N OT A SINGLE PROOF ASSISTANT FOR ALL BUT PROOF ASSISTANTS FOR - - PowerPoint PPT Presentation

NICOLAS TABAREAU

NOT A SINGLE PROOF ASSISTANT FOR ALL

BUT PROOF ASSISTANTS FOR EVERYONE


Not a single proof assistant for all but proof assistants for everyone


Not the Work of a Single Man

Not a single proof assistant for all but proof assistants for everyone


Coq: a success but ...

3

Based on the correspondence: Formula ⟺ Type Proof ⟺ Program Type Theory has been developed, providing a common language for mathematics and computer science ⇒ Coq

Not a single proof assistant for all but proof assistants for everyone


Coq: a success but ...

3

Based on the correspondence: Formula ⟺ Type Proof ⟺ Program Type Theory has been developed, providing a common language for mathematics and computer science ⇒ Coq “At the same time a programming language and a logical system”

Not a single proof assistant for all but proof assistants for everyone


Coq: a success but ...

4

CompCert Compiler

Theorem Proving Program certification

Odd Order Theorem

A mature system: ACM 2013 Software System Award Coq Consortium (Inria Foundation) Continuous Integration, 2 releases per year

Not a single proof assistant for all but proof assistants for everyone


... not the last word

5

Many weaknesses cannot be solved without changing the theoretical foundations of Coq: Extend Coq as a programming language Extend Coq as a logical system

Not a single proof assistant for all but proof assistants for everyone


Extend the logic

6

common operators/principles cannot be “constructed” (e.g., excluded middle) the notion of equality/conversion is too weak

Not a single proof assistant for all but proof assistants for everyone


Extend the logic

6

common operators/principles cannot be “constructed” (e.g., excluded middle) the notion of equality/conversion is too weak

(n;prime_n) ≠ (n;prime_n)

Example: prime integers

Not a single proof assistant for all but proof assistants for everyone


Extend the logic

7

The difficulty is that every new logical principle must come with its computational interpretation.

Not a single proof assistant for all but proof assistants for everyone


Extend the logic

7

The difficulty is that every new logical principle must come with its computational interpretation. For instance, what is the computational meaning of the excluded middle ?

Not a single proof assistant for all but proof assistants for everyone
 8

Extend the language

Hello World in Coq

Not a single proof assistant for all but proof assistants for everyone
 8

No “Hello World” !

Extend the language

Hello World in Coq

Not a single proof assistant for all but proof assistants for everyone
 9

Users Need More

On the logical side: Excluded Middle UIP Univalence / FunExt Definitional Pf Irr On the PL side: Exceptions Memory Non-determinism Non-termination

Not a single proof assistant for all but proof assistants for everyone
 10

Excluded Middle

∀P, ¬P + P

Not a single proof assistant for all but proof assistants for everyone
 10

Excluded Middle

∀P, ¬P + P

Useful to do proof by contradiction

Note: I don’t want to dive into constructivism debate

Not a single proof assistant for all but proof assistants for everyone
 11

Functional Extensionality

∀A B (f g : ∀a : A, B a), (∀a, f a = g a) → f = g

Not a single proof assistant for all but proof assistants for everyone
 11

Functional Extensionality

Applications: prove monadic laws, for instance for states actually useful as soon as we need to deal with equality of functions

∀A B (f g : ∀a : A, B a), (∀a, f a = g a) → f = g

Not a single proof assistant for all but proof assistants for everyone
 12

Univalence

8(A B : Type), A ' B ! A = B

Not a single proof assistant for all but proof assistants for everyone
 12

Univalence

Applications: conversion between equivalent structures synthetic homotopy

8(A B : Type), A ' B ! A = B

Not a single proof assistant for all but proof assistants for everyone
 13

Uniqueness of Identity Proof

∀A (x y : A) (e e0 : x = y), e = e0

Not a single proof assistant for all but proof assistants for everyone
 13

Uniqueness of Identity Proof

Applications: avoid higher coherence issue

∀A (x y : A) (e e0 : x = y), e = e0

Not a single proof assistant for all but proof assistants for everyone
 14

Definitional Proof Irrelevance

∀ (P : Prop)(x y : P), x ≡ y

Not a single proof assistant for all but proof assistants for everyone
 14

Definitional Proof Irrelevance

∀ (P : Prop)(x y : P), x ≡ y

Applications:

(n;prime_n) = (n;prime_n)

Not a single proof assistant for all but proof assistants for everyone
 15

Exceptions

by a function raise : E → ΠA : ⇤. A wher limits the ability to catch exceptions on the

catchBe : ΠP : Be → ⇤e

i . P truee → P falsee →

which is subject to the following equations

→ (Πe : E. P (raise Be e)) → Πb : Be. P b

quations

Not a single proof assistant for all but proof assistants for everyone
 15

Exceptions

Applications: partiality : define head without premisses importing Haskell functions into Coq
 (hs-to-coq project)

by a function raise : E → ΠA : ⇤. A wher limits the ability to catch exceptions on the

catchBe : ΠP : Be → ⇤e

i . P truee → P falsee →

which is subject to the following equations

→ (Πe : E. P (raise Be e)) → Πb : Be. P b

quations

Not a single proof assistant for all but proof assistants for everyone
 16

Memory

write : Mem → N → ()

read : Mem → N

Not a single proof assistant for all but proof assistants for everyone
 16

Memory

Applications: define and reason on efficient functions
 e.g., in computer algebra

write : Mem → N → ()

read : Mem → N

Not a single proof assistant for all but proof assistants for everyone
 17

Non-determinism

nd : ∀ A, A → A → A

Not a single proof assistant for all but proof assistants for everyone
 17

Non-determinism

Applications: modelling and reasoning on physical phenomena which are non-deterministic
 (or similarly not entirely understood)

nd : ∀ A, A → A → A

Not a single proof assistant for all but proof assistants for everyone
 18

Non-termination

Y : ∀ A B, ((A → B) → (A → B)) → (A → B)

Not a single proof assistant for all but proof assistants for everyone
 18

Non-termination

Applications: dealing with arbitrary fixpoints

Y : ∀ A B, ((A → B) → (A → B)) → (A → B)

Not a single proof assistant for all but proof assistants for everyone
 19

consistency issues
 valid axioms can be wrong altogether breaks the extraction mechanism
 axioms have no computational meaning limits possibility of automation
 can not use reflection in the proof

One EASY way out

make use of axioms

19

Not a single proof assistant for all but proof assistants for everyone
 20

strong engineering effort
 HO unification, tactic language, efficiency community issue
 needs to build a new user community maintenance issue
 needs a strategy to go beyond prototyping

One HARD way out

define a new proof assistant

20

Not a single proof assistant for all but proof assistants for everyone
 21

Difficulties in Extending the Theoretical Foundations

can break consistency can break decidability of type checking can break dependent elimination

Not a single proof assistant for all but proof assistants for everyone
 22

Difficulties in Extending the Theoretical Foundations

can break consistency For several reasons, all not necessarily bad

Not a single proof assistant for all but proof assistants for everyone
 23

Inconsistency 1: Non-Termination

Y () ⊥ id tt : ⊥

Not a single proof assistant for all but proof assistants for everyone
 23

Inconsistency 1: Non-Termination

As a programming language this is not necessarily an issue.

Y () ⊥ id tt : ⊥

Not a single proof assistant for all but proof assistants for everyone
 24

Inconsistency I1: UIP + univalence

UIP says there is one proof of 
 given by reflection.
 Univalence says that there are at least two proofs of , coarsely the identity function and boolean negation.

B = B

B = B

Not a single proof assistant for all but proof assistants for everyone
 24

Inconsistency I1: UIP + univalence

UIP says there is one proof of 
 given by reflection.
 Univalence says that there are at least two proofs of , coarsely the identity function and boolean negation.

B = B

B = B

This inconsistency is more problematic.

Not a single proof assistant for all but proof assistants for everyone
 25

Inconsistency III: Mutable States + univalence

Using states, you can build an equivalence between and ().

B

Contextual Isomorphisms, P. B. Levy, POPL’17

Not a single proof assistant for all but proof assistants for everyone
 25

Inconsistency III: Mutable States + univalence

Using states, you can build an equivalence between and ().

B

Contextual Isomorphisms, P. B. Levy, POPL’17

true = false → ⊥

Not a single proof assistant for all but proof assistants for everyone
 26

Undecidability of type checking

Not a single proof assistant for all but proof assistants for everyone
 26

Undecidability of type checking

x = y → x ≡ y

reflection rule (extensional type theory)

Not a single proof assistant for all but proof assistants for everyone
 26

Undecidability of type checking

undecidable because it assumes that every equality can be computed by the system

x = y → x ≡ y

reflection rule (extensional type theory)

Not a single proof assistant for all but proof assistants for everyone
 27

Invalid Dependent Elimination

Not a single proof assistant for all but proof assistants for everyone
 27

Invalid Dependent Elimination

∀ n m : N, n + m = m + n

Not a single proof assistant for all but proof assistants for everyone
 27

Invalid Dependent Elimination

∀ n m : N, n + m = m + n

Provable by induction on n

Not a single proof assistant for all but proof assistants for everyone
 28

Invalid Dependent Elimination

• (n , m) => n + m = m + n

∀ n m : N, n + m = m + n

Not a single proof assistant for all but proof assistants for everyone
 28

Invalid Dependent Elimination

• (3 , 5) => 8 = 8dddddddd
• (n , m) => n + m = m + n

∀ n m : N, n + m = m + n

Not a single proof assistant for all but proof assistants for everyone
 28

Invalid Dependent Elimination

• (3 , 5) => 8 = 8dddddddd
• (raise “foo”, 8) => raise “foo” = raise “foo”
• (n , m) => n + m = m + n

∀ n m : N, n + m = m + n

Not a single proof assistant for all but proof assistants for everyone
 28

Invalid Dependent Elimination

• (3 , 5) => 8 = 8dddddddd
• (raise “foo”, 8) => raise “foo” = raise “foo”
• (raise “foo” , raise “bar”) => raise “foo” = raise “bar”dddddddd
• (n , m) => n + m = m + n

∀ n m : N, n + m = m + n

Not a single proof assistant for all but proof assistants for everyone
 29

Invalid Dependent Elimination

∀ n m : N, n + m = m + n

Not true in presence of effects

Not a single proof assistant for all but proof assistants for everyone
 30

Effectful Hierarchies of Universes

This means we need to consider more complex type theories with several hierarchies of universes: pure exceptional ICFP’19 stateful non-terminating

Not a single proof assistant for all but proof assistants for everyone
 31

• 1. By modifying the kernel of Coq

ITP’14, POPL’19

• 2. By a direct encoding (“high level syntactic sugar”)

ICFP’16, JFP’18, ICFP’18, CPP’19

• 3. By a compilation phase into the initial system

LICS’12, LICS’16, LICS’17, ESOP’18, ICFP’19 There are (at least) three ways to extend Coq:

Not a single proof assistant for all but proof assistants for everyone
 32

• 1. By modifying the kernel of Coq
• 2. By a direct encoding (“high level syntactic sugar”)
• 3. By a compilation phase into the initial system

There are (at least) three ways to extend Coq:

Not a single proof assistant for all but proof assistants for everyone


Definitional Proof-Irrelevance without K

33

• Γ ⊢ A : i

Γ ⊢ x : A Γ ⊢ y : A Γ ⊢ x ≡ y : A

Not a single proof assistant for all but proof assistants for everyone


Definitional Proof-Irrelevance without K

33

• Γ ⊢ A : i

Γ ⊢ x : A Γ ⊢ y : A Γ ⊢ x ≡ y : A

• (n;prime_n)

= (n;prime_n)

Not a single proof assistant for all but proof assistants for everyone


Definitional Proof-Irrelevance without K

33

Agda

8.10 2.6

• Γ ⊢ A : i

Γ ⊢ x : A Γ ⊢ y : A Γ ⊢ x ≡ y : A

Not a single proof assistant for all but proof assistants for everyone
 34

• 1. By modifying the kernel of Coq
• 2. By a direct encoding (“high level syntactic sugar”)
• 3. By a compilation phase into the initial system

There are (at least) three ways to extend Coq:

Not a single proof assistant for all but proof assistants for everyone


: N N :=

BinNat

Univalent Parametricity ICFP’18

35

Not a single proof assistant for all but proof assistants for everyone


: N N :=

BinNat

Univalent Parametricity ICFP’18

35

Not a single proof assistant for all but proof assistants for everyone


: N N :=

BinNat

Univalent Parametricity ICFP’18

35

Not a single proof assistant for all but proof assistants for everyone


: N N :=

BinNat

Univalent Parametricity ICFP’18

automatic lifting using parametricity and homotopy equivalences

35

Not a single proof assistant for all but proof assistants for everyone
 36

• 1. By modifying the kernel of Coq
• 2. By a direct encoding (“high level syntactic sugar”)
• 3. By a compilation phase into the initial system

There are (at least) three ways to extend Coq:

36

Not a single proof assistant for all but proof assistants for everyone
 37

From complex model to simple model

Build complex models from simpler ones.

• Presheaves
• Grothendieck Sheaves
• Coalgebras
• Quotients

source model target model

Not a single proof assistant for all but proof assistants for everyone
 37

From complex model to simple model

source model target model

Example: Presheaves F : Presheaves F : A Set

Not a single proof assistant for all but proof assistants for everyone
 38

From high-level languages to low-level languages

Compile high level languages into low level languages

• C binary code
• Prolog abstract machine code
• Scala Java bytecode
• Defunctionalization

source language target language

JpK p

Not a single proof assistant for all but proof assistants for everyone
 38

From high-level languages to low-level languages

source language target language

JpK p

Example:

Not a single proof assistant for all but proof assistants for everyone
 39

From complex logics to simple logics

Through the Curry-Howard correspondence: Logical translation = program compilation

Not a single proof assistant for all but proof assistants for everyone
 40

The connection between extension of models and compilation of languages is more than an analogy

Claim

Not a single proof assistant for all but proof assistants for everyone
 40

The connection between extension of models and compilation of languages is more than an analogy The target system is the type theory of Coq, seen as an assembly language of logic

Claim

Not a single proof assistant for all but proof assistants for everyone
 41

Motto

“ Not a single proof assistant for all, but proof assistants for everyone. ”

Not a single proof assistant for all but proof assistants for everyone


Methodology.

Distinct compilation phases

Compile complex type theories into simpler

• nes.

inherit consistency 


• f Coq


split the complexity 


• f type checking

42

Full Coq w/o Exceptions w/o General Fixpoints Compiled Coq w/o Effects Kernel of Coq

ESOP’18 LICS’16 LICS’17 ICFP’19

Not a single proof assistant for all but proof assistants for everyone
 43

Methodology.

Extend Coq using plugins

+ =

with new principles, without axioms

Not a single proof assistant for all but proof assistants for everyone
 44

Several Compilation Phases

dependent types + forcing

LICS’12 LICS’16

dependent types + monadic translation

LICS’17

dependent types + exceptional translation

ESOP’18 ICFP’19

Not a single proof assistant for all but proof assistants for everyone
 45

Users Need More

On the logical side: Excluded Middle UIP Univalence / FunExt Definitional Pf Irr On the PL side: Exceptions Memory Non-determinism Non-termination

Not a single proof assistant for all but proof assistants for everyone
 46

Users Need More

Excluded Middle
 SPROP + Gödel translation UIP
 SPROP + equality elimination Univalence / FunExt
 Forcing on cubes Definitional Proof Irrelevance
 SPROP

Not a single proof assistant for all but proof assistants for everyone
 47

Users Need More

Exceptions
 Exceptional Translation Memory
 WE DON’T KNOW YET Non-determinism Monadic Translation Non-termination Monadic Translation

Not a single proof assistant for all but proof assistants for everyone


Certified MetaProgramming with MetaCoq

48

Not a single proof assistant for all but proof assistants for everyone
 49

MetaCoq is a Coq plugin that allows to describe the syntax and type system of Coq in Coq

quoting unquoting

MetaCoq

ITP’18

Not a single proof assistant for all but proof assistants for everyone
 50

Certification of compilation phases in Coq

quoting compilation + unquoting

Not a single proof assistant for all but proof assistants for everyone
 51

A Certified Proof Assistant

Certification of Coq in Coq

Not a single proof assistant for all but proof assistants for everyone
 51

A Certified Proof Assistant

The goal is not to prove the consistency of Coq, but to certify its implementation !

Certification of Coq in Coq

Not a single proof assistant for all but proof assistants for everyone
 52

Challenges

• 1. Define type preserving compilation phases
• 2. Understand the theory justified by compilation
• 3. Get something usable in practice

Not a single proof assistant for all but proof assistants for everyone
 53

Challenges

• 1. Define type preserving compilation phases

Correct proofs correspond to well-typed programs => correct compilations must be type-preserving.

Not a single proof assistant for all but proof assistants for everyone
 54

Challenges

• 2. Understand the theory justified by compilation

What are the new programming features ? What are the new logical features ? How do they compute ?

Not a single proof assistant for all but proof assistants for everyone
 55

Challenges

• 3. Get something usable in practice

Efficiency is a critical feature for the scaling of proof assistants. Problem: a compilation phase may introduce an exponential blow up in the size of the term !

Not a single proof assistant for all but proof assistants for everyone
 56

Idea: Implement directly the source theory in the Coq Proof Assistant.

Not a single proof assistant for all but proof assistants for everyone
 56

Idea: Implement directly the source theory in the Coq Proof Assistant. But HOW ?

Not a single proof assistant for all but proof assistants for everyone
 57

Rewrite Rules to the Rescue

Not a single proof assistant for all but proof assistants for everyone
 57

Rewrite Rules to the Rescue

Coq Decidable typechecking Anti-modular and anti-experimentation

Not a single proof assistant for all but proof assistants for everyone
 57

Rewrite Rules to the Rescue

Coq Decidable typechecking Anti-modular and anti-experimentation Coq + equality reflection Freedom to reflect arbitrary equalities Typechecking requires user input

Not a single proof assistant for all but proof assistants for everyone
 57

Rewrite Rules to the Rescue

Coq Decidable typechecking Anti-modular and anti-experimentation Coq + equality reflection Freedom to reflect arbitrary equalities Typechecking requires user input Coq + confluent rewrite rules Reflect any confluent rewrite system Typechecking works in practice

Not a single proof assistant for all but proof assistants for everyone
 58

Coming Back to Exceptions

Not a single proof assistant for all but proof assistants for everyone
 58

Coming Back to Exceptions

Not a single proof assistant for all but proof assistants for everyone
 59

Rewrite Rules can break Subject Reduction

Not a single proof assistant for all but proof assistants for everyone
 60

Rewrite Rules can break SR

Not a single proof assistant for all but proof assistants for everyone
 61

Tame Your Rewrite Rules in Two Steps

Disallow rewriting of type constructors Check confluence of rewrite rules In Agda : --rewriting --confluence-check Now available in Agda, soon also in Coq!

Not a single proof assistant for all but proof assistants for everyone
 62

Prevent Misbehaved Examples

Not a single proof assistant for all but proof assistants for everyone
 63

In a nutshell

Extending proof assistants 
 using compilation phases
 Certified with MetaCoq 
 Implemented using rewrite rules

Full Coq w/o Exceptions w/o General Fixpoints Compiled Coq w/o Effects Kernel of Coq