1 (* Title: HOL/SPARK/Tools/spark_vcs.ML
2 Author: Stefan Berghofer
3 Copyright: secunet Security Networks AG
5 Store for verification conditions generated by SPARK/Ada.
10 val set_vcs: Fdl_Parser.decls -> Fdl_Parser.rules ->
11 (string * string) * Fdl_Parser.vcs -> Path.T -> theory -> theory
12 val add_proof_fun: (typ option -> 'a -> term) ->
13 string * ((string list * string) option * 'a) ->
15 val add_type: string * typ -> theory -> theory
16 val lookup_vc: theory -> string -> (Element.context_i list *
17 (string * thm list option * Element.context_i * Element.statement_i)) option
18 val get_vcs: theory ->
19 Element.context_i list * (binding * thm) list * (string *
20 (string * thm list option * Element.context_i * Element.statement_i)) list
21 val mark_proved: string -> thm list -> theory -> theory
22 val close: theory -> theory
23 val is_closed: theory -> bool
26 structure SPARK_VCs: SPARK_VCS =
34 fun err_unfinished () = error "An unfinished SPARK environment is still open."
36 val strip_number = pairself implode o take_suffix Fdl_Lexer.is_digit o raw_explode;
38 val name_ord = prod_ord string_ord (option_ord int_ord) o
39 pairself (strip_number ##> Int.fromString);
41 structure VCtab = Table(type key = string val ord = name_ord);
43 structure VCs = Theory_Data
46 {pfuns: ((string list * string) option * term) Symtab.table,
47 type_map: typ Symtab.table,
49 {ctxt: Element.context_i list,
50 defs: (binding * thm) list,
52 funs: (string list * string) tab,
53 ids: (term * string) Symtab.table * Name.context,
55 vcs: (string * thm list option *
56 (string * expr) list * (string * expr) list) VCtab.table,
58 val empty : T = {pfuns = Symtab.empty, type_map = Symtab.empty, env = NONE}
60 fun merge ({pfuns = pfuns1, type_map = type_map1, env = NONE},
61 {pfuns = pfuns2, type_map = type_map2, env = NONE}) =
62 {pfuns = Symtab.merge (eq_pair (op =) (op aconv)) (pfuns1, pfuns2),
63 type_map = Symtab.merge (op =) (type_map1, type_map2),
65 | merge _ = err_unfinished ()
71 val to_lower = raw_explode #> map Symbol.to_ascii_lower #> implode;
73 val lcase_eq = (op =) o pairself (to_lower o Long_Name.base_name);
76 let val T = fastype_of t
77 in Const (s, T --> T) $ t end;
81 val setT = fastype_of t;
82 val T = HOLogic.dest_setT setT;
83 val U = HOLogic.dest_setT (fastype_of u)
85 Const (@{const_name Sigma}, setT --> (T --> HOLogic.mk_setT U) -->
86 HOLogic.mk_setT (HOLogic.mk_prodT (T, U))) $ t $ Abs ("", T, u)
90 let val {type_map, ...} = VCs.get thy
91 in Symtab.lookup type_map ty end;
93 fun mk_type _ "integer" = HOLogic.intT
94 | mk_type _ "boolean" = HOLogic.boolT
96 (case get_type thy ty of
98 Syntax.check_typ (Proof_Context.init_global thy)
99 (Type (Sign.full_name thy (Binding.name ty), []))
102 val booleanN = "boolean";
103 val integerN = "integer";
105 fun define_overloaded (def_name, eq) lthy =
107 val ((c, _), rhs) = eq |> Syntax.check_term lthy |>
108 Logic.dest_equals |>> dest_Free;
109 val ((_, (_, thm)), lthy') = Local_Theory.define
110 ((Binding.name c, NoSyn), ((Binding.name def_name, []), rhs)) lthy
111 val ctxt_thy = Proof_Context.init_global (Proof_Context.theory_of lthy');
112 val thm' = singleton (Proof_Context.export lthy' ctxt_thy) thm
113 in (thm', lthy') end;
115 fun strip_underscores s =
116 strip_underscores (unsuffix "_" s) handle Fail _ => s;
119 unsuffix "~" s ^ "_init" handle Fail _ => s;
121 val mangle_name = strip_underscores #> strip_tilde;
123 fun mk_variables thy xs ty (tab, ctxt) =
125 val T = mk_type thy ty;
126 val (ys, ctxt') = Name.variants (map mangle_name xs) ctxt;
127 val zs = map (Free o rpair T) ys;
128 in (zs, (fold (Symtab.update o apsnd (rpair ty)) (xs ~~ zs) tab, ctxt')) end;
130 fun get_record_info thy T = (case Record.dest_recTs T of
131 [(tyname, [@{typ unit}])] =>
132 Record.get_info thy (Long_Name.qualifier tyname)
135 fun find_field fname = find_first (curry lcase_eq fname o fst);
137 fun find_field' fname = get_first (fn (flds, fldty) =>
138 if member (op =) flds fname then SOME fldty else NONE);
140 fun assoc_ty_err thy T s msg =
141 error ("Type " ^ Syntax.string_of_typ_global thy T ^
142 " associated with SPARK type " ^ s ^ "\n" ^ msg);
145 (** generate properties of enumeration types **)
147 fun add_enum_type tyname tyname' thy =
149 val {case_name, ...} = the (Datatype_Data.get_info thy tyname');
150 val cs = map Const (the (Datatype_Data.get_constrs thy tyname'));
152 val T = Type (tyname', []);
153 val p = Const (@{const_name pos}, T --> HOLogic.intT);
154 val v = Const (@{const_name val}, HOLogic.intT --> T);
155 val card = Const (@{const_name card},
156 HOLogic.mk_setT T --> HOLogic.natT) $ HOLogic.mk_UNIV T;
158 fun mk_binrel_def s f = Logic.mk_equals
159 (Const (s, T --> T --> HOLogic.boolT),
160 Abs ("x", T, Abs ("y", T,
161 Const (s, HOLogic.intT --> HOLogic.intT --> HOLogic.boolT) $
162 (f $ Bound 1) $ (f $ Bound 0))));
164 val (((def1, def2), def3), lthy) = thy |>
166 Class.instantiation ([tyname'], [], @{sort enum}) |>
168 define_overloaded ("pos_" ^ tyname ^ "_def", Logic.mk_equals
170 list_comb (Const (case_name, replicate k HOLogic.intT @
171 [T] ---> HOLogic.intT),
172 map (HOLogic.mk_number HOLogic.intT) (0 upto k - 1)))) ||>>
174 define_overloaded ("less_eq_" ^ tyname ^ "_def",
175 mk_binrel_def @{const_name less_eq} p) ||>>
176 define_overloaded ("less_" ^ tyname ^ "_def",
177 mk_binrel_def @{const_name less} p);
179 val UNIV_eq = Goal.prove lthy [] []
180 (HOLogic.mk_Trueprop (HOLogic.mk_eq
181 (HOLogic.mk_UNIV T, HOLogic.mk_set T cs)))
183 rtac @{thm subset_antisym} 1 THEN
184 rtac @{thm subsetI} 1 THEN
185 Datatype_Aux.exh_tac (K (#exhaust (Datatype_Data.the_info
186 (Proof_Context.theory_of lthy) tyname'))) 1 THEN
187 ALLGOALS (asm_full_simp_tac (simpset_of lthy)));
189 val finite_UNIV = Goal.prove lthy [] []
190 (HOLogic.mk_Trueprop (Const (@{const_name finite},
191 HOLogic.mk_setT T --> HOLogic.boolT) $ HOLogic.mk_UNIV T))
192 (fn _ => simp_tac (simpset_of lthy addsimps [UNIV_eq]) 1);
194 val card_UNIV = Goal.prove lthy [] []
195 (HOLogic.mk_Trueprop (HOLogic.mk_eq
196 (card, HOLogic.mk_number HOLogic.natT k)))
197 (fn _ => simp_tac (simpset_of lthy addsimps [UNIV_eq]) 1);
199 val range_pos = Goal.prove lthy [] []
200 (HOLogic.mk_Trueprop (HOLogic.mk_eq
201 (Const (@{const_name image}, (T --> HOLogic.intT) -->
202 HOLogic.mk_setT T --> HOLogic.mk_setT HOLogic.intT) $
203 p $ HOLogic.mk_UNIV T,
204 Const (@{const_name atLeastLessThan}, HOLogic.intT -->
205 HOLogic.intT --> HOLogic.mk_setT HOLogic.intT) $
206 HOLogic.mk_number HOLogic.intT 0 $
207 (@{term int} $ card))))
209 simp_tac (simpset_of lthy addsimps [card_UNIV]) 1 THEN
210 simp_tac (simpset_of lthy addsimps [UNIV_eq, def1]) 1 THEN
211 rtac @{thm subset_antisym} 1 THEN
212 simp_tac (simpset_of lthy) 1 THEN
213 rtac @{thm subsetI} 1 THEN
214 asm_full_simp_tac (simpset_of lthy addsimps @{thms interval_expand}
215 delsimps @{thms atLeastLessThan_iff}) 1);
218 Class.prove_instantiation_instance (fn _ =>
219 Class.intro_classes_tac [] THEN
220 rtac finite_UNIV 1 THEN
221 rtac range_pos 1 THEN
222 simp_tac (HOL_basic_ss addsimps [def3]) 1 THEN
223 simp_tac (HOL_basic_ss addsimps [def2]) 1) lthy;
225 val (pos_eqs, val_eqs) = split_list (map_index (fn (i, c) =>
227 val n = HOLogic.mk_number HOLogic.intT i;
228 val th = Goal.prove lthy' [] []
229 (HOLogic.mk_Trueprop (HOLogic.mk_eq (p $ c, n)))
230 (fn _ => simp_tac (simpset_of lthy' addsimps [def1]) 1);
231 val th' = Goal.prove lthy' [] []
232 (HOLogic.mk_Trueprop (HOLogic.mk_eq (v $ n, c)))
234 rtac (@{thm inj_pos} RS @{thm injD}) 1 THEN
235 simp_tac (simpset_of lthy' addsimps
236 [@{thm pos_val}, range_pos, card_UNIV, th]) 1)
237 in (th, th') end) cs);
239 val first_el = Goal.prove lthy' [] []
240 (HOLogic.mk_Trueprop (HOLogic.mk_eq
241 (Const (@{const_name first_el}, T), hd cs)))
242 (fn _ => simp_tac (simpset_of lthy' addsimps
243 [@{thm first_el_def}, hd val_eqs]) 1);
245 val last_el = Goal.prove lthy' [] []
246 (HOLogic.mk_Trueprop (HOLogic.mk_eq
247 (Const (@{const_name last_el}, T), List.last cs)))
248 (fn _ => simp_tac (simpset_of lthy' addsimps
249 [@{thm last_el_def}, List.last val_eqs, card_UNIV]) 1);
251 val simp_att = [Attrib.internal (K Simplifier.simp_add)]
256 ((Binding.name (tyname ^ "_card_UNIV"), simp_att), [card_UNIV]) ||>>
258 ((Binding.name (tyname ^ "_pos"), simp_att), pos_eqs) ||>>
260 ((Binding.name (tyname ^ "_val"), simp_att), val_eqs) ||>>
262 ((Binding.name (tyname ^ "_first_el"), simp_att), [first_el]) ||>>
264 ((Binding.name (tyname ^ "_last_el"), simp_att), [last_el]) |> snd |>
265 Local_Theory.exit_global
269 fun check_no_assoc thy s = case get_type thy s of
271 | SOME _ => error ("Cannot associate a type with " ^ s ^
272 "\nsince it is no record or enumeration type");
274 fun check_enum [] [] = NONE
275 | check_enum els [] = SOME ("has no element(s) " ^ commas els)
276 | check_enum [] cs = SOME ("has extra element(s) " ^
277 commas (map (Long_Name.base_name o fst) cs))
278 | check_enum (el :: els) ((cname, _) :: cs) =
279 if lcase_eq (el, cname) then check_enum els cs
280 else SOME ("either has no element " ^ el ^
281 " or it is at the wrong position");
283 fun add_type_def (s, Basic_Type ty) (ids, thy) =
284 (check_no_assoc thy s;
286 Typedecl.abbrev_global (Binding.name s, [], NoSyn)
287 (mk_type thy ty) thy |> snd))
289 | add_type_def (s, Enum_Type els) ((tab, ctxt), thy) =
291 val (thy', tyname) = (case get_type thy s of
294 val tyb = Binding.name s;
295 val tyname = Sign.full_name thy tyb
298 Datatype.add_datatype {strict = true, quiet = true} [s]
300 map (fn s => (Binding.name s, [], NoSyn)) els)] |> snd |>
301 add_enum_type s tyname,
304 | SOME (T as Type (tyname, [])) =>
305 (case Datatype_Data.get_constrs thy tyname of
306 NONE => assoc_ty_err thy T s "is not a datatype"
307 | SOME cs => (case check_enum els cs of
308 NONE => (thy, tyname)
309 | SOME msg => assoc_ty_err thy T s msg)));
310 val cs = map Const (the (Datatype_Data.get_constrs thy' tyname))
312 ((fold (Symtab.update_new o apsnd (rpair s)) (els ~~ cs) tab,
313 fold Name.declare els ctxt),
317 | add_type_def (s, Array_Type (argtys, resty)) (ids, thy) =
318 (check_no_assoc thy s;
320 Typedecl.abbrev_global (Binding.name s, [], NoSyn)
321 (foldr1 HOLogic.mk_prodT (map (mk_type thy) argtys) -->
322 mk_type thy resty) thy |> snd))
324 | add_type_def (s, Record_Type fldtys) (ids, thy) =
326 let val fldTs = maps (fn (flds, ty) =>
327 map (rpair (mk_type thy ty)) flds) fldtys
328 in case get_type thy s of
330 Record.add_record true ([], Binding.name s) NONE
331 (map (fn (fld, T) => (Binding.name fld, T, NoSyn)) fldTs) thy
333 (case get_record_info thy rT of
334 NONE => assoc_ty_err thy rT s "is not a record type"
335 | SOME {fields, ...} =>
336 (case subtract (lcase_eq o pairself fst) fldTs fields of
338 | flds => assoc_ty_err thy rT s ("has extra field(s) " ^
339 commas (map (Long_Name.base_name o fst) flds));
341 case AList.lookup lcase_eq fields fld of
342 NONE => assoc_ty_err thy rT s ("has no field " ^ fld)
343 | SOME U => T = U orelse assoc_ty_err thy rT s
345 fld ^ " whose type\n" ^
346 Syntax.string_of_typ_global thy U ^
347 "\ndoes not match declared type\n" ^
348 Syntax.string_of_typ_global thy T)) fldTs;
352 | add_type_def (s, Pending_Type) (ids, thy) =
353 (check_no_assoc thy s;
354 (ids, Typedecl.typedecl_global (Binding.name s, [], NoSyn) thy |> snd));
357 fun term_of_expr thy types funs pfuns =
359 fun tm_of vs (Funct ("->", [e, e'])) =
360 (HOLogic.mk_imp (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
362 | tm_of vs (Funct ("<->", [e, e'])) =
363 (HOLogic.mk_eq (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
365 | tm_of vs (Funct ("or", [e, e'])) =
366 (HOLogic.mk_disj (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
368 | tm_of vs (Funct ("and", [e, e'])) =
369 (HOLogic.mk_conj (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
371 | tm_of vs (Funct ("not", [e])) =
372 (HOLogic.mk_not (fst (tm_of vs e)), booleanN)
374 | tm_of vs (Funct ("=", [e, e'])) =
375 (HOLogic.mk_eq (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
377 | tm_of vs (Funct ("<>", [e, e'])) = (HOLogic.mk_not
378 (HOLogic.mk_eq (fst (tm_of vs e), fst (tm_of vs e'))), booleanN)
380 | tm_of vs (Funct ("<", [e, e'])) = (HOLogic.mk_binrel @{const_name less}
381 (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
383 | tm_of vs (Funct (">", [e, e'])) = (HOLogic.mk_binrel @{const_name less}
384 (fst (tm_of vs e'), fst (tm_of vs e)), booleanN)
386 | tm_of vs (Funct ("<=", [e, e'])) = (HOLogic.mk_binrel @{const_name less_eq}
387 (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
389 | tm_of vs (Funct (">=", [e, e'])) = (HOLogic.mk_binrel @{const_name less_eq}
390 (fst (tm_of vs e'), fst (tm_of vs e)), booleanN)
392 | tm_of vs (Funct ("+", [e, e'])) = (HOLogic.mk_binop @{const_name plus}
393 (fst (tm_of vs e), fst (tm_of vs e')), integerN)
395 | tm_of vs (Funct ("-", [e, e'])) = (HOLogic.mk_binop @{const_name minus}
396 (fst (tm_of vs e), fst (tm_of vs e')), integerN)
398 | tm_of vs (Funct ("*", [e, e'])) = (HOLogic.mk_binop @{const_name times}
399 (fst (tm_of vs e), fst (tm_of vs e')), integerN)
401 | tm_of vs (Funct ("/", [e, e'])) = (HOLogic.mk_binop @{const_name divide}
402 (fst (tm_of vs e), fst (tm_of vs e')), integerN)
404 | tm_of vs (Funct ("div", [e, e'])) = (HOLogic.mk_binop @{const_name sdiv}
405 (fst (tm_of vs e), fst (tm_of vs e')), integerN)
407 | tm_of vs (Funct ("mod", [e, e'])) = (HOLogic.mk_binop @{const_name mod}
408 (fst (tm_of vs e), fst (tm_of vs e')), integerN)
410 | tm_of vs (Funct ("-", [e])) =
411 (mk_unop @{const_name uminus} (fst (tm_of vs e)), integerN)
413 | tm_of vs (Funct ("**", [e, e'])) =
414 (Const (@{const_name power}, HOLogic.intT --> HOLogic.natT -->
415 HOLogic.intT) $ fst (tm_of vs e) $
416 (@{const nat} $ fst (tm_of vs e')), integerN)
418 | tm_of (tab, _) (Ident s) =
419 (case Symtab.lookup tab s of
421 | NONE => error ("Undeclared identifier " ^ s))
423 | tm_of _ (Number i) = (HOLogic.mk_number HOLogic.intT i, integerN)
425 | tm_of vs (Quantifier (s, xs, ty, e)) =
427 val (ys, vs') = mk_variables thy xs ty vs;
429 "for_all" => HOLogic.mk_all
430 | "for_some" => HOLogic.mk_exists)
432 (fold_rev (fn Free (x, T) => fn t => q (x, T, t))
433 ys (fst (tm_of vs' e)),
437 | tm_of vs (Funct (s, es)) =
439 (* record field selection *)
440 (case try (unprefix "fld_") s of
441 SOME fname => (case es of
444 val (t, rcdty) = tm_of vs e;
445 val rT = mk_type thy rcdty
446 in case (get_record_info thy rT, lookup types rcdty) of
447 (SOME {fields, ...}, SOME (Record_Type fldtys)) =>
448 (case (find_field fname fields,
449 find_field' fname fldtys) of
450 (SOME (fname', fT), SOME fldty) =>
451 (Const (fname', rT --> fT) $ t, fldty)
452 | _ => error ("Record " ^ rcdty ^
453 " has no field named " ^ fname))
454 | _ => error (rcdty ^ " is not a record type")
456 | _ => error ("Function " ^ s ^ " expects one argument"))
459 (* record field update *)
460 (case try (unprefix "upf_") s of
461 SOME fname => (case es of
464 val (t, rcdty) = tm_of vs e;
465 val rT = mk_type thy rcdty;
466 val (u, fldty) = tm_of vs e';
467 val fT = mk_type thy fldty
468 in case get_record_info thy rT of
469 SOME {fields, ...} =>
470 (case find_field fname fields of
473 (Const (fname' ^ "_update",
474 (fT --> fT) --> rT --> rT) $
475 Abs ("x", fT, u) $ t,
477 else error ("Type\n" ^
478 Syntax.string_of_typ_global thy fT ^
479 "\ndoes not match type\n" ^
480 Syntax.string_of_typ_global thy fU ^
481 "\nof field " ^ fname)
482 | NONE => error ("Record " ^ rcdty ^
483 " has no field named " ^ fname))
484 | _ => error (rcdty ^ " is not a record type")
486 | _ => error ("Function " ^ s ^ " expects two arguments"))
489 (* enumeration type to integer *)
490 (case try (unsuffix "__pos") s of
491 SOME tyname => (case es of
492 [e] => (Const (@{const_name pos},
493 mk_type thy tyname --> HOLogic.intT) $ fst (tm_of vs e), integerN)
494 | _ => error ("Function " ^ s ^ " expects one argument"))
497 (* integer to enumeration type *)
498 (case try (unsuffix "__val") s of
499 SOME tyname => (case es of
500 [e] => (Const (@{const_name val},
501 HOLogic.intT --> mk_type thy tyname) $ fst (tm_of vs e), tyname)
502 | _ => error ("Function " ^ s ^ " expects one argument"))
505 (* successor / predecessor of enumeration type element *)
506 if s = "succ" orelse s = "pred" then (case es of
509 val (t, tyname) = tm_of vs e;
510 val T = mk_type thy tyname
512 (if s = "succ" then @{const_name succ}
513 else @{const_name pred}, T --> T) $ t, tyname)
515 | _ => error ("Function " ^ s ^ " expects one argument"))
517 (* user-defined proof function *)
519 (case Symtab.lookup pfuns s of
520 SOME (SOME (_, resty), t) =>
521 (list_comb (t, map (fst o tm_of vs) es), resty)
522 | _ => error ("Undeclared proof function " ^ s))))))
524 | tm_of vs (Element (e, es)) =
525 let val (t, ty) = tm_of vs e
526 in case lookup types ty of
527 SOME (Array_Type (_, elty)) =>
528 (t $ foldr1 HOLogic.mk_prod (map (fst o tm_of vs) es), elty)
529 | _ => error (ty ^ " is not an array type")
532 | tm_of vs (Update (e, es, e')) =
533 let val (t, ty) = tm_of vs e
534 in case lookup types ty of
535 SOME (Array_Type (idxtys, elty)) =>
537 val T = foldr1 HOLogic.mk_prodT (map (mk_type thy) idxtys);
538 val U = mk_type thy elty;
541 (Const (@{const_name fun_upd}, fT --> T --> U --> fT) $
542 t $ foldr1 HOLogic.mk_prod (map (fst o tm_of vs) es) $
546 | _ => error (ty ^ " is not an array type")
549 | tm_of vs (Record (s, flds)) =
551 val T = mk_type thy s;
552 val {extension = (ext_name, _), fields, ...} =
553 (case get_record_info thy T of
554 NONE => error (s ^ " is not a record type")
555 | SOME info => info);
556 val flds' = map (apsnd (tm_of vs)) flds;
557 val fnames = map (Long_Name.base_name o fst) fields;
558 val fnames' = map fst flds;
559 val (fvals, ftys) = split_list (map (fn s' =>
560 case AList.lookup lcase_eq flds' s' of
561 SOME fval_ty => fval_ty
562 | NONE => error ("Field " ^ s' ^ " missing in record " ^ s))
564 val _ = (case subtract lcase_eq fnames fnames' of
566 | xs => error ("Extra field(s) " ^ commas xs ^
568 val _ = (case duplicates (op =) fnames' of
570 | xs => error ("Duplicate field(s) " ^ commas xs ^
575 map (mk_type thy) ftys @ [HOLogic.unitT] ---> T),
576 fvals @ [HOLogic.unit]),
580 | tm_of vs (Array (s, default, assocs)) =
581 (case lookup types s of
582 SOME (Array_Type (idxtys, elty)) =>
584 val Ts = map (mk_type thy) idxtys;
585 val T = foldr1 HOLogic.mk_prodT Ts;
586 val U = mk_type thy elty;
587 fun mk_idx' T (e, NONE) = HOLogic.mk_set T [fst (tm_of vs e)]
588 | mk_idx' T (e, SOME e') = Const (@{const_name atLeastAtMost},
589 T --> T --> HOLogic.mk_setT T) $
590 fst (tm_of vs e) $ fst (tm_of vs e');
592 if length Ts <> length idx then
593 error ("Arity mismatch in construction of array " ^ s)
594 else foldr1 mk_times (map2 mk_idx' Ts idx);
595 fun mk_upd (idxs, e) t =
596 if length idxs = 1 andalso forall (is_none o snd) (hd idxs)
598 Const (@{const_name fun_upd}, (T --> U) -->
599 T --> U --> T --> U) $ t $
600 foldl1 HOLogic.mk_prod
601 (map (fst o tm_of vs o fst) (hd idxs)) $
604 Const (@{const_name fun_upds}, (T --> U) -->
605 HOLogic.mk_setT T --> U --> T --> U) $ t $
606 foldl1 (HOLogic.mk_binop @{const_name sup})
612 SOME e => Abs ("x", T, fst (tm_of vs e))
613 | NONE => Const (@{const_name undefined}, T --> U)),
616 | _ => error (s ^ " is not an array type"))
621 fun term_of_rule thy types funs pfuns ids rule =
622 let val tm_of = fst o term_of_expr thy types funs pfuns ids
624 Inference_Rule (es, e) => Logic.list_implies
625 (map (HOLogic.mk_Trueprop o tm_of) es, HOLogic.mk_Trueprop (tm_of e))
626 | Substitution_Rule (es, e, e') => Logic.list_implies
627 (map (HOLogic.mk_Trueprop o tm_of) es,
628 HOLogic.mk_Trueprop (HOLogic.mk_eq (tm_of e, tm_of e')))
632 val builtin = Symtab.make (map (rpair ())
633 ["->", "<->", "or", "and", "not", "=", "<>", "<", ">", "<=", ">=",
634 "+", "-", "*", "/", "div", "mod", "**"]);
636 fun complex_expr (Number _) = false
637 | complex_expr (Ident _) = false
638 | complex_expr (Funct (s, es)) =
639 not (Symtab.defined builtin s) orelse exists complex_expr es
640 | complex_expr (Quantifier (_, _, _, e)) = complex_expr e
641 | complex_expr _ = true;
643 fun complex_rule (Inference_Rule (es, e)) =
644 complex_expr e orelse exists complex_expr es
645 | complex_rule (Substitution_Rule (es, e, e')) =
646 complex_expr e orelse complex_expr e' orelse
647 exists complex_expr es;
650 Symtab.defined builtin orf
651 can (unprefix "fld_") orf can (unprefix "upf_") orf
652 can (unsuffix "__pos") orf can (unsuffix "__val") orf
653 equal "succ" orf equal "pred";
655 fun fold_opt f = the_default I o Option.map f;
656 fun fold_pair f g (x, y) = f x #> g y;
658 fun fold_expr f g (Funct (s, es)) = f s #> fold (fold_expr f g) es
659 | fold_expr f g (Ident s) = g s
660 | fold_expr f g (Number _) = I
661 | fold_expr f g (Quantifier (_, _, _, e)) = fold_expr f g e
662 | fold_expr f g (Element (e, es)) =
663 fold_expr f g e #> fold (fold_expr f g) es
664 | fold_expr f g (Update (e, es, e')) =
665 fold_expr f g e #> fold (fold_expr f g) es #> fold_expr f g e'
666 | fold_expr f g (Record (_, flds)) = fold (fold_expr f g o snd) flds
667 | fold_expr f g (Array (_, default, assocs)) =
668 fold_opt (fold_expr f g) default #>
670 (fold (fold (fold_pair
671 (fold_expr f g) (fold_opt (fold_expr f g)))))
672 (fold_expr f g)) assocs;
674 val add_expr_pfuns = fold_expr
675 (fn s => if is_pfun s then I else insert (op =) s) (K I);
677 val add_expr_idents = fold_expr (K I) (insert (op =));
679 fun pfun_type thy (argtys, resty) =
680 map (mk_type thy) argtys ---> mk_type thy resty;
682 fun check_pfun_type thy s t optty1 optty2 =
684 val T = fastype_of t;
686 let val U = pfun_type thy ty
690 Syntax.string_of_typ_global thy T ^
692 Syntax.string_of_term_global thy t ^
693 " associated with proof function " ^ s ^
694 "\ndoes not match declared type\n" ^
695 Syntax.string_of_typ_global thy U)
697 in (Option.map check optty1; Option.map check optty2; ()) end;
699 fun upd_option x y = if is_some x then x else y;
701 fun check_pfuns_types thy funs =
702 Symtab.map (fn s => fn (optty, t) =>
703 let val optty' = lookup funs s
705 (check_pfun_type thy s t optty optty';
706 (NONE |> upd_option optty |> upd_option optty', t))
712 fun err_vcs names = error (Pretty.string_of
713 (Pretty.big_list "The following verification conditions have not been proved:"
714 (map Pretty.str names)))
716 fun set_env (env as {funs, ...}) thy = VCs.map (fn
717 {pfuns, type_map, env = NONE} =>
718 {pfuns = check_pfuns_types thy funs pfuns,
721 | _ => err_unfinished ()) thy;
723 fun mk_pat s = (case Int.fromString s of
724 SOME i => [HOLogic.mk_Trueprop (Var (("C", i), HOLogic.boolT))]
725 | NONE => error ("Bad conclusion identifier: C" ^ s));
727 fun mk_vc thy types funs pfuns ids (tr, proved, ps, cs) =
729 HOLogic.mk_Trueprop o fst o term_of_expr thy types funs pfuns ids
732 Element.Assumes (map (fn (s', e) =>
733 ((Binding.name ("H" ^ s'), []), [(prop_of e, [])])) ps),
734 Element.Shows (map (fn (s', e) =>
735 (Attrib.empty_binding, [(prop_of e, mk_pat s')])) cs))
739 VCtab.fold (fn (_, (_, _, ps, cs)) => fold f ps #> fold f cs) vcs;
741 fun pfuns_of_vcs pfuns vcs =
742 fold_vcs (add_expr_pfuns o snd) vcs [] |>
743 filter_out (Symtab.defined pfuns);
745 fun declare_missing_pfuns thy funs pfuns vcs (tab, ctxt) =
747 val (fs, (tys, Ts)) =
748 pfuns_of_vcs pfuns vcs |>
749 map_filter (fn s => lookup funs s |>
750 Option.map (fn ty => (s, (SOME ty, pfun_type thy ty)))) |>
751 split_list ||> split_list;
752 val (fs', ctxt') = Name.variants fs ctxt
754 (fold Symtab.update_new (fs ~~ (tys ~~ map Free (fs' ~~ Ts))) pfuns,
755 Element.Fixes (map2 (fn s => fn T =>
756 (Binding.name s, SOME T, NoSyn)) fs' Ts),
760 fun add_proof_fun prep (s, (optty, raw_t)) thy =
762 {env = SOME {proving = true, ...}, ...} => err_unfinished ()
763 | {pfuns, type_map, env} =>
765 val optty' = (case env of
766 SOME {funs, ...} => lookup funs s
768 val optty'' = NONE |> upd_option optty |> upd_option optty';
769 val t = prep (Option.map (pfun_type thy) optty'') raw_t;
770 val _ = (case fold_aterms (fn u =>
771 if is_Var u orelse is_Free u then insert (op =) u else I) t [] of
773 | ts => error ("Term\n" ^ Syntax.string_of_term_global thy t ^
774 "\nto be associated with proof function " ^ s ^
775 " contains free variable(s) " ^
776 commas (map (Syntax.string_of_term_global thy) ts)));
778 (check_pfun_type thy s t optty optty';
779 if is_some optty'' orelse is_none env then
780 {pfuns = Symtab.update_new (s, (optty'', t)) pfuns,
783 handle Symtab.DUP _ => error ("Proof function " ^ s ^
784 " already associated with function")
785 else error ("Undeclared proof function " ^ s))
788 fun add_type (s, T as Type (tyname, Ts)) thy =
791 {env = SOME _, ...} => err_unfinished ()
792 | {pfuns, type_map, env} =>
794 type_map = Symtab.update_new (s, T) type_map,
796 handle Symtab.DUP _ => error ("SPARK type " ^ s ^
797 " already associated with type")) |>
799 case Datatype_Data.get_constrs thy' tyname of
804 (fn (_, Type (_, [])) => ()
805 | (cname, _) => assoc_ty_err thy T s
806 ("has illegal constructor " ^
807 Long_Name.base_name cname)) cs;
808 add_enum_type s tyname thy')
809 else assoc_ty_err thy T s "is illegal")
810 | add_type (s, T) thy = assoc_ty_err thy T s "is illegal";
812 val is_closed = is_none o #env o VCs.get;
814 fun lookup_vc thy name =
816 {env = SOME {vcs, types, funs, ids, ctxt, ...}, pfuns, ...} =>
817 (case VCtab.lookup vcs name of
819 let val (pfuns', ctxt', ids') =
820 declare_missing_pfuns thy funs pfuns vcs ids
821 in SOME (ctxt @ [ctxt'], mk_vc thy types funs pfuns' ids' vc) end
825 fun get_vcs thy = (case VCs.get thy of
826 {env = SOME {vcs, types, funs, ids, ctxt, defs, ...}, pfuns, ...} =>
827 let val (pfuns', ctxt', ids') =
828 declare_missing_pfuns thy funs pfuns vcs ids
830 (ctxt @ [ctxt'], defs,
832 map (apsnd (mk_vc thy types funs pfuns' ids')))
834 | _ => ([], [], []));
836 fun mark_proved name thms = VCs.map (fn
838 env = SOME {ctxt, defs, types, funs, ids, vcs, path, ...}} =>
841 env = SOME {ctxt = ctxt, defs = defs,
842 types = types, funs = funs, ids = ids,
844 vcs = VCtab.map_entry name (fn (trace, _, ps, cs) =>
845 (trace, SOME thms, ps, cs)) vcs,
852 {pfuns, type_map, env = SOME {vcs, path, ...}} =>
853 (case VCtab.fold_rev (fn vc as (_, (_, p, _, _)) =>
854 (if is_some p then apfst else apsnd) (cons vc)) vcs ([], []) of
856 (Thm.join_proofs (maps (the o #2 o snd) proved);
857 File.write (Path.ext "prv" path)
858 (concat (map (fn (s, _) => snd (strip_number s) ^
859 " -- proved by " ^ Distribution.version ^ "\n") proved));
860 {pfuns = pfuns, type_map = type_map, env = NONE})
861 | (_, unproved) => err_vcs (map fst unproved))
862 | _ => error "No SPARK environment is currently open") |>
866 (** set up verification conditions **)
868 fun partition_opt f =
870 fun part ys zs [] = (rev ys, rev zs)
871 | part ys zs (x :: xs) = (case f x of
872 SOME y => part (y :: ys) zs xs
873 | NONE => part ys (x :: zs) xs)
876 fun dest_def (id, (Substitution_Rule ([], Ident s, rhs))) = SOME (id, (s, rhs))
879 fun mk_rulename (s, i) = Binding.name (s ^ string_of_int i);
881 fun add_const (s, ty) ((tab, ctxt), thy) =
883 val T = mk_type thy ty;
884 val b = Binding.name s;
885 val c = Const (Sign.full_name thy b, T)
888 ((Symtab.update (s, (c, ty)) tab, Name.declare s ctxt),
889 Sign.add_consts_i [(b, T, NoSyn)] thy))
892 fun add_def types funs pfuns consts (id, (s, e)) (ids as (tab, ctxt), thy) =
893 (case lookup consts s of
896 val (t, ty') = term_of_expr thy types funs pfuns ids e;
897 val T = mk_type thy ty;
898 val T' = mk_type thy ty';
899 val _ = T = T' orelse
900 error ("Declared type " ^ ty ^ " of " ^ s ^
901 "\ndoes not match type " ^ ty' ^ " in definition");
902 val id' = mk_rulename id;
903 val lthy = Named_Target.theory_init thy;
904 val ((t', (_, th)), lthy') = Specification.definition
905 (NONE, ((id', []), HOLogic.mk_Trueprop (HOLogic.mk_eq
906 (Free (s, T), t)))) lthy;
907 val phi = Proof_Context.export_morphism lthy' lthy
909 ((id', Morphism.thm phi th),
910 ((Symtab.update (s, (Morphism.term phi t', ty)) tab,
911 Name.declare s ctxt),
912 Local_Theory.exit_global lthy'))
914 | NONE => error ("Undeclared constant " ^ s));
916 fun add_var (s, ty) (ids, thy) =
917 let val ([Free p], ids') = mk_variables thy [s] ty ids
918 in (p, (ids', thy)) end;
920 fun add_init_vars vcs (ids_thy as ((tab, _), _)) =
923 (fn s => case try (unsuffix "~") s of
924 SOME s' => (case Symtab.lookup tab s' of
925 SOME (_, ty) => SOME (s, ty)
926 | NONE => error ("Undeclared identifier " ^ s'))
928 (fold_vcs (add_expr_idents o snd) vcs []))
931 fun is_trivial_vc ([], [(_, Ident "true")]) = true
932 | is_trivial_vc _ = false;
934 fun rulenames rules = commas
935 (map (fn ((s, i), _) => s ^ "(" ^ string_of_int i ^ ")") rules);
937 (* sort definitions according to their dependency *)
938 fun sort_defs _ _ [] sdefs = rev sdefs
939 | sort_defs pfuns consts defs sdefs =
940 (case find_first (fn (_, (_, e)) =>
941 forall (Symtab.defined pfuns) (add_expr_pfuns e []) andalso
943 member (fn (s, (_, (s', _))) => s = s') sdefs id orelse
945 (add_expr_idents e [])) defs of
946 SOME d => sort_defs pfuns consts
947 (remove (op =) d defs) (d :: sdefs)
948 | NONE => error ("Bad definitions: " ^ rulenames defs));
950 fun set_vcs ({types, vars, consts, funs} : decls)
951 (rules, _) ((_, ident), vcs) path thy =
953 val {pfuns, ...} = VCs.get thy;
954 val (defs, rules') = partition_opt dest_def rules;
956 subtract (fn ((_, (s, _)), (s', _)) => s = s') defs (items consts);
957 (* ignore all complex rules in rls files *)
958 val (rules'', other_rules) =
959 List.partition (complex_rule o snd) rules';
960 val _ = if null rules'' then ()
961 else warning ("Ignoring rules: " ^ rulenames rules'');
963 val vcs' = VCtab.make (maps (fn (tr, vcs) =>
964 map (fn (s, (ps, cs)) => (s, (tr, NONE, ps, cs)))
965 (filter_out (is_trivial_vc o snd) vcs)) vcs);
967 val _ = (case filter_out (is_some o lookup funs)
968 (pfuns_of_vcs pfuns vcs') of
970 | fs => error ("Undeclared proof function(s) " ^ commas fs));
972 val (((defs', vars''), ivars), (ids, thy')) =
974 Symtab.update ("false", (HOLogic.false_const, booleanN)) |>
975 Symtab.update ("true", (HOLogic.true_const, booleanN)),
977 thy |> Sign.add_path (Long_Name.base_name ident)) |>
978 fold add_type_def (items types) |>
979 fold (snd oo add_const) consts' |> (fn ids_thy as ((tab, _), _) =>
981 fold_map (add_def types funs pfuns consts)
982 (sort_defs pfuns (Symtab.defined tab) defs []) ||>>
983 fold_map add_var (items vars) ||>>
987 [Element.Fixes (map (fn (s, T) =>
988 (Binding.name s, SOME T, NoSyn)) (vars'' @ ivars)),
989 Element.Assumes (map (fn (id, rl) =>
990 ((mk_rulename id, []),
991 [(term_of_rule thy' types funs pfuns ids rl, [])]))
993 Element.Notes (Thm.definitionK,
994 [((Binding.name "defns", []), map (rpair [] o single o snd) defs')])]
997 set_env {ctxt = ctxt, defs = defs', types = types, funs = funs,
998 ids = ids, proving = false, vcs = vcs', path = path} thy'