Structural Logical Relations∗

Structural Logical Relations∗ Carsten Schurmann¨ Jeffrey Sarnat IT University of Copenhagen Yale University Copenhagen, Denmark New Haven, CT, USA [email protected] [email protected] Abstract The proof theoretic strength of the different systems vary significantly. Once the proof assistant question is settled Tait’s method (a.k.a. proof by logical relations) is a pow- and a proof development has begun, there is often no turn- erful proof technique frequently used for showing founda- ing back. If unforeseen challenges in the formalization of tional properties of languages based on typed λ-calculi. a meta-theoretic argument arise, one can find oneself in a Historically, these proofs have been extremely difficult to situation where one is seemingly stuck. This might suggest formalize in proof assistants with weak meta-logics, such that the best proof assistant is necessarily the most expres- as Twelf, and yet they are often straightforward in proof as- sive, but such a perspective is too naive with respect to other sistants with stronger meta-logics. In this paper, we propose considerations that influence the choice of proof assistant. structural logical relations as a technique for conducting In this paper we present a technique called structural these proofs in systems with limited meta-logical strength logical relations that avails proofs by logical relations to by explicitly representing and reasoning about an auxiliary systems with limited meta-logical strength by explicitly rep- logic. In support of our claims, we give a Twelf-checked resenting and reasoning about an auxiliary logic. Proofs by proof of the completeness of an algorithm for checking structural logical relations follow the same line of reasoning equality of simply typed λ-terms. as their informal counterparts. The central idea is to formalize the relevant part of the argument in this auxiliary logic, which we refer to as the assertion logic. Structural logi- 1. Introduction cal relations are therefore best employed in proof assistants based on logical frameworks, such as Twelf, that provide When formalizing meta-theoretic proofs about formal adequate, elegant, and convenient to work with encodings systems, one is usually first confronted with choosing a of proofs in the assertion logic. proof assistant. This decision is usually driven by concerns We show how to formalize structural logical relations in regarding the expressive power of the proof assistant, the practice using the meta-logical framework Twelf. But this trust in its logical foundation, performance, the features of paper is not just about the how, it also highlights some in- the tactic language, and the ease with which we can encode sights into the proof itself. For example, we illustrate that the formal system. a proof by logical relations can be viewed as a recipe to re- For example, Thomas Hales has chosen HOL duce the provability of a theorem to the normalizability of Light [Har96] for his work on the formalization of proofs in the assertion logic. We present the results in such a Kepler’s conjecture. George Necula has chosen variants of way that the reader interested in the nature of logical proofs, the LF type theory for his original work on proof-carrying but not in their formalization, should be able to follow this code [Nec97]. Daniel Lee, Karl Crary, and Bob Harper paper by ignoring the formalized material. have chosen the Twelf system for formalizing the proof To best follow the paper, however, it is important that of the soundness of an SML type system [LCH07] and we distinguish carefully between the logical framework, Georges Gonthier has chosen Coq for his formalized proof in our case LF [HHP93] that serves the formalization of of the four color theorem [Gon05]. The solutions posted to judgments, the assertion logic that we will encode in LF, the POPLmark challenge employ a whole range of different and the meta-logic of Twelf, in which we carry out proofs proof assistants, including Twelf, Coq, Isabelle/HOL, by structural logical relations. Our proofs are construc- Matita, Alpha Prolog, and ATS. tive and executable, laying to rest the common miscon- ∗This research has been funded by the National Science Foundation ception that the meta-logical framework Twelf is unable under grant CCR-0325808. to reason with proofs by logical relations. The F OL∆N 1 system [MM97] has a similar distinction between logical proof using structural logical relations for the same property framework and meta-logic; we suspect that structural logi- is given in Section 4. cal relations would be convenient in that setting as well. Taking a step back, we notice that the logical relation This paper is structured as follows: In Section 2 we defined above relies on two things: structural induction on define the term structural logical relation and give a sim- τ, judgments of the form of J, and connectives “for all” ple yet useful example of an assertion logic, namely min- and “if ... then.” Logical relations are typically formulated imal first-order logic, suitable for reasoning about sim- with the understanding that the induction principle, judg- ply typed languages. In Section 3, we briefly comment ments, and connectives live on the same level. The idea of on the formalization of the technique in the proof assis- structural logical relations is to separate these concepts: in- tant Twelf. We give an introductory example of a struc- duction lives on the meta-level, whereas the judgments and tural logical relations proof, namely the weak normaliza- connectives live elsewhere. To this end, we declare a logic, tion for the simply typed λ-calculus in Section 4 before the assertion logic, that is expressive enough to define both we address the goal of this paper, the completeness of a logical relation in terms of logical connectives and atomic equivalence checking in Section 5. An identifying fea- formulas P that represent the judgments J in the logic. The ture of our structural logical relations proofs is the cut- formulas of our assertion logic that we use throughout this elimination property of the assertion logic. Therefore, we paper are defined by the following. study the features and implications of cut-elimination of the τ assertion logic in Section 6. We conclude with Section 7 Formulas F; G ::= P j F ⊃ G j 8x :F τ where we discuss implications and possible extensions. The Assumptions ∆ ::= · j ∆;F j ∆; x accompanying Twelf source code [SS08] is available at In the definition of expressions, every variable carries its http://www.twelf.org/slr. own type, which means that we can restrict the universal quantifier to range over well-typed expressions even if these 2. Structural Logical Relations contain free variables. We write eτ for an expression e of type τ and omit the superscript τ whenever it can be easily A proof by logical relations (also sometimes referred to inferred. as Tait’s method) relies on an interpretation of types as re- We define the judgment of derivability in a sequent cal- lations between objects. On paper, these interpretations are culus ∆ ` F by the following rules. If ∆ is ·, then we usually formulated in set theory. In the spirit of intuition- simply drop it from the judgment. ism, we not only want to know that a certain property holds, F 2 ∆ ∆;F ` G but we would like to be able to produce a constructive wit- ax impR ness of this fact. ∆ ` F ∆ ` F ⊃ G Consider the simply typed λ-calculus. ∆;F ⊃ G ` F ∆;F ⊃ G; G ` H impL Types τ ::= o j τ1 ) τ2 ∆;F ⊃ G ` H τ τ Expressions e ::= x j lam x : e j app e1 e2 ∆; xτ ` F ∆; 8xτ : F; [eτ =x]F ` H We refer to a property that is logic independent as a judg- allR allL τ τ ment. Examples of judgments J include, for example, e ∆ ` 8x :F ∆; 8x :F ` H reduces to a normal form, e weak-head reduces to e0, or e The rules are standard. We let the universal quantifier is βη-equivalent to e0. Given some judgment J(e), a unary range over expressions eτ . We write [eτ =x]F for the usual logical relation [[τ]] can be defined as the smallest set that notion of capture-avoiding substitution. satisfies the following two conditions. For practical reasons we will work with the assertion cut logic with cut. The judgment ∆ ` F is defined by infer- e 2 [[o]] iff J(e) cut ence rules similar to the ones above except with ` instead e 2 [[τ2 ) τ1]] iff for all e2, if e2 2 [[τ2]] of `, plus one additional rule. then app e e2 2 [[τ1]] cut cut The hallmark characteristic of a logical relation is the def- ∆ ` F ∆;F ` G cut cut inition at function types: functions are related if they map ∆ ` G related arguments to related results. A proof by logical relations typically proceeds in two stages: first, it is shown that The rules for defining the atomic formulas P vary for e 2 [[τ]] implies J(e), then it is shown that, for every e of each structural logical relation. Hence they are defined in type τ, e 2 [[τ]]. A paper proof for the weak normalization Sections 4 and 5, where we discuss concrete applications of of the simply typed λ-calculus can be found in [Pfe92]; a our technique. We show later in the paper that the choice of 2 inference rules cannot be arbitrary: they must not destroy We write -> (infix) if the dependency is vacuous. Further- the cut-elimination property of the sequent-calculus. more, we write [t:tp] for λ-abstraction, t:tp for type Returning to the definition of structural logical relations, ascription, and juxtaposition for application in the logical we can now define [[τ]] more formally by meta-level induc- framework.

Load more