Attaching Efficient Executability to Partial Functions in ACL2 - - PowerPoint PPT Presentation

▶
attaching efficient executability to partial functions in
SMART_READER_LITE
LIVE PREVIEW

Attaching Efficient Executability to Partial Functions in ACL2 - - PowerPoint PPT Presentation

Oct 10, 2022 260 likes •630 views

Attaching Efficient Executability to Partial Functions in ACL2 Sandip Ray Department of Computer Science University of Texas at Austin Email: sandip@cs.utexas.edu web: http://www.cs.utexas.edu/users/sandip U NIVERSITY OF T EXAS AT A USTIN D

slide-1
SLIDE 1

Attaching Efficient Executability to Partial Functions in ACL2

Sandip Ray Department of Computer Science University of Texas at Austin Email: sandip@cs.utexas.edu web: http://www.cs.utexas.edu/users/sandip

UNIVERSITY OF TEXAS AT AUSTIN

slide-2
SLIDE 2

DEPARTMENT OF COMPUTER SCIENCES

Background: Partial Functions

Manolios and Moore [MM00, MM03] presented the notion of introducing partial functions in ACL2. (defpun factorial (n a) (if (equal n 0) a (factorial (- n 1) (* n a))))

UNIVERSITY OF TEXAS AT AUSTIN 1

slide-3
SLIDE 3

DEPARTMENT OF COMPUTER SCIENCES

Background: Partial Functions

Manolios and Moore [MM00, MM03] introduced a macro defpun that allows us to write partial functions in ACL2. (defpun factorial (n a) (if (equal n 0) a (factorial (- n 1) (* n a)))) This introduces the axiom: (equal (factorial n a) (if (equal n 0) a (factorial (- n 1) (* n a))))

UNIVERSITY OF TEXAS AT AUSTIN 2

slide-4
SLIDE 4

DEPARTMENT OF COMPUTER SCIENCES

Background: Partial Functions

Manolios and Moore [MM00, MM03] introduced a macro defpun that allows us to write partial functions in ACL2. (defpun factorial (n a) (if (equal n 0) a (factorial (- n 1) (* n a)))) This introduces the axiom: (equal (factorial n a) (if (equal n 0) a (factorial (- n 1) (* n a)))) Partial functions can be used in defining machine simulators, and inductive invariants [Moo03].

UNIVERSITY OF TEXAS AT AUSTIN 3

slide-5
SLIDE 5

DEPARTMENT OF COMPUTER SCIENCES

Defpun Issues

Partial functions cannot be evaluated (other than via repeated rewriting) even for values on which they are guaranteed to terminate. (defpun factorial (n a) (if (equal n 0) a (factorial (- n 1) (* n a)))) We cannot evaluate (factorial 3 1) to 6.

UNIVERSITY OF TEXAS AT AUSTIN 4

slide-6
SLIDE 6

DEPARTMENT OF COMPUTER SCIENCES

Goal of this Work

Define a macro defpun-exec so that we can write the following form: (defpun-exec factorial (n a) (if (equal n 0) a (factorial (- n 1) (* n 1))) :guard (and (natp n) (natp a)))

UNIVERSITY OF TEXAS AT AUSTIN 5

slide-7
SLIDE 7

DEPARTMENT OF COMPUTER SCIENCES

Goal of this Work

Define a macro defpun-exec so that we can write the following form: (defpun-exec factorial (n a) (if (equal n 0) a (factorial (- n 1) (* n 1))) :guard (and (natp n) (natp a))) Logically, this introduces the same axiom as defpun: (equal (factorial n a) (if (equal n 0) a (factorial (- n 1) (* n a))))

UNIVERSITY OF TEXAS AT AUSTIN 6

slide-8
SLIDE 8

DEPARTMENT OF COMPUTER SCIENCES

Goal of this Work

Define a macro defpun-exec so that we can write the following form: (defpun-exec factorial (n a) (if (equal n 0) a (factorial (- n 1) (* n 1))) :guard (and (natp n) (natp a))) Logically, this introduces the same axiom as defpun: (equal (factorial n a) (if (equal n 0) a (factorial (- n 1) (* n a)))) But in addition, we want to be able to evaluate the function when the guards hold. That is, we want to evaluate (factorial 3 1) to 6.

UNIVERSITY OF TEXAS AT AUSTIN 7

slide-9
SLIDE 9

DEPARTMENT OF COMPUTER SCIENCES

Our Approach

Executability in partial functions is achieved by a new feature in ACL2, called mbe.

UNIVERSITY OF TEXAS AT AUSTIN 8

slide-10
SLIDE 10

DEPARTMENT OF COMPUTER SCIENCES

Our Approach

Executability in partial functions is achieved by a new feature in ACL2, called mbe.

Logically (mbe :logic x :exec y) is simply x.

UNIVERSITY OF TEXAS AT AUSTIN 9

slide-11
SLIDE 11

DEPARTMENT OF COMPUTER SCIENCES

Our Approach

Executability in partial functions is achieved by a new feature in ACL2, called mbe.

Logically (mbe :logic x :exec y) is simply x. But mbe introduces a guard obligation (equal x y).

UNIVERSITY OF TEXAS AT AUSTIN 10

slide-12
SLIDE 12

DEPARTMENT OF COMPUTER SCIENCES

Our Approach

Executability in partial functions is achieved by a new feature in ACL2, called mbe.

Logically (mbe :logic x :exec y) is simply x. But mbe introduces a guard obligation (equal x y). When the guards are verified, the expression evaluates to y.

UNIVERSITY OF TEXAS AT AUSTIN 11

slide-13
SLIDE 13

DEPARTMENT OF COMPUTER SCIENCES

A Simple Demonstration

(defpun-exec factorial (n a) (if (equal n 0) a (factorial (- n 1) (* n 1))) :guard (and (natp n) (natp a)))

UNIVERSITY OF TEXAS AT AUSTIN 12

slide-14
SLIDE 14

DEPARTMENT OF COMPUTER SCIENCES

A Simple Demonstration

(defpun-exec factorial (n a) (if (equal n 0) a (factorial (- n 1) (* n 1))) :guard (and (natp n) (natp a))) We first introduce a new function factorial-logic using defpun. (defpun factorial-logic (n a) (if (equal n 0) a (factorial-logic (- n 1) (* n a))))

UNIVERSITY OF TEXAS AT AUSTIN 13

slide-15
SLIDE 15

DEPARTMENT OF COMPUTER SCIENCES

A Simple Demonstration

(defpun-exec factorial (n a) (if (equal n 0) a (factorial (- n 1) (* n 1))) :guard (and (natp n) (natp a))) We then introduce the following form: (defun factorial (n a) (declare (xargs :guard (and (natp n) (natp a)))) (mbe :logic (factorial-logic n a) :exec (if (equal n 0) a (factorial (- n 1) (* n a)))))

UNIVERSITY OF TEXAS AT AUSTIN 14

slide-16
SLIDE 16

DEPARTMENT OF COMPUTER SCIENCES

The Problem: Stobjs and Defpun

Suppose we want to define a partial function that manipulates a single-threaded object (stobj). (defstobj mc-state (fld)) (defun mc-step (mc-state) (declare (xargs :stobjs mc-state)) ...) (defpun run (mc-state) (declare (xargs :stobjs mc-state)) (if (halting mc-state) mc-state (run (mc-step mc-state))))

UNIVERSITY OF TEXAS AT AUSTIN 15

slide-17
SLIDE 17

DEPARTMENT OF COMPUTER SCIENCES

The Problem: Stobjs and Defpun

The problem is with signatures of functions.

The defpun macro introduces partial functions via encapsulation.

– A local witness is defined which is shown to satisfy the defining equation.

UNIVERSITY OF TEXAS AT AUSTIN 16

slide-18
SLIDE 18

DEPARTMENT OF COMPUTER SCIENCES

The Problem: Stobjs and Defpun

The problem is with signatures of functions.

The defpun macro introduces partial functions via encapsulation.

– A local witness is defined which is shown to satisfy the defining equation.

The signature of the constrained function symbol must match the

signature of the local witness.

UNIVERSITY OF TEXAS AT AUSTIN 17

slide-19
SLIDE 19

DEPARTMENT OF COMPUTER SCIENCES

The Problem: Stobjs and Defpun

The problem is with signatures of functions.

The defpun macro introduces partial functions via encapsulation.

– A local witness is defined which is shown to satisfy the defining equation.

The signature of the constrained function symbol must match the

signature of the local witness.

The local witness for defpun is chosen via a special form

defchoose whose return value must be an ordinary object.

UNIVERSITY OF TEXAS AT AUSTIN 18

slide-20
SLIDE 20

DEPARTMENT OF COMPUTER SCIENCES

The Defpun Solution

The local witness is made :non-executable.

When a function is declared :non-executable the syntactic

restrictions on stobjs are not enforced.

The return value of a :non-executable function has the signature
  • f an ordinary ACL2 object.
But, such a function cannot be evaluated.

UNIVERSITY OF TEXAS AT AUSTIN 19

slide-21
SLIDE 21

DEPARTMENT OF COMPUTER SCIENCES

The Defpun-exec Problem

The :logic and :exec arguments of an mbe must have the same signature.

We cannot have a stobj in the :exec argument if the :logic

argument is :non-executable.

UNIVERSITY OF TEXAS AT AUSTIN 20

slide-22
SLIDE 22

DEPARTMENT OF COMPUTER SCIENCES

The Defpun-exec Solution: 1

Ignore the stobjs and functions manipulating them.

UNIVERSITY OF TEXAS AT AUSTIN 21

slide-23
SLIDE 23

DEPARTMENT OF COMPUTER SCIENCES

The Defpun-exec Solution: 1

Ignore the stobjs and functions manipulating them. (defstobj stor (fld :type (array T (100)) :resizable t)) (defpun-exec bar (x stor) (if (equal x 0) stor (let* ((stor (resize-fld 100 stor)) (stor (update-fldi 0 2 stor))) (bar (- x 1) stor))) :guard (...) :stobjs stor)

UNIVERSITY OF TEXAS AT AUSTIN 22

slide-24
SLIDE 24

DEPARTMENT OF COMPUTER SCIENCES

The Defpun-exec Solution: 1

(defun bar (x stor) (declare (xargs :guard (...))) (mbe :logic (bar-logic x stor) :exec (if (equal x 0) stor (let* ((stor (update-nth 0 (resize-list (nth 0 stor) 100 nil) stor)) (stor (update-nth 0 (update-nth 0 2 (nth 0 stor)) stor))) (bar (- x 1) stor))))) We get executability but lose the efficient execution via stobjs.

UNIVERSITY OF TEXAS AT AUSTIN 23

slide-25
SLIDE 25

DEPARTMENT OF COMPUTER SCIENCES

The Defpun-exec Solution: 2

This solution is based on a recent email by John Matthews in the acl2-help mailing list. (Thanks, John.)

Suppose we have a stobj stor, and want to define a partial function

foo that manipulates stor.

UNIVERSITY OF TEXAS AT AUSTIN 24

slide-26
SLIDE 26

DEPARTMENT OF COMPUTER SCIENCES

The Defpun-exec Solution: 2

This solution is based on a recent email by John Matthews in the acl2-help mailing list. (Thanks, John.)

Suppose we have a stobj stor, and want to define a partial function

foo that manipulates stor.

Define two functions:

((copy-from-stor stor) => *) ((copy-to-stor * stor) => stor)

UNIVERSITY OF TEXAS AT AUSTIN 25

slide-27
SLIDE 27

DEPARTMENT OF COMPUTER SCIENCES

The Defpun-exec Solution: 2

Define the function foo as follows: (defun foo (stor) (declare (xargs :stobjs stor)) (mbe :logic (let* ((lst (copy-from-stor stor)) (lst (foo-logic stor)) (stor (copy-to-stor lst stor))) stor) :exec (<body for foo>))) There is no execution penalty since the coercions are done in the :logic part of mbe.

UNIVERSITY OF TEXAS AT AUSTIN 26

slide-28
SLIDE 28

DEPARTMENT OF COMPUTER SCIENCES

The Defpun-exec Solution: 2

We have implemented a macro defcoerce that achieves these coercions.

UNIVERSITY OF TEXAS AT AUSTIN 27

slide-29
SLIDE 29

DEPARTMENT OF COMPUTER SCIENCES

The Defpun-exec Solution: 2

We have implemented a macro defcoerce that achieves these coercions. Given a stobj name stor, (defcoerce stor) defines two functions copy-to-stor and copy-from-stor.

UNIVERSITY OF TEXAS AT AUSTIN 28

slide-30
SLIDE 30

DEPARTMENT OF COMPUTER SCIENCES

The Defpun-exec Solution: 2

Then the following theorems are proven: (defthm copy-from-stor-identity (implies (storp stor) (equal (copy-from-stor stor) stor))) (defthm copy-to-stor-identity (implies (storp l) (equal (copy-from-stor l stor) l)))

UNIVERSITY OF TEXAS AT AUSTIN 29

slide-31
SLIDE 31

DEPARTMENT OF COMPUTER SCIENCES

The Defpun-exec Solution: 2

We have a version of defpun-exec that uses the defcoerce

macro.

This is work in progress.

– We can handle partial functions that have one stobj argument.

UNIVERSITY OF TEXAS AT AUSTIN 30

slide-32
SLIDE 32

DEPARTMENT OF COMPUTER SCIENCES

Observations

Our slow execution approach gets us executability but is inefficient. Our defcoerce approach gets us efficient executability but

complicates the logical definition (and hence theorem proving).

UNIVERSITY OF TEXAS AT AUSTIN 31

slide-33
SLIDE 33

DEPARTMENT OF COMPUTER SCIENCES

Observations

Our slow execution approach gets us executability but is inefficient. Our defcoerce approach gets us efficient executability but

complicates the logical definition (and hence theorem proving). We believe that ACL2 should handle mbe with stobjs differently.

Since mbe is meant to cleanly separate execution efficiency with

logical consideration, syntactic restrictions on stobjs should not be enforced on the :logic argument of mbe.

UNIVERSITY OF TEXAS AT AUSTIN 32

slide-34
SLIDE 34

DEPARTMENT OF COMPUTER SCIENCES

Questions?

UNIVERSITY OF TEXAS AT AUSTIN 33

slide-35
SLIDE 35

DEPARTMENT OF COMPUTER SCIENCES

References

[MM00] P . Manolios and J S. Moore. Partial Functions in ACL2. In

  • M. Kaufmann and J S. Moore, editors, Second International

Workshop on ACL2 Theorem Prover and Its Applications, Austin, TX, October 2000. [MM03] P . Manolios and J S. Moore. Partial Functions in ACL2. Journal

  • f Automated Reasoning, 31(2):107–127, 2003.

[Moo03] J S. Moore. Inductive Assertions and Operational Semantics. In D. Geist, editor,

12 th International Conference on Correct

Hardware Design and Verification Methods (CHARME), volume 2860 of LNCS, pages 289–303. Springer-Verlag, October 2003.

UNIVERSITY OF TEXAS AT AUSTIN 34