1 (* Title: HOL/SPARK/Tools/spark_vcs.ML
2 Author: Stefan Berghofer
3 Copyright: secunet Security Networks AG
5 Store for verification conditions generated by SPARK/Ada.
10 val set_vcs: Fdl_Parser.decls -> Fdl_Parser.rules ->
11 (string * string) * Fdl_Parser.vcs -> Path.T -> string -> theory -> theory
12 val add_proof_fun: (typ option -> 'a -> term) ->
13 string * ((string list * string) option * 'a) ->
15 val add_type: string * (typ * (string * string) list) -> theory -> theory
16 val lookup_vc: theory -> bool -> string -> (Element.context_i list *
17 (string * thm list option * Element.context_i * Element.statement_i)) option
18 val get_vcs: theory -> bool ->
19 Element.context_i list * (binding * thm) list * (string *
20 (string * thm list option * Element.context_i * Element.statement_i)) list
21 val mark_proved: string -> thm list -> theory -> theory
22 val close: bool -> theory -> theory
23 val is_closed: theory -> bool
26 structure SPARK_VCs: SPARK_VCS =
34 fun err_unfinished () = error "An unfinished SPARK environment is still open."
36 val strip_number = pairself implode o take_suffix Fdl_Lexer.is_digit o raw_explode;
38 val name_ord = prod_ord string_ord (option_ord int_ord) o
39 pairself (strip_number ##> Int.fromString);
41 structure VCtab = Table(type key = string val ord = name_ord);
43 structure VCs = Theory_Data
46 {pfuns: ((string list * string) option * term) Symtab.table,
47 type_map: (typ * (string * string) list) Symtab.table,
49 {ctxt: Element.context_i list,
50 defs: (binding * thm) list,
52 funs: (string list * string) tab,
53 pfuns: ((string list * string) option * term) Symtab.table,
54 ids: (term * string) Symtab.table * Name.context,
56 vcs: (string * thm list option *
57 (string * expr) list * (string * expr) list) VCtab.table,
59 prefix: string} option}
60 val empty : T = {pfuns = Symtab.empty, type_map = Symtab.empty, env = NONE}
62 fun merge ({pfuns = pfuns1, type_map = type_map1, env = NONE},
63 {pfuns = pfuns2, type_map = type_map2, env = NONE}) =
64 {pfuns = Symtab.merge (eq_pair (op =) (op aconv)) (pfuns1, pfuns2),
65 type_map = Symtab.merge (op =) (type_map1, type_map2),
67 | merge _ = err_unfinished ()
73 val to_lower = raw_explode #> map Symbol.to_ascii_lower #> implode;
75 val lcase_eq = (op =) o pairself (to_lower o Long_Name.base_name);
77 fun lookup_prfx "" tab s = Symtab.lookup tab s
78 | lookup_prfx prfx tab s = (case Symtab.lookup tab s of
79 NONE => Symtab.lookup tab (prfx ^ "__" ^ s)
84 fun strip ys [] = ("", implode ys)
85 | strip ys ("_" :: "_" :: xs) = (implode (rev xs), implode ys)
86 | strip ys (x :: xs) = strip (x :: ys) xs
87 in strip [] (rev (raw_explode s)) end;
89 fun unprefix_pfun "" s = s
90 | unprefix_pfun prfx s =
91 let val (prfx', s') = strip_prfx s
92 in if prfx = prfx' then s' else s end;
95 let val T = fastype_of t
96 in Const (s, T --> T) $ t end;
100 val setT = fastype_of t;
101 val T = HOLogic.dest_setT setT;
102 val U = HOLogic.dest_setT (fastype_of u)
104 Const (@{const_name Sigma}, setT --> (T --> HOLogic.mk_setT U) -->
105 HOLogic.mk_setT (HOLogic.mk_prodT (T, U))) $ t $ Abs ("", T, u)
108 fun get_type thy prfx ty =
109 let val {type_map, ...} = VCs.get thy
110 in lookup_prfx prfx type_map ty end;
112 fun mk_type' _ _ "integer" = (HOLogic.intT, [])
113 | mk_type' _ _ "boolean" = (HOLogic.boolT, [])
114 | mk_type' thy prfx ty =
115 (case get_type thy prfx ty of
117 (Syntax.check_typ (Proof_Context.init_global thy)
118 (Type (Sign.full_name thy (Binding.name ty), [])),
122 fun mk_type thy prfx ty = fst (mk_type' thy prfx ty);
124 val booleanN = "boolean";
125 val integerN = "integer";
127 fun define_overloaded (def_name, eq) lthy =
129 val ((c, _), rhs) = eq |> Syntax.check_term lthy |>
130 Logic.dest_equals |>> dest_Free;
131 val ((_, (_, thm)), lthy') = Local_Theory.define
132 ((Binding.name c, NoSyn), ((Binding.name def_name, []), rhs)) lthy
133 val ctxt_thy = Proof_Context.init_global (Proof_Context.theory_of lthy');
134 val thm' = singleton (Proof_Context.export lthy' ctxt_thy) thm
135 in (thm', lthy') end;
137 fun strip_underscores s =
138 strip_underscores (unsuffix "_" s) handle Fail _ => s;
141 unsuffix "~" s ^ "_init" handle Fail _ => s;
143 val mangle_name = strip_underscores #> strip_tilde;
145 fun mk_variables thy prfx xs ty (tab, ctxt) =
147 val T = mk_type thy prfx ty;
148 val (ys, ctxt') = fold_map Name.variant (map mangle_name xs) ctxt;
149 val zs = map (Free o rpair T) ys;
150 in (zs, (fold (Symtab.update o apsnd (rpair ty)) (xs ~~ zs) tab, ctxt')) end;
152 fun get_record_info thy T = (case Record.dest_recTs T of
153 [(tyname, [@{typ unit}])] =>
154 Record.get_info thy (Long_Name.qualifier tyname)
157 fun find_field [] fname fields =
158 find_first (curry lcase_eq fname o fst) fields
159 | find_field cmap fname fields =
160 (case AList.lookup (op =) cmap fname of
162 | SOME fname' => SOME (fname', the (AList.lookup (op =) fields fname')));
164 fun find_field' fname = get_first (fn (flds, fldty) =>
165 if member (op =) flds fname then SOME fldty else NONE);
167 fun assoc_ty_err thy T s msg =
168 error ("Type " ^ Syntax.string_of_typ_global thy T ^
169 " associated with SPARK type " ^ s ^ "\n" ^ msg);
172 (** generate properties of enumeration types **)
174 fun add_enum_type tyname tyname' thy =
176 val {case_name, ...} = the (Datatype.get_info thy tyname');
177 val cs = map Const (the (Datatype.get_constrs thy tyname'));
179 val T = Type (tyname', []);
180 val p = Const (@{const_name pos}, T --> HOLogic.intT);
181 val v = Const (@{const_name val}, HOLogic.intT --> T);
182 val card = Const (@{const_name card},
183 HOLogic.mk_setT T --> HOLogic.natT) $ HOLogic.mk_UNIV T;
185 fun mk_binrel_def s f = Logic.mk_equals
186 (Const (s, T --> T --> HOLogic.boolT),
187 Abs ("x", T, Abs ("y", T,
188 Const (s, HOLogic.intT --> HOLogic.intT --> HOLogic.boolT) $
189 (f $ Bound 1) $ (f $ Bound 0))));
191 val (((def1, def2), def3), lthy) = thy |>
193 Class.instantiation ([tyname'], [], @{sort spark_enum}) |>
195 define_overloaded ("pos_" ^ tyname ^ "_def", Logic.mk_equals
197 list_comb (Const (case_name, replicate k HOLogic.intT @
198 [T] ---> HOLogic.intT),
199 map (HOLogic.mk_number HOLogic.intT) (0 upto k - 1)))) ||>>
201 define_overloaded ("less_eq_" ^ tyname ^ "_def",
202 mk_binrel_def @{const_name less_eq} p) ||>>
203 define_overloaded ("less_" ^ tyname ^ "_def",
204 mk_binrel_def @{const_name less} p);
206 val UNIV_eq = Goal.prove lthy [] []
207 (HOLogic.mk_Trueprop (HOLogic.mk_eq
208 (HOLogic.mk_UNIV T, HOLogic.mk_set T cs)))
210 rtac @{thm subset_antisym} 1 THEN
211 rtac @{thm subsetI} 1 THEN
212 Datatype_Aux.exh_tac (K (#exhaust (Datatype.the_info
213 (Proof_Context.theory_of lthy) tyname'))) 1 THEN
214 ALLGOALS (asm_full_simp_tac (simpset_of lthy)));
216 val finite_UNIV = Goal.prove lthy [] []
217 (HOLogic.mk_Trueprop (Const (@{const_name finite},
218 HOLogic.mk_setT T --> HOLogic.boolT) $ HOLogic.mk_UNIV T))
219 (fn _ => simp_tac (simpset_of lthy addsimps [UNIV_eq]) 1);
221 val card_UNIV = Goal.prove lthy [] []
222 (HOLogic.mk_Trueprop (HOLogic.mk_eq
223 (card, HOLogic.mk_number HOLogic.natT k)))
224 (fn _ => simp_tac (simpset_of lthy addsimps [UNIV_eq]) 1);
226 val range_pos = Goal.prove lthy [] []
227 (HOLogic.mk_Trueprop (HOLogic.mk_eq
228 (Const (@{const_name image}, (T --> HOLogic.intT) -->
229 HOLogic.mk_setT T --> HOLogic.mk_setT HOLogic.intT) $
230 p $ HOLogic.mk_UNIV T,
231 Const (@{const_name atLeastLessThan}, HOLogic.intT -->
232 HOLogic.intT --> HOLogic.mk_setT HOLogic.intT) $
233 HOLogic.mk_number HOLogic.intT 0 $
234 (@{term int} $ card))))
236 simp_tac (simpset_of lthy addsimps [card_UNIV]) 1 THEN
237 simp_tac (simpset_of lthy addsimps [UNIV_eq, def1]) 1 THEN
238 rtac @{thm subset_antisym} 1 THEN
239 simp_tac (simpset_of lthy) 1 THEN
240 rtac @{thm subsetI} 1 THEN
241 asm_full_simp_tac (simpset_of lthy addsimps @{thms interval_expand}
242 delsimps @{thms atLeastLessThan_iff}) 1);
245 Class.prove_instantiation_instance (fn _ =>
246 Class.intro_classes_tac [] THEN
247 rtac finite_UNIV 1 THEN
248 rtac range_pos 1 THEN
249 simp_tac (HOL_basic_ss addsimps [def3]) 1 THEN
250 simp_tac (HOL_basic_ss addsimps [def2]) 1) lthy;
252 val (pos_eqs, val_eqs) = split_list (map_index (fn (i, c) =>
254 val n = HOLogic.mk_number HOLogic.intT i;
255 val th = Goal.prove lthy' [] []
256 (HOLogic.mk_Trueprop (HOLogic.mk_eq (p $ c, n)))
257 (fn _ => simp_tac (simpset_of lthy' addsimps [def1]) 1);
258 val th' = Goal.prove lthy' [] []
259 (HOLogic.mk_Trueprop (HOLogic.mk_eq (v $ n, c)))
261 rtac (@{thm inj_pos} RS @{thm injD}) 1 THEN
262 simp_tac (simpset_of lthy' addsimps
263 [@{thm pos_val}, range_pos, card_UNIV, th]) 1)
264 in (th, th') end) cs);
266 val first_el = Goal.prove lthy' [] []
267 (HOLogic.mk_Trueprop (HOLogic.mk_eq
268 (Const (@{const_name first_el}, T), hd cs)))
269 (fn _ => simp_tac (simpset_of lthy' addsimps
270 [@{thm first_el_def}, hd val_eqs]) 1);
272 val last_el = Goal.prove lthy' [] []
273 (HOLogic.mk_Trueprop (HOLogic.mk_eq
274 (Const (@{const_name last_el}, T), List.last cs)))
275 (fn _ => simp_tac (simpset_of lthy' addsimps
276 [@{thm last_el_def}, List.last val_eqs, card_UNIV]) 1);
280 ((Binding.name (tyname ^ "_card"), @{attributes [simp]}), [card_UNIV]) ||>>
282 ((Binding.name (tyname ^ "_pos"), @{attributes [simp]}), pos_eqs) ||>>
284 ((Binding.name (tyname ^ "_val"), @{attributes [simp]}), val_eqs) ||>>
286 ((Binding.name (tyname ^ "_first_el"), @{attributes [simp]}), [first_el]) ||>>
288 ((Binding.name (tyname ^ "_last_el"), @{attributes [simp]}), [last_el]) |> snd |>
289 Local_Theory.exit_global
293 fun check_no_assoc thy prfx s = case get_type thy prfx s of
295 | SOME _ => error ("Cannot associate a type with " ^ s ^
296 "\nsince it is no record or enumeration type");
298 fun check_enum [] [] = NONE
299 | check_enum els [] = SOME ("has no element(s) " ^ commas els)
300 | check_enum [] cs = SOME ("has extra element(s) " ^
301 commas (map (Long_Name.base_name o fst) cs))
302 | check_enum (el :: els) ((cname, _) :: cs) =
303 if lcase_eq (el, cname) then check_enum els cs
304 else SOME ("either has no element " ^ el ^
305 " or it is at the wrong position");
307 fun invert_map [] = I
309 map (apfst (the o AList.lookup (op =) (map swap cmap)));
311 fun add_type_def prfx (s, Basic_Type ty) (ids, thy) =
312 (check_no_assoc thy prfx s;
314 Typedecl.abbrev_global (Binding.name s, [], NoSyn)
315 (mk_type thy prfx ty) thy |> snd))
317 | add_type_def prfx (s, Enum_Type els) ((tab, ctxt), thy) =
319 val (thy', tyname) = (case get_type thy prfx s of
322 val tyb = Binding.name s;
323 val tyname = Sign.full_name thy tyb
326 Datatype.add_datatype {strict = true, quiet = true}
328 map (fn s => (Binding.name s, [], NoSyn)) els)] |> snd |>
329 add_enum_type s tyname,
332 | SOME (T as Type (tyname, []), cmap) =>
333 (case Datatype.get_constrs thy tyname of
334 NONE => assoc_ty_err thy T s "is not a datatype"
336 let val (prfx', _) = strip_prfx s
338 case check_enum (map (unprefix_pfun prfx') els)
339 (invert_map cmap cs) of
340 NONE => (thy, tyname)
341 | SOME msg => assoc_ty_err thy T s msg
343 | SOME (T, _) => assoc_ty_err thy T s "is not a datatype");
344 val cs = map Const (the (Datatype.get_constrs thy' tyname));
346 ((fold (Symtab.update_new o apsnd (rpair s)) (els ~~ cs) tab,
347 fold Name.declare els ctxt),
351 | add_type_def prfx (s, Array_Type (argtys, resty)) (ids, thy) =
352 (check_no_assoc thy prfx s;
354 Typedecl.abbrev_global (Binding.name s, [], NoSyn)
355 (foldr1 HOLogic.mk_prodT (map (mk_type thy prfx) argtys) -->
356 mk_type thy prfx resty) thy |> snd))
358 | add_type_def prfx (s, Record_Type fldtys) (ids, thy) =
360 let val fldTs = maps (fn (flds, ty) =>
361 map (rpair (mk_type thy prfx ty)) flds) fldtys
362 in case get_type thy prfx s of
364 Record.add_record ([], Binding.name s) NONE
365 (map (fn (fld, T) => (Binding.name fld, T, NoSyn)) fldTs) thy
367 (case get_record_info thy rT of
368 NONE => assoc_ty_err thy rT s "is not a record type"
369 | SOME {fields, ...} =>
370 let val fields' = invert_map cmap fields
372 (case subtract (lcase_eq o pairself fst) fldTs fields' of
374 | flds => assoc_ty_err thy rT s ("has extra field(s) " ^
375 commas (map (Long_Name.base_name o fst) flds));
377 case AList.lookup lcase_eq fields' fld of
378 NONE => assoc_ty_err thy rT s ("has no field " ^ fld)
379 | SOME U => T = U orelse assoc_ty_err thy rT s
381 fld ^ " whose type\n" ^
382 Syntax.string_of_typ_global thy U ^
383 "\ndoes not match declared type\n" ^
384 Syntax.string_of_typ_global thy T)) fldTs;
389 | add_type_def prfx (s, Pending_Type) (ids, thy) =
391 case get_type thy prfx s of
393 | NONE => Typedecl.typedecl_global
394 (Binding.name s, [], NoSyn) thy |> snd);
397 fun term_of_expr thy prfx types pfuns =
399 fun tm_of vs (Funct ("->", [e, e'])) =
400 (HOLogic.mk_imp (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
402 | tm_of vs (Funct ("<->", [e, e'])) =
403 (HOLogic.mk_eq (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
405 | tm_of vs (Funct ("or", [e, e'])) =
406 (HOLogic.mk_disj (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
408 | tm_of vs (Funct ("and", [e, e'])) =
409 (HOLogic.mk_conj (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
411 | tm_of vs (Funct ("not", [e])) =
412 (HOLogic.mk_not (fst (tm_of vs e)), booleanN)
414 | tm_of vs (Funct ("=", [e, e'])) =
415 (HOLogic.mk_eq (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
417 | tm_of vs (Funct ("<>", [e, e'])) = (HOLogic.mk_not
418 (HOLogic.mk_eq (fst (tm_of vs e), fst (tm_of vs e'))), booleanN)
420 | tm_of vs (Funct ("<", [e, e'])) = (HOLogic.mk_binrel @{const_name less}
421 (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
423 | tm_of vs (Funct (">", [e, e'])) = (HOLogic.mk_binrel @{const_name less}
424 (fst (tm_of vs e'), fst (tm_of vs e)), booleanN)
426 | tm_of vs (Funct ("<=", [e, e'])) = (HOLogic.mk_binrel @{const_name less_eq}
427 (fst (tm_of vs e), fst (tm_of vs e')), booleanN)
429 | tm_of vs (Funct (">=", [e, e'])) = (HOLogic.mk_binrel @{const_name less_eq}
430 (fst (tm_of vs e'), fst (tm_of vs e)), booleanN)
432 | tm_of vs (Funct ("+", [e, e'])) = (HOLogic.mk_binop @{const_name plus}
433 (fst (tm_of vs e), fst (tm_of vs e')), integerN)
435 | tm_of vs (Funct ("-", [e, e'])) = (HOLogic.mk_binop @{const_name minus}
436 (fst (tm_of vs e), fst (tm_of vs e')), integerN)
438 | tm_of vs (Funct ("*", [e, e'])) = (HOLogic.mk_binop @{const_name times}
439 (fst (tm_of vs e), fst (tm_of vs e')), integerN)
441 | tm_of vs (Funct ("/", [e, e'])) = (HOLogic.mk_binop @{const_name divide}
442 (fst (tm_of vs e), fst (tm_of vs e')), integerN)
444 | tm_of vs (Funct ("div", [e, e'])) = (HOLogic.mk_binop @{const_name sdiv}
445 (fst (tm_of vs e), fst (tm_of vs e')), integerN)
447 | tm_of vs (Funct ("mod", [e, e'])) = (HOLogic.mk_binop @{const_name mod}
448 (fst (tm_of vs e), fst (tm_of vs e')), integerN)
450 | tm_of vs (Funct ("-", [e])) =
451 (mk_unop @{const_name uminus} (fst (tm_of vs e)), integerN)
453 | tm_of vs (Funct ("**", [e, e'])) =
454 (Const (@{const_name power}, HOLogic.intT --> HOLogic.natT -->
455 HOLogic.intT) $ fst (tm_of vs e) $
456 (@{const nat} $ fst (tm_of vs e')), integerN)
458 | tm_of (tab, _) (Ident s) =
459 (case Symtab.lookup tab s of
461 | NONE => (case lookup_prfx prfx pfuns s of
462 SOME (SOME ([], resty), t) => (t, resty)
463 | _ => error ("Undeclared identifier " ^ s)))
465 | tm_of _ (Number i) = (HOLogic.mk_number HOLogic.intT i, integerN)
467 | tm_of vs (Quantifier (s, xs, ty, e)) =
469 val (ys, vs') = mk_variables thy prfx xs ty vs;
471 "for_all" => HOLogic.mk_all
472 | "for_some" => HOLogic.mk_exists)
474 (fold_rev (fn Free (x, T) => fn t => q (x, T, t))
475 ys (fst (tm_of vs' e)),
479 | tm_of vs (Funct (s, es)) =
481 (* record field selection *)
482 (case try (unprefix "fld_") s of
483 SOME fname => (case es of
486 val (t, rcdty) = tm_of vs e;
487 val (rT, cmap) = mk_type' thy prfx rcdty
488 in case (get_record_info thy rT, lookup types rcdty) of
489 (SOME {fields, ...}, SOME (Record_Type fldtys)) =>
490 (case (find_field cmap fname fields,
491 find_field' fname fldtys) of
492 (SOME (fname', fT), SOME fldty) =>
493 (Const (fname', rT --> fT) $ t, fldty)
494 | _ => error ("Record " ^ rcdty ^
495 " has no field named " ^ fname))
496 | _ => error (rcdty ^ " is not a record type")
498 | _ => error ("Function " ^ s ^ " expects one argument"))
501 (* record field update *)
502 (case try (unprefix "upf_") s of
503 SOME fname => (case es of
506 val (t, rcdty) = tm_of vs e;
507 val (rT, cmap) = mk_type' thy prfx rcdty;
508 val (u, fldty) = tm_of vs e';
509 val fT = mk_type thy prfx fldty
510 in case get_record_info thy rT of
511 SOME {fields, ...} =>
512 (case find_field cmap fname fields of
515 (Const (fname' ^ "_update",
516 (fT --> fT) --> rT --> rT) $
517 Abs ("x", fT, u) $ t,
519 else error ("Type\n" ^
520 Syntax.string_of_typ_global thy fT ^
521 "\ndoes not match type\n" ^
522 Syntax.string_of_typ_global thy fU ^
523 "\nof field " ^ fname)
524 | NONE => error ("Record " ^ rcdty ^
525 " has no field named " ^ fname))
526 | _ => error (rcdty ^ " is not a record type")
528 | _ => error ("Function " ^ s ^ " expects two arguments"))
531 (* enumeration type to integer *)
532 (case try (unsuffix "__pos") s of
533 SOME tyname => (case es of
534 [e] => (Const (@{const_name pos},
535 mk_type thy prfx tyname --> HOLogic.intT) $ fst (tm_of vs e),
537 | _ => error ("Function " ^ s ^ " expects one argument"))
540 (* integer to enumeration type *)
541 (case try (unsuffix "__val") s of
542 SOME tyname => (case es of
543 [e] => (Const (@{const_name val},
544 HOLogic.intT --> mk_type thy prfx tyname) $ fst (tm_of vs e),
546 | _ => error ("Function " ^ s ^ " expects one argument"))
549 (* successor / predecessor of enumeration type element *)
550 if s = "succ" orelse s = "pred" then (case es of
553 val (t, tyname) = tm_of vs e;
554 val T = mk_type thy prfx tyname
556 (if s = "succ" then @{const_name succ}
557 else @{const_name pred}, T --> T) $ t, tyname)
559 | _ => error ("Function " ^ s ^ " expects one argument"))
561 (* user-defined proof function *)
563 (case lookup_prfx prfx pfuns s of
564 SOME (SOME (_, resty), t) =>
565 (list_comb (t, map (fst o tm_of vs) es), resty)
566 | _ => error ("Undeclared proof function " ^ s))))))
568 | tm_of vs (Element (e, es)) =
569 let val (t, ty) = tm_of vs e
570 in case lookup types ty of
571 SOME (Array_Type (_, elty)) =>
572 (t $ foldr1 HOLogic.mk_prod (map (fst o tm_of vs) es), elty)
573 | _ => error (ty ^ " is not an array type")
576 | tm_of vs (Update (e, es, e')) =
577 let val (t, ty) = tm_of vs e
578 in case lookup types ty of
579 SOME (Array_Type (idxtys, elty)) =>
581 val T = foldr1 HOLogic.mk_prodT
582 (map (mk_type thy prfx) idxtys);
583 val U = mk_type thy prfx elty;
586 (Const (@{const_name fun_upd}, fT --> T --> U --> fT) $
587 t $ foldr1 HOLogic.mk_prod (map (fst o tm_of vs) es) $
591 | _ => error (ty ^ " is not an array type")
594 | tm_of vs (Record (s, flds)) =
596 val (T, cmap) = mk_type' thy prfx s;
597 val {extension = (ext_name, _), fields, ...} =
598 (case get_record_info thy T of
599 NONE => error (s ^ " is not a record type")
600 | SOME info => info);
601 val flds' = map (apsnd (tm_of vs)) flds;
602 val fnames = fields |> invert_map cmap |>
603 map (Long_Name.base_name o fst);
604 val fnames' = map fst flds;
605 val (fvals, ftys) = split_list (map (fn s' =>
606 case AList.lookup lcase_eq flds' s' of
607 SOME fval_ty => fval_ty
608 | NONE => error ("Field " ^ s' ^ " missing in record " ^ s))
610 val _ = (case subtract lcase_eq fnames fnames' of
612 | xs => error ("Extra field(s) " ^ commas xs ^
614 val _ = (case duplicates (op =) fnames' of
616 | xs => error ("Duplicate field(s) " ^ commas xs ^
621 map (mk_type thy prfx) ftys @ [HOLogic.unitT] ---> T),
622 fvals @ [HOLogic.unit]),
626 | tm_of vs (Array (s, default, assocs)) =
627 (case lookup types s of
628 SOME (Array_Type (idxtys, elty)) =>
630 val Ts = map (mk_type thy prfx) idxtys;
631 val T = foldr1 HOLogic.mk_prodT Ts;
632 val U = mk_type thy prfx elty;
633 fun mk_idx' T (e, NONE) = HOLogic.mk_set T [fst (tm_of vs e)]
634 | mk_idx' T (e, SOME e') = Const (@{const_name atLeastAtMost},
635 T --> T --> HOLogic.mk_setT T) $
636 fst (tm_of vs e) $ fst (tm_of vs e');
638 if length Ts <> length idx then
639 error ("Arity mismatch in construction of array " ^ s)
640 else foldr1 mk_times (map2 mk_idx' Ts idx);
641 fun mk_upd (idxs, e) t =
642 if length idxs = 1 andalso forall (is_none o snd) (hd idxs)
644 Const (@{const_name fun_upd}, (T --> U) -->
645 T --> U --> T --> U) $ t $
646 foldl1 HOLogic.mk_prod
647 (map (fst o tm_of vs o fst) (hd idxs)) $
650 Const (@{const_name fun_upds}, (T --> U) -->
651 HOLogic.mk_setT T --> U --> T --> U) $ t $
652 foldl1 (HOLogic.mk_binop @{const_name sup})
658 SOME e => Abs ("x", T, fst (tm_of vs e))
659 | NONE => Const (@{const_name undefined}, T --> U)),
662 | _ => error (s ^ " is not an array type"))
667 fun term_of_rule thy prfx types pfuns ids rule =
668 let val tm_of = fst o term_of_expr thy prfx types pfuns ids
670 Inference_Rule (es, e) => Logic.list_implies
671 (map (HOLogic.mk_Trueprop o tm_of) es, HOLogic.mk_Trueprop (tm_of e))
672 | Substitution_Rule (es, e, e') => Logic.list_implies
673 (map (HOLogic.mk_Trueprop o tm_of) es,
674 HOLogic.mk_Trueprop (HOLogic.mk_eq (tm_of e, tm_of e')))
678 val builtin = Symtab.make (map (rpair ())
679 ["->", "<->", "or", "and", "not", "=", "<>", "<", ">", "<=", ">=",
680 "+", "-", "*", "/", "div", "mod", "**"]);
682 fun complex_expr (Number _) = false
683 | complex_expr (Ident _) = false
684 | complex_expr (Funct (s, es)) =
685 not (Symtab.defined builtin s) orelse exists complex_expr es
686 | complex_expr (Quantifier (_, _, _, e)) = complex_expr e
687 | complex_expr _ = true;
689 fun complex_rule (Inference_Rule (es, e)) =
690 complex_expr e orelse exists complex_expr es
691 | complex_rule (Substitution_Rule (es, e, e')) =
692 complex_expr e orelse complex_expr e' orelse
693 exists complex_expr es;
696 Symtab.defined builtin orf
697 can (unprefix "fld_") orf can (unprefix "upf_") orf
698 can (unsuffix "__pos") orf can (unsuffix "__val") orf
699 equal "succ" orf equal "pred";
701 fun fold_opt f = the_default I o Option.map f;
702 fun fold_pair f g (x, y) = f x #> g y;
704 fun fold_expr f g (Funct (s, es)) = f s #> fold (fold_expr f g) es
705 | fold_expr f g (Ident s) = g s
706 | fold_expr f g (Number _) = I
707 | fold_expr f g (Quantifier (_, _, _, e)) = fold_expr f g e
708 | fold_expr f g (Element (e, es)) =
709 fold_expr f g e #> fold (fold_expr f g) es
710 | fold_expr f g (Update (e, es, e')) =
711 fold_expr f g e #> fold (fold_expr f g) es #> fold_expr f g e'
712 | fold_expr f g (Record (_, flds)) = fold (fold_expr f g o snd) flds
713 | fold_expr f g (Array (_, default, assocs)) =
714 fold_opt (fold_expr f g) default #>
716 (fold (fold (fold_pair
717 (fold_expr f g) (fold_opt (fold_expr f g)))))
718 (fold_expr f g)) assocs;
720 fun add_expr_pfuns funs = fold_expr
721 (fn s => if is_pfun s then I else insert (op =) s)
722 (fn s => if is_none (lookup funs s) then I else insert (op =) s);
724 val add_expr_idents = fold_expr (K I) (insert (op =));
726 fun pfun_type thy prfx (argtys, resty) =
727 map (mk_type thy prfx) argtys ---> mk_type thy prfx resty;
729 fun check_pfun_type thy prfx s t optty1 optty2 =
731 val T = fastype_of t;
733 let val U = pfun_type thy prfx ty
737 Syntax.string_of_typ_global thy T ^
739 Syntax.string_of_term_global thy t ^
740 " associated with proof function " ^ s ^
741 "\ndoes not match declared type\n" ^
742 Syntax.string_of_typ_global thy U)
744 in (Option.map check optty1; Option.map check optty2; ()) end;
746 fun upd_option x y = if is_some x then x else y;
748 fun check_pfuns_types thy prfx funs =
749 Symtab.map (fn s => fn (optty, t) =>
750 let val optty' = lookup funs (unprefix_pfun prfx s)
752 (check_pfun_type thy prfx s t optty optty';
753 (NONE |> upd_option optty |> upd_option optty', t))
759 fun pp_vcs msg vcs = Pretty.big_list msg (map (Pretty.str o fst) vcs);
761 fun pp_open_vcs [] = Pretty.str "All verification conditions have been proved."
762 | pp_open_vcs vcs = pp_vcs
763 "The following verification conditions remain to be proved:" vcs;
765 fun partition_vcs vcs = VCtab.fold_rev
766 (fn (name, (trace, SOME thms, ps, cs)) =>
767 apfst (cons (name, (trace, thms, ps, cs)))
768 | (name, (trace, NONE, ps, cs)) =>
769 apsnd (cons (name, (trace, ps, cs))))
772 fun insert_break prt = Pretty.blk (0, [Pretty.fbrk, prt]);
774 fun print_open_vcs f vcs =
775 (Pretty.writeln (f (pp_open_vcs (snd (partition_vcs vcs)))); vcs);
777 fun set_env ctxt defs types funs ids vcs path prefix thy = VCs.map (fn
778 {pfuns, type_map, env = NONE} =>
782 {ctxt = ctxt, defs = defs, types = types, funs = funs,
783 pfuns = check_pfuns_types thy prefix funs pfuns,
784 ids = ids, proving = false, vcs = print_open_vcs I vcs, path = path,
786 | _ => err_unfinished ()) thy;
788 fun mk_pat s = (case Int.fromString s of
789 SOME i => [HOLogic.mk_Trueprop (Var (("C", i), HOLogic.boolT))]
790 | NONE => error ("Bad conclusion identifier: C" ^ s));
792 fun mk_vc thy prfx types pfuns ids name_concl (tr, proved, ps, cs) =
794 HOLogic.mk_Trueprop o fst o term_of_expr thy prfx types pfuns ids
797 Element.Assumes (map (fn (s', e) =>
798 ((Binding.name ("H" ^ s'), []), [(prop_of e, [])])) ps),
799 Element.Shows (map (fn (s', e) =>
800 (if name_concl then (Binding.name ("C" ^ s'), [])
801 else Attrib.empty_binding,
802 [(prop_of e, mk_pat s')])) cs))
806 VCtab.fold (fn (_, (_, _, ps, cs)) => fold f ps #> fold f cs) vcs;
808 fun pfuns_of_vcs prfx funs pfuns vcs =
809 fold_vcs (add_expr_pfuns funs o snd) vcs [] |>
810 filter (is_none o lookup_prfx prfx pfuns);
812 fun declare_missing_pfuns thy prfx funs pfuns vcs (tab, ctxt) =
814 val (fs, (tys, Ts)) =
815 pfuns_of_vcs prfx funs pfuns vcs |>
816 map_filter (fn s => lookup funs s |>
817 Option.map (fn ty => (s, (SOME ty, pfun_type thy prfx ty)))) |>
818 split_list ||> split_list;
819 val (fs', ctxt') = fold_map Name.variant fs ctxt
821 (fold Symtab.update_new (fs ~~ (tys ~~ map Free (fs' ~~ Ts))) pfuns,
822 Element.Fixes (map2 (fn s => fn T =>
823 (Binding.name s, SOME T, NoSyn)) fs' Ts),
827 fun map_pfuns f {pfuns, type_map, env} =
828 {pfuns = f pfuns, type_map = type_map, env = env}
830 fun map_pfuns_env f {pfuns, type_map,
831 env = SOME {ctxt, defs, types, funs, pfuns = pfuns_env,
832 ids, proving, vcs, path, prefix}} =
833 if proving then err_unfinished ()
835 {pfuns = pfuns, type_map = type_map,
836 env = SOME {ctxt = ctxt, defs = defs, types = types, funs = funs,
837 pfuns = f pfuns_env, ids = ids, proving = false, vcs = vcs,
838 path = path, prefix = prefix}};
840 fun add_proof_fun prep (s, (optty, raw_t)) thy =
841 VCs.map (fn data as {env, ...} =>
843 val (optty', prfx, map_pf) = (case env of
844 SOME {funs, prefix, ...} =>
845 (lookup funs (unprefix_pfun prefix s),
846 prefix, map_pfuns_env)
847 | NONE => (NONE, "", map_pfuns));
848 val optty'' = NONE |> upd_option optty |> upd_option optty';
849 val t = prep (Option.map (pfun_type thy prfx) optty'') raw_t;
850 val _ = (case fold_aterms (fn u =>
851 if is_Var u orelse is_Free u then insert (op =) u else I) t [] of
853 | ts => error ("Term\n" ^ Syntax.string_of_term_global thy t ^
854 "\nto be associated with proof function " ^ s ^
855 " contains free variable(s) " ^
856 commas (map (Syntax.string_of_term_global thy) ts)));
858 (check_pfun_type thy prfx s t optty optty';
859 if is_some optty'' orelse is_none env then
860 map_pf (Symtab.update_new (s, (optty'', t))) data
861 handle Symtab.DUP _ => error ("Proof function " ^ s ^
862 " already associated with function")
863 else error ("Undeclared proof function " ^ s))
866 fun check_mapping _ _ [] _ = ()
867 | check_mapping err s cmap cs =
868 (case duplicates (op = o pairself fst) cmap of
869 [] => (case duplicates (op = o pairself snd) cmap of
870 [] => (case subtract (op = o apsnd snd) cs cmap of
871 [] => (case subtract (op = o apfst snd) cmap cs of
873 | zs => err ("has extra " ^ s ^ "(s) " ^ commas zs))
874 | zs => err ("does not have " ^ s ^ "(s) " ^
875 commas (map snd zs)))
876 | zs => error ("Several SPARK names are mapped to " ^
877 commas (map snd zs)))
878 | zs => error ("The SPARK names " ^ commas (map fst zs) ^
879 " are mapped to more than one name"));
881 fun add_type (s, (T as Type (tyname, Ts), cmap)) thy =
882 let val cmap' = map (apsnd (Sign.intern_const thy)) cmap
886 {env = SOME _, ...} => err_unfinished ()
887 | {pfuns, type_map, env} =>
889 type_map = Symtab.update_new (s, (T, cmap')) type_map,
891 handle Symtab.DUP _ => error ("SPARK type " ^ s ^
892 " already associated with type")) |>
894 case Datatype.get_constrs thy' tyname of
895 NONE => (case get_record_info thy' T of
897 | SOME {fields, ...} =>
898 (check_mapping (assoc_ty_err thy' T s) "field"
899 cmap' (map fst fields);
904 (fn (_, Type (_, [])) => ()
905 | (cname, _) => assoc_ty_err thy' T s
906 ("has illegal constructor " ^
907 Long_Name.base_name cname)) cs;
908 check_mapping (assoc_ty_err thy' T s) "constructor"
910 add_enum_type s tyname thy')
911 else assoc_ty_err thy' T s "is illegal")
913 | add_type (s, (T, _)) thy = assoc_ty_err thy T s "is illegal";
915 val is_closed = is_none o #env o VCs.get;
917 fun lookup_vc thy name_concl name =
919 {env = SOME {vcs, types, funs, pfuns, ids, ctxt, prefix, ...}, ...} =>
920 (case VCtab.lookup vcs name of
922 let val (pfuns', ctxt', ids') =
923 declare_missing_pfuns thy prefix funs pfuns vcs ids
925 SOME (ctxt @ [ctxt'],
926 mk_vc thy prefix types pfuns' ids' name_concl vc)
931 fun get_vcs thy name_concl = (case VCs.get thy of
932 {env = SOME {vcs, types, funs, pfuns, ids, ctxt, defs, prefix, ...}, ...} =>
933 let val (pfuns', ctxt', ids') =
934 declare_missing_pfuns thy prefix funs pfuns vcs ids
936 (ctxt @ [ctxt'], defs,
938 map (apsnd (mk_vc thy prefix types pfuns' ids' name_concl)))
940 | _ => ([], [], []));
942 fun mark_proved name thms = VCs.map (fn
944 env = SOME {ctxt, defs, types, funs, pfuns = pfuns_env,
945 ids, vcs, path, prefix, ...}} =>
948 env = SOME {ctxt = ctxt, defs = defs,
949 types = types, funs = funs, pfuns = pfuns_env,
952 vcs = print_open_vcs insert_break (VCtab.map_entry name
953 (fn (trace, _, ps, cs) => (trace, SOME thms, ps, cs)) vcs),
958 fun close incomplete thy =
961 {pfuns, type_map, env = SOME {vcs, path, ...}} =>
963 val (proved, unproved) = partition_vcs vcs;
964 val _ = Thm.join_proofs (maps (#2 o snd) proved);
965 val (proved', proved'') = List.partition (fn (_, (_, thms, _, _)) =>
966 exists (#oracle o Thm.status_of) thms) proved
968 (if null unproved then ()
969 else (if incomplete then warning else error)
970 (Pretty.string_of (pp_open_vcs unproved));
971 if null proved' then ()
972 else warning (Pretty.string_of (pp_vcs
973 "The following VCs are not marked as proved \
974 \because their proofs contain oracles:" proved'));
975 File.write (Path.ext "prv" path)
976 (implode (map (fn (s, _) => snd (strip_number s) ^
977 " -- proved by " ^ Distribution.version ^ "\n") proved''));
978 {pfuns = pfuns, type_map = type_map, env = NONE})
980 | _ => error "No SPARK environment is currently open") |>
984 (** set up verification conditions **)
986 fun partition_opt f =
988 fun part ys zs [] = (rev ys, rev zs)
989 | part ys zs (x :: xs) = (case f x of
990 SOME y => part (y :: ys) zs xs
991 | NONE => part ys (x :: zs) xs)
994 fun dest_def (id, (Substitution_Rule ([], Ident s, rhs))) = SOME (id, (s, rhs))
997 fun mk_rulename (s, i) = Binding.name (s ^ string_of_int i);
999 fun add_const prfx (s, ty) ((tab, ctxt), thy) =
1001 val T = mk_type thy prfx ty;
1002 val b = Binding.name s;
1003 val c = Const (Sign.full_name thy b, T)
1006 ((Symtab.update (s, (c, ty)) tab, Name.declare s ctxt),
1007 Sign.add_consts_i [(b, T, NoSyn)] thy))
1010 fun add_def prfx types pfuns consts (id, (s, e)) (ids as (tab, ctxt), thy) =
1011 (case lookup consts s of
1014 val (t, ty') = term_of_expr thy prfx types pfuns ids e;
1015 val T = mk_type thy prfx ty;
1016 val T' = mk_type thy prfx ty';
1017 val _ = T = T' orelse
1018 error ("Declared type " ^ ty ^ " of " ^ s ^
1019 "\ndoes not match type " ^ ty' ^ " in definition");
1020 val id' = mk_rulename id;
1021 val lthy = Named_Target.theory_init thy;
1022 val ((t', (_, th)), lthy') = Specification.definition
1023 (NONE, ((id', []), HOLogic.mk_Trueprop (HOLogic.mk_eq
1024 (Free (s, T), t)))) lthy;
1025 val phi = Proof_Context.export_morphism lthy' lthy
1027 ((id', Morphism.thm phi th),
1028 ((Symtab.update (s, (Morphism.term phi t', ty)) tab,
1029 Name.declare s ctxt),
1030 Local_Theory.exit_global lthy'))
1032 | NONE => error ("Undeclared constant " ^ s));
1034 fun add_var prfx (s, ty) (ids, thy) =
1035 let val ([Free p], ids') = mk_variables thy prfx [s] ty ids
1036 in (p, (ids', thy)) end;
1038 fun add_init_vars prfx vcs (ids_thy as ((tab, _), _)) =
1039 fold_map (add_var prfx)
1041 (fn s => case try (unsuffix "~") s of
1042 SOME s' => (case Symtab.lookup tab s' of
1043 SOME (_, ty) => SOME (s, ty)
1044 | NONE => error ("Undeclared identifier " ^ s'))
1046 (fold_vcs (add_expr_idents o snd) vcs []))
1049 fun is_trivial_vc ([], [(_, Ident "true")]) = true
1050 | is_trivial_vc _ = false;
1052 fun rulenames rules = commas
1053 (map (fn ((s, i), _) => s ^ "(" ^ string_of_int i ^ ")") rules);
1055 (* sort definitions according to their dependency *)
1056 fun sort_defs _ _ _ _ [] sdefs = rev sdefs
1057 | sort_defs prfx funs pfuns consts defs sdefs =
1058 (case find_first (fn (_, (_, e)) =>
1059 forall (is_some o lookup_prfx prfx pfuns)
1060 (add_expr_pfuns funs e []) andalso
1062 member (fn (s, (_, (s', _))) => s = s') sdefs id orelse
1064 (add_expr_idents e [])) defs of
1065 SOME d => sort_defs prfx funs pfuns consts
1066 (remove (op =) d defs) (d :: sdefs)
1067 | NONE => error ("Bad definitions: " ^ rulenames defs));
1069 fun set_vcs ({types, vars, consts, funs} : decls)
1070 (rules, _) ((_, ident), vcs) path prfx thy =
1072 val {pfuns, ...} = VCs.get thy;
1073 val (defs, rules') = partition_opt dest_def rules;
1075 subtract (fn ((_, (s, _)), (s', _)) => s = s') defs (items consts);
1076 (* ignore all complex rules in rls files *)
1077 val (rules'', other_rules) =
1078 List.partition (complex_rule o snd) rules';
1079 val _ = if null rules'' then ()
1080 else warning ("Ignoring rules: " ^ rulenames rules'');
1082 val vcs' = VCtab.make (maps (fn (tr, vcs) =>
1083 map (fn (s, (ps, cs)) => (s, (tr, NONE, ps, cs)))
1084 (filter_out (is_trivial_vc o snd) vcs)) vcs);
1086 val _ = (case filter_out (is_some o lookup funs)
1087 (pfuns_of_vcs prfx funs pfuns vcs') of
1089 | fs => error ("Undeclared proof function(s) " ^ commas fs));
1091 val (((defs', vars''), ivars), (ids, thy')) =
1093 Symtab.update ("false", (@{term False}, booleanN)) |>
1094 Symtab.update ("true", (@{term True}, booleanN)),
1096 thy |> Sign.add_path
1097 ((if prfx = "" then "" else prfx ^ "__") ^ Long_Name.base_name ident)) |>
1098 fold (add_type_def prfx) (items types) |>
1099 fold (snd oo add_const prfx) consts' |> (fn ids_thy as ((tab, _), _) =>
1101 fold_map (add_def prfx types pfuns consts)
1102 (sort_defs prfx funs pfuns (Symtab.defined tab) defs []) ||>>
1103 fold_map (add_var prfx) (items vars) ||>>
1104 add_init_vars prfx vcs');
1107 [Element.Fixes (map (fn (s, T) =>
1108 (Binding.name s, SOME T, NoSyn)) (vars'' @ ivars)),
1109 Element.Assumes (map (fn (id, rl) =>
1110 ((mk_rulename id, []),
1111 [(term_of_rule thy' prfx types pfuns ids rl, [])]))
1113 Element.Notes ("", [((Binding.name "defns", []), map (rpair [] o single o snd) defs')])]
1116 set_env ctxt defs' types funs ids vcs' path prfx thy'