Question

我试图证明icmp6校验和函数的属性（总和16位整数，加上进位，反转16位整数）。

我在isabelle中定义了函数。（我知道我的证据太可怕了）

但出于某种原因，isabelle无法证明icmp_csum函数的某些功能，它想拥有它。当我用oops替换粘贴中的done时，它会生成数千行，只是说： “linarith_split_limit超出（当前值为9）”

theory Scratch
imports Main Int List
begin

fun norm_helper :: "nat ⇒ nat" where
  "norm_helper x = (let y = divide x 65536 in (y + x - y * 65536))"

lemma "x ≥ 65536 ⟹ norm_helper x < x" by simp
lemma h: "norm_helper x ≤ x" by simp

fun normalize :: "nat ⇒ nat" where
  "normalize x = (if x ≥ 65536
    then normalize (norm_helper x)
    else x)"

inductive norm_to :: "nat ⇒ nat ⇒ bool" where
  "(x < 65536) ⟹ norm_to x x"
| "norm_to y z ⟹ y = norm_helper x ⟹ norm_to x z"

lemma ne: "norm_to x y ⟹ y = normalize x"
  apply (induct x y rule: norm_to.induct) by simp+

lemma i: "norm_to x y ⟹ x ≥ y"
  apply (induct x y rule: norm_to.induct) by simp+
lemma l: "norm_to x y ⟹ y < 65536"
  apply (induct x y rule: norm_to.induct) by simp+

lemma en: "y = normalize x ⟹ norm_to x y"
  apply (induct x rule: normalize.induct)
proof -
  fix x :: nat
  assume 1: "(x ≥ 65536 ⟹ y = Scratch.normalize (norm_helper x) ⟹ norm_to (norm_helper x) y)"
  assume 2: "y = Scratch.normalize x"  
  show "norm_to x y"
  proof (cases "x ≥ 65536")
    show "¬ 65536 ≤ x ⟹ norm_to x y"
      using norm_to.intros(1)[of x] 2 by simp
    {
      assume s: "65536 ≤ x"
      have d: "y = normalize (norm_helper x)" using 2 s by simp
      show "65536 ≤ x ⟹ norm_to x y"
        using 1 d norm_to.intros(2)[of "norm_helper x" y x]
        by blast
    }
  qed
qed

lemma "normalize x ≤ x" using en i by simp
lemma n[simp]: "normalize x < 65536" using en l by blast

fun sum :: "nat list ⇒ nat" where
  "sum [] = 0"
| "sum (x#xs) = x + sum xs"

fun csum :: "nat list ⇒ nat" where
  "csum xs = normalize (sum xs)"

fun invert :: "nat ⇒ nat" where
  "invert x = 65535 - x"

lemma c: "csum xs ≤ 65535" using n[of "sum xs"] by simp
lemma ic: "invert (csum xs) ≥ 0" using c[of xs] by blast

lemma asdf:
  assumes "xs = ys"
  shows "invert (csum xs) = invert (csum ys)"
  using  HOL.arg_cong[of "csum xs" "csum ys" invert,
                      OF HOL.arg_cong[of xs ys csum]] assms(1)
  by blast

function icmp_csum :: "nat list ⇒ nat" where
  "icmp_csum xs = invert (csum xs)"
apply simp
apply (rule asdf)
apply simp
oops

end

Answer 1

我不知道为什么会有来自linarith的跟踪输出，但鉴于您的定义既不是递归也不是执行模式匹配，您可以将其写为definition：

definition icmp_csum :: "nat list ⇒ nat" where
  "icmp_csum xs = invert (csum xs)"

另一种可能性是将invert更改为definition而不是fun。（一般来说，如果它既不递归也不执行模式匹配，definition更可取，因为它的开销比fun少得多。）

注意，只需导入Main，而不是Main Int List。

编辑： Tobias Nipkow对the mailing list的解释：

这是一个已知问题。在过时的LNCS 2283中，您可以在第3.5.3节“简化和递归函数”中找到有关如何处理的讨论。要点：不要使用＆＃34;如果＆＃34;，请使用模式匹配或＆＃34; case＆＃34;。或者禁用if_split。

在功能证明期间会发生什么

1 个答案: