Haskell: Compiler as Theorem-Prover Greg Price ( price ) 2007 Nov 19 - - PowerPoint PPT Presentation

▶
haskell compiler as theorem prover
SMART_READER_LITE
LIVE PREVIEW

Haskell: Compiler as Theorem-Prover Greg Price ( price ) 2007 Nov 19 - - PowerPoint PPT Presentation

Mar 02, 2023 377 likes •873 views

Haskell: Compiler as Theorem-Prover Greg Price ( price ) 2007 Nov 19 code samples: http://cluedumps.mit.edu/wiki/2007/11-19 Greg Price ( price ) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 1 / 26 Software Transactional Memory 1

slide-1
SLIDE 1

Haskell: Compiler as Theorem-Prover

Greg Price (price) 2007 Nov 19 code samples: http://cluedumps.mit.edu/wiki/2007/11-19

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 1 / 26

slide-2
SLIDE 2

1

Software Transactional Memory

2

Protocol Types

3

More theorems

4

The Big Picture

5

References

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 2 / 26

slide-3
SLIDE 3

Software Transactional Memory

Concurrency: locking

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 4 / 26

slide-4
SLIDE 4

Software Transactional Memory

Concurrency: locking costly, deadlocks, bugs. Optimistic transactions, restarting

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 4 / 26

slide-5
SLIDE 5

Software Transactional Memory

Concurrency: locking costly, deadlocks, bugs. Optimistic transactions, restarting Worse bugs: void f() { begin_transaction(); if (x != y) launch_missiles(); end_transaction(); } void g() { begin_transaction(); x++; y++; end_transaction(); }

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 4 / 26

slide-6
SLIDE 6

Software Transactional Memory

Concurrency: locking costly, deadlocks, bugs. Optimistic transactions, restarting Worse bugs: void f() { begin_transaction(); if (x != y) launch_missiles(); end_transaction(); } void g() { begin_transaction(); x++; y++; end_transaction(); } Restart side effects?

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 4 / 26

slide-7
SLIDE 7

Software Transactional Memory

Concurrency: locking costly, deadlocks, bugs. Optimistic transactions, restarting Worse bugs: void f() { begin_transaction(); if (x != y) launch_missiles(); end_transaction(); } void g() { begin_transaction(); x++; y++; end_transaction(); } Restart side effects? & all the old bugs too

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 4 / 26

slide-8
SLIDE 8

Software Transactional Memory

Solution: f = atomically $ do xv <- readTVar x yv <- readTVar y if xv /= yv then launch_missiles_soon else return () g = atomically $ do xv <- readTVar x; writeTVar x (xv+1) yv <- readTVar y; writeTVar y (yv+1) (see example STMExample)

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 6 / 26

slide-9
SLIDE 9

Software Transactional Memory

Solution: f = atomically $ do xv <- readTVar x yv <- readTVar y if xv /= yv then launch_missiles_soon else return () g = atomically $ do xv <- readTVar x; writeTVar x (xv+1) yv <- readTVar y; writeTVar y (yv+1) (see example STMExample) can’t have (non-transactional) side effects

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 6 / 26

slide-10
SLIDE 10

Software Transactional Memory

Solution: f = atomically $ do xv <- readTVar x yv <- readTVar y if xv /= yv then launch_missiles_soon else return () g = atomically $ do xv <- readTVar x; writeTVar x (xv+1) yv <- readTVar y; writeTVar y (yv+1) (see example STMExample) can’t have (non-transactional) side effects no special compiler support (except runtime)

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 6 / 26

slide-11
SLIDE 11

Software Transactional Memory

Solution: f = atomically $ do xv <- readTVar x yv <- readTVar y if xv /= yv then launch_missiles_soon else return () g = atomically $ do xv <- readTVar x; writeTVar x (xv+1) yv <- readTVar y; writeTVar y (yv+1) (see example STMExample) can’t have (non-transactional) side effects no special compiler support (except runtime)

  • ther bugs ruled out too

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 6 / 26

slide-12
SLIDE 12

STM: Guaranteeing No Side Effects

pure

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 8 / 26

slide-13
SLIDE 13

STM: Guaranteeing No Side Effects

pure putStr "hello" :: IO ()

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 8 / 26

slide-14
SLIDE 14

STM: Guaranteeing No Side Effects

pure putStr "hello" :: IO () an IO action

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 8 / 26

slide-15
SLIDE 15

STM: Guaranteeing No Side Effects

pure putStr "hello" :: IO () an IO action sequenced: do { ...; f :: IO a; ... }

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 8 / 26

slide-16
SLIDE 16

STM: Guaranteeing No Side Effects

pure putStr "hello" :: IO () an IO action sequenced: do { ...; f :: IO a; ... } executed only through main: main :: IO () main = do putStr "Hello world!\n" launch_missiles

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 8 / 26

slide-17
SLIDE 17

STM: Guaranteeing No Side Effects

pure putStr "hello" :: IO () an IO action sequenced: do { ...; f :: IO a; ... } executed only through main: main :: IO () main = do putStr "Hello world!\n" launch_missiles ⇒ side effects only through type IO a

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 8 / 26

slide-18
SLIDE 18

STM: Guaranteeing No Side Effects

side effects only through type IO a

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 10 / 26

slide-19
SLIDE 19

STM: Guaranteeing No Side Effects

side effects only through type IO a atomically :: STM a -> IO a

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 10 / 26

slide-20
SLIDE 20

STM: Guaranteeing No Side Effects

side effects only through type IO a atomically :: STM a -> IO a newTVar :: a -> STM (TVar a) readTVar :: TVar a -> STM a writeTVar :: TVar a -> a -> STM ()

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 10 / 26

slide-21
SLIDE 21

STM: Guaranteeing No Side Effects

side effects only through type IO a atomically :: STM a -> IO a newTVar :: a -> STM (TVar a) readTVar :: TVar a -> STM a writeTVar :: TVar a -> a -> STM () do { ...; f :: STM a; ... } (same)

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 10 / 26

slide-22
SLIDE 22

1

Software Transactional Memory

2

Protocol Types

3

More theorems

4

The Big Picture

5

References

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 11 / 26

slide-23
SLIDE 23

Protocol Types

spec :: Spec ((Snd Int :+: Snd String) :->: End) IOChan a protocol spec

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 13 / 26

slide-24
SLIDE 24

Protocol Types

spec :: Spec ((Snd Int :+: Snd String) :->: End)

  • s

IOChan a protocol spec

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 13 / 26

slide-25
SLIDE 25

Protocol Types

spec :: Spec ((Snd Int :+: Snd String) :->: End)

  • s

IOChan a protocol spec accept spec request spec

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 13 / 26

slide-26
SLIDE 26

Protocol Types

spec :: Spec ((Snd Int :+: Snd String) :->: End)

  • s

IOChan a protocol spec accept spec :: (Extend M (ChanCap c s) e e’ n) => LinearT IO e e’ (LVar n) request spec :: (Dual s s’, Extend M (ChanCap c s’) e e’ n) => LinearT IO e e’ (LVar n)

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 13 / 26

slide-27
SLIDE 27

Protocol Types

spec :: Spec ((Snd Int :+: Snd String) :->: End)

  • s

IOChan a protocol spec accept spec :: (Extend M (ChanCap c s) e e’ n) => LinearT IO e e’ (LVar n) request spec :: (Dual s s’, Extend M (ChanCap c s’) e e’ n) => LinearT IO e e’ (LVar n) runLinearT (accept spec >>>= ...) :: IO a executes protocol exactly

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 13 / 26

slide-28
SLIDE 28

Protocol Types: Means of Proof

runLinearT :: LinearT IO Empty Empty a -> IO a

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 15 / 26

slide-29
SLIDE 29

Protocol Types: Means of Proof

runLinearT :: LinearT IO Empty Empty a -> IO a environments of capabilities

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 15 / 26

slide-30
SLIDE 30

Protocol Types: Means of Proof

runLinearT :: LinearT IO Empty Empty a -> IO a environments of capabilities send :: (Evolve n c (Snd a :->: x) e x e’) => LVar n -> a -> LinearT IO e e’ () recv :: (Evolve n c (Rcv a :->: x) e x e’) => LVar n -> LinearT IO e e’ a

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 15 / 26

slide-31
SLIDE 31

Protocol Types: Means of Proof

runLinearT :: LinearT IO Empty Empty a -> IO a environments of capabilities send :: (Evolve n c (Snd a :->: x) e x e’) => LVar n -> a -> LinearT IO e e’ () recv :: (Evolve n c (Rcv a :->: x) e x e’) => LVar n -> LinearT IO e e’ a sel1 :: (Evolve n c ((x1:+:x2):->:y) e (x1:->:y) e’) => LVar n -> LinearT IO e e’ ()

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 15 / 26

slide-32
SLIDE 32

Protocol Types: Generic Building Blocks

data T data F class Prop a instance Prop T instance Prop F

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 17 / 26

slide-33
SLIDE 33

Protocol Types: Generic Building Blocks

data T data F class Prop a instance Prop T instance Prop F class Prop b => Equal x y b | x y -> b

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 17 / 26

slide-34
SLIDE 34

Protocol Types: Generic Building Blocks

data T data F class Prop a instance Prop T instance Prop F class Prop b => Equal x y b | x y -> b data Z data S x class Nat a instance Nat Z instance Nat n => Nat (S n)

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 17 / 26

slide-35
SLIDE 35

Protocol Types: Generic Building Blocks

data T data F class Prop a instance Prop T instance Prop F class Prop b => Equal x y b | x y -> b data Z data S x class Nat a instance Nat Z instance Nat n => Nat (S n) instance Equal Z Z T instance Nat n => Equal (S n) Z F instance Nat n => Equal Z (S n) F instance (Nat n1, Nat n2, Equal n1 n2 b) => Equal (S n1) (S n2) b

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 17 / 26

slide-36
SLIDE 36

Protocol Types: Generic Building Blocks

data T data F class Prop a instance Prop T instance Prop F class Prop b => Equal x y b | x y -> b data Z data S x class Nat a instance Nat Z instance Nat n => Nat (S n) instance Equal Z Z T instance Nat n => Equal (S n) Z F instance Nat n => Equal Z (S n) F instance (Nat n1, Nat n2, Equal n1 n2 b) => Equal (S n1) (S n2) b also lists, environments, many other things

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 17 / 26

slide-37
SLIDE 37

Other popular theorems

type-checked physical dimensions: newton = kg <*> m </> s </> s thrust = dm 12537.2 <*> newton dm 1 <*> m <+> dm 1 <*> m</>s

  • - error!

(see example Dimensional)

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 19 / 26

slide-38
SLIDE 38

Other popular theorems

type-checked physical dimensions: newton = kg <*> m </> s </> s thrust = dm 12537.2 <*> newton dm 1 <*> m <+> dm 1 <*> m</>s

  • - error!

(see example Dimensional) mutable state on a leash: runST :: (forall s. ST s a) -> a

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 19 / 26

slide-39
SLIDE 39

Other popular theorems

type-checked physical dimensions: newton = kg <*> m </> s </> s thrust = dm 12537.2 <*> newton dm 1 <*> m <+> dm 1 <*> m</>s

  • - error!

(see example Dimensional) mutable state on a leash: runST :: (forall s. ST s a) -> a “theorems for free”: if maybemap :: (a -> b) -> [a] -> [b] then maybemap f == maybemap id . map f

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 19 / 26

slide-40
SLIDE 40

1

Software Transactional Memory

2

Protocol Types

3

More theorems

4

The Big Picture

5

References

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 20 / 26

slide-41
SLIDE 41

A Proof

A ∧ B ⇒ B ∧ A

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 21 / 26

slide-42
SLIDE 42

A Proof

{} ⊢ A ∧ B ⇒ B ∧ A

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 21 / 26

slide-43
SLIDE 43

A Proof

{A ∧ B} ⊢ B ∧ A {} ⊢ A ∧ B ⇒ B ∧ A

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 21 / 26

slide-44
SLIDE 44

A Proof

{A ∧ B} ⊢ A ∧ B {A ∧ B} ⊢ B {A ∧ B} ⊢ A ∧ B {A ∧ B} ⊢ A {A ∧ B} ⊢ B ∧ A {} ⊢ A ∧ B ⇒ B ∧ A

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 21 / 26

slide-45
SLIDE 45

A Proof

{A ∧ B} ⊢ A ∧ B

Id

{A ∧ B} ⊢ B

∧E2

{A ∧ B} ⊢ A ∧ B

Id

{A ∧ B} ⊢ A

∧E1

{A ∧ B} ⊢ B ∧ A

∧I

{} ⊢ A ∧ B ⇒ B ∧ A

⇒I

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 21 / 26

slide-46
SLIDE 46

A Proof (the same one)

λx. pair (snd x) (fst x)

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 23 / 26

slide-47
SLIDE 47

A Proof (the same one)

{x : A × B} ⊢ x : A × B

Id

{x : A × B} ⊢ (snd x) : B

×E2

{x : A × B} ⊢ x : A × B

Id

{x : A × B} ⊢ (fst x) : A

×E1

{x : A × B} ⊢ (pair (snd x)(fst x)) : B × A

×I

{} ⊢ (λx. pair (snd x)(fst x)) : A × B → B × A

→I

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 24 / 26

slide-48
SLIDE 48

References

all at http://cluedumps.mit.edu/wiki/2007/11-19 STM: Harris, Marlow, Peyton Jones, Herlihy 2005; Peyton Jones “Beautiful Concurrency” for intro protocol types: Jesse Tov, unpublished. Some of the ideas in Oleg Kiselyov’s HList. “theorems for free”: Phil Wadler, 1989. Now ∃ a web app.

Greg Price (price) () Haskell: Compiler as Theorem-Prover 2007 Nov 19 26 / 26