Functional Programming with Isabelle/HOL

Transcription

1 Functional Programming with Isabelle/HOL = Isabelle λ β HOL α Florian Haftmann Technische Universität München January 2009

2 Overview Viewing Isabelle/HOL as a functional programming language: 1. Isabelle/HOL Specification Tools. 2. Code Generation from Isabelle/HOL-Theories. 3. Behind the Scene. 1 / 18

3 Overview Viewing Isabelle/HOL as a functional programming language: 1. Isabelle/HOL Specification Tools. 2. Code Generation from Isabelle/HOL-Theories. 3. Behind the Scene. Isabelle/HOL code generation SML / OCaml / Haskell specification tools 1 / 18

4 Isabelle/HOL specification tools

5 The definitional game Aim: write programs in Isabelle/HOL as naturally as in, say, SML... Isabelle/HOL specification tools 3 / 18

6 The definitional game Aim: write programs in Isabelle/HOL as naturally as in, say, SML... but it s not enough just to claim arbitrary things: axiomatization nonsense :: nat nat where nonsense-def : nonsense n = Suc (nonsense n) Isabelle/HOL specification tools 3 / 18

7 The definitional game Aim: write programs in Isabelle/HOL as naturally as in, say, SML... but it s not enough just to claim arbitrary things: axiomatization nonsense :: nat nat where nonsense-def : nonsense n = Suc (nonsense n) lemma 0 = Suc 0 proof from nonsense-def have nonsense 0 nonsense 0 = Suc (nonsense 0) nonsense 0 by simp then show 0 = Suc 0 by simp qed Isabelle/HOL specification tools 3 / 18

8 The definitional game Aim: write programs in Isabelle/HOL as naturally as in, say, SML... but it s not enough just to claim arbitrary things: axiomatization nonsense :: nat nat where nonsense-def : nonsense n = Suc (nonsense n) lemma 0 = Suc 0 proof from nonsense-def have nonsense 0 nonsense 0 = Suc (nonsense 0) nonsense 0 by simp then show 0 = Suc 0 by simp qed Things have to be properly constructed, that is: Find an appropriate primitive definition. Derive desired specification (honest toil). Specification tools automate this. Isabelle/HOL specification tools 3 / 18

9 The Isabelle/HOL toolbox Isabelle/HOL code generation SML / OCaml / Haskell specification tools inductive predicates Knaster-Tarski fixed point theorem inductive datatypes inductive predicate plus typedef primitive recursion primitive recursion combinator terminating functions explicit function graph plus definite choice Isabelle/HOL specification tools 4 / 18

10 Type classes Leightweight mechanism for overloading plus abstract specification. Example: algebra Isabelle/HOL specification tools 5 / 18

11 Code generator basics

12 Code generation paradigms proof extraction animates proof derivations in the spirit of the Curry- Howard isomorphism (cf. Coq) Code generator basics 7 / 18

13 Code generation paradigms proof extraction animates proof derivations in the spirit of the Curry- Howard isomorphism (cf. Coq) shallow embedding identifies term language of logic with term language of target language Code generator basics 7 / 18

14 Code generation paradigms proof extraction animates proof derivations in the spirit of the Curry- Howard isomorphism (cf. Coq) shallow embedding identifies term language of logic with term language of target language In the HOL tradition the second approach is favoured, Isabelle/HOL permits proof extraction, though. Code generator basics 7 / 18

15 Code generation paradigms proof extraction animates proof derivations in the spirit of the Curry- Howard isomorphism (cf. Coq) shallow embedding identifies term language of logic with term language of target language In the HOL tradition the second approach is favoured, Isabelle/HOL permits proof extraction, though. Isabelle/HOL code generation SML / OCaml / Haskell specification tools Code generator basics 7 / 18

16 Code generation using shallow embedding Correctness criterion: semantics of generated target language program P describes a term rewrite system where each derivation can be simulated in the theory Θ of the logic: sum [Suc Zero_nat, Suc Zero_nat] t identification t datatype nat = Suc of nat Zero_nat; fun plus_nat (Suc m) n = plus_nat m (Suc n) plus_nat Zero_nat n = n; fun sum [] = Zero_nat sum (m :: ms) = plus_nat m (sum ms); E Θ code generation E P Suc (Suc Zero_nat) u identification u Code generator basics 8 / 18

17 Code generation using shallow embedding Correctness criterion: semantics of generated target language program P describes a term rewrite system where each derivation can be simulated in the theory Θ of the logic: sum [Suc Zero_nat, Suc Zero_nat] t identification t datatype nat = Suc of nat Zero_nat; fun plus_nat (Suc m) n = plus_nat m (Suc n) plus_nat Zero_nat n = n; fun sum [] = Zero_nat sum (m :: ms) = plus_nat m (sum ms); E Θ code generation E P Suc (Suc Zero_nat) u identification u (partial correctness) Code generator basics 8 / 18

18 Examples amortised queues amortised queues with poor man s datatype abstraction algebra with type classes Code generator basics 9 / 18

19 A closer look at code generation

20 How does a code generator look like? A closer look at code generation 11 / 18

21 How does a code generator look like? A closer look at code generation 11 / 18

22 Architecture Isabelle/HOL tools Isabelle theory selection SML OCaml... Haskell serialisation preprocessing code equations translation intermediate language A closer look at code generation 12 / 18

23 Intermediate language purpose: add structure to bare logical equations A closer look at code generation 13 / 18

24 Intermediate language purpose: add structure to bare logical equations data κ α k = f 1 of τ 1... f n of τ n fun f :: α::s k. τ where f [α::s k ] t 1 = t 1... f [α::s k ] t k = t k class c c 1... c m where f 1 :: α. τ 1,..., f n :: α. τ n inst κ α::s k :: c where f 1 [κ α::s k ] = t 1,..., f n [κ α::s k ] = t n... a kind of Mini-Haskell A closer look at code generation 13 / 18

25 Intermediate language purpose: add structure to bare logical equations data κ α k = f 1 of τ 1... f n of τ n fun f :: α::s k. τ where f [α::s k ] t 1 = t 1... f [α::s k ] t k = t k class c c 1... c m where f 1 :: α. τ 1,..., f n :: α. τ n inst κ α::s k :: c where f 1 [κ α::s k ] = t 1,..., f n [κ α::s k ] = t n... a kind of Mini-Haskell... not All-gol, but Thin-gol A closer look at code generation 13 / 18

26 Selecting Two degrees of freedom: code equations by default: definition, primrec, fun, function explicitly: attribute [code] datatype constructors by default: datatype, record explicitly: code-datatype A closer look at code generation 14 / 18

27 Preprocessing Interface to plugin arbitrary theorem transformations: rewrites simpset function transformators theory -> thm list -> thm list A closer look at code generation 15 / 18

28 Serialising Adaption to target-language specifics: improving readability and aesthetics of generated code (bools, tuples, lists,... ) gaining efficiency (target-language integers) interface with language parts which have no direct counterpart in HOL (imperative data structures) A closer look at code generation 16 / 18

29 Serialising Adaption to target-language specifics: improving readability and aesthetics of generated code (bools, tuples, lists,... ) gaining efficiency (target-language integers) interface with language parts which have no direct counterpart in HOL (imperative data structures)... but: know what you are doing! A closer look at code generation 16 / 18

30 Serialising Adaption to target-language specifics: improving readability and aesthetics of generated code (bools, tuples, lists,... ) gaining efficiency (target-language integers) interface with language parts which have no direct counterpart in HOL (imperative data structures)... but: know what you are doing! Remember the fundamental rule of software engineering: Don t write your own foo; if you can, use somebody else s. A closer look at code generation 16 / 18

31 Serialising Adaption to target-language specifics: improving readability and aesthetics of generated code (bools, tuples, lists,... ) gaining efficiency (target-language integers) interface with language parts which have no direct counterpart in HOL (imperative data structures)... but: know what you are doing! Remember the fundamental rule of software engineering: Don t write your own foo; if you can, use somebody else s. foo { operating system, garabage collector, cryptographic algorithm, concurrency framework, theorem prover,... } A closer look at code generation 16 / 18

32 Serialising Adaption to target-language specifics: improving readability and aesthetics of generated code (bools, tuples, lists,... ) gaining efficiency (target-language integers) interface with language parts which have no direct counterpart in HOL (imperative data structures)... but: know what you are doing! Remember the fundamental rule of software engineering: Don t write your own foo; if you can, use somebody else s. foo { operating system, garabage collector, cryptographic algorithm, concurrency framework, theorem prover,... } {serialisation} A closer look at code generation 16 / 18

33 What remains Not mentioned here implementing equality code extraction from proofs Ongoing work and research turning inductive predicates into equations Haskabelle: importing Haskell files Quickcheck concept for datatype abstraction Further reading Tutorials in the Isabelle distribution for functions, code generation etc. PhD thesis on code generation (under heavy construction... )... A closer look at code generation 17 / 18

34 Happy proving, happy hacking Thanks for your attention