A Machine-Checked Model of MGU Axioms - Semantic Scholar

5 downloads 0 Views 300KB Size Report
Aug 2, 2009 - Axiom iii. Axiom iv. 5. Conclusions and Future Work. Kothari Caldwell (U. of Wyoming). A Machine-Checked Model of MGU Axioms. UNIF'09.
A Machine-Checked Model of MGU Axioms: Applications of Finite Maps and Functional Induction Presented by Sunil Kothari Joint work with Prof. James Caldwell Department of Computer Science, University of Wyoming, USA

23rd International Workshop on Unification August 2, 2009

Outline 1

Overview Type Reconstruction Algorithms

2

Introduction Substitution Coq

3

First-order unification algorithm Specification in Coq Termination

4

A model for MGU axioms Axiom iii Axiom iv

5

Conclusions and Future Work

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

2 / 31

Outline 1

Overview Type Reconstruction Algorithms

2

Introduction Substitution Coq

3

First-order unification algorithm Specification in Coq Termination

4

A model for MGU axioms Axiom iii Axiom iv

5

Conclusions and Future Work

Overview

Type Reconstruction Algorithms

Highlights

Essential feature of many functional programming languages (ML, Haskell, OCaml, etc.).

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

3 / 31

Overview

Type Reconstruction Algorithms

Highlights

Essential feature of many functional programming languages (ML, Haskell, OCaml, etc.). Automated type reconstruction is possible.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

3 / 31

Overview

Type Reconstruction Algorithms

Highlights

Essential feature of many functional programming languages (ML, Haskell, OCaml, etc.). Automated type reconstruction is possible. Substitution-based algorithms. Intermittent constraint generation and constraint solving.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

3 / 31

Overview

Type Reconstruction Algorithms

Highlights

Essential feature of many functional programming languages (ML, Haskell, OCaml, etc.). Automated type reconstruction is possible. Substitution-based algorithms. Intermittent constraint generation and constraint solving.

Constraint-based algorithms. Two distinct phases: constraint generation and constraint solving.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

3 / 31

Overview

Type Reconstruction Algorithms

Type Reconstruction Algorithms...contd

Substitution-based Algorithm W, J by Milner, 1978. Algorithm M by Leroy, 1993.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

4 / 31

Overview

Type Reconstruction Algorithms

Type Reconstruction Algorithms...contd

Substitution-based Algorithm W, J by Milner, 1978. Algorithm M by Leroy, 1993. Constraint-based Frameworks/Algorithms Wand’s algorithm [Wan87]. Qualified types [Jon95]. HM(X) [SOW97] by Sulzmann et al. 1999, Pottier and Rémy 2005 [PR05]. Top quality error messages [Hee05].

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

4 / 31

Overview

Type Reconstruction Algorithms

Type Reconstruction Algorithms... Contd

Machine-Certified Correctness Proof Algorithm W in Coq, Isabelle/HOL [DM99, NN99a, NN99b, NN96].

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

5 / 31

Overview

Type Reconstruction Algorithms

Type Reconstruction Algorithms... Contd

Machine-Certified Correctness Proof Algorithm W in Coq, Isabelle/HOL [DM99, NN99a, NN99b, NN96]. Nominal verification of Algorithm W [UN09].

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

5 / 31

Overview

Type Reconstruction Algorithms

Type Reconstruction Algorithms... Contd

Machine-Certified Correctness Proof Algorithm W in Coq, Isabelle/HOL [DM99, NN99a, NN99b, NN96]. Nominal verification of Algorithm W [UN09]. We want to formalize multi-phase unification algorithm needed to handle polymorphic let.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

5 / 31

Overview

Type Reconstruction Algorithms

Type Reconstruction Algorithms... Contd

Machine-Certified Correctness Proof Algorithm W in Coq, Isabelle/HOL [DM99, NN99a, NN99b, NN96]. Nominal verification of Algorithm W [UN09]. We want to formalize multi-phase unification algorithm needed to handle polymorphic let. POPLMark challenge also aims at mechanizing meta-theory.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

5 / 31

Overview

Type Reconstruction Algorithms

Type Reconstruction Algorithms... Contd

Modeling MGU The most general unifier (MGU) is often a first-order unification algorithm over simple type terms.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

6 / 31

Overview

Type Reconstruction Algorithms

Type Reconstruction Algorithms... Contd

Modeling MGU The most general unifier (MGU) is often a first-order unification algorithm over simple type terms. In machine checked correctness proofs, the MGU is modeled as a set of four axioms: (i) (ii) (iii) (iv )

c

mgu σ (τ1 =τ2 ) ⇒ σ(τ1 ) = σ(τ2 ) c mgu σ (τ1 =τ2 ) ∧ σ 0 (τ1 ) = σ 0 (τ2 ) ⇒ ∃σ 00 .σ 0 ≈ σ ◦ σ 00 c c mgu σ (τ1 =τ2 ) ⇒ FTVS (σ) ⊆ FVC (τ1 =τ2 ) c σ(τ1 ) = σ(τ2 ) ⇒ ∃σ 0 . mgu σ 0 (τ1 =τ2 )

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

6 / 31

Outline 1

Overview Type Reconstruction Algorithms

2

Introduction Substitution Coq

3

First-order unification algorithm Specification in Coq Termination

4

A model for MGU axioms Axiom iii Axiom iv

5

Conclusions and Future Work

Introduction

Terms and Constraint Syntax

Terms τ ::= TyVar(x) | τ 0 → τ 00

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

7 / 31

Introduction

Terms and Constraint Syntax

Terms τ ::= TyVar(x) | τ 0 → τ 00 Atomic types (of the form TyVar x) are denoted by α, β, α0 etc.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

7 / 31

Introduction

Terms and Constraint Syntax

Terms τ ::= TyVar(x) | τ 0 → τ 00 Atomic types (of the form TyVar x) are denoted by α, β, α0 etc. Constraints c

Constraint are of the form τ =τ 0 .

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

7 / 31

Introduction

Terms and Constraint Syntax

Terms τ ::= TyVar(x) | τ 0 → τ 00 Atomic types (of the form TyVar x) are denoted by α, β, α0 etc. Constraints c

Constraint are of the form τ =τ 0 . A list of constraint is given as: c

C ::= [ ] | τ =τ 0 :: C0

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

7 / 31

Introduction

FTV and FVC

Free type variable (FTV) FTV (TyVar x) 0

FTV (τ → τ )

def

=

[x]

def

FTV (τ ) ++ FTV (τ 0 )

=

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

8 / 31

Introduction

FTV and FVC

Free type variable (FTV) FTV (TyVar x) 0

FTV (τ → τ )

def

=

[x]

def

FTV (τ ) ++ FTV (τ 0 )

=

Free variables of a constraint list (FVC) def

FVC [ ]

=

c

FVC ((τ1 =τ2 ) :: C)

Kothari Caldwell (U. of Wyoming)

def

=

[] FTV (τ1 ) ++ FTV (τ2 ) ++ FVC (C)

A Machine-Checked Model of MGU Axioms

UNIF’09

8 / 31

Introduction

Substitution

Substitution

Related Concepts A substitution (denoted by ρ) maps type variables to types.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

9 / 31

Introduction

Substitution

Substitution

Related Concepts A substitution (denoted by ρ) maps type variables to types. Denoted by σ, σ 0 , σ1 etc.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

9 / 31

Introduction

Substitution

Substitution

Related Concepts A substitution (denoted by ρ) maps type variables to types. Denoted by σ, σ 0 , σ1 etc. Substitution application to a type τ is defined as: σ (TyVar(x)) σ (τ1 → τ2 )

Kothari Caldwell (U. of Wyoming)

def

=

if hx, τ i ∈ σ then τ else TyVar(x)

def

σ(τ1 ) → σ(τ2 )

=

A Machine-Checked Model of MGU Axioms

UNIF’09

9 / 31

Introduction

Substitution

Substitution

Related Concepts A substitution (denoted by ρ) maps type variables to types. Denoted by σ, σ 0 , σ1 etc. Substitution application to a type τ is defined as: σ (TyVar(x)) σ (τ1 → τ2 )

def

=

if hx, τ i ∈ σ then τ else TyVar(x)

def

σ(τ1 ) → σ(τ2 )

=

Application of a substitution to a constraint is defined similarly: c

def

c

σ(τ1 =τ2 ) = σ(τ1 )=σ(τ2 )

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

9 / 31

Introduction

Substitution

Substitution

Substitution Composition Substitution composition definition using Coq’s finite maps is complicated. But the following theorem holds Theorem 1 (Composition apply) ∀σ, σ 0 .∀τ.(σ ◦ σ 0 )τ = σ 0 (σ(τ ))

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

10 / 31

Introduction

Substitution

Substitution

Substitution Composition Substitution composition definition using Coq’s finite maps is complicated. But the following theorem holds Theorem 1 (Composition apply) ∀σ, σ 0 .∀τ.(σ ◦ σ 0 )τ = σ 0 (σ(τ ))

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

10 / 31

Introduction

Substitution

Substitution

Substitution Composition Substitution composition definition using Coq’s finite maps is complicated. But the following theorem holds Theorem 1 (Composition apply) ∀σ, σ 0 .∀τ.(σ ◦ σ 0 )τ = σ 0 (σ(τ )) Extensional equality Substitutions are equal if they behave the same on all type variables. def

σ ≈ σ 0 = ∀α. σ(α) = σ 0 (α)

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

10 / 31

Introduction

Substitution

Unifiers and MGUs

Unifier c

We write σ |= (τ1 =τ2 ), if σ(τ1 ) = σ(τ2 ). def

σ |= C = ∀c ∈ C, σ |= c.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

11 / 31

Introduction

Substitution

Unifiers and MGUs

Unifier c

We write σ |= (τ1 =τ2 ), if σ(τ1 ) = σ(τ2 ). def

σ |= C = ∀c ∈ C, σ |= c. Most General Unifier A unifier σ is the most general unifier(MGU) if for any other unifier σ 00 there is a substitution σ 0 such that σ ◦ σ 0 ≈ σ 00 .

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

11 / 31

Introduction

Coq

Coq

Overview Based on the Calculus of Constructions.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

12 / 31

Introduction

Coq

Coq

Overview Based on the Calculus of Constructions. System F extended with dependent types.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

12 / 31

Introduction

Coq

Coq

Overview Based on the Calculus of Constructions. System F extended with dependent types. Support for inductive datatypes.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

12 / 31

Introduction

Coq

Coq

Overview Based on the Calculus of Constructions. System F extended with dependent types. Support for inductive datatypes. Programs can be extracted from proofs.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

12 / 31

Introduction

Coq

Coq

Overview Based on the Calculus of Constructions. System F extended with dependent types. Support for inductive datatypes. Programs can be extracted from proofs. Lots of libraries.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

12 / 31

Introduction

Coq

Finite maps in Coq

Representing substitutions Substitution represented as a list of pairs, set of pairs, and normal function. We represent a substitution as a finite function.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

13 / 31

Introduction

Coq

Finite maps in Coq

Representing substitutions Substitution represented as a list of pairs, set of pairs, and normal function. We represent a substitution as a finite function. Substitution as finite map Used the Coq’s finite maps library Coq.FSets.FMapInterface. Axiomatic presentation. Provides no induction principle. Forward reasoning is often required.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

13 / 31

Introduction

Coq

Substitution Related Concepts in Coq

Domain def

dom_subst(σ) = List.map (λt.fst (t)) (M.elements( σ))

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

14 / 31

Introduction

Coq

Substitution Related Concepts in Coq

Domain def

dom_subst(σ) = List.map (λt.fst (t)) (M.elements( σ)) Range def

range_subst(σ) = List.flat_map (λt.FTV (snd (t))) (M.elements( σ))

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

14 / 31

Introduction

Coq

Substitution Related Concepts in Coq

Domain def

dom_subst(σ) = List.map (λt.fst (t)) (M.elements( σ)) Range def

range_subst(σ) = List.flat_map (λt.FTV (snd (t))) (M.elements( σ))

FTVS def

FTVS(σ) = dom_subst(σ) ++ range_subst(σ)

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

14 / 31

Outline 1

Overview Type Reconstruction Algorithms

2

Introduction Substitution Coq

3

First-order unification algorithm Specification in Coq Termination

4

A model for MGU axioms Axiom iii Axiom iv

5

Conclusions and Future Work

First-order unification algorithm

Specification in Coq

Unification

The Algorithm c

def

c

def

c

def

c

def

unify (α=α) :: C unify (α=β) :: C unify (α=τ ) :: C

unify (τ =α) :: C

= unify C = {α 7→ β} ◦ unify ({α 7→ β}C)

= if α occurs in τ then Fail else {α 7→ τ } ◦ unify ({α 7→ τ }C)

=

c

unify (α=τ ) :: C

def

c

c

unify (τ1 → τ2 = unify (τ1 =τ3 :: τ2 =τ4 :: C) c =τ3 → τ4 ) :: C unify [ ]

def

= Id

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

15 / 31

First-order unification algorithm

Specification in Coq

Unification

The Algorithm c

def

c

def

c

def

c

def

unify (α=α) :: C unify (α=β) :: C unify (α=τ ) :: C

unify (τ =α) :: C

= unify C = {α 7→ β} ◦ unify ({α 7→ β}C)

= if α occurs in τ then Fail else {α 7→ τ } ◦ unify ({α 7→ τ }C)

= if α occurs in τ then Fail else {α 7→ τ } ◦ unify ({α 7→ τ }C)

def

c

c

unify (τ1 → τ2 = unify (τ1 =τ3 :: τ2 =τ4 :: C) c =τ3 → τ4 ) :: C unify [ ]

def

= Id

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

16 / 31

First-order unification algorithm

Specification in Coq

Specification in Coq Function unify (c:list constr){wf meaPairMLt} :(option (M.t type)) := match c with nil => Some (M.empty type) | h::t => (match h with EqCons (TyVar x) (TyVar y) => if eq_dec_stamp x y then unify t else (match unify (apply_subst_to_constr_list (M.add x (TyVar y) (M.empty type)) t) with Some p => Some (compose_subst (M.add x (TyVar y) (M.empty type)) p) | None => None end) | EqCons (TyVar x) (Arrow ty3 ty4) => if (member x (FTV ty3)) || (member x (FTV ty4)) then None else (match (unify (apply_subst_to_constr_list (M.add x (Arrow ty3 ty4) (M.empty type)) t) with Some p => Some (compose_subst (M.add x (Arrow ty3 ty4) (M.empty type)) p) | None => None end) | EqCons (Arrow ty3 ty4)(TyVar x) => if (member x (FTV ty3)) || (member x (FTV ty4)) then None else (match (unify (apply_subst_to_constr_list (M.add x (Arrow ty3 ty4) (M.empty type))t))Model withof MGU Axioms Kothari Caldwell (U. of Wyoming) A Machine-Checked

UNIF’09

17 / 31

First-order unification algorithm

Specification in Coq

First-order unification in Coq

Issues in formalization Raise exceptions, but that’s not possible. We choose an option type defined as: Inductive option (A : Set) : Set := Some (_ : A) | None.

Our specification of unification is general recursive – so Coq will require a termination criteria. Give a measure that reduces on each recursive call. Give a well-founded ordering, and ... Show that recursive call is lower in order w.r.t the above order (bunched together as proof obligations). Show that the ordering is well-founded.

Others ....

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

18 / 31

First-order unification algorithm

Termination

Termination

Lexicographic Ordering The lexicographic ordering (≺3 ) on the two triples hn1 , n2 , n3 i and hm1 , m2 , m3 i is defined as def

hn1 , n2 , n3 i ≺3 hm1 , m2 , m3 i = (n1 < m1 ) ∨ (n1 = m1 ∧ n2 < m2 ) ∨ (n1 = m1 ∧ n2 = m2 ∧ n3 < m3 ), where < and = are the ordinary less-than inequality and equality on natural numbers.

The Triple The triple is , where | CFVC | - the number of unique free variables in a constraint list; | C→ | - the total number of arrows in the constraint list; | C | - the length of the constraint list.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

19 / 31

First-order unification algorithm

Termination

Termination...contd

Original call c

(α=α) :: C c (α=α) :: C c (α=β) :: C c (α=τ ) :: C c (α=τ ) :: C c (τ =α) :: C c (τ =α) :: C (τ1 → τ2 c =τ3 → τ4 ) :: C

Recursive call

Conditions, if any

| CFVC |

| C→ |

|C |

C C {α 7→ β}C {α 7→ τ }C {α 7→ τ }C {α 7→ τ }C {α 7→ τ }C c (τ1 =τ3 ) c :: (τ2 =τ4 ) :: C

α ∈ (FVC C) α∈ / (FVC C) α 6= β α∈ / (FTV τ ) ∧ α α∈ / (FTV τ ) ∧ α α∈ / (FTV τ ) ∧ α α∈ / (FTV τ ) ∧ α None

↓ ↓ ↓ ↓ ↓ ↓ -

↓ ↑ ↓ ↑ ↓

↓ ↓ ↓ ↓ ↓ ↓ ↓ ↑

∈ / (FVC C) ∈ (FVC C) ∈ / (FVC C) ∈ (FVC C)

Table: Variation of termination measure components on the recursive call

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

20 / 31

Outline 1

Overview Type Reconstruction Algorithms

2

Introduction Substitution Coq

3

First-order unification algorithm Specification in Coq Termination

4

A model for MGU axioms Axiom iii Axiom iv

5

Conclusions and Future Work

A model for MGU axioms

Functional Induction in Coq

Requires an induction principle generated before.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

21 / 31

A model for MGU axioms

Functional Induction in Coq

Requires an induction principle generated before. functional induction (f x1 x2 x3 .. xn) is a short form for induction x1 x2 x3 ...xn f(x1 ... xn) using id, where id is the induction principle for f .

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

21 / 31

A model for MGU axioms

Functional Induction in Coq

Requires an induction principle generated before. functional induction (f x1 x2 x3 .. xn) is a short form for induction x1 x2 x3 ...xn f(x1 ... xn) using id, where id is the induction principle for f . functional induction (unify c) (unify c) using unif_ind.

induction c

Important first step in proof of the axioms.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

21 / 31

A model for MGU axioms

MGU axioms

Old Axioms (i) (ii) (iii) (iv )

Kothari Caldwell (U. of Wyoming)

c

mgu σ (τ1 =τ2 ) ⇒ σ(τ1 ) = σ(τ2 ) c mgu σ (τ1 =τ2 ) ∧ σ 0 (τ1 ) = σ 0 (τ2 ) ⇒ ∃δ.σ 0 ≈ σ ◦ δ c c mgu σ (τ1 =τ2 ) ⇒ FTVS (σ) ⊆ FVC (τ1 =τ2 ) c σ(τ1 ) = σ(τ2 ) ⇒ ∃σ 0 . mgu σ 0 (τ1 =τ2 )

A Machine-Checked Model of MGU Axioms

UNIF’09

22 / 31

A model for MGU axioms

MGU axioms

Old Axioms (i) (ii) (iii) (iv )

c

mgu σ (τ1 =τ2 ) ⇒ σ(τ1 ) = σ(τ2 ) c mgu σ (τ1 =τ2 ) ∧ σ 0 (τ1 ) = σ 0 (τ2 ) ⇒ ∃δ.σ 0 ≈ σ ◦ δ c c mgu σ (τ1 =τ2 ) ⇒ FTVS (σ) ⊆ FVC (τ1 =τ2 ) c σ(τ1 ) = σ(τ2 ) ⇒ ∃σ 0 . mgu σ 0 (τ1 =τ2 )

New Generalized Axioms (i) unify C = Some σ ⇒ σ |= C (ii) (unify C = Some σ ∧ σ 0 |= C) ⇒ ∃σ 00 . σ 0 ≈ σ ◦ σ 00 (iii) unify C = Some σ ⇒ FTVS(σ) ⊆ FVC (C) (iv ) σ |= C ⇒ ∃σ 0 . unify C = Some σ 0

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

22 / 31

A model for MGU axioms

Axiom iii

Axiom iii

Lemma 2 (Compose and domain membership) ∀x, y . ∀τ.∀σ. y ∈ dom_subst ({x 7→ τ } ◦ σ)) ⇒ y ∈ dom_subst {x 7→ τ } ∨ y ∈ dom_subst σ Lemma 3 (Compose and range membership) ∀x, y . ∀τ. ∀σ. (x ∈ / (FTV τ ) ∧ y ∈ range_subst ({x 7→ τ } ◦ σ)) ⇒ y ∈ range_subst {x 7→ τ } ∨ y ∈ range_subst σ

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

23 / 31

A model for MGU axioms

Axiom iii

Axiom iii ...contd

Lemma 4 (Subst range abstraction) ∀x. ∀σ. x ∈ range_subst (σ) ⇔ ∃y .y ∈ dom_subst (σ) ∧ x ∈ FTV (σ(TyVar y )) Theorem 5 ∀σ, σ 0 . ∀C. unify C = Some σ ⇒ FTVS(σ) ⊆ FVC(C) Proof. By functional induction on unify C and lemmas 2, 3.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

24 / 31

A model for MGU axioms

Axiom iv

Axiom iv Proper Subterms Definition subterms α subterms (τ1 → τ2 )

def

=

def

=

[] τ1 :: τ2 :: (subterms τ1 ) ++ (subterms τ2 )

Lemma 6 (Containment) ∀τ, τ 0 . τ ∈ (subterms τ 0 ) ⇒ ∀τ 00 . τ 00 ∈ (subterms τ ) ⇒ τ 00 ∈ (subterms τ 0 ) Proof. By induction on τ 0 . Lemma 7 (Well founded types) ∀τ. ¬ τ ∈ (subterms τ ) Proof. By induction on τ and by lemma 6. Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

25 / 31

A model for MGU axioms

Axiom iv

Axiom iv ... contd

Lemma 8 (Member subterms unequal) ∀τ, τ 0 . τ ∈ (subterms τ 0 ) ⇒ τ 6= τ 0 Proof. By case analysis on τ = τ 0 and by lemma 7. Lemma 9 (Member subterms and apply subst) ∀σ. ∀α. ∀τ. α ∈ (subterms τ ) ⇒ σ(α) 6= σ(τ ) Proof. By induction on τ and by lemma 8.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

26 / 31

A model for MGU axioms

Axiom iv

Axiom iv...contd Lemma 10 (Member arrow and subterms) ∀σ. ∀x. ∀τ1 , τ2 . member x (FTV τ1 ) = true ∨ member x (FTV τ2 ) = true ⇒ TyVar (x) ∈ subterms(τ1 → τ2 ) Proof. By induction on τ1 , followed by induction on τ2 . Corollary 11 (Member apply subst unequal) ∀σ. ∀x. ∀τ1 , τ2 . member x (FTV τ1 ) = true ∨ member x (FTV τ2 ) = true ⇒ σ(TyVar (x)) 6= σ(τ1 → τ2 ) Proof. By lemma 9 and 10. Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

27 / 31

A model for MGU axioms

Axiom iv

Axiom iv ... contd

Theorem 12 ∀σ. ∀C. σ |= C ⇒ ∃σ 0 . unify C = Some σ 0 Proof. By functional induction on unify C and lemma ?? and corollary 11.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

28 / 31

Outline 1

Overview Type Reconstruction Algorithms

2

Introduction Substitution Coq

3

First-order unification algorithm Specification in Coq Termination

4

A model for MGU axioms Axiom iii Axiom iv

5

Conclusions and Future Work

Conclusions and Future Work

Conclusions and Future Work

Some of the lemmas are more generalized version of the lemmas actually needed.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

29 / 31

Conclusions and Future Work

Conclusions and Future Work

Some of the lemmas are more generalized version of the lemmas actually needed. In many proofs we abstracted away from the actual construct or looked at its behavior.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

29 / 31

Conclusions and Future Work

Conclusions and Future Work

Some of the lemmas are more generalized version of the lemmas actually needed. In many proofs we abstracted away from the actual construct or looked at its behavior. The entire verification took almost 4400 lines of specification and tactics and is available online at http://www.cs.uwyo.edu/~skothari.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

29 / 31

Conclusions and Future Work

Conclusions and Future Work

Some of the lemmas are more generalized version of the lemmas actually needed. In many proofs we abstracted away from the actual construct or looked at its behavior. The entire verification took almost 4400 lines of specification and tactics and is available online at http://www.cs.uwyo.edu/~skothari. Many of the lemmas and theorems will be useful in our machine certified correctness proof of Wand’s algorithm.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

29 / 31

Conclusions and Future Work

Merci!!!!!

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

30 / 31

Conclusions and Future Work

Induction Principle unify_ind : forall P : list constr -> option (M.t type) -> Prop, (forall c : list constr, c = nil -> P nil (Some (M.empty type))) -> (forall (c : list constr) (h : constr) (t : list constr), c = h :: t -> forall x y : nat, h = EqCons (TyVar x) (TyVar y) -> forall _x : x = y, eq_dec_stamp x y = left (x y) _x -> P t (unify t) -> P (EqCons (TyVar x) (TyVar y) :: t) (unify t)) -> (forall (c : list constr) (h : constr) (t0 : list constr), c = h :: t0 -> forall x y : nat, h = EqCons (TyVar x) (TyVar y) -> forall _x : x y, eq_dec_stamp x y = right (x = y) _x -> P (apply_subst_to_constr_list (M.add x (TyVar y) (M.empty type)) t0) (unify (apply_subst_to_constr_list (M.add x (TyVar y) (M.empty type)) t0)) -> forall p : M.t type, unify (apply_subst_to_constr_list (M.add x (TyVar y) (M.empty type)) t0) = Some p -> P (EqCons (TyVar x) (TyVar y) :: t0) (Some (compose_subst (M.add x (TyVar y) (M.empty type)) p))) -> (forall (c : list constr) (h : constr) (t0 : list constr), c = h :: t0 -> forall x y : nat, h = EqCons (TyVar x) (TyVar y) -> forall _x : x y, eq_dec_stamp x y = right (x = y) _x -> Kothari Caldwell (U. of Wyoming) A Machine-Checked Model of MGU Axioms P (apply_subst_to_constr_list (M.add x (TyVar y) (M.empty type)) t0)

UNIF’09

31 / 31

Conclusions and Future Work

Catherine Dubois and Valerie M. Morain. Certification of a type inference tool for ml: Damas–milner within coq. J. Autom. Reason., 23(3):319–346, 1999. Bastiaan Heeren. Top Quality Type Error Messages. PhD thesis, Universitiet Utrecht, 2005. Mark P. Jones. Qualified Types: Theory and Practice. Distinguished Dissertations in Computer Science. Cambridge University Press, 1995. Dieter Nazareth and Tobias Nipkow. Theorem Proving in Higher Order Logics, volume 1125, chapter Formal Verification of Alg. W: The Monomorphic Case, pages 331–345. Springer Berlin / Heidelberg, 1996. Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

31 / 31

Conclusions and Future Work

Wolfgang Naraschewski and Tobias Nipkow. Type inference verified: Algorithm w in isabelle/hol. J. Autom. Reason., 23(3):299–318, 1999. Wolfgang Naraschewski and Tobias Nipkow. Type Inference Verified: Algorithm W in Isabelle/HOL. Journal of Automated Reasoning, 23(3-4):299–318, 1999. F. Pottier and D. Rémy. The essence of ML type inference. In Benjamin C. Pierce, editor, Advanced Topics in Types and Programming Languages, chapter 10, pages 389–489. MIT Press, 2005. Martin Sulzmann, Martin Odersky, and Martin Wehr. Type inference with constrained types. In Fourth International Workshop on Foundations of Object-Oriented Programming (FOOL 4), 1997. Christian Urban and Tobias Nipkow. Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

31 / 31

Conclusions and Future Work

From Semantics to Computer Science, chapter Nominal verification of algorithm W. Cambridge University Press, 2009. Mitchell Wand. A simple algorithm and proof for type inference. Fundamenta Informaticae, 10:115–122, 1987.

Kothari Caldwell (U. of Wyoming)

A Machine-Checked Model of MGU Axioms

UNIF’09

31 / 31