Towards a Judgmental Reconstruction of Logical Relation Proofs
Total Page:16
File Type:pdf, Size:1020Kb
Towards a Judgmental Reconstruction of Logical Relation Proofs Carsten Sch¨urmann and Jeffrey Sarnat Yale University and IT University of Copenhagen [email protected] and [email protected] Abstract. Tait’s method (a.k.a. proof by logical relations) is a powerful proof technique frequently used for showing foundational properties of languages based on typed lambda-calculi. Historically, these proofs have been difficult to formalize in proof assistants with weak meta-logics, such as Twelf. Logical relations are notoriously difficult to define judgmentally. In this paper, we present and discuss a Twelf proof of weak normalization for System F making use of higher-order encodings. We exhibit a modular technique on how to formalize proofs of this kind, and make explicit all logical principles that one needs to trust in order believe in the proof. 1 Introduction When formalizing meta-theoretic proofs about formal systems, one is usually first confronted with the choice of proof assistant. Driven by concerns of the expressive power of the proof assistant, the trust in its logical foundation, performance, the features of the tactic language, and often also the ease with which we can encode the formal system, the final decision of which system to choose varies in practice. Thomas Hales for example, has chosen HOL light [Har96] for his work on the formalization of Kepler’s conjecture, George Necula has chosen variants of the LF type theory for his work on proof-carrying code [Nec97], Daniel Lee, Karl Crary, and Bob Harper have chosen the Twelf system for formalizing the proof of the soundness of a SML type system [LCH07] and Georges Gonthier has used Coq for his formalized proof of the four color theorem [Gon05]. The proof theoretic strengths of different systems vary, and once the proof assistant question is settled and a proof development has begun, there is often no turning back. If unforseen challenges in the formalization of a meta-theoretic argument arise, one can find oneself in a situation where one is seemingly stuck. This might suggest that the best proof assistant is necessarily the most expres- sive, but such a perspective is too naive with respect to other considerations that influence the choice of proof assistant. In this paper we illustrate how limitations imposed by the meta-logic can sometimes be circumvented. We show in the setting of Twelf how one can push some of the burden related to logical expressivity down into an auxiliary logical system that is represented in LF. This trick not only works, but it allows us to point to the principles that we need to trust in order to believe the overall proof. This logical system is called assertion logic. We discuss a proof of weak normalization for System F in Twelf via logical relations. In formalizing the proof, we overcome two significant technical obsta- cles. First, we solve a previously open problem as to whether logical relations are representable in Twelf at all. Second, because the theorems provable in Twelf can informally be seen to be a subset of those provable in Peano arithmetic, G¨odel’s second incompleteness theorem tells us that we should not be able to prove normalization of a calculus as proof-theoretically strong as System F. In- deed, Twelf cannot certify the validity of our entire proof: the consistency of a second-order assertion logic must be explicitly assumed, a leap of faith no larger than the one required to trust the soundness of any proof-assistant with the built-in expressive power to certify our proof in its entirety. In our encoding we carefully distinguish between the logical framework, in our case LF [HHP93], the assertion logic, encoded in LF, and the meta logic of LF, Twelf, in which we prove the aforementioned conjecture. Our proof is constructive and executable. This paper is structured as follows: In Section 2 we encode in LF both System F and the judgments that characterize when terms are weakly normalizing. In Section 3 we describe the assertion logic, its properties, and the formalization in LF. Next, we define the logical relation in the assertion logic by meta-level induction. With this definition, we are able to prove that for every term in System F there is an assertion-logic proof that the term is convertible to a canonical form. The desired theorem then follows from the assumption that our cut-elimination procedure for second-order logic terminates. In Section 4, we discuss implications and extensions of the result before we conclude. Please find the accompanying Twelf source code at http://www.cs.yale.edu/~sarnat/tphols. 2 System F in LF System F [GTL90], independently discovered by Jean-Yves Girard and John Reynolds, is an extension of the simply typed λ-calculus by polymorphic types. Inspired by Church’s definition of higher-order logic using the simply-typed cal- culus as a logical framework [Chu40], we define our System F in the dependently typed logical framework LF [HHP93]. We define the syntactic category of types as follows. Types: A ::= α | A1 ⇒ A2 | ∀(λα : tp.A) λ stands for the binding construct of LF, and tp is an LF type constant. Next, we define the syntactic category of terms of type A. We write tm A for the corresponding LF type taking advantage of the fact that in LF type families may be indexed by LF objects. Terms: e ::= x | lam (λx : tm A. e) | app e1 e2 | tlam (λα : tp. e) | tapp e A The symbols lam, app, tlam and tapp are represented as constants in LF. In the interest of readability, we will not discuss the encoding of terms and types tm : tp → type. tp : type. lam :(tm A → tm B) → tm (A ⇒ B). ⇒: tp → tp → tp. app : tm (A ⇒ B) → tm A → tm B. ∀ :(tp → tp) → tp. tlam :(Πα:tp. tm (A α)) → tm (∀ (λα:tp. A α)). tapp : tm (∀ (λα:tp. A α)) → (Πα:tp. tm (A α)). Fig. 1. LF Encoding of Types and Terms any further, simply because there is no difference between the formalized and the informal presentation. Every syntactic category given in this paper can be adequately represented in LF. Our encoding of terms ensures that all expressible terms are well-typed: 1. If e : tm B is a term with a hole, say x : tm A, then lam (λx : tm A. e): tm (A ⇒ B). 2. If e1 : tm (A ⇒ B) and e2 : tm A then app e1 e2 : tm B. 3. If e : tm B is a term with a hole, say α : tp, then tlam (λα : tp. e): tm (∀(λα : tp.A)). 4. If e : tm (∀(λα : tp.A)) and A0 : tp then tapp e A0 : tm (A[A0/α]). The actual LF encoding of System F is given in Figure 1. →, Π, λ, and jux- tapositions are defined by LF and substitutions are provided by LF. We follow the syntactic convention of Twelf by omitting leading Π abstraction from types that are easily inferable. In the setting of the logical framework LF, we usually encode judgments-as- types and derivations-as-objects where inferences rules are encoded as constants. We write e ⇓ if e is atomic, which means that the head of e is not a β-redex. We write e ⇑ if e is canonical, which means that it is a β-normal, η-long form. Note that the rule n1 can only be applied when e is of type tm α, which we express using a form a type ascription (e : tm α). e1 ⇓ e2 ⇑ e ⇓ p1 p2 app e1 e2 ⇓ tapp e A ⇓ u x ⇓ . (e : tm α) ⇓ e ⇑ e ⇑ n1 n2x,u n3α (e : tm α) ⇑ lam (λx : tm A. e) ⇑ tlam (λα : tp. e) ⇑ Next we define three judgments e −→ e0, e −→∗ e0, e −→whr e0. r1 r2 app (lam (λx : tm A. e1)) e2 −→ e1[e2/x] tapp (tlam (λα : tp. e)) A −→ e[A/α] r3 r4 e −→ lam (λx : tm A. app e x) e −→ tlam (λα : tp. tapp e α) 0 0 0 e1 −→ e1 e2 −→ e2 e −→ e r5 r6 r7 0 0 0 app e1 e2 −→ app e1 e2 app e1 e2 −→ app e1 e2 tapp e A −→ tapp e A e −→ e0 e −→ e0 r8x r9α lam (λx : tm A. e) −→ lam (λx : tm A. e0) tlam (λα : tp. e) −→ tlam (λα : tp. e0) r1 and r2 define β-reduction for objects and types, respectively, r3 and r4 define η expansion, and rules r5 – r9 define the usual congruence closure for βη. The following two rules describe the reflexive transitive closure of −→. ∗ e1 −→ e2 e2 −→ e3 r1∗ r2∗ ∗ ∗ e −→ e e1 −→ e3 Next, we define weak head reduction. w1 whr app (lam (λx : tm A. e1)) e2 −→ e1[e2/x] w2 tapp (tlam (λα : tp. e)) A −→whr e[A/α] whr 0 whr 0 e1 −→ e1 e −→ e w3 w4 whr 0 whr 0 app e1 e2 −→ app e1 e2 tapp e A −→ tapp e A w1 and w2 execute a β-reduction step, and w3 and w4 define the congruence closure for weak-head reduction. It is worth mentioning the reduction rules are only applicable to terms of the same type. Finally we define a judgment about the existence of atomic and canonical forms that will play a central role in our development. We capture the meaning that a term e can be reduced to canonical or atomic form with the judgments e ↓ and e ↑, respectively. e1 ↓ e2 ↑ e ↓ a1 a2 app e1 e2 ↓ tapp e A1 ↓ u x ↓ . app e x ↑ tapp e α ↓ c1x,u c2α e : tm (A1 ⇒ A2) ↑ e : tm (∀ (λα.