Dafny：子集产品证明

Question

我正在尝试在dafny中编写一个程序，它找到给定整数集的所有子集，其产品是给定的数字。

我所做的是实现ComputeSubProduct，FindProductSets和GenerateAllIndexSubsets方法。

这是我到目前为止所得到的：

method Main() {
    var q := [2,3,4];
    var productSets := FindProductSets(q, 12);
    assert {1,2} in productSets by {
        calc {
            SubProduct(q, {1,2});
        == { LemmaSubProductsOrderIndifference(q, {1,2}, 1); }
            q[1]*q[2];
        ==
            3*4;
        ==
            12;
        }
    }
}

function SubProduct(q: seq<int>, indexSet: set<nat>): int
    requires InRange(q, indexSet)
{
    if |indexSet| == 0 then 1 else var i :| i in indexSet; q[i] * SubProduct(q, indexSet-{i})
}

predicate InRange<T>(q: seq<T>, indexSet: set<nat>)
{
    forall i :: i in indexSet ==> 0 <= i < |q|
}

function AllIndexSubsets<T>(q: seq<T>): (res: set<set<nat>>)
    ensures forall s :: s in res ==> InRange(q, s)
{
    AllSubsets(set i | P(i) && 0 <= i < |q|)
}

predicate P<T>(x: T) { true } // this is helpful only for avoiding a "no triggers found" warning by Dafny

function AllSubsets<T>(s: set<T>): set<set<T>>
{
    set subset: set<T> | P(subset) && subset <= s
}

method FindProductSets(q: seq<int>, num: int) returns (result: set<set<int>>)
    ensures forall indexSet :: indexSet in result <==> indexSet in AllIndexSubsets(q) && SubProduct(q, indexSet) == num


method GenerateAllIndexSubsets<T>(q: seq<T>) returns (res: set<set<nat>>)
    ensures res == AllIndexSubsets(q)
{
    res := A(q, 0);
}
method A<T>(q: seq<T>, index: nat) returns (res: set<set<nat>>)
    ensures res == AllIndexSubsets(q)
{
    if |q| == 0
        { 
        assert |q| == 0;// if's guard
        // ==>
        assert {} == AllIndexSubsets<nat>([]);
        assert q == [];
        assert {} == AllIndexSubsets(q);
        res := {};
        assert res == AllIndexSubsets(q); // postcondition
        }
    else
        { 
            assert |q| != 0; // !(if's guard)
            var res0 : set<set<nat>> := A(q[1..], index + 1);
            assert res0 == AllIndexSubsets(q[1..]);
            res := res0;    
            assert res ==  AllIndexSubsets(q[1..]); //GenerateAllIndexSubsets postcondition with q[1..]
            //var res1 : set<set<nat>> := AllIndexSubsetsIntersection(q, q[0], res0);
            var res1: set<set<nat>> := (set x | x in res0 :: x + {index});
            assert res1 == AllIndexSubsets(q) - AllIndexSubsets(q[1..]);
            assert res0 == AllIndexSubsets(q[1..]);
            assert res1 == AllIndexSubsets(q) - res0;
            // ==>
            assert res0 + res1 == AllIndexSubsets(q);
            res := res + res1;
            assert res == AllIndexSubsets(q); // postcondition
        }
    assert res == AllIndexSubsets(q); // postcondition
} 


method ComputeSubProduct(q: seq<int>, indexSet: set<nat>) returns (prod: int)
    requires InRange(q, indexSet)
    ensures prod == SubProduct(q, indexSet)

lemma {:verify false} LemmaSubProductsOrderIndifference(q: seq<int>, indexSet: set<nat>, i: nat)
    requires i in indexSet
    requires InRange(q, indexSet)
    ensures q[i] * SubProduct(q, indexSet-{i}) == SubProduct(q, indexSet)
{}

我在'A'方法中遇到断言：

1. 断言{} == AllIndexSubsets（[]）
2. 断言res1 == AllIndexSubsets（q） - AllIndexSubsets（q [1 ..]）