Formal Verification of the Equivalence of System F and the Pure Type
Total Page：16
File Type：pdf, Size：1020Kb
Formal Verification of the Equivalence of System F and the Pure Type System L2 Jonas Kaiser Dissertation zur Erlangung des Grades des Doktors der Ingenieurwissenschaften der Fakult¨atf¨urMathematik und Informatik der Universit¨atdes Saarlandes Saarbr¨ucken, 2019 Berichterstatter: Prof. Dr. Gert Smolka, Universit¨atdes Saarlandes Prof. Brigitte Pientka, Ph.D., McGill University Dekan: Univ.-Prof. Dr. Sebastian Hack Pr¨ufungsausschuss: Prof. Dr. Markus Bl¨aser(Vorsitz) Prof. Dr. Gert Smolka Prof. Brigitte Pientka, Ph.D. Dr. Richard Membarth (Beisitzer) Tag des Kolloquiums: 11. Juli 2019 Textfassung vom 11. August 2019 Copyright c 2019 Jonas Kaiser ii Abstract We develop a formal proof of the equivalence of two different variants of System F. The first is close to the original presentation where expressions are separated into distinct syntactic classes of types and terms. The second, L2 (also written as λ2), is a particular pure type system (PTS) where the notions of types and terms, and the associated expressions are unified in a single syntactic class. The employed notion of equivalence is a bidirectional reduction of the respective typing relations. A machine- verified proof of this result turns out to be surprisingly intricate, since the two variants noticeably differ in their expression languages, their type systems and the binding of local variables. Most of this work is executed in the Coq theorem prover and encompasses a general development of the PTS metatheory, an equivalence result for a stratified and a PTS variant of the simply typed λ-calculus as well as the subsequent extension to the full equivalence result for System F. We utilise nameless de Bruijn syntax with parallel substitutions for the representation of variable binding and develop an extended notion of context morphism lemmas as a structured proof method for this setting. We also provide two developments of the equivalence result in the proof systems Abella and Beluga, where we rely on higher-order abstract syntax (HOAS). This allows us to compare the three proof systems, as well as HOAS and de Bruijn for the purpose of developing formal metatheory. iii Kurzzusammenfassung Wir pr¨asentieren einen maschinell verifizierten Beweis der Aquivalenz¨ zweier Darstellungen des Lambda-Kalk¨ulsSystem F. Die erste unterscheidet syntaktisch zwischen Termen und Typen und entspricht somit der gel¨aufigenForm. Die zweite, L2 bzw. λ2, ist ein sog. Pure Type System (PTS), bei welchem alle Ausdr¨ucke in einer syntaktischen Klasse zusammen fallen. Unser Aquivalenzbegriff¨ ist eine bidirektionale Reduktion der jeweiligen Typrelationen. Ein formaler Beweis dieser Eigenschaft ist aufgrund der Unterschiede der Ausdruckssprachen, der Typrelationen und der Bindung lokaler Variablen ¨uberraschend anspruchsvoll. Der Hauptteil dieser Arbeit wurde in dem Beweisassistenten Coq entwickelt und umfasst eine Abhandlung der PTS Metatheorie, sowie einen Aquivalenzbeweis¨ f¨urdas einfach getypte Lambda-Kalk¨ul, welcher dann zu dem vollen Ergebnis f¨ur System F skaliert wird. F¨urdie Darstellung lokaler Variablenbindung verwenden wir de Bruijn Syntax, gepaart mit parallelen Substitutionen. Außerdem entwickeln wir eine generalisierte Form von Kontext-Morphismen Lemmas, welche eine strukturierte Beweismethodik in diesem Umfeld liefern. Dar¨uber hinaus betrachten wir zwei weitere Formalisierungen des Aquivalenz-¨ resultats in den Beweissystemen Abella und Beluga, welche beide h¨oherstufigeabstrakte Syntax (HOAS) zur Darstellung lokaler Bindung verwenden. Dies erm¨oglicht es uns, sowohl die drei Beweissysteme, als auch den HOAS und den de Bruijn Ansatz mit Hinblick auf die Entwicklung formaler Metatheorie zu vergleichen. v Acknowledgements I am indebted to a number of people without whom this work would not have been possible and I would like to use this space to express my sincerest gratitude. First and foremost I thank Gert for his supervision and for opening my eyes to the beauty of a well-engineered, formalised proof, as well as the attention to detail that goes with it. Meanwhile, it was Chad who taught me that, despite their apparent power, proof assistants are not a substitute for but rather a complement to rigorous mathematical thinking. This project benefitted from countless discussions with my collaborators and colleagues at the Programming Systems Lab. I want to thank, in particular, Tobias for introducing me to the intricacies of de Bruijn syntax, Steven for being a fountain of ideas that would never run dry, and Kathrin for her dedication to the Autosubst 2 project. My gratitude also extends to the rest of the lab which provided a relaxed, pleasant and inspiring research environment. Here Ute deserves a special mention for keeping everything running as smoothly as it did and helping with all kinds of organisational concerns. Beyond the lab it was Dale, who approached me in Porto to propose Abella as a candidate proof system for my equivalence proof, and later Brigitte, who in Paris introduced me to Beluga. Without those two, the project would likely have remained stuck in the walled-in perspective of a single proof system. Contrary to a common adage in academia, there is more to life than research. Hence I would like to thank my family and friends for their moral support and just being there these past years. A big thank you goes out to Klaas, Christian and Roland for many splendid game nights and the much needed levity, as well as to Linus and Fabian for always offering sound advice and an outside perspective. Finally, and most important of all, I want to say thank you to my wife Verena for her unwavering love, encouragement and patience through the many ups and downs of my research and dissertation phase. The lines in this text are mine, but it is her presence that carries them. vii Contents Abstract iii Kurzzusammenfassungv Acknowledgements vii 1 Introduction1 1.1 Motivation . .1 1.2 Related Work . .3 1.3 Formalisation . .7 1.4 Contributions . .8 1.5 Thesis Overview . 10 2 Technical Preliminaries 11 2.1 Notational Conventions . 11 2.2 Variables, Binding and α-Equivalence . 14 2.3 De Bruijn Syntax . 15 2.4 Abstract Reduction Systems . 20 3 Pure Type Systems 27 3.1 A Class of Systems . 27 3.2 Uniform Syntax . 28 3.3 Reduction and Conversion . 29 3.4 Free Variables . 37 3.5 Typing . 39 3.6 Context Morphism Lemmas . 45 3.7 Subject Reduction . 52 3.8 Functional Pure Type Systems and Strengthening . 55 3.9 The λ-Cube . 62 3.10 Discussion . 63 4 Simply Typed Lambda-Calculus 67 4.1 STLC . 69 4.2 The PTS λ! ............................... 74 4.3 Relating de Bruijn Indices . 78 4.4 Proof of Correspondence . 83 4.5 Demo: Transfer of Results . 100 4.6 Discussion . 101 viii 5 System F 103 5.1 PLC . 104 5.2 The PTS λ2................................ 110 5.3 Proof of Correspondence . 113 5.4 Discussion . 126 6 Higher-Order Abstract Syntax 127 6.1 Basic HOAS . 127 6.2 HOAS Representations of PLC and λ2................. 129 6.3 Subordination . 135 6.4 Abella Implementation . 136 6.5 Beluga Implementation . 161 6.6 Remarks on Adequacy . 179 6.7 Discussion . 180 7 Remarks on the Formalisation 183 7.1 De Bruijn vs HOAS . 183 7.2 Comparison of Effort . 186 7.3 Technical Comparison of Provers . 186 8 Conclusion 191 8.1 Summary of Results . 191 8.2 Open Questions and Challenges . 194 Bibliography 199 ix 1 Introduction This thesis formally verifies the claim that System F, also known as the polymorphic λ-calculus (PLC), and its formulation as the pure type system λ2 (pronounced \lambda-two")1 are equivalent. Here, and throughout the remainder of this text, formal means machine-verified with a proof assistant. Both System F and pure type systems (PTSs) are formalisms that consist of a syntactic expression language, a notion of computation and a typing discipline. Accordingly, both systems support the notion of typing judgements Γ ` s : t, which assign types t to terms s under a given typing context Γ. We consider two formalisms as equivalent when they are co-typeable, that is we have a bidirectional reduction of typing between the two formalisms. The complementary notion of co-reducibility is not covered in any detail in this text. As a precursor to the full result for System F we will first tackle a similar result for the simply typed λ-calculus (STLC) and the corresponding PTS λ! (pronounced \lambda-base"). This allows us to demonstrate some of the necessary proof constructions and definitions in a simplified setting. We also present a general development of the PTS metatheory since a lot of the required properties can be uniformly established for the two PTSs for which we consider the correspondence result. Viewed from a slightly different angle, our work illustrates how we can establish that a certain PTS, like λ2, faithfully captures a given traditional formalism like PLC. 1.1 Motivation System F is well-established and its metatheory has been discussed at length in the literature. Gentle introductions can be found in [Pie02, Har13], while an excellent in-depth discussion is given in [SU06]. It is both interesting from a logical point of view, since it extends intuitionistic logic with universal quantification, as well as a prototypical programming language with support for polymorphic types. Girard introduced the system with a focus on the first aspect in [Gir72], while Reynolds independently invented it based on the latter motivation [Rey74]. We found that since its inception, quite a number of different presentations of the formalism have been proposed. Some of the differences are negligible, others not so much. While not problematic per se, it becomes an issue as soon as we want to transfer metatheoretic results from one presentation to another. Such results include properties like the correctness of types or the compatibility of the typing judgement 1 As in the title of this thesis, we also denote this system as L2, where the usage of Greek letters could be undesirable.