Reasoning on programs using Step-indexed Realizability Guilhem Jaber - PowerPoint PPT Presentation

Reasoning on programs using Step-indexed Realizability Guilhem Jaber PPS, IRIF, Universite Paris Diderot Realizability in Uruguay 2016 July 19th 2016 1 / 23

How to reason formally on programs ? Program logics (Hoare, Separation, . . . ) Type systems (Dependent, Refinement, . . . ) Denotational models (Domains, Games, . . . ) Syntactic models (Realizability, Logical Relations, . . . ) 2 / 23

Outline of the Talk What we will do: Semantics proof of soundness for a simple call-by-value language with fixed points; Realizability model for a language with refinment types. To show that: Semantic proofs of type soundness give a lot more information than syntactic one (Wright and Felleisen’s“progress and preservations” ); Step-indexing is a great technique to make these proofs feasible; We can abstract over step-indexes using Godel-Lob Logic; Gidel-Lob logic can be embedded into Dependent Type theory. 3 / 23

Contents Semantic proof of type soundness 1 Refinement types 2 Abstracting over step-indexing: Godel-Lob Logic 3 Going further into abstraction: Guarded recursive types 4 4 / 23

A CBV λ -calculus with fixed points def v = x | fix f ( x ) . M | n | true | false ( n ∈ N , x ∈ Var ) def M , N = v | MN | if M then N 1 else N 2 | . . . def • | vK | KM | if K then M else M ′ | . . . K = def τ, σ = Nat | Bool | τ → σ ( fix f ( x ) . M ) v �→ M { v / x }{ fix f ( x ) . M / f } if true then N 1 else N 2 �→ N 1 if false then N 1 else N 2 �→ N 2 M �→ M ′ K [ M ] �→ K [ M ′ ] Γ , x : τ, f : τ → σ ⊢ M : σ Γ ⊢ fix f ( x ) . M : τ → σ 5 / 23

Realizability model Types interpreted as set of terms. def V � Nat � = N def V � Bool � = { true , false } def V � τ → σ � = { fix f ( x ) . M | ∀ v ∈ V � τ � . ( fix f ( x ) . M ) v ∈ E � σ � } def { M | ∀ v . ( M �→ ∗ v ) ⇒ v ∈ V � τ � } E � τ � = def G � Γ � = { γ | ∀ ( x , τ ) ∈ Γ , γ ( x ) ∈ V � τ � } M ∈ E � τ � means that M realizes τ . Theorem (Soundness) If Γ ⊢ M : τ then for all γ ∈ G � Γ � , M { γ } ∈ E � τ � . 6 / 23

Proof of Soundness By induction on the derivation tree of Γ ⊢ M : τ . Interesting case: typing rule for fixed points. Γ , x : τ, f : τ → σ ⊢ M : σ Γ ⊢ fix f ( x ) . M : τ → σ 7 / 23

Proof of Soundness By induction on the derivation tree of Γ ⊢ M : τ . Interesting case: typing rule for fixed points. Γ , x : τ, f : τ → σ ⊢ M : σ Γ ⊢ fix f ( x ) . M : τ → σ Let γ ∈ G � Γ � , we must prove that ( fix f ( x ) . M ) { γ } ∈ E � τ → σ � (?) 7 / 23

Proof of Soundness By induction on the derivation tree of Γ ⊢ M : τ . Interesting case: typing rule for fixed points. Γ , x : τ, f : τ → σ ⊢ M : σ Γ ⊢ fix f ( x ) . M : τ → σ Let γ ∈ G � Γ � , we must prove that ( fix f ( x ) . M ) { γ } ∈ E � τ → σ � (?) i.e. fix f ( x ) . M { γ } ∈ V � τ → σ � (?) 7 / 23

Proof of Soundness By induction on the derivation tree of Γ ⊢ M : τ . Interesting case: typing rule for fixed points. Γ , x : τ, f : τ → σ ⊢ M : σ Γ ⊢ fix f ( x ) . M : τ → σ Let γ ∈ G � Γ � , we must prove that ( fix f ( x ) . M ) { γ } ∈ E � τ → σ � (?) i.e. fix f ( x ) . M { γ } ∈ V � τ → σ � (?) i.e. for all v ∈ V � τ � , ( fix f ( x ) . M { γ } ) v ∈ E � σ � (?) 7 / 23

Proof of Soundness By induction on the derivation tree of Γ ⊢ M : τ . Interesting case: typing rule for fixed points. Γ , x : τ, f : τ → σ ⊢ M : σ Γ ⊢ fix f ( x ) . M : τ → σ Let γ ∈ G � Γ � , we must prove that ( fix f ( x ) . M ) { γ } ∈ E � τ → σ � (?) i.e. fix f ( x ) . M { γ } ∈ V � τ → σ � (?) i.e. for all v ∈ V � τ � , ( fix f ( x ) . M { γ } ) v ∈ E � σ � (?) i.e. M { γ }{ v / x }{ ( fix f ( x ) . M { γ } ) / f } ∈ E � σ � (?) 7 / 23

Proof of Soundness By induction on the derivation tree of Γ ⊢ M : τ . Interesting case: typing rule for fixed points. Γ , x : τ, f : τ → σ ⊢ M : σ Γ ⊢ fix f ( x ) . M : τ → σ Let γ ∈ G � Γ � , we must prove that ( fix f ( x ) . M ) { γ } ∈ E � τ → σ � (?) i.e. fix f ( x ) . M { γ } ∈ V � τ → σ � (?) i.e. for all v ∈ V � τ � , ( fix f ( x ) . M { γ } ) v ∈ E � σ � (?) i.e. M { γ }{ v / x }{ ( fix f ( x ) . M { γ } ) / f } ∈ E � σ � (?) IH: for all γ ′ ∈ G � Γ , x : τ, f : τ → σ � , M { γ ′ } ∈ E � τ → σ � 7 / 23

Proof of Soundness By induction on the derivation tree of Γ ⊢ M : τ . Interesting case: typing rule for fixed points. Γ , x : τ, f : τ → σ ⊢ M : σ Γ ⊢ fix f ( x ) . M : τ → σ Let γ ∈ G � Γ � , we must prove that ( fix f ( x ) . M ) { γ } ∈ E � τ → σ � (?) i.e. fix f ( x ) . M { γ } ∈ V � τ → σ � (?) i.e. for all v ∈ V � τ � , ( fix f ( x ) . M { γ } ) v ∈ E � σ � (?) i.e. M { γ }{ v / x }{ ( fix f ( x ) . M { γ } ) / f } ∈ E � σ � (?) IH: for all γ ′ ∈ G � Γ , x : τ, f : τ → σ � , M { γ ′ } ∈ E � τ → σ � Does γ · [ x �→ v ] · [ f �→ fix f ( x ) . M { γ } ] ∈ G � Γ , x : τ, f : τ → σ � ? 7 / 23

Proof of Soundness By induction on the derivation tree of Γ ⊢ M : τ . Interesting case: typing rule for fixed points. Γ , x : τ, f : τ → σ ⊢ M : σ Γ ⊢ fix f ( x ) . M : τ → σ Let γ ∈ G � Γ � , we must prove that ( fix f ( x ) . M ) { γ } ∈ E � τ → σ � (?) i.e. fix f ( x ) . M { γ } ∈ V � τ → σ � (?) i.e. for all v ∈ V � τ � , ( fix f ( x ) . M { γ } ) v ∈ E � σ � (?) i.e. M { γ }{ v / x }{ ( fix f ( x ) . M { γ } ) / f } ∈ E � σ � (?) IH: for all γ ′ ∈ G � Γ , x : τ, f : τ → σ � , M { γ ′ } ∈ E � τ → σ � Does γ · [ x �→ v ] · [ f �→ fix f ( x ) . M { γ } ] ∈ G � Γ , x : τ, f : τ → σ � ? Only if fix f ( x ) . M { γ } ∈ V � τ → σ � ... That’s problematic ! 7 / 23

Step-Indexing to the rescue ! Idea: Stratify the model using natural numbers as indices ! (Appel & McAllester, Ahmed, . . . ) def V k � Nat � = N def V k � Bool � = { true , false } def V k � τ → σ � = { fix f ( x ) . M | ∀ j ≤ k . ∀ v . v ∈ V j � τ � ⇒ ( fix f ( x ) . M ) v ) ∈ E j � σ � } def { M | ∀ j < k . ∀ v . ( M �→ j v ) ⇒ v ∈ V k − j � τ � } E k � τ � = def G k � Γ � = { ρ | ∀ ( x , τ ) ∈ Γ , ρ ( x ) ∈ V k � τ � } If M reduces in more than k steps to a value (or diverges), then M ∈ E � τ � k !! Theorem (Monotonicity) If M ∈ E k � τ � then for all j ≤ k, M ∈ E j � τ � . 8 / 23

Soundness of the Step-indexed model Theorem (Soundness) If Γ ⊢ M : τ then for all γ ∈ G k � Γ � , M { γ } ∈ E k � τ � . By induction on the derivation tree of Γ ⊢ M : τ and on the step-index k . 9 / 23

Compatibility lemma for the fixed point Let γ ∈ G k � Γ � , we must prove that ( fix f ( x ) . M ) { γ } ∈ E k � τ → σ � (?) 10 / 23

Compatibility lemma for the fixed point Let γ ∈ G k � Γ � , we must prove that ( fix f ( x ) . M ) { γ } ∈ E k � τ → σ � (?) i.e. does fix f ( x ) . ( M { γ } ) ∈ V k � τ → σ � (?) 10 / 23

Compatibility lemma for the fixed point Let γ ∈ G k � Γ � , we must prove that ( fix f ( x ) . M ) { γ } ∈ E k � τ → σ � (?) i.e. does fix f ( x ) . ( M { γ } ) ∈ V k � τ → σ � (?) i.e. for all j ≤ k and v ∈ V j � τ � , does ( fix f ( x ) . M { γ } ) v ∈ E j � σ � (?) 10 / 23

Compatibility lemma for the fixed point Let γ ∈ G k � Γ � , we must prove that ( fix f ( x ) . M ) { γ } ∈ E k � τ → σ � (?) i.e. does fix f ( x ) . ( M { γ } ) ∈ V k � τ → σ � (?) i.e. for all j ≤ k and v ∈ V j � τ � , does ( fix f ( x ) . M { γ } ) v ∈ E j � σ � (?) i.e.does M { γ }{ v / x }{ ( fix f ( x ) . M { γ } ) / f } ∈ E j − 1 � σ � (?) 10 / 23

Compatibility lemma for the fixed point Let γ ∈ G k � Γ � , we must prove that ( fix f ( x ) . M ) { γ } ∈ E k � τ → σ � (?) i.e. does fix f ( x ) . ( M { γ } ) ∈ V k � τ → σ � (?) i.e. for all j ≤ k and v ∈ V j � τ � , does ( fix f ( x ) . M { γ } ) v ∈ E j � σ � (?) i.e.does M { γ }{ v / x }{ ( fix f ( x ) . M { γ } ) / f } ∈ E j − 1 � σ � (?) IH 1 : for all γ ′ ∈ G i � Γ , x : τ, f : τ → σ � , M { γ ′ } ∈ E i � σ � IH 2 : for all i < k , fix f ( x ) . M ) { γ } ∈ E i � τ → σ � 10 / 23

Compatibility lemma for the fixed point Let γ ∈ G k � Γ � , we must prove that ( fix f ( x ) . M ) { γ } ∈ E k � τ → σ � (?) i.e. does fix f ( x ) . ( M { γ } ) ∈ V k � τ → σ � (?) i.e. for all j ≤ k and v ∈ V j � τ � , does ( fix f ( x ) . M { γ } ) v ∈ E j � σ � (?) i.e.does M { γ }{ v / x }{ ( fix f ( x ) . M { γ } ) / f } ∈ E j − 1 � σ � (?) IH 1 : for all γ ′ ∈ G i � Γ , x : τ, f : τ → σ � , M { γ ′ } ∈ E i � σ � IH 2 : for all i < k , fix f ( x ) . M ) { γ } ∈ E i � τ → σ � Does ( γ · [ x �→ v ] · [ f �→ fix f ( x ) . M { γ } ]) ∈ G j − 1 � Γ , x : τ, f : τ → σ � ? 10 / 23