Lightweight proof by reflection using a posteriori simulation of - PowerPoint PPT Presentation

Lightweight proof by reflection using a posteriori simulation of effectful computation Guillaume Claret 1 Lourdes del Carmen González Huesca 1 Yann Régis-Gianas 1 Beta Ziliani 2 lgonzale@pps.univ-paris-diderot.fr 1 PPS, team π r 2 (University Paris Diderot, CNRS, and INRIA) 2 Max Planck Institute for Software Systems (MPI-SWS) TYPES April 24, 2013 1 / 25

Lightweight proof by reflection using a posteriori simulation of effectful computation 2 / 25

Lightweight proof by reflection using a posteriori simulation of effectful computation 3 / 25

Running example How should we prove the following equivalence? H 1 : A 11 „ A 12 A 21 „ A 22 H 2 : . . . A n 1 „ A n 2 H n : A 1 A „ 4 / 25

Running example How should we prove the following equivalence? Manually using a script? H 1 : A 11 „ A 12 A 21 „ A 22 H 2 : . . . A n 1 „ A n 2 H n : A 1 A „ 4 / 25

Running example How should we prove the following equivalence? Using a decision procedure ? H 1 : A 11 „ A 12 A 21 „ A 22 H 2 : . . . A n 1 „ A n 2 H n : A 1 A „ 4 / 25

Running example : A decision procedure in pseudo-code let is_equivalent (hs, (i, j)) : bool = iter ( fun (i,j) -> union i j) hs; return (find i == find j) where " union i j merges the equivalence classes of i and j returns the unique representative of i find i 5 / 25

How can we put this decision procedure in work? 6 / 25

Recipe for a proof by reflection D R p P q : B D p R p P qq : bool R Original Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 7 / 25

Recipe for a proof by reflection D R p P q : B D p R p P qq : bool R Original Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 7 / 25

Recipe for a proof by reflection D R p P q : B D p R p P qq : bool R Original Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. p hs , p i , j qq : list p atom ˆ atom q ˆ p atom ˆ atom q where atom is a type with decidable equality 7 / 25

Recipe for a proof by reflection D R p P q : B D p R p P qq : bool R Original Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 2. Write an interpretation function I : B Ñ Prop. 7 / 25

Recipe for a proof by reflection D R p P q : B D p R p P qq : bool R Original Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 2. Write an interpretation function I : B Ñ Prop. I (hs, (i, j)) : Prop. 7 / 25

Recipe for a proof by reflection D R p P q : B D p R p P qq : bool R Original Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 2. Write an interpretation function I : B Ñ Prop. 3. Write the decision procedure D : B Ñ bool in Coq. 7 / 25

Recipe for a proof by reflection D R p P q : B D p R p P qq : bool R Original Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 2. Write an interpretation function I : B Ñ Prop. 3. Write the decision procedure D : B Ñ bool in Coq. D p hs , p i , j qq : bool . Critical: How should we implement union and find ? 7 / 25

Recipe for a proof by reflection D R p P q : B D p R p P qq : bool R Original Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 2. Write an interpretation function I : B Ñ Prop. 3. Write the decision procedure D : B Ñ bool in Coq. 4. Prove the soundness of D 7 / 25

Recipe for a proof by reflection D R p P q : B D p R p P qq : bool R Original Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 2. Write an interpretation function I : B Ñ Prop. 3. Write the decision procedure D : B Ñ bool in Coq. 4. Prove the soundness of D sound : @ x : B , D x “ true Ñ I x. if D p hs , p i , j qq “ true then a „ a 1 Critical: The development cost of this proof depends on the implementation choice for union and find . 7 / 25

Recipe for a proof by reflection D R p P q : B D p R p P qq : bool R sound Original Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 2. Write an interpretation function I : B Ñ Prop. 3. Write the decision procedure D : B Ñ bool in Coq. 4. Prove the soundness of D For a specific instance b “ R p P q , the proof-term for I b has the form: ` ` ˘˘ sound b refl_eq D p b q 7 / 25

Recipe for a proof by reflection D R p P q : B D p R p P qq : bool R sound Original Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 2. Write an interpretation function I : B Ñ Prop. 3. Write the decision procedure D : B Ñ bool in Coq. 4. Prove the soundness of D For a specific instance b “ R p P q , the proof-term for I b has the form: ` ` ˘˘ sound b refl_eq D p b q This term has type I b only if D b is convertible to true. 7 / 25

Original proof by reflection A certified decision procedure written in a total language is a robust tool for the proof developer. But, it has a high cost of development , often leading to simplifications destroying efficiency. 8 / 25

Recipe for a proof by reflection with an untrusted oracle D R p P q : B D p R p P qq : C in OCaml R Oracle Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 9 / 25

Recipe for a proof by reflection with an untrusted oracle D R p P q : B D p R p P qq : C in OCaml R Oracle Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 9 / 25

Recipe for a proof by reflection with an untrusted oracle D R p P q : B D p R p P qq : C in OCaml R Oracle Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 2. Write an interpretation function I : B Ñ Prop. 9 / 25

Recipe for a proof by reflection with an untrusted oracle D R p P q : B D p R p P qq : C in OCaml R Oracle Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 2. Write an interpretation function I : B Ñ Prop. 3. Write an (untrusted) oracle D in ML. 9 / 25

Recipe for a proof by reflection with an untrusted oracle D R p P q : B D p R p P qq : C in OCaml R Oracle Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 2. Write an interpretation function I : B Ñ Prop. 3. Write an (untrusted) oracle D in ML. D : B Ñ C Critical: D gives a certificate that must be checked. 9 / 25

Recipe for a proof by reflection with an untrusted oracle D R p P q : B D p R p P qq : C in OCaml R Oracle Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 2. Write an interpretation function I : B Ñ Prop. 3. Write an (untrusted) oracle D in ML. 4. Write a simple certificate checker in Coq. 9 / 25

Recipe for a proof by reflection with an untrusted oracle D R p P q : B D p R p P qq : C in OCaml R Oracle Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 2. Write an interpretation function I : B Ñ Prop. 3. Write an (untrusted) oracle D in ML. 4. Write a simple certificate checker in Coq. check : @ x : B , C Ñ bool 9 / 25

Recipe for a proof by reflection with an untrusted oracle D R p P q : B D p R p P qq : C in OCaml R Oracle Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 2. Write an interpretation function I : B Ñ Prop. 3. Write an (untrusted) oracle D in ML. 4. Write a simple certificate checker in Coq. 5. Prove the soundness of the checker 9 / 25

Recipe for a proof by reflection with an untrusted oracle D R p P q : B D p R p P qq : C in OCaml R sound check . check Oracle Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 2. Write an interpretation function I : B Ñ Prop. 3. Write an (untrusted) oracle D in ML. 4. Write a simple certificate checker in Coq. 5. Prove the soundness of the checker sound check : @ x : B , y : C , check x y “ true Ñ I x 9 / 25

Recipe for a proof by reflection with an untrusted oracle D R p P q : B D p R p P qq : C in OCaml R sound check . check Oracle Proof by Reflection P : Prop I p R p P qq : Prop ” conv ? : P ∆ : P 1. Define a type B for the targeted class of problems in Coq. 2. Write an interpretation function I : B Ñ Prop. 3. Write an (untrusted) oracle D in ML. 4. Write a simple certificate checker in Coq. 5. Prove the soundness of the checker For a specific instance b “ R p P q , a proof-term for I b has the form: ` ` ˘˘ sound check b D p b q refl_eq check D p b q 9 / 25