Daniel Matichuk Makarius Wenzel, Toby Murray

Transcription

1 THE UNIVERSITY OF NEW SOUTH WALES Eisbach: An Isabelle Proof Method Language Daniel Matichuk Makarius Wenzel, Toby Murray ITP 2014

2 Proof Engineering average 0 Mar-2004 Size distribution of AFP entries in lines of proof, sorted by submission date Feb

3 Proof Engineering average 0 Mar-2004 Size distribution of AFP entries in lines of proof, sorted by submission date Feb

4 Proof Engineering average 0 Mar-2004 Size distribution of AFP entries in lines of proof, sorted by submission date Feb

5 Proof Engineering average 0 Mar-2004 Size distribution of AFP entries in lines of proof, sorted by submission date Feb

6 Outline = Isabelle = Isabelle Isabelle Concepts - Isar - Proof Methods Eisbach - Easy Custom Proof Methods - Demo Evaluation/Future -Existing method rewritten -Tracing/Debugging 3

7 Isabelle Concepts = Isabelle = Isabelle Isabelle Concepts - Isar - Proof Methods Eisbach - Easy Custom Proof Methods - Demo Evaluation/Future -Existing method rewritten -Tracing/Debugging 4

8 Isabelle/Isar theorem Knaster-Tarski: assumes mono: V xy. x apple y =) fxapple fy shows f ( d {x. fxapple x}) = d {x. fxapple x} (is f?a=?a) proof have : f?aapple?a (is - apple d?h ) proof fix x assume H : x 2?H then have?a apple x.. also from H have f... apple x.. moreover note mono finally show f?aapple x. qed also have?a apple f?a proof from mono and have f (f?a) apple f?a. then show f?a2?h.. qed finally show f?a=?a. qed 5

9 Isabelle/Isar theorem Knaster-Tarski: assumes mono: V xy. x apple y =) fxapple fy shows f ( d {x. fxapple x}) = d {x. fxapple x} (is f?a=?a) proof have : f?aapple?a (is - apple d?h ) proof fix x assume H : x 2?H then have?a apple x.. also from H have f... apple x.. moreover note mono finally show f?aapple x. qed also have?a apple f?a proof from mono and have f (f?a) apple f?a. then show f?a2?h.. qed finally show f?a=?a. qed 5

10 Isabelle/Isar theorem Knaster-Tarski 0 : assumes mono[intro]: V xy. x apple y =) fxapplefy shows f ( d {x. fxapplex}) = d { } ({x. { fxapple x}) } (is f?a=?a) proof have : f?aapple apple?a by (clarsimp,rule order.trans, fastforce) also have?a apple f?aby (fastforce intro: ) finally show f?a=?a. qed 6

11 Isabelle/Isar theorem Knaster-Tarski 0 : assumes mono[intro]: V xy. x apple y =) fxapplefy shows f ( d {x. fxapplex}) = d { } ({x. { fxapple x}) } (is f?a=?a) proof have : f?aapple apple?a by (clarsimp,rule order.trans, fastforce) also have?a apple f?aby (fastforce intro: ) finally show f?a=?a. qed 6

12 Proof Methods V d { apple } d { apple } have : f?aapple?a by (clarsimp,rule order.trans, fastforce) apple Goal Method Combinator d V d apple also have?a apple f?aby (fastforce intro: ) Method Parameter 7

13 Isabelle/ML theorem Knaster-Tarski 0 :( V xy. x apple y =) fxapple fy)=) f ( d {x. fxapple x}) = d ({x. fxapple x}) apply (tactic hh [0 ]@{thms order-eq-i } 1 ) THEN context-conji } 1 ) THEN Inf-greatest} 1 ) THEN Inf-lower} 1 ) THEN 1 ) THEN Inf-lower} 1 ) THEN 1 ) ii) done 8

14 Isabelle s AFP Number of files in AFP ML 50 Isar (.thy) 1,663 9

15 sel4 - our experience Full functional correctness proof Source code and Proof going open source for more info July 29 Isabelle proof methods developed WP/WPC - vcg for monadic hoare logic sep-* - automating separation logic Proof Engineers want more Languages like Ltac show this 10

16 Eisbach = Isabelle = Isabelle Isabelle Concepts - Isar - Proof Methods Eisbach - Easy Custom Proof Methods - Demo Evaluation/Future -Existing method rewritten -Tracing/Debugging 11

17 12

18 Eisbach 12

19 Language Elements Integrates existing/new methods fastforce, simp, auto Abstract over Terms/Facts/Methods Attributes for method hints simp, intro, my_vcg_rules Matching provides control flow Match and bind higher-order patterns against focused subgoal elements 13

20 Eisbach method-definition induct-list facts simp = (match?concl in?p (?x :: 0 a list) ) (induct?x 7 fastforce simp: simp)) lemma length ys) =length xs + length ys by induct-list 14

21 Eisbach - Design goals Easy for beginners and experts Familiar method syntax from Isar Limited functionality - leave complexity to Isabelle/ML Integration with other Isabelle languages Readable proof procedures 15

22 Eisbach - Combinators Standard Isar Method Combinators - alternative composition, - sequential composition? - suppress failure (try) + - repeated application New Combinator 7 - compose with emerging subgoals method-definition prop-solver 1 =((rule impi, (erule conje)?) assumption)+ lemma P ^ Q ^ R P by prop-solver 16

23 Eisbach - Abstraction Parameterize over facts, terms, and methods Method Signature method-definition prop-solver 2 facts intro elim = ((rule intro, (erule elim)?) assumption)+ lemma P ^ Q P by prop-solver intro impi elim Abstracted Facts 17

24 Eisbach - Abstraction Parameterize over facts, terms, and methods Method Signature method-definition prop-solver 2 facts intro elim = ((rule intro, (erule elim)?) assumption)+ lemma P ^ Q P by prop-solver intro impi elim Abstracted Facts Fact Arguments lemma P ^ Q P by (prop-solver 2 intro: impi elim: conje) 17

25 Eisbach - Attributes New command: declare-attributes Managed with the usual Isar declare command declare-attributes intro elim method-definition prop-solver declare impi [intro] and conje [elim] lemma P ^ Q P by prop-solver Used at run-time by methods method-definition prop-solver 3 facts [intro] [elim] = ((rule intro, (erule elim)?) assumption)+ declare and 18

26 Eisbach - Attributes New command: declare-attributes Managed with the usual Isar declare command declare-attributes intro elim method-definition prop-solver declare impi [intro] and conje [elim] lemma P ^ Q P by prop-solver Used at run-time by methods method-definition prop-solver 3 facts [intro] [elim] = ((rule intro, (erule elim)?) assumption)+ declare and Square brackets indicate fact parameter is managed by attribute 18

27 Eisbach - Attributes New command: declare-attributes Managed with the usual Isar declare command declare-attributes intro elim method-definition prop-solver declare impi [intro] and conje [elim] lemma P ^ Q P by prop-solver Used at run-time by methods method-definition prop-solver 3 facts [intro] [elim] = ((rule intro, (erule elim)?) assumption)+ declare Contains impi ^ and Contains conje Square brackets indicate fact parameter is managed by attribute 18

28 Eisbach - Attributes New command: declare-attributes Managed with the usual Isar declare command declare-attributes intro elim method-definition prop-solver declare impi [intro] and conje [elim] lemma P ^ Q P by prop-solver Used at run-time by methods Square brackets indicate fact parameter is managed by attribute method-definition prop-solver 3 facts [intro] [elim] = ((rule intro, (erule elim)?) assumption)+ declare Contains impi ^ and Contains conje lemma P ^ Q P by prop-solver 3 18

29 Eisbach - Matching Higher-order matching for control flow Bind matched patterns method-definition solve-ex = (match?concl in 9 x.?q x ) (match prems in U: Q?y ) (rule exi [where x = y and P = Q, OF U]))) 9 19

30 Eisbach - Matching Higher-order matching for control flow Bind matched patterns definitio Special term?concl is current subgoal h prems method-definition solve-ex = (match?concl in 9 x.?q x ) (match prems in U: Q?y ) (rule exi [where x = y and P = Q, OF U]))) 9 19

31 Eisbach - Matching Higher-order matching for control flow Bind matched patterns definitio Special term?concl is current subgoal h prems method-definition solve-ex = (match?concl in 9 x.?q x ) (match prems in U: Q?y ) (rule exi [where x = y and P = Q, OF U]))) 9 Matched pattern is bound?q Q?y 19

32 Eisbach - Matching Higher-order matching for control flow Bind matched patterns definitio Special term?concl is current subgoal h prems method-definition solve-ex = (match?concl in 9 x.?q x ) (match prems in U: Q?y ) (rule exi [where x = y and P = Q, OF U]))) 9 Matched pattern is bound?q Q?y Special fact prems is current premises 19

33 Eisbach - Matching Higher-order matching for control flow Bind matched patterns definitio Special term?concl is current subgoal h prems method-definition solve-ex = (match?concl in 9 x.?q x ) (match prems in U: Q?y ) (rule exi [where x = y and P = Q, OF U]))) 9 Matched pattern is bound?q Q?y Special fact prems is current premises Matching singleton fact is bound 9 U: 19

34 Focus/Matching Problem: Raw subgoals are unstructured V x. Ax=) Bx=) Ax^ Bx V 20

35 Focus/Matching Problem: Raw subgoals are unstructured V V x. Ax=) Bx=) Ax^ Bx lemma V assumes A: A and B: B show by (rule conji [OF assms(1 ) assms(2 )]) V 20

36 Focus/Matching Problem: Raw subgoals are unstructured V V x. Ax=) Bx=) Ax^ Bx lemma V assumes A: A and B: B show by (rule conji [OF assms(1 ) assms(2 )]) V 20

37 Focus/Matching Problem: Raw subgoals are unstructured V V x. Ax=) Bx=) Ax^ Bx lemma V assumes A: A and B: B show by (rule conji [OF assms(1 ) assms(2 )]) Goal: V method-definition solve-conj = (match?concl in?p ^?Q ) (match prems in U : P and U 0 : Q ) (rule conji [OF U U 0 ]))) V 20

38 Focus/Matching Problem: Raw subgoals are unstructured V V x. Ax=) Bx=) Ax^ Bx lemma V assumes A: A and B: B show by (rule conji [OF assms(1 ) assms(2 )]) Goal: method-definition solve-conj = (match?concl in?p ^?Q ) (match prems in U : P and U 0 : Q ) (rule conji [OF U U 0 ]))) V V Find and name assumptions through matching 20

39 Focus Solution: Focusing Based on existing work V x. Ax=) Bx=) Ax^ Bx V 21

40 Focus Solution: Focusing Based on existing work V x. Ax=) Bx=) Ax^ Bx V V emma V x. fixes x assumes Axand Bx shows Ax^ Bx V Ax Ax^ Bx Bx 21

41 Focus Solution: Focusing Based on existing work V x. Ax=) Bx=) Ax^ Bx V V emma V x. fixes x assumes Axand Bx shows Ax^ Bx V Ax Ax^ Bx Bx prems definiti?concl h prems 21

42 Demo 22

43 Evaluation/Future work = Isabelle = Isabelle Isabelle Concepts - Isar - Proof Methods Eisbach - Easy Custom Proof Methods - Demo Evaluation/Future -Existing method rewritten -Tracing/Debugging 23

44 Tactic Languages are not new Ltac Untyped High-level tactic language for Coq Goal matching, iteration, recursion VeriML Dependently typed tactic language Provides strong static guarantees Mtac Typed tactic language for Coq Leverages built-in Coq notion of computation Strong static guarantees 24

45 Current Results Eisbach Extension of Isar, Isabelle s proof language Integrates with existing Isar syntax methods attributes Evaluation Existing methods rewritten in Eisbach WP, WPC: l4.verified invariant proof successfully checked Future Work Tracing/Debugging Optimisations 25

46 Conclusion Proof Engineers need tools to write proofs at scale Isar provides structure/syntax for proofs Most Isabelle users most familiar with Isar Eisbach provides easy mechanisms for writing automation abstraction matching backtracking recursion Coming soon 26

47 Thank You 27