A Saucerful of Proofs in Coq Olivier Danvy Department of Computer - - PowerPoint PPT Presentation

▶
a saucerful of proofs in coq
SMART_READER_LITE
LIVE PREVIEW

A Saucerful of Proofs in Coq Olivier Danvy Department of Computer - - PowerPoint PPT Presentation

Jun 28, 2023 109 likes •720 views

A Saucerful of Proofs in Coq Olivier Danvy Department of Computer Science Aarhus University danvy@cs.au.dk Annapolis, Maryland 8 November 2012 Olivier Danvy, 2.8, Annapolis November 8, 2012 1 / 40 Summing the first odd numbers The

slide-1
SLIDE 1

A Saucerful of Proofs in Coq

Olivier Danvy Department of Computer Science Aarhus University

danvy@cs.au.dk

Annapolis, Maryland 8 November 2012

Olivier Danvy, 2.8, Annapolis – November 8, 2012 1 / 40

slide-2
SLIDE 2

Summing the first odd numbers

The stream of odd natural numbers:

1, 3, 5, 7, 9, 11, 13, 15, ...

Olivier Danvy, 2.8, Annapolis – November 8, 2012 2 / 40

slide-3
SLIDE 3

Summing the first odd numbers

The stream of odd natural numbers:

1, 3, 5, 7, 9, 11, 13, 15, ...

The corresponding stream of partial sums:

1,

Olivier Danvy, 2.8, Annapolis – November 8, 2012 2 / 40

slide-4
SLIDE 4

Summing the first odd numbers

The stream of odd natural numbers:

1, 3, 5, 7, 9, 11, 13, 15, ...

The corresponding stream of partial sums:

1, 4,

Olivier Danvy, 2.8, Annapolis – November 8, 2012 2 / 40

slide-5
SLIDE 5

Summing the first odd numbers

The stream of odd natural numbers:

1, 3, 5, 7, 9, 11, 13, 15, ...

The corresponding stream of partial sums:

1, 4, 9,

Olivier Danvy, 2.8, Annapolis – November 8, 2012 2 / 40

slide-6
SLIDE 6

Summing the first odd numbers

The stream of odd natural numbers:

1, 3, 5, 7, 9, 11, 13, 15, ...

The corresponding stream of partial sums:

1, 4, 9, 16,

Olivier Danvy, 2.8, Annapolis – November 8, 2012 2 / 40

slide-7
SLIDE 7

Summing the first odd numbers

The stream of odd natural numbers:

1, 3, 5, 7, 9, 11, 13, 15, ...

The corresponding stream of partial sums:

1, 4, 9, 16, 25,

Olivier Danvy, 2.8, Annapolis – November 8, 2012 2 / 40

slide-8
SLIDE 8

Summing the first odd numbers

The stream of odd natural numbers:

1, 3, 5, 7, 9, 11, 13, 15, ...

The corresponding stream of partial sums:

1, 4, 9, 16, 25, 36,

Olivier Danvy, 2.8, Annapolis – November 8, 2012 2 / 40

slide-9
SLIDE 9

Summing the first odd numbers

The stream of odd natural numbers:

1, 3, 5, 7, 9, 11, 13, 15, ...

The corresponding stream of partial sums:

1, 4, 9, 16, 25, 36, 49,

Olivier Danvy, 2.8, Annapolis – November 8, 2012 2 / 40

slide-10
SLIDE 10

Summing the first odd numbers

The stream of odd natural numbers:

1, 3, 5, 7, 9, 11, 13, 15, ...

The corresponding stream of partial sums:

1, 4, 9, 16, 25, 36, 49, 64, ...

Olivier Danvy, 2.8, Annapolis – November 8, 2012 2 / 40

slide-11
SLIDE 11

Summing the first odd numbers

The stream of odd natural numbers:

1, 3, 5, 7, 9, 11, 13, 15, ...

The corresponding stream of partial sums:

1, 4, 9, 16, 25, 36, 49, 64, ...

i.e.,

12, 22, 32, 42, 52, 62, 72, 82, ...

Olivier Danvy, 2.8, Annapolis – November 8, 2012 2 / 40

slide-12
SLIDE 12

Constructively

  • start from the stream of natural numbers
  • strike out every 2nd

element

  • compute the successive partial sums

Result: the stream of squares .

Olivier Danvy, 2.8, Annapolis – November 8, 2012 3 / 40

slide-13
SLIDE 13

Scaling up

  • start from the stream of natural numbers
  • strike out every 3rd

element

  • compute the successive partial sums
  • strike out every 2nd

element

  • compute the successive partial sums

Result: the stream of ...

Olivier Danvy, 2.8, Annapolis – November 8, 2012 4 / 40

slide-14
SLIDE 14

Scaling up

  • start from the stream of natural numbers
  • strike out every 3rd

element

  • compute the successive partial sums
  • strike out every 2nd

element

  • compute the successive partial sums

Result: the stream of cubes .

Olivier Danvy, 2.8, Annapolis – November 8, 2012 4 / 40

slide-15
SLIDE 15

Scaling up: Moessner’s theorem

  • start from the stream of natural numbers
  • strike out every nth

element & sum

  • strike out every (n − 1)th

element & sum

  • ...
  • strike out every 3rd

element & sum

  • strike out every 2nd

element & sum Result: the stream of powers of n .

Olivier Danvy, 2.8, Annapolis – November 8, 2012 5 / 40

slide-16
SLIDE 16

Background

  • Moessner (1951)

The property, no proofs.

  • Perron (1951), Paasche (1952), Sali´

e (1952) Complicated inductive proofs.

  • Hinze (IFL 2008)

A calculational proof.

  • Rutten & Niqui (HOSC 2012)

A co-inductive proof.

Olivier Danvy, 2.8, Annapolis – November 8, 2012 6 / 40

slide-17
SLIDE 17

This work (in progress)

  • a formalization in Coq
  • but first, learning Coq

Olivier Danvy, 2.8, Annapolis – November 8, 2012 7 / 40

slide-18
SLIDE 18

Learning Coq in principle

  • web resources
  • book
  • seasonal schools

Olivier Danvy, 2.8, Annapolis – November 8, 2012 8 / 40

slide-19
SLIDE 19

Learning Coq in practice

  • practice, practice, practice
  • need a TA (or ideally, a coach)
  • forces you to think things through
  • can be frustrating at times

Olivier Danvy, 2.8, Annapolis – November 8, 2012 9 / 40

slide-20
SLIDE 20

Asking an expert

Require Import Omega3.

Olivier Danvy, 2.8, Annapolis – November 8, 2012 10 / 40

slide-21
SLIDE 21

Asking an expert

Require Import Omega3. (* undocumented, but perfect here, thanks to the fatty acids: *) do_the_right_thing.

Olivier Danvy, 2.8, Annapolis – November 8, 2012 10 / 40

slide-22
SLIDE 22

Learning Coq in practice

  • practice, practice, practice
  • need a TA (or ideally, a coach)
  • forces you to think things through
  • can be frustrating at times
  • wonderfully rewarding, overall

Olivier Danvy, 2.8, Annapolis – November 8, 2012 11 / 40

slide-23
SLIDE 23

Teaching Coq

  • introduction to functional programming

(Q3 2011-2012, Q1 2012-2013)

  • more advanced functional programming

(Q4 2011-2012) a marvelous experience

Olivier Danvy, 2.8, Annapolis – November 8, 2012 12 / 40

slide-24
SLIDE 24

Term projects in Q3

  • a standard batch (interpreters, compilers,

decompilers, VMs, CPS, power series, searching in binary trees, Boolean negational normalization, FSA, etc.)

  • a cherry on top of the pie: formalizing a

theorem and a proof from another course(!)

Olivier Danvy, 2.8, Annapolis – November 8, 2012 13 / 40

slide-25
SLIDE 25

Term projects in Q4

  • functional & relational programming
  • the Ackermann-Peter function
  • Boolean normalization and equisatisfiability
  • abstract interpretation (strided intervals)
  • group theory and pronic numbers
  • B-trees
  • graph theory
  • reduction from circuit to SAT
  • vector spaces & Cauchy-Schwarz inequality

Olivier Danvy, 2.8, Annapolis – November 8, 2012 14 / 40

slide-26
SLIDE 26

Plan

  • Moessner’s theorem at degree 3
  • Moessner’s theorem at degree 4
  • Which starting indices in the master lemma?
  • Introductory teaching with Coq
  • Conclusion and perspectives

Olivier Danvy, 2.8, Annapolis – November 8, 2012 15 / 40

slide-27
SLIDE 27

We are given

  • stream of ones
  • stream of positive powers of 3
  • stream of positive powers of 4
  • skip 2, skip 3, skip 4, ...
  • sums & sums aux, which uses an accumulator
  • stream bisimilar

Olivier Danvy, 2.8, Annapolis – November 8, 2012 16 / 40

slide-28
SLIDE 28

Moessner’s theorem at degree 3

  • the statement
  • the proof
  • the master lemma

Olivier Danvy, 2.8, Annapolis – November 8, 2012 17 / 40

slide-29
SLIDE 29

Theorem Moessner_3 : stream_bisimilar stream_of_positive_powers_of_3 (sums (skip_2 (sums (skip_3 (sums stream_of_ones))))).

Olivier Danvy, 2.8, Annapolis – November 8, 2012 18 / 40

slide-30
SLIDE 30

Proof. unfold stream_of_positive_powers_of_3. unfold sums. apply (Moessner_3_aux 0). Qed.

Olivier Danvy, 2.8, Annapolis – November 8, 2012 19 / 40

slide-31
SLIDE 31

Lemma Moessner_3_aux : forall (n : nat), stream_bisimilar (make_stream_of_nats (S n) (fun i => i * i * i) S) (sums_aux ??? (skip_2 (sums_aux ??? (skip_3 (sums_aux ??? stream_of_ones))))).

Olivier Danvy, 2.8, Annapolis – November 8, 2012 20 / 40

slide-32
SLIDE 32

Moessner’s theorem at degree 4

  • the statement
  • the proof
  • the master lemma

Olivier Danvy, 2.8, Annapolis – November 8, 2012 21 / 40

slide-33
SLIDE 33

Theorem Moessner_4 : stream_bisimilar stream_of_positive_powers_of_4 (sums (skip_2 (sums (skip_3 (sums (skip_4 (sums stream_of_ones))))))).

Olivier Danvy, 2.8, Annapolis – November 8, 2012 22 / 40

slide-34
SLIDE 34

Proof. unfold stream_of_positive_powers_of_4. unfold sums. apply (Moessner_4_aux 0). Qed.

Olivier Danvy, 2.8, Annapolis – November 8, 2012 23 / 40

slide-35
SLIDE 35

Lemma Moessner_4_aux : forall (n : nat), stream_bisimilar (make_stream_of_nats (S n) (fun i => i * i * i * i) S) (sums_aux ??? (skip_2 (sums_aux ??? (skip_3 (sums_aux ??? (skip_4 (sums_aux ??? stream_of_ones))))))).

Olivier Danvy, 2.8, Annapolis – November 8, 2012 24 / 40

slide-36
SLIDE 36

So, which starting indices?

Olivier Danvy, 2.8, Annapolis – November 8, 2012 25 / 40

slide-37
SLIDE 37

Newton’s binomial expansion

Reminder:

(n + 1)2 = n2 + 2 · n + 1 (n + 1)3 = n3 + 3 · n2 + 3 · n + 1 (n + 1)4 = n4 + 4 · n3 + 6 · n2 + 4 · n + 1 ...

Olivier Danvy, 2.8, Annapolis – November 8, 2012 26 / 40

slide-38
SLIDE 38

Lemma Moessner_2_aux : forall (n : nat), stream_bisimilar (make_stream_of_nats (S n) (fun i => i * i) S) (sums_aux (n * n) (skip_2 (sums_aux (2 * n) stream_of_ ones ))).

Olivier Danvy, 2.8, Annapolis – November 8, 2012 27 / 40

slide-39
SLIDE 39

Lemma Moessner_3_aux : forall (n : nat), stream_bisimilar (make_stream_of_nats (S n) (fun i => i * i * i) S) (sums_aux (n * n * n) (skip_2 (sums_aux (3 * n * n) (skip_3 (sums_aux (3 * n) stream_of_ ones ))))).

Olivier Danvy, 2.8, Annapolis – November 8, 2012 28 / 40

slide-40
SLIDE 40

Lemma Moessner_4_aux : forall (n : nat), stream_bisimilar (make_stream_of_nats (S n) (fun i => i * i * i * i) S) (sums_aux (n * n * n * n) (skip_2 (sums_aux (4 * n * n * n) (skip_3 (sums_aux (6 * n * n) (skip_4 (sums_aux (4 * n) stream_of_ ones ))))))).

Olivier Danvy, 2.8, Annapolis – November 8, 2012 29 / 40

slide-41
SLIDE 41

Assessment

  • The monomials of the binomial expansion.
  • Essential algebraic support from Coq

to find the starting indices.

  • A uniform structure for the proofs.
  • A code generator in OCaml (Moe Masuko).
  • A tactic in Ltac (Christian Clausen).
  • And now what?

Olivier Danvy, 2.8, Annapolis – November 8, 2012 30 / 40

slide-42
SLIDE 42

Consulting an expert – Danko Ilik

If your Ltac tactic does not use general recursion, you can tease out the corresponding lambda-term. This lambda-term is your proof.

Olivier Danvy, 2.8, Annapolis – November 8, 2012 31 / 40

slide-43
SLIDE 43

Consulting an expert – Danko Ilik

If your Ltac tactic does not use general recursion, you can tease out the corresponding lambda-term. This lambda-term is your proof. (The mathematical possibilities!)

Olivier Danvy, 2.8, Annapolis – November 8, 2012 31 / 40

slide-44
SLIDE 44

My introductory lectures on Coq

The “what” is classical:

  • functional programming, and proving

The “how” is classical too:

  • from the known towards the unknown
  • mathematical anxiety

Olivier Danvy, 2.8, Annapolis – November 8, 2012 32 / 40

slide-45
SLIDE 45

From the known

Or more precisely, from what should be known:

  • propositional logic
  • proofs (e.g., Modus Ponens)

Olivier Danvy, 2.8, Annapolis – November 8, 2012 33 / 40

slide-46
SLIDE 46

Strengthening the conclusion

Proposition modus_ponens_v1 : forall P Q : Prop, P /\ (P -> Q) -> Q. Proof. intros P Q [H_P H_P_implies_Q]. apply H_P_implies_Q. assumption. Qed.

Olivier Danvy, 2.8, Annapolis – November 8, 2012 34 / 40

slide-47
SLIDE 47

Weakening an hypothesis

Proposition modus_ponens_v2 : forall P Q : Prop, P /\ (P -> Q) -> Q. Proof. intros P Q [H_P H_P_implies_Q]. assert (H := H_P). apply H_P_implies_Q in H. assumption. Qed.

Olivier Danvy, 2.8, Annapolis – November 8, 2012 35 / 40

slide-48
SLIDE 48

Generalizing the goal

Proposition modus_ponens_v3 : forall P Q : Prop, P /\ (P -> Q) -> Q. Proof. intros P Q [H_P H_P_implies_Q]. revert H_P. assumption. Qed.

Olivier Danvy, 2.8, Annapolis – November 8, 2012 36 / 40

slide-49
SLIDE 49

From the known

Or more precisely, from what should be known:

  • propositional logic
  • proofs (e.g., Modus Ponens)
  • inductive definition of data
  • recursive definition of programs

Olivier Danvy, 2.8, Annapolis – November 8, 2012 37 / 40

slide-50
SLIDE 50

Conclusion and perspectives

Proof assistants are changing the world:

  • the 4-color theorem
  • the FeitThompson theorem
  • DemTech

Olivier Danvy, 2.8, Annapolis – November 8, 2012 38 / 40

slide-51
SLIDE 51

This was then: MFPS 1991

Olivier Danvy, 2.8, Annapolis – November 8, 2012 39 / 40

slide-52
SLIDE 52

This was then: MFPS 1991

“Look guys. We don’t say anything about your proofs, so don’t say anything about our programs, OK?”

Olivier Danvy, 2.8, Annapolis – November 8, 2012 39 / 40

slide-53
SLIDE 53

This is now: MAP 2012

Moi: A lightweight question: how does it feel, ...

Olivier Danvy, 2.8, Annapolis – November 8, 2012 40 / 40

slide-54
SLIDE 54

This is now: MAP 2012

Moi: A lightweight question: how does it feel, as a mathematician, to show your proofs to the world in complete detail?

Olivier Danvy, 2.8, Annapolis – November 8, 2012 40 / 40

slide-55
SLIDE 55

This is now: MAP 2012

Moi: A lightweight question: how does it feel, as a mathematician, to show your proofs to the world in complete detail?

  • V. Voevodsky (smiling): Liberating.

Olivier Danvy, 2.8, Annapolis – November 8, 2012 40 / 40

slide-56
SLIDE 56

This is now: MAP 2012

Moi: A lightweight question: how does it feel, as a mathematician, to show your proofs to the world in complete detail?

  • V. Voevodsky (smiling): Liberating.
  • Y. Bertot (intervening): But you only show

a representation of your proofs.

Olivier Danvy, 2.8, Annapolis – November 8, 2012 40 / 40

slide-57
SLIDE 57

This is now: MAP 2012

Moi: A lightweight question: how does it feel, as a mathematician, to show your proofs to the world in complete detail?

  • V. Voevodsky (smiling): Liberating.
  • Y. Bertot (intervening): But you only show

a representation of your proofs.

Olivier Danvy, 2.8, Annapolis – November 8, 2012 40 / 40

slide-58
SLIDE 58

This is now: MAP 2012

Moi: A lightweight question: how does it feel, as a mathematician, to show your proofs to the world in complete detail?

  • V. Voevodsky (smiling): Liberating.
  • Y. Bertot (intervening): But you only show

a representation of your proofs. Their spirit might be lost in the process.

Olivier Danvy, 2.8, Annapolis – November 8, 2012 40 / 40

slide-59
SLIDE 59

This is now: MAP 2012

Moi: A lightweight question: how does it feel, as a mathematician, to show your proofs to the world in complete detail?

  • V. Voevodsky (smiling): Liberating.
  • Y. Bertot (intervening): But you only show

a representation of your proofs. Their spirit might be lost in the process.

  • V. Voevodsky (definitely): I doubt it.

Olivier Danvy, 2.8, Annapolis – November 8, 2012 40 / 40

slide-60
SLIDE 60

This is now: MAP 2012

Moi: A lightweight question: how does it feel, as a mathematician, to show your proofs to the world in complete detail?

  • V. Voevodsky (smiling): Liberating.
  • Y. Bertot (intervening): But you only show

a representation of your proofs. Their spirit might be lost in the process.

  • V. Voevodsky (definitely): I doubt it.

Thank you.

Olivier Danvy, 2.8, Annapolis – November 8, 2012 40 / 40