diff --git a/doc/notes/verified-compilation/isabelle/Inline.thy b/doc/notes/verified-compilation/isabelle/Inline.thy new file mode 100644 index 00000000000..c016a4eb859 --- /dev/null +++ b/doc/notes/verified-compilation/isabelle/Inline.thy @@ -0,0 +1,109 @@ +section \Outline\ +text \This is just an experiment with presenting the datatypes and relations from Jacco's + paper in Iasbelle and working out how well (or otherwise) sledgehamemr et al. can handle + generating proofs for them. \ + +theory Inline + imports + Main + HOL.String + HOL.List +begin + +type_synonym Name = string + +section \Simple Lambda Calculus\ + +text \A very cut down lambda calculus with just enough to demo the functions below. \ + +text \I have commented out the Let definition because it produces some slightly complicated + variable name shadowing issues that wouldn't really help with this demo. \ + +datatype AST = Var Name + | Lam Name AST + | App AST AST +(* | Let Name AST AST *) (* The definition below does some name introduction without + checking things are free, which could cause shadowing, + which in turn makes the proofs harder...*) + +text \Simple variable substitution is useful later.\ + +fun subst :: "AST \ Name \ AST \ AST" where +"subst (Var n) m e = (if (n = m) then e else Var n)" +| "subst (Lam x e) m e' = Lam x (subst e m e')" +| "subst (App a b) m e' = App (subst a m e') (subst b m e')" +(* | "subst (Let x xv e) m e' = (Let x (subst xv m e') (subst e m e'))" (* how should this work if x = m? *) *) + +text \Beta reduction is just substitution when done right. + This isn't actually used in this demo, but it works...\ + +fun beta_reduce :: "AST \ AST" where +"beta_reduce (App (Lam n e) x) = (subst e n x)" +| "beta_reduce e = e" + +section \Translation Relation\ + +text \In a context, it is valid to inline variable values.\ + +type_synonym Context = "Name \ AST" + +fun extend :: "Context \ (Name * AST) \ Context" where +"extend \ (n, ast) = (\ x . if (x = n) then ast else \ x)" + +text \This defintion is from figure 2 of + [the paper](https://iohk.io/en/research/library/papers/translation-certification-for-smart-contracts-scp/)\ + +inductive inline :: "Context \ AST \ AST \ bool" ("_ \ _ \ _" 60) where +"\(\ x) = y ; \ \ y \ y' \ \ \ \ (Var x) \ y'" +| "\ \ (Var x) \ (Var x)" +(* | "\ \ \ t1 \ t1' ; (extend \ (x,t1)) \ t2 \ t2' \ \ \ \ (Let x t1 t2) \ (Let x t1' t2')" *) +| "\ \ \ t1 \ t1' ; \ \ t2 \ t2' \ \ \ \ App t1 t2 \ App t1' t2'" +| "\ \ t1 \ t1' \ \ \ Lam x t1 \ Lam x t1'" + +text \Idempotency is useful for resolving inductive substitutions.\ + +lemma inline_idempotent : "\ \ x \ x" +proof (induct x) + case (Var x) + then show ?case by (rule inline.intros(2)) +next + case (Lam x1a x) + then show ?case by (rule inline.intros(4)) +next + case (App x1 x2) + then show ?case by (rule inline.intros(3)) +(* This requires x1a to be free in x1 and x2, or to shadow in a consistent way, which is a hassle to demonstrate... +next + case (Let x1a x1 x2) + then show ?case + apply (rule_tac ?x="x1a" in VerifiedCompilation.inline.intros(3)) + apply simp +*) +qed + +section \Experiments\ + +text \We can present some simple pairs of ASTs and ask sledgehammer to produce proofs. + For all of these it just works with the simplifier, since they are just applications + of the definition of the translation. \ + +lemma demo_inline1 : "\ \ x = (Var y) \ \ \ \ (Var x) \ (Var y)" + by (simp add: inline.intros(1) inline_idempotent) + +lemma demo_inline2 : "\ \ f = (Lam x (App g (Var x))) ; \ y = (Var b) \ \ \ \ (App (Var f) (Var y)) \ (App (Lam x (App g (Var x))) (Var b))" + by (simp add: inline.intros(1) inline.intros(3) inline_idempotent) + +lemma demo_inline_2step : "\ \ f = (Lam x (Lam y (App (Var x) (Var y)))) ; \ b = (Var z) \ \ \ \ (App (Var f) (Var b)) \ (App (Lam x (Lam y (App (Var x) (Var y)))) (Var z))" + by (simp add: inline.intros(1) inline.intros(3) inline_idempotent) + +lemma demo_inline_4step : "\ \ f = (Lam x (Lam y (App (Var x) (Var y)))) ; \ b = (Var c) ; \ c = (Var d) ; \ d = (App (Var i) (Var j)) \ \ \ \ (App (Var f) (Var b)) \ (App (Lam x (Lam y (App (Var x) (Var y)))) (App (Var i) (Var j)))" + using inline.intros(1) inline.intros(3) inline_idempotent by presburger + +text \A false example to show verification actually happen! This reqriting isn't valid and + nitpick can show you a counterexample pretty quickly (although it isn't very readable).\ +lemma demo_wrong_inline : "\ \ f = (Lam x (Lam y (App (Var x) (Var y)))) \ \ \ \ (App (Var f) (Var z)) \ (App (Var x) (Var y))" + nitpick + sorry + +end +