src/HOL/ex/Quickcheck_Examples.thy
author bulwahn
Fri Oct 21 11:17:14 2011 +0200 (2011-10-21)
changeset 45231 d85a2fdc586c
parent 45118 7462f287189a
child 45441 fb4ac1dd4fde
permissions -rw-r--r--
replacing code_inline by code_unfold, removing obsolete code_unfold, code_inline del now that the ancient code generator is removed
berghofe@14592
     1
(*  Title:      HOL/ex/Quickcheck_Examples.thy
bulwahn@40645
     2
    Author:     Stefan Berghofer, Lukas Bulwahn
bulwahn@40645
     3
    Copyright   2004 - 2010 TU Muenchen
berghofe@14592
     4
*)
berghofe@14592
     5
berghofe@14592
     6
header {* Examples for the 'quickcheck' command *}
berghofe@14592
     7
haftmann@28314
     8
theory Quickcheck_Examples
bulwahn@41231
     9
imports Complex_Main
haftmann@28314
    10
begin
berghofe@14592
    11
berghofe@14592
    12
text {*
berghofe@14592
    13
The 'quickcheck' command allows to find counterexamples by evaluating
bulwahn@40654
    14
formulae.
bulwahn@40654
    15
Currently, there are two different exploration schemes:
bulwahn@40654
    16
- random testing: this is incomplete, but explores the search space faster.
bulwahn@40654
    17
- exhaustive testing: this is complete, but increasing the depth leads to
bulwahn@40654
    18
  exponentially many assignments.
bulwahn@40654
    19
bulwahn@40654
    20
quickcheck can handle quantifiers on finite universes.
bulwahn@40654
    21
berghofe@14592
    22
*}
berghofe@14592
    23
bulwahn@43803
    24
declare [[quickcheck_timeout = 3600]]
bulwahn@43803
    25
berghofe@14592
    26
subsection {* Lists *}
berghofe@14592
    27
berghofe@14592
    28
theorem "map g (map f xs) = map (g o f) xs"
bulwahn@40917
    29
  quickcheck[random, expect = no_counterexample]
bulwahn@40917
    30
  quickcheck[exhaustive, size = 3, expect = no_counterexample]
berghofe@14592
    31
  oops
berghofe@14592
    32
berghofe@14592
    33
theorem "map g (map f xs) = map (f o g) xs"
bulwahn@40917
    34
  quickcheck[random, expect = counterexample]
bulwahn@40917
    35
  quickcheck[exhaustive, expect = counterexample]
berghofe@14592
    36
  oops
berghofe@14592
    37
berghofe@14592
    38
theorem "rev (xs @ ys) = rev ys @ rev xs"
bulwahn@40917
    39
  quickcheck[random, expect = no_counterexample]
bulwahn@40917
    40
  quickcheck[exhaustive, expect = no_counterexample]
bulwahn@42087
    41
  quickcheck[exhaustive, size = 1000, timeout = 0.1]
berghofe@14592
    42
  oops
berghofe@14592
    43
berghofe@14592
    44
theorem "rev (xs @ ys) = rev xs @ rev ys"
bulwahn@40917
    45
  quickcheck[random, expect = counterexample]
bulwahn@40917
    46
  quickcheck[exhaustive, expect = counterexample]
berghofe@14592
    47
  oops
berghofe@14592
    48
berghofe@14592
    49
theorem "rev (rev xs) = xs"
bulwahn@40917
    50
  quickcheck[random, expect = no_counterexample]
bulwahn@40917
    51
  quickcheck[exhaustive, expect = no_counterexample]
berghofe@14592
    52
  oops
berghofe@14592
    53
berghofe@14592
    54
theorem "rev xs = xs"
bulwahn@42159
    55
  quickcheck[tester = random, finite_types = true, report = false, expect = counterexample]
bulwahn@42159
    56
  quickcheck[tester = random, finite_types = false, report = false, expect = counterexample]
bulwahn@42159
    57
  quickcheck[tester = random, finite_types = true, report = true, expect = counterexample]
bulwahn@42159
    58
  quickcheck[tester = random, finite_types = false, report = true, expect = counterexample]
bulwahn@42159
    59
  quickcheck[tester = exhaustive, finite_types = true, expect = counterexample]
bulwahn@42159
    60
  quickcheck[tester = exhaustive, finite_types = false, expect = counterexample]
bulwahn@42159
    61
oops
bulwahn@42159
    62
berghofe@14592
    63
berghofe@25891
    64
text {* An example involving functions inside other data structures *}
berghofe@25891
    65
haftmann@28314
    66
primrec app :: "('a \<Rightarrow> 'a) list \<Rightarrow> 'a \<Rightarrow> 'a" where
berghofe@25891
    67
  "app [] x = x"
haftmann@28314
    68
  | "app (f # fs) x = app fs (f x)"
berghofe@25891
    69
berghofe@25891
    70
lemma "app (fs @ gs) x = app gs (app fs x)"
bulwahn@40917
    71
  quickcheck[random, expect = no_counterexample]
bulwahn@40917
    72
  quickcheck[exhaustive, size = 4, expect = no_counterexample]
berghofe@25891
    73
  by (induct fs arbitrary: x) simp_all
berghofe@25891
    74
berghofe@25891
    75
lemma "app (fs @ gs) x = app fs (app gs x)"
bulwahn@40917
    76
  quickcheck[random, expect = counterexample]
bulwahn@40917
    77
  quickcheck[exhaustive, expect = counterexample]
berghofe@25891
    78
  oops
berghofe@25891
    79
haftmann@28314
    80
primrec occurs :: "'a \<Rightarrow> 'a list \<Rightarrow> nat" where
berghofe@14592
    81
  "occurs a [] = 0"
haftmann@28314
    82
  | "occurs a (x#xs) = (if (x=a) then Suc(occurs a xs) else occurs a xs)"
berghofe@14592
    83
haftmann@28314
    84
primrec del1 :: "'a \<Rightarrow> 'a list \<Rightarrow> 'a list" where
berghofe@14592
    85
  "del1 a [] = []"
haftmann@28314
    86
  | "del1 a (x#xs) = (if (x=a) then xs else (x#del1 a xs))"
berghofe@14592
    87
berghofe@25891
    88
text {* A lemma, you'd think to be true from our experience with delAll *}
berghofe@14592
    89
lemma "Suc (occurs a (del1 a xs)) = occurs a xs"
berghofe@14592
    90
  -- {* Wrong. Precondition needed.*}
bulwahn@40917
    91
  quickcheck[random, expect = counterexample]
bulwahn@40917
    92
  quickcheck[exhaustive, expect = counterexample]
berghofe@14592
    93
  oops
berghofe@14592
    94
berghofe@14592
    95
lemma "xs ~= [] \<longrightarrow> Suc (occurs a (del1 a xs)) = occurs a xs"
bulwahn@40917
    96
  quickcheck[random, expect = counterexample]
bulwahn@40917
    97
  quickcheck[exhaustive, expect = counterexample]
berghofe@14592
    98
    -- {* Also wrong.*}
berghofe@14592
    99
  oops
berghofe@14592
   100
berghofe@14592
   101
lemma "0 < occurs a xs \<longrightarrow> Suc (occurs a (del1 a xs)) = occurs a xs"
bulwahn@40917
   102
  quickcheck[random, expect = no_counterexample]
bulwahn@40917
   103
  quickcheck[exhaustive, expect = no_counterexample]
haftmann@28314
   104
  by (induct xs) auto
berghofe@14592
   105
haftmann@28314
   106
primrec replace :: "'a \<Rightarrow> 'a \<Rightarrow> 'a list \<Rightarrow> 'a list" where
berghofe@14592
   107
  "replace a b [] = []"
haftmann@28314
   108
  | "replace a b (x#xs) = (if (x=a) then (b#(replace a b xs)) 
berghofe@14592
   109
                            else (x#(replace a b xs)))"
berghofe@14592
   110
berghofe@14592
   111
lemma "occurs a xs = occurs b (replace a b xs)"
bulwahn@40917
   112
  quickcheck[random, expect = counterexample]
bulwahn@40917
   113
  quickcheck[exhaustive, expect = counterexample]
berghofe@14592
   114
  -- {* Wrong. Precondition needed.*}
berghofe@14592
   115
  oops
berghofe@14592
   116
berghofe@14592
   117
lemma "occurs b xs = 0 \<or> a=b \<longrightarrow> occurs a xs = occurs b (replace a b xs)"
bulwahn@40917
   118
  quickcheck[random, expect = no_counterexample]
bulwahn@40917
   119
  quickcheck[exhaustive, expect = no_counterexample]
haftmann@28314
   120
  by (induct xs) simp_all
berghofe@14592
   121
berghofe@14592
   122
berghofe@14592
   123
subsection {* Trees *}
berghofe@14592
   124
berghofe@14592
   125
datatype 'a tree = Twig |  Leaf 'a | Branch "'a tree" "'a tree"
berghofe@14592
   126
haftmann@28314
   127
primrec leaves :: "'a tree \<Rightarrow> 'a list" where
berghofe@14592
   128
  "leaves Twig = []"
haftmann@28314
   129
  | "leaves (Leaf a) = [a]"
haftmann@28314
   130
  | "leaves (Branch l r) = (leaves l) @ (leaves r)"
berghofe@14592
   131
haftmann@28314
   132
primrec plant :: "'a list \<Rightarrow> 'a tree" where
berghofe@14592
   133
  "plant [] = Twig "
haftmann@28314
   134
  | "plant (x#xs) = Branch (Leaf x) (plant xs)"
berghofe@14592
   135
haftmann@28314
   136
primrec mirror :: "'a tree \<Rightarrow> 'a tree" where
berghofe@14592
   137
  "mirror (Twig) = Twig "
haftmann@28314
   138
  | "mirror (Leaf a) = Leaf a "
haftmann@28314
   139
  | "mirror (Branch l r) = Branch (mirror r) (mirror l)"
berghofe@14592
   140
berghofe@14592
   141
theorem "plant (rev (leaves xt)) = mirror xt"
bulwahn@40917
   142
  quickcheck[random, expect = counterexample]
bulwahn@40917
   143
  quickcheck[exhaustive, expect = counterexample]
berghofe@14592
   144
    --{* Wrong! *} 
berghofe@14592
   145
  oops
berghofe@14592
   146
berghofe@14592
   147
theorem "plant((leaves xt) @ (leaves yt)) = Branch xt yt"
bulwahn@40917
   148
  quickcheck[random, expect = counterexample]
bulwahn@40917
   149
  quickcheck[exhaustive, expect = counterexample]
berghofe@14592
   150
    --{* Wrong! *} 
berghofe@14592
   151
  oops
berghofe@14592
   152
berghofe@14592
   153
datatype 'a ntree = Tip "'a" | Node "'a" "'a ntree" "'a ntree"
berghofe@14592
   154
haftmann@28314
   155
primrec inOrder :: "'a ntree \<Rightarrow> 'a list" where
berghofe@14592
   156
  "inOrder (Tip a)= [a]"
haftmann@28314
   157
  | "inOrder (Node f x y) = (inOrder x)@[f]@(inOrder y)"
berghofe@14592
   158
haftmann@28314
   159
primrec root :: "'a ntree \<Rightarrow> 'a" where
berghofe@14592
   160
  "root (Tip a) = a"
haftmann@28314
   161
  | "root (Node f x y) = f"
berghofe@14592
   162
haftmann@28314
   163
theorem "hd (inOrder xt) = root xt"
bulwahn@40917
   164
  quickcheck[random, expect = counterexample]
bulwahn@40917
   165
  quickcheck[exhaustive, expect = counterexample]
bulwahn@40917
   166
  --{* Wrong! *} 
berghofe@14592
   167
  oops
berghofe@14592
   168
bulwahn@40645
   169
bulwahn@40645
   170
subsection {* Exhaustive Testing beats Random Testing *}
bulwahn@40645
   171
bulwahn@40645
   172
text {* Here are some examples from mutants from the List theory
bulwahn@40645
   173
where exhaustive testing beats random testing *}
bulwahn@40645
   174
bulwahn@40645
   175
lemma
bulwahn@40645
   176
  "[] ~= xs ==> hd xs = last (x # xs)"
bulwahn@40917
   177
quickcheck[random]
bulwahn@40917
   178
quickcheck[exhaustive, expect = counterexample]
bulwahn@40645
   179
oops
bulwahn@40645
   180
bulwahn@40645
   181
lemma
bulwahn@40645
   182
  assumes "!!i. [| i < n; i < length xs |] ==> P (xs ! i)" "n < length xs ==> ~ P (xs ! n)"
bulwahn@40645
   183
  shows "drop n xs = takeWhile P xs"
bulwahn@40917
   184
quickcheck[random, iterations = 10000, quiet]
bulwahn@40917
   185
quickcheck[exhaustive, expect = counterexample]
bulwahn@40645
   186
oops
bulwahn@40645
   187
bulwahn@40645
   188
lemma
bulwahn@40645
   189
  "i < length (List.transpose (List.transpose xs)) ==> xs ! i = map (%xs. xs ! i) [ys<-xs. i < length ys]"
bulwahn@40917
   190
quickcheck[random, iterations = 10000]
bulwahn@40917
   191
quickcheck[exhaustive, expect = counterexample]
bulwahn@40645
   192
oops
bulwahn@40645
   193
bulwahn@40645
   194
lemma
bulwahn@40645
   195
  "i < n - m ==> f (lcm m i) = map f [m..<n] ! i"
bulwahn@40917
   196
quickcheck[random, iterations = 10000, finite_types = false]
bulwahn@40917
   197
quickcheck[exhaustive, finite_types = false, expect = counterexample]
bulwahn@40645
   198
oops
bulwahn@40645
   199
bulwahn@40645
   200
lemma
bulwahn@40645
   201
  "i < n - m ==> f (lcm m i) = map f [m..<n] ! i"
bulwahn@40917
   202
quickcheck[random, iterations = 10000, finite_types = false]
bulwahn@40917
   203
quickcheck[exhaustive, finite_types = false, expect = counterexample]
bulwahn@40645
   204
oops
bulwahn@40645
   205
bulwahn@40645
   206
lemma
bulwahn@40645
   207
  "ns ! k < length ns ==> k <= listsum ns"
bulwahn@40917
   208
quickcheck[random, iterations = 10000, finite_types = false, quiet]
bulwahn@40917
   209
quickcheck[exhaustive, finite_types = false, expect = counterexample]
bulwahn@40645
   210
oops
bulwahn@40645
   211
bulwahn@40645
   212
lemma
bulwahn@40645
   213
  "[| ys = x # xs1; zs = xs1 @ xs |] ==> ys @ zs = x # xs"
bulwahn@40917
   214
quickcheck[random, iterations = 10000]
bulwahn@40917
   215
quickcheck[exhaustive, expect = counterexample]
bulwahn@40645
   216
oops
bulwahn@40645
   217
bulwahn@40645
   218
lemma
bulwahn@40645
   219
"i < length xs ==> take (Suc i) xs = [] @ xs ! i # take i xs"
bulwahn@40917
   220
quickcheck[random, iterations = 10000]
bulwahn@40917
   221
quickcheck[exhaustive, expect = counterexample]
bulwahn@40645
   222
oops
bulwahn@40645
   223
bulwahn@40645
   224
lemma
bulwahn@40645
   225
  "i < length xs ==> take (Suc i) xs = (xs ! i # xs) @ take i []"
bulwahn@40917
   226
quickcheck[random, iterations = 10000]
bulwahn@40917
   227
quickcheck[exhaustive, expect = counterexample]
bulwahn@40645
   228
oops
bulwahn@40645
   229
bulwahn@40645
   230
lemma
bulwahn@40645
   231
  "[| sorted (rev (map length xs)); i < length xs |] ==> xs ! i = map (%ys. ys ! i) [ys<-remdups xs. i < length ys]"
bulwahn@40917
   232
quickcheck[random]
bulwahn@40917
   233
quickcheck[exhaustive, expect = counterexample]
bulwahn@40645
   234
oops
bulwahn@40645
   235
bulwahn@40645
   236
lemma
huffman@44189
   237
  "[| sorted (rev (map length xs)); i < length xs |] ==> xs ! i = map (%ys. ys ! i) [ys<-List.transpose xs. length ys \<in> {..<i}]"
bulwahn@40917
   238
quickcheck[random]
bulwahn@40917
   239
quickcheck[exhaustive, expect = counterexample]
bulwahn@40645
   240
oops
bulwahn@40645
   241
bulwahn@40645
   242
lemma
bulwahn@40645
   243
  "(ys = zs) = (xs @ ys = splice xs zs)"
bulwahn@40917
   244
quickcheck[random]
bulwahn@40917
   245
quickcheck[exhaustive, expect = counterexample]
bulwahn@40645
   246
oops
bulwahn@40645
   247
bulwahn@41231
   248
subsection {* Examples with quantifiers *}
bulwahn@40654
   249
bulwahn@40654
   250
text {*
bulwahn@40654
   251
  These examples show that we can handle quantifiers.
bulwahn@40654
   252
*}
bulwahn@40654
   253
bulwahn@40654
   254
lemma "(\<exists>x. P x) \<longrightarrow> (\<forall>x. P x)"
bulwahn@40917
   255
  quickcheck[random, expect = counterexample]
bulwahn@40917
   256
  quickcheck[exhaustive, expect = counterexample]
bulwahn@40654
   257
oops
bulwahn@40654
   258
bulwahn@40654
   259
lemma "(\<forall>x. \<exists>y. P x y) \<longrightarrow> (\<exists>y. \<forall>x. P x y)"
bulwahn@40917
   260
  quickcheck[random, expect = counterexample]
bulwahn@40654
   261
  quickcheck[expect = counterexample]
bulwahn@40654
   262
oops
bulwahn@40654
   263
bulwahn@40654
   264
lemma "(\<exists>x. P x) \<longrightarrow> (EX! x. P x)"
bulwahn@40917
   265
  quickcheck[random, expect = counterexample]
bulwahn@40654
   266
  quickcheck[expect = counterexample]
bulwahn@40654
   267
oops
bulwahn@40654
   268
bulwahn@45118
   269
bulwahn@45118
   270
subsection {* Examples with relations *}
bulwahn@45118
   271
bulwahn@45118
   272
lemma
bulwahn@45118
   273
  "acyclic R ==> acyclic S ==> acyclic (R Un S)"
bulwahn@45118
   274
quickcheck[expect = counterexample]
bulwahn@45118
   275
oops
bulwahn@45118
   276
bulwahn@45118
   277
lemma
bulwahn@45118
   278
  "(x, z) : rtrancl (R Un S) ==> \<exists> y. (x, y) : rtrancl R & (y, z) : rtrancl S"
bulwahn@45118
   279
quickcheck[expect = counterexample]
bulwahn@45118
   280
oops
bulwahn@45118
   281
bulwahn@45118
   282
bulwahn@41231
   283
subsection {* Examples with numerical types *}
bulwahn@41231
   284
bulwahn@41231
   285
text {*
bulwahn@41231
   286
Quickcheck supports the common types nat, int, rat and real.
bulwahn@41231
   287
*}
bulwahn@41231
   288
bulwahn@41231
   289
lemma
bulwahn@41231
   290
  "(x :: nat) > 0 ==> y > 0 ==> z > 0 ==> x * x + y * y \<noteq> z * z"
bulwahn@41231
   291
quickcheck[exhaustive, size = 10, expect = counterexample]
bulwahn@41231
   292
quickcheck[random, size = 10]
bulwahn@41231
   293
oops
bulwahn@41231
   294
bulwahn@41231
   295
lemma
bulwahn@41231
   296
  "(x :: int) > 0 ==> y > 0 ==> z > 0 ==> x * x + y * y \<noteq> z * z"
bulwahn@41231
   297
quickcheck[exhaustive, size = 10, expect = counterexample]
bulwahn@41231
   298
quickcheck[random, size = 10]
bulwahn@41231
   299
oops
bulwahn@41231
   300
bulwahn@41231
   301
lemma
bulwahn@41231
   302
  "(x :: rat) > 0 ==> y > 0 ==> z > 0 ==> x * x + y * y \<noteq> z * z"
bulwahn@41231
   303
quickcheck[exhaustive, size = 10, expect = counterexample]
bulwahn@41231
   304
quickcheck[random, size = 10]
bulwahn@41231
   305
oops
bulwahn@41231
   306
bulwahn@41231
   307
lemma
bulwahn@41231
   308
  "(x :: real) > 0 ==> y > 0 ==> z > 0 ==> x * x + y * y \<noteq> z * z"
bulwahn@41231
   309
quickcheck[exhaustive, size = 10, expect = counterexample]
bulwahn@41231
   310
quickcheck[random, size = 10]
bulwahn@41231
   311
oops
bulwahn@41231
   312
bulwahn@43734
   313
subsubsection {* floor and ceiling functions *}
bulwahn@43734
   314
bulwahn@43734
   315
lemma
bulwahn@43734
   316
  "floor x + floor y = floor (x + y :: rat)"
bulwahn@43734
   317
quickcheck[expect = counterexample]
bulwahn@43734
   318
oops
bulwahn@43734
   319
bulwahn@43734
   320
lemma
bulwahn@43734
   321
  "floor x + floor y = floor (x + y :: real)"
bulwahn@43734
   322
quickcheck[expect = counterexample]
bulwahn@43734
   323
oops
bulwahn@43734
   324
bulwahn@43734
   325
lemma
bulwahn@43734
   326
  "ceiling x + ceiling y = ceiling (x + y :: rat)"
bulwahn@43734
   327
quickcheck[expect = counterexample]
bulwahn@43734
   328
oops
bulwahn@43734
   329
bulwahn@43734
   330
lemma
bulwahn@43734
   331
  "ceiling x + ceiling y = ceiling (x + y :: real)"
bulwahn@43734
   332
quickcheck[expect = counterexample]
bulwahn@43734
   333
oops
bulwahn@43734
   334
bulwahn@43734
   335
bulwahn@42696
   336
subsection {* Examples with Records *}
bulwahn@42696
   337
bulwahn@42696
   338
record point =
bulwahn@42696
   339
  xpos :: nat
bulwahn@42696
   340
  ypos :: nat
bulwahn@42696
   341
bulwahn@42696
   342
lemma
bulwahn@42696
   343
  "xpos r = xpos r' ==> r = r'"
bulwahn@42696
   344
quickcheck[exhaustive, expect = counterexample]
bulwahn@42696
   345
quickcheck[random, expect = counterexample]
bulwahn@42696
   346
oops
bulwahn@42696
   347
bulwahn@42696
   348
datatype colour = Red | Green | Blue
bulwahn@42696
   349
bulwahn@42696
   350
record cpoint = point +
bulwahn@42696
   351
  colour :: colour
bulwahn@42696
   352
bulwahn@42696
   353
lemma
bulwahn@42696
   354
  "xpos r = xpos r' ==> ypos r = ypos r' ==> (r :: cpoint) = r'"
bulwahn@42696
   355
quickcheck[exhaustive, expect = counterexample]
bulwahn@42696
   356
quickcheck[random, expect = counterexample]
bulwahn@42696
   357
oops
bulwahn@42696
   358
bulwahn@42434
   359
subsection {* Examples with locales *}
bulwahn@42434
   360
bulwahn@42434
   361
locale Truth
bulwahn@42434
   362
bulwahn@42434
   363
context Truth
bulwahn@42434
   364
begin
bulwahn@42434
   365
bulwahn@42434
   366
lemma "False"
bulwahn@43909
   367
quickcheck[exhaustive, expect = no_counterexample]
bulwahn@42434
   368
oops
bulwahn@42434
   369
berghofe@14592
   370
end
bulwahn@42434
   371
bulwahn@42434
   372
interpretation Truth .
bulwahn@42434
   373
bulwahn@42434
   374
context Truth
bulwahn@42434
   375
begin
bulwahn@42434
   376
bulwahn@42434
   377
lemma "False"
bulwahn@43890
   378
quickcheck[exhaustive, expect = counterexample]
bulwahn@42434
   379
oops
bulwahn@42434
   380
bulwahn@42434
   381
end
bulwahn@42434
   382
bulwahn@42434
   383
end