Engineering formal metatheory

Abstract

Machine-checked proofs of properties of programming languages have become a critical need, both for increased confidence in large and complex designs and as a foundation for technologies such as proof-carrying code. However, constructing these proofs remains a black art, involving many choices in the formulation of definitions and theorems that make a huge cumulative difference in the difficulty of carrying out large formal developments. The representation and manipulation of terms with variable binding is a key issue.We propose a novel style for formalizing metatheory, combining locally nameless representation of terms and cofinite quantification of free variable names in inductive definitions of relations on terms (typing, reduction, . . . ). The key technical insight is that our use of cofinite quantification obviates the need for reasoning about equivariance (the fact that free names can be renamed in derivations); in particular, the structural induction principles of relations defined using cofinite quantification are strong enough for metatheoretic reasoning, and need not be explicitly strengthened. Strong inversion principles follow (automatically, in Coq) from the induction principles. Although many of the underlying ingredients of our technique have been used before, their combination here yields a significant improvement over other methodologies using first-order representations, leading to developments that are faithful to informal practice, yet require no external tool support and little infrastructure within the proof assistant.We have carried out several large developments in this style using the Coq proof assistant and have made them publicly available. Our developments include type soundness for System F<: and core ML (with references, exceptions, datatypes, recursion, and patterns) and subject reduction for the Calculus of Constructions. Not only do these developments demonstrate the comprehensiveness of our approach; they have also been optimized for clarity and robustness, making them good templates for future extension.

A Formalized General Theory of Syntax with Bindings

“…To our knowledge, none of the existing frameworks provides support for substitution and the interpretation of terms in semantic domains at this level of generality. Consequently, formalizations for concrete syntaxes, even those based on sophisticated packages such as Nominal Isabelle or the similar tools and formalizations in Coq [2,3,29], have to redefine these standard concepts and prove their properties over and over again-an unnecessary consumption of time and brain power.…”

“…While the "exists" variant is useful when proving that two terms are alpha-equivalent, the "forall" variant gives stronger inversion and induction rules for proving implications from alpha. (Such fruitful "exsist-fresh/forall-fresh," or "some-any" dychotomies have been previously discussed in the context of bindings, e.g, in [3,34,41].)…”

“…What we presented so far was actually a simple version of primitive recursion called iteration. The difference between the two is illustrated by the following simple example: 3 The predecessor function pred : nat → nat is defined by pred 0 = 0 and pred (Suc n) = n. This does not fit the iteration scheme, where only the value of the function on smaller arguments, and not the arguments themselves, can be used. In the example, iteration would allow pred (Suc n) to invoke recursively pred n, but not n. Of course, we can simulate recursion by iteration if we are allowed an auxiliary output: defining pred : nat → nat × nat by iteration, pred 0 = (0, 0) and pred (Suc n) = case pred n of (n 1 , n 2 ) ⇒ (n 1 , _), and then taking pred n to be the first component of pred n. (See also [46, §1.4.2].)…”

A path to DOT: formalizing fully path-dependent types

“…The pDOT calculus is formalized using the locally nameless representation with cofinite quantification [Aydemir et al 2008] in which free variables are represented as named variables, and bound variables are represented as de Bruijn indices.…”

Pure Type Systems without Explicit Contexts

“…Based on the methodology described in [1], we have combined the locally nameless presentation with co-finite quantification to obtain strong induction principles. To be sure that our co-finite presentation is adequate we have proved it to be equivalent to an exists-fresh presentation.…”