Bind Induction : Extracting Monadic Programs from Proofs

Lecture Notes in Computer Science, 2005

We discuss methods for dealing effectively with let-bindings in proofs. Our contribution is a small set of unconditional rewrite rules, found by the bracket abstraction translation from the λ-calculus to combinators. This approach copes with the usual HOL encodings of paired abstraction, ensures that bound variable names are preserved, and uses only conventional simplification technology.

ENTCS, 2006

This paper presents an emacs interface for an interactive editor for proofs and programs. The interface allows for editing proofs in the same way as we write programs, but in addition offers commands that help term construction. It differs from most other proof editors for its support for direct construction of terms rather than tactics for building them.

2004

Abstract: Type classes are a widely adopted means of abstraction for overloading in functional programming languages. Although operating on different types, in general all instances of a class implement equivalent operations and hence have properties in common. Using formal reasoning, such a property can be proven by showing it holds for all instance definitions. This is not straightforward, however, because when instance definitions depend on each other, so will the proofs.

Proceedings of the ACM SIGPLAN International Conference on Functional Programming, ICFP, 2013

Effective support for custom proof automation is essential for largescale interactive proof development. However, existing languages for automation via tactics either (a) provide no way to specify the behavior of tactics within the base logic of the accompanying theorem prover, or (b) rely on advanced type-theoretic machinery that is not easily integrated into established theorem provers. We present Mtac, a lightweight but powerful extension to Coq that supports dependently-typed tactic programming. Mtac tactics have access to all the features of ordinary Coq programming, as well as a new set of typed tactical primitives. We avoid the need to touch the trusted kernel typechecker of Coq by encapsulating uses of these new tactical primitives in a monad, and instrumenting Coq so that it executes monadic tactics during type inference.

Formal software engineering methodologies provide a vast array of languages for specifying correctness properties and associated tools for property verification. Unfortunately, the implementation of each verification tool requires an early commitment to a particular methodology and language, in terms of both high-level semantic concerns and low-level syntactic representation of properties and proofs. In this paper, we present Prufrock, a novel approach to constructing automated reasoning systems, which abstracts semantic concerns over entire classes of potential object languages. Prufrock is a modular, generic prover framework written in Haskell taking advantage of its type class system. It consists of a set of independent logic modules defining the semantics required for proof over entire classes of abstract syntaxes using generic programming techniques. The fundamental contribution of Prufrock is that any object language may be used for specifying and verifying properties, as long as it provides a semantics consistent with the logic modules required for a proof. The implementation details of the reasoning system thus remain independent from the structure of the specification language. This facilitates large-scale reuse of logics as well as tacticals and proofs themselves when constructing or retargeting automated reasoning tools. At the same time, Prufrock aids in closing the gap between an object language and verification of objects written in it by operating on its abstract syntax directly rather than transforming it into a separate theorem proving language. * This material is based upon work supported by the United States National Science Foundation under Grant Nos. 0209193 and 0350425 † This work was completed while a student in the System-Level Design Group at The University of Kansas properties, and axioms used in the verification process. Inference and proof are carried out by manipulating this syntax in a logically sound fashion. Unfortunately, this approach can be a serious hindrance to modularity and reuse due to the tight coupling between abstract syntax and the proof techniques used to manipulate it.

2019

We describe the breadth-first traversal algorithm by Martin Hofmann that uses a non-strictly positive data type and carry out a simple verification in an extensional setting. Termination is shown by implementing the algorithm in the strongly normalising extension of system F by Mendler-style recursion. We then analyze the same algorithm by alternative verifications first in an intensional setting using a non-strictly positive inductive definition (not just a non-strictly positive data type), and subsequently by two different algebraic reductions. The verification approaches are compared in terms of notions of simulation and should elucidate the somewhat mysterious algorithm and thus make a case for other uses of non-strictly positive data types. Except for the termination proof, which cannot be formalised in Coq, all proofs were formalised in Coq and some of the algorithms were implemented in Agda and Haskell. 2012 ACM Subject Classification Theory of computation → Logic and verific...

2005

Current formal software engineering methodologies provide a vast array of languages for specifying correctness properties, as well as a wide assortment automated tools that aid in the verification of specified properties. Unfortunately, the implementation of each such tool requires an early commitment to a particular methodology and language, in terms of both high-level semantic concerns and the lower-level syntactic representations of properties and proofs. In this paper, we present Prufrock, a novel approach to automated reasoning systems, which abstracts semantic concerns over entire classes of potential implementation languages. Prufrock is a modular prover framework written in the Haskell programming language. It consists of a set of largely independent logic modules, which define the semantics required for proof over entire classes of abstract syntaxes, using polytypic programming techniques. Any given representation language may be used for specifying and verifying properties in Prufrock, so long as it provides a semantics consistent with the logic modules that required for a proof. The implementation details of the reasoning system thus remain independent of the structure specification language, facilitating large-scale reuse in the construction of automated reasoning tools. At the same time, Prufrock aids in closing the gap between actual source-level implementation and the formal specification and verification of correctness properties. This paper provides an overview of the major design philosophy behind Prufrock, as well as a brief description of the polytypic techniques that make its implementation possible.

Proceedings of the 9th International Symposium on Haskell, 2016

We present a small extension to Haskell called the Key monad. With the Key monad, unique keys of different types can be created and can be tested for equality. When two keys are equal, we also obtain a concrete proof that their types are equal. This gives us a form of dynamic typing, without the need for Typeable constraints. We show that our extension allows us to safely do things we could not otherwise do: it allows us to implement the ST monad (inefficiently), to implement an embedded form of arrow notation, and to translate parametric HOAS to typed de Bruijn indices, among others. Although strongly related to the ST monad, the Key monad is simpler and might be easier to prove safe. We do not provide such a proof of the safety of the Key monad, but we note that, surprisingly, a full proof of the safety of the ST monad also remains elusive to this day. Hence, another reason for studying the Key monad is that a safety proof for it might be a stepping stone towards a safety proof of the ST monad.

Journal of Pure and Applied Algebra, 2002

We give an explicit description of the free completion EM(K) of a 2-category K under the Eilenberg-Moore construction, and show that this has the same underlying category as the 2-category Mnd(K) of monads in K. We then demonstrate that much of the formal theory of monads can be deduced using only the universal property of this completion, provided that one is willing to work with EM(K) as the 2-category of monads rather than Mnd(K). We also introduce the wreaths in K; these are the objects of EM(EM(K)), and are to be thought of as generalized distributive laws. We study these wreaths, and give examples to show how they arise in a variety of contexts.

ACM SIGPLAN Notices, 2017

While type soundness proofs are taught in every graduate PL class, the gap between realistic languages and what is accessible to formal proofs is large. In the case of Scala, it has been shown that its formal model, the Dependent Object Types (DOT) calculus, cannot simultaneously support key metatheoretic properties such as environment narrowing and subtyping transitivity, which are usually required for a type soundness proof. Moreover, Scala and many other realistic languages lack a general substitution property. The first contribution of this paper is to demonstrate how type soundness proofs for advanced, polymorphic, type systems can be carried out with an operational semantics based on high-level, definitional interpreters, implemented in Coq. We present the first mechanized soundness proofs in this style for System F and several extensions, including mutable references. Our proofs use only straightforward induction, which is significant, as the combination of big-step semantics...