(*<*)

theory Slides6

imports "~~/src/HOL/Library/LaTeXsugar" "Nominal"

begin

declare [[show_question_marks = false]]

notation (latex output)

  set ("_") and

  Cons  ("_::/_" [66,65] 65) 

(*>*)

text_raw {*

  \newcommand{\abst}[2]{#1.#2}% atom-abstraction

  \newcommand{\pair}[2]{\langle #1,#2\rangle} % pairing

  \newcommand{\susp}{{\boldsymbol{\cdot}}}% for suspensions

  \newcommand{\unit}{\langle\rangle}% unit

  \newcommand{\app}[2]{#1\,#2}% application

  \newcommand{\eqprob}{\mathrel{{\approx}?}}

  \newcommand{\freshprob}{\mathrel{\#?}}

  \newcommand{\redu}[1]{\stackrel{#1}{\Longrightarrow}}% reduction

  \newcommand{\id}{\varepsilon}% identity substitution

  \newcommand{\bl}[1]{\textcolor{blue}{#1}}

  \newcommand{\gr}[1]{\textcolor{gray}{#1}}

  \newcommand{\rd}[1]{\textcolor{red}{#1}}

  \newcommand{\ok}{\includegraphics[scale=0.07]{ok.png}}

  \newcommand{\notok}{\includegraphics[scale=0.07]{notok.png}}

  \newcommand{\largenotok}{\includegraphics[scale=1]{notok.png}}

  \renewcommand{\Huge}{\fontsize{61.92}{77}\selectfont}

  \newcommand{\veryHuge}{\fontsize{74.3}{93}\selectfont}

  \newcommand{\VeryHuge}{\fontsize{89.16}{112}\selectfont}

  \newcommand{\VERYHuge}{\fontsize{107}{134}\selectfont}

  \newcommand{\LL}{$\mathbb{L}\,$}

  \pgfdeclareradialshading{smallbluesphere}{\pgfpoint{0.5mm}{0.5mm}}%

  {rgb(0mm)=(0,0,0.9);

  rgb(0.9mm)=(0,0,0.7);

  rgb(1.3mm)=(0,0,0.5);

  rgb(1.4mm)=(1,1,1)}

  \def\myitemi{\begin{pgfpicture}{-1ex}{-0.55ex}{1ex}{1ex}

    \usebeamercolor[fg]{subitem projected}

    {\pgftransformscale{0.8}\pgftext{\normalsize\pgfuseshading{bigsphere}}}

    \pgftext{%

      \usebeamerfont*{subitem projected}}

  \end{pgfpicture}}

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \mode<presentation>{

  \begin{frame}<1>[t]

  \frametitle{%

  \begin{tabular}{@ {\hspace{-3mm}}c@ {}}

  \\

  \LARGE Verifying a Regular Expression\\[-1mm] 

  \LARGE Matcher and Formal Language\\[-1mm]

  \LARGE Theory\\[5mm]

  \end{tabular}}

  \begin{center}

  Christian Urban\\

  \small Technical University of Munich, Germany

  \end{center}

  \begin{center}

  \small joint work with Chunhan Wu and Xingyuan Zhang from the PLA

  University of Science and Technology in Nanjing

  \end{center}

  \end{frame}}

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

*}

text_raw {*

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \mode<presentation>{

  \begin{frame}<1->[c]

  \frametitle{My Background}

  \mbox{}\\[-10mm]

  \begin{itemize}

  \item My background is in theory and programming languages.\bigskip

  \pause

  \item But I am also a programmer with a \alert<2>{software system} of around 800 kloc 

  (though I am responsible for only appr.~35 kloc),

  \item and I write papers.

  \end{itemize}

  \only<2>{

  \begin{textblock}{6}(6.5,11.5)

  \begin{tikzpicture}

  \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

  {\color{darkgray}

  \begin{minipage}{6.5cm}\raggedright

  \begin{tabular}[b]{@ {}p{4.5cm}c@ {}}

  \raggedright

  The software is a theorem prover, called {\bf Isabelle}. 

  & \mbox{}\hspace{-5mm}\raisebox{-14mm}{\includegraphics[scale=0.28]{isabelle1.png}}

  \end{tabular}%

  \end{minipage}};

  \end{tikzpicture}

  \end{textblock}}

  \only<4>{

  \begin{textblock}{6}(3,11.5)

  \begin{tikzpicture}

  \draw (0,0) node[inner sep=2mm,fill=cream, ultra thick, draw=red, rounded corners=2mm] 

  {\color{darkgray}

  \begin{minipage}{9.6cm}\raggedright

  So I can experience every day that writing error-free code is {\bf very, very hard}

  and that papers are also {\bf hard} to get correct.

  \end{minipage}};

  \end{tikzpicture}

  \end{textblock}}

  \end{frame}}

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

*}

text_raw {*

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \mode<presentation>{

  \begin{frame}

  \frametitle{Getting Papers Correct}

  \begin{minipage}{1.1\textwidth}

  My work over the last 5 years.\\

  {\small (in the fields of programming languages, logic and lambda-calculi)}

  \end{minipage}\bigskip

  \only<1>{

  \mbox{}\\[15mm]

  \begin{center}

  \begin{tikzpicture}[node distance=0.5mm]

  \node at (-1.0,-0.3) (proof) [double arrow, fill=gray,text=white, minimum height=2cm]{\bf Proof};

  \node [left=of proof]{\Large\bf Specification};

  \node [right=of proof]{\Large\bf Code};

  \end{tikzpicture}

  \end{center}

  }

  \pause

  \begin{tabular}{c@ {\hspace{2mm}}c}

  \begin{tabular}{c}

  \includegraphics[scale=0.09]{harper.jpg}\\[-2mm]

  {\footnotesize Bob Harper}\\[-2.5mm]

  {\footnotesize (CMU)}

  \end{tabular}

  \begin{tabular}{c}

  \includegraphics[scale=0.31]{pfenning.jpg}\\[-2mm]

  {\footnotesize Frank Pfenning}\\[-2.5mm]

  {\footnotesize (CMU)}

  \end{tabular} &

  \begin{tabular}{p{6cm}}

  \raggedright\small

  \color{gray}{published a proof in ACM Transactions on Computational Logic (2005),

  $\sim$31pp}

  \end{tabular}\\

  \\[-4mm]

  \begin{tabular}{c}

  \includegraphics[scale=0.3]{appel.jpg}\\[-2mm] 

  {\footnotesize Andrew Appel}\\[-2.5mm]

  {\footnotesize (Princeton)}

  \end{tabular} &

  \begin{tabular}{p{6cm}}

  \raggedright\small

  \color{gray}{relied on their proof in a safety critical system (proof carrying code)}

  \end{tabular}

  \end{tabular}\medskip

  \end{frame}}

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

*}

text_raw {*

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \mode<presentation>{

  \begin{frame}

  \frametitle{Proof-Carrying Code}

  \begin{textblock}{10}(2.5,2.2)

  \begin{block}{Idea:}

  \begin{center}

  \begin{tikzpicture}

  \draw[help lines,cream] (0,0.2) grid (8,4);

  \draw[line width=1mm, red] (5.5,0.6) rectangle (7.5,4);

  \node[anchor=base] at (6.5,2.8) 

     {\small\begin{tabular}{@ {}p{1.9cm}@ {}}\centering  user needs to run untrusted code\end{tabular}};

  \draw[line width=1mm, red] (0.5,0.6) rectangle (2.5,4);

  \node[anchor=base] at (1.5,2.3) 

     {\small\begin{tabular}{@ {}p{1.9cm}@ {}}\centering  code developer/ web server/ Apple 

  Store\end{tabular}};

  \onslide<4->{

  \draw[line width=1mm, red, fill=red] (5.5,0.6) rectangle (7.5,1.8);

  \node[anchor=base,white] at (6.5,1.1) 

     {\small\begin{tabular}{@ {}p{1.9cm}@ {}}\bf\centering proof- checker\end{tabular}};}

  \node at (3.8,3.0) [single arrow, fill=red,text=white, minimum height=3cm]{\bf code};

  \onslide<3->{

  \node at (3.8,1.3) [single arrow, fill=red,text=white, minimum height=3cm]{\bf LF proof};

  \node at (3.8,1.9) {\small certificate};

  }

  \onslide<2>{\node at (4.0,1.3) [text=red]{\begin{tabular}{c}\bf Highly\\\bf Dangerous!\end{tabular}};}

  \end{tikzpicture}

  \end{center}

  \end{block}

  \end{textblock}

  \begin{textblock}{15}(2,12)

  \small

  \begin{itemize}

  \item<4-> Appel's checker is $\sim$2700 lines of code (1865 loc of\\ LF definitions; 

  803 loc in C including 2 library functions)\\[-3mm]

  \item<5-> 167 loc in C implement a type-checker

  \end{itemize}

  \end{textblock}

  \end{frame}}

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

*}

text {*

  \tikzstyle{every node}=[node distance=25mm,text height=1.5ex, text depth=.25ex]

  \tikzstyle{node1}=[rectangle, minimum size=10mm, rounded corners=3mm, very thick, 

                     draw=black!50, top color=white, bottom color=black!20]

  \tikzstyle{node2}=[rectangle, minimum size=12mm, rounded corners=3mm, very thick, 

                     draw=red!70, top color=white, bottom color=red!50!black!20]

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \mode<presentation>{

  \begin{frame}<2->[squeeze]

  \frametitle{Type-Checking in LF} 

  \begin{columns}

  \begin{column}{0.8\textwidth}

  \begin{textblock}{0}(1,2)

  \begin{tikzpicture}

  \matrix[ampersand replacement=\&,column sep=7mm, row sep=5mm]

  { \&[-10mm] 

    \node (def1)   [node1] {\large\hspace{1mm}Spec\hspace{1mm}\mbox{}}; \&

    \node (proof1) [node1] {\large Proof}; \&

    \node (alg1)   [node1] {\large\hspace{1mm}Alg\hspace{1mm}\mbox{}}; \\

    \onslide<4->{\node {\begin{tabular}{c}\small 1st\\[-2.5mm] \footnotesize solution\end{tabular}};} \&

    \onslide<4->{\node (def2)   [node2] {\large Spec$^\text{+ex}$};} \&

    \onslide<4->{\node (proof2) [node1] {\large Proof};} \&

    \onslide<4->{\node (alg2)   [node1] {\large\hspace{1mm}Alg\hspace{1mm}\mbox{}};} \\

    \onslide<5->{\node {\begin{tabular}{c}\small 2nd\\[-2.5mm] \footnotesize solution\end{tabular}};} \&

    \onslide<5->{\node (def3)   [node1] {\large\hspace{1mm}Spec\hspace{1mm}\mbox{}};} \&

    \onslide<5->{\node (proof3) [node1] {\large Proof};} \&

    \onslide<5->{\node (alg3)   [node2] {\large Alg$^\text{-ex}$};} \\

    \onslide<6->{\node {\begin{tabular}{c}\small 3rd\\[-2.5mm] \footnotesize solution\end{tabular}};} \&

    \onslide<6->{\node (def4)   [node1] {\large\hspace{1mm}Spec\hspace{1mm}\mbox{}};} \&

    \onslide<6->{\node (proof4) [node2] {\large\hspace{1mm}Proof\hspace{1mm}};} \&

    \onslide<6->{\node (alg4)   [node1] {\large\hspace{1mm}Alg\hspace{1mm}\mbox{}};} \\

  };

  \draw[->,black!50,line width=2mm] (proof1) -- (def1);

  \draw[->,black!50,line width=2mm] (proof1) -- (alg1);

  \onslide<4->{\draw[->,black!50,line width=2mm] (proof2) -- (def2);}

  \onslide<4->{\draw[->,black!50,line width=2mm] (proof2) -- (alg2);}

  \onslide<5->{\draw[->,black!50,line width=2mm] (proof3) -- (def3);}

  \onslide<5->{\draw[->,black!50,line width=2mm] (proof3) -- (alg3);}

  \onslide<6->{\draw[->,black!50,line width=2mm] (proof4) -- (def4);}

  \onslide<6->{\draw[->,black!50,line width=2mm] (proof4) -- (alg4);}

  \onslide<3->{\draw[white,line width=1mm] (1.1,3.2) -- (0.9,2.85) -- (1.1,2.35) -- (0.9,2.0);} 

  \end{tikzpicture}

  \end{textblock}

  \end{column}

  \end{columns}

  \begin{textblock}{3}(12,3.6)

  \onslide<4->{

  \begin{tikzpicture}

  \node at (0,0) [single arrow, shape border rotate=270, fill=red,text=white]{2h};

  \end{tikzpicture}}

  \end{textblock}

  \only<7->{

  \begin{textblock}{14}(0.6,12.8)

  \begin{block}{}

  \small Each time one needs to check $\sim$31pp~of informal paper proofs.

  You have to be able to keep definitions and proofs consistent.

  \end{block}

  \end{textblock}}

  \end{frame}}

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

*}

text_raw {*

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \mode<presentation>{

  \begin{frame}<1->[c]

  \begin{itemize}

  \item Theorem provers help with keeping large proofs consistent;

  make them modifiable.\medskip

  \item They can ensure that all cases are covered.\medskip

  \item Some reasoning can be automated. 

  \end{itemize}\bigskip\pause

  \begin{minipage}{1.1\textwidth}

  Formal reasoning needs to be ``smooth''.\\

  {\small (ideally as close as possible to reasoning with ``pen-and-paper'')}

  \end{minipage}

  \only<2->{

  \begin{textblock}{3}(0.1,9.9)

  \begin{tikzpicture}

  \node at (0,0) [single arrow, shape border rotate=0, fill=red,text=red]{a};

  \end{tikzpicture}

  \end{textblock}}

  \end{frame}}

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

*}

(*<*)

atom_decl name

nominal_datatype lam = 

    Var "name"

  | App "lam" "lam"

  | Lam "\<guillemotleft>name\<guillemotright>lam" ("Lam [_]._" [100,100] 100)

nominal_primrec

  subst :: "lam \<Rightarrow> name \<Rightarrow> lam \<Rightarrow> lam"  ("_[_::=_]")

where

  "(Var x)[y::=s] = (if x=y then s else (Var x))"

| "(App t\<^isub>1 t\<^isub>2)[y::=s] = App (t\<^isub>1[y::=s]) (t\<^isub>2[y::=s])"

| "x\<sharp>(y,s) \<Longrightarrow> (Lam [x].t)[y::=s] = Lam [x].(t[y::=s])"

apply(finite_guess)+

apply(rule TrueI)+

apply(simp add: abs_fresh)

apply(fresh_guess)+

done

lemma  subst_eqvt[eqvt]:

  fixes pi::"name prm"

  shows "pi\<bullet>(t1[x::=t2]) = (pi\<bullet>t1)[(pi\<bullet>x)::=(pi\<bullet>t2)]"

by (nominal_induct t1 avoiding: x t2 rule: lam.strong_induct)

   (auto simp add: perm_bij fresh_atm fresh_bij)

lemma fresh_fact:

  fixes z::"name"

  shows "\<lbrakk>z\<sharp>s; (z=y \<or> z\<sharp>t)\<rbrakk> \<Longrightarrow> z\<sharp>t[y::=s]"

by (nominal_induct t avoiding: z y s rule: lam.strong_induct)

   (auto simp add: abs_fresh fresh_prod fresh_atm)

lemma forget: 

  assumes asm: "x\<sharp>L"

  shows "L[x::=P] = L"

  using asm 

by (nominal_induct L avoiding: x P rule: lam.strong_induct)

   (auto simp add: abs_fresh fresh_atm)

(*>*)

text_raw {*

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \mode<presentation>{

  \begin{frame}

  \begin{textblock}{16}(1,1)

  \renewcommand{\isasymbullet}{$\cdot$}

  \tiny\color{black}

*}

lemma substitution_lemma_not_to_be_tried_at_home: 

  assumes asm: "x\<noteq>y" "x\<sharp>L"

  shows "M[x::=N][y::=L] = M[y::=L][x::=N[y::=L]]"

using asm

proof (induct M arbitrary: x y N L rule: lam.induct)

  case (Lam z M1) 

  have ih: "\<And>x y N L. \<lbrakk>x\<noteq>y; x\<sharp>L\<rbrakk> \<Longrightarrow> M1[x::=N][y::=L] = M1[y::=L][x::=N[y::=L]]" by fact

  have "x\<noteq>y" by fact

  have "x\<sharp>L" by fact

  obtain z'::"name" where fc: "z'\<sharp>(x,y,z,M1,N,L)" by (rule exists_fresh) (auto simp add: fs_name1)

  have eq: "Lam [z'].([(z',z)]\<bullet>M1) = Lam [z].M1" using fc 

    by (auto simp add: lam.inject alpha fresh_prod fresh_atm)

  have fc': "z'\<sharp>N[y::=L]" using fc by (simp add: fresh_fact fresh_prod)

  have "([(z',z)]\<bullet>x) \<noteq> ([(z',z)]\<bullet>y)" using `x\<noteq>y` by (auto simp add: calc_atm)

  moreover

  have "([(z',z)]\<bullet>x)\<sharp>([(z',z)]\<bullet>L)" using `x\<sharp>L` by (simp add: fresh_bij)

  ultimately 

  have "M1[([(z',z)]\<bullet>x)::=([(z',z)]\<bullet>N)][([(z',z)]\<bullet>y)::=([(z',z)]\<bullet>L)] 

        = M1[([(z',z)]\<bullet>y)::=([(z',z)]\<bullet>L)][([(z',z)]\<bullet>x)::=([(z',z)]\<bullet>N)[([(z',z)]\<bullet>y)::=([(z',z)]\<bullet>L)]]"

    using ih by simp

  then have "[(z',z)]\<bullet>(M1[([(z',z)]\<bullet>x)::=([(z',z)]\<bullet>N)][([(z',z)]\<bullet>y)::=([(z',z)]\<bullet>L)] 

        = M1[([(z',z)]\<bullet>y)::=([(z',z)]\<bullet>L)][([(z',z)]\<bullet>x)::=([(z',z)]\<bullet>N)[([(z',z)]\<bullet>y)::=([(z',z)]\<bullet>L)]])"

    by (simp add: perm_bool)

  then have ih': "([(z',z)]\<bullet>M1)[x::=N][y::=L] = ([(z',z)]\<bullet>M1)[y::=L][x::=N[y::=L]]"

    by (simp add: eqvts perm_swap)

  show "(Lam [z].M1)[x::=N][y::=L] = (Lam [z].M1)[y::=L][x::=N[y::=L]]" (is "?LHS=?RHS") 

  proof - 

    have "?LHS = (Lam [z'].([(z',z)]\<bullet>M1))[x::=N][y::=L]" using eq by simp

    also have "\<dots> = Lam [z'].(([(z',z)]\<bullet>M1)[x::=N][y::=L])" using fc by (simp add: fresh_prod)

    also from ih have "\<dots> = Lam [z'].(([(z',z)]\<bullet>M1)[y::=L][x::=N[y::=L]])" sorry 

    also have "\<dots> = (Lam [z'].([(z',z)]\<bullet>M1))[y::=L][x::=N[y::=L]]" using fc fc' by (simp add: fresh_prod)

    also have "\<dots> = ?RHS" using eq by simp

    finally show "?LHS = ?RHS" .

  qed

qed (auto simp add: forget)

text_raw {*

  \end{textblock}

  \mbox{}

  \only<2->{

  \begin{textblock}{11.5}(4,2.3)

  \begin{minipage}{9.3cm}

  \begin{block}{}\footnotesize

*}

lemma substitution_lemma\<iota>:

  assumes asm: "x \<noteq> y" "x \<sharp> L"

  shows "M[x::=N][y::=L] = M[y::=L][x::=N[y::=L]]"

  using asm

by (nominal_induct M avoiding: x y N L rule: lam.strong_induct)

     (auto simp add: forget fresh_fact)

text_raw {*  

  \end{block}

  \end{minipage}

  \end{textblock}}

  \end{frame}}

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

*}

text_raw {*

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

  \mode<presentation>{

  \begin{frame}<1>[c]

  \frametitle{Getting Programs Correct}

  \begin{center}

  \begin{tikzpicture}[node distance=0.5mm]

  \node at (-1.0,-0.3) (proof) [double arrow, fill=gray,text=white, minimum height=2cm]{\bf Proof};

  \node [left=of proof]{\Large\bf Specification};

  \node [right=of proof]{\Large\bf Code};

  \end{tikzpicture}

  \end{center}

  \end{frame}}

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%     

*}

text_raw {*

  %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%