How to Make Ad Hoc Proof Automation Less Ad Hoc Georges Gonthier 1 - PowerPoint PPT Presentation

How to Make Ad Hoc Proof Automation Less Ad Hoc Georges Gonthier 1 Beta Ziliani 2 Aleks Nanevski 3 Derek Dreyer 2 1 Microsoft Research Cambridge 2 Max Planck Institute for Software Systems (MPI-SWS) 3 IMDEA Software Institute, Madrid ICFP 2011, Tokyo

Why proof automation at ICFP? Ad hoc polymorphism ≈ Overloading terms Ad hoc proof automation ≈ Overloading lemmas “How to make ad hoc polymorphism less ad hoc” Haskell type classes (Wadler & Blott ’89) “How to make ad hoc proof automation less ad hoc” Canonical structures: A generalization of type classes that’s already present in Coq G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Motivating example from program verification Lemma noalias: If pointers x 1 and x 2 appear in disjoint heaps, they do not alias. In formal syntax: noalias : ∀ h : heap . ∀ x 1 x 2 : ptr . ∀ v 1 : A 1 . ∀ v 2 : A 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Motivating example from program verification Lemma noalias: If pointers x 1 and x 2 appear in disjoint heaps, they do not alias. In formal syntax: noalias : ∀ h : heap . ∀ x 1 x 2 : ptr . ∀ v 1 : A 1 . ∀ v 2 : A 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 singleton heaps G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Motivating example from program verification Lemma noalias: If pointers x 1 and x 2 appear in disjoint heaps, they do not alias. In formal syntax: noalias : ∀ h : heap . ∀ x 1 x 2 : ptr . ∀ v 1 : A 1 . ∀ v 2 : A 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 disjoint union (undefined if heaps overlap) G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Motivating example from program verification Lemma noalias: If pointers x 1 and x 2 appear in disjoint heaps, they do not alias. In formal syntax: noalias : ∀ h : heap . ∀ x 1 x 2 : ptr . ∀ v 1 : A 1 . ∀ v 2 : A 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 test for definedness/disjointness G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Motivating example from program verification Lemma noalias: If pointers x 1 and x 2 appear in disjoint heaps, they do not alias. In formal syntax: noalias : ∀ h : heap . ∀ x 1 x 2 : ptr . ∀ v 1 : A 1 . ∀ v 2 : A 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 no alias G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Using noalias requires a lot of “glue proof” noalias : ∀ h x 1 x 2 v 1 v 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 D : def ( h 1 ⊎ ( y 1 �→ w 1 ⊎ y 2 �→ w 2 ) ⊎ ( h 2 ⊎ y 3 �→ w 3 )) ( y 1 != y 2 ) && ( y 2 != y 3 ) && ( y 3 != y 1 ) G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Using noalias requires a lot of “glue proof” noalias : ∀ h x 1 x 2 v 1 v 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 D : def ( h 1 ⊎ ( y 1 �→ w 1 ⊎ y 2 �→ w 2 ) ⊎ ( h 2 ⊎ y 3 �→ w 3 )) ( y 1 != y 2 ) && ( y 2 != y 3 ) && ( y 3 != y 1 ) G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Using noalias requires a lot of “glue proof” noalias : ∀ h x 1 x 2 v 1 v 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 D : def ( h 1 ⊎ ( y 1 �→ w 1 ⊎ y 2 �→ w 2 ) ⊎ ( h 2 ⊎ y 3 �→ w 3 )) ( y 1 != y 2 ) && ( y 2 != y 3 ) && ( y 3 != y 1 ) G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Using noalias requires a lot of “glue proof” noalias : ∀ h x 1 x 2 v 1 v 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 D : def ( h 1 ⊎ ( y 1 �→ w 1 ⊎ y 2 �→ w 2 ) ⊎ ( h 2 ⊎ y 3 �→ w 3 )) ( y 1 != y 2 ) && ( y 2 != y 3 ) && ( y 3 != y 1 ) G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Using noalias requires a lot of “glue proof” noalias : ∀ h x 1 x 2 v 1 v 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 D : def ( y 1 �→ w 1 ⊎ y 2 �→ w 2 ⊎ ( h 1 ⊎ ( h 2 ⊎ y 3 �→ w 3 ))) ( y 1 != y 2 ) && ( y 2 != y 3 ) && ( y 3 != y 1 ) G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Using noalias requires a lot of “glue proof” noalias : ∀ h x 1 x 2 v 1 v 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 D : def ( y 1 �→ w 1 ⊎ y 2 �→ w 2 ⊎ ( h 1 ⊎ ( h 2 ⊎ y 3 �→ w 3 ))) true && ( y 2 != y 3 ) && ( y 3 != y 1 ) G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Using noalias requires a lot of “glue proof” noalias : ∀ h x 1 x 2 v 1 v 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 D : def ( y 1 �→ w 1 ⊎ y 2 �→ w 2 ⊎ ( h 1 ⊎ ( h 2 ⊎ y 3 �→ w 3 ))) true && ( y 2 != y 3 ) && ( y 3 != y 1 ) G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Using noalias requires a lot of “glue proof” noalias : ∀ h x 1 x 2 v 1 v 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 D : def ( y 1 �→ w 1 ⊎ y 2 �→ w 2 ⊎ ( h 1 ⊎ ( h 2 ⊎ y 3 �→ w 3 ))) true && ( y 2 != y 3 ) && ( y 3 != y 1 ) G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Using noalias requires a lot of “glue proof” noalias : ∀ h x 1 x 2 v 1 v 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 D : def ( y 2 �→ w 2 ⊎ y 3 �→ w 3 ⊎ ( y 1 �→ w 1 ⊎ h 1 ⊎ h 2 )) true && ( y 2 != y 3 ) && ( y 3 != y 1 ) G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Using noalias requires a lot of “glue proof” noalias : ∀ h x 1 x 2 v 1 v 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 D : def ( y 2 �→ w 2 ⊎ y 3 �→ w 3 ⊎ ( y 1 �→ w 1 ⊎ h 1 ⊎ h 2 )) true && true && ( y 3 != y 1 ) G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Using noalias requires a lot of “glue proof” noalias : ∀ h x 1 x 2 v 1 v 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 D : def ( y 2 �→ w 2 ⊎ y 3 �→ w 3 ⊎ ( y 1 �→ w 1 ⊎ h 1 ⊎ h 2 )) true && true && ( y 3 != y 1 ) G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Using noalias requires a lot of “glue proof” noalias : ∀ h x 1 x 2 v 1 v 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 D : def ( y 2 �→ w 2 ⊎ y 3 �→ w 3 ⊎ ( y 1 �→ w 1 ⊎ h 1 ⊎ h 2 )) true && true && ( y 3 != y 1 ) G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Using noalias requires a lot of “glue proof” noalias : ∀ h x 1 x 2 v 1 v 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 D : def ( y 3 �→ w 3 ⊎ y 1 �→ w 1 ⊎ ( y 2 �→ w 2 ⊎ h 1 ⊎ h 2 )) true && true && ( y 3 != y 1 ) G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Using noalias requires a lot of “glue proof” noalias : ∀ h x 1 x 2 v 1 v 2 . def ( x 1 �→ v 1 ⊎ x 2 �→ v 2 ⊎ h ) → x 1 != x 2 D : def ( y 3 �→ w 3 ⊎ y 1 �→ w 1 ⊎ ( y 2 �→ w 2 ⊎ h 1 ⊎ h 2 )) true && true && true G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Glue proof, formally (in Coq) rewrite − !unA − !(unCA ( y 2 �→ ) − !(unCA ( y 1 �→ )) unA in D . rewrite (noalias D ) . rewrite − !unA − (unC ( y 3 �→ )) − !(unCA ( y 3 �→ )) in D . rewrite − !(unCA ( y 2 �→ )) unA in D . rewrite (noalias D ) . rewrite − !unA − !(unCA ( y 1 �→ )) − !(unCA ( y 3 �→ )) unA in D . rewrite (noalias D ) . G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Glue proof, formally (in Coq) rewrite − !unA − !(unCA ( y 2 �→ ) − !(unCA ( y 1 �→ )) unA in D . rewrite (noalias D ) . rewrite − !unA − (unC ( y 3 �→ )) − !(unCA ( y 3 �→ )) in D . rewrite − !(unCA ( y 2 �→ )) unA in D . rewrite (noalias D ) . rewrite − !unA − !(unCA ( y 1 �→ )) − !(unCA ( y 3 �→ )) unA in D . rewrite (noalias D ) . G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc

Automation as it is today Write custom tactic: For each x i != x j in the goal: rearrange hypothesis, to bring x i and x j to the front apply the noalias lemma repeat G. Gonthier, B. Ziliani, A. Nanevski, D. Dreyer How to Make Ad Hoc Proof Automation Less Ad Hoc