Open ranjitjhala opened 5 years ago
Verification passes if the measures are changed to reflected functions. It would be worth looking at the equalities that PLE produces in each case.
Oh, I know what it is. The measure equalities are not in scope where they are needed in the unsafe variant. We have discussed this a few times in other issues by now.
Change the let
by a case
in lem_select
and it will pass verification.
lem_select_1 x (h:t)
| x <= h = case select x t of
P j l' -> let s_x_ht = P j (h : l')
in
select x (h:t) === s_x_ht *** QED
| otherwise = undefined
The only way I can imagine improving the experience is augmenting the error message with the equalities that are used in the failed constrained. Seeing that the measures are missing is perhaps enough (?)
Here are two definitions of a
reflect
-ed function -- one works and the other does not. Why?