Meta-reasoning in the concurrent logical framework CLF Jorge Luis - - PowerPoint PPT Presentation

▶
meta reasoning in the concurrent logical framework clf
SMART_READER_LITE
LIVE PREVIEW

Meta-reasoning in the concurrent logical framework CLF Jorge Luis - - PowerPoint PPT Presentation

Dec 13, 2023 177 likes •1.05k views

Meta-reasoning in the concurrent logical framework CLF Jorge Luis Sacchini (joint work with Iliano Cervesato) Carnegie Mellon University Qatar campus Nagoya University, 27 June 2014 Jorge Luis Sacchini (joint work with Iliano Cervesato)

slide-1
SLIDE 1

Meta-reasoning in the concurrent logical framework CLF

Jorge Luis Sacchini (joint work with Iliano Cervesato)

Carnegie Mellon University – Qatar campus

Nagoya University, 27 June 2014

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 1 / 48

slide-2
SLIDE 2

Objectives

Concurrency and distribution are essential features in modern systems. PLs are engineered (or retrofitted) to support them. Their formal semantics is not as well understood or studied as in the sequential case. Formal semantics will enable, e.g.,

◮ development of formal verification, ◮ logical frameworks, ◮ verifying programs and program transformations. Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 2 / 48

slide-3
SLIDE 3

Logical frameworks

Logical frameworks are formalisms used to specify PL and their metatheory.

◮ Coq, Agda, Twelf, Beluga, Delphin, . . .

Our goal is to develop logical frameworks for specifying concurrent and distributed PL. Two main approaches.

◮ Deep approach: specify a concurrency model in a general purpose LF

(Coq, Agda)

◮ Shallow approach: provide direct support in a special purpose LF

(Twelf, Beluga, Delphin, LLF, HLF, CLF)

We follow the shallow approach, using CLF as our LF.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 3 / 48

slide-4
SLIDE 4

Outline

1

Twelf

2

CLF

3

Substructural operational semantics

4

Safety for SSOS

5

Meta-CLF

6

Conclusions and future work

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 4 / 48

slide-5
SLIDE 5

Outline

1

Twelf

2

CLF

3

Substructural operational semantics

4

Safety for SSOS

5

Meta-CLF

6

Conclusions and future work

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 5 / 48

slide-6
SLIDE 6

Twelf

Logical framework designed to specify and prove properties about deductive systems (e.g. logics, programming languages). Based on the Edinburgh logical framework (LF). Binders are represented using Higher-Order Abstract Syntax (HOAS). Used in large specifications: SML, TALT, Proof-Carrying Code. . .

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 6 / 48

slide-7
SLIDE 7

Twelf

Example

Natural numbers: z nat n nat s(n) nat Addition: z + n = n m + n = p s(m) + n = s(p) In Twelf:

nat : type. z : nat. s : nat -> nat. plus : nat -> nat -> nat -> type. plus/z : plus z N N. plus/s : plus (s M) N (s P) <- plus M N P.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 7 / 48

slide-8
SLIDE 8

Twelf

Addition in Twelf:

plus : nat -> nat -> nat -> type. plus/z : plus z N N. plus/s : plus (s M) N (s P) <- plus M N P.

Backward chaining proof search: plus (s(s z)) (s(s z)) X X?

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 8 / 48

slide-9
SLIDE 9

Twelf

Addition in Twelf:

plus : nat -> nat -> nat -> type. plus/z : plus z N N. plus/s : plus (s M) N (s P) <- plus M N P.

Backward chaining proof search: plus (s z) (s(s z)) X1 plus (s(s z)) (s(s z)) X X = s X1

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 8 / 48

slide-10
SLIDE 10

Twelf

Addition in Twelf:

plus : nat -> nat -> nat -> type. plus/z : plus z N N. plus/s : plus (s M) N (s P) <- plus M N P.

Backward chaining proof search: plus z (s(s z)) X2 plus (s z) (s(s z)) X1 plus (s(s z)) (s(s z)) X X = s X1 = s (s X2)

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 8 / 48

slide-11
SLIDE 11

Twelf

Addition in Twelf:

plus : nat -> nat -> nat -> type. plus/z : plus z N N. plus/s : plus (s M) N (s P) <- plus M N P.

Backward chaining proof search: plus z (s(s z)) X2 plus (s z) (s(s z)) X1 plus (s(s z)) (s(s z)) X X = s X1 = s (s X2) = 4

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 8 / 48

slide-12
SLIDE 12

Meta-theorems in Twelf

Example: ∀m, n, p. m + n = p → n + m = p In Twelf:

plus/comm: plus M N P -> plus N M P -> type.

(Proof proceeds by induction on M).

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 9 / 48

slide-13
SLIDE 13

Specifying PLs in Twelf

Simply-typed λ-calculus: e ::= x | λx.e | e1 e2 (Expressions) τ ::= ρ | τ → τ (Types) In Twelf:

exp : type. lam : (exp -> exp) -> exp. app : exp -> exp -> exp. tp : type. arr : tp -> tp -> tp.

HOAS: variables in Twelf represent variables in the object language.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 10 / 48

slide-14
SLIDE 14

Specifying PLs in Twelf

Typing judgment: Γ ⊢ e : τ x : τ ∈ Γ Γ ⊢ x : τ Γ, x : τ ⊢ e : τ ′ Γ ⊢ λx.r : τ → τ ′ Γ ⊢ e1 : τ ′ → τ Γ ⊢ e2 : τ ′ Γ ⊢ e1 e2 : τ In Twelf:

  • f : exp -> tp -> type.
  • f/lam :
  • f (lam \x. E x) (arr T T’)

<- ({x} of x T -> of (E x) T’).

  • f/app :
  • f (app E1 E2) T

<- of E1 (arr T’ T) <- of E2 T’.

HOAS: Twelf context represents the object language context.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 11 / 48

slide-15
SLIDE 15

Meta-theorems in Twelf

Type preservation: ∀Γ, e1, e2, τ. Γ ⊢ e1 : τ ∧ e1 → e2 ⇒ Γ ⊢ e2 : τ In Twelf:

type-pres: of E1 T -> red E1 E2 -> of E2 T -> type.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 12 / 48

slide-16
SLIDE 16

Extensions of Twelf

Many PL features are difficult to represent in Twelf:

◮ State ◮ Concurrency ◮ Parallelism ◮ Distribution

Several extensions have been proposed: Linear LF (state, linear logic) Hybrid LF (hybrid logic, reasoning about LLF) Concurrent LF (concurrency, distribution) . . .

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 13 / 48

slide-17
SLIDE 17

Outline

1

Twelf

2

CLF

3

Substructural operational semantics

4

Safety for SSOS

5

Meta-CLF

6

Conclusions and future work

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 14 / 48

slide-18
SLIDE 18

CLF

CLF is an extension of the Edinburgh logical framework (LF) designed to specify distributed and concurrent systems. Large number of examples: semantics of PL, Petri nets, voting protocols, etc. CLF extends LF with linear types and a monad to encapsulate concurrent effects: K ::= type | Π!x : A.K (Kinds) A ::= P | Πx : A.A | A → B | A ⊸ B | {S} (Async types) S ::= 1 | !A | A | S ⊗ S | ∃x : A.S (Sync types) as well as proof terms for these types (more on that later)

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 15 / 48

slide-19
SLIDE 19

CLF

CLF combines: Asynchronous types (Π, ⊸, &)

◮ Linear Logical Framework ◮ Backward chaining operational semantics

Synchronous types (∃, ⊗)

◮ Encapsulated in a monad ({S}) ◮ Forward chaining operational semantics Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 16 / 48

slide-20
SLIDE 20

CLF

Synchronous fragment

Monadic types are used to encapsulate concurrent effects: A ⊸ B ⊸ {C} (Multiset) Rewriting interpretation of linear logic. Example: in : tick ⊸ count N ⊸ {count (N + 1)}

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 17 / 48

slide-21
SLIDE 21

CLF

Synchronous fragment

Monadic types are used to encapsulate concurrent effects: A ⊸ B ⊸ {C} (Multiset) Rewriting interpretation of linear logic. Example: in : tick ⊸ count N ⊸ plus N 1 M → {count M}

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 17 / 48

slide-22
SLIDE 22

CLF

Synchronous fragment

Monadic types are used to encapsulate concurrent effects: A ⊸ B ⊸ {C} (Multiset) Rewriting interpretation of linear logic. Example: in : tick ⊸ count N ⊸ {count (N + 1)}

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 17 / 48

slide-23
SLIDE 23

CLF

Synchronous fragment

Monadic types are used to encapsulate concurrent effects: A ⊸ B ⊸ {C} (Multiset) Rewriting interpretation of linear logic. Example: in : tick ⊸ count N ⊸ {count (N + 1)}

t1 : tick, t2 : tick, t3 : tick, t4 : tick, t5 : tick, c1 : count 0, c2 : count 0

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 17 / 48

slide-24
SLIDE 24

CLF

Synchronous fragment

Monadic types are used to encapsulate concurrent effects: A ⊸ B ⊸ {C} (Multiset) Rewriting interpretation of linear logic. Example: in : tick ⊸ count N ⊸ {count (N + 1)}

t1 : tick, t2 : tick, t3 : tick, t4 : tick, t5 : tick, c1 : count 0, c2 : count 0 t2 : tick, t3 : tick, t4 : tick, t5 : tick, c1 : count 1, c2 : count 0

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 17 / 48

slide-25
SLIDE 25

CLF

Synchronous fragment

Monadic types are used to encapsulate concurrent effects: A ⊸ B ⊸ {C} (Multiset) Rewriting interpretation of linear logic. Example: in : tick ⊸ count N ⊸ {count (N + 1)}

t1 : tick, t2 : tick, t3 : tick, t4 : tick, t5 : tick, c1 : count 0, c2 : count 0 t2 : tick, t3 : tick, t4 : tick, t5 : tick, c1 : count 1, c2 : count 0 t3 : tick, t4 : tick, t5 : tick, c1 : count 2, c2 : count 0

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 17 / 48

slide-26
SLIDE 26

CLF

Synchronous fragment

Monadic types are used to encapsulate concurrent effects: A ⊸ B ⊸ {C} (Multiset) Rewriting interpretation of linear logic. Example: in : tick ⊸ count N ⊸ {count (N + 1)}

t1 : tick, t2 : tick, t3 : tick, t4 : tick, t5 : tick, c1 : count 0, c2 : count 0 t2 : tick, t3 : tick, t4 : tick, t5 : tick, c1 : count 1, c2 : count 0 t3 : tick, t4 : tick, t5 : tick, c1 : count 2, c2 : count 0 t4 : tick, t5 : tick, c1 : count 2, c2 : count 1

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 17 / 48

slide-27
SLIDE 27

CLF

Synchronous fragment

Monadic types are used to encapsulate concurrent effects: A ⊸ B ⊸ {C} (Multiset) Rewriting interpretation of linear logic. Example: in : tick ⊸ count N ⊸ {count (N + 1)}

t1 : tick, t2 : tick, t3 : tick, t4 : tick, t5 : tick, c1 : count 0, c2 : count 0 t2 : tick, t3 : tick, t4 : tick, t5 : tick, c1 : count 1, c2 : count 0 t3 : tick, t4 : tick, t5 : tick, c1 : count 2, c2 : count 0 t4 : tick, t5 : tick, c1 : count 2, c2 : count 1 t5 : tick, c1 : count 3, c2 : count 1

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 17 / 48

slide-28
SLIDE 28

CLF

Synchronous fragment

Monadic types are used to encapsulate concurrent effects: A ⊸ B ⊸ {C} (Multiset) Rewriting interpretation of linear logic. Example: in : tick ⊸ count N ⊸ {count (N + 1)}

t1 : tick, t2 : tick, t3 : tick, t4 : tick, t5 : tick, c1 : count 0, c2 : count 0 t2 : tick, t3 : tick, t4 : tick, t5 : tick, c1 : count 1, c2 : count 0 t3 : tick, t4 : tick, t5 : tick, c1 : count 2, c2 : count 0 t4 : tick, t5 : tick, c1 : count 2, c2 : count 1 t5 : tick, c1 : count 3, c2 : count 1 c1 : count 3, c2 : count 2

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 17 / 48

slide-29
SLIDE 29

Proof terms

Monadic types are introduced by traces A trace is basically a sequence of rule applications: ε ::= ⋄ | {∆}c · S | ε1; ε2 Trace composition (;) is associative and ⋄ is a neutral element Forward chaining with committed choice after every step.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 18 / 48

slide-30
SLIDE 30

Traces

Example: in : tick ⊸ count N ⊸ {count (N + 1)}

t1 : tick, t2 : tick, t3 : tick, t4 : tick, t5 : tick, c1 : count 0, c2 : count 0 ⊢ {c11} ← in · t1, c1 {c12} ← in · t2, c11 {c21} ← in · t3, c2 {c13} ← in · t4, c12 {c22} ← in · t5, c21 : c13 : count 3, c22 : count 2

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 19 / 48

slide-31
SLIDE 31

Traces

Equality on traces: α-equivalence modulo permutation of independent subtraces. Allows encoding of concurrent and distributed features. Two traces are independent (ε1 ε2) if they operate on different sets

  • f variables.

Trace interface:

  • (⋄) = ∅

(⋄)• = ∅

  • ({∆}c · S) = FV(S)

({∆}c · S)• = dom(∆)

  • (ε1; ε2) = •ε1 ∪ (•ε2 \ ε1•)

(ε1; ε2)• = ε2• ∪ (ε1• \ •ε2) ∪ !(ε1•)

ε1 ε2 ⇐ ⇒ •ε1 ∩ ε2• = ε1• ∩ •ε2 = ∅.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 20 / 48

slide-32
SLIDE 32

Traces

Trace equality: ε; ⋄ ≡ ε ε ≡ ε; ⋄ ε1; (ε2; ε3) ≡ (ε1; ε2); ε3 ε1 ε2 ε1; ε2 ≡ ε2; ε1 ε1 ≡ ε′

1

ε1; ε2 ≡ ε′

1; ε2

ε2 ≡ ε′

2

ε1; ε2 ≡ ε1; ε′

2

Example: {c11} ← in · t1, c1 {c12} ← in · t2, c11 {c21} ← in · t3, c2 {c13} ← in · t4, c12 {c22} ← in · t5, c21 ≡ {c11} ← in · t1, c1 {c21} ← in · t3, c2 {c12} ← in · t2, c11 {c13} ← in · t4, c12 {c22} ← in · t5, c21

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 21 / 48

slide-33
SLIDE 33

Outline

1

Twelf

2

CLF

3

Substructural operational semantics

4

Safety for SSOS

5

Meta-CLF

6

Conclusions and future work

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 22 / 48

slide-34
SLIDE 34

Substructural operational semantics

Substructural operational semantics combines

◮ Structural operational semantics ◮ Substructural logics

Extensible: we can add features without breaking previous developments Expressive: wide variety of concurrent and distributed mechanisms (Simmons12).

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 23 / 48

slide-35
SLIDE 35

Higher-order abstract syntax

Simply-typed λ-calculus e ::= x | λx.e | e e In (C)LF: exp : type. lam : (exp → exp) → exp . app : exp → exp → exp .

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 24 / 48

slide-36
SLIDE 36

SSOS

Linear-destination passing style (Pfenning04) Based on multiset rewriting; suitable for specifying in linear logic Multiset of facts: eval e d Evaluate expression e in destination d ret e d Value e in destination d fapp d1 d2 d Application: expects the function and argument to be evaluated in d1 and d2, and the result is evaluated in d Evaluation rules transform multisets of facts

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 25 / 48

slide-37
SLIDE 37

SSOS

Multiset of facts: eval e d, ret e d, fapp d1 d2 d In CLF: dest : type. eval : exp → dest → type. ret : exp → dest → type. fapp : dest → dest → dest → type.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 26 / 48

slide-38
SLIDE 38

Evaluation rules

Multiset rewriting rules (parallel semantics): eval e d ret e d if e is a value In CLF: step/eval : eval e d ⊸ value e → {ret e d}.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 27 / 48

slide-39
SLIDE 39

Evaluation rules

Multiset rewriting rules (parallel semantics): eval (e1 e2) d eval e1 d1, eval e2 d2, fapp d1 d2 d where d1, d2 fresh In CLF: step/app : eval (app e1 e2) d ⊸ {!d1 !d2 : dest, eval e1 d1, eval e2 d2, fapp d1 d2 d}.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 27 / 48

slide-40
SLIDE 40

Evaluation rules

Multiset rewriting rules (parallel semantics): ret (λx.e1) d1, ret e2 d2, fapp d1 d2 d eval (e1[e2/x]) d In CLF: step/beta : ret (lam e1) d1 ⊸ ret e2 d2 ⊸ fapp d1 d2 d ⊸ {eval (e1 e2) d}

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 27 / 48

slide-41
SLIDE 41

Example

eval ((λx.x)(λy.y)) d In CLF: !d : dest, x0 : eval (app (lam λx.x) (lam λy.y)) d ⊢ ⋄ : (!d : dest)(x0 : eval (app (lam λx.x) (lam λy.y)) d)

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 28 / 48

slide-42
SLIDE 42

Example

eval ((λx.x)(λy.y)) d

  • eval (λx.x) d1, eval (λy.y) d2, fapp d1 d2 d

In CLF: !d : dest, x0 : eval (app (lam λx.x) (lam λy.y)) d ⊢ {!d1, !d2, x, y, z} ← step/app x0; : !d !d1 !d2 : dest, x : eval (lam λx.x) d1, y : eval (lam λy.y) d2, z : fapp d1 d2 d

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 28 / 48

slide-43
SLIDE 43

Example

eval ((λx.x)(λy.y)) d

  • eval (λx.x) d1, eval (λy.y) d2, fapp d1 d2 d
  • ret (λx.x) d1, eval (λy.y) d2, fapp d1 d2 d

In CLF: !d : dest, x0 : eval (app (lam λx.x) (lam λy.y)) d ⊢ {!d1, !d2, x, y, z} ← step/app x0; {x′} ← step/eval x; : !d !d1 !d2 : dest, x′ : ret (lam λx.x) d1, y : eval (lam λy.y) d2 z : fapp d1 d2 d

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 28 / 48

slide-44
SLIDE 44

Example

eval ((λx.x)(λy.y)) d

  • eval (λx.x) d1, eval (λy.y) d2, fapp d1 d2 d
  • ret (λx.x) d1, eval (λy.y) d2, fapp d1 d2 d
  • ret (λx.x) d1, ret (λy.y) d2, fapp d1 d2 d

In CLF: !d : dest, x0 : eval (app (lam λx.x) (lam λy.y)) d ⊢ {!d1, !d2, x, y, z} ← step/app x0; {x′} ← step/eval x; {y′} ← step/eval y; : !d !d1 !d2 : dest, x′ : ret (lam λx.x) d1, y′ : ret (lam λy.y) d2 z : fapp d1 d2 d

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 28 / 48

slide-45
SLIDE 45

Example

eval ((λx.x)(λy.y)) d

  • eval (λx.x) d1, eval (λy.y) d2, fapp d1 d2 d
  • ret (λx.x) d1, eval (λy.y) d2, fapp d1 d2 d
  • ret (λx.x) d1, ret (λy.y) d2, fapp d1 d2 d
  • eval (λy.y) d

In CLF: !d : dest, x0 : eval (app (lam λx.x) (lam λy.y)) d ⊢ {!d1, !d2, x, y, z} ← step/app x0; {x′} ← step/eval x; {y′} ← step/eval y; {w} ← step/beta x′ y′ z; : !d !d1 !d2 : dest, w : eval (lam λy.y) d

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 28 / 48

slide-46
SLIDE 46

Example

eval ((λx.x)(λy.y)) d

  • eval (λx.x) d1, eval (λy.y) d2, fapp d1 d2 d
  • ret (λx.x) d1, eval (λy.y) d2, fapp d1 d2 d
  • ret (λx.x) d1, ret (λy.y) d2, fapp d1 d2 d
  • eval (λy.y) d
  • ret (λy.y) d

In CLF: !d : dest, x0 : eval (app (lam λx.x) (lam λy.y)) d ⊢ {!d1, !d2, x, y, z} ← step/app x0; {x′} ← step/eval x; {y′} ← step/eval y; {w} ← step/beta x′ y′ z; {w′} ← step/eval w; : !d !d1 !d2 : dest, w′ : ret (lam λy.y) d

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 28 / 48

slide-47
SLIDE 47

Example

eval ((λx.x)(λy.y)) d

  • eval (λx.x) d1, eval (λy.y) d2, fapp d1 d2 d
  • ret (λx.x) d1, eval (λy.y) d2, fapp d1 d2 d
  • ret (λx.x) d1, ret (λy.y) d2, fapp d1 d2 d
  • eval (λy.y) d
  • ret (λy.y) d

In CLF: !d : dest, x0 : eval (app (lam λx.x) (lam λy.y)) d ⊢ {!d1, !d2, x, y, z} ← step/app x0; {y′} ← step/eval y; {x′} ← step/eval x; {w} ← step/beta x′ y′ z; {w′} ← step/eval w; : !d !d1 !d2 : dest, w′ : ret (lam λy.y) d

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 28 / 48

slide-48
SLIDE 48

π-calculus in CLF

Example

Process expressions: P, Q ::= 0 | (P | Q) | ν u.P | !P | u(v).P | uv In CLF:

exp : type. chan : type. zero : exp. par : exp -> exp -> exp. new : (chan -> exp) -> exp. ! : exp -> exp. inp : chan -> (chan -> exp) -> exp.

  • utp : chan -> chan -> exp.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 29 / 48

slide-49
SLIDE 49

π-calculus in CLF

Example

Operational semantics: u(v) | uw.P − → [v/w]P In CLF:

proc : exp -> type. msg : chan -> chan -> type. proc/zero : proc zero -o {1}. proc/par : proc (par P Q) -o {proc P ⊗ proc Q}. proc/outp : proc (out U V) -o { msg U V }. proc/inp : proc U (inp \v. P v) -o msg U W -o { proc (P W) }.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 30 / 48

slide-50
SLIDE 50

SSOS

Many PL features can be represented using SSOS:

◮ State ◮ Threads ◮ Futures ◮ Concurrency (e.g. π-calculus) ◮ Distribution

How to reason about CLF specifications?

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 31 / 48

slide-51
SLIDE 51

Outline

1

Twelf

2

CLF

3

Substructural operational semantics

4

Safety for SSOS

5

Meta-CLF

6

Conclusions and future work

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 32 / 48

slide-52
SLIDE 52

Safety

Recall that the previous semantics is parallel (more complex languages can have concurrent and distributed semantics as well). Safety is the conjunction of the following properties:

◮ Preservation: evaluation preserves well-typed multisets.

If ∆ is a well-typed multiset, and ∆ ∆′ (step), then ∆′ is a well-typed multiset.

◮ Progress: a well-typed multiset is either final (result) or is possible to

take a step. If ∆ is a well-typed multiset, then either ∆ = {ret e d} or there exists ∆′ such that ∆ ∆′.

We need a notion of well-typed multiset for SSOS specifications.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 33 / 48

slide-53
SLIDE 53

Well-typed multisets

Example: eval e1 d, eval e2 d

✩ (repeated destination)

fapp d1 d2 d, eval e1 d1 ✩ (no fact for d2) Well-typed multisets form a tree: fapp d1 d2 d

  • eval plus d1

fapp d21 d22 d2

  • ret 0 d21

eval 2 d22

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 34 / 48

slide-54
SLIDE 54

Well-typed multisets

Well-typed multisets can be described by rewriting rules. gen t d means “generate a term of type t rooted at d” gen d

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 35 / 48

slide-55
SLIDE 55

Well-typed multisets

Well-typed multisets can be described by rewriting rules. gen t d means “generate a term of type t rooted at d” fapp d1 d2 d

  • gen d1

gen d2

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 35 / 48

slide-56
SLIDE 56

Well-typed multisets

Well-typed multisets can be described by rewriting rules. gen t d means “generate a term of type t rooted at d” fapp d1 d2 d

  • eval plus d1

gen d2

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 35 / 48

slide-57
SLIDE 57

Well-typed multisets

Well-typed multisets can be described by rewriting rules. gen t d means “generate a term of type t rooted at d” fapp d1 d2 d

  • eval plus d1

fapp d21 d22 d2

  • gen d21

gen d22

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 35 / 48

slide-58
SLIDE 58

Well-typed multisets

Well-typed multisets can be described by rewriting rules. gen t d means “generate a term of type t rooted at d” fapp d1 d2 d

  • eval plus d1

fapp d21 d22 d2

  • ret 0 d21

gen d22

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 35 / 48

slide-59
SLIDE 59

Well-typed multisets

Well-typed multisets can be described by rewriting rules. gen t d means “generate a term of type t rooted at d” fapp d1 d2 d

  • eval plus d1

fapp d21 d22 d2

  • ret 0 d21

eval 2 d22

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 35 / 48

slide-60
SLIDE 60

Well-typed multisets

Generating well-typed states: gen t d ∗ A where A contains no fact of the form gen t0 d0. In CLF: gen : tp → dest → type. gen/eval : gen t d ⊸ of e t → {eval e d}. gen/ret : gen t d ⊸ of e t → {ret e d}. gen/fapp : gen t d ⊸ {!d1 !d2 : dest, fapp d1 d2 d, gen (arr t1 t) d1, gen t1 d2}. We call these type of rules generative invariants (Simmons 12).

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 36 / 48

slide-61
SLIDE 61

Safety

Lemma (Safety)

Preservation If {gen t d} ∗

gen A and A step A′ then

{gen t d} ∗

gen A′.

Progress if {gen t d} ∗

gen A, then either A Is of the form {ret e d}

  • r there exists A′ such that A step A′.

Proof.

Preservation The proof proceeds by case analysis on the evaluation step. Progress The proof proceeds by induction on the generating trace.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 37 / 48

slide-62
SLIDE 62

Limitations of CLF

In CLF it is not possible to express preservation and progress. CLF lacks support for first-order traces, and quantification over contexts. We propose an extension of LF with trace types: Meta-CLF. Similar approaches are taken in Beluga, Delphin, Abella (in the sense

  • f using a two-level approach).

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 38 / 48

slide-63
SLIDE 63

Outline

1

Twelf

2

CLF

3

Substructural operational semantics

4

Safety for SSOS

5

Meta-CLF

6

Conclusions and future work

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 39 / 48

slide-64
SLIDE 64

Meta-CLF

Meta-CLF is an extension of LF with trace types and quantification

  • ver contexts and names:

A ::= . . . | {∆} Σ∗ {∆} | {∆} Σ1 {∆} | Πψ : ctx.A | ∇x.A {∆} Σ∗ {∆′} is the type of all traces ε satisfying ∆ ⊢ ε : ∆′ that use

  • nly rules in the signature Σ.

{∆} Σ1 {∆′} is the type of all 1-step traces ε satisfying ∆ ⊢ ε : ∆′ that use only rules in the signature Σ.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 40 / 48

slide-65
SLIDE 65

Meta-CLF

In Meta-CLF we can express properties about traces: preservation : Πt : tp. ∇d. ∇g. Πψ1 : ctx. Πψ2 : ctx. {!d : dest, g : gen d t} Σ∗

gen {ψ1} → {ψ1} Σ1 step {ψ2} →

{!d : dest, g : gen d t} Σ∗

gen {ψ2} → type.

“If ψ1 is a well-typed state (generated from a single gen d) and there is a step from ψ1 to ψ2, then ψ2 is a well-typed state”

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 41 / 48

slide-66
SLIDE 66

Meta-CLF

In Meta-CLF we can express properties about traces: preservation : Πt : tp. ∇d. ∇g. Πψ1 : ctx. Πψ2 : ctx. {!d : dest, g : gen d t} Σ∗

gen {ψ1} → {ψ1} Σ1 step {ψ2} →

{!d : dest, g : gen d t} Σ∗

gen {ψ2} → type.

“If ψ1 is a well-typed state (generated from a single gen d) and there is a step from ψ1 to ψ2, then ψ2 is a well-typed state”

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 41 / 48

slide-67
SLIDE 67

Meta-CLF

In Meta-CLF we can express properties about traces: preservation : Πt : tp. ∇d. ∇g. Πψ1 : ctx. Πψ2 : ctx. {!d : dest, g : gen d t} Σ∗

gen {ψ1} → {ψ1} Σ1 step {ψ2} →

{!d : dest, g : gen d t} Σ∗

gen {ψ2} → type.

“If ψ1 is a well-typed state (generated from a single gen d) and there is a step from ψ1 to ψ2, then ψ2 is a well-typed state”

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 41 / 48

slide-68
SLIDE 68

Meta-CLF

In Meta-CLF we can express properties about traces: preservation : Πt : tp. ∇d. ∇g. Πψ1 : ctx. Πψ2 : ctx. {!d : dest, g : gen d t} Σ∗

gen {ψ1} → {ψ1} Σ1 step {ψ2} →

{!d : dest, g : gen d t} Σ∗

gen {ψ2} → type.

“If ψ1 is a well-typed state (generated from a single gen d) and there is a step from ψ1 to ψ2, then ψ2 is a well-typed state”

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 41 / 48

slide-69
SLIDE 69

Meta-CLF

In Meta-CLF we can express properties about traces: preservation : Πt : tp. ∇d. ∇g. Πψ1 : ctx. Πψ2 : ctx. {!d : dest, g : gen d t} Σ∗

gen {ψ1} → {ψ1} Σ1 step {ψ2} →

{!d : dest, g : gen d t} Σ∗

gen {ψ2} → type.

“If ψ1 is a well-typed state (generated from a single gen d) and there is a step from ψ1 to ψ2, then ψ2 is a well-typed state”

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 41 / 48

slide-70
SLIDE 70

Meta-CLF

In Meta-CLF we can express properties about traces: preservation : Πt : tp. ∇d. ∇g. Πψ1 : ctx. Πψ2 : ctx. {!d : dest, g : gen d t} Σ∗

gen {ψ1} → {ψ1} Σ1 step {ψ2} →

{!d : dest, g : gen d t} Σ∗

gen {ψ2} → type.

“If ψ1 is a well-typed state (generated from a single gen d) and there is a step from ψ1 to ψ2, then ψ2 is a well-typed state”

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 41 / 48

slide-71
SLIDE 71

Meta-CLF

The safety proof in Meta-CLF follows closely the paper proof. A, eval e d step A, ret e d

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 42 / 48

slide-72
SLIDE 72

Meta-CLF

The safety proof in Meta-CLF follows closely the paper proof. gen t0 d0 A, eval e d step A, ret e d

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 42 / 48

slide-73
SLIDE 73

Meta-CLF

The safety proof in Meta-CLF follows closely the paper proof. gen t0 d0 ∗

gen

A, gen t d gen A, eval e d step A, ret e d

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 42 / 48

slide-74
SLIDE 74

Meta-CLF

The safety proof in Meta-CLF follows closely the paper proof. gen t0 d0 gen t0 d0 ∗

gen

A, gen t d gen A, eval e d step A, ret e d

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 42 / 48

slide-75
SLIDE 75

Meta-CLF

The safety proof in Meta-CLF follows closely the paper proof. gen t0 d0 gen t0 d0 ∗

gen

∗

gen

A, gen t d A.gen t d gen gen A, eval e d step A, ret e d

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 42 / 48

slide-76
SLIDE 76

Meta-CLF

The safety proof in Meta-CLF follows closely the paper proof. gen t0 d0 gen t0 d0 ∗

gen

∗

gen

A, gen t d A.gen t d gen gen A, eval e d step A, ret e d In Meta-CLF: pres/ret : preservation (X1; {↓x}gen/eval e d0 g0 H) ({↓y}step/eval e d0 x Hv) (X1; {↓y}gen/ret e d0 g0 H Hv)

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 42 / 48

slide-77
SLIDE 77

Meta-CLF

Both proofs of preservation and progress in Meta-CLF follow the pen-and-paper proofs. Preservation is performed by case analysis (no induction). Progress relies on induction, but termination is easy (size of the trace). However, we rely on coverage to ensure the proof is total. Coverage checking in the presence of traces is tricky, due to the possibility of permuting steps. (Left for future work.)

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 43 / 48

slide-78
SLIDE 78

SSOS

We can extend this semantics with other features without invalidating the previous rules Example: store, futures, call/cc, communication,. . . location : type. loc : location → exp . get : exp → exp . ref : exp → exp . set : exp → exp → exp . cell : location → exp → type. step/ref : eval (ref e) d ⊸ {!d1 : dest, !l : loc, fref d1 l, eval e d1, ret (loc l) d}. step/fref : ret e d ⊸ fref d l ⊸ {cell l e}.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 44 / 48

slide-79
SLIDE 79

SSOS

We can extend this semantics with other features without invalidating the previous rules Example: store, futures, call/cc, communication,. . . future : exp → exp . promise : dest → exp . deliver : exp → dest → type. step/fut : eval (future e) d ⊸ {!d1 : dest, eval e d1, fdel d1, ret (promise d1) d}. step/fdel : ret e d ⊸ fdel d1 ⊸ {!deliver e d}. step/promise : ret (promise d1) d ⊸ delivee e d1 → ret e d.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 44 / 48

slide-80
SLIDE 80

Outline

1

Twelf

2

CLF

3

Substructural operational semantics

4

Safety for SSOS

5

Meta-CLF

6

Conclusions and future work

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 45 / 48

slide-81
SLIDE 81

Conclusions

Our goal is to develop logical frameworks suitable for specifying concurrent and distributed systems. We introduced Meta-CLF, an extension of LF to reason about CLF specifications. We showed that it is expressive enough to write safety proofs of parallel/concurrent PL.

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 46 / 48

slide-82
SLIDE 82

Future work

Decidability of type checking

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 47 / 48

slide-83
SLIDE 83

Future work

Decidability of type checking Type reconstruction for implicit arguments (very important for usability)

pres/ret : preservation (X1; {↓x}gen/eval e d0 g0 H) ({↓y}step/eval e d0 x Hv) (X1; {↓y}gen/ret e d0 g0 H Hv)

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 47 / 48

slide-84
SLIDE 84

Future work

Decidability of type checking Type reconstruction for implicit arguments (very important for usability)

pres/ret : ∇x.∇y.∇d.∇g.∇d0.∇g0.Πψ′

1 : ctx.Πe : exp.

Πt : tp.Πt0 : tp.ΠH : of e t0.ΠHv : value e ΠX : {!d : dest, ↓g : gen d t} Σ∗

gen {ψ′ 1, !d0 : dest, ↓g0 : gen d0 t0}.

preservation t d g (ψ′

1, !d0 : dest, ↓x : eval e d0)

(ψ′

1, !d0 : dest, ↓y : ret e d0)

(X1; {↓x}gen/eval e d0 g0 H) ({↓y}step/eval e d0 x Hv) (X1; {↓y}gen/ret e d0 g0 H Hv)

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 47 / 48

slide-85
SLIDE 85

Future work

Decidability of type checking Type reconstruction for implicit arguments (very important for usability)

pres/ret : ∇x.∇y.∇d.∇g.∇d0.∇g0.Πψ′

1 : ctx.Πe : exp.

Πt : tp.Πt0 : tp.ΠH : of e t0.ΠHv : value e ΠX : {!d : dest, ↓g : gen d t} Σ∗

gen {ψ′ 1, !d0 : dest, ↓g0 : gen d0 t0}.

preservation t d g (ψ′

1, !d0 : dest, ↓x : eval e d0)

(ψ′

1, !d0 : dest, ↓y : ret e d0)

(X1; {↓x}gen/eval e d0 g0 H) ({↓y}step/eval e d0 x Hv) (X1; {↓y}gen/ret e d0 g0 H Hv)

Implementation

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 47 / 48

slide-86
SLIDE 86

Future work

Coverage checking

◮ Coverage checking for traces is difficult due to the equality relation. ◮ Easier when restricted to generative invariants ◮ GI look like a generalization of context-free grammars

gen/eval : gen t d ⊸ of e t → {eval e d}. gen/ret : gen t d ⊸ of e t → {ret e d}. gen/fapp : gen t d ⊸ {!d1 !d2 : dest, fapp d1 d2 d, gen (arr t1 t) d1, gen t1 d2}. Non-terminal: gen. Terminals: eval, ret, fapp. Example: X1; ({y}gen/eval x); X2 ≡ X1; X2; ({y}gen/eval x)

Termination (trace size)

Jorge Luis Sacchini (joint work with Iliano Cervesato) Meta-reasoning in CLF 48 / 48