Semantics of linear logic and higher-order model-checking Charles - - PowerPoint PPT Presentation

▶
semantics of linear logic and higher order model checking
SMART_READER_LITE
LIVE PREVIEW

Semantics of linear logic and higher-order model-checking Charles - - PowerPoint PPT Presentation

Dec 28, 2022 114 likes •715 views

Semantics of linear logic and higher-order model-checking Charles Grellois Thse dirige par Paul-Andr Mellis et Olivier Serre IRIF Universit Paris Diderot - Paris 7 8 avril 2016 Charles Grellois (IRIF) Semantics of linear logic

slide-1
SLIDE 1

Semantics of linear logic and higher-order model-checking

Charles Grellois Thèse dirigée par Paul-André Melliès et Olivier Serre

IRIF — Université Paris Diderot - Paris 7

8 avril 2016

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 1 / 46

slide-2
SLIDE 2

Semantics of linear logic and higher-order model-checking

Linear logic: a logical system with an emphasis on the notion of resource. Model-checking: a key technique in verification — where we want to determine automatically whether a program satisfies a specification. My thesis: linear logic and its semantics can be enriched to obtain new and cleaner proofs of decidability in higher-order model-checking.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 2 / 46

slide-3
SLIDE 3

What is model-checking?

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 3 / 46

slide-4
SLIDE 4

The halting problem

A natural question: does a program always terminate? Undecidable problem (Turing 1936): a machine can not always determine the answer. What if we use approximations?

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 4 / 46

slide-5
SLIDE 5

Model-checking

Approximate the program − → build a model M. Then, formulate a logical specification ϕ over the model. Aim: design a program which checks whether M ϕ. That is, whether the model M meets the specification ϕ.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 5 / 46

slide-6
SLIDE 6

An example

Main

= Listen Nil Listen x = if end_signal() then x else Listen received_data() :: x

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 6 / 46

slide-7
SLIDE 7

An example

Main

= Listen Nil Listen x = if end_signal() then x else Listen received_data()::x A tree model: if if if . . . data data Nil data Nil Nil We abstracted conditionals and datatypes. The approximation contains a non-terminating branch.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 6 / 46

slide-8
SLIDE 8

Finite representations of infinite trees

if if if . . . data data Nil data Nil Nil

is not regular: it is not the unfolding of a finite graph as

if Nil if data Nil

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 7 / 46

slide-9
SLIDE 9

Finite representations of infinite trees

if if if . . . data data Nil data Nil Nil

but it is represented by a higher-order recursion scheme (HORS).

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 7 / 46

slide-10
SLIDE 10

Higher-order recursion schemes

Some regularity for infinite trees (see Chapter 3)

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 8 / 46

slide-11
SLIDE 11

Higher-order recursion schemes

Main

= Listen Nil Listen x = if end_signal() then x else Listen received_data() :: x is abstracted as G =

  • S

= L Nil L x = if x (L (data x ) ) which represents the higher-order tree of actions if if . . . data Nil Nil

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 9 / 46

slide-12
SLIDE 12

Higher-order recursion schemes

G =

  • S

= L Nil L x = if x (L (data x ) ) Rewriting starts from the start symbol S: S →G L Nil

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 10 / 46

slide-13
SLIDE 13

Higher-order recursion schemes

G =

  • S

= L Nil L x = if x (L (data x ) ) L Nil →G if L data Nil Nil

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 10 / 46

slide-14
SLIDE 14

Higher-order recursion schemes

G =

  • S

= L Nil L x = if x (L (data x ) ) if L data Nil Nil →G if if L data data Nil data Nil Nil

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 10 / 46

slide-15
SLIDE 15

Higher-order recursion schemes

G =

  • S

= L Nil L x = if x (L (data x ) ) G = if if if . . . data data Nil data Nil Nil

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 10 / 46

slide-16
SLIDE 16

Higher-order recursion schemes

G =

  • S

= L Nil L x = if x (L (data x ) ) HORS can alternatively be seen as simply-typed λ-terms with simply-typed recursion operators Yσ : (σ → σ) → σ.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 10 / 46

slide-17
SLIDE 17

Higher-order recursion schemes

G =

  • S

= L Nil L x = if x (L (data x ) ) HORS can alternatively be seen as simply-typed λ-terms with simply-typed recursion operators Yσ : (σ → σ) → σ. The rewriting may be presented coinductively (see Chapter 4).

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 10 / 46

slide-18
SLIDE 18

Alternating parity tree automata

Checking specifications over trees (see Chapter 2)

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 11 / 46

slide-19
SLIDE 19

Monadic second order logic

MSO is a common logic in verification, allowing to express properties as: « all executions halt » « a given operation is executed infinitely often in some execution » « every time data is added to a buffer, it is eventually processed »

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 12 / 46

slide-20
SLIDE 20

Alternating parity tree automata

Checking whether a formula holds can be performed using an automaton. For an MSO formula ϕ, there exists an equivalent APT Aϕ s.t. G

  • ϕ

iff Aϕ has a run over G. APT = alternating tree automata (ATA) + parity condition.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 13 / 46

slide-21
SLIDE 21

Alternating tree automata

ATA: non-deterministic tree automata whose transitions may duplicate or drop a subtree. Typically: δ(q0, if) = (2, q0) ∧ (2, q1).

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 14 / 46

slide-22
SLIDE 22

Alternating tree automata

ATA: non-deterministic tree automata whose transitions may duplicate or drop a subtree. Typically: δ(q0, if) = (2, q0) ∧ (2, q1). if q0 if if . . . data data Nil data Nil Nil − →Aϕ if q0 if q1 if . . . data data Nil data Nil if q0 if . . . data data Nil data Nil

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 14 / 46

slide-23
SLIDE 23

Alternating parity tree automata

Each state of an APT is attributed a color Ω(q) ∈ Col ⊆ N An infinite branch of a run-tree is winning iff the maximal color among the

  • nes occuring infinitely often along it is even.

c1 c2 c3 c4 c5

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 15 / 46

slide-24
SLIDE 24

Alternating parity tree automata

Each state of an APT is attributed a color Ω(q) ∈ Col ⊆ N An infinite branch of a run-tree is winning iff the maximal color among the

  • nes occuring infinitely often along it is even.

A run-tree is winning iff all its infinite branches are. For a MSO formula ϕ: Aϕ has a winning run-tree over G iff G ϕ.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 15 / 46

slide-25
SLIDE 25

The higher-order model-checking problems

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 16 / 46

slide-26
SLIDE 26

The (local) HOMC problem

Input: HORS G, formula ϕ. Output: true if and only if G ϕ. Example: ϕ = « there is an infinite execution » if if if . . . data data Nil data Nil Nil Output: true.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 17 / 46

slide-27
SLIDE 27

The (local) HOMC problem

Input: HORS G, formula ϕ. Output: true if and only if G ϕ. Example: ϕ = « there is an infinite execution » if if if . . . data data Nil data Nil Nil Output: true.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 17 / 46

slide-28
SLIDE 28

The global HOMC problem

Input: HORS G, formula ϕ. Output: a HORS G• producing a marking of G. Example: ϕ = « there is an infinite execution » Output: G• of value tree: if• if• if• . . . data data Nil data Nil Nil

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 18 / 46

slide-29
SLIDE 29

The selection problem

Input: HORS G, APT A, state q ∈ Q. Output: false if there is no winning run of A over G. Else, a HORS Gq producing a such a winning run. Example: ϕ = « there is an infinite execution », q0 corresponding to ϕ Output: Gq0 producing ifq0 ifq0 ifq0 . . .

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 19 / 46

slide-30
SLIDE 30

Purpose of this thesis

These three problems are decidable, with elaborate proofs (often) relying

  • n semantics.

Our contribution: an excavation of the semantic roots of HOMC, at the light of linear logic, leading to refined and clarified proofs.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 20 / 46

slide-31
SLIDE 31

Recognition by homomorphism

Where semantics comes into play

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 21 / 46

slide-32
SLIDE 32

Automata and recognition

For the usual finite automata on words: given a regular language L ⊆ A∗, there exists a finite automaton A recognizing L if and only if. . . there exists a finite monoid M, a subset K ⊆ M and a homomorphism ϕ : A∗ → M such that L = ϕ−1(K).

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 22 / 46

slide-33
SLIDE 33

Automata and recognition

The picture we want: (after Aehlig 2006, Salvati 2009) but with recursion and w.r.t. an APT.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 23 / 46

slide-34
SLIDE 34

Intersection types and alternation

A first connection with linear logic

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 24 / 46

slide-35
SLIDE 35

Alternating tree automata and intersection types

A key remark (Kobayashi 2009): δ(q0, if) = (2, q0) ∧ (2, q1) can be seen as the intersection typing if : ∅ → (q0 ∧ q1) → q0 refining the simple typing if : o → o → o

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 25 / 46

slide-36
SLIDE 36

Alternating tree automata and intersection types

In a derivation typing the tree if T1 T2 :

δ ∅ ⊢ if : ∅ → (q0 ∧ q1) → q0 ∅ App ∅ ⊢ if T1 : (q0 ∧ q1) → q0 . . . ∅ ⊢ T2 : q0 . . . ∅ ⊢ T2 : q1 App ∅ ⊢ if T1 T2 : q0

Intersection types naturally lift to higher-order – and thus to G, which finitely represents G.

Theorem (Kobayashi 2009)

⊢ G : q0 iff the ATA Aϕ has a run-tree over G.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 26 / 46

slide-37
SLIDE 37

A closer look at the Application rule

In the intersection type system:

∆ ⊢ t : ( θ1 ∧ · · · ∧ θn) → θ ∆i ⊢ u : θi App ∆ , ∆1 , . . . , ∆n ⊢ t u : θ

This rule could be decomposed as: ∆ ⊢ t : ( n

i=1 θi ) → θ′

∆i ⊢ u : θi ∀i ∈ {1, . . . , n} Right ∆1, . . . , ∆n ⊢ u : n

i=1 θi

∆, ∆1, . . . , ∆n ⊢ t u : θ′

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 27 / 46

slide-38
SLIDE 38

A closer look at the Application rule

In the intersection type system:

∆ ⊢ t : ( θ1 ∧ · · · ∧ θn) → θ ∆i ⊢ u : θi App ∆ , ∆1 , . . . , ∆n ⊢ t u : θ

This rule could be decomposed as: ∆ ⊢ t : ( n

i=1 θi ) → θ′

∆i ⊢ u : θi ∀i ∈ {1, . . . , n} Right ∆1, . . . , ∆n ⊢ u : n

i=1 θi

∆, ∆1, . . . , ∆n ⊢ t u : θ′

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 27 / 46

slide-39
SLIDE 39

A closer look at the Application rule

∆ ⊢ t : ( n

i=1 θi ) → θ′

∆i ⊢ u : θi ∀i ∈ {1, . . . , n} Right ∆1, . . . , ∆n ⊢ u : n

i=1 θi

∆, ∆1, . . . , ∆n ⊢ t u : θ′ Linear decomposition of the intuitionistic arrow: A ⇒ B = ! A ⊸ B Two steps: duplication / erasure, then linear use. Right corresponds to the Promotion rule of indexed linear logic. (see G.-Melliès, ITRS 2014)

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 28 / 46

slide-40
SLIDE 40

Intersection types and semantics of linear logic

A ⇒ B = ! A ⊸ B Two interpretations of the exponential modality: Qualitative models (Scott semantics) ! A = Pfin(A) [ [o ⇒ o] ] = Pfin(Q) × Q {q0, q0, q1} = {q0, q1} Order closure Quantitative models (Relational semantics) ! A = Mfin(A) [ [o ⇒ o] ] = Mfin(Q) × Q [q0, q0, q1] = [q0, q1] Unbounded multiplicities

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 29 / 46

slide-41
SLIDE 41

An example of interpretation

λx λy a q0 a q1 x q1 x q1 a q0 y q1 x q0 In Rel, one denotation: ([q0, q1, q1], [q1], q0) In ScottL, a set containing the principal type ({q0, q1}, {q1}, q0) but also ({q0, q1, q2}, {q1}, q0) and ({q0, q1}, {q0, q1}, q0) and . . .

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 30 / 46

slide-42
SLIDE 42

Intersection types and semantics of linear logic

Rel!

Ehrhard

  • Bucciarelli−Ehrhard

de Carvalho

Non-idempotent types

Ehrhard

  • ScottL!

Ehrhard Terui

Idempotent types

  • (Bucciarelli-Ehrhard 2001, de Carvalho 2009, Ehrhard 2012, Terui 2012)

Fundamental idea: [ [t] ] ∼ = { θ | ∅ ⊢ t : θ } for a closed term.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 31 / 46

slide-43
SLIDE 43

Intersection types and semantics of linear logic

Rel!

Ehrhard

  • Bucciarelli−Ehrhard

de Carvalho

Non-idempotent types

Ehrhard

  • ScottL!

Ehrhard Terui

Idempotent types

  • Let t be a term normalizing to a tree t and A be an alternating

automaton. A accepts t from q ⇔ q ∈ [ [t] ] ⇔ ∅ ⊢ t : q :: o (see Chapter 5) Extension with recursion and parity condition?

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 31 / 46

slide-44
SLIDE 44

Adding parity conditions to the type system

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 32 / 46

slide-45
SLIDE 45

Alternating parity tree automata

We add coloring annotations to intersection types: δ(q0, if) = (2, q0) ∧ (2, q1) now corresponds to if : ∅ →

  • Ω(q0) q0 ∧ Ω(q1) q1
  • → q0

Idea: if is a run-tree with two holes: if [ ]q1 [ ]q0 A new neutral (least) color: ǫ. We refine the approach of Kobayashi and Ong in a modal way (see Chapter 6).

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 33 / 46

slide-46
SLIDE 46

An example of colored intersection type

Set Ω(q0) = 0 and Ω(q1) = 1. λx λy a q1 a q1 x q1 x q1 a q0 y q1 x q0 has now type 0 q0 ∧ 1 q1 → 1 q1 → q1 Note the color 0 on q0. . .

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 34 / 46

slide-47
SLIDE 47

A type-system for verification (Grellois-Melliès 2014)

Axiom x : ǫ θi ⊢ x : θi { (i, qij) | 1 ≤ i ≤ n, 1 ≤ j ≤ ki} satisfies δA(q, a) δ ∅ ⊢ a : k1

j=1 Ω(q1j) q1j → . . . → kn j=1 Ω(qnj) qnj → q

∆ ⊢ t : (m1 θ1 ∧ · · · ∧ mk θk) → θ ∆i ⊢ u : θi App ∆ + m1∆1 + . . . + mk∆k ⊢ t u : θ ∆ , x :

i∈I mi θi

⊢ t : θ λ ∆ ⊢ λ x . t :

  • i∈I mi θi
  • → θ

Γ ⊢ R(F) : θ fix F : ǫ θ ⊢ F : θ

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 35 / 46

slide-48
SLIDE 48

A type-system for verification

A colored Application rule:

∆ ⊢ t : (m1 θ1 ∧ · · · ∧ mk θk) → θ ∆i ⊢ u : θi App ∆ + m1∆1 + . . . + mk∆k ⊢ t u : θ

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 36 / 46

slide-49
SLIDE 49

A type-system for verification

A colored Application rule:

∆ ⊢ t : (m1 θ1 ∧ · · · ∧ mk θk) → θ ∆i ⊢ u : θi App ∆ + m1∆1 + . . . + mk∆k ⊢ t u : θ

inducing a winning condition on infinite proofs: the node ∆i ⊢ u : θi has color mi, others have color ǫ, and we use the parity condition.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 36 / 46

slide-50
SLIDE 50

A type-system for verification

We now capture all MSO (see Chapter 6-8):

Theorem (G.-Melliès 2014, from Kobayashi-Ong 2009)

S : q0 ⊢ S : q0 admits a winning typing derivation iff the alternating parity automaton A has a winning run-tree over G. We obtain decidability by considering idempotent types. Our reformulation shows the modal nature of (in the sense of S4), internalizes the parity condition, paves the way for semantic constructions.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 37 / 46

slide-51
SLIDE 51

Colored models of linear logic

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 38 / 46

slide-52
SLIDE 52

A closer look at the Application rule

∆ ⊢ t : (m1 θ1 ∧ · · · ∧ mk θk) → θ ∆i ⊢ u : θi ∆ + m1∆1 + . . . + mk∆k ⊢ t u : θ

could be decomposed as:

∆ ⊢ t : k

i=1 mi θi

  • → θ

∆1 ⊢ u : θ1 m1 ∆1 ⊢ u : m1 θ1 . . . ∆k ⊢ u : θk Right mk ∆k ⊢ u : mk θk Right m1∆1, . . . , mk∆k ⊢ u : k

i=1 mi θi

∆, m1∆1, . . . , mk∆k ⊢ t u : θ

Right looks like a promotion. In linear logic: A ⇒ B = ! A ⊸ B We show that the modality distributes over the exponential in the semantics.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 39 / 46

slide-53
SLIDE 53

Colored semantics

We extend: Rel with countable multiplicities, coloring and an inductive-coinductive fixpoint (Chapter 9) ScottL with coloring and an inductive-coinductive fixpoint (Chapter 10). Methodology: think in the relational semantics, and adapt to the Scott semantics using Ehrhard’s 2012 result: the finitary model ScottL is the extensional collapse of Rel.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 40 / 46

slide-54
SLIDE 54

Infinitary relational semantics

Extension of Rel with infinite multiplicities: A = Mcount(A) and coloring modality (parametric comonad) A = Col × A Composite comonad:

  • = is an exponential.

Induces a colored CCC Rel

  • (→ model of the λ-calculus).

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 41 / 46

slide-55
SLIDE 55

An example of interpretation

Set Ω(qi) = i. λx λy a q1 a q1 x q1 x q1 a q0 y q1 x q0 has denotation ([(0, q0), (1, q1), (1, q1)], [(1, q1)], q1) (corresponding to the type 0 q0 ∧ 1 q1 → 1 q1 → q1)

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 42 / 46

slide-56
SLIDE 56

Model-checking and infinitary semantics (Chapter 9)

Inductive-coinductive fixpoint operator: composes denotations w.r.t. the parity condition.

Theorem

An APT A has a winning run from q0 over G if and only if q0 ∈ [ [λ(G)] ]A where λ(G) is a λY -term corresponding to G.

Conjecture

An APT A has a winning run from q0 over G if and only if q0 ∈ [ [λ(G)Σ] ] ◦ [ [δ†] ] where λ(G)Σ is a Church encoding of a λY -term corresponding to G.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 43 / 46

slide-57
SLIDE 57

Finitary semantics (Chapter 10)

In ScottL, we define , λ and Y similarly (using downward-closures). ScottL

  • is a model of the λY -calculus.

Theorem

An APT A has a winning run from q0 over G if and only if q0 ∈ [ [λ(G)] ].

Corollary

The local higher-order model-checking problem is decidable (and is n-EXPTIME complete).

Theorem

The selection problem is decidable.

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 44 / 46

slide-58
SLIDE 58

Contributions (see Chapter 11)

A coinductive presentation of the interaction of HORS rewriting and APT execution (Chapter 4) A modal and purely type-theoretic reformulation of the Kobayashi-Ong type system (Chapter 6), including a full proof of the soundness-and-completeness theorem (Chapters 7 and 8) An infinitary model of linear logic, with a non-continuous interpretation of λY -terms (Chapter 9) Colored tensorial logic (Chapter 9) A finitary model of linear logic leading to the decidability of the HOMC problems (Chapter 10)

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 45 / 46

slide-59
SLIDE 59

Perspectives (see Chapter 11)

A purely coinductive proof of the soundness-and-completeness theorem Accommodating the modal approach to other classes of automata Understanding the infinitary semantics Logical aspects: colored tensorial logic, fixpoints. . . Game semantics interpretations? Is the complexity related to light linear logics? Extensional collapse between the two colored models?

Charles Grellois (IRIF) Semantics of linear logic and HOMC April 8, 2016 46 / 46