romac
commented
6 years ago It is indeed not clear to me as well why assert(lemmaV1[List[T]](xss, { _.size == length && length > 0 }, { _.size > 0 })) would verify but assert(lemmaV1(xss, p1, p2)) would not.
Looking at the generated VCs, we see the following for the first one:
// - Now solving 'precond. (call lemmaV1[List[T]](xss, p1, p2))' VC for foo @30:12...
(length > 0 && forall[List[T]](xss, (x$1: List[T]) => {
require(true)
size[T](x$1) == length && length > 0
}) && lemmaV1[List[T]](xss, (x$2: List[T]) => {
require(true)
size[T](x$2) == length && length > 0
}, (x$3: List[T]) => {
require(true)
size[T](x$3) > 0
})) ==> {
val p1: (List[T]) => Boolean = (xs: List[T]) => {
require(true)
size[T](xs) > 0
}
val p2: (List[T]) => Boolean = (xs: List[T]) => {
require((size[T](xs) > 0) ==> (xs ≠ Nil[T]()))
size[T](xs) > 0 && size[T](tail[T](xs)) == size[T](xs) - 1
}
∀x$58: List[T]. p1.pre(x$58) && ∀x$59: List[T]. p2.pre(x$59) && ∀z: List[T]. (p1(z) ==> p2(z))
}
// Solving with: nativez3
// - Result for 'precond. (call lemmaV1[List[T]](xss, p1, p2))' VC for foo @30:12:
// => TIMEOUTBut this for the second one:
// - Now solving 'body assertion' VC for foo @20:5...
(length > 0 && forall[List[T]](xss, (x$1: List[T]) => {
require(true)
size[T](x$1) == length && length > 0
})) ==> lemmaV1[List[T]](xss, (x$2: List[T]) => {
require(true)
size[T](x$2) == length && length > 0
}, (x$3: List[T]) => {
require(true)
size[T](x$3) > 0
})
// Solving with: nativez3
// - Result for 'body assertion' VC for foo @20:5:
// => VALIDIn the second case, Stainless correctly infers the precondition require(true) for both of the lambdas.
But in the first case, Stainless infers the following precondition for p2:
require((size[T](xs) > 0) ==> (xs ≠ Nil[T]()))And then tries to prove that:
∀x$58: List[T]. p1.pre(x$58) && ∀x$59: List[T]. p2.pre(x$59) && ∀z: List[T]. (p1(z) ==> p2(z))which it does not seem to be able to do, most likely because p2 has an actual precondition (which we know is always true, but Stainless does not seem to be able to infer it in that case).
Defining p2 as
val p2 = { (xs: List[T]) =>
require(true)
xs.size > 0 && (xs.tail.size == xs.size - 1)
}makes everything verifies.
I'm not exactly sure what is happening here, or why the generated VCs look so different, but this problem seems to be related to the discussion in https://github.com/epfl-lara/stainless/issues/92#issuecomment-339925700 and below.
jad-hamza
mantognini
I've been trying to prove a few things with higher order functions and forall. The main trouble I have is to understand how to express things such that stainless can (dis-)prove my lemmas.
Take this toy example.
I basically want to prove stuff like this:
for specific predicates:
(The lemma are instantiated with T = List[T'].)
As a matter of fact, I can manually prove the precondition of
lemmaV1holds, but stainless still complains that the VC for the precondition times out.However, if I additionally express
Ɐxs: p1(xs) ==> p2(x)using a named function, hereproperty, and add the assertion before calling the lemma, then stainless is happy and confirms that the precondition is valid. (Thanks @jad-hamza for the tip!)So the question is, what conclusion should we take from this?
Should we always express such property using named functions? This seems to work, at least with this example as
lemmaV2andbarshow. The downside is that, to stat with,lemmaV2is more verbose thanlemmaV1to prove the same thing. It's also arguably less intuitive to hoist such small property into named functions to get the proofs we want.If we agree it's better/simpler for stainless to work with named functions, the documentation & example should reflect such decision.
Maybe I simply missed something?
Should we try instead to do the required transformations automatically? It's not quite clear to me what are those transformations yet, as I don't fully grok why they are needed.