A proof checking kernel for the -calculus modulo Mathieu - - PowerPoint PPT Presentation

▶
a proof checking kernel for the calculus modulo
SMART_READER_LITE
LIVE PREVIEW

A proof checking kernel for the -calculus modulo Mathieu - - PowerPoint PPT Presentation

Dec 25, 2023 219 likes •819 views

A proof checking kernel for the -calculus modulo Mathieu Boespflug, cole Polytechnique PhD defense, 18 january 2011 Funded by Pythia of Delphi Pythia of Delphi True False Proof implies truth. 1 1 For any reasonable notion

slide-1
SLIDE 1

A proof checking kernel for the λΠ-calculus modulo

Mathieu Boespflug, École Polytechnique ☙ PhD defense, 18 january 2011 ☙ Funded by

slide-2
SLIDE 2

Pythia of Delphi

slide-3
SLIDE 3

Pythia of Delphi

True False

slide-4
SLIDE 4

Proof implies truth.

1

1 For any reasonable notion of proof.

slide-5
SLIDE 5

Formal systems

Example ☙ The language of formulae words ☙ The set of axioms (or assumptions) a-z,ǫ ☙ The language of proofs P is an axiom (ax) P is a palindrome P is a palindrome (ext) xP x is a palindrome P is a palindrome Q is a palindrome (concat) QP Q is a palindrome ☙ Theorems are formulae that have proofs.

slide-6
SLIDE 6

Palindromes: example

d is an axiom (ax) t is a palindrome (ext) rtr is a palindrome (ext) artra is a palindrome (ext) tartrat is a palindrome (ext) etartrate is a palindrome (ext) detartrated is a palindrome

slide-7
SLIDE 7

Palindromes: example

t ∈ Γ (ax) Γ ⊢ t (ext) Γ ⊢ rtr (ext) Γ ⊢ artra (ext) Γ ⊢ tartrat (ext) Γ ⊢ etartrate (ext) Γ ⊢ detartrated d ∈ Γ (ax) Γ ⊢ d (ext) Γ ⊢ ada (ext) Γ ⊢ radar (concat) Γ ⊢ radardetartratedradar

slide-8
SLIDE 8

Tree of proofs

...

slide-9
SLIDE 9

Tree of proofs

...

slide-10
SLIDE 10

Proof reduction

Γ ⊢ P Γ ⊢ Q (ext) Γ ⊢ xQx (concat) Γ ⊢ xQxP xQx − → Γ ⊢ P (ext) Γ ⊢ xP x Γ ⊢ Q (concat) Γ ⊢ QxP xQ (ext) Γ ⊢ xQxP xQx

slide-11
SLIDE 11

Proof reduction: example

t ∈ Γ (ax) Γ ⊢ t (ext) Γ ⊢ rtr (ext) Γ ⊢ artra (ext) Γ ⊢ tartrat (ext) Γ ⊢ etartrate (ext) Γ ⊢ detartrated d ∈ Γ (ax) Γ ⊢ d (ext) Γ ⊢ ada (ext) Γ ⊢ radar (concat) Γ ⊢ radardetartratedradar

slide-12
SLIDE 12

Proof reduction: example

t ∈ Γ (ax) Γ ⊢ t (ext) Γ ⊢ rtr (ext) Γ ⊢ artra (ext) Γ ⊢ tartrat (ext) Γ ⊢ etartrate (ext) Γ ⊢ detartrated (ext) Γ ⊢ rdetartratedr d ∈ Γ (ax) Γ ⊢ d (ext) Γ ⊢ ada (concat) Γ ⊢ adardetartratedrada (ext) Γ ⊢ radardetartratedradar

slide-13
SLIDE 13

Proof reduction: example

t ∈ Γ (ax) Γ ⊢ t (ext) Γ ⊢ rtr (ext) Γ ⊢ artra (ext) Γ ⊢ tartrat (ext) Γ ⊢ etartrate (ext) Γ ⊢ detartrated (ext) Γ ⊢ rdetartratedr (ext) Γ ⊢ ardetartratedra d ∈ Γ (ax) Γ ⊢ d (concat) Γ ⊢ dardetartratedrad (ext) Γ ⊢ adardetartratedrada (ext) Γ ⊢ radardetartratedradar

slide-14
SLIDE 14

Proof reduction: example

t ∈ Γ (ax) Γ ⊢ t (ext) Γ ⊢ rtr (ext) Γ ⊢ artra (ext) Γ ⊢ tartrat (ext) Γ ⊢ etartrate (ext) Γ ⊢ detartrated (ext) Γ ⊢ rdetartratedr (ext) Γ ⊢ ardetartratedra (ext) Γ ⊢ dardetartratedrad (ext) Γ ⊢ adardetartratedrada (ext) Γ ⊢ radardetartratedradar

slide-15
SLIDE 15

Proof reduction: example

n t ∈ Γ (ax) Γ ⊢ t (ext) Γ ⊢ rtr (ext) Γ ⊢ artra (ext) Γ ⊢ tartrat (ext) Γ ⊢ etartrate (ext) Γ ⊢ detartrated (ext) Γ ⊢ rdetartratedr (ext) Γ ⊢ ardetartratedra (ext) Γ ⊢ dardetartratedrad (ext) Γ ⊢ adardetartratedrada (ext) Γ ⊢ radardetartratedradar 2n + 1 ☙ Proof in normal form. ☙ Proof always ends with an (ax)

  • r (ext) rule.

☙ Can compute with proofs. Γ, radar ⊢ radar

slide-16
SLIDE 16

Modus Ponens Γ ⊢ A ⇒ B Γ ⊢ A Γ ⊢ B

slide-17
SLIDE 17

Computation with proofs of logical formulae

Γ ⊢ A ⇒ B Γ ⊢ A Γ ⊢ B Γ,A ⊢ B Γ ⊢ A ⇒ B Computation Rule: Γ,A ⊢ B Γ ⊢ A ⇒ B Γ ⊢ A Γ ⊢ B − → Γ ⊢ B

slide-18
SLIDE 18

Modulo --- formula rewriting

Proofs ← → Programs Formulae ← → Types ☙ Want to reason on proofs/programs. ☙ If we can write proofs inside formulae then we should be able to compute inside formulae. ☙ Computation is a means to reduce proof effort (e.g. Four Colour Theorem, reflexive tactics).

slide-19
SLIDE 19

Dedukti

Dedukti (λΠ modulo)

slide-20
SLIDE 20

Dedukti

Dedukti (λΠ modulo) Coq HOL PVS Epigram Isabelle Agda ... ...

slide-21
SLIDE 21

Thesis Analysis, transformation and compilation of programs is a simple and effective method for checking proofs.

slide-22
SLIDE 22

Conversion test Γ ⊢ A A ≡βR B Γ ⊢ B

slide-23
SLIDE 23

Normalization by Evaluation

terms model

interpretation ⟦·⟧ reification ↓ · 1. ∀M .∀N . M ≡ N ⇒ ⟦M ⟧ = ⟦N ⟧ (soundness), 2. ∀M . ↓ ⟦M ⟧ = M if M is in normal form (reproduction).

slide-24
SLIDE 24

From program to data x = B x λx. M = Lam (λx. M ) M · N = App M N

slide-25
SLIDE 25

Data evaluation

x = B x λx. M = Lam (λx. M ) M · N = App M N

eval (B x) = x eval (Lam f ) = λx. eval (f x) eval (App M N ) = app (eval M ) (eval N ) app f N = f N

slide-26
SLIDE 26

Evaluation to a residualizing semantics

x = B x λx. M = Lam (λx. M ) M · N = App M N

eval (B x) = x eval (Lam f ) = Lam (λx. eval (f x)) eval (App M N ) = app (eval M ) (eval N ) app (Lam f ) N = f N app M N = App M N

slide-27
SLIDE 27

Interpretation

x = B x λx. M = Lam (λx. M ) M · N = App M N eval (B x) = x eval (Lam f ) = Lam (λx. eval (f x)) eval (App M N ) = app (eval M ) (eval N ) app (Lam f ) N = f N app M N = App M N

⟦M ⟧ = eval M .

slide-28
SLIDE 28

Partial evaluation of eval ◦ · ⟦x⟧ = x ⟦λx. M ⟧ = Lam (λx. ⟦M ⟧) ⟦M · N ⟧ = app ⟦M ⟧ ⟦N ⟧

slide-29
SLIDE 29

Reification

⟦x⟧ = x ⟦λx. M ⟧ = Lam (λx. ⟦M ⟧) ⟦M · N ⟧ = app ⟦M ⟧ ⟦N ⟧

↓n F m = m ↓n Lam f = λn. ↓n+1 (f (F n)) ↓n App M N = (↓n M )·(↓n N )

slide-30
SLIDE 30

Rewrite Rules and extensions

⟦_⟧ = _ ⟦x⟧ = x ⟦c P 1 . . . P n⟧ = App (. . .(App (Con ˆ c) ⟦P 1⟧). . .) ⟦P n⟧       c P 11 . . . P 1n − → M 1 . . . . . . c P m1 . . . P mn − → M m       = fix (λc. λx1. · · ·λxn. case (x1, . . ., xn) of (⟦P 11⟧, . . ., ⟦P 1n⟧) → ⟦M 1⟧ . . . . . . (⟦P m1⟧, . . ., ⟦P mn⟧) → ⟦M m⟧ default → App (. . .(App (Con ˆ c) x1). . .) xn) ☙ Untyped NbE extends naturally to residual forms and reduction rules of the Calculus of Constructions.

slide-31
SLIDE 31

Optimizations

☙ Removal of intermediate closure allocation by standard eval/apply transformation. ☙ Constructors of object-level datatypes interpreted as metalevel constructors. ☙ Native pattern matching.

slide-32
SLIDE 32

Micro benchmarks

append even sort exp38 queens 1 2 3 ahn singlearity evalapply constructors ucea whnf

slide-33
SLIDE 33

Synthetic benchmark

Cooper n = 5 50 100 n/a Standard VM NbE NbE accu

slide-34
SLIDE 34

Context-free typing

slide-35
SLIDE 35

An alternative interpretation ⟦x⟧ = x ⟦λx. M ⟧ = Lam (λx. ⟦M ⟧) ⟦M · N ⟧ = App ⟦M ⟧ ⟦N ⟧

slide-36
SLIDE 36

Dependent product elimination Γ ⊢ M : Πx : A. B Γ ⊢ N : A (app) Γ ⊢ M N : {N /x}B

slide-37
SLIDE 37

Dependent product elimination

Γ ⊢ M : Πx : A. B Γ ⊢ N : A (app) Γ ⊢ M N : {N /x}B

Γ ⊢ M : Pi A f Γ ⊢ N : A (app-ho) Γ ⊢ M N : f N

☙ Easy implementation of capture avoiding substitution.

slide-38
SLIDE 38

Dependent product introduction ⟦λx. M ⟧ = Lam (λx. ⟦M ⟧)

  • f
slide-39
SLIDE 39

Dependent product introduction ⟦λx. M ⟧ = Lam (λx. ⟦M ⟧)

  • f
slide-40
SLIDE 40

Dependent product introduction f (Var n)

slide-41
SLIDE 41

Dependent product introduction f [n : A]

slide-42
SLIDE 42

Dependent product introduction Γ,x : A ⊢ M : B (abs) Γ ⊢ λx : A. M : Πx : A. B

slide-43
SLIDE 43

Dependent product introduction

Γ,x : A ⊢ M : B (abs) Γ ⊢ λx : A. M : Πx : A. B

⊢ M : f [n : A] (abs-ho) ⊢ Lam A f : Pi A f

☙ Drop explicit context in judgements.

slide-44
SLIDE 44

Towards a LCF style proof checker for dependently typed theories

☙ Type decorated variable occurrences in HOL. ☙ Proofs checked by construction. ☙ Allows cheap combination of proofs. ☙ No context — no checking that contexts are compatible. Example: Γ ⊢ M : Πx : A. B Γ′ ⊢ N : A′ Γ ⊢ {N /x}B

slide-45
SLIDE 45

Towards a LCF style proof checker for dependently typed theories

☙ Type decorated variable occurrences in HOL. ☙ Proofs checked by construction. ☙ Allows cheap combination of proofs. ☙ No context — no checking that contexts are compatible. Example: Γ ⊢ M : Πx : A. B Γ′ ⊢ N : A′ Γ ⊢ {N /x}B

slide-46
SLIDE 46

A purely functional kernel

☙ Proof checked by construction means no need for global registry of checked proofs. ☙ No state during proof checking.

slide-47
SLIDE 47

A purely functional kernel

☙ Proof checked by construction means no need for global registry of checked proofs. ☙ No state during proof checking.

  • t
  • t

t = ◦

slide-48
SLIDE 48

A purely functional kernel

☙ Proof checked by construction means no need for global registry of checked proofs. ☙ No state during proof checking.

  • [ ◦
  • : A]
slide-49
SLIDE 49

Managing dual interpretations

slide-50
SLIDE 50

Code explosion: example a1 (a2 (a3 (a4 (a5 (a6 (a7 a8))))))

slide-51
SLIDE 51

Recuperating sharing

[ [ [x] ] ]ρ = ρ(x) si x ∈ dom(ρ). [ [ [s] ] ]ρ = s, s [ [ [λx : A. M ] ] ]ρ = Let [ [ [A] ] ]ρ (λy. Lam ˆ y (λx. [ [ [M ] ] ]ρ[x→x]), Lam (λx. ⟦M ⟧)) [ [ [Πx : A. B] ] ]ρ = Let [ [ [A] ] ]ρ (λy. Pi ˆ y (λx. [ [ [B] ] ]ρ[x→x]), Pi ˇ y (λx. ⟦B⟧)) [ [ [M N ] ] ]ρ = Let [ [ [N ] ] ]ρ (λx. Let [ [ [M ] ] ]ρ (λy. App ˆ x ˆ y, app ˇ x ˇ y))

slide-52
SLIDE 52

Connecting subterms to their code

slide-53
SLIDE 53

Connecting subterms to their code

  • λ

λ

  • λ

λ

slide-54
SLIDE 54

Connecting subterms to their code

  • λ

λ

  • λ

λ

slide-55
SLIDE 55

Lambda-lifting

  • λ

λ

  • λ

λ

slide-56
SLIDE 56

Lambda-lifting

  • λ

λ

  • λ

λ

slide-57
SLIDE 57

Final words

slide-58
SLIDE 58

Proof checking by program analysis, transformation and compilation is a cheap and effective method for checking proofs.

slide-59
SLIDE 59

Future work

☙ More clever shortcutting of normalization. ☙ Development of more embeddings in the λΠ-calculus modulo. ☙ Bootstrap of core type checker.