-
Notifications
You must be signed in to change notification settings - Fork 15
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update scalar_tac
to use the aesop
tactic
#282
Merged
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR is a first step towards relying on Aesop for some class of automation. As such it is very basic, but opens up quite interesting possibilities.
For now, I simply replaced the part of
scalar_tac
which automatically introduces assumptions in the goal, for instance to introduce information about the bounds of the machine integers in the context. As I needed this system to be extensible I originally used typeclasses, but it was a bit ad-hoc. By using the forward reasoning abilities ofaesop
, and in particular its "patterns", I was able to make the implementation simpler and more flexible. In practice, it works as follows.Whenever we want
scalar_tac
to automatically introduce a lemma in the context during its preprocessing step, we simply mark the lemma with thescalar_tac
attribute, together with a pattern which will guide the application.For instance (comes from here) to introduce bounds for all
x : Scalar ty
in the context:It is possible to make the rules local (to a section/file) with the
local
keyword (this comes for free). I use this in the proof of the hashmap, for instance (see here - I pasted the code below) to use the fact that some arithmetic facts can be deduced from the invariant. The idea is to have automation, but local to the file (it wouldn't make sense for this rule to escape to client code). If we think in terms of SMT automation (for instance, with Dafny), this is tantamount to declaring the invariant as transparent, except here we reveal only the facts we need, and when reasoning about arithmetic (withscalar_tac
).Because I expect this to be frequently used, I defined a rule set for some non-linear arithmetic rules, which can be activated via the option
scalarTac.nonLin
. They provide rules to reason about the modulo operation (I use it in the hashmap) or the fact that the multiplication of two positive numbers is positive. For instance (comes from here):I also provide a generic way of specifying the sets of rules to use (see here).