Daniel Matichuk Makarius Wenzel, Toby Murray

THE UNIVERSITY OF NEW SOUTH WALES Eisbach: An Isabelle Proof Method Language Daniel Matichuk Makarius Wenzel, Toby Murray ITP 2014

Proof Engineering 80 000 60 000 40 000 20 000 average 0 Mar-2004 Size distribution of AFP entries in lines of proof, sorted by submission date Feb-2012 2013 2

Outline = Isabelle = Isabelle Isabelle Concepts - Isar - Proof Methods Eisbach - Easy Custom Proof Methods - Demo Evaluation/Future -Existing method rewritten -Tracing/Debugging 3

Isabelle Concepts = Isabelle = Isabelle Isabelle Concepts - Isar - Proof Methods Eisbach - Easy Custom Proof Methods - Demo Evaluation/Future -Existing method rewritten -Tracing/Debugging 4

Isabelle/Isar theorem Knaster-Tarski: assumes mono: V xy. x apple y =) fxapple fy shows f ( d {x. fxapple x}) = d {x. fxapple x} (is f?a=?a) proof have : f?aapple?a (is - apple d?h ) proof fix x assume H : x 2?H then have?a apple x.. also from H have f... apple x.. moreover note mono finally show f?aapple x. qed also have?a apple f?a proof from mono and have f (f?a) apple f?a. then show f?a2?h.. qed finally show f?a=?a. qed 5

Isabelle/Isar theorem Knaster-Tarski 0 : assumes mono[intro]: V xy. x apple y =) fxapplefy shows f ( d {x. fxapplex}) = d { } ({x. { fxapple x}) } (is f?a=?a) proof have : f?aapple apple?a by (clarsimp,rule order.trans, fastforce) also have?a apple f?aby (fastforce intro: ) finally show f?a=?a. qed 6

Proof Methods V d { apple } d { apple } have : f?aapple?a by (clarsimp,rule order.trans, fastforce) apple Goal Method Combinator d V d apple also have?a apple f?aby (fastforce intro: ) Method Parameter 7

Isabelle/ML theorem Knaster-Tarski 0 :( V xy. x apple y =) fxapple fy)=) f ( d {x. fxapple x}) = d ({x. fxapple x}) apply (tactic hh (EqSubst.eqsubst-tac @{context} [0 ]@{thms order-eq-i } 1 ) THEN (Tactic.resolve-tac @{thms context-conji } 1 ) THEN (Tactic.resolve-tac @{thms Inf-greatest} 1 ) THEN (Tactic.forward-tac @{thms Inf-lower} 1 ) THEN (Clasimp.fast-force-tac @{context} 1 ) THEN (Tactic.resolve-tac @{thms Inf-lower} 1 ) THEN (Clasimp.fast-force-tac @{context} 1 ) ii) done 8

Isabelle s AFP Number of files in AFP ML 50 Isar (.thy) 1,663 9

sel4 - our experience Full functional correctness proof Source code and Proof going open source http://sel4.systems for more info July 29 Isabelle proof methods developed WP/WPC - vcg for monadic hoare logic sep-* - automating separation logic Proof Engineers want more Languages like Ltac show this 10

Eisbach = Isabelle = Isabelle Isabelle Concepts - Isar - Proof Methods Eisbach - Easy Custom Proof Methods - Demo Evaluation/Future -Existing method rewritten -Tracing/Debugging 11

Eisbach 12

Language Elements Integrates existing/new methods fastforce, simp, auto Abstract over Terms/Facts/Methods Attributes for method hints simp, intro, my_vcg_rules Matching provides control flow Match and bind higher-order patterns against focused subgoal elements 13

Eisbach method-definition induct-list facts simp = (match?concl in?p (?x :: 0 a list) ) (induct?x 7 fastforce simp: simp)) lemma length (xs @ ys) =length xs + length ys by induct-list 14

Eisbach - Design goals Easy for beginners and experts Familiar method syntax from Isar Limited functionality - leave complexity to Isabelle/ML Integration with other Isabelle languages Readable proof procedures 15

Eisbach - Combinators Standard Isar Method Combinators - alternative composition, - sequential composition? - suppress failure (try) + - repeated application New Combinator 7 - compose with emerging subgoals method-definition prop-solver 1 =((rule impi, (erule conje)?) assumption)+ lemma P ^ Q ^ R P by prop-solver 16

Eisbach - Abstraction Parameterize over facts, terms, and methods Method Signature method-definition prop-solver 2 facts intro elim = ((rule intro, (erule elim)?) assumption)+ lemma P ^ Q P by prop-solver intro impi elim Abstracted Facts 17

Eisbach - Attributes New command: declare-attributes Managed with the usual Isar declare command declare-attributes intro elim method-definition prop-solver declare impi [intro] and conje [elim] lemma P ^ Q P by prop-solver Used at run-time by methods method-definition prop-solver 3 facts [intro] [elim] = ((rule intro, (erule elim)?) assumption)+ declare and 18

Eisbach - Attributes New command: declare-attributes Managed with the usual Isar declare command declare-attributes intro elim method-definition prop-solver declare impi [intro] and conje [elim] lemma P ^ Q P by prop-solver Used at run-time by methods Square brackets indicate fact parameter is managed by attribute method-definition prop-solver 3 facts [intro] [elim] = ((rule intro, (erule elim)?) assumption)+ declare Contains impi ^ and Contains conje lemma P ^ Q P by prop-solver 3 18

Eisbach - Matching Higher-order matching for control flow Bind matched patterns method-definition solve-ex = (match?concl in 9 x.?q x ) (match prems in U: Q?y ) (rule exi [where x = y and P = Q, OF U]))) 9 19

Eisbach - Matching Higher-order matching for control flow Bind matched patterns definitio Special term?concl is current subgoal h prems method-definition solve-ex = (match?concl in 9 x.?q x ) (match prems in U: Q?y ) (rule exi [where x = y and P = Q, OF U]))) 9 19

Focus/Matching Problem: Raw subgoals are unstructured V x. Ax=) Bx=) Ax^ Bx V 20

Focus/Matching Problem: Raw subgoals are unstructured V V x. Ax=) Bx=) Ax^ Bx lemma V assumes A: A and B: B show by (rule conji [OF assms(1 ) assms(2 )]) V 20

Focus/Matching Problem: Raw subgoals are unstructured V V x. Ax=) Bx=) Ax^ Bx lemma V assumes A: A and B: B show by (rule conji [OF assms(1 ) assms(2 )]) Goal: V method-definition solve-conj = (match?concl in?p ^?Q ) (match prems in U : P and U 0 : Q ) (rule conji [OF U U 0 ]))) V 20

Focus/Matching Problem: Raw subgoals are unstructured V V x. Ax=) Bx=) Ax^ Bx lemma V assumes A: A and B: B show by (rule conji [OF assms(1 ) assms(2 )]) Goal: method-definition solve-conj = (match?concl in?p ^?Q ) (match prems in U : P and U 0 : Q ) (rule conji [OF U U 0 ]))) V V Find and name assumptions through matching 20

Focus Solution: Focusing Based on existing work V x. Ax=) Bx=) Ax^ Bx V 21

Focus Solution: Focusing Based on existing work V x. Ax=) Bx=) Ax^ Bx V V emma V x. fixes x assumes Axand Bx shows Ax^ Bx V Ax Ax^ Bx Bx 21

Focus Solution: Focusing Based on existing work V x. Ax=) Bx=) Ax^ Bx V V emma V x. fixes x assumes Axand Bx shows Ax^ Bx V Ax Ax^ Bx Bx prems definiti?concl h prems 21

Demo 22

Evaluation/Future work = Isabelle = Isabelle Isabelle Concepts - Isar - Proof Methods Eisbach - Easy Custom Proof Methods - Demo Evaluation/Future -Existing method rewritten -Tracing/Debugging 23

Tactic Languages are not new Ltac Untyped High-level tactic language for Coq Goal matching, iteration, recursion VeriML Dependently typed tactic language Provides strong static guarantees Mtac Typed tactic language for Coq Leverages built-in Coq notion of computation Strong static guarantees 24

Current Results Eisbach Extension of Isar, Isabelle s proof language Integrates with existing Isar syntax methods attributes Evaluation Existing methods rewritten in Eisbach WP, WPC: l4.verified invariant proof successfully checked Future Work Tracing/Debugging Optimisations 25

Conclusion Proof Engineers need tools to write proofs at scale Isar provides structure/syntax for proofs Most Isabelle users most familiar with Isar Eisbach provides easy mechanisms for writing automation abstraction matching backtracking recursion Coming soon 26

Thank You 27