A Refinement Framework for Monadic Programs in Isabelle/HOL

Transcription

1 A Refinement Framework for Monadic Programs in Isabelle/HOL Peter Lammich TU Munich, Institut für Informatik, Theorem Proving Group Easter 2013 Peter Lammich (TUM) Refinement Framework Easter / 17

2 Motivation Goal: Verified (model checking) algorithms Use theorem prover Isabelle/HOL Extract efficient implementations Problem Implementation details obfuscate algorithmic idea Proofs tend to get large and unmanageable Solution: Top-Down development by stepwise refinement Spec P 1... P n Impl Prove that each step preserves correctness Advantage Separation of concerns More modular and manageable proofs Peter Lammich (TUM) Refinement Framework Easter / 17

3 Program representation Requirements Nondeterminism by relations (or stronger) Choice operator and parameterization do not work in general Good fit to HOL (functional programming style) Solution: Shallowly embedded monad Advantages Shallow embedding: Simple proofs, extendable Monads: Nondeterminism + elegant functional programming style Deterministic fragment translated to functional program Peter Lammich (TUM) Refinement Framework Easter / 17

4 Refinement Monad Set/Exception monad datatype r nres ::= res (r set) fail Complete lattice: x fail and res X res Y iff X Y Monad operations: return x := res {x} { fail bind m f := x X f x if m = fail if m = res X Peter Lammich (TUM) Refinement Framework Easter / 17

5 Useful Programming Constructs assert Φ := if Φ then return () else fail µf, νf Least, greatest fixed point for recursion µf: partial correctness νf: total correctness while b f := µf x. if b x then bind (f x) F else return x while T b f := νf x. if b x then bind (f x) F else return x foreach Iteration over finite set if, let, case Standard HOL constructs do{...} Do notation (like in Haskell)... Peter Lammich (TUM) Refinement Framework Easter / 17

6 Programs Program is HOL-function f : a r nres Refinement: f x f x Possible results of f x are also results of f x Correctness: Φ x = f x res (Ψ x) If argument satisfies precondition, results satisfy postcondition Peter Lammich (TUM) Refinement Framework Easter / 17

7 Example: Dijkstra s Algorithm (Available from Archive of Formal Proofs) dijkstra do { σ0 dinit; (_,r) while dinvar T (λ(wl,_). wl {}) (λσ. do { (v,σ ) pop_min σ; update v σ }) σ0; return r } update v σ do { assert (update_pre v σ); res (update_spec v σ)} theorem dijkstra_correct: dijkstra res (is_shortest_path_map v0) Peter Lammich (TUM) Refinement Framework Easter / 17

8 Data Refinement Replace abstract data type by concrete one e. g. implement (finite) sets by red-black trees Abstraction relation R = {(c, a) a = α R c I R c} Lift to nres yields abstraction and concretization functions: R : c nres a nres and R : a nres c nres Galois connection: R m m iff m R m Transitive: m R m m S m = m RS m Peter Lammich (TUM) Refinement Framework Easter / 17

9 Refinement preserves correctness Correctness w. r. t. data refinement (x, x ) R Φ x = f x S res (Ψ x ) If argument s abstraction satisfies precondition, the result s abstraction satisfies postcondition Peter Lammich (TUM) Refinement Framework Easter / 17

10 Monadic Refinement Calculus Rules for showing programs correct x Y return x res Y m res {x. f x res X} bind m f res X... Rules for showing data refinement (x,y) R return x R (return y) m R m (x,x ) R. f x S f bind m f R bind m f... Peter Lammich (TUM) Refinement Framework Easter / 17

11 Refinement Framework for Isabelle/HOL Formalization of monadic refinement calculus Syntax driven verification condition generator For goals of the forms m res X and m R m Produces trusted code in ML/OCaml/Haskell/Scala For deterministic programs Integration with Isabelle Collection Framework (ICF) Peter Lammich (TUM) Refinement Framework Easter / 17

12 Example: Refine update update v σ do { assert (update_pre v σ); let (wl,r) = σ; let wv = path_weight (r v); let pv = r v; foreach uinvar v wl r (succ G v) (λ(w,v ) (wl,r). if (wv + Num w < path_weight (r v )) then do { assert (v wl pv None); return (wl,r(v the pv@[(v,w,v )])) } else return (wl,r) ) (wl,r)} lemma update _refines: "update v σ Id (update v σ)" Peter Lammich (TUM) Refinement Framework Easter / 17

13 Dijkstra: Chain of Refinements 1 dijkstra res (is_shortest_path_map v0) 2 dijkstra Id dijkstra 3 mdijkstra (build_rel αr res_invarm) dijkstra 4 cdijkstra g v0 (build_rel mr.α mr.invar) mdijkstra (in locale with (g,ga) br g.α g.invar) 5 g.invar g = return (idijkstra g v0) cdijkstra g v0 Peter Lammich (TUM) Refinement Framework Easter / 17

14 Dijkstra: Implementation theorem (in dijkstrac) idijkstra_correct: assumes g.invar g assumes v0 nodes (g.α g) assumes v w v. (v,w,v ) edges (g.α g) = 0 w shows weighted_graph.is_shortest_path_map (g.α g) v0 (Dijkstra.αr (mr.α (idijkstra g v0))) and "Dijkstra.res_invarm (mr.α (idijkstra g v0)) interpretation hrf!: dijkstrac hlg_ops rm_ops aluprioi_ops Yields executable constant hrf.idijkstra and theorem hrf.idijkstra_correct. Peter Lammich (TUM) Refinement Framework Easter / 17

15 Automatic Data Refinement (ITP-2013) Automatically synthesize implementation from abstract program Use heuristics to choose adequate data structures Based on parametricity Automatic instantiation of generic algorithms In Dijkstra example: Generate executable code from mdijkstra Peter Lammich (TUM) Refinement Framework Easter / 17

16 Applications Implemented Algorithms BFS, DFS graph traversals [Lammich] Dijkstra s shortest paths algorithm [Nordhoff, Lammich] Nested DFS (Büchi automata acceptance) [Neumann], [Lammich] Hopcroft s algorithm for automata minimization [Tuerk] Gerth s algorithm (LTL to Büchi automata) [Schimpf] Saturation algorithm for pre of PDS/DPN, work in progress [Lammich] Algorithm of Ilie, Navarro, and Yu (simulation relations on NFAs) [Eberl] Conversion of NFAs to RExps [Eberl] Executable code uses efficient data structures Peter Lammich (TUM) Refinement Framework Easter / 17

17 Conclusion Refinement framework for monadic programs Based on refinement calculus Available in Archive of Formal Proofs ( Automatic Refinement ( Many case studies show its applicability Some would not have been manageable without refinement Current/Future work: Automatic refinement to Imperative/HOL Complexity proofs Peter Lammich (TUM) Refinement Framework Easter / 17