PROOF WEAVING Anne Mulhern Computer Sciences Department University

PROOF WEAVING Anne Mulhern Computer Sciences Department University of Wisconsin-Madison, WI USA mulhern@cs. wisc. edu www. cs. wisc. edu/~mulhern MM 2006 Proof Weaving

Modifying Proofs I’ll use tacticals to must Imust could add modify new, IBut I’ll will write and they not ever are a special very must fix add broken newmore make my scripts Done! dissimilar the proof constructor objects graduate purpose big structured and complex tactic doing this scripts constructor robust MM 2006 Proof Weaving 2

Mutual Antagonism • Modular and incremental approaches are ubiquitous in computer science • Theorem provers do not readily support certain kinds of modular or incremental proof development – Transparent dependencies invalidate existing proofs when underlying structures are changed MM 2006 Proof Weaving 3

Proof Weaving • A technique for combining – Separate proof objects – Of the same theorem – On different underlying structures • And forming – A single proof object – Of the same theorem – On a combination of the underlying structures MM 2006 Proof Weaving 4

Disclaimer • There is no implementation • Demo: me typing MM 2006 Proof Weaving 5

Dependencies • If L 1 and L 2 are two identifiers denoting definitions, lemmas, functions, or types, a dependency between L 1 and L 2 exists when L 1 is a free identifier occurring in the -term associated with L 2. [Proof Reuse with Extended Inductive Types, Boite, 2004] MM 2006 Proof Weaving 6

Dependencies on term • Forall lists of terms, either the length of the list is zero or the length of the list is greater than zero • Tm. True, which is a term, is a value • Equality on terms is decidable MM 2006 Proof Weaving 7

Dependencies • An object L has a transparent dependency with an inductive type I, if L has a dependency with an induction principle of I, or if a case analysis on type I is performed in the -term representing L. • An object L has an opaque dependency with an inductive type I, if its dependency with I is not transparent. [Proof Reuse with Extended Inductive Types, Boite, 2004] MM 2006 Proof Weaving 8

Transparent Dependencies Bad • If a constructor C is added to an inductive type I, wherever there is a transparent dependency on I the object that contains the transparent dependency must be updated to accommodate C. – Match case added – Additional argument passed to induction principle MM 2006 Proof Weaving 9

Quiz: Transparent or Opaque? Forall lists of terms, either the length of the list is zero or the length of the list is greater than zero Opaque! MM 2006 Proof Weaving 10

Quiz: Transparent or Opaque? Tm. True, which is a term, is a value Opaque! MM 2006 Proof Weaving 11

Quiz: Transparent or Opaque? Equality on terms is decidable Transparent! MM 2006 Proof Weaving 12

Inductive term : Set : = | Tm. True : term | Tm. False : term. Lemma eq_dec : forall (t t’ : term), {t = t’} + {t <> t’}. decide equality. induction t. Qed. intro t’. case t’. left. reflexivity. right. discriminate. intro t’. case t’. right. discriminate. left. reflexivity. Qed. MM 2006 Proof Weaving 13

Transparent Dependency on term MM 2006 Proof Weaving 14

Transparent Dependency on term MM 2006 Proof Weaving 15

Transparent dependency on term MM 2006 Proof Weaving 16

Transparent dependency on term inductiont. t. introt’. caset’. left. reflexivity. right. discriminate. intro t’. caset’. right. discriminate. intro t’. case t’. left. reflexivity. right. discriminate. Qed. left. reflexivity. Qed. MM 2006 Proof Weaving 17

False Transparent Dependencies • Some transparent dependencies are false transparent dependencies – A case analysis is performed – Most constructors are irrelevant • False transparent dependencies are removable MM 2006 Proof Weaving 18

Outline • False Transparent Dependencies • True Transparent Dependencies MM 2006 Proof Weaving 19

Outline • False Transparent Dependencies • True Transparent Dependencies MM 2006 Proof Weaving 20

Transparent Dependency MM 2006 Proof Weaving 21

Transparent Dependencies MM 2006 Proof Weaving 22

False Transparent Dependencies (@eq_ind term Tm. True (fun e : term => match e with | Tm. True => True | Tm. False => False | Tm. If _ _ _ => False end) I (Type Environment) eq_ind : forall (A : Type) (x : A) (P : A -> Prop), P x -> forall y : A, x = y -> P y term : Set Tm. True : term Tm. False : term Tm. If : term -> term True : Prop False : Prop I : True H 1 : Tm. True = Tm. If tm 1 tm 2 tm 3 (Tm. If tm 1 tm 2 tm 3) H 1) MM 2006 Proof Weaving 23

False Transparent Dependencies forall (A : Type) (x : A) (P : A -> Prop), forall (x. P: xterm) (P : yterm -> forall : A, -> x =Prop), y -> P y forall (PP: xterm -> Prop), -> forall y : term, x = y -> P y P Tm. True -> forall y : term, Tm. True = y -> P y (@eq_ind term Tm. True (fun e : term => match e with | Tm. True => True | Tm. False => False | Tm. If _ _ _ => False end) F F Tm. True -> forall y : term, Tm. True = y -> F y forall y : term, Tm. True = ytm 3) -> F->y Tm. True = (Tm. If tm 1 tm 2 F (Tm. If tm 1 tm 2 tm 3) False I (Tm. If tm 1 tm 2 tm 3) H 1) MM 2006 Proof Weaving 24

False Transparent Dependencies (fun e : term => match e with | Tm. True => True | Tm. False => False | Tm. If _ _ _ => False end) MM 2006 (fun ee : : term => => match ee with || Tm. True => => True || Tm. If __ __ __ => => False | _ => 0 = 1 end) Proof Weaving 25

False Transparent Dependencies MM 2006 Proof Weaving 26

False Transparent Dependencies • Easily identified • Fixable MM 2006 Proof Weaving 27

Outline • False Transparent Dependencies • True Transparent Dependencies MM 2006 Proof Weaving 28

Outline • False Transparent Dependencies • True Transparent Dependencies – Syntactically similar subterms MM 2006 Proof Weaving 29

Syntactically Similar Subterms MM 2006 Proof Weaving 30

Template Extraction match H 0 in (typeof t t 0) return (t = Tm. If tm 1 tm 2 tm 3 -> t 0 = x -> exists x 0 : term, eval (Tm. If tm 1 tm 2 tm 3) x 0) with | TTrue => fun (H 1 : Tm. True = Tm. If tm 1 tm 2 tm 3) (H 2 : Ty. Bool = x) => False_ind (Ty. Bool = x -> exists x 0 : term, eval (Tm. If tm 1 tm 2 tm 3) x 0) (@eq_ind term Tm. True (fun e : term => match e with | Tm. True => True | Tm. If _ _ _ => False | _ => 0 = 1 end) I (Tm. If tm 1 tm 2 tm 3) H 1) H 2 MM 2006 Proof Weaving 31

Template Extraction template (H 0 : typeof t t 0) => H 0 => fun (H 1 : t = Tm. If tm 1 tm 2 tm 3) (H 2 : t 0 = x) => False_ind (t 0 = x -> exists x 0 : term, eval (Tm. If tm 1 tm 2 tm 3) x 0) (@eq_ind term t (fun e : term => match e with | t => True | Tm. If _ _ _ => False | _ => 0 = 1 end) I (Tm. If tm 1 tm 2 tm 3) H 1) H 2 MM 2006 Proof Weaving 32

Term Reconstruction MM 2006 Proof Weaving 33

Example: if If an if statement is well typed then it can be further evaluated. true : Bool False The if statement can be further evaluated. false : Bool False The if statement can be further evaluated. t 1 : Bool t 2 : T t 3 : T if t 1 then t 2 else t 3 : T MM 2006 The if statement can be further evaluated. Proof Weaving 34

Observation • False transparent dependencies and true transparent dependencies with syntactically similar subterms – Arise frequently – Are easily identified – Are tractable MM 2006 Proof Weaving 35

To Weave Proof Objects… • Remove false dependencies in each proof object • For each proof object – Reconstruct proof subterms corresponding to the constructors in the other proof object • Reject those terms that are not well-typed • Weave subterms from each proof together MM 2006 Proof Weaving 36

How is this technique working? • Algorithm performed by hand • Numerous small examples • References + if statements – Each separate proof has several hundred lines of code – Six subgoals presented to refine tactic • Must move to implementation MM 2006 Proof Weaving 37

Could this technique be useful? • Yes – Size of proof is roughly polynomial in number of constructors – “Developer effort” linear? MM 2006 Proof Weaving 38

Related Work • Proof Reuse with Extended Inductive Types [Olivier Boite, TPHOLS 2004] • Generating Generic Functions [Johan Jeuring, Alexey Rodrigues, Gideon Smeding, WGP 2006] • Plagiator - A learning prover [Thomas Kolbe and Jurgen Brauburger, CADE-14 1997] MM 2006 Proof Weaving 39

Topics Not Covered • Mapping generated proof to proof script • Simplifying proof terms for easier template extraction • Removing or changing (rather than adding) constructors • Changing the proof statement MM 2006 Proof Weaving 40

Future Work • Implementation – Requires Coq infrastructure • Typechecker • Tools for manipulating AST • Supporting refactorings MM 2006 Proof Weaving 41

Conclusion • Proof Weaving – Addresses the drawbacks of tactic reuse and specialized tactics – Is a general technique – Especially suitable for proofs of programming language properties – Preliminary results are encouraging MM 2006 Proof Weaving 42

PROOF WEAVING Anne Mulhern Computer Sciences Department University of Wisconsin-Madison, WI USA mulhern@cs. wisc. edu www. cs. wisc. edu/~mulhern MM 2006 Proof Weaving