HO in Coq Guillaume Ambal, Sergue Lenglet and Alan Schmitt - - PowerPoint PPT Presentation

▶
ho in coq
SMART_READER_LITE
LIVE PREVIEW

HO in Coq Guillaume Ambal, Sergue Lenglet and Alan Schmitt - - PowerPoint PPT Presentation

Jan 29, 2023 286 likes •868 views

HO in Coq Guillaume Ambal, Sergue Lenglet and Alan Schmitt Higher-Order -calculus Model of concurrent and communicating systems First-order: inert data (channel names, . . . ) Higher-order: executable processes

slide-1
SLIDE 1

HOπ in Coq

Guillaume Ambal, Sergue¨ ı Lenglet and Alan Schmitt

slide-2
SLIDE 2

Higher-Order π-calculus

◮ Model of concurrent and communicating systems

◮ First-order: inert data (channel names, . . . ) ◮ Higher-order: executable processes

◮ Behavioral equivalence proofs (bisimulation): complex, prone to error ◮ Very few formalization of higher-order process calculi ◮ Difficulty: binders

slide-3
SLIDE 3

Higher-Order π-calculus

Communication channel names a, b, c, . . . Process variables X, Y , Z, . . . P, Q ::=

slide-4
SLIDE 4

Higher-Order π-calculus

Communication channel names a, b, c, . . . Process variables X, Y , Z, . . . P, Q ::= ⊘ nil process

slide-5
SLIDE 5

Higher-Order π-calculus

Communication channel names a, b, c, . . . Process variables X, Y , Z, . . . P, Q ::= ⊘ nil process | P Q parallel composition

slide-6
SLIDE 6

Higher-Order π-calculus

Communication channel names a, b, c, . . . Process variables X, Y , Z, . . . P, Q ::= ⊘ nil process | P Q parallel composition | X variable | a(X).P process input a(X).X

slide-7
SLIDE 7

Higher-Order π-calculus

Communication channel names a, b, c, . . . Process variables X, Y , Z, . . . P, Q ::= ⊘ nil process | P Q parallel composition | X variable | a(X).P process input a(X).(X b(Y ).Y)

slide-8
SLIDE 8

Higher-Order π-calculus

Communication channel names a, b, c, . . . Process variables X, Y , Z, . . . P, Q ::= ⊘ nil process | P Q parallel composition | X variable | a(X).P process input | aP.Q process output a(X).(X b(Y ).Y b⊘. ⊘ )

slide-9
SLIDE 9

Higher-Order π-calculus

Communication channel names a, b, c, . . . Process variables X, Y , Z, . . . P, Q ::= ⊘ nil process | P Q parallel composition | X variable | a(X).P process input | aP.Q process output a(X).(X b(Y ).Y b⊘. ⊘ ) abc(Z).Z.⊘⊘

slide-10
SLIDE 10

Higher-Order π-calculus

Communication channel names a, b, c, . . . Process variables X, Y , Z, . . . P, Q ::= ⊘ nil process | P Q parallel composition | X variable | a(X).P process input | aP.Q process output a(X).(X b(Y ).Y b⊘. ⊘ ) abc(Z).Z.⊘⊘

slide-11
SLIDE 11

Higher-Order π-calculus

Communication channel names a, b, c, . . . Process variables X, Y , Z, . . . P, Q ::= ⊘ nil process | P Q parallel composition | X variable | a(X).P process input | aP.Q process output Communication: a(X).P aR.Q − → P{R/X} Q a(X).(X b(Y ).Y b⊘. ⊘ ) abc(Z).Z.⊘⊘

slide-12
SLIDE 12

Higher-Order π-calculus

Communication channel names a, b, c, . . . Process variables X, Y , Z, . . . P, Q ::= ⊘ nil process | P Q parallel composition | X variable | a(X).P process input | aP.Q process output Communication: a(X).P aR.Q − → P{R/X} Q a(X).(X b(Y ).Y b⊘. ⊘ ) abc(Z).Z.⊘⊘ − → bc(Z).Z.⊘ b(Y ).Y b⊘.⊘ ⊘

slide-13
SLIDE 13

Higher-Order π-calculus

Communication channel names a, b, c, . . . Process variables X, Y , Z, . . . P, Q ::= ⊘ nil process | P Q parallel composition | X variable | a(X).P process input | aP.Q process output Communication: a(X).P aR.Q − → P{R/X} Q a(X).(X b(Y ).Y b⊘. ⊘ ) abc(Z).Z.⊘⊘ − → bc(Z).Z.⊘ b(Y ).Y b⊘.⊘ ⊘

slide-14
SLIDE 14

Higher-Order π-calculus

Communication channel names a, b, c, . . . Process variables X, Y , Z, . . . P, Q ::= ⊘ nil process | P Q parallel composition | X variable | a(X).P process input | aP.Q process output Communication: a(X).P aR.Q − → P{R/X} Q a(X).(X b(Y ).Y b⊘. ⊘ ) abc(Z).Z.⊘⊘ − → bc(Z).Z.⊘ b(Y ).Y b⊘.⊘ ⊘ − → ⊘ c(Z).Z b⊘.⊘ ⊘

slide-15
SLIDE 15

Higher-Order π-calculus

Communication channel names a, b, c, . . . Process variables X, Y , Z, . . . P, Q ::= ⊘ nil process | P Q parallel composition | X variable | a(X).P process input | aP.Q process output | νa.P name restriction Communication: a(X).P aR.Q − → P{R/X} Q

slide-16
SLIDE 16

Name restriction

Syntax: P, Q ::= ⊘ | P Q | X | a(X).P | aP.Q | νa.P νab.(ab⊘.⊘.P a(X).dX.Q)

slide-17
SLIDE 17

Name restriction

Syntax: P, Q ::= ⊘ | P Q | X | a(X).P | aP.Q | νa.P νab.(ab⊘.⊘.P a(X).dX.Q) a(X).X

slide-18
SLIDE 18

Name restriction

Syntax: P, Q ::= ⊘ | P Q | X | a(X).P | aP.Q | νa.P νab.(ab⊘.⊘.P a(X).dX.Q)

slide-19
SLIDE 19

Name restriction

Syntax: P, Q ::= ⊘ | P Q | X | a(X).P | aP.Q | νa.P νab.(ab⊘.⊘.P a(X).dX.Q) − → νab.(P db⊘.⊘.Q)

slide-20
SLIDE 20

Name restriction

Syntax: P, Q ::= ⊘ | P Q | X | a(X).P | aP.Q | νa.P νab.(ab⊘.⊘.P a(X).dX.Q) − → νab.(P db⊘.⊘.Q) d(Y ).(Y R)

slide-21
SLIDE 21

Name restriction

Syntax: P, Q ::= ⊘ | P Q | X | a(X).P | aP.Q | νa.P νab.(ab⊘.⊘.P a(X).dX.Q) − → νab.(P db⊘.⊘.Q) d(Y ).(Y R) − →νab.(P Q) b⊘.⊘ R

slide-22
SLIDE 22

Name restriction

Syntax: P, Q ::= ⊘ | P Q | X | a(X).P | aP.Q | νa.P νab.(ab⊘.⊘.P a(X).dX.Q) − → νab.(P db⊘.⊘.Q) d(Y ).(Y R) ≃ νba.(P db⊘.⊘.Q) d(Y ).(Y R)

slide-23
SLIDE 23

Name restriction

Syntax: P, Q ::= ⊘ | P Q | X | a(X).P | aP.Q | νa.P νab.(ab⊘.⊘.P a(X).dX.Q) − → νab.(P db⊘.⊘.Q) d(Y ).(Y R) ≃ νba.(P db⊘.⊘.Q) d(Y ).(Y R) ≃ νb.(νa.(P db⊘.⊘.Q) d(Y ).(Y R))

slide-24
SLIDE 24

Name restriction

Syntax: P, Q ::= ⊘ | P Q | X | a(X).P | aP.Q | νa.P νab.(ab⊘.⊘.P a(X).dX.Q) − → νab.(P db⊘.⊘.Q) d(Y ).(Y R) ≃ νba.(P db⊘.⊘.Q) d(Y ).(Y R) ≃ νb.(νa.(P db⊘.⊘.Q) d(Y ).(Y R)) − → νb.(νa.(P Q) b⊘.⊘ R)

slide-25
SLIDE 25

Name restriction

Syntax: P, Q ::= ⊘ | P Q | X | a(X).P | aP.Q | νa.P νab.(ab⊘.⊘.P a(X).dX.Q) − → νab.(P db⊘.⊘.Q) d(Y ).(Y R) ≃ νba.(P db⊘.⊘.Q) d(Y ).(Y R) ≃ νb.(νa.(P db⊘.⊘.Q) d(Y ).(Y R)) − → νb.(νa.(P Q) b⊘.⊘ R) Input: P

a

− → (X)R Output: Q

a

− → ν b.ST

slide-26
SLIDE 26

Name restriction

Syntax: P, Q ::= ⊘ | P Q | X | a(X).P | aP.Q | νa.P νab.(ab⊘.⊘.P a(X).dX.Q) − → νab.(P db⊘.⊘.Q) d(Y ).(Y R) ≃ νba.(P db⊘.⊘.Q) d(Y ).(Y R) ≃ νb.(νa.(P db⊘.⊘.Q) d(Y ).(Y R)) − → νb.(νa.(P Q) b⊘.⊘ R) Input: P

a

− → (X)R Output: Q

a

− → ν b.ST P

a

− → (X)R Q

a

− → ν b.ST P Q − → ν b.(R{S/X} T)

  • b ∩ fn(R) = ∅
slide-27
SLIDE 27

What we formalize

◮ Bisimilarity: if P

∼ α

  • Q

P′ then P

α

  • ∼

Q

α

  • P′

∼

Q′ ◮ Congruence: if P ∼ Q then P R ∼ Q R, νa.P ∼ νa.Q, . . . ◮ Howe’s method [CONCUR 15]

slide-28
SLIDE 28
slide-29
SLIDE 29

Binders

Process input a(X).P: binds process variables X ◮ Static scope ◮ Process variables are substituted (by processes) ◮ Forbids computation Name restriction νa.P, ν a.PQ: binds names a ◮ Dynamic scope ◮ No substitution ◮ Allows computation

slide-30
SLIDE 30

Binders

Process input a(X).P: binds process variables X ◮ Static scope ◮ Process variables are substituted (by processes) ◮ Forbids computation Similar to λ-abstraction: any representation Name restriction νa.P, ν a.PQ: binds names a ◮ Dynamic scope ◮ No substitution ◮ Allows computation

slide-31
SLIDE 31

Binders

Process input a(X).P: binds process variables X ◮ Static scope ◮ Process variables are substituted (by processes) ◮ Forbids computation Similar to λ-abstraction: any representation Name restriction νa.P, ν a.PQ: binds names a ◮ Dynamic scope ◮ No substitution ◮ Allows computation Locally nameless (CPP 18) and Nominal

slide-32
SLIDE 32

Locally Nameless

slide-33
SLIDE 33

Locally nameless

Bound names are de Bruijn indices νba.(ab⊘.⊘.⊘ a(X).dX.⊘) d(Y ).Y ν.ν.(01⊘.⊘.⊘ 0(X).dX.⊘) d(Y ).Y Invalid terms ν.1⊘.⊘ ⇒ well-formedness predicate

slide-34
SLIDE 34

Locally nameless

Bound names are de Bruijn indices νba.(ab⊘.⊘.⊘ a(X).dX.⊘) d(Y ).Y ν.ν.(01⊘.⊘.⊘ 0(X).dX.⊘) d(Y ).Y Invalid terms ν.1⊘.⊘ ⇒ well-formedness predicate Message output R

a

− → ν b.PQ νnPQ Scope extrusion

slide-35
SLIDE 35

Scope extrusion in locally nameless

Bind c then d in νba.PabdQabcd ν ν 0 1 d . 0 1 c d

slide-36
SLIDE 36

Scope extrusion in locally nameless

Bind c then d in νba.Pabdνc.Qabcd ν ν 0 1 d . 0 1 c d

slide-37
SLIDE 37

Scope extrusion in locally nameless

Bind c then d in νba.Pabdνc.Qabcd ν ν 0 1 d . 0 1 c d ν ν 0 1 d . ν 0 1 ? d

slide-38
SLIDE 38

Scope extrusion in locally nameless

Bind c then d in νba.Pabdνc.Qabcd ν ν 0 1 d . 0 1 c d ν ν 0 1 d . ν 1 2 0 d

slide-39
SLIDE 39

Scope extrusion in locally nameless

Bind c then d in νdba.Pabdνc.Qabcd ν ν 0 1 d . 0 1 c d ν ν 0 1 d . ν 1 2 0 d ν ν ν 0 1 2 . ν 1 2 0 3

slide-40
SLIDE 40

Computing under binders

P − → P′ νa.P − → νa.P′ {K → a}P replaces K with a in P ∀a / ∈ fn(P) ∪ fn(P′) {0 → a}P − → {0 → a}P′ ν.P − → ν.P′

Lemma (Renaming)

If P holds for {K → a}P, it holds for {K → b}P if . . .

slide-41
SLIDE 41

Nominal

slide-42
SLIDE 42

Nominal

As on paper: names and α-equivalence νa.P =α νb.(P{b/a}) if b / ∈ fn(P) Swapping instead of renaming [a ↔ b](νc.Q) ∆ = ν([a ↔ b]c).[a ↔ b]Q

slide-43
SLIDE 43

Nominal

As on paper: names and α-equivalence νa.P =α νb.(P{b/a}) if b / ∈ fn(P) Swapping instead of renaming [a ↔ b](νc.Q) ∆ = ν([a ↔ b]c).[a ↔ b]Q

Lemma

◮ [b ↔ c](P{Q/X}) =α ([b ↔ c]P){([b ↔ c]Q)/X}; ◮ if P =α P′ and Q =α Q′ then P{Q/X} =α P′{Q′/X}

slide-44
SLIDE 44

Nominal

As on paper: names and α-equivalence νa.P =α νb.(P{b/a}) if b / ∈ fn(P) Swapping instead of renaming [a ↔ b](νc.Q) ∆ = ν([a ↔ b]c).[a ↔ b]Q

Lemma

◮ [b ↔ c](P{Q/X}) =α ([b ↔ c]P){([b ↔ c]Q)/X}; ◮ if P =α P′ and Q =α Q′ then P{Q/X} =α P′{Q′/X} Working modulo α-equivalence Swapping lemmas: much simpler than renaming lemmas

slide-45
SLIDE 45

Representing outputs

R

a

− → ν b.PQ: list b1, . . . , bn, P, and Q New binding structure Redo what we did for processes Manipulation of lists

slide-46
SLIDE 46

Evaluation

Nominal Locally nameless

slide-47
SLIDE 47

Evaluation

Nominal Locally nameless intrinsic α-equivalence < wf predicate name > de Bruijn indices

slide-48
SLIDE 48

Evaluation

Nominal Locally nameless intrinsic α-equivalence < wf predicate name > de Bruijn indices

  • utputs

list of names < 1 number specific α-equivalence ≪ ∅

slide-49
SLIDE 49

Evaluation

Nominal Locally nameless intrinsic α-equivalence < wf predicate name > de Bruijn indices

  • utputs

list of names < 1 number specific α-equivalence ≪ ∅ renaming swapping ≫ renaming

slide-50
SLIDE 50

Evaluation

Nominal Locally nameless intrinsic α-equivalence < wf predicate name > de Bruijn indices

  • utputs

list of names < 1 number specific α-equivalence ≪ ∅ renaming swapping ≫ renaming total 4k lines ≫ 5k lines

slide-51
SLIDE 51

New challenger incoming pure deBruijn indices

slide-52
SLIDE 52

Evaluation (bis)

Nominal de Bruijn Locally nameless

slide-53
SLIDE 53

Evaluation (bis)

Nominal de Bruijn Locally nameless intrinsic α-equivalence ∅ wf predicate name dB indices dB indices

slide-54
SLIDE 54

Evaluation (bis)

Nominal de Bruijn Locally nameless intrinsic α-equivalence ∅ wf predicate name dB indices dB indices

  • utputs

list of names 1 number 1 number specific α-equivalence ∅ ∅

slide-55
SLIDE 55

Evaluation (bis)

Nominal de Bruijn Locally nameless intrinsic α-equivalence ∅ wf predicate name dB indices dB indices

  • utputs

list of names 1 number 1 number specific α-equivalence ∅ ∅ renaming [a ↔ b]P map f P {0 → a}P f : N → N

slide-56
SLIDE 56

Evaluation (bis)

Nominal de Bruijn Locally nameless intrinsic α-equivalence ∅ wf predicate name dB indices dB indices

  • utputs

list of names 1 number 1 number specific α-equivalence ∅ ∅ renaming [a ↔ b]P map f P {0 → a}P f : N → N total 4k lines 3k lines 5k lines

slide-57
SLIDE 57

Conclusion and Future Work

◮ de Bruijn wins! (in a cripples fight) ◮ More automation, tactics ◮ Add support for name restriction to existing libraries (Autosubst?) ◮ More expressive calculi ◮ Tools for bisimulation (Howe’s method)