Aug 2, 2009 - Axiom iii. Axiom iv. 5. Conclusions and Future Work. Kothari Caldwell (U. of Wyoming). A Machine-Checked Model of MGU Axioms. UNIF'09.
A Machine-Checked Model of MGU Axioms: Applications of Finite Maps and Functional Induction Presented by Sunil Kothari Joint work with Prof. James Caldwell Department of Computer Science, University of Wyoming, USA
23rd International Workshop on Unification August 2, 2009
Outline 1
Overview Type Reconstruction Algorithms
2
Introduction Substitution Coq
3
First-order unification algorithm Specification in Coq Termination
4
A model for MGU axioms Axiom iii Axiom iv
5
Conclusions and Future Work
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
2 / 31
Outline 1
Overview Type Reconstruction Algorithms
2
Introduction Substitution Coq
3
First-order unification algorithm Specification in Coq Termination
4
A model for MGU axioms Axiom iii Axiom iv
5
Conclusions and Future Work
Overview
Type Reconstruction Algorithms
Highlights
Essential feature of many functional programming languages (ML, Haskell, OCaml, etc.).
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
3 / 31
Overview
Type Reconstruction Algorithms
Highlights
Essential feature of many functional programming languages (ML, Haskell, OCaml, etc.). Automated type reconstruction is possible.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
3 / 31
Overview
Type Reconstruction Algorithms
Highlights
Essential feature of many functional programming languages (ML, Haskell, OCaml, etc.). Automated type reconstruction is possible. Substitution-based algorithms. Intermittent constraint generation and constraint solving.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
3 / 31
Overview
Type Reconstruction Algorithms
Highlights
Essential feature of many functional programming languages (ML, Haskell, OCaml, etc.). Automated type reconstruction is possible. Substitution-based algorithms. Intermittent constraint generation and constraint solving.
Constraint-based algorithms. Two distinct phases: constraint generation and constraint solving.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
3 / 31
Overview
Type Reconstruction Algorithms
Type Reconstruction Algorithms...contd
Substitution-based Algorithm W, J by Milner, 1978. Algorithm M by Leroy, 1993.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
4 / 31
Overview
Type Reconstruction Algorithms
Type Reconstruction Algorithms...contd
Substitution-based Algorithm W, J by Milner, 1978. Algorithm M by Leroy, 1993. Constraint-based Frameworks/Algorithms Wand’s algorithm [Wan87]. Qualified types [Jon95]. HM(X) [SOW97] by Sulzmann et al. 1999, Pottier and Rémy 2005 [PR05]. Top quality error messages [Hee05].
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
4 / 31
Overview
Type Reconstruction Algorithms
Type Reconstruction Algorithms... Contd
Machine-Certified Correctness Proof Algorithm W in Coq, Isabelle/HOL [DM99, NN99a, NN99b, NN96].
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
5 / 31
Overview
Type Reconstruction Algorithms
Type Reconstruction Algorithms... Contd
Machine-Certified Correctness Proof Algorithm W in Coq, Isabelle/HOL [DM99, NN99a, NN99b, NN96]. Nominal verification of Algorithm W [UN09].
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
5 / 31
Overview
Type Reconstruction Algorithms
Type Reconstruction Algorithms... Contd
Machine-Certified Correctness Proof Algorithm W in Coq, Isabelle/HOL [DM99, NN99a, NN99b, NN96]. Nominal verification of Algorithm W [UN09]. We want to formalize multi-phase unification algorithm needed to handle polymorphic let.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
5 / 31
Overview
Type Reconstruction Algorithms
Type Reconstruction Algorithms... Contd
Machine-Certified Correctness Proof Algorithm W in Coq, Isabelle/HOL [DM99, NN99a, NN99b, NN96]. Nominal verification of Algorithm W [UN09]. We want to formalize multi-phase unification algorithm needed to handle polymorphic let. POPLMark challenge also aims at mechanizing meta-theory.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
5 / 31
Overview
Type Reconstruction Algorithms
Type Reconstruction Algorithms... Contd
Modeling MGU The most general unifier (MGU) is often a first-order unification algorithm over simple type terms.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
6 / 31
Overview
Type Reconstruction Algorithms
Type Reconstruction Algorithms... Contd
Modeling MGU The most general unifier (MGU) is often a first-order unification algorithm over simple type terms. In machine checked correctness proofs, the MGU is modeled as a set of four axioms: (i) (ii) (iii) (iv )
c
mgu σ (τ1 =τ2 ) ⇒ σ(τ1 ) = σ(τ2 ) c mgu σ (τ1 =τ2 ) ∧ σ 0 (τ1 ) = σ 0 (τ2 ) ⇒ ∃σ 00 .σ 0 ≈ σ ◦ σ 00 c c mgu σ (τ1 =τ2 ) ⇒ FTVS (σ) ⊆ FVC (τ1 =τ2 ) c σ(τ1 ) = σ(τ2 ) ⇒ ∃σ 0 . mgu σ 0 (τ1 =τ2 )
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
6 / 31
Outline 1
Overview Type Reconstruction Algorithms
2
Introduction Substitution Coq
3
First-order unification algorithm Specification in Coq Termination
4
A model for MGU axioms Axiom iii Axiom iv
5
Conclusions and Future Work
Introduction
Terms and Constraint Syntax
Terms τ ::= TyVar(x) | τ 0 → τ 00
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
7 / 31
Introduction
Terms and Constraint Syntax
Terms τ ::= TyVar(x) | τ 0 → τ 00 Atomic types (of the form TyVar x) are denoted by α, β, α0 etc.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
7 / 31
Introduction
Terms and Constraint Syntax
Terms τ ::= TyVar(x) | τ 0 → τ 00 Atomic types (of the form TyVar x) are denoted by α, β, α0 etc. Constraints c
Constraint are of the form τ =τ 0 .
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
7 / 31
Introduction
Terms and Constraint Syntax
Terms τ ::= TyVar(x) | τ 0 → τ 00 Atomic types (of the form TyVar x) are denoted by α, β, α0 etc. Constraints c
Constraint are of the form τ =τ 0 . A list of constraint is given as: c
C ::= [ ] | τ =τ 0 :: C0
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
7 / 31
Introduction
FTV and FVC
Free type variable (FTV) FTV (TyVar x) 0
FTV (τ → τ )
def
=
[x]
def
FTV (τ ) ++ FTV (τ 0 )
=
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
8 / 31
Introduction
FTV and FVC
Free type variable (FTV) FTV (TyVar x) 0
FTV (τ → τ )
def
=
[x]
def
FTV (τ ) ++ FTV (τ 0 )
=
Free variables of a constraint list (FVC) def
FVC [ ]
=
c
FVC ((τ1 =τ2 ) :: C)
Kothari Caldwell (U. of Wyoming)
def
=
[] FTV (τ1 ) ++ FTV (τ2 ) ++ FVC (C)
A Machine-Checked Model of MGU Axioms
UNIF’09
8 / 31
Introduction
Substitution
Substitution
Related Concepts A substitution (denoted by ρ) maps type variables to types.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
9 / 31
Introduction
Substitution
Substitution
Related Concepts A substitution (denoted by ρ) maps type variables to types. Denoted by σ, σ 0 , σ1 etc.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
9 / 31
Introduction
Substitution
Substitution
Related Concepts A substitution (denoted by ρ) maps type variables to types. Denoted by σ, σ 0 , σ1 etc. Substitution application to a type τ is defined as: σ (TyVar(x)) σ (τ1 → τ2 )
Kothari Caldwell (U. of Wyoming)
def
=
if hx, τ i ∈ σ then τ else TyVar(x)
def
σ(τ1 ) → σ(τ2 )
=
A Machine-Checked Model of MGU Axioms
UNIF’09
9 / 31
Introduction
Substitution
Substitution
Related Concepts A substitution (denoted by ρ) maps type variables to types. Denoted by σ, σ 0 , σ1 etc. Substitution application to a type τ is defined as: σ (TyVar(x)) σ (τ1 → τ2 )
def
=
if hx, τ i ∈ σ then τ else TyVar(x)
def
σ(τ1 ) → σ(τ2 )
=
Application of a substitution to a constraint is defined similarly: c
def
c
σ(τ1 =τ2 ) = σ(τ1 )=σ(τ2 )
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
9 / 31
Introduction
Substitution
Substitution
Substitution Composition Substitution composition definition using Coq’s finite maps is complicated. But the following theorem holds Theorem 1 (Composition apply) ∀σ, σ 0 .∀τ.(σ ◦ σ 0 )τ = σ 0 (σ(τ ))
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
10 / 31
Introduction
Substitution
Substitution
Substitution Composition Substitution composition definition using Coq’s finite maps is complicated. But the following theorem holds Theorem 1 (Composition apply) ∀σ, σ 0 .∀τ.(σ ◦ σ 0 )τ = σ 0 (σ(τ ))
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
10 / 31
Introduction
Substitution
Substitution
Substitution Composition Substitution composition definition using Coq’s finite maps is complicated. But the following theorem holds Theorem 1 (Composition apply) ∀σ, σ 0 .∀τ.(σ ◦ σ 0 )τ = σ 0 (σ(τ )) Extensional equality Substitutions are equal if they behave the same on all type variables. def
σ ≈ σ 0 = ∀α. σ(α) = σ 0 (α)
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
10 / 31
Introduction
Substitution
Unifiers and MGUs
Unifier c
We write σ |= (τ1 =τ2 ), if σ(τ1 ) = σ(τ2 ). def
σ |= C = ∀c ∈ C, σ |= c.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
11 / 31
Introduction
Substitution
Unifiers and MGUs
Unifier c
We write σ |= (τ1 =τ2 ), if σ(τ1 ) = σ(τ2 ). def
σ |= C = ∀c ∈ C, σ |= c. Most General Unifier A unifier σ is the most general unifier(MGU) if for any other unifier σ 00 there is a substitution σ 0 such that σ ◦ σ 0 ≈ σ 00 .
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
11 / 31
Introduction
Coq
Coq
Overview Based on the Calculus of Constructions.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
12 / 31
Introduction
Coq
Coq
Overview Based on the Calculus of Constructions. System F extended with dependent types.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
12 / 31
Introduction
Coq
Coq
Overview Based on the Calculus of Constructions. System F extended with dependent types. Support for inductive datatypes.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
12 / 31
Introduction
Coq
Coq
Overview Based on the Calculus of Constructions. System F extended with dependent types. Support for inductive datatypes. Programs can be extracted from proofs.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
12 / 31
Introduction
Coq
Coq
Overview Based on the Calculus of Constructions. System F extended with dependent types. Support for inductive datatypes. Programs can be extracted from proofs. Lots of libraries.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
12 / 31
Introduction
Coq
Finite maps in Coq
Representing substitutions Substitution represented as a list of pairs, set of pairs, and normal function. We represent a substitution as a finite function.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
13 / 31
Introduction
Coq
Finite maps in Coq
Representing substitutions Substitution represented as a list of pairs, set of pairs, and normal function. We represent a substitution as a finite function. Substitution as finite map Used the Coq’s finite maps library Coq.FSets.FMapInterface. Axiomatic presentation. Provides no induction principle. Forward reasoning is often required.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
13 / 31
Introduction
Coq
Substitution Related Concepts in Coq
Domain def
dom_subst(σ) = List.map (λt.fst (t)) (M.elements( σ))
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
14 / 31
Introduction
Coq
Substitution Related Concepts in Coq
Domain def
dom_subst(σ) = List.map (λt.fst (t)) (M.elements( σ)) Range def
range_subst(σ) = List.flat_map (λt.FTV (snd (t))) (M.elements( σ))
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
14 / 31
Introduction
Coq
Substitution Related Concepts in Coq
Domain def
dom_subst(σ) = List.map (λt.fst (t)) (M.elements( σ)) Range def
range_subst(σ) = List.flat_map (λt.FTV (snd (t))) (M.elements( σ))
FTVS def
FTVS(σ) = dom_subst(σ) ++ range_subst(σ)
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
14 / 31
Outline 1
Overview Type Reconstruction Algorithms
2
Introduction Substitution Coq
3
First-order unification algorithm Specification in Coq Termination
4
A model for MGU axioms Axiom iii Axiom iv
5
Conclusions and Future Work
First-order unification algorithm
Specification in Coq
Unification
The Algorithm c
def
c
def
c
def
c
def
unify (α=α) :: C unify (α=β) :: C unify (α=τ ) :: C
unify (τ =α) :: C
= unify C = {α 7→ β} ◦ unify ({α 7→ β}C)
= if α occurs in τ then Fail else {α 7→ τ } ◦ unify ({α 7→ τ }C)
=
c
unify (α=τ ) :: C
def
c
c
unify (τ1 → τ2 = unify (τ1 =τ3 :: τ2 =τ4 :: C) c =τ3 → τ4 ) :: C unify [ ]
def
= Id
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
15 / 31
First-order unification algorithm
Specification in Coq
Unification
The Algorithm c
def
c
def
c
def
c
def
unify (α=α) :: C unify (α=β) :: C unify (α=τ ) :: C
unify (τ =α) :: C
= unify C = {α 7→ β} ◦ unify ({α 7→ β}C)
= if α occurs in τ then Fail else {α 7→ τ } ◦ unify ({α 7→ τ }C)
= if α occurs in τ then Fail else {α 7→ τ } ◦ unify ({α 7→ τ }C)
def
c
c
unify (τ1 → τ2 = unify (τ1 =τ3 :: τ2 =τ4 :: C) c =τ3 → τ4 ) :: C unify [ ]
def
= Id
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
16 / 31
First-order unification algorithm
Specification in Coq
Specification in Coq Function unify (c:list constr){wf meaPairMLt} :(option (M.t type)) := match c with nil => Some (M.empty type) | h::t => (match h with EqCons (TyVar x) (TyVar y) => if eq_dec_stamp x y then unify t else (match unify (apply_subst_to_constr_list (M.add x (TyVar y) (M.empty type)) t) with Some p => Some (compose_subst (M.add x (TyVar y) (M.empty type)) p) | None => None end) | EqCons (TyVar x) (Arrow ty3 ty4) => if (member x (FTV ty3)) || (member x (FTV ty4)) then None else (match (unify (apply_subst_to_constr_list (M.add x (Arrow ty3 ty4) (M.empty type)) t) with Some p => Some (compose_subst (M.add x (Arrow ty3 ty4) (M.empty type)) p) | None => None end) | EqCons (Arrow ty3 ty4)(TyVar x) => if (member x (FTV ty3)) || (member x (FTV ty4)) then None else (match (unify (apply_subst_to_constr_list (M.add x (Arrow ty3 ty4) (M.empty type))t))Model withof MGU Axioms Kothari Caldwell (U. of Wyoming) A Machine-Checked
UNIF’09
17 / 31
First-order unification algorithm
Specification in Coq
First-order unification in Coq
Issues in formalization Raise exceptions, but that’s not possible. We choose an option type defined as: Inductive option (A : Set) : Set := Some (_ : A) | None.
Our specification of unification is general recursive – so Coq will require a termination criteria. Give a measure that reduces on each recursive call. Give a well-founded ordering, and ... Show that recursive call is lower in order w.r.t the above order (bunched together as proof obligations). Show that the ordering is well-founded.
Others ....
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
18 / 31
First-order unification algorithm
Termination
Termination
Lexicographic Ordering The lexicographic ordering (≺3 ) on the two triples hn1 , n2 , n3 i and hm1 , m2 , m3 i is defined as def
hn1 , n2 , n3 i ≺3 hm1 , m2 , m3 i = (n1 < m1 ) ∨ (n1 = m1 ∧ n2 < m2 ) ∨ (n1 = m1 ∧ n2 = m2 ∧ n3 < m3 ), where < and = are the ordinary less-than inequality and equality on natural numbers.
The Triple The triple is , where | CFVC | - the number of unique free variables in a constraint list; | C→ | - the total number of arrows in the constraint list; | C | - the length of the constraint list.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
19 / 31
First-order unification algorithm
Termination
Termination...contd
Original call c
(α=α) :: C c (α=α) :: C c (α=β) :: C c (α=τ ) :: C c (α=τ ) :: C c (τ =α) :: C c (τ =α) :: C (τ1 → τ2 c =τ3 → τ4 ) :: C
Recursive call
Conditions, if any
| CFVC |
| C→ |
|C |
C C {α 7→ β}C {α 7→ τ }C {α 7→ τ }C {α 7→ τ }C {α 7→ τ }C c (τ1 =τ3 ) c :: (τ2 =τ4 ) :: C
α ∈ (FVC C) α∈ / (FVC C) α 6= β α∈ / (FTV τ ) ∧ α α∈ / (FTV τ ) ∧ α α∈ / (FTV τ ) ∧ α α∈ / (FTV τ ) ∧ α None
↓ ↓ ↓ ↓ ↓ ↓ -
↓ ↑ ↓ ↑ ↓
↓ ↓ ↓ ↓ ↓ ↓ ↓ ↑
∈ / (FVC C) ∈ (FVC C) ∈ / (FVC C) ∈ (FVC C)
Table: Variation of termination measure components on the recursive call
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
20 / 31
Outline 1
Overview Type Reconstruction Algorithms
2
Introduction Substitution Coq
3
First-order unification algorithm Specification in Coq Termination
4
A model for MGU axioms Axiom iii Axiom iv
5
Conclusions and Future Work
A model for MGU axioms
Functional Induction in Coq
Requires an induction principle generated before.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
21 / 31
A model for MGU axioms
Functional Induction in Coq
Requires an induction principle generated before. functional induction (f x1 x2 x3 .. xn) is a short form for induction x1 x2 x3 ...xn f(x1 ... xn) using id, where id is the induction principle for f .
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
21 / 31
A model for MGU axioms
Functional Induction in Coq
Requires an induction principle generated before. functional induction (f x1 x2 x3 .. xn) is a short form for induction x1 x2 x3 ...xn f(x1 ... xn) using id, where id is the induction principle for f . functional induction (unify c) (unify c) using unif_ind.
induction c
Important first step in proof of the axioms.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
21 / 31
A model for MGU axioms
MGU axioms
Old Axioms (i) (ii) (iii) (iv )
Kothari Caldwell (U. of Wyoming)
c
mgu σ (τ1 =τ2 ) ⇒ σ(τ1 ) = σ(τ2 ) c mgu σ (τ1 =τ2 ) ∧ σ 0 (τ1 ) = σ 0 (τ2 ) ⇒ ∃δ.σ 0 ≈ σ ◦ δ c c mgu σ (τ1 =τ2 ) ⇒ FTVS (σ) ⊆ FVC (τ1 =τ2 ) c σ(τ1 ) = σ(τ2 ) ⇒ ∃σ 0 . mgu σ 0 (τ1 =τ2 )
A Machine-Checked Model of MGU Axioms
UNIF’09
22 / 31
A model for MGU axioms
MGU axioms
Old Axioms (i) (ii) (iii) (iv )
c
mgu σ (τ1 =τ2 ) ⇒ σ(τ1 ) = σ(τ2 ) c mgu σ (τ1 =τ2 ) ∧ σ 0 (τ1 ) = σ 0 (τ2 ) ⇒ ∃δ.σ 0 ≈ σ ◦ δ c c mgu σ (τ1 =τ2 ) ⇒ FTVS (σ) ⊆ FVC (τ1 =τ2 ) c σ(τ1 ) = σ(τ2 ) ⇒ ∃σ 0 . mgu σ 0 (τ1 =τ2 )
New Generalized Axioms (i) unify C = Some σ ⇒ σ |= C (ii) (unify C = Some σ ∧ σ 0 |= C) ⇒ ∃σ 00 . σ 0 ≈ σ ◦ σ 00 (iii) unify C = Some σ ⇒ FTVS(σ) ⊆ FVC (C) (iv ) σ |= C ⇒ ∃σ 0 . unify C = Some σ 0
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
22 / 31
A model for MGU axioms
Axiom iii
Axiom iii
Lemma 2 (Compose and domain membership) ∀x, y . ∀τ.∀σ. y ∈ dom_subst ({x 7→ τ } ◦ σ)) ⇒ y ∈ dom_subst {x 7→ τ } ∨ y ∈ dom_subst σ Lemma 3 (Compose and range membership) ∀x, y . ∀τ. ∀σ. (x ∈ / (FTV τ ) ∧ y ∈ range_subst ({x 7→ τ } ◦ σ)) ⇒ y ∈ range_subst {x 7→ τ } ∨ y ∈ range_subst σ
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
23 / 31
A model for MGU axioms
Axiom iii
Axiom iii ...contd
Lemma 4 (Subst range abstraction) ∀x. ∀σ. x ∈ range_subst (σ) ⇔ ∃y .y ∈ dom_subst (σ) ∧ x ∈ FTV (σ(TyVar y )) Theorem 5 ∀σ, σ 0 . ∀C. unify C = Some σ ⇒ FTVS(σ) ⊆ FVC(C) Proof. By functional induction on unify C and lemmas 2, 3.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
24 / 31
A model for MGU axioms
Axiom iv
Axiom iv Proper Subterms Definition subterms α subterms (τ1 → τ2 )
def
=
def
=
[] τ1 :: τ2 :: (subterms τ1 ) ++ (subterms τ2 )
Lemma 6 (Containment) ∀τ, τ 0 . τ ∈ (subterms τ 0 ) ⇒ ∀τ 00 . τ 00 ∈ (subterms τ ) ⇒ τ 00 ∈ (subterms τ 0 ) Proof. By induction on τ 0 . Lemma 7 (Well founded types) ∀τ. ¬ τ ∈ (subterms τ ) Proof. By induction on τ and by lemma 6. Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
25 / 31
A model for MGU axioms
Axiom iv
Axiom iv ... contd
Lemma 8 (Member subterms unequal) ∀τ, τ 0 . τ ∈ (subterms τ 0 ) ⇒ τ 6= τ 0 Proof. By case analysis on τ = τ 0 and by lemma 7. Lemma 9 (Member subterms and apply subst) ∀σ. ∀α. ∀τ. α ∈ (subterms τ ) ⇒ σ(α) 6= σ(τ ) Proof. By induction on τ and by lemma 8.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
26 / 31
A model for MGU axioms
Axiom iv
Axiom iv...contd Lemma 10 (Member arrow and subterms) ∀σ. ∀x. ∀τ1 , τ2 . member x (FTV τ1 ) = true ∨ member x (FTV τ2 ) = true ⇒ TyVar (x) ∈ subterms(τ1 → τ2 ) Proof. By induction on τ1 , followed by induction on τ2 . Corollary 11 (Member apply subst unequal) ∀σ. ∀x. ∀τ1 , τ2 . member x (FTV τ1 ) = true ∨ member x (FTV τ2 ) = true ⇒ σ(TyVar (x)) 6= σ(τ1 → τ2 ) Proof. By lemma 9 and 10. Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
27 / 31
A model for MGU axioms
Axiom iv
Axiom iv ... contd
Theorem 12 ∀σ. ∀C. σ |= C ⇒ ∃σ 0 . unify C = Some σ 0 Proof. By functional induction on unify C and lemma ?? and corollary 11.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
28 / 31
Outline 1
Overview Type Reconstruction Algorithms
2
Introduction Substitution Coq
3
First-order unification algorithm Specification in Coq Termination
4
A model for MGU axioms Axiom iii Axiom iv
5
Conclusions and Future Work
Conclusions and Future Work
Conclusions and Future Work
Some of the lemmas are more generalized version of the lemmas actually needed.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
29 / 31
Conclusions and Future Work
Conclusions and Future Work
Some of the lemmas are more generalized version of the lemmas actually needed. In many proofs we abstracted away from the actual construct or looked at its behavior.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
29 / 31
Conclusions and Future Work
Conclusions and Future Work
Some of the lemmas are more generalized version of the lemmas actually needed. In many proofs we abstracted away from the actual construct or looked at its behavior. The entire verification took almost 4400 lines of specification and tactics and is available online at http://www.cs.uwyo.edu/~skothari.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
29 / 31
Conclusions and Future Work
Conclusions and Future Work
Some of the lemmas are more generalized version of the lemmas actually needed. In many proofs we abstracted away from the actual construct or looked at its behavior. The entire verification took almost 4400 lines of specification and tactics and is available online at http://www.cs.uwyo.edu/~skothari. Many of the lemmas and theorems will be useful in our machine certified correctness proof of Wand’s algorithm.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
29 / 31
Conclusions and Future Work
Merci!!!!!
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
30 / 31
Conclusions and Future Work
Induction Principle unify_ind : forall P : list constr -> option (M.t type) -> Prop, (forall c : list constr, c = nil -> P nil (Some (M.empty type))) -> (forall (c : list constr) (h : constr) (t : list constr), c = h :: t -> forall x y : nat, h = EqCons (TyVar x) (TyVar y) -> forall _x : x = y, eq_dec_stamp x y = left (x y) _x -> P t (unify t) -> P (EqCons (TyVar x) (TyVar y) :: t) (unify t)) -> (forall (c : list constr) (h : constr) (t0 : list constr), c = h :: t0 -> forall x y : nat, h = EqCons (TyVar x) (TyVar y) -> forall _x : x y, eq_dec_stamp x y = right (x = y) _x -> P (apply_subst_to_constr_list (M.add x (TyVar y) (M.empty type)) t0) (unify (apply_subst_to_constr_list (M.add x (TyVar y) (M.empty type)) t0)) -> forall p : M.t type, unify (apply_subst_to_constr_list (M.add x (TyVar y) (M.empty type)) t0) = Some p -> P (EqCons (TyVar x) (TyVar y) :: t0) (Some (compose_subst (M.add x (TyVar y) (M.empty type)) p))) -> (forall (c : list constr) (h : constr) (t0 : list constr), c = h :: t0 -> forall x y : nat, h = EqCons (TyVar x) (TyVar y) -> forall _x : x y, eq_dec_stamp x y = right (x = y) _x -> Kothari Caldwell (U. of Wyoming) A Machine-Checked Model of MGU Axioms P (apply_subst_to_constr_list (M.add x (TyVar y) (M.empty type)) t0)
UNIF’09
31 / 31
Conclusions and Future Work
Catherine Dubois and Valerie M. Morain. Certification of a type inference tool for ml: Damas–milner within coq. J. Autom. Reason., 23(3):319–346, 1999. Bastiaan Heeren. Top Quality Type Error Messages. PhD thesis, Universitiet Utrecht, 2005. Mark P. Jones. Qualified Types: Theory and Practice. Distinguished Dissertations in Computer Science. Cambridge University Press, 1995. Dieter Nazareth and Tobias Nipkow. Theorem Proving in Higher Order Logics, volume 1125, chapter Formal Verification of Alg. W: The Monomorphic Case, pages 331–345. Springer Berlin / Heidelberg, 1996. Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
31 / 31
Conclusions and Future Work
Wolfgang Naraschewski and Tobias Nipkow. Type inference verified: Algorithm w in isabelle/hol. J. Autom. Reason., 23(3):299–318, 1999. Wolfgang Naraschewski and Tobias Nipkow. Type Inference Verified: Algorithm W in Isabelle/HOL. Journal of Automated Reasoning, 23(3-4):299–318, 1999. F. Pottier and D. Rémy. The essence of ML type inference. In Benjamin C. Pierce, editor, Advanced Topics in Types and Programming Languages, chapter 10, pages 389–489. MIT Press, 2005. Martin Sulzmann, Martin Odersky, and Martin Wehr. Type inference with constrained types. In Fourth International Workshop on Foundations of Object-Oriented Programming (FOOL 4), 1997. Christian Urban and Tobias Nipkow. Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
31 / 31
Conclusions and Future Work
From Semantics to Computer Science, chapter Nominal verification of algorithm W. Cambridge University Press, 2009. Mitchell Wand. A simple algorithm and proof for type inference. Fundamenta Informaticae, 10:115–122, 1987.
Kothari Caldwell (U. of Wyoming)
A Machine-Checked Model of MGU Axioms
UNIF’09
31 / 31