Certified Undecidability of Intuitionistic Linear Logic via Binary Stack Machines and Minsky Machines Yannick Forster, Dominique Larchey-Wendling
To cite this version:
Yannick Forster, Dominique Larchey-Wendling. Certified Undecidability of Intuitionistic Linear Logic via Binary Stack Machines and Minsky Machines. The 8th ACM SIGPLAN International Con- ference on Certified Programs and Proofs, CPP 2019, Jan 2019, Cascais, Portugal. pp.104-117, 10.1145/3293880.3294096. hal-02333390
HAL Id: hal-02333390 https://hal.archives-ouvertes.fr/hal-02333390 Submitted on 9 Nov 2020
HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Certified Undecidability of Intuitionistic Linear Logic via Binary Stack Machines and Minsky Machines
Yannick Forster Dominique Larchey-Wendling Saarland University Université de Lorraine, CNRS, LORIA Saarbrücken, Germany Vandœuvre-lès-Nancy, France [email protected] [email protected]
Abstract machines (BSM), Minsky machines (MM) and (elementary) We formally prove the undecidability of entailment in intu- intuitionistic linear logic (both eILL and ILL): itionistic linear logic in Coq. We reduce the Post correspond- PCP ⪯ BPCP ⪯ iBPCP ⪯ BSM ⪯ MM ⪯ eILL ⪯ ILL ence problem (PCP) via binary stack machines and Minsky machines to intuitionistic linear logic. The reductions rely on Combined with the reduction Halt ⪯ PCP of [11], this yields several technically involved formalisations, amongst them a a fully formalised reduction from the halting problem of binary stack machine simulator for PCP, a verified low-level Turing machines to entailment in ILL. compiler for instruction-based languages and a soundness PCP is a problem over a finite set of cards, each having a proof for intuitionistic linear logic with respect to trivial string at the top and bottom. Such a PCP instance is solvable phase semantics. We exploit the computability of all func- if there is a non-empty finite sequence of those cards with tions definable in constructive type theory and thus do not an equal upper and lower string. We follow [11] in giving a have to rely on a concrete model of computation, enabling definition of PCP with countably many symbols. We reduce the reduction proofs to focus on correctness properties. PCP to BPCP, where symbols are restricted to Booleans and to iBPCP, where the sequence of cards is represented by a Keywords Undecidability, many-one reduction, binary stack sequence of their indices (natural numbers). machines, Minsky machines, intuitionistic linear logic, low- We describe a general framework for the semantics of level compiler, constructive type theory, Coq instruction-based machine models and explain how it can be used for compositional reasoning. We then define bin- 1 Introduction ary stack machines as an instance of such instruction-based Undecidability of advanced problems is usually established machines. BSMs have a fixed number of binary stacks and using computable (many-one) reductions from a problem programs consist of consecutively indexed PUSH and POP already known to be undecidable. Such reductions rely on instructions, the latter allowing conditional jumps based many subtle details and could thus be a prime example for on the obtained Boolean or if the stack is empty. A BSM the use of interactive theorem provers to assist ongoing re- program terminates if it jumps to a non-existing index. We search. However, formalisations of undecidability proofs are verify an iBPCP simulator — which is a BSM program ter- not common in the literature. There are two main obstacles minating if and only if a given iBPCP instance is solvable — in our eyes: (1) proofs on paper mostly omit the invariants by enumerating all possible sequences of cards. The pro- needed for the verification of the reduction; (2) they omit gram size is linear in the size of the instance and always has the computability proof, which amounts to the formal veri- more than 80 instructions. It consists of several independ- fication of a program in the chosen model of computation. ent sub-programs, making the verification crucially rely on Constructive type theory, as implemented in the proof compositional reasoning. assistant Coq [36], provides a particularly convenient set- We define Minsky machines32 [ ] with a fixed number of ting for decidability and undecidability proofs. Since every natural-number registers as another instance of instruction- function definable in constructive type theory is computable, based machines. MM-programs consist of INC and DEC op- one can use a synthetic approach to computability. This ap- erations, the latter allowing conditional jumps if the re- proach makes an explicit model of computation and explicit gister is zero. We describe and verify a general compiler computability proofs unnecessary, enabling the proofs to for instruction-based languages and use it to compile BSM focus on the invariants needed for the reduction. programs to MM programs. The main challenge is to re- In this paper we contribute a formalised chain of reduc- arrange jumps using a linker. For the reduction we have tions, starting at the Post correspondence problem (PCP), via to prove correctness of the compiler for both terminating binary PCP (BPCP), BPCP with indices (iBPCP), binary stack and non-terminating programs, a notable difference to other verified compilers (e.g. [6, 28]). CPP’19, January 14–15 2019, Lisbon, Portugal We formalise intuitionistic linear logic with a sequent cal- 2018. culus SILL. We introduce the elementary fragment of ILL [26, 1 CPP’19, January 14–15 2019, Lisbon, Portugal Yannick Forster and Dominique Larchey-Wendling
1 27] together with a goal directed sequent calculus GeILL a problem p can never be actually proven. However, in which is equivalent to SILL on this fragment: both define the practice, the undecidability of a problem is rarely established same entailment predicate. We give a denotational semantics directly anyway. Most proofs are by reduction from another for ILL using trivial phase semantics based on commutat- undecidable problem, and ultimately most problems are thus ive monoids and prove soundness of SILL for this semantics. proven undecidable by reduction from an initial undecidable Finally, we show that entailment in GeILL is complete for problem. In most textbook presentations, it is the halting trivial phase semantics, yielding a reduction of eILL to ILL. problem (Halt) which is seen as a seed of undecidability. Our arguments slightly generalise those of the proof in [27] The idea to exploit reductions to prove the undecidability to formalise the reduction chain MM ⪯ eILL ⪯ ILL. of problems is well-known. It was first used to formalise We conclude the paper by summarising our efforts to build undecidability proofs in a proof assistant without referring a library of undecidable problems in Coq [14] and by giving to an explicit model of computation in [11]. They define an overview of related work. The library should contain (many-one) reductions from a problem (X,p) to (Y,q) as both entry points for plugging new undecidability results a (computable) function f : X → Y such that ∀x, p x ↔ and tools to mechanise the corresponding reductions. We q (f x). We write p ⪯ q and say that p reduces to q if a discuss some ongoing additions to our library. reduction of (X,p) to (Y,q) exists. In the case of axiom- The axiom-free Coq formalisation of all the results in this free Coq, all such reductions are inherently computable and paper is available online and the main lemmas and theorems thus, computability can be dropped from the definition. This in the pdf version of the paper are hyper-linked with the coincides with usual practice in non-formalised papers where html version of the Coq source code: the computability of reductions is left out most of the time. https://uds-psl.github.io/ill-undecidability Actually, many-one reductions are only an instance of the more general notion of Turing-reductions (see e.g. [33]): 2 Type Theory and Formal Undecidability (X,p) is Turing-reducible to (Y,q), written p ⪯T q, if p is decidable given that q is decidable. 2.1 Definitions We write P to denote the type of propositions. The basic Lemma 2.1. If p ⪯ q then p ⪯T q. inductive data structures we use are natural numbers (n : The structure of undecidability proofs can be comprehens- N ::= 0 | S n), Booleans (b : B ::= 0 | 1), the option type ively described using an inductive predicate undec p: (O X ::= (x : X ) | ⋆) and lists (l : L X ::= [] | x :: l). We write ⪯ l1 ++l2 for the concatenation of two lists, |l | for the length p T q undec p of a list, l for the reversal of a list, and [ f s | s ∈ l ] for a undec Halt undec q map over a list. We define l[i]: O X as the i-th element of l. The first rule establishes the halting problem for Turing Moreover, we write s ∈ l if s is a member of l, and l1 ⊆ l2 if machines as a seed of undecidability. By the second rule, every member of l1 is a member of l2. We will overload the notation for lists and use it for vectors undecidability can be transferred via (Turing) reductions. as well. Given a type X, we write the type of vectors of Lemma 2.2. undec (λx. ¬p x) implies undec p. length n as X n. We write the finite datatype of n elements n Proof. If p is decidable then so is λx. ¬p x. □ as α, β : Fn ::= 0 | ... | n − 1. If v : X , x : X and α : Fn, we define v[α] as the α-th component of v and v[α := x] as the Lemma 2.3. undec p if and only if Halt ⪯T p. vector v as the α-th component updated by x. A problem that would be decidable and undecidable at the 2.2 Undecidability in Coq same time would entail an obviously unwanted statement: A decision problem consists of a type X and a unary predicate Lemma 2.4. If p is decidable and undec p then Halt is de- p : X → P on X. A problem (X,p) is decidable if there is a cidable. function f : X → B s.t. ∀x. p x ↔ f x = 1, or equivalently, if there is a (dependent) decider of type ∀x : X, {p x} + {¬p x}. We rely on the assumptions that Halt in [11] is a faithful Being able to define the concept of decidability without implementation of the halting problem and that functions referring to a model of computation is a feature of construct- in Coq are indeed computable. If the latter would not be ive type theory: due to the commitment of its designers to the case, the earlier mentioned publications on decidability effective methods, all definable functions are computable. proofs would all lose their grounds. There has been a lot of work on proving problems to be The choice of Halt as the seed of undecidability is arbitrary: decidable using this notion, see e.g. [5,8,9, 22, 25, 31, 34]. most problems that are universally accepted as undecidable Note that since it is consistentin constructive type theory 1This illustrates that adding axioms to Coq could render the assumption to assume that all problems are “decidable,” i.e. by the axiom that all functions are computable invalid, thus we safely commit ourselves ∀P : P, {P} + {¬P}, the logical negation of decidability of to axiom-free Coq. 2 Certified Undecidability of Intuitionistic Linear Logic via BSM and MM CPP’19, January 14–15 2019, Lisbon, Portugal
1 2 would work. Since the halting problem Halt for a concrete Lemma 3.1. iBPCP R iff ∃I , [], (∀i ∈ I, i < |R|) ∧I R = I R . Turing machine model has already been reduced to PCP in Coq [11], we can safely use PCP as an alternate seed 3.1 PCP reduces to BPCP of undecidability. This also explains why the reductions in We define a function f : N∗ → B∗ by f ϵ := ϵ and f (nx) := this paper start at PCP. Remark that we use this inductive 1n0 (f x) and we extend f to cards and lists of cards by definition of undec only for illustrative purposes. For our pointwise application. proofs, we simply rely on many-one reductions. Lemma 3.2. The following hold for k ∈ {1, 2}: 3 Post Correspondence Problem 1. (f A)k = f (Ak ) and 2. If A ⊆ C then f A ⊆ f C. All definitions concerning strings will be parametrised over a type X of symbols. We will later use natural numbers as We define the inverse function д : B∗ → N → N∗ with an symbols for PCP and Booleans as symbols for BPCP.A string auxiliary argument by д ϵ n := ϵ and д (1x) n := д x (1 + n) is a list of symbols. We write X ∗ if the symbol type is X. We and д (0x) n := n(д x 0). We write д x for д x 0 and again call strings over Booleans bitstrings. The letters x, y, z, u, extend it pointwise to cards and stacks. and v range over strings, and the letters a, b, c range over ∈ { } ⊆ symbols. We write xy for x ++y and ax for a :: x. We use ϵ to Lemma 3.3. If k 1, 2 and A f B then denote the empty string. 1. (д A)k = д(Ak ) and 2. д A ⊆ B. A card x/y a is a pair (x,y) of two strings. When we call x/y a card we see x as the upper and y as the lower string Theorem 3.4. PCP ⪯ BPCP. of the card. A card set (CS) is finite set of cards represented ↔ by a list (where the order and multiplicity do not matter). A Proof. We prove that PCP R BPCP(f R). ⊆ stack is a sequence of cards also represented by a list (but For the direction from left to right let [] , A R with 1 = 2 ⊆ the order and multiplicity matter). The letters A, B, C range A A be given. Then f A f R by Lemma 3.2 (2), f A , [] 1 = 2 over stacks and the letter R ranges over CS. We use the letter is trivial and (f A) (f A) follows from Lemma 3.2 (1). ⊆ I to range over a list of natural numbers. For the direction from right to left let [] , B f R with 1 = 2 ⊆ The upper trace A1 and the lower trace A2 of a stack A are B B be given. д B R follows by Lemma 3.3 (2), д B , [] 1 = 2 strings defined by the following equations: is trivial and (д B) (д B) by Lemma 3.3 (1). □ []1,2 := ϵ (x/y :: A)1 := x (A1)(x/y :: A)2 := y(A2) 3.2 BPCP reduces to iBPCP Note that A1 is the concatenation of the upper strings of We define 2 the cards in A, and that A is the concatenation of the lower f R [] := [] strings of the cards in A. We say that a stack A matches if / = / ∈ A1 = A2.A match is a matching stack. f R (x y :: A) : n :: f R A (if x y R at pos. n) We define the predicate for the Post correspondence problem f R (x/y :: A) := f R A (if x/y < R) over elements of type X as symbols as: and 1 2 PCP (R : CSX ) := ∃A ⊆ R. A , [] ∧ A = A д R [] := [] Note that PCP(R) holds iff there exists a non-empty match д R (i :: I ) := (x/y)(д RI ) (if R[i] = x/y) A ⊆ R. If we do not specify the type X, we mean the spe- д R (i :: I ) := д RI (if R[i] is undefined) cial case PCP (R : CSN) where the symbols type is N, used as the standard one in [11]. Here we also define the bin- Lemma 3.5. The following hold for k ∈ {1, 2}: ary Post correspondence problem fixing Booleans as symbols: 1. If B ⊆ R then (f R B)k = Bk BPCP (R : CSB) := PCP (R : CSB). R ∀ ∈ | | k k Finally, we define a version of BPCP using explicit indices, 2. If ( i I, i < R ) then (д RI ) = IR . which is easier to treat for low-level machines. We define Proof. (1) is by induction on B, (2) by induction on I. □ k ∈ { } functions IR for lists of indices I and k 1, 2 . k k k Theorem 3.6. BPCP ⪯ iBPCP. []R := ϵ (i :: I )R := AR (for R[i] undefined) 1 1 2 2 (i :: I )R := x (AR )(i :: I )R := y(AR ) (for R[i] = x/y) 4 Code and define binary PCP with indices: We define code over arbitrary instruction sets to reuse later for both binary stack machines and Minsky machines. Since iBPCP (R : CS ) := ∃I [], (∀i ∈ I, i < |R|) ∧ I 1 = I 2 B , R R both instruction sets contain absolute jump instructions, the Note the equivalence when we reverse lists of indices: positions of instructions are represented by natural numbers. 3 CPP’19, January 14–15 2019, Lisbon, Portugal Yannick Forster and Dominique Larchey-Wendling
4.1 Syntax transitive closure ≻+ and reflexive-transitive closure ≻∗ of We model the type of code type-theoretically by defining it the step relation as follows: over a type of instructions I as N × LI. We use the letter ρ P // s ≻+ s′ := ∃n > 0, P // s ≻n s′ for individual instructions and P for lists of instructions. A P // s ≻∗ s′ := ∃n, P // s ≻n s′ code (i, [ρ0; ρ1; ... ; ρn−1]) can be seen as a labelled program: We call the step relation deterministic if for any ρ and s, s1 i : ρ0; i + 1 : ρ1; ... i + n − 1 : ρn−1; and s2, if ρ // s ≻ s1 and ρ // s ≻ s2 then s1 = s2. In this paper, we only consider deterministic step relations. In this case, where i,i + 1,...,i + n − 1 represent program counter (PC) the small-step semantics is also deterministic, i.e. for any P, s values which identify the positions of individual instructions. and n, there is at most one s′ s.t. P // s ≻n s′. However, there The reason we use any number i instead of just 0 as the first are generally many possible s′ s.t. P // s ≻∗ s′. Thus neither label is to be able to reason about the whole code as well as ≻∗ nor ≻+ are a well-suited big-step semantics because they about segments in the code, segments which we call subcode. are not deterministic. By further assuming termination, we We define the subcode relation denoted (i, P) < (j,Q) by sc obtain the unicity of the end state. (i, P) 0 In our setting, compositional reasoning translates into (i, P) // (i1,v1) ≻ (i1,v1) tools which allow the transfer of properties of subcode to P = P1 ++ ρ :: P2 i1 = i + |P1| larger code. For instance, the following property is a simple n ρ // (i1,v1) ≻ (i2,v2)(i, P) // (i2,v2) ≻ (i3,v3) and obvious example of compositional reasoning: n+1 P Q ′ (i, P) // (i1,v1) ≻ (i3,v3) Lemma 4.1. Given Any terminating computation in code Q can be decom- given as a list R : L (LB × LB) of binary cards. The problem posed into a prefix terminating computation in subcode P is to find a non-empty list of indices of cards of R such that followed by a suffix terminating computation in Q. the upper and lower trace are equal. We solve this problem using a simulator denoted pcp_bsm implemented as a BSM- Lemma 4.3. If we assume the step relation ≻ to be determin- R program in which the iBPCP instance R is hard-coded. istic, we get: So let us fix the list R. The program pcp_bsmR will solve + p P Notice that pcp_bsmR never stops if there is no solution to Hence, compare_stacks can distinguish between v[x] = the iBPCP instance R. On the other hand, since (1) enumer- v[y] and v[x] , v[y] by jumping to either p or (another) ates any possible card list (including some possibly invalid PC value q. Notice that the resulting state w is not affected encodings which are rejected as such), if there is a solution too much by the computation since it preserves any stack to R, then pcp_bsmR will stop when (3) detects such a solu- register except x and y. Since the values of w[x] and w[y] tion where u = l. Of course, these parts (1)-(3) correspond are unspecified, we might have to erase them afterwards: to specific BSM code for which correctness and complete- ness results are established. Here we only explain certain Lemma 5.5. The program (i, empty_stack) with sub-programs of the pcp_bsmR program. empty_stack := [POP x i (3 + i); PUSH x 0; POP x i i] 5.3 Details of the Reduction from iBPCP to BSM composed of 3 instructions satisfies the specification To solve part (1), we enumerate all index lists using a function ∀ ≻∗ next : LB → LB such that the sequence of its iterations v, (i, empty_stack) // (i,v) (3 + i,v[x := []]). starting at [0] visits all non-empty binary lists: This solves part (3) of pcp_bsmR . To complete the reduc- Lemma 5.1. There is a function next : LB → LB such that tion of an iBPCP instance to a BSM instance we have to prove soundness and completeness of the pcp_bsm program. We ∀A : LB, A , [] → ∃n : N, nextn [0] = A. R do this by combining the previous results using the tools of Then we show that next is BSM-computable: compositional reasoning described in Section 4.3. Lemma 5.2. For any n,i : N and x , y : Fn there is a Theorem 5.6 (iBPCP simulator). For any configuration v program increment : LIn with 15 instructions satisfying and any state s, the two following properties hold: ∗ ∀v, (i, increment) // (i,v) ≻ (15 + i,v[x := next (v[x])]). ∗ iBPCP R → (1, pcp_bsmR ) // (1,v) ≻ s0 (sound) Notice the absence of y in the specification of increment (1, pcp_bsmR ) // (1,v) ⇝ s → iBPCP R ∧ s = s0 (complete) witnessing its use as a spare register: its content might be locally modified during the execution of increment but it is where s0 = (0,v0) and v0 = [s,u,l, a := []]. reverted back to its initial value afterwards. Using a simple As a side remark, we show that the length of pcp_bsm increment pcp bsm R loop over allows us to solve part (1) of _ R . is 86 + 3 · |R| + size R where size R is the length of all To solve part (2) we implement programs tileα /β pushing concatenated upper and lower traces in R. This allows us to the strings α and β to the stacks x and y: conclude: N F , LB Lemma 5.3. For all n : , x , y : n and α β : there is a Theorem 5.7. iBPCP ⪯ BSM. program tileα /β : LIn with |tileα /β | = |α | + |β| satisfying the following specification: 6 A Certified Low-Level Compiler ∀v i w, w = v x := α ++v[x],y := β ++v[y] We present the implementation of a certified compiler for f ∗ g → (i, tileα /β ) // (i,v) ≻ (|tileα /β | + i,w). low-level languages as defined in Section4, to be used in later Section 7.3 to reduce BSM-termination to MM-termination. The cards decoder consists in gluing tile , tile ,..., c1 c2 Let us start with a description of the problem. We are tile where R = [c ; ... ;c ], interleaved with a measure ck 1 k given two models of computation X and Y as presented in of the number j of head 0’s in v[s] = 0j 1 ... to branch on the Section4, each with their own set of instructions and their appropriate tile . This decoders also detects and rejects a cj own semantics described by step relations. We adapt the value j ≥ |R| or a stack v[s] of the form 0∗ not containing notation of Section4 to discuss about those two different any 1. This card index decoder is implemented by structural models at the same time by decorating the notations with induction on R. We refer to the Coq term full_decoder in either X or Y, hence P // s ≻3 s means program P file bsm_utils.v for more detailed explanations. This solves X 1 2 of model X can compute state s2 in 3 steps when starting part (2) of pcp_bsmR . from state s1, while Q //Y s ↓ means that the computation of To solve part (3), we implement stack comparison. program Q of model Y terminates when starting from state Lemma 5.4. For all n : N, x , y : Fn and i,p,q : N, there is a s. The model X will be the source while Y will be the target program compare_stacks : LIn (of length 10) which satisfies model of the compiler. the following specification: The compiler consists of transforming any program P in model X into a program Q in model Y such that Q simulates ∀v ∃ j w, (i, compare_stacks) // (i,v) ≻∗ (j,w) the behaviour of P faithfully. We model the correspondence ∧ ∀z, z , x → z , y → v[z] = w[z] between the configurations of machines in model X and in ∧ (v[x] = v[y] ∧ j = p ∨ v[x] , v[y] ∧ j = q). model Y by a simulation binary relation ▷◁ : CX → CY → P. 6 Certified Undecidability of Intuitionistic Linear Logic via BSM and MM CPP’19, January 14–15 2019, Lisbon, Portugal A typical soundness result would be Let us now describe the compiler more formally. We as- sume an instruction compiler and a code length function: ∧ P ≻∗ v1 ▷◁ w1 //X (i1,v1) (i2,v2) icomp : (N → N) → N → IX → LIY ∗ → ∃(j2,w2), v2 ▷◁ w2 ∧ Q //Y (j1,w1) ≻ (j2,w2) ilen : IX → N where icomp lnk i ρ compiles instruction ρ into llρ : LIY meaning that this particular computation of P from (i1,v1) is at source position i using linker lnk to remap absolute and simulated by some computation of Q from (j1,w1) preserving relative jumps, and the length of llρ is given by ilen ρ. Hence, the simulation relation between the configurations in X and we assume the hypothesis Y . However, such a result only expresses a relation between H : ∀ lnk i ρ, |icomp lnk i ρ| = ilen ρ configurations, not between PC values. The relation between ilen PC values is going to be made more precise using a linker. so that the length of compiled instructions only depends As it is generic, our compiler cannot cope with the partic- on instruction ρ, not where it is positioned (i.e. i) or where ular behaviour of individual instructions because that really jumps are remapped (i.e. lnk). In contrast, the actual code depends on the choice of X and Y: for instance, there can- icomp lnk i ρ almost always depends on lnk and i. not exist a correct compiler if model X is more expressive Let us now come to the semantic soundness hypothesis than model Y. As a result, the generic compiler assumes as on icomp. For this, a step relation for X and a step relation input a one-to-many instruction compiler that transforms a for Y must be given. For simplicity of arguments, we assume single instruction in IX into a list of instructions in LIY . that the step relation for X is total and that the step relation The problem solved by our generic compiler is transforming for Y is deterministic (i.e. functional). this individual instruction compiler into a program compiler HX : the step relation ≻X is total while preserving soundness. HY : the step relation ≻Y is deterministic Because the replacement of X instructions by Y instruc- We do not view totality as a strong requirement. It could be tions is one-to-many, absolute jumps must be relocated at noted however that determinism would not be satisfied in addresses that depend on the whole program, not only on the case the target code involves some form of parallelism. instruction that is being compiled. For instance, consider the Given a simulation relation ▷◁ : C → C → P between absolute jumps p and q embedded in the BSM-instruction X Y the configurations of X and Y , the critical soundness assump- POP α p q which is compiled in 16 MM-instructions in Sec- tion we make on icomp is the following: tion 7.3. These PC addresses p/q must be recomputed before compiling the POP α p q instruction. But their new values Hicomp : ∀ lnk ρ (i1,v1)(i2,v2) w1, depend on the content of the compiled program ahead of the ρ //X (i1,v1) ≻ (i2,v2) instructions they point at. If they point forward, a chicken- ∧ v1 ▷◁ w1 ∧ lnk(1 + i1) = ilen ρ + lnk(i1) and-egg problem appears. To solve it, traditional compilers + replace p/q with symbolic addresses and the whole program → ∃w2, (lnk i1,llρ ) //Y (lnk i1,w1) ≻ (lnk i2,w2) is compiled in a symbolic address space of graph-like struc- ∧ v2 ▷◁ w2 ture. Symbols are resolved by a linker in a later phase that where llρ is shorthand for llρ := icomp lnk i1 ρ. It requires maps the graph of instructions into a sequence again. some explanations: Hicomp states that if llρ is the result of Here, we can avoid this quite complex machinery by as- the compilation of instruction ρ at source position i1 using suming a specific feature of our instruction compiler: even linker lnk, if the X-step relation for ρ transforms state (i1,v1) though the list llρ : LIY of Y-instructions corresponding into state (i2,v2) and if w1 simulates v1, then the compiled to some X-instruction ρ : IX might depend on where ρ is code llρ at its target address as given by lnk computes some located in the compiled code (and also on where the absolute state (lnk i2,w2) from state (lnk i1,w1) in the Y semantics and relative2 jumps which ρ contains are remapped), the and w2 simulates v2. The simulated computation must make length |llρ | does not depend on those actual positions. So there progress, hence llρ can never be empty. Additionally, the is a first abstract compilation phase that only computes the pre-condition lnk(1 + i1) = ilen ρ + lnk(i1) assumes that the length of codes, from which we can deduce a linker that is linker lnk preserves the +1 (implicit) relative address. going to be compatible with a later concrete compilation These assumptions, in particular Hicomp which is the most phase that computes actual instructions at their definitive important, are sufficient to build our program compiler and location as given by the linker. show its correctness, of which the proof is decomposed in two phases: a semantic one and a syntactic one. 6.1 Semantic Correctness of Compiled Code 2Although instructions might not refer to specific relative addresses ex- plicitly, the default incrementation of the PC by one makes +1 an almost Under the previous assumptions, suppose that we are given a ubiquitous relative address. source X-program P, a linker lnk and a compiled Y -program 7 CPP’19, January 14–15 2019, Lisbon, Portugal Yannick Forster and Dominique Larchey-Wendling Q. We give a syntactic correctness criterion which is suffi- There are some subtleties of secondary importance related to cient to establish that Q correctly simulates P. The criterion where source PC values outside of P should be remapped.3 ( For our purpose, we simply map them all to lnk(n + i). This (lnk i, icomp lnk i ρ) To the best of our understanding, this question of complete- Fact 7.1. For any n : N, x , q , r : Fn and i : N, the list ness does not seem to have been considered by any of these mm_div2 of 6 MM-instructions projects. However, to establish undecidability results — all [DEC x (6+i); INC r; DEC x (6+i); DEC r (4+i); INC q; DEC r i] the more in a constructive setting, — it is not possible to assume termination and thus we really need a completeness implements division by 2 because it satisfies the following result to show the correctness of compiler-based reductions. specification for all k,b,v: v[q] = 0 ∧ v[r] = 0 ∧ v[x] = b + 2.k 7 Minsky Machines → (i, mm_div2) // (i,v) ≻+ (6 + i,v[x := 0,q := k,r := b]) Minsky Machines (MM) [32] have n registers with natural Note that b : B is cast into 0/1 : N to simplify the above number values. Similar to BSM configurations, we define statement. We also need transfer (resp. nullify) programs C Nn MM configurations as vectors of registers values, i.e. := . which adds the value of register x to y, nullifying x at the Instructions are defined by same time (resp. nullifies one or several registers). These In ::= INC (α : Fn ) | DEC (α : Fn )(p : N). programs are (somewhat) obvious to write and prove correct. We can then encode a binary stack l : LB as a natural 7.1 Semantics for MM number s2nl : N using: The rules defining the step relation for MM instructions are: s2n [] := 1 s2n (0 :: l) := 2 · s2nl s2n (1 :: l) := 1 + 2 · s2nl INC α // (i,v) ≻ (1 + i,v[α := 1 + n]) if v[α] = n and simulate PUSH x 0, PUSH x 1 and POP x j e instructions. DEC α p // (i,v) ≻ (p,v) if v[α] = 0 Lemma 7.2. For any n : N, x , z , t : Fn and i : N, there is DEC α p // (i,v) ≻ (1 + i,v[α := n]) if v[α] = 1 + n a list mm_push_0 of 7 instructions which satisfies the following specification for all l,v: That means, INC α increases the value of register α by one. DEC α p decreases the value of register α by one if that is v[t] = 0 ∧ v[z] = 0 ∧ v[x] = s2nl + possible and increases the PC, or, if the register is already 0, → (i, mm_push_0) // (i,v) ≻ (7 + i,v[x := s2n(0 :: l)]) jumps to PC value p. As is the case for BSM, the step relation Lemma 7.3. For any n : N, x , z , t : Fn and i : N, there is for MM is both deterministic and total. a list mm_push_1 of 8 instructions which satisfies the following Finally, we use a more restricted halting problem for MM specification for all l,v: than for BSM, where we start execution with PC at 1 and v[t] = 0 ∧ v[z] = 0 ∧ v[x] = s2nl expect the machine to halt with PC at 0 and on a null register → (i, mm_push_1) // (i,v) ≻+ (8 + i,v[x := s2n(1 :: l)]) configuration: Lemma 7.4. For any n : N, x z t : F and i, j,k, e : N, n ⃗ , , n MM n : N, P : LIn,v : N := (1, P) // (1,v) ⇝ (0, 0). there is a list mm_pop of 16 instructions which satisfies the This restricted halting problem is well-suited for a reduction following specifications for any l and v s.t. v[t] = v[z] = 0: to linear logic. We could use a more general halting problem v[x] = s2n [] → (i, mm_pop) // (i,v) ≻+ (e,v) and then reduce this more general problem to the special v[x] = s2n(0 :: l) → (i, mm_pop) // (i,v) ≻+ (j,v[x := s2nl]) problem. However, this would require a dedicated transform- v[x] = s2n(1 :: l) → (i, mm_pop) // (i,v) ≻+ (k,v[x := s2nl]) ation on MM programs, which we circumvent by reducing Hence, we simulate any individual BSM instruction by BSM to the special version directly. a (small) list of MM instructions that operate on stacks en- 7.2 Simulating Binary Stacks with Numbers coded using s2n. Using Theorem 6.3 of Section6, we obtain a correct compiler for whole BSM programs to MM programs. The reduction from BSM to MM is derived as a direct con- sequence of our implementation of a generic certified low- 7.3 BSM reduces to MM level compiler. Basically to get a correct compiler from BSM We describe the correctness and completeness results we to MM, the only remaining tasks are: (a) simulate binary obtain from the generic compiler of Theorem 6.3. Assume stacks with naturals natural numbers, and (b) simulate indi- that we are given a BSM program (i, P) with n binary stack vidual BSM-instructions with lists of MM-instructions. We registers, we compile (i, P) at address 1 into a linker lnk : give a high-level overview of the principal ideas and the N → N and a MM program Q starting at address 1 with 2+n main soundness and completeness results. registers. Each stack register p : F is s2n encoded into the BSM programs manipulate binary stacks in LB while n register 2 + p : F of Q. The registers 0, 1 : F of Q serve MM programs manipulate natural numbers in N. Hence 2+n 2+n as spare registers for internal computations. The simulation to represent LB with N, we implement multiplication and invariant division by 2. For instance, we show the following fact. v ▷◁ w := w[0] = 0 ∧ w[1] = 0 ∧ ∀p,w[2 + p] = s2n(v[p]) 9 CPP’19, January 14–15 2019, Lisbon, Portugal Yannick Forster and Dominique Larchey-Wendling ensures the preservation of the encoding during execution. Here we present the reduction of termination of arbitrary lnk satisfies lnki = 1 and for any j for which out j (i, P) MM (with n counters) and we verify it in Coq. The proof holds, we have lnk j = end(1,Q). Moreover, the code (1,Q) consists first of the reduction of MM to entailment in eILL, satisfies the following soundness and completeness results: and then the proof of the (faithful) embedding of eILL into ILL. The latter proof actually takes place in the {&, ⊸, !} cut- Fact 7.5. For any i ,i ,v ,v ,w , the following holds: 1 2 1 2 1 free fragment of ILL, i.e. we do not need the {⊗, ⊕, ⊥, ⊤, 1} v1 ▷◁ w1 ∧ (i, P) // (i1,v1) ⇝ (i2,v2) logical connectives nor the cut rule to build the embedding. As a way to limit the technical material we need to present, → ∃w2, v2 ▷◁ w2 ∧ (1,Q) // (lnki1,w1) ⇝ (lnki2,w2). we only introduce the {&, ⊸, !} fragment in this paper. How- Fact 7.6. For any i1,v1,w1, j2,w2, the following holds: ever, the Coq code contains the proof of the embedding of eILL into the whole ILL.4 Hence from now on, we will abus- v1 ▷◁ w1 ∧ (1,Q) //Y (lnki1,w1) ⇝ (j2,w2) ively denote ILL for its restriction to the {&, ⊸, !} fragment. → ∃ i v , v ▷◁ w ∧ (i, P) // (i ,v ) ⇝ (i ,v ). 2 2 2 2 X 1 1 2 2 The syntax of (the {&, ⊸, !} fragment of) ILL is described From those correctness results, it is easy to derive a simu- by the BNF-grammar A ::= v | A & A | A ⊸ A | ! A where lator for BSM termination as MM termination. v belongs to a countably infinite set of logical variables. A sequent is a pair denoted Γ ⊢ A composed of a multiset Γ of Theorem 7.7 (BSM simulator). Let (i, P) be a BSM-program formulæ and a single formula A on the right of the ⊢ sign. with n binary stacks. One can compute a 2 + n registers MM- The sequent calculus SILL is described in Fig.1. In the last program bsm_mm with the following specification. For any v, rule, ! Γ denotes ! Γ := ! A1,..., ! An when Γ = A1,..., An. with w := [s2nl | l ∈ v], we have: Using SILL, we define the entailment relation: the hypotheses (i, P) // (i,v) ↓ ↔ (1, bsm_mm) // (1, 0 :: 0 :: w) ⇝ (0,⃗0). in Γ entail A when Γ ⊢ A has a derivation in SILL. Proof. The code of bsm_mm consists of the compiled code 8.1 eILL reduces to ILL (1,Q) of (i, P) followed by some obvious code nullifying all ILL contains a sub-fragment called elementary Intuitionistic the variables after the execution of (1,Q) is terminated and Linear Logic (eILL) first spotted in [26]. It is not a syntactic then jumping to PC value 0. The nullifying code uses the fact fragment at the level of formulæ, but it is a syntactic fragment that any output state (j2,w2) of (1,Q) satisfies j2 = end(1,Q) at the level of sequents. A sequent in eILL is a sequent of and w2[0] = 0 to nullify the other registers using register 0 as ILL of the form ! Σ, Γ ⊢ u, where Γ is a multiset composed empty register. We critically need both the soundness Fact 7.5 of logical variables only and u is a unique logical variable. and completeness Fact 7.6 to get the above equivalence. □ On the contrary, Σ is composed of formulæ called command This allows us to conclude: formulæ [27] of the form (u ⊸ v) ⊸ w, u ⊸ (v ⊸ w) and (u & v) ⊸ w where u, v and w are logical variables. So eILL Theorem 7.8. BSM ⪯ MM. sequents have a very simple/flat syntactic structure. 8 Intuitionistic Linear Logic ! Σ, Γ,u ⊢ v Ax (u ⊸ v) ⊸ w ∈ Σ ! Σ,u ⊢ u ! Σ, Γ ⊢ w ⊢ , ⊢ , ⊢ Γ A ∆ B C Γ A B ! Σ, Γ ⊢ u ! Σ, ∆ ⊢ v ⊢ , , ⊢ ⊢ u ⊸ (v ⊸ w) ∈ Σ A A Γ ∆ A ⊸ B C Γ A ⊸ B ! Σ, Γ, ∆ ⊢ w , ⊢ , ⊢ Γ A C Γ B C Γ ⊢ A Γ ⊢ B ! Σ, Γ ⊢ u ! Σ, Γ ⊢ v , ⊢ , ⊢ ⊢ (u & v) ⊸ w ∈ Σ Γ A & B C Γ A & B C Γ A & B ! Σ, Γ ⊢ w Γ, A ⊢ B Γ ⊢ B Γ, ! A, ! A ⊢ B ! Γ ⊢ B Γ, ! A ⊢ B Γ, ! A ⊢ B Γ, ! A ⊢ B ! Γ ⊢ ! B Figure 2. The GeILL goal-directed sequent calculus. Figure 1. The SILL sequent calculus. Although entailment in eILL could be described by SILL, for the purpose of reducing MM, it is more conveniently The reduction of MM to entailment in Intuitionistic Linear described by the goal directed rules of GeILL in Fig.2. The Logic (ILL) [16] implements the method presented in [26] and reason is that they directly encode MM small-step semantics fully described in [27]. The undecidability of (I)LL was first as shall be explained in Section 8.2. Notice however that established in [30] and a rich literature followed [20, 21, 29], 4This means that our method proves the embedding of eILL into both but [26] singled out the elementary fragment of ILL (eILL) the {&, ⊸, !} fragment and the whole ILL. However, we do not show or together with a short proof of undecidability by reducing formalise the embedding of the fragment into the whole: it involves a proof the termination of two counters Minsky machines. of either cut-elimination, or a larger phase semantics development. 10 Certified Undecidability of Intuitionistic Linear Logic via BSM and MM CPP’19, January 14–15 2019, Lisbon, Portugal while sequents of eILL are stable under (backwards applica- In addition, we add the following 1 + n2 commands to Σ tion of) the rules of GeILL, they are not stable under the rules independently of P. These just depend on n: of SILL, which means that proof-search from an eILL sequent {(q0 ⊸ q0) ⊸ q0} ⊎ {(xi ⊸ xi ) ⊸ xi | i < n} in SILL might produce sequents which do not belong to eILL. ⊎ {xj ⊸ (xi ⊸ xi ) | i , j < n}. Given a commutative monoid (M, •, ϵ), for any X,Y ⊆ M, we define the point-wise extension by X • Y := {x • y | x ∈ We define the multiset Γv := {v[0].x0,...,v[n − 1].xn−1} X ∧ y ∈ Y } and its linear adjunct as X −−• Y := {k ∈ M | where p.xi means repeating p times xi in the multiset. We {k}• X ⊆ Y } providing a residuated monoidal structure on show the following reduction. → P the powerset M . Given any semantic interpretation Lemma 8.3. We have (1, P) // (i,v) ⇝ (0,⃗0) if and only if [[·]] ⊆ M of logical variables, we extend it inductively to ILL the sequent ! Σ, Γv ⊢ qi is provable in GeILL. via trivial phase semantics: Proof. We show the only if part by structural induction on [[A & B]] := [[A]] ∩ [[B]] [[! A]] := {ϵ} ∩ [[A]] the predicate (1, P) // (i,v) ≻∗ (0,⃗0). In the base case we [[A ⊸ B]] := [[A]] −−• [[B]] have i = 0 and v = ⃗0 and we check ! Σ, ∅ ⊢ q0: •···• and to multisets by [[A1,..., An]] := [[A1]] [[An]]. An Ax ILL sequent Γ ⊢ A is valid in that interpretation if [[Γ]] ⊆ [[A]]. ! Σ,q0 ⊢ q0 A sequent is valid in a commutative monoid (M, •, ϵ) if it is (q0 ⊸ q0) ⊸ q0 ∈ Σ ! Σ, ∅ ⊢ q valid for any trivial interpretation [[·]] ⊆ M in that monoid. 0 If the last rule is Theorem 8.1. The three following results hold: INC p // (i,v) ≻ s (1, P) // s ≻∗ (0,⃗0) 1. If derivable in GeILL, ! Σ, Γ ⊢ u is also derivable in SILL; 2. An ILL sequent derivable in SILL is valid in every com- (i, P) // (i,v) ≻∗ (0,⃗0) mutative monoid; 3. Let n be greater than the number of logical variables then s = (i + 1,v + 1.xp ) and we build the following proof of Σ, Γ. If ! Σ, Γ ⊢ w is valid in the free commutative ... n monoid (N , +,⃗0) then ! Σ, Γ ⊢ w is provable in GeILL. ! Σ, Γv , xp ⊢ qi+1 Notice that trivial phase semantics is also sound for the (xp ⊸ qi+1) ⊸ qi ∈ Σ whole ILL, not just the (&, ⊸, !)-fragment ILL or eILL. But it ! Σ, Γv ⊢ qi is only complete for eILL, not for the (&, ⊸, !)-fragment nor where the top dots symbolize a sub-proof corresponding to for the whole ILL because the interpretation of the bang ! is the induction hypothesis. Notice that (xp ⊸ qi+1) ⊸ qi was too restricted compared to general phase semantics [27]. explicitly added to Σ to encode instruction i : INC p. We do the same for i : DEC p j. If the last rule is Theorem 8.2. eILL ⪯ ILL. ∗ Proof. We simply need to show that a sequent of eILL has a DEC p j // (i,v) ≻ s (1, P) // s ≻ (0,⃗0) proof in GeILL if and only if it has a proof in SILL and this is a (i, P) // (i,v) ≻∗ (0,⃗0) direct consequence of Theorem 8.1. □ then there are two cases depending on whether the value of 8.2 MM reduces to eILL v at coordinate p is 0 or not. If v[p] , 0 then v = w + 1.xp , We show how to faithfully encode MM-termination by en- Γv = Γw , xp and s = (i + 1,w) and we build the following tailment in GeILL. For this, we describe how to transform a n proof using the induction hypothesis for the top-right dots: registers MM-program P and a vector v : Nn into an eILL- ... sequent, s.t. the GeILL-entailment of the sequent simulates Ax , ⊢ , ⊢ the predicate (1, P) // (1,v) ⇝ (0,⃗0). ! Σ xp xp ! Σ Γw qi+1 xp ⊸ (qi+1 ⊸ qi ) ∈ Σ We fix n and P = [ρ1; ... ; ρl ]. Let us partition the count- ! Σ, Γw , xp ⊢ qi ably infinite set of logical variables into disjoint sets The case where v[p] = 0 is a bit more complicated. In that {x0,..., xn−1} ⊎ {x0,..., xn−1} ⊎ {q0,q1,...}. case, xp < Γv and we have s = (j,v). We build the proof as: Let us describe the eILL-sequent ! Σ, Γv ⊢ q1 simulating ...... (1, P) // (1,v) ⇝ (0,⃗0). We start with the commands in Σ. xp < Γv ! Σ, Γ ⊢ x ! Σ, Γ ⊢ q For every labelled instruction i : ρ of (1, P), we add one or v p v j i (xp & qj ) ⊸ qi ∈ Σ two commands in Σ according to: ! Σ, Γv ⊢ qi i : INC p ⇝ (xp ⊸ qi+1) ⊸ qi where the top-right dots represent the induction hypothesis. i : DEC p j ⇝ xp ⊸ (qi+1 ⊸ qi ) and (xp & qj ) ⊸ qi . For the top-left dots, we build a proof that can only succeed 11 CPP’19, January 14–15 2019, Lisbon, Portugal Yannick Forster and Dominique Larchey-Wendling when Γv does not contains any occurrence of xp , implement- requiring intermediate steps, in striking contrast to the in- ing a zero-test by proof-search. For q , p < n, we can remove volved formalisations needed to complete our reduction.5 the occurrence of xq in ∆, xq using xp as a goal: They also include the notion of enumerability, connect (non)- enumerability with (un)decidability and give enumerability ... proofs for PCP and provable formulas. Ax ! Σ, xq ⊢ xq ! Σ, ∆ ⊢ xp With regard to the formalisation of models of compu- x ⊸ (x ⊸ x ) ∈ Σ q p p tations in constructive type theory, there is slightly more ! Σ, ∆, xq ⊢ xp related work, starting with a proof of the smn theorem by As Γv is only composed of variables xq with q , p, we repeat Zammit [38]. Forster and Smolka [15] formalise the call- the previous step until Γv becomes empty and we end up by-value λ-calculus as model of computation in Coq. They with ! Σ, ∅ ⊢ xp which is then proved by constructively develop the standard theory of computation, Ax but only consider undecidability problems related to the ! Σ, xp ⊢ xp λ-calculus. (xp ⊸ xp ) ⊸ xp ∈ Σ Larchey-Wendling [24] formalises another standard model ! Σ, ∅ ⊢ x p of computation, that of µ-recursive functions, which are This conclude the only if part of the argument. shown to be representable by guarded Coq-terms. In par- ticular, total µ-recursive predicates Nk → N → P can be The if part is obtained using soundness of trivial phase constructively reified into functions of type Nk → N. semantics (see Theorem 8.1). To simplify notations, we de- Asperti and Ricciotti [1] formalise multi-tape Turing ma- note by (x⃗ ,..., x⃗ ) the canonical basis of (Nn, +,⃗0), i.e. 0 n−1 chines in the proof assistant Matita and construct a universal we write Nn = N.x⃗ ⊕ · · · ⊕ N.x⃗ and the correspondence 0 n−1 Turing machine. Ciaffaglione [7] formalises Turing machines x ⇌ x⃗ induces a monoid isomorphism between the multis- i i in Coq using coinductive definitions and proves the halting ets generated by {x ,..., x } and (Nn, +,⃗0). We define the 0 n−1 problem to be undecidable. Vinogradova [37] gives an ab- Nn ⃗ following interpretation of logical variables in ( , +, 0): stract discussion of undecidability using Turing categories. ⊥ [[xi ]] := {x⃗i } [[xi ]] := {x⃗i } = {w | w[i] = 0} Forster and Kunze [13] present a framework to extract n Coq functions to the call-by-value λ-calculus from [15] in [[qi ]] := {w ∈ N | (1, P) // (i,w) ⇝ (0,⃗0)} a verified way. We could use this framework to prove the and we show that ⃗0 ∈ [[σ]] for any σ ∈ Σ. Hence the identity computability of all reductions explicitly, allowing for the [[! Σ]] = {⃗0} holds. Writing v = α1.x⃗1 +···+αn .x⃗n we deduce assumption of non-constructive axioms, but thereby com- [[Γv ]] = [[α1.x1,..., αn .xn]] = α1.{x⃗1} + ··· + αn .{x⃗n } = {v}. mitting to a fixed model of computation. As a consequence, we get [[! Σ, Γ ]] = [[! Σ]] + [[Γ ]] = {v}. v v Future work. We envision a library of undecidable problems Thus, if ! Σ, Γv ⊢qi has a proof in GeILL, by soundness of trivial phase semantics we deduce v ∈ [[! Σ, Γ ]] ⊆ [[q ]], i.e. the in Coq. The library should contain basic problems that can v i be used for further reductions, like PCP, BSM, MM, and Halt computation (1, P) // (i,v) ⇝ (0,⃗0) terminates. □ as well as advanced problems with non-trivial proofs like This allows us to conclude: ILL. We want to add the µ-recursive functions from [24], the halting problem for the call-by-value λ-calculus from [15], Theorem 8.4. MM ⪯ eILL. and more computational models, like for instance the WHILE language used by Jones [19]. Other basic problems that can 9 Conclusion serve as stepping stones for other reductions include tiling Our formalisation consists of about 5200 lines of code. Around problems from e.g. Berger [3]. 200 loc are needed for the definition and reductions concern- Formalising Hilbert’s 10th problem — the undecidability ing PCP. The generic compiler needs 1500 loc. We have 1600 of diophantine equations, — could be a challenge, e.g. fol- loc for the BSM section, 900 loc for the MM section, and lowing [18]. Finally, concerning linear logic, there are still 1000 loc for the ILL section. fragments where the decidability status is unclear or debated: the entailment of multiplicative and exponential linear logic Related work. There is not much related work concerning (MELL) was claimed to be decidable in [4] but this proof and formalised undecidability proofs. Forster, Heiter, and Smolka hence the result is highly contested, see e.g. [10, footnote 1] [11] reduce the halting problem for Turing machines via and [35, footnote 4] and [25]. We hope that using the library, string rewriting systems to PCP and further on to problems future research in this direction can be formalised. concerning context-free grammars. Forster, Kirst and Smolka [12] reduce PCP to validity, sat- 5As it is highly expressive, FOL can directly express a characteristic formula isfiability and provability in both classical and intuitionistic for PCP. On the opposite side, directly giving a characterising ILL formula first-order logicFOL ( ). They have undecidability proofs not is quite infeasible, making intermediate steps crucial. 12 Certified Undecidability of Intuitionistic Linear Logic via BSM and MM CPP’19, January 14–15 2019, Lisbon, Portugal References [19] Neil D Jones. 1997. Computability and complexity: from a programming [1] Andrea Asperti and Wilmer Ricciotti. 2015. A formalization of multi- perspective. Vol. 21. MIT press. tape Turing machines. Theoret. Comput. Sci. 603 (2015), 23–42. [20] Max Kanovich. 1994. Linear Logic as a Logic of Computations. Ann. [2] Mauricio Ayala-Rincón and César A. Muñoz (Eds.). 2017. Interactive Pure Appl. Logic 67, 1–3 (1994), 183–212. Theorem Proving - 8th International Conference, ITP 2017, Proceedings. [21] Max Kanovich. 1995. The direct simulation of Minsky machines in Lecture Notes in Computer Science, Vol. 10499. Springer. linear logic. See [17], Chapter 2, 123–145. [3] Robert Berger. 1966. The undecidability of the domino problem. Num- [22] Chantal Keller and Thorsten Altenkirch. 2010. Hereditary substitutions ber 66 in Memoirs of the American Mathematical Society. American for simple types, formalized. In Proceedings of the third ACM SIGPLAN Mathematical Soc. workshop on Mathematically structured functional programming. ACM, [4] Katalin Bimbó. 2015. The decidability of the intensional fragment of 3–10. [23] Ramana Kumar, Magnus O. Myreen, Michael Norrish, and Scott Owens. classical linear logic. Theoret. Comput. Sci. 597 (2015), 1–17. 2014. CakeML: a verified implementation of ML. In The 41st Annual [5] Thomas Braibant and Damien Pous. 2010. An efficient Coq tactic for ACM SIGPLAN-SIGACT Symposium on Principles of Programming Lan- deciding Kleene algebras. In International Conference on Interactive guages. ACM, 179–192. Theorem Proving. Springer, 163–178. [24] Dominique Larchey-Wendling. 2017. Typing Total Recursive Functions [6] Adam Chlipala. 2010. A verified compiler for an impure functional in Coq, See [2], 371–388. language. In Proceedings of the 37th ACM SIGPLAN-SIGACT Symposium [25] Dominique Larchey-Wendling. 2018. Constructive Decision via on Principles of Programming Languages. ACM, 93–106. Redundancy-Free Proof-Search. In Automated Reasoning - 9th Interna- [7] Alberto Ciaffaglione. 2016. Towards Turing computability via coin- tional Joint Conference, IJCAR, Proceedings (Lecture Notes in Computer duction. Science of Computer Programming 126 (2016), 31–51. Science), Vol. 10900. Springer, 422–438. [8] Christian Doczkal and Joachim Bard. 2018. Completeness and de- [26] Dominique Larchey-Wendling and Didier Galmiche. 2010. The unde- cidability of converse PDL in the constructive type theory of Coq. cidability of boolean BI through phase semantics. In LICS 2010. IEEE, In Proceedings of the 7th ACM SIGPLAN International Conference on 140–149. Certified Programs and Proofs. ACM, 42–52. [27] Dominique Larchey-Wendling and Didier Galmiche. 2013. Non- [9] Christian Doczkal and Gert Smolka. 2016. Completeness and decidab- deterministic Phase Semantics and the Undecidability of Boolean BI. ility results for CTL in constructive type theory. J. Automat. Reason. ACM Trans. Comput. Log. 14, 1 (2013), 6:1–6:41. 56, 3 (2016), 343–365. [28] Xavier Leroy. 2006. Formal certification of a compiler back-end or: [10] Diego Figueira, Ranko Lazic, Jérôme Leroux, Filip Mazowiecki, and programming a compiler with a proof assistant. In Proceedings of the Grégoire Sutre. 2017. Polynomial-Space Completeness of Reachability 33rd ACM SIGPLAN-SIGACT Symposium on Principles of Programming for Succinct Branching VASS in Dimension One. In ICALP 2017 (LIPIcs), Languages. ACM, 42–54. Vol. 80. Schloss Dagstuhl, 119:1–14. [29] Patrick Lincoln. 1995. Deciding provability of linear logic formulas. [11] Yannick Forster, Edith Heiter, and Gert Smolka. 2018. Verification See [17], Chapter 2, 109–122. of PCP-Related Computational Reductions in Coq. In International [30] Patrick Lincoln, John C. Mitchell, Andre Scedrov, and Natarajan Conference on Interactive Theorem Proving. Springer, 253–269. Shankar. 1990. Decision Problems for Propositional Linear Logic. [12] Yannick Forster, Dominik Kirst, and Gert Smolka. 2018. On Synthetic In 31st Annual Symposium on Foundations of Computer Science, Vol. 2. Undecidability in Coq, with an Application to the Entscheidungsprob- IEEE Computer Society, 662–671. lem. (2018). https://www.ps.uni-saarland.de/Publications/documents/ [31] Petar Maksimović and Alan Schmitt. 2015. HOCore in coq. In Interna- ForsterEtAl_2018_On-Synthetic-Undecidability.pdf Submitted to tional Conference on Interactive Theorem Proving. Springer, 278–293. CPP’19. [32] Marvin L Minsky. 1967. Computation: finite and infinite machines. [13] Yannick Forster and Fabian Kunze. 2016. Verified Extraction from Coq Prentice-Hall, Inc. to a Lambda-Calculus. In Coq Workshop 2016. [33] Hartley Rogers. 1967. Theory of recursive functions and effective com- [14] Yannick Forster and Dominique Larchey-Wendling. 2018. Towards a putability. Vol. 5. McGraw-Hill New York. library of formalised undecidable problems in Coq: The undecidability [34] Steven Schäfer, Gert Smolka, and Tobias Tebbi. 2015. Completeness of intuitionistic linear logic. Workshop on Syntax and Semantics of and decidability of de Bruijn substitution algebra in Coq. In Proceedings Low-level Languages, Oxford (2018). of the 2015 Conference on Certified Programs and Proofs. ACM, 67–73. [15] Yannick Forster and Gert Smolka. 2017. Weak call-by-value lambda [35] Sylvain Schmitz. 2016. The Complexity of Reachability in Vector calculus as a model of computation in Coq, See [2], 189–206. Addition Systems. ACM SIGLOG News 3, 1 (2016), 4–21. [16] Jean-Yves Girard. 1987. Linear logic. Theoret. Comput. Sci. 50, 1 (1987), [36] The Coq proof assistant. 2018. http://coq.inria.fr. (2018). 1–102. [37] Polina Vinogradova. 2017. Formalizing Abstract Computability: Turing [17] Jean-Yves Girard, Yves Lafont, and Laurent Regnier (Eds.). 1995. Ad- Categories in Coq. Ph.D. Dissertation. University of Ottawa. vances in Linear Logic. London Mathematical Society Lecture Note [38] Vincent Zammit. 1997. A Proof of the S-m-n theorem in Coq. Technical Series, Vol. 222. Cambridge University Press. report. The Computing Laboratory, The University of Kent, Canter- [18] J. P. Jones and Y. V. Matijasevič. 1984. Register Machine Proof of the bury, Kent, UK. http://kar.kent.ac.uk/21524/ Theorem on Exponential Diophantine Representation of Enumerable Sets. J. Symb. Log. 49, 3 (1984), 818–829. 13