Certified Code Generation in Isabelle/HOL

Transcript

1. Cer fied Code Genera on in Isabelle/HOL Lars Hupel Technische Universität München August 19, 2014
2. Isabelle ▶ interac ve proof assistant ▶ powerful automa on ▶ classical and equa onal reasoning ▶ decision procedures (e.g. linear arithme c) ▶ integra on with external automated theorem provers ▶ ... ▶ supports func onal programming 2 / 12
3. Defining Datatypes datatype α list = Nil | Cons α (α list) This specifica on introduces: ▶ an induc on principle ▶ a recursor rec list :: α → (β → β list → α → α) → β list → α ▶ ... a lot more 3 / 12
4. Defining Func ons ▶ HOL has a defini on principle: x = λy1 . . . yn . t ▶ ... introduces a new constant and an axiom ▶ but: t must not depend on x itself ▶ primrec defines a func on using that recursor ▶ fun allows more flexible recursion, but need to prove termina on 4 / 12
5. Func onal Programming in Isabelle Defini ons datatype α list = Nil | Cons α (α list) primrec append where append Nil ys = ys append (Cons x xs) ys = Cons x (append xs ys) 5 / 12
6. Func onal Programming in Isabelle Defini ons datatype α list = Nil | Cons α (α list) primrec append where append Nil ys = ys append (Cons x xs) ys = Cons x (append xs ys) Proofs lemma append xs (append ys zs) = append (append xs ys) zs by (induct xs) simp+ 5 / 12
7. Evalua ng Expressions We want to evaluate append xs ys for concrete xs and ys 1. using term rewri ng (by simp) ▶ cer fied, but slow 2. using code genera on (by eval) ▶ fast, but not cer fied 6 / 12
8. Evalua ng Expressions We want to evaluate append xs ys for concrete xs and ys 1. using term rewri ng (by simp) ▶ cer fied, but slow 2. using code genera on (by eval) ▶ fast, but not cer fied 6 / 12
9. Code Genera on Isabelle can generate code for ML, Haskell and Scala datatype ’a list = Nil | Cons of ’a * ’a list; fun append Nil xs = xs | append (Cons (y, ys)) xs = Cons (y, append ys xs); 7 / 12
10. Code Genera on Isabelle can generate code for ML, Haskell and Scala abstract sealed class list[A] final case class Nila[A]() extends list[A] final case class Cons[A](a: A, b: list[A]) extends list[A] def append[A](x0: list[A], xs: list[A]): list[A] = (x0, xs) match { case (Nila(), xs) => xs case (Cons(y, ys), xs) => Cons[A](y, append[A](ys, xs)) } 7 / 12
11. Code Genera on Pipeline 1. Input: Set of equa ons 2. Preprocess 3. Build dependency graph, compute SCCs 4. Translate to intermediate language 5. Serialize to target language 6. Output: Source text 8 / 12
12. Cer fying Code Genera on Idea: Transform equa ons into intermediate formal object Intermediate AST is a value in the logic 9 / 12
13. Cer fying Code Genera on Idea: Transform equa ons into intermediate formal object Intermediate AST is a value in the logic Magnus O. Myreen and Sco Owens. Proof-producing synthesis of ML from higher-order logic. In Interna onal Conference on Func onal Programming (ICFP), 2012. 9 / 12
14. Cer fying Code Genera on Approach by Myreen et. al. ▶ Define a datatype for ML syntax, formalize seman cs ▶ Define relators between HOL values and ML values, e. g. relint :: ML val → int → bool ▶ When code generator is invoked on constant f, ▶ define a logical constant fML containing the AST ▶ prove theorem rela ng f to fML using the type’s relator 10 / 12
15. Cer fying Code Genera on Our Approach ▶ Reuse ML syntax and seman cs by Myreen ▶ Define intermediate layer of an Higher-Order TRS (including relators) ▶ When code generator is invoked on constant f, ▶ define a logical constant fTRS containing the TRS ▶ prove theorem rela ng f to fTRS using the type’s relator ▶ Define a HOL func on compile :: trs → ML val ▶ Prove it correct once and for all 11 / 12
16. Challenges ▶ Isabelle supports type classes, ML doesn’t cer fying dic onary construc on ▶ Users can specify custom equa ons need to figure out termina on and induc on principles (like fun) ▶ Genera on of relators for complex data types complex proof tac cs to accomodate for non-standard recursion ▶ Set of code equa ons is unordered need to specify wellformedness condi ons ▶ Execu on of the compiler itself (compile compileTRS ) bootstrapping using term rewri ng (slow!) 12 / 12