The Nominal Datatype Package in Isabelle/HOL Christian Urban - PowerPoint PPT Presentation

The Nominal Datatype Package in Isabelle/HOL Christian Urban University of Munich joint work with Stefan Berghofer, Markus Wenzel, Alexander Krauss. . . Not tingham, 18. April 2006 – p.1 (1/1)

The POPLmark-Challenge “How close are we to a world where program- ming language papers are routinely supported by machine-checked metatheory proofs, where full-scale language definitions are expressed in machine-processed mathematics. . . ?” Obviously we aren’t there yet: for binders reasonable powerful tools are available: de-Bruijn indices (in Coq, Isabelle,. . . ) or HOAS (mainly in Twelf) but apart from some theorem-proving experts, nobody seems to use them; non-experts are still routinely do their proofs on paper, only Not tingham, 18. April 2006 – p.2 (1/2)

The POPLmark-Challenge “How close are we to a world where program- The aim of the nominal datatype ming language papers are routinely supported package is to support the kind of by machine-checked metatheory proofs, where reasoning that is employed on paper. full-scale language definitions are expressed in The hope is: if you can do formal machine-processed mathematics. . . ?” proofs on paper, then you can Obviously we aren’t there yet: implement them in Isabelle/HOL with ease. for binders reasonable powerful tools are available: de-Bruijn indices (in Coq, Isabelle,. . . ) or That is not a trivial task. HOAS (mainly in Twelf) but apart from some theorem-proving experts, nobody seems to use them; non-experts are still routinely do their proofs on paper, only Not tingham, 18. April 2006 – p.2 (2/2)

x 6� y and x 62 F V ( L ) , then M [ x := N ℄[ y := L ℄ � M [ y := L ℄[ x := N [ y := L ℄℄ . M . Substitution Lemma: If � Case 1: M is a variable. M � x . Then both sides equal N [ y := L ℄ since x 6� y . Proof: By induction on the structure of M � y . Then both sides equal L , for x 62 F V ( L ) L [ x := : : : ℄ � L . This is a simple example illustrating M � z 6� x; y . Then both sides equal z . Case 1.1. � Case 2: M � �z :M Case 1.2. 1 . By the variable convention we may assume a point. We have already z 6� x; y and z is not free in N ; L . Then by induction hypothesis implies implemented much more complicated ( �z :M )[ x := N ℄[ y := L ℄ 1 Case 1.3. � proofs, e.g. Church-Rosser, SN, �z : ( M [ x := N ℄[ y := L ℄) 1 that � �z : ( M [ y := L ℄[ x := N [ y := L ℄℄) 1 transitivity of subtyping in � ( �z :M )[ y := L ℄[ x := N [ y := L ℄℄ . 1 POPLmark, etc. � Case 3: M � M M 1 2 . The statement follows again from the induc- � tion hypothesis. Not tingham, 18. April 2006 – p.3 (1/8)

x 6� y and x 62 F V ( L ) , then M [ x := N ℄[ y := L ℄ � M [ y := L ℄[ x := N [ y := L ℄℄ . M . Substitution Lemma: If � Case 1: M is a variable. M � x . Then both sides equal N [ y := L ℄ since x 6� y . Proof: By induction on the structure of M � y . Then both sides equal L , for x 62 F V ( L ) L [ x := : : : ℄ � L . M � z 6� x; y . Then both sides equal z . Case 1.1. � Case 2: M � �z :M Case 1.2. 1 . By the variable convention we may assume z 6� x; y and z is not free in N ; L . Then by induction hypothesis implies ( �z :M )[ x := N ℄[ y := L ℄ 1 Case 1.3. � �z : ( M [ x := N ℄[ y := L ℄) 1 that � �z : ( M [ y := L ℄[ x := N [ y := L ℄℄) 1 � ( �z :M )[ y := L ℄[ x := N [ y := L ℄℄ . 1 � Case 3: M � M M 1 2 . The statement follows again from the induc- � tion hypothesis. Not tingham, 18. April 2006 – p.3 (2/8)

x 6� y and x 62 F V ( L ) , then M [ x := N ℄[ y := L ℄ � M [ y := L ℄[ x := N [ y := L ℄℄ . M . Substitution Lemma: If � Case 1: M is a variable. M � x . Then both sides equal N [ y := L ℄ since x 6� y . Proof: By induction on the structure of M � y . Then both sides equal L , for x 62 F V ( L ) L [ x := : : : ℄ � L . M � z 6� x; y . Then both sides equal z . Case 1.1. � Case 2: M � �z :M Case 1.2. 1 . By the variable convention we may assume z 6� x; y and z is not free in N ; L . Then by induction hypothesis implies ( �z :M )[ x := N ℄[ y := L ℄ 1 Case 1.3. � �z : ( M [ x := N ℄[ y := L ℄) 1 that � �z : ( M [ y := L ℄[ x := N [ y := L ℄℄) 1 � ( �z :M )[ y := L ℄[ x := N [ y := L ℄℄ . 1 � Case 3: M � M M 1 2 . The statement follows again from the induc- � tion hypothesis. Not tingham, 18. April 2006 – p.3 (3/8)

x 6� y and x 62 F V ( L ) , then M [ x := N ℄[ y := L ℄ � M [ y := L ℄[ x := N [ y := L ℄℄ . M . Substitution Lemma: If � Case 1: M is a variable. M � x . Then both sides equal N [ y := L ℄ since x 6� y . Proof: By induction on the structure of M � y . Then both sides equal L , for x 62 F V ( L ) L [ x := : : : ℄ � L . M � z 6� x; y . Then both sides equal z . Case 1.1. � Case 2: M � �z :M Case 1.2. 1 . By the variable convention we may assume z 6� x; y and z is not free in N ; L . Then by induction hypothesis implies ( �z :M )[ x := N ℄[ y := L ℄ 1 Case 1.3. � �z : ( M [ x := N ℄[ y := L ℄) 1 that � �z : ( M [ y := L ℄[ x := N [ y := L ℄℄) 1 � ( �z :M )[ y := L ℄[ x := N [ y := L ℄℄ . 1 � Case 3: M � M M 1 2 . The statement follows again from the induc- � tion hypothesis. Not tingham, 18. April 2006 – p.3 (4/8)

x 6� y and x 62 F V ( L ) , then M [ x := N ℄[ y := L ℄ � M [ y := L ℄[ x := N [ y := L ℄℄ . M . Substitution Lemma: If � Case 1: M is a variable. M � x . Then both sides equal N [ y := L ℄ since x 6� y . Proof: By induction on the structure of M � y . Then both sides equal L , for x 62 F V ( L ) L [ x := : : : ℄ � L . M � z 6� x; y . Then both sides equal z . Case 1.1. � Case 2: M � �z :M Case 1.2. 1 . By the variable convention we may assume z 6� x; y and z is not free in N ; L . Then by induction hypothesis implies ( �z :M )[ x := N ℄[ y := L ℄ 1 Case 1.3. � �z : ( M [ x := N ℄[ y := L ℄) 1 that � �z : ( M [ y := L ℄[ x := N [ y := L ℄℄) 1 � ( �z :M )[ y := L ℄[ x := N [ y := L ℄℄ . 1 � Case 3: M � M M 1 2 . The statement follows again from the induc- � tion hypothesis. Not tingham, 18. April 2006 – p.3 (5/8)

x 6� y and x 62 F V ( L ) , then M [ x := N ℄[ y := L ℄ � M [ y := L ℄[ x := N [ y := L ℄℄ . M . Substitution Lemma: If � Case 1: M is a variable. M � x . Then both sides equal N [ y := L ℄ since x 6� y . Proof: By induction on the structure of M � y . Then both sides equal L , for x 62 F V ( L ) L [ x := : : : ℄ � L . M � z 6� x; y . Then both sides equal z . Case 1.1. � Case 2: M � �z :M Case 1.2. 1 . By the variable convention we may assume z 6� x; y and z is not free in N ; L . Then by induction hypothesis implies ( �z :M )[ x := N ℄[ y := L ℄ 1 Case 1.3. � �z : ( M [ x := N ℄[ y := L ℄) 1 that � �z : ( M [ y := L ℄[ x := N [ y := L ℄℄) 1 � ( �z :M )[ y := L ℄[ x := N [ y := L ℄℄ . 1 � Case 3: M � M M 1 2 . The statement follows again from the induc- � tion hypothesis. Not tingham, 18. April 2006 – p.3 (6/8)

y 6 = x and x 62 F V ( N ) then x 6� y and x 62 F V ( L ) , then ( �y :M )[ x := N ℄ = �y : ( M [ x := N ℄) M [ x := N ℄[ y := L ℄ � M [ y := L ℄[ x := N [ y := L ℄℄ . ( �z :M )[ x := N ℄[ y := L ℄ M . 1 Remember: only if Substitution Lemma: If 1 � Case 1: M is a variable. � ( �z : ( M [ x := N ℄))[ y := L ℄ 1 M � x . Then both sides equal N [ y := L ℄ since x 6� y . 2 � �z : ( M [ x := N ℄[ y := L ℄) 1 Proof: By induction on the structure of M � y . Then both sides equal L , for x 62 F V ( L ) � �z : ( M [ y := L ℄[ x := N [ y := L ℄℄) 1 L [ x := : : : ℄ � L . 2 M � z 6� x; y . Then both sides equal z . Case 1.1. � ( �z : ( M [ y := L ℄))[ x := N [ y := L ℄℄) ! ! 1 1 � Case 2: M � �z :M Case 1.2. 1 . By the variable convention we may assume � ( �z :M )[ y := L ℄[ x := N [ y := L ℄℄ . ! 1 IH z 6� x; y and z is not free in N ; L . Then by induction hypothesis implies ( �z :M )[ x := N ℄[ y := L ℄ 1 Case 1.3. � �z : ( M [ x := N ℄[ y := L ℄) 1 that � �z : ( M [ y := L ℄[ x := N [ y := L ℄℄) 1 � ( �z :M )[ y := L ℄[ x := N [ y := L ℄℄ . 1 � Case 3: M � M M 1 2 . The statement follows again from the induc- � tion hypothesis. Not tingham, 18. April 2006 – p.3 (7/8)