%a@]@." Pretty.print_theory my_theory
\end{ocamlcode}
which outputs
\begin{verbatim}
theory is:
theory My_theory
  (* use BuiltIn *)
  
  goal goal1 : true \/ false
  
  predicate A
  
  predicate B
  
  goal goal2 : A /\ B -> A
  
  (* use int.Int *)
  
  goal goal3 : (2 + 2) = 4
  
  goal goal4 : forall x:int. (x * x) >= 0
end
\end{verbatim}

From a theory, one can compute at once all the proof tasks it contains
as follows:
\begin{ocamlcode}
let my_tasks : Task.task list = 
  List.rev (Task.split_theory my_theory None None)
\end{ocamlcode}
Note that the tasks are returned in reverse order, so we reverse the
list above.

We can check our generated tasks by printing them:
\begin{ocamlcode}
let () = 
  printf "Tasks are:@.";
  let _ =
    List.fold_left
      (fun i t -> printf "Task %d: %a@." i Pretty.print_task t; i+1)
      1 my_tasks
  in ()
\end{ocamlcode}

One can run provers on those tasks exactly as we did above.

\section{Applying transformations}

[TO BE COMPLETED]

\section{Writing new functions on term}

[TO BE COMPLETED]
% pattern-matching on terms, opening a quantifier

\section{Proof sessions}

See the example \url{examples/use_api/create_session.ml} of the distribution for
an illustration on how to manipulate proof sessions from an OCaml program.




%%% Local Variables:
%%% mode: latex
%%% TeX-PDF-mode: t
%%% TeX-master: "manual"
%%% End: