sbv-12.2: Data/SBV/TP/Utils.hs
-----------------------------------------------------------------------------
-- |
-- Module : Data.SBV.TP.Utils
-- Copyright : (c) Levent Erkok
-- License : BSD3
-- Maintainer: erkokl@gmail.com
-- Stability : experimental
--
-- Various theorem-proving machinery.
-----------------------------------------------------------------------------
{-# LANGUAGE DataKinds #-}
{-# LANGUAGE DeriveAnyClass #-}
{-# LANGUAGE DeriveGeneric #-}
{-# LANGUAGE DerivingStrategies #-}
{-# LANGUAGE GeneralizedNewtypeDeriving #-}
{-# LANGUAGE NamedFieldPuns #-}
{-# LANGUAGE ScopedTypeVariables #-}
{-# LANGUAGE TupleSections #-}
{-# LANGUAGE TypeAbstractions #-}
{-# LANGUAGE TypeApplications #-}
{-# OPTIONS_GHC -Wall -Werror #-}
module Data.SBV.TP.Utils (
TP, runTP, runTPWith, Proof(..), ProofObj(..), assumptionFromProof, sorry, quickCheckProof
, startTP, finishTP, getTPState, getTPConfig, setTPConfig, tpGetNextUnique, TPState(..), TPStats(..), RootOfTrust(..)
, TPProofContext(..), message, updStats, rootOfTrust, concludeModulo
, ProofTree(..), TPUnique(..), showProofTree, showProofTreeHTML, shortProofName
, withProofCache
, tpQuiet, tpRibbon, tpAsms, tpStats, tpCache
) where
import Control.Monad.Reader (ReaderT, runReaderT, MonadReader, ask, liftIO)
import Control.Monad.Trans (MonadIO)
import Data.Time (NominalDiffTime)
import Data.Tree
import Data.Tree.View
import Data.Proxy
import Data.Typeable (typeOf, TypeRep)
import Data.Char (isSpace)
import Data.List (intercalate, isPrefixOf, isSuffixOf, isInfixOf, nubBy, partition, sort)
import Data.Int (Int64)
import Data.SBV.Utils.Lib (unQuote)
import System.IO (hFlush, stdout)
import System.Random (randomIO)
import Data.SBV.Core.Data (SBool, Forall(..), quantifiedBool)
import Data.SBV.Core.Model (label)
import Data.SBV.Core.Symbolic (SMTConfig, TPOptions(..))
import Data.SBV.Provers.Prover (defaultSMTCfg, SMTConfig(..))
import Data.SBV.Utils.TDiff (showTDiff, timeIf)
import Control.DeepSeq (NFData(rnf))
import Data.IORef
import GHC.Generics
import Data.Dynamic
import qualified Data.Map as Map
import Data.Map (Map)
-- | Various statistics we collect
data TPStats = TPStats { noOfCheckSats :: Int
, solverElapsed :: NominalDiffTime
, qcElapsed :: NominalDiffTime
}
-- | Extra state we carry in a TP context
data TPState = TPState { stats :: IORef TPStats
, proofCache :: IORef (Map (String, TypeRep) ProofObj)
, config :: IORef SMTConfig
}
-- | Monad for running TP proofs in.
newtype TP a = TP (ReaderT TPState IO a)
deriving newtype (Applicative, Functor, Monad, MonadIO, MonadReader TPState, MonadFail)
-- | If caches are enabled, see if we cached this proof and return it; otherwise generate it, cache it, and return it
withProofCache :: forall a. Typeable a => String -> TP (Proof a) -> TP (Proof a)
withProofCache nm genProof = do
TPState{proofCache, config} <- getTPState
cfg@SMTConfig {tpOptions = TPOptions {cacheProofs}} <- liftIO $ readIORef config
let key = (nm, typeOf (Proxy @a))
if not cacheProofs
then genProof
else do cache <- liftIO $ readIORef proofCache
case key `Map.lookup` cache of
Just prf -> do liftIO $ do tab <- startTP cfg False "Cached" 0 (TPProofOneShot nm [])
finishTP cfg "Q.E.D." (tab, Nothing) []
pure $ Proof prf{isCached = True}
Nothing -> do p <- genProof
liftIO $ modifyIORef' proofCache (Map.insert key (proofOf p))
pure p
-- | The context in which we make a check-sat call
data TPProofContext = TPProofOneShot String -- ^ A one shot proof, with string containing its name
[ProofObj] -- ^ Helpers used (latter only used for cex generation)
| TPProofStep Bool -- ^ A proof step. If Bool is true, then these are the assumptions for that step
String -- ^ Name of original goal
[String] -- ^ The helper "strings" given by the user
[String] -- ^ The step name, i.e., the name of the branch in the proof tree
-- | Run a TP proof, using the default configuration.
runTP :: TP a -> IO a
runTP = runTPWith defaultSMTCfg
-- | Run a TP proof, using the given configuration.
runTPWith :: SMTConfig -> TP a -> IO a
runTPWith cfg@SMTConfig{tpOptions = TPOptions{printStats}} (TP f) = do
rStats <- newIORef $ TPStats { noOfCheckSats = 0, solverElapsed = 0, qcElapsed = 0 }
rCache <- newIORef Map.empty
rCfg <- newIORef cfg
(mbT, r) <- timeIf printStats $ runReaderT f TPState {config = rCfg, stats = rStats, proofCache = rCache}
case mbT of
Nothing -> pure ()
Just t -> do TPStats noOfCheckSats solverTime qcElapsed <- readIORef rStats
let stats = [ ("SBV", showTDiff (t - solverTime - qcElapsed))
, ("Solver", showTDiff solverTime)
, ("QC", showTDiff qcElapsed)
, ("Total", showTDiff t)
, ("Decisions", show noOfCheckSats)
]
message cfg $ '[' : intercalate ", " [k ++ ": " ++ v | (k, v) <- stats] ++ "]\n"
pure r
-- | get the state
getTPState :: TP TPState
getTPState = ask
-- | Make a unique number in this TP run. We combine that context with the proof-count
tpGetNextUnique :: TP TPUnique
tpGetNextUnique = TPUser <$> liftIO randomIO
-- | get the configuration
getTPConfig :: TP SMTConfig
getTPConfig = do rCfg <- config <$> getTPState
liftIO (readIORef rCfg)
-- | set the configuration
setTPConfig :: SMTConfig -> TP ()
setTPConfig cfg = do st <- getTPState
liftIO (writeIORef (config st) cfg)
-- | Update stats
updStats :: MonadIO m => TPState -> (TPStats -> TPStats) -> m ()
updStats TPState{stats} u = liftIO $ modifyIORef' stats u
-- | Display the message if not quiet. Note that we don't print a newline; so the message must have it if needed.
message :: MonadIO m => SMTConfig -> String -> m ()
message SMTConfig{tpOptions = TPOptions{quiet}} s
| quiet = pure ()
| True = liftIO $ putStr s
-- | Start a proof. We return the number of characters we printed, so the finisher can align the result.
startTP :: SMTConfig -> Bool -> String -> Int -> TPProofContext -> IO Int
startTP cfg newLine what level ctx = do message cfg $ line ++ if newLine then "\n" else ""
hFlush stdout
return (length line)
where nm = case ctx of
TPProofOneShot n _ -> n
TPProofStep _ _ hs ss -> intercalate "." ss ++ userHints hs
tab = 2 * level
line = replicate tab ' ' ++ what ++ ": " ++ nm
userHints [] = ""
userHints ss = " (" ++ intercalate ", " ss ++ ")"
-- | Finish a proof. First argument is what we got from the call of 'startTP' above.
finishTP :: SMTConfig -> String -> (Int, Maybe NominalDiffTime) -> [NominalDiffTime] -> IO ()
finishTP cfg@SMTConfig{tpOptions = TPOptions{ribbonLength}} what (skip, mbT) extraTiming =
message cfg $ replicate (ribbonLength - skip) ' ' ++ what ++ timing ++ extras ++ "\n"
where timing = maybe "" ((' ' :) . mkTiming) mbT
extras = concatMap mkTiming extraTiming
mkTiming t = '[' : showTDiff t ++ "]"
-- | Unique identifier for each proof.
data TPUnique = TPInternal -- IH's
| TPSorry -- sorry
| TPQC -- qc (quick-check)
| TPUser Int64 -- user given
deriving (NFData, Generic, Eq)
-- | Proof for a property. This type is left abstract, i.e., the only way to create on is via a
-- call to lemma/theorem etc., ensuring soundness. (Note that the trusted-code base here
-- is still large: The underlying solver, SBV, and TP kernel itself. But this
-- mechanism ensures we can't create proven things out of thin air, following the standard LCF
-- methodology.)
newtype Proof a = Proof { proofOf :: ProofObj -- ^ Get the underlying proof object
}
-- | Grab the underlying boolean in a proof. Useful in assumption contexts where we need a boolean
assumptionFromProof :: Proof a -> SBool
assumptionFromProof = getObjProof . proofOf
-- | The actual proof container
data ProofObj = ProofObj { dependencies :: [ProofObj] -- ^ Immediate dependencies of this proof. (Not transitive)
, isUserAxiom :: Bool -- ^ Was this an axiom given by the user?
, getObjProof :: SBool -- ^ Get the underlying boolean
, getProp :: Dynamic -- ^ The actual proposition
, proofName :: String -- ^ User given name
, uniqId :: TPUnique -- ^ Unique identifier
, isCached :: Bool -- ^ Was this a cached proof?
}
-- | Drop the instantiation part
shortProofName :: ProofObj -> String
shortProofName p | " @ " `isInfixOf` s = reverse . dropWhile isSpace . reverse . takeWhile (/= '@') $ s
| True = s
where s = proofName p
-- | Keeping track of where the sorry originates from. Used in displaying dependencies.
newtype RootOfTrust = RootOfTrust (Maybe [ProofObj])
-- | Show instance for t'RootOfTrust'
instance Show RootOfTrust where
show (RootOfTrust mbp) = case mbp of
Nothing -> "Nothing"
Just ps -> "Just [" ++ intercalate ", " (map shortProofName ps) ++ "]"
-- | Trust forms a semigroup
instance Semigroup RootOfTrust where
RootOfTrust as <> RootOfTrust bs = RootOfTrust $ nubBy (\a b -> uniqId a == uniqId b) <$> (as <> bs)
-- | Trust forms a monoid
instance Monoid RootOfTrust where
mempty = RootOfTrust Nothing
-- | NFData ignores the getProp field
instance NFData ProofObj where
rnf (ProofObj dependencies isUserAxiom getObjProof _getProp proofName uniqId isCached) = rnf dependencies
`seq` rnf isUserAxiom
`seq` rnf getObjProof
`seq` rnf proofName
`seq` rnf uniqId
`seq` rnf isCached
-- | Dependencies of a proof, in a tree format.
data ProofTree = ProofTree ProofObj [ProofTree]
-- | Return all the proofs this particular proof depends on, transitively
getProofTree :: ProofObj -> ProofTree
getProofTree p = ProofTree p $ map getProofTree (dependencies p)
-- | Turn dependencies to a container tree, for display purposes
depsToTree :: Bool -> [TPUnique] -> (String -> Int -> Int -> a) -> (Int, ProofTree) -> ([TPUnique], Tree a)
depsToTree shouldCompress visited xform (cnt, ProofTree top ds) = (nVisited, Node (xform nTop cnt (length chlds)) chlds)
where nTop = shortProofName top
uniq = uniqId top
(nVisited, chlds)
| shouldCompress && uniq `elem` visited = (visited, [])
| shouldCompress = walk (uniq : visited) (compress (filter interesting ds))
| True = walk visited (map (1,) (filter interesting ds))
walk v [] = (v, [])
walk v (c:cs) = let (v', t) = depsToTree shouldCompress v xform c
(v'', ts) = walk v' cs
in (v'', t : ts)
-- Don't show internal axioms, not interesting
interesting (ProofTree p _) = case uniqId p of
TPInternal -> False
TPSorry -> True
TPQC -> True
TPUser{} -> True
-- If a proof is used twice in the same proof, compress it
compress :: [ProofTree] -> [(Int, ProofTree)]
compress [] = []
compress (p : ps) = (1 + length [() | (_, True) <- filtered], p) : compress [d | (d, False) <- filtered]
where filtered = [(d, uniqId p' == curUniq) | d@(ProofTree p' _) <- ps]
curUniq = case p of
ProofTree curProof _ -> uniqId curProof
-- | Display the proof tree as ASCII text. The first argument is if we should compress the tree, showing only the first
-- use of any sublemma.
showProofTree :: Bool -> Proof a -> String
showProofTree compress d = showTree $ snd $ depsToTree compress [] sh (1, getProofTree (proofOf d))
where sh nm 1 _ = nm
sh nm x _= nm ++ " (x" ++ show x ++ ")"
-- | Display the tree as an html doc for rendering purposes.
-- The first argument is if we should compress the tree, showing only the first
-- use of any sublemma. Second is the path (or URL) to external CSS file, if needed.
showProofTreeHTML :: Bool -> Maybe FilePath -> Proof a -> String
showProofTreeHTML compress mbCSS p = htmlTree mbCSS $ snd $ depsToTree compress [] nodify (1, getProofTree (proofOf p))
where nodify :: String -> Int -> Int -> NodeInfo
nodify nm cnt dc = NodeInfo { nodeBehavior = InitiallyExpanded
, nodeName = nm
, nodeInfo = spc (used cnt) ++ depCount dc
}
used 1 = ""
used n = "Used " ++ show n ++ " times."
spc "" = ""
spc s = s ++ " "
depCount 0 = ""
depCount 1 = "Has one dependency."
depCount n = "Has " ++ show n ++ " dependencies."
-- | Show instance for t'Proof'
instance Typeable a => Show (Proof a) where
show p@(Proof po@ProofObj{proofName = nm}) = '[' : sh (rootOfTrust p) ++ "] " ++ nm ++ " :: " ++ pretty (show (typeOf p))
where sh (RootOfTrust Nothing) = "Proven" ++ cacheInfo
sh (RootOfTrust (Just ps)) = "Modulo: " ++ join ps ++ cacheInfo
join = intercalate ", " . sort . map shortProofName
cacheInfo = case cachedProofs po of
[] -> ""
cs -> ". Cached: " ++ join (nubBy (\p1 p2 -> uniqId p1 == uniqId p2) cs)
cachedProofs prf@ProofObj{isCached} = if isCached then prf : rest else rest
where rest = concatMap cachedProofs (dependencies prf)
-- More mathematical notation for types.
pretty :: String -> String
pretty = unwords . walk . words . concatMap (\c -> if c == ',' then " , " else [c]) . clean
where fa v = ['Ɐ' : unQuote v, "∷"]
ex v = ['∃' : unQuote v, "∷"]
walk ("SBV" : "Bool" : rest) = walk $ "Bool" : rest
walk ("Forall" : xs : rest) = walk $ fa xs ++ rest
walk ("Exists" : xs : rest) = walk $ ex xs ++ rest
walk ("->" : rest) = walk $ "→" : rest
-- handle the double case. This isn't quite solid, but it does the trick.
walk ("((Forall" : xs : t1 : "," : "(Forall" : ys : t2 : rest) = ap (fa xs) ++ [np t1 ++ ","] ++ fa ys ++ [np t2] ++ walk rest
where -- remove a closing paren from the end if it's there
np s | ")" `isSuffixOf` s = init s
| True = s
-- add open paren to the first word
ap (t : ts) = ('(':t) : ts
ap [] = []
-- Otherwise, pass along
walk (c : cs) = c : walk cs
walk [] = []
-- Strip of Proof (...)
clean :: String -> String
clean s | pre `isPrefixOf` s && suf `isSuffixOf` s
= reverse . drop (length suf) . reverse . drop (length pre) $ s
| True
= s
where pre = "Proof ("
suf = ")"
-- | A manifestly false theorem. This is useful when we want to prove a theorem that the underlying solver
-- cannot deal with, or if we want to postpone the proof for the time being. TP will keep
-- track of the uses of 'sorry' and will print them appropriately while printing proofs.
-- NB. We keep this as a t'ProofObj' as opposed to a t'Proof' as it is then easier to use it as a lemma helper.
sorry :: ProofObj
sorry = ProofObj { dependencies = []
, isUserAxiom = False
, getObjProof = label "sorry" (quantifiedBool p)
, getProp = toDyn p
, proofName = "sorry"
, uniqId = TPSorry
, isCached = False
}
where -- ideally, I'd rather just use
-- p = sFalse
-- but then SBV constant folds the boolean, and the generated script
-- doesn't contain the actual contents, as SBV determines unsatisfiability
-- itself. By using the following proposition (which is easy for the backend
-- solver to determine as false, we avoid the constant folding.
p (Forall @"__sbvTP_sorry" (x :: SBool)) = label "SORRY: TP, proof uses \"sorry\"" x
-- | Quick-check uses this proof. It's equivalent to sorry, really; except for its name
quickCheckProof :: ProofObj
quickCheckProof = ProofObj { dependencies = []
, isUserAxiom = False
, getObjProof = label "quickCheck" (quantifiedBool p)
, getProp = toDyn p
, proofName = "quickCheck"
, uniqId = TPQC
, isCached = False
}
where -- ideally, I'd rather just use
-- p = sFalse
-- but then SBV constant folds the boolean, and the generated script
-- doesn't contain the actual contents, as SBV determines unsatisfiability
-- itself. By using the following proposition (which is easy for the backend
-- solver to determine as false, we avoid the constant folding.
p (Forall @"__sbvTP_quickCheck" (x :: SBool)) = label "QUICKCHECK: TP, proof uses \"qc\"" x
-- | Calculate the root of trust. The returned list of proofs, if any, will need to be sorry and quickcheck free to
-- have the given proof to be sorry-free.
rootOfTrust :: Proof a -> RootOfTrust
rootOfTrust = rot True . proofOf
where rot atTop p@ProofObj{uniqId = curUniq, dependencies} = compress res
where res = case curUniq of
TPInternal -> RootOfTrust Nothing
TPQC -> RootOfTrust $ Just [quickCheckProof]
TPSorry -> RootOfTrust $ Just [sorry]
TPUser {} -> self <> foldMap (rot False) dependencies
-- if sorry or quickcheck is one of our direct dependencies, then we trust this proof.
-- Note that we skip this at the top. Why? at that level, we want to see the direct
-- dependency. But if we're down at a lower level, we just want to pick up
self | atTop = mempty
| any isUnsafe dependencies = RootOfTrust $ Just [p]
| True = mempty
isUnsafe ProofObj{uniqId = u} = u `elem` [TPSorry, TPQC]
-- If we have any dependency that is not sorry itself, then we can skip all the sorries.
-- Why? Because "sorry" will implicitly be coming from one of these anyhow. (In other
-- words, we do not need to (or want to) distinguish between different uses of sorry.
compress (RootOfTrust mbps) = RootOfTrust $ reduce <$> mbps
where reduce ps = case partition isUnsafe ps of
(l, []) | TPSorry `elem` map uniqId l -> [sorry]
| True -> [quickCheckProof]
(_, os) -> os
-- | Calculate the modulo string for dependencies
concludeModulo :: [ProofObj] -> String
concludeModulo by = case foldMap (rootOfTrust . Proof) by of
RootOfTrust Nothing -> ""
RootOfTrust (Just ps) -> " [Modulo: " ++ intercalate ", " (map shortProofName ps) ++ "]"
-- | Make TP proofs quiet. Note that this setting will be effective with the
-- call to 'runTP'\/'runTPWith', i.e., if you change the solver in a call to 'Data.SBV.TP.lemmaWith'\/'Data.SBV.TP.theoremWith', we
-- will inherit the quiet settings from the surrounding environment.
tpQuiet :: Bool -> SMTConfig -> SMTConfig
tpQuiet b cfg = cfg{tpOptions = (tpOptions cfg) { quiet = b }}
-- | Change the size of the ribbon for TP proofs. Note that this setting will be effective with the
-- call to 'runTP'\/'runTPWith', i.e., if you change the solver in a call to 'Data.SBV.TP.lemmaWith'\/'Data.SBV.TP.theoremWith', we
-- will inherit the ribbon settings from the surrounding environment.
tpRibbon :: Int -> SMTConfig -> SMTConfig
tpRibbon i cfg = cfg{tpOptions = (tpOptions cfg) { ribbonLength = i }}
-- | Make TP proofs produce statistics. Note that this setting will be effective with the
-- call to 'runTP'\/'runTPWith', i.e., if you change the solver in a call to 'Data.SBV.TP.lemmaWith'\/'Data.SBV.TP.theoremWith', we
-- will inherit the statistics settings from the surrounding environment.
tpStats :: SMTConfig -> SMTConfig
tpStats cfg = cfg{tpOptions = (tpOptions cfg) { printStats = True }}
-- | Make TP proofs use proof-cache. Note that if you use this option then you are obligated to ensure all
-- lemma\/theorem names\/type pairs you use are unique for the whole run. (That is, we will reuse proofs if they have the
-- same name and type; hence if you prove two theorems that share name and type will be considered the same.)
-- If you don't ensure this uniqueness, the results are not guaranteed to be sound. A good tip is to run the proof at
-- least once to completion, and use cache for regression purposes to avoid re-runs. Also, this setting will be effective
-- with the call to 'runTP'\/'runTPWith', i.e., if you -- the solver in a call to 'Data.SBV.TP.lemmaWith'\/'Data.SBV.TP.theoremWith', we will
-- inherit the caching behavior settings from the surrounding environment.
tpCache :: SMTConfig -> SMTConfig
tpCache cfg = cfg{tpOptions = (tpOptions cfg) { cacheProofs = True }}
-- | When proving assumptions for each step, print them as well. Normally, SBV doesn't
-- print assumptions in each proof step, though it does prove them as they are typically trivial.
-- But in certain cases seeing them would be helpful.
tpAsms :: SMTConfig -> SMTConfig
tpAsms cfg = cfg{tpOptions = (tpOptions cfg) { printAsms = True }}