Dependent Type Systems As Macros
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Formal Verification of Termination Criteria for First-Order Recursive Functions
Formal Verification of Termination Criteria for First-Order Recursive Functions Cesar A. Muñoz £ Mauricio Ayala-Rincón £ NASA Langley Research Center, Hampton, VA, Departments of Computer Science and Mathem- USA atics, Universidade de Brasília, Brazil Mariano M. Moscato £ Aaron M. Dutle £ National Institute of Aerospace, Hampton, VA, NASA Langley Research Center, Hampton, VA, USA USA Anthony J. Narkawicz Ariane Alves Almeida £ USA Department of Computer Science, Universidade de Brasília, Brazil Andréia B. Avelar da Silva Thiago M. Ferreira Ramos £ Faculdade de Planaltina, Universidade de Brasília, Department of Computer Science, Universidade Brazil de Brasília, Brazil Abstract This paper presents a formalization of several termination criteria for first-order recursive functions. The formalization, which is developed in the Prototype Verification System (PVS), includes the specification and proof of equivalence of semantic termination, Turing termination, sizechange principle, calling context graphs, and matrix-weighted graphs. These termination criteria are defined on a computational model that consists of a basic functional language called PVS0, which is an embedding of recursive first-order functions. Through this embedding, the native mechanism for checking termination of recursive functions in PVS could be soundly extended with semi-automatic termination criteria such as calling contexts graphs. 2012 ACM Subject Classification Theory of computation → Models of computation; Software and its engineering → Software verification; Computing methodologies → Theorem proving algorithms Keywords and phrases Formal Verification, Termination, Calling Context Graph, PVS Digital Object Identifier 10.4230/LIPIcs.ITP.2021.26 Supplementary Material Other (NASA PVS Library): https://github.com/nasa/pvslib Funding Mariano M. Moscato: corresponding author; research supported by the National Aeronaut- ics and Space Administration under NASA/NIA Cooperative Agreement NNL09AA00A. -
Types Are Internal Infinity-Groupoids Antoine Allioux, Eric Finster, Matthieu Sozeau
Types are internal infinity-groupoids Antoine Allioux, Eric Finster, Matthieu Sozeau To cite this version: Antoine Allioux, Eric Finster, Matthieu Sozeau. Types are internal infinity-groupoids. 2021. hal- 03133144 HAL Id: hal-03133144 https://hal.inria.fr/hal-03133144 Preprint submitted on 5 Feb 2021 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Types are Internal 1-groupoids Antoine Allioux∗, Eric Finstery, Matthieu Sozeauz ∗Inria & University of Paris, France [email protected] yUniversity of Birmingham, United Kingdom ericfi[email protected] zInria, France [email protected] Abstract—By extending type theory with a universe of defini- attempts to import these ideas into plain homotopy type theory tionally associative and unital polynomial monads, we show how have, so far, failed. This appears to be a result of a kind of to arrive at a definition of opetopic type which is able to encode circularity: all of the known classical techniques at some point a number of fully coherent algebraic structures. In particular, our approach leads to a definition of 1-groupoid internal to rely on set-level algebraic structures themselves (presheaves, type theory and we prove that the type of such 1-groupoids is operads, or something similar) as a means of presenting or equivalent to the universe of types. -
Lemma Functions for Frama-C: C Programs As Proofs
Lemma Functions for Frama-C: C Programs as Proofs Grigoriy Volkov Mikhail Mandrykin Denis Efremov Faculty of Computer Science Software Engineering Department Faculty of Computer Science National Research University Ivannikov Institute for System Programming of the National Research University Higher School of Economics Russian Academy of Sciences Higher School of Economics Moscow, Russia Moscow, Russia Moscow, Russia [email protected] [email protected] [email protected] Abstract—This paper describes the development of to additionally specify loop invariants and termination an auto-active verification technique in the Frama-C expression (loop variants) in case the function under framework. We outline the lemma functions method analysis contains loops. Then the verification instrument and present the corresponding ACSL extension, its implementation in Frama-C, and evaluation on a set generates verification conditions (VCs), which can be of string-manipulating functions from the Linux kernel. separated into categories: safety and behavioral ones. We illustrate the benefits our approach can bring con- Safety VCs are responsible for runtime error checks for cerning the effort required to prove lemmas, compared known (modeled) types, while behavioral VCs represent to the approach based on interactive provers such as the functional correctness checks. All VCs need to be Coq. Current limitations of the method and its imple- mentation are discussed. discharged in order for the function to be considered fully Index Terms—formal verification, deductive verifi- proved (totally correct). This can be achieved either by cation, Frama-C, auto-active verification, lemma func- manually proving all VCs discharged with an interactive tions, Linux kernel prover (i. e., Coq, Isabelle/HOL or PVS) or with the help of automatic provers. -
Sequent Calculus and Equational Programming (Work in Progress)
Sequent Calculus and Equational Programming (work in progress) Nicolas Guenot and Daniel Gustafsson IT University of Copenhagen {ngue,dagu}@itu.dk Proof assistants and programming languages based on type theories usually come in two flavours: one is based on the standard natural deduction presentation of type theory and involves eliminators, while the other provides a syntax in equational style. We show here that the equational approach corresponds to the use of a focused presentation of a type theory expressed as a sequent calculus. A typed functional language is presented, based on a sequent calculus, that we relate to the syntax and internal language of Agda. In particular, we discuss the use of patterns and case splittings, as well as rules implementing inductive reasoning and dependent products and sums. 1 Programming with Equations Functional programming has proved extremely useful in making the task of writing correct software more abstract and thus less tied to the specific, and complex, architecture of modern computers. This, is in a large part, due to its extensive use of types as an abstraction mechanism, specifying in a crisp way the intended behaviour of a program, but it also relies on its declarative style, as a mathematical approach to functions and data structures. However, the vast gain in expressivity obtained through the development of dependent types makes the programming task more challenging, as it amounts to the question of proving complex theorems — as illustrated by the double nature of proof assistants such as Coq [11] and Agda [18]. Keeping this task as simple as possible is then of the highest importance, and it requires the use of a clear declarative style. -
Synthesising Interprocedural Bit-Precise Termination Proofs
Synthesising Interprocedural Bit-Precise Termination Proofs Hong-Yi Chen, Cristina David, Daniel Kroening, Peter Schrammel and Bjorn¨ Wachter Department of Computer Science, University of Oxford, fi[email protected] Abstract—Proving program termination is key to guaranteeing does terminate with mathematical integers, but does not ter- absence of undesirable behaviour, such as hanging programs and minate with machine integers if n equals the largest unsigned even security vulnerabilities such as denial-of-service attacks. To integer. On the other hand, the following code: make termination checks scale to large systems, interprocedural termination analysis seems essential, which is a largely unex- void foo2 ( unsigned x ) f while ( x>=10) x ++; g plored area of research in termination analysis, where most effort has focussed on difficult single-procedure problems. We present does not terminate with mathematical integers, but terminates a modular termination analysis for C programs using template- with machine integers because unsigned machine integers based interprocedural summarisation. Our analysis combines a wrap around. context-sensitive, over-approximating forward analysis with the A second challenge is to make termination analysis scale to inference of under-approximating preconditions for termination. Bit-precise termination arguments are synthesised over lexico- larger programs. The yearly Software Verification Competition graphic linear ranking function templates. Our experimental (SV-COMP) [6] includes a division in termination analysis, results show that our tool 2LS outperforms state-of-the-art alter- which reflects a representative picture of the state-of-the-art. natives, and demonstrate the clear advantage of interprocedural The SV-COMP’15 termination benchmarks contain challeng- reasoning over monolithic analysis in terms of efficiency, while ing termination problems on smaller programs with at most retaining comparable precision. -
On Modeling Homotopy Type Theory in Higher Toposes
Review: model categories for type theory Left exact localizations Injective fibrations On modeling homotopy type theory in higher toposes Mike Shulman1 1(University of San Diego) Midwest homotopy type theory seminar Indiana University Bloomington March 9, 2019 Review: model categories for type theory Left exact localizations Injective fibrations Here we go Theorem Every Grothendieck (1; 1)-topos can be presented by a model category that interprets \Book" Homotopy Type Theory with: • Σ-types, a unit type, Π-types with function extensionality, and identity types. • Strict universes, closed under all the above type formers, and satisfying univalence and the propositional resizing axiom. Review: model categories for type theory Left exact localizations Injective fibrations Here we go Theorem Every Grothendieck (1; 1)-topos can be presented by a model category that interprets \Book" Homotopy Type Theory with: • Σ-types, a unit type, Π-types with function extensionality, and identity types. • Strict universes, closed under all the above type formers, and satisfying univalence and the propositional resizing axiom. Review: model categories for type theory Left exact localizations Injective fibrations Some caveats 1 Classical metatheory: ZFC with inaccessible cardinals. 2 Classical homotopy theory: simplicial sets. (It's not clear which cubical sets can even model the (1; 1)-topos of 1-groupoids.) 3 Will not mention \elementary (1; 1)-toposes" (though we can deduce partial results about them by Yoneda embedding). 4 Not the full \internal language hypothesis" that some \homotopy theory of type theories" is equivalent to the homotopy theory of some kind of (1; 1)-category. Only a unidirectional interpretation | in the useful direction! 5 We assume the initiality hypothesis: a \model of type theory" means a CwF. -
Practical Reflection and Metaprogramming for Dependent
Practical Reflection and Metaprogramming for Dependent Types David Raymond Christiansen Advisor: Peter Sestoft Submitted: November 2, 2015 i Abstract Embedded domain-specific languages are special-purpose pro- gramming languages that are implemented within existing general- purpose programming languages. Dependent type systems allow strong invariants to be encoded in representations of domain-specific languages, but it can also make it difficult to program in these em- bedded languages. Interpreters and compilers must always take these invariants into account at each stage, and authors of embedded languages must work hard to relieve users of the burden of proving these properties. Idris is a dependently typed functional programming language whose semantics are given by elaboration to a core dependent type theory through a tactic language. This dissertation introduces elabo- rator reflection, in which the core operators of the elaborator are real- ized as a type of computations that are executed during the elab- oration process of Idris itself, along with a rich API for reflection. Elaborator reflection allows domain-specific languages to be imple- mented using the same elaboration technology as Idris itself, and it gives them additional means of interacting with native Idris code. It also allows Idris to be used as its own metalanguage, making it into a programmable programming language and allowing code re-use across all three stages: elaboration, type checking, and execution. Beyond elaborator reflection, other forms of compile-time reflec- tion have proven useful for embedded languages. This dissertation also describes error reflection, in which Idris code can rewrite DSL er- ror messages before presenting domain-specific messages to users, as well as a means for integrating quasiquotation into a tactic-based elaborator so that high-level syntax can be used for low-level reflected terms. -
Irrelevance, Heterogeneous Equality, and Call-By-Value Dependent Type Systems
Irrelevance, Heterogeneous Equality, and Call-by-value Dependent Type Systems Vilhelm Sjoberg¨ Chris Casinghino Ki Yung Ahn University of Pennsylvania University of Pennsylvania Portland State University [email protected] [email protected] [email protected] Nathan Collins Harley D. Eades III Peng Fu Portland State University University of Iowa University of Iowa [email protected] [email protected] [email protected] Garrin Kimmell Tim Sheard Aaron Stump University of Iowa Portland State University University of Iowa [email protected] [email protected] [email protected] Stephanie Weirich University of Pennsylvania [email protected] We present a full-spectrum dependently typed core language which includes both nontermination and computational irrelevance (a.k.a. erasure), a combination which has not been studied before. The two features interact: to protect type safety we must be careful to only erase terminating expressions. Our language design is strongly influenced by the choice of CBV evaluation, and by our novel treatment of propositional equality which has a heterogeneous, completely erased elimination form. 1 Introduction The Trellys project is a collaborative effort to design a new dependently typed programming language. Our goal is to bridge the gap between ordinary functional programming and program verification with dependent types. Programmers should be able to port their existing functional programs to Trellys with minor modifications, and then gradually add more expressive types as appropriate. This goal has implications for our design. First, and most importantly, we must consider nonter- mination and other effects. Unlike Coq and Agda, functional programming languages like OCaml and Haskell allow general recursive functions, so to accept functional programs ‘as-is’ we must be able to turn off the termination checker. -
Unfailing Haskell
The University of York Department of Computer Science Programming Languages and Systems Group Unfailing Haskell Qualifying Dissertation 30th June 2005 Neil Mitchell 2 Abstract Programs written in Haskell may fail at runtime with either a pattern match error, or with non-termination. Both of these can be thought of as giving the value ⊥ as a result. Other forms of failure, for example heap exhaustion, are not considered. The first section of this document reviews previous work, including total functional programming and sized types. Attention is paid to termination checkers for both Prolog and various functional languages. The main result from work so far is a static checker for pattern match errors that allows non-exhaustive patterns to exist, yet ensures that a pattern match error does not occur. It includes a constraint language that can be used to reason about pattern matches, along with mechanisms to propagate these constraints between program components. The proposal deals with future work to be done. It gives an approximate timetable for the design and implementation of a static checker for termination and pattern match errors. 1 Contents 1 Introduction 4 1.1 Total Programming . 4 1.2 Benefits of Totality . 4 1.3 Drawbacks of Totality . 5 1.4 A Totality Checker . 5 2 Field Survey and Review 6 2.1 Background . 6 2.1.1 Bottom ⊥ ........................................... 6 2.1.2 Normal Form . 7 2.1.3 Laziness . 7 2.1.4 Higher Order . 8 2.1.5 Peano Numbers . 8 2.2 Static Analysis . 8 2.2.1 Data Flow Analysis . 9 2.2.2 Constraint Based Analysis . -
Better SMT Proofs for Easier Reconstruction Haniel Barbosa, Jasmin Blanchette, Mathias Fleury, Pascal Fontaine, Hans-Jörg Schurr
Better SMT Proofs for Easier Reconstruction Haniel Barbosa, Jasmin Blanchette, Mathias Fleury, Pascal Fontaine, Hans-Jörg Schurr To cite this version: Haniel Barbosa, Jasmin Blanchette, Mathias Fleury, Pascal Fontaine, Hans-Jörg Schurr. Better SMT Proofs for Easier Reconstruction. AITP 2019 - 4th Conference on Artificial Intelligence and Theorem Proving, Apr 2019, Obergurgl, Austria. hal-02381819 HAL Id: hal-02381819 https://hal.archives-ouvertes.fr/hal-02381819 Submitted on 26 Nov 2019 HAL is a multi-disciplinary open access L’archive ouverte pluridisciplinaire HAL, est archive for the deposit and dissemination of sci- destinée au dépôt et à la diffusion de documents entific research documents, whether they are pub- scientifiques de niveau recherche, publiés ou non, lished or not. The documents may come from émanant des établissements d’enseignement et de teaching and research institutions in France or recherche français ou étrangers, des laboratoires abroad, or from public or private research centers. publics ou privés. Better SMT Proofs for Easier Reconstruction Haniel Barbosa1, Jasmin Christian Blanchette2;3;4, Mathias Fleury4;5, Pascal Fontaine3, and Hans-J¨orgSchurr3 1 University of Iowa, 52240 Iowa City, USA [email protected] 2 Vrije Universiteit Amsterdam, 1081 HV Amsterdam, the Netherlands [email protected] 3 Universit´ede Lorraine, CNRS, Inria, LORIA, 54000 Nancy, France fjasmin.blanchette,pascal.fontaine,[email protected] 4 Max-Planck-Institut f¨urInformatik, Saarland Informatics Campus, Saarbr¨ucken, Germany fjasmin.blanchette,[email protected] 5 Saarbr¨ucken Graduate School of Computer Science, Saarland Informatics Campus, Saarbr¨ucken, Germany [email protected] Proof assistants are used in verification, formal mathematics, and other areas to provide trust- worthy, machine-checkable formal proofs of theorems. -
Termination Analysis with Compositional Transition Invariants*
Termination Analysis with Compositional Transition Invariants? Daniel Kroening1, Natasha Sharygina2;4, Aliaksei Tsitovich2, and Christoph M. Wintersteiger3 1 Oxford University, Computing Laboratory, UK 2 Formal Verification and Security Group, University of Lugano, Switzerland 3 Computer Systems Institute, ETH Zurich, Switzerland 4 School of Computer Science, Carnegie Mellon University, USA Abstract. Modern termination provers rely on a safety checker to con- struct disjunctively well-founded transition invariants. This safety check is known to be the bottleneck of the procedure. We present an alter- native algorithm that uses a light-weight check based on transitivity of ranking relations to prove program termination. We provide an exper- imental evaluation over a set of 87 Windows drivers, and demonstrate that our algorithm is often able to conclude termination by examining only a small fraction of the program. As a consequence, our algorithm is able to outperform known approaches by multiple orders of magnitude. 1 Introduction Automated termination analysis of systems code has advanced to a level that permits industrial application of termination provers. One possible way to obtain a formal argument for termination of a program is to rank all states of the pro- gram with natural numbers such that for any pair of consecutive states si; si+1 the rank is decreasing, i.e., rank(si+1) < rank(si). In other words, a program is terminating if there exists a ranking function for every program execution. Substantial progress towards the applicability of procedures that compute ranking arguments to industrial code was achieved by an algorithm called Binary Reachability Analysis (BRA), proposed by Cook, Podelski, and Rybalchenko [1]. -
Proof-Assistants Using Dependent Type Systems
CHAPTER 18 Proof-Assistants Using Dependent Type Systems Henk Barendregt Herman Geuvers Contents I Proof checking 1151 2 Type-theoretic notions for proof checking 1153 2.1 Proof checking mathematical statements 1153 2.2 Propositions as types 1156 2.3 Examples of proofs as terms 1157 2.4 Intermezzo: Logical frameworks. 1160 2.5 Functions: algorithms versus graphs 1164 2.6 Subject Reduction . 1166 2.7 Conversion and Computation 1166 2.8 Equality . 1168 2.9 Connection between logic and type theory 1175 3 Type systems for proof checking 1180 3. l Higher order predicate logic . 1181 3.2 Higher order typed A-calculus . 1185 3.3 Pure Type Systems 1196 3.4 Properties of P ure Type Systems . 1199 3.5 Extensions of Pure Type Systems 1202 3.6 Products and Sums 1202 3.7 E-typcs 1204 3.8 Inductive Types 1206 4 Proof-development in type systems 1211 4.1 Tactics 1212 4.2 Examples of Proof Development 1214 4.3 Autarkic Computations 1220 5 P roof assistants 1223 5.1 Comparing proof-assistants . 1224 5.2 Applications of proof-assistants 1228 Bibliography 1230 Index 1235 Name index 1238 HANDBOOK OF AUTOMAT8D REASONING Edited by Alan Robinson and Andrei Voronkov © 2001 Elsevier Science Publishers 8.V. All rights reserved PROOF-ASSISTANTS USING DEPENDENT TYPE SYSTEMS 1151 I. Proof checking Proof checking consists of the automated verification of mathematical theories by first fully formalizing the underlying primitive notions, the definitions, the axioms and the proofs. Then the definitions are checked for their well-formedness and the proofs for their correctness, all this within a given logic.