The Nominal Datatype Package in Isabelle/HOL Christian Urban - - PowerPoint PPT Presentation

The Nominal Datatype Package in Isabelle/HOL

Christian Urban University of Munich joint work with Stefan Berghofer, Markus Wenzel, Alexander Krauss. . .

Not tingham, 18. April 2006 – p.1 (1/1)

The POPLmark-Challenge

“How close are we to a world where program- ming language papers are routinely supported by machine-checked metatheory proofs, where full-scale language definitions are expressed in machine-processed mathematics. . . ?”

Obviously we aren’t there yet: for binders reasonable powerful tools are available: de-Bruijn indices (in Coq, Isabelle,. . . ) or HOAS (mainly in Twelf) but apart from some theorem-proving experts, nobody seems to use them; non-experts are still routinely do their proofs on paper, only

Not tingham, 18. April 2006 – p.2 (1/2)

The POPLmark-Challenge

“How close are we to a world where program- ming language papers are routinely supported by machine-checked metatheory proofs, where full-scale language definitions are expressed in machine-processed mathematics. . . ?”

Obviously we aren’t there yet: for binders reasonable powerful tools are available: de-Bruijn indices (in Coq, Isabelle,. . . ) or HOAS (mainly in Twelf) but apart from some theorem-proving experts, nobody seems to use them; non-experts are still routinely do their proofs on paper, only

The aim of the nominal datatype package is to support the kind of reasoning that is employed on paper. The hope is: if you can do formal proofs on paper, then you can implement them in Isabelle/HOL with ease. That is not a trivial task.

Not tingham, 18. April 2006 – p.2 (2/2)

Substitution Lemma: If

• M

Proof: By induction on the structure of

Case 1.1.

• x. Then both sides equal

Case 1.2.

• y. Then both sides equal

implies

• L.

Case 1.3.

• z

• y. Then both sides equal

• z

• 1. By the variable convention we may assume

that

• L. Then by induction hypothesis

• z

• z

• (z

• M

• 2. The statement follows again from the induc-

tion hypothesis.

• This is a simple example illustrating

a point. We have already implemented much more complicated proofs, e.g. Church-Rosser, SN, transitivity of subtyping in POPLmark, etc.

Not tingham, 18. April 2006 – p.3 (1/8)

Substitution Lemma: If

• M

Proof: By induction on the structure of

Case 1.1.

• x. Then both sides equal

Case 1.2.

• y. Then both sides equal

implies

• L.

Case 1.3.

• z

• y. Then both sides equal

• z

• 1. By the variable convention we may assume

that

• L. Then by induction hypothesis

• z

• z

• (z

• M

• 2. The statement follows again from the induc-

tion hypothesis.

• Not

tingham, 18. April 2006 – p.3 (2/8)

Substitution Lemma: If

• M

Proof: By induction on the structure of

Case 1.1.

• x. Then both sides equal

Case 1.2.

• y. Then both sides equal

implies

• L.

Case 1.3.

• z

• y. Then both sides equal

• z

• 1. By the variable convention we may assume

that

• L. Then by induction hypothesis

• z

• z

• (z

• M

• 2. The statement follows again from the induc-

tion hypothesis.

• Not

tingham, 18. April 2006 – p.3 (3/8)

Substitution Lemma: If

• M

Proof: By induction on the structure of

Case 1.1.

• x. Then both sides equal

Case 1.2.

• y. Then both sides equal

implies

• L.

Case 1.3.

• z

• y. Then both sides equal

• z

• 1. By the variable convention we may assume

that

• L. Then by induction hypothesis

• z

• z

• (z

• M

• 2. The statement follows again from the induc-

tion hypothesis.

• Not

tingham, 18. April 2006 – p.3 (4/8)

Substitution Lemma: If

• M

Proof: By induction on the structure of

Case 1.1.

• x. Then both sides equal

Case 1.2.

• y. Then both sides equal

implies

• L.

Case 1.3.

• z

• y. Then both sides equal

• z

• 1. By the variable convention we may assume

that

• L. Then by induction hypothesis

• z

• z

• (z

• M

• 2. The statement follows again from the induc-

tion hypothesis.

• Not

tingham, 18. April 2006 – p.3 (5/8)

Substitution Lemma: If

• M

Proof: By induction on the structure of

Case 1.1.

• x. Then both sides equal

Case 1.2.

• y. Then both sides equal

implies

• L.

Case 1.3.

• z

• y. Then both sides equal

• z

• 1. By the variable convention we may assume

that

• L. Then by induction hypothesis

• z

• z

• (z

• M

• 2. The statement follows again from the induc-

tion hypothesis.

• Not

tingham, 18. April 2006 – p.3 (6/8)

Substitution Lemma: If

• M

Proof: By induction on the structure of

Case 1.1.

• x. Then both sides equal

Case 1.2.

• y. Then both sides equal

implies

• L.

Case 1.3.

• z

• y. Then both sides equal

• z

• 1. By the variable convention we may assume

that

• L. Then by induction hypothesis

• z

• z

• (z

• M

• 2. The statement follows again from the induc-

tion hypothesis.

• Remember: only if

• (z

• z

• z

IH

• (z

• (z

Not tingham, 18. April 2006 – p.3 (7/8)

Substitution Lemma: If

• M

Proof: By induction on the structure of

Case 1.1.

• x. Then both sides equal

Case 1.2.

• y. Then both sides equal

implies

• L.

Case 1.3.

• z

• y. Then both sides equal

• z

• 1. By the variable convention we may assume

that

• L. Then by induction hypothesis

• z

• z

• (z

• M

• 2. The statement follows again from the induc-

tion hypothesis.

• Not

tingham, 18. April 2006 – p.3 (8/8)

Formal Proof in Isabelle

lemma forget: assumes a: ”

shows ”

using a by (nominal induct

(auto simp add: abs fresh fresh atm) lemma fresh fact: fixes

assumes a: ”

shows ”

using a b by (nominal induct

(auto simp add: abs fresh fresh atm) lemma subst lemma: assumes a: ”

shows ”

using a b by (nominal induct

(auto simp add: forget fresh fact)

Not tingham, 18. April 2006 – p.4 (1/3)

Formal Proof in Isabelle

lemma forget: assumes a: ”

shows ”

using a by (nominal induct

(auto simp add: abs fresh fresh atm) lemma fresh fact: fixes

assumes a: ”

shows ”

using a b by (nominal induct

(auto simp add: abs fresh fresh atm) lemma subst lemma: assumes a: ”

shows ”

using a b by (nominal induct

(auto simp add: forget fresh fact)

stands for

reads as “x fresh for

is a polymorphic construction from the Nominal Logic Work by Pitts

Not tingham, 18. April 2006 – p.4 (2/3)

Formal Proof in Isabelle

lemma forget: assumes a: ”

shows ”

using a by (nominal induct

(auto simp add: abs fresh fresh atm) lemma fresh fact: fixes

assumes a: ”

shows ”

using a b by (nominal induct

(auto simp add: abs fresh fresh atm) lemma subst lemma: assumes a: ”

shows ”

using a b by (nominal induct

(auto simp add: forget fresh fact)

Not tingham, 18. April 2006 – p.4 (3/3)

Crucial Points

The nominal datatype package generates the

• equivalence classes as a type in Isabelle/HOL.

atom decl name nominal datatype lam =

The type lam is defined so that we have equations Lam

which do not hold for “normal” datatypes.

Not tingham, 18. April 2006 – p.5 (1/1)

Structural Induction

Then automatically generated is a structural induction principle that has Barendregt’s convention already build in:

Not tingham, 18. April 2006 – p.6 (1/7)

Structural Induction

Then automatically generated is a structural induction principle that has Barendregt’s convention already build in:

the variable over which the induction proceeds: “. . . By induction over the structure of

• M. . . ”

Not tingham, 18. April 2006 – p.6 (2/7)

Structural Induction

Then automatically generated is a structural induction principle that has Barendregt’s convention already build in:

the context of the induction; for which the binder should be fresh

“. . . By the variable convention we can assume

• L. . . ”

Not tingham, 18. April 2006 – p.6 (3/7)

Structural Induction

Then automatically generated is a structural induction principle that has Barendregt’s convention already build in:

the property to be proved by induction:

Not tingham, 18. April 2006 – p.6 (4/7)

Structural Induction

Then automatically generated is a structural induction principle that has Barendregt’s convention already build in:

One only has to write (more in the talk of Markus Wenzel): by (nominal induct

Not tingham, 18. April 2006 – p.6 (5/7)

Structural Induction

Then automatically generated is a structural induction principle that has Barendregt’s convention already build in:

The lambda-case amounts to:

Not tingham, 18. April 2006 – p.6 (6/7)

Structural Induction

Then automatically generated is a structural induction principle that has Barendregt’s convention already build in:

By the way: There is a condition for when Barendregt’s variable convention is applicable—it is almost always satisfied, but not always:

all names as free)

Not tingham, 18. April 2006 – p.6 (7/7)

Conclusion

the nominal datatype package is still work in progress already quite usable for the lambda-calculus Church-Rosser strong normalisation using candidates weakening (transitivity of subtyping,

• calc.)

mailing list and download

nominal-isabelle@mailbroy.informatik.tu-muenchen.de http://isabelle.in.tum.de/nominal/

Not tingham, 18. April 2006 – p.7 (1/1)