Mechanizing Meta-Theory in Beluga Brigitte Pientka School of - - PowerPoint PPT Presentation

▶
mechanizing meta theory in beluga
SMART_READER_LITE
LIVE PREVIEW

Mechanizing Meta-Theory in Beluga Brigitte Pientka School of - - PowerPoint PPT Presentation

Jan 27, 2024 27 likes •687 views

Introduction Beluga:Design and implementation Mechanizing Meta-Theory in Beluga Brigitte Pientka School of Computer Science McGill University Montreal, Canada B. Pientka Mechanizing Meta-Theory in Beluga 1 / 35 Introduction Beluga:Design

slide-1
SLIDE 1

Introduction Beluga:Design and implementation

Mechanizing Meta-Theory in Beluga

Brigitte Pientka School of Computer Science McGill University Montreal, Canada

  • B. Pientka

Mechanizing Meta-Theory in Beluga 1 / 35

slide-2
SLIDE 2

Introduction Beluga:Design and implementation

Mechanizing formal systems and proofs: How and Why?

  • B. Pientka

Mechanizing Meta-Theory in Beluga 2 / 35

slide-3
SLIDE 3

Introduction Beluga:Design and implementation

Mechanizing formal systems and proofs: How and Why?

  • Formal systems (given via axioms and inference rules) play an important

role when designing languages and more generally ensure that software are reliable, safe, and trustworthy.

  • Proofs (that a given property is satisfied) are becoming pervasive and an

integral part of certified software. (see: CompCert, DeepSpec, RustBelt, Sel4, Cogent)

  • B. Pientka

Mechanizing Meta-Theory in Beluga 2 / 35

slide-4
SLIDE 4

Introduction Beluga:Design and implementation

Mechanizing formal systems and proofs: How and Why?

  • Formal systems (given via axioms and inference rules) play an important

role when designing languages and more generally ensure that software are reliable, safe, and trustworthy.

  • Proofs (that a given property is satisfied) are becoming pervasive and an

integral part of certified software. (see: CompCert, DeepSpec, RustBelt, Sel4, Cogent)

Program

(in Assembler, C, ML, Java, Rust, ...)

Properties:

– Memory/Type Safety: Prog. doesn’t crash – Contextual Equivalence: Two programs are indistinguishable in any valid program context – Bisimulation: Two systems behave the same

Meta-Theory

  • B. Pientka

Mechanizing Meta-Theory in Beluga 2 / 35

slide-5
SLIDE 5

Introduction Beluga:Design and implementation

Challenges in Establishing Formal Guarantees

  • B. Pientka

Mechanizing Meta-Theory in Beluga 3 / 35

slide-6
SLIDE 6

Introduction Beluga:Design and implementation

Challenges in Establishing Formal Guarantees

  • Costly
  • B. Pientka

Mechanizing Meta-Theory in Beluga 3 / 35

slide-7
SLIDE 7

Introduction Beluga:Design and implementation

Challenges in Establishing Formal Guarantees

  • Costly
  • Large size of formal developments
  • CompCert: 4,400 lines of compiler code vs 28,000 lines of verification
  • A specification of dependent Haskel [ICFP’17]: 17K Coq code + 13K

generated code from Ott Spec.; 1.4K Ott Specification;

  • B. Pientka

Mechanizing Meta-Theory in Beluga 3 / 35

slide-8
SLIDE 8

Introduction Beluga:Design and implementation

Challenges in Establishing Formal Guarantees

  • Costly
  • Large size of formal developments
  • CompCert: 4,400 lines of compiler code vs 28,000 lines of verification
  • A specification of dependent Haskel [ICFP’17]: 17K Coq code + 13K

generated code from Ott Spec.; 1.4K Ott Specification;

  • Low-level representations (variables are modelled via de Bruijn indices)
  • D. Hirschkoff [TPHOLs’97]: Bisimulation Proofs for the π-calculus in

Coq (600 out of 800 lemmas are infrastructural)

  • Ambler and Crole [TPHOLs’99]: Precongruence of bisimulation for

PCFL (≈ 160 infrastructural lemmas about de Brujn representation;main lemmas ≈ 34)

  • J. Kaiser et. al [FSCD’17]: Relating System F and λ2 (PTS)

de Bruijn over 1K lines of infrastructural code in Coq; over 500 lines in Abella; about 100 in Beluga

  • B. Pientka

Mechanizing Meta-Theory in Beluga 3 / 35

slide-9
SLIDE 9

Introduction Beluga:Design and implementation

Challenges in Establishing Formal Guarantees

  • Costly
  • Large size of formal developments
  • CompCert: 4,400 lines of compiler code vs 28,000 lines of verification
  • A specification of dependent Haskel [ICFP’17]: 17K Coq code + 13K

generated code from Ott Spec.; 1.4K Ott Specification;

  • Low-level representations (variables are modelled via de Bruijn indices)
  • D. Hirschkoff [TPHOLs’97]: Bisimulation Proofs for the π-calculus in

Coq (600 out of 800 lemmas are infrastructural)

  • Ambler and Crole [TPHOLs’99]: Precongruence of bisimulation for

PCFL (≈ 160 infrastructural lemmas about de Brujn representation;main lemmas ≈ 34)

  • J. Kaiser et. al [FSCD’17]: Relating System F and λ2 (PTS)

de Bruijn over 1K lines of infrastructural code in Coq; over 500 lines in Abella; about 100 in Beluga

  • Scalability, reusability, maintainability, automation
  • B. Pientka

Mechanizing Meta-Theory in Beluga 3 / 35

slide-10
SLIDE 10

Introduction Beluga:Design and implementation

Proofs: The tip of the iceberg

“We may think of [the] proof as an iceberg. In the top of it, we find what we usually consider the real proof; underwater, the most of the matter, consisting of all mathematical preliminaries a reader must know in order to understand what is going on.”

  • S. Berardi [1990]
  • B. Pientka

Mechanizing Meta-Theory in Beluga 4 / 35

slide-11
SLIDE 11

Introduction Beluga:Design and implementation

Proofs: The tip of the iceberg

Main Proof E i g e n v a r i a b l e s Hypothesis Variables Context Renaming Derivation Tree Substitution Scope Binding

“We may think of [the] proof as an iceberg. In the top of it, we find what we usually consider the real proof; underwater, the most of the matter, consisting of all mathematical preliminaries a reader must know in order to understand what is going on.”

  • S. Berardi [1990]
  • B. Pientka

Mechanizing Meta-Theory in Beluga 5 / 35

slide-12
SLIDE 12

Introduction Beluga:Design and implementation

Question

What are good meta-languages to program and reason with formal systems and proofs?

“The motivation behind the work in very-high-level languages is to ease the programming task by providing the programmer with a language containing primitives or abstractions suitable to his problem area. The programmer is then able to spend his effort in the right place; he concentrates on solving his problem, and the resulting program will be more reliable as a result. Clearly, this is a worthwhile goal.”

  • B. Liskov [1974]
  • B. Pientka

Mechanizing Meta-Theory in Beluga 6 / 35

slide-13
SLIDE 13

Introduction Beluga:Design and implementation

Above and Below the Surface

Beluga: Dependently typed Programming and Proof Environment

Main Proof E i g e n v a r i a b l e s Hypothesis Context Variables Renaming Derivation Tree Substitution Scope Binding Contextual LF Functional Programmming with Indexed Types

  • Below the surface: Support for key concepts based on Contextual LF
  • Above the surface: (Co)Inductive Proofs = (Co)Recursive Programs using

(Co)pattern Matching with built-in index language of Contextual LF objects

  • B. Pientka

Mechanizing Meta-Theory in Beluga 7 / 35

slide-14
SLIDE 14

Introduction Beluga:Design and implementation

Design of Beluga

  • Top : Functional programming with indexed (co)data types

[POPL’08,POPL’12,POPL’13,ICFP’16] On paper proof In Beluga [IJCAR’10,CADE’15] Case analysis of inputs Case analysis via pattern matching Inversion Pattern matching using let-expression Observations on output Case analysis via copattern matching (Co)Induction hypothesis (Co)Recursive call

  • Bottom: Contextual LF

Well-formed derivations Dependent types Renaming,Substitution α-renaming, β-reduction in LF Well-scoped derivation Contextual types and objects [TOCL’08] Context Context schemas Properties of contexts Typing for schemas (weakening, uniqueness) Simultaneous Substitutions Substitution type [LFMTP’13,15] (composition, identity)

  • B. Pientka

Mechanizing Meta-Theory in Beluga 8 / 35

slide-15
SLIDE 15

Introduction Beluga:Design and implementation

This Talk

Design and implementation of Beluga

  • Introduction
  • Example: Proof by logical relation
  • Writing a proof in Beluga . . .
  • Conclusion and curent work

“The limits of my language mean the limits of my world.”

  • L. Wittgenstein
  • B. Pientka

Mechanizing Meta-Theory in Beluga 9 / 35

slide-16
SLIDE 16

Introduction Beluga:Design and implementation

This Talk

Design and implementation of Beluga

  • Introduction
  • Example: Proof by logical relations
  • Writing a proof in Beluga . . .
  • Conclusion and curent work

“The limits of my language mean the limits of my world.”

  • L. Wittgenstein
  • B. Pientka

Mechanizing Meta-Theory in Beluga 9 / 35

slide-17
SLIDE 17

Introduction Beluga:Design and implementation

Simply Typed Lambda-calculus (Gentzen-style)

Types A, B::= i Terms M, N ::= x | c | A ⇒ B | lam x.M | app M N

Evaluation Judgment: M − → M′ read as “M steps to M′”

app (lam x.M) N − → [N/x]M s/beta M − → M s/refl M − → M′ app M N − → app M′ N s/app M − → M′ M′ − → N M − → N s/trans

  • B. Pientka

Mechanizing Meta-Theory in Beluga 10 / 35

slide-18
SLIDE 18

Introduction Beluga:Design and implementation

Simply Typed Lambda-calculus (Gentzen-style)

Types A, B::= i Terms M, N ::= x | c | A ⇒ B | lam x.M | app M N

Evaluation Judgment: M − → M′ read as “M steps to M′”

app (lam x.M) N − → [N/x]M s/beta M − → M s/refl M − → M′ app M N − → app M′ N s/app M − → M′ M′ − → N M − → N s/trans

Typing Judgment: M : A read as “M has type A” (Gentzen-style)

c : i const x : A u . . . M : B lam x.M : A ⇒ B lamx,u M : A ⇒ B N : A app M N : B app

  • B. Pientka

Mechanizing Meta-Theory in Beluga 10 / 35

slide-19
SLIDE 19

Introduction Beluga:Design and implementation

Simply Typed Lambda-calculus with Contexts

Types and Terms

Types A, B::= i Terms M, N ::= x | c | A ⇒ B | lam x.M | app M N

Evaluation Judgment: M − → M′ read as “M steps to M′”

app (lamx.M) N − → [N/x]M s/beta M − → M s/refl M − → M′ app M N − → app M′ N s/app M − → M′ M′ − → N M − → N s/trans

Typing Judgment: Γ ⊢ M : A read as “M has type A in context Γ”

x : A ∈ Γ Γ ⊢ x : A Γ, x : A ⊢M : B Γ ⊢lam x.M : A ⇒ B lamx Γ ⊢M : A ⇒ B Γ ⊢N A Γ ⊢app M N : B app Context Γ ::= · | Γ, x : A We are introducing the variable x together with the assumption x : A

  • B. Pientka

Mechanizing Meta-Theory in Beluga 11 / 35

slide-20
SLIDE 20

Introduction Beluga:Design and implementation

Weak Normalization for Simply Typed Lambda-calculus

  • B. Pientka

Mechanizing Meta-Theory in Beluga 12 / 35

slide-21
SLIDE 21

Introduction Beluga:Design and implementation

Weak Normalization for Simply Typed Lambda-calculus

Theorem If ⊢ M : A then M halts, i.e. there exists a value V s.t. M − →∗ V .

  • B. Pientka

Mechanizing Meta-Theory in Beluga 12 / 35

slide-22
SLIDE 22

Introduction Beluga:Design and implementation

Weak Normalization for Simply Typed Lambda-calculus

Theorem If ⊢ M : A then M halts, i.e. there exists a value V s.t. M − →∗ V . Proof. 1 Define reducibility candidate RA Ri = {M | M halts} RA⇒B = {M | M halts and ∀N ∈ RA, (app M N) ∈ RB} 2 If M ∈ RA then M halts. 3 Backwards closed: If M′ ∈ RA and M − → M′ then M ∈ RA. 4 Fundamental Lemma: If ⊢ M : A then M ∈ RA. (Requires a generalization)

  • B. Pientka

Mechanizing Meta-Theory in Beluga 12 / 35

slide-23
SLIDE 23

Introduction Beluga:Design and implementation

Generalization of Fundamental Lemma

Lemma (Main lemma) If D : Γ ⊢ M : A and σ ∈ RΓ then [σ]M ∈ RA. where σ ∈ RΓ is defined as: · ∈ R· σ ∈ RΓ N ∈ RA (σ, N/x) ∈ RΓ,x:A

  • B. Pientka

Mechanizing Meta-Theory in Beluga 13 / 35

slide-24
SLIDE 24

Introduction Beluga:Design and implementation

Generalization of Fundamental Lemma

Lemma (Main lemma) If D : Γ ⊢ M : A and σ ∈ RΓ then [σ]M ∈ RA. Proof. Case D = D1 Γ, x:A ⊢ M : B Γ ⊢ lam x.M : A ⇒ B lam [σ](lam x.M) = lam x.([σ, x/x]M) by properties of substitution

halts (lam x.[σ, x/x]M)

since it is a value Suppose N ∈ RA. [σ, N/x]M ∈ RB by I.H. on D1 since σ ∈ RΓ [N/x][σ, x/x]M ∈ RB by properties of substitution app (lam x. [σ, x/x]M) N ∈ RB by Backwards closure Hence [σ](lam x.M) ∈ RA⇒B by definition

  • B. Pientka

Mechanizing Meta-Theory in Beluga 14 / 35

slide-25
SLIDE 25

Introduction Beluga:Design and implementation

Challenging Benchmark

“I discovered that the core part of the proof (here proving lemmas about CR) is fairly straightforward and only requires a good understanding of the paper version. However, in completing the proof I observed that in certain places I had to invest much more work than expected, e.g. proving lemmas about substitution and weakening.”

  • T. Altenkirch [TLCA’93]
  • B. Pientka

Mechanizing Meta-Theory in Beluga 15 / 35

slide-26
SLIDE 26

Introduction Beluga:Design and implementation

Challenging Benchmark

“I discovered that the core part of the proof (here proving lemmas about CR) is fairly straightforward and only requires a good understanding of the paper version. However, in completing the proof I observed that in certain places I had to invest much more work than expected, e.g. proving lemmas about substitution and weakening.”

  • T. Altenkirch [TLCA’93]
  • B. Pientka

Mechanizing Meta-Theory in Beluga 15 / 35

slide-27
SLIDE 27

Introduction Beluga:Design and implementation

This Talk

Design and implementation of Beluga

  • Introduction
  • Example: Proof by logical relations
  • Writing a proof in Beluga . . .
  • Conclusion and curent work
  • B. Pientka

Mechanizing Meta-Theory in Beluga 16 / 35

slide-28
SLIDE 28

Introduction Beluga:Design and implementation

Step 1: Represent Types and Lambda-terms in LF

Types A, B::= i Terms M, N ::= x | c | A ⇒ B | lam x.M | app M N

Typing rules

c : i const x : A u . . . M : B lam x.M : A ⇒ B lamx M : A ⇒ B N : A app M N : B app

LF representation in Beluga

LF tp:type = | i: tp | arr: tp → tp → tp; LF tm: tp → type = | c : tm i | lam:(tm A → tm B) → tm (arr A B) | app: tm (arr A B) → tm A → tm B;

  • Higher-order abstract syntax (HOAS) to represent variabe binding

(lam x.app (lam y.y) x) is represented as (lam λx. app (lam λy.y) x).

  • Inheriting α-renaming and single substitutions (β-reduction) from LF
  • B. Pientka

Mechanizing Meta-Theory in Beluga 17 / 35

slide-29
SLIDE 29

Introduction Beluga:Design and implementation

Step 1: Encoding Evaluation in LF

Evaluation Judgment: M − → M′ read as “M steps to M′”

app (lam x.M) N − → [N/x]M s/beta M − → M s/refl M − → M′ app M N − → app M′ N s/app M − → M′ M′ − → N M − → N s/trans

  • B. Pientka

Mechanizing Meta-Theory in Beluga 18 / 35

slide-30
SLIDE 30

Introduction Beluga:Design and implementation

Step 1: Encoding Evaluation in LF

Evaluation Judgment: M − → M′ read as “M steps to M′”

app (lam x.M) N − → [N/x]M s/beta M − → M s/refl M − → M′ app M N − → app M′ N s/app M − → M′ M′ − → N M − → N s/trans

LF representation in Beluga

LF step: tm A → tm A → type = | s/beta : step (app (lam M) N) (M N) | s/app : step M M’ → step (app M N) (app M’ N) | s/refl : step M M | s/trans: step M M’ → step M’ N → step M N;

  • Substitution in the tm language is modelled

via LF application and LF β-reduction

  • B. Pientka

Mechanizing Meta-Theory in Beluga 18 / 35

slide-31
SLIDE 31

Introduction Beluga:Design and implementation

So far . . .

. . . encodings in the logical framework LF

  • B. Pientka

Mechanizing Meta-Theory in Beluga 19 / 35

slide-32
SLIDE 32

Introduction Beluga:Design and implementation

So far . . .

. . . encodings in the logical framework LF

Question: How to reason about LF terms and types?

  • B. Pientka

Mechanizing Meta-Theory in Beluga 19 / 35

slide-33
SLIDE 33

Introduction Beluga:Design and implementation

So far . . .

. . . encodings in the logical framework LF

Question: How to reason about LF terms and types? Answer: Contextual terms and types [TOCL’08]

  • B. Pientka

Mechanizing Meta-Theory in Beluga 19 / 35

slide-34
SLIDE 34

Introduction Beluga:Design and implementation

What are contextual terms and types?

Recall: lam λx. app (lam λy.y) x

  • B. Pientka

Mechanizing Meta-Theory in Beluga 20 / 35

slide-35
SLIDE 35

Introduction Beluga:Design and implementation

What are contextual terms and types?

Recall: lam λx.

app (lam λy.y) x

  • B. Pientka

Mechanizing Meta-Theory in Beluga 19 / 35

slide-36
SLIDE 36

Introduction Beluga:Design and implementation

What are contextual terms and types?

Recall: lam λx.

app (lam λy.y) x

  • Subexpression app (lam λy.y) x refers to the variable x!
  • B. Pientka

Mechanizing Meta-Theory in Beluga 19 / 35

slide-37
SLIDE 37

Introduction Beluga:Design and implementation

What are contextual terms and types?

Recall: lam λx.

app (lam λy.y) x

  • Subexpression app (lam λy.y) x refers to the variable x!
  • The contextual view:

Pair up terms and types with their context of variables!

[x:tm _ ⊢ app (lam λy.y) x]

has type

[x:tm _ ⊢ tm _ ]

  • Contextual terms and types are closed objects!

= ⇒ there are canonical forms = ⇒ check for equality by comparing their canonical forms

  • B. Pientka

Mechanizing Meta-Theory in Beluga 19 / 35

slide-38
SLIDE 38

Introduction Beluga:Design and implementation

What are contextual terms and types?

Recall: lam λx.

app (lam λy.y) x

  • Subexpression app (lam λy.y) x refers to the variable x!
  • The contextual view:

Pair up terms and types with their context of variables!

[x:tm _ ⊢ app (lam λy.y) x]

has type

[x:tm _ ⊢ tm _ ]

  • Contextual terms and types are closed objects!

= ⇒ there are canonical forms = ⇒ check for equality by comparing their canonical forms

  • Reason about contextual terms and types using first-order logic with

least and greatest fixed points. = ⇒ need to abstract over contexts

  • B. Pientka

Mechanizing Meta-Theory in Beluga 19 / 35

slide-39
SLIDE 39

Introduction Beluga:Design and implementation

Reducibility Candidates as Indexed Types

Reducibility candidates for terms M ∈ RA: Ri = {M | halts M} RA⇒B = {M | halts M and ∀N ∈ RA, (app M N) ∈ RB}

  • B. Pientka

Mechanizing Meta-Theory in Beluga 20 / 35

slide-40
SLIDE 40

Introduction Beluga:Design and implementation

Reducibility Candidates as Indexed Types

Reducibility candidates for terms M ∈ RA: Ri = {M | halts M} RA⇒B = {M | halts M and ∀N ∈ RA, (app M N) ∈ RB}

Computation-level data types in Beluga

stratified Reduce : {A:[tp]} {M:[tm A]} type = | I : [halts M] → Reduce [i] [M] | Arr : [halts M] → ({N:[tm A]} Reduce [A] [N] → Reduce [B] [app M N]) → Reduce [arr A B] [M];

  • [app M N] and [arr A B] is shorthand for [ ⊢ app M N] and [ ⊢ arr A B];

they are contextual types [TOCL’08].

  • Note: → is overloaded.
  • → is the LF function space : binders in the object language are

modelled by LF functions (used inside [

])

  • → is a computation-level function (used outside [

])

  • Not strictly positive definition, but stratified.
  • B. Pientka

Mechanizing Meta-Theory in Beluga 20 / 35

slide-41
SLIDE 41

Introduction Beluga:Design and implementation

Reducibility Candidates as Indexed Types

Reducibility candidates for substitutions σ ∈ RΓ : · ∈ R· σ ∈ RΓ N ∈ RA (σ, N/x) ∈ RΓ,x:A

  • B. Pientka

Mechanizing Meta-Theory in Beluga 21 / 35

slide-42
SLIDE 42

Introduction Beluga:Design and implementation

Reducibility Candidates as Indexed Types

Reducibility candidates for substitutions σ ∈ RΓ : · ∈ R· σ ∈ RΓ N ∈ RA (σ, N/x) ∈ RΓ,x:A Computation-level data types in Beluga

inductive RedSub : (Γ:ctx){σ: ⊢ Γ} type = | Nil : RedSub [ ⊢ ^ ] | Cons : RedSub [ ⊢ σ] → Reduce [ ⊢ A] [ ⊢ M] → RedSub [ ⊢ σ, M ];

  • Contexts are structured sequences and are classified by context schemas

schema ctx = x:tm A.

  • Substitution σ are first-class and have type Ψ ⊢ Φ providing a mapping from

Φ to Ψ.

  • B. Pientka

Mechanizing Meta-Theory in Beluga 21 / 35

slide-43
SLIDE 43

Introduction Beluga:Design and implementation

Theorems as Computation-level Types

Lemma (Backward closed) If M − → M′ and M′ ∈ RA then M ∈ RA.

rec closed : [step M M’] → Reduce [A] [M’] → Reduce [A] [M] = ? ;

Lemma (Main lemma) If Γ ⊢ M : A and σ ∈ RΓ then [σ]M ∈ RA.

rec main : {Γ:ctx}{M:[Γ ⊢ tm A[]]} RedSub [ ⊢ σ] → Reduce [A] [M[σ]] = ? ;

  • B. Pientka

Mechanizing Meta-Theory in Beluga 22 / 35

slide-44
SLIDE 44

Introduction Beluga:Design and implementation

Fundamental Lemma

  • B. Pientka

Mechanizing Meta-Theory in Beluga 23 / 35

slide-45
SLIDE 45

Introduction Beluga:Design and implementation

Fundamental Lemma

rec closed : [step M M’] → Reduce [A] [M’] → Reduce [A] [M] = ? ; rec main : {Γ:ctx}{M:[Γ ⊢ tm A[]]} RedSub [ ⊢ σ] → Reduce [A] [M[σ]] =

  • B. Pientka

Mechanizing Meta-Theory in Beluga 23 / 35

slide-46
SLIDE 46

Introduction Beluga:Design and implementation

Fundamental Lemma

rec closed : [step M M’] → Reduce [A] [M’] → Reduce [A] [M] = ? ; rec main : {Γ:ctx}{M:[Γ ⊢ tm A[]]} RedSub [ ⊢ σ] → Reduce [A] [M[σ]] = mlam Γ⇒mlam M ⇒fn rs ⇒ case [Γ ⊢ M ] of | [Γ ⊢#p ] ⇒lookup [Γ] [Γ ⊢#p ] rs % Variable

  • B. Pientka

Mechanizing Meta-Theory in Beluga 23 / 35

slide-47
SLIDE 47

Introduction Beluga:Design and implementation

Fundamental Lemma

rec closed : [step M M’] → Reduce [A] [M’] → Reduce [A] [M] = ? ; rec main : {Γ:ctx}{M:[Γ ⊢ tm A[]]} RedSub [ ⊢ σ] → Reduce [A] [M[σ]] = mlam Γ⇒mlam M ⇒fn rs ⇒ case [Γ ⊢ M ] of | [Γ ⊢#p ] ⇒lookup [Γ] [Γ ⊢#p ] rs % Variable | [Γ ⊢ app M1 M2] ⇒ % Application let Arr ha f = main [Γ] [Γ ⊢ M1] rs in f [ ⊢ _ ] (main [Γ] [Γ ⊢ M2] rs)

  • B. Pientka

Mechanizing Meta-Theory in Beluga 23 / 35

slide-48
SLIDE 48

Introduction Beluga:Design and implementation

Fundamental Lemma

rec closed : [step M M’] → Reduce [A] [M’] → Reduce [A] [M] = ? ; rec main : {Γ:ctx}{M:[Γ ⊢ tm A[]]} RedSub [ ⊢ σ] → Reduce [A] [M[σ]] = mlam Γ⇒mlam M ⇒fn rs ⇒ case [Γ ⊢ M ] of | [Γ ⊢#p ] ⇒lookup [Γ] [Γ ⊢#p ] rs % Variable | [Γ ⊢ app M1 M2] ⇒ % Application let Arr ha f = main [Γ] [Γ ⊢ M1] rs in f [ ⊢ _ ] (main [Γ] [Γ ⊢ M2] rs) | [Γ ⊢ lam λx. M1] ⇒ % Abstraction Arr [ ⊢ h/value s/refl v/lam] (mlam N ⇒ fn rN ⇒ closed [ ⊢ s/beta] (main [Γ,x:tm _] [Γ,x ⊢ M1] (Cons rs rN)))

  • B. Pientka

Mechanizing Meta-Theory in Beluga 23 / 35

slide-49
SLIDE 49

Introduction Beluga:Design and implementation

Fundamental Lemma

rec closed : [step M M’] → Reduce [A] [M’] → Reduce [A] [M] = ? ; rec main : {Γ:ctx}{M:[Γ ⊢ tm A[]]} RedSub [ ⊢ σ] → Reduce [A] [M[σ]] = mlam Γ⇒mlam M ⇒fn rs ⇒ case [Γ ⊢ M ] of | [Γ ⊢#p ] ⇒lookup [Γ] [Γ ⊢#p ] rs % Variable | [Γ ⊢ app M1 M2] ⇒ % Application let Arr ha f = main [Γ] [Γ ⊢ M1] rs in f [ ⊢ _ ] (main [Γ] [Γ ⊢ M2] rs) | [Γ ⊢ lam λx. M1] ⇒ % Abstraction Arr [ ⊢ h/value s/refl v/lam] (mlam N ⇒ fn rN ⇒ closed [ ⊢ s/beta] (main [Γ,x:tm _] [Γ,x ⊢ M1] (Cons rs rN))) | [Γ ⊢ c] ⇒ I [ ⊢ h/value s/refl v/c]; % Constant

  • B. Pientka

Mechanizing Meta-Theory in Beluga 23 / 35

slide-50
SLIDE 50

Introduction Beluga:Design and implementation

Fundamental Lemma

rec closed : [step M M’] → Reduce [A] [M’] → Reduce [A] [M] = ? ; rec main : {Γ:ctx}{M:[Γ ⊢ tm A[]]} RedSub [ ⊢ σ] → Reduce [A] [M[σ]] = mlam Γ⇒mlam M ⇒fn rs ⇒ case [Γ ⊢ M ] of | [Γ ⊢#p ] ⇒lookup [Γ] [Γ ⊢#p ] rs % Variable | [Γ ⊢ app M1 M2] ⇒ % Application let Arr ha f = main [Γ] [Γ ⊢ M1] rs in f [ ⊢ _ ] (main [Γ] [Γ ⊢ M2] rs) | [Γ ⊢ lam λx. M1] ⇒ % Abstraction Arr [ ⊢ h/value s/refl v/lam] (mlam N ⇒ fn rN ⇒ closed [ ⊢ s/beta] (main [Γ,x:tm _] [Γ,x ⊢ M1] (Cons rs rN))) | [Γ ⊢ c] ⇒ I [ ⊢ h/value s/refl v/c]; % Constant

  • Direct encoding of on-paper proof
  • Equations about substitution properties automatically discharged

(amounts to roughly a dozen lemmas about substitution and weakening)

  • Total encoding about 75 lines of Beluga code
  • B. Pientka

Mechanizing Meta-Theory in Beluga 23 / 35

slide-51
SLIDE 51

Introduction Beluga:Design and implementation

Some Alternatives

General Theorem Proving Environments

  • Calculus of Construction (Coq) / Martin L¨
  • f Type Theory (Agda)

No special support for variables, assumptions, derivation trees, etc. About a dozen extra lemmas

  • Isabelle / Nominal

support for variable names, but not for assumptions, derivation trees, etc. based on nominal set theory; about a dozen extra lemmas

  • B. Pientka

Mechanizing Meta-Theory in Beluga 24 / 35

slide-52
SLIDE 52

Introduction Beluga:Design and implementation

Some Alternatives

General Theorem Proving Environments

  • Calculus of Construction (Coq) / Martin L¨
  • f Type Theory (Agda)

No special support for variables, assumptions, derivation trees, etc. About a dozen extra lemmas

  • Isabelle / Nominal

support for variable names, but not for assumptions, derivation trees, etc. based on nominal set theory; about a dozen extra lemmas

Domain-specific Provers (Higher-Order Abstract Syntax (HOAS))

  • Abella: encode second-order hereditary Harrop (HH) logic in G, an

extension of first-order logic with a new quantifier ∇, and develop inductive proofs in G by reasoning about the size of HH derivations . diverges a bit from on-paper proof; 4 additional lemmas

  • Twelf: Too weak for directly encoding such proofs; implement auxiliary

logic.

  • B. Pientka

Mechanizing Meta-Theory in Beluga 24 / 35

slide-53
SLIDE 53

Introduction Beluga:Design and implementation

Logical Relations on Open Terms

  • Allowing reductions under lambda-abstractions:

M − → N lam x.M − → lam x.N s/lamx

  • B. Pientka

Mechanizing Meta-Theory in Beluga 25 / 35

slide-54
SLIDE 54

Introduction Beluga:Design and implementation

Logical Relations on Open Terms

  • Allowing reductions under lambda-abstractions:

M − → N lam x.M − → lam x.N s/lamx

  • Revisiting the reducibility candidates

for well-scoped and well-typed open terms Γ ⊢M ∈ RA: Ri = {Ψ ⊢M | Ψ ⊢M halts} RA⇒B = {Ψ ⊢M | Ψ ⊢M halts and ∀Φ ≥ρ Ψ, N where Φ ⊢N : A, if (Φ ⊢N) ∈ RA then (Φ ⊢app M[ρ] N) ∈ RB}

  • B. Pientka

Mechanizing Meta-Theory in Beluga 25 / 35

slide-55
SLIDE 55

Introduction Beluga:Design and implementation

Encoding Logical Relations on Open Terms

Definition on paper: Ri = {Ψ ⊢M | Ψ ⊢M halts} RA⇒B = {Ψ ⊢M | Ψ ⊢M halts and ∀Φ ≥ρ Ψ, N where Φ ⊢N : A, if (Φ ⊢N) ∈ RA then (Φ ⊢app M[ρ] N) ∈ RB} Encoding in Beluga

stratified Reduce : (Ψ:nctx) {A:[tp]} {M:[Ψ ⊢ tm A[]]} type = | Base : Halts [i] [Ψ ⊢ M] → Reduce [i] [Ψ ⊢ M] | Arr : {M:[ Ψ ⊢ tm (arr A[] B[])]} Halts [arr A B] [Ψ ⊢ M] → ({Φ:nctx} {ρ:[Φ ⊢ Ψ]} {N:[Φ ⊢ tm A[]]} Reduce [A] [Φ ⊢ N] → Reduce [B] [Φ ⊢ app M[ρ] N]) → Reduce [arr A B] [Ψ ⊢ M];

See our journal paper discussing case studies [MSCS’16]

  • B. Pientka

Mechanizing Meta-Theory in Beluga 26 / 35

slide-56
SLIDE 56

Introduction Beluga:Design and implementation

POPLMark Reloaded! Strong normalization of a simply-typed lambda- calculus using Kripke-style logical relations.

  • B. Pientka

Mechanizing Meta-Theory in Beluga 27 / 35

slide-57
SLIDE 57

Introduction Beluga:Design and implementation

POPLMark Reloaded: Goal

Benchmark problems that

  • Push the state of the art in the area and outline new areas of research
  • Compare systems and mechanized proofs qualitatively
  • Understand what infrastructural parts (boilerplate) should be

generically supported and factored

  • Find bugs in existing proof assistants
  • Highlight theoretical limitations of existing proof environments
  • Highlight practical limitations of existing proof environments
  • Polularize and provide a better understanding of logical relations
  • B. Pientka

Mechanizing Meta-Theory in Beluga 28 / 35

slide-58
SLIDE 58

Introduction Beluga:Design and implementation

Question

Why pick strong normalization for simply-typed lambda-calculus using Kripke-style logical relations?

  • B. Pientka

Mechanizing Meta-Theory in Beluga 29 / 35

slide-59
SLIDE 59

Introduction Beluga:Design and implementation

Question

Why pick strong normalization for simply-typed lambda-calculus using Kripke-style logical relations?

Follow up: We can prove SN without Kripke-style logical relations and we’ve already done it.

  • B. Pientka

Mechanizing Meta-Theory in Beluga 29 / 35

slide-60
SLIDE 60

Introduction Beluga:Design and implementation

Witness 1: Lego [Altenkirch’93]

. . . “following Girard’s Proofs and Types” Characteristic Features:

  • Terms are not well-scoped or well-typed
  • Candidate relation is untyped and does not enforce well-scoped terms

= ⇒ does not scale to typed-directed evaluatation or equivalence = ⇒ maybe better techniquues to modularize and structure proof

  • B. Pientka

Mechanizing Meta-Theory in Beluga 30 / 35

slide-61
SLIDE 61

Introduction Beluga:Design and implementation

Witness 2: Abella, ATS/HOAS

. . . “following Girard’s Proofs and Types”

  • B. Pientka

Mechanizing Meta-Theory in Beluga 31 / 35

slide-62
SLIDE 62

Introduction Beluga:Design and implementation

Witness 2: Abella, ATS/HOAS

. . . “following Girard’s Proofs and Types”

  • Strictly speaking:

SN for simply-typed λ-calculus plus one constant that has any type.

  • Adding a constant significantly simplifies the proof
  • Reducibility of terms only defined on closed terms
  • Strictly speaking:

Show that SN for simply-typed λ-calculus plus one constant implies also SN for open simply-typed λ-terms

  • B. Pientka

Mechanizing Meta-Theory in Beluga 31 / 35

slide-63
SLIDE 63

Introduction Beluga:Design and implementation

A Call for Action

  • Be part of formulating and tackling the challenge
  • Choose your favorite proof assistant and complete the challenge
  • B. Pientka

Mechanizing Meta-Theory in Beluga 32 / 35

slide-64
SLIDE 64

Introduction Beluga:Design and implementation

Status Report

  • Prototype in OCaml (ongoing - last release March 2015)

providing an interactive programming mode, totality checker [CADE’15]

https://github.com/Beluga-lang/Beluga

  • Mechanizing Types and Programming Languages - A companion:

https://github.com/Beluga-lang/Meta

  • B. Pientka

Mechanizing Meta-Theory in Beluga 33 / 35

slide-65
SLIDE 65

Introduction Beluga:Design and implementation

Current and Future Directions

  • Lincx: A linear logical framework LF with first-class contexts (A.L. Georges,
  • A. Murawska, S. Otis)[ESOP’17]
  • Programming with syntax in existing proof and programming

environments (F. Ferreira[ESOP’17])

Translate contextual objects via a deep embedding

  • Coinductive Proofs (e.g. Contextual Equivalence)[ICFP’16]

(joint work with A. Momigliano, D. Thibodeau [Dale’s Festschrift’17])

  • Full Dependent Type Theory with Contextual Objects and First-class

Contexts (joint work with A. Abel, F. Ferreira, D. Thibodeau, R. Zucchini)

  • B. Pientka

Mechanizing Meta-Theory in Beluga 34 / 35

slide-66
SLIDE 66

Introduction Beluga:Design and implementation

The End Thank you!

Download prototype and examples at http://complogic.cs.mcgill.ca/beluga/ Thanks go to: Andrew Cave, Joshua Dunfield, Olivier Savary Be- langer, Matthias Boespflug, Scott Cooper, Francisco Ferreira, Aidan Marchildon, Stefan Monnier, Agata Murawska, Nicolas Jeannerod, David Thibodeau, Shawn Otis, Rohan Jacob Rao, Shanshan Ruan, Tao Xue “A language that doesn’t affect the way you think about programming, is not worth knowing.“

  • Alan Perlis
  • B. Pientka

Mechanizing Meta-Theory in Beluga 35 / 35