Toward a machine-certified correctness proof of Wand’s type reconstruction algorithm Sunil Kothari

James L. Caldwell

Department of Computer Science University of Wyoming Laramie, USA

Department of Computer Science University of Wyoming Laramie, USA

[email protected]

[email protected]

def

e

ABSTRACT

σ(τ1 = τ2 )

Although there are machine-certified proofs of correctness of Alg. W and Alg. J, we know of no machine-checked correctness proof of Wand’s type reconstruction algorithm. We give here a brief description of our progress on a machinecertified proof of correctness of Wand’s algorithm. Correctness is given in terms of completeness and soundness with respect to the Hindley-Milner type system. Also, we have verified the MGU axioms using the Coq’s finite map library.

σ((x, τ ) :: Γ)

=

def

=

e

σ(τ1 ) = σ(τ2 ) (x, σ(τ )) :: σ(Γ)

e

We write σ |= (τ1 = τ2 ), if σ(τ1 ) = σ(τ2 ),i.e. σ is a unifier of τ1 and τ2 . We extend this notion to a set of constraints and we write σ |= C if and only if for every c ∈ C, σ |= c. A unifier σ is the most general unifier (MGU) if there is a substitution σ 0 such that for any other unifier σ 00 , σ ◦ σ 0 ≈ σ 00 , where substitution composition (◦) is defined as: def

σ ◦ σ 0 (τ ) = σ 0 (σ(τ ))

and extensionality on substitutions (≈) is defined as:

1.

def

σ ≈ σ 0 = ∀α. σ(α) = σ 0 (α)

INTRODUCTION

Type reconstruction algorithms can be broadly categorized into two categories: substitution-based and constraint-based. This categorization is based on whether the algorithms generate and solve constraints intermittently (substitution-based) or separately (constraint-based). There is now a trend toward constraint-based algorithms/frameworks [7, 3, 5, 9]. Although there are various machine-checked correctness proofs of Alg. W [6, 2, 8], we know of no previous machine-checked correctness proof of any constraint-based algorithms. We are working on a machine-checked correctness proof of Wand’s algorithm [9] in Coq [1]. Our current work is a step toward machine-certified proof of correctness of our extension to Wand’s algorithm to polymorphic let [5], which is a variant of the one presented in [7, 3]. We have adopted the following conventions in this paper: atomic types (of the form Tvar x) are denoted by α, β, α0 etc.; compound types by τ, τ 0 , τ1 etc.; substitutions by σ, σ 0 , σ1 etc. We consider the language of pure untyped lambda terms. Λ ::= x | M N | λx.M where x ∈ Var and M, N ∈ Λ.

The types for the terms of the above language is given by the following grammar: τ ::=

Tvar x | τ1 → τ2 where x ∈ N and τ1 , τ2 ∈ τ .

One of the most important issues in machine checked correctness proofs of the type reconstruction algorithms is the representation used for substitutions and most general unifiers. To a large extent, this representation determines the kind of reasoning needed for substitutions. The type reconstruction verification literature has substitutions represented as normal functions, list of pairs, and a set of pairs. We represent substitution as finite functions and use the Coq finite map library Coq.FSets.FMapInterface, which provides an axiomatic presentation of finite maps and a number of supporting implementations. However, the finite map library (ver. 8.1.pl3) that we used does not provide an induction principle and forward reasoning is often needed for reasoning about some simple lemmas. Despite these limitations, the library is powerful and expressive.

2.

CORRECTNESS PROOF OVERVIEW

Correctness is given in term of completeness and soundness with respect to the Hindley-Milner type system given below in Table 1. Judgments are denoted by Γ  M : τ and can be read as “in the type environment Γ, M has type τ ”. We write ` Γ  M : τ to denote that judgment Γ  M : τ has a derivation in the Hindley Milner type system. hx, τ i ∈ Γ is the leftmost binding Γ x:τ

(HM-Var)

e

Constraints are of the form τ1 = τ2 , where τ1 , τ2 ∈ τ . A type environment is a list of pairs of type Var × τ . A substitution is a finite function from N to types. Substitution application to a type is defined as: def σ (Tvar (n)) = if hn, τ i ∈ σ then τ else Tvar(n) def

σ (τ1 → τ2 ) = σ(τ1 ) → σ(τ2 ) Substitution application to a constraint and type environment are defined similarly:

(x, τ ) :: Γ  M : τ 0 Γ  λx.M : τ → τ 0 Γ  M : τ0 → τ Γ  N : τ0 Γ  MN : τ

(HM-Abs)

(HM-App)

Table 1: Modified Hindley-Milner type system

search type env(x, Γ) = Some τ e

Wand(Γ, x, n0 ) = (Some {Tvar(n0 ) = τ }, n0 + 1)

(W-Var)

Wand(((x : Tvar(n0 + 1)) :: Γ), M, n0 + 2) = (Some C, n1 ) e

Wand(Γ, λx.M, n0 ) = (Some {Tvar(n0 ) = Tvar(n0 + 1) → Tvar(n0 + 2)} ∪ C, n1 ) Wand(Γ, M, n0 + 1) = (Some C0 , n1 )

Wand(Γ, N, n1 ) = (Some C00 , n2 ) e

Wand(Γ, M N, n0 ) = (Some {Tvar(n0 + 1) = Tvar(n1 ) → Tvar(n0 )} ∪ C0 ∪ C00 , n2 )

(W-Abs)

(W-App)

Table 2: Rule-based description of Wand’s algorithm Our experience shows that the above presentation of type system is easier to reason than the standard representation of Hindley-Milner type systems, where the existing binding of x is removed from the type environment in the rule HMAbs. By considering the leftmost binding in the HM-Var rule, we get the same effect as the traditional Hindley-Milner type system. In hindsight, we might have used finite maps to represent type environments as well. Wand’s original description of the algorithm does not easily lend itself to formalization. Our efforts to formalize it lead to a number of changes in its presentation. The modified version of Wand’s algorithm is shown in Table 2 and the changes are described below:

i) Failure has to be made explicit. We use Coq’s option type to represent failure. For example, in the rule WVar, if the function search typ env is unable to find a binding, it returns a None, otherwise it returns Some τ , where τ is the binding of x in Γ. This failure to find a binding is reflected in the constraint generation too. All calls to Wand now result in either Some C or None, meaning that constraint generation might fail, unlike Wand’s algorithm. ii) Freshness is now explicit - a freshness counter is threaded through the entire algorithm to keep track of the fresh type variables introduced so far. The freshness counter also serves as the initial type of a term - by lifting the counter to a type by applying the constructor Tvar, unlike Wand’s original description where a type is passed as an argument. iii) In W-App rule, an additional constraint is added to the constraints generated by the recursive calls, unlike Wand’s original description. This corresponds to a strengthened induction hypothesis.

With the changes above, Wand algorithm will always return a principal type, if the term is typable and the initial type environment is empty. The modified description helps us to account for both principal as well as non-principal HindleyMilner derivations in the completeness theorem (mentioned below). In Wand’s original paper, the correctness of his algorithm is stated as an invariant preservation in all steps of the algorithm. Our soundness and completeness theorem are stated rather differently:

Theorem 1 (Soundness). ∀Γ, ∀M, ∀σ, ∀n, ∀n0 , ∀C. Wand(Γ, M, n) = (Some C, n0 ) ∧ unify C = Some σ ⇒ ` σ(Γ) HM M : σ(τ ) The completeness theorem is more involved, and also involves a notion of freshness of type variables (with respect to the type environment): Theorem 2 (Completeness). ∀Γ0 , ∀M, ∀τ. ` Γ0 HM M : τ ⇒ ∀Γ, ∀n.(∃σ. σ(Γ) = Γ0 ) ∧ fresh env n Γ ⇒ ∀C, ∀n0 .Wand(Γ, M, n) = (Some C, n0 ) ∧ ∃σ 0 .unify C = Some σ 0 ⇒ ∃σ 00 .(σ 0 ◦ σ 00 )(Tvar(n)) = τ ∧ (σ 0 ◦ σ 00 )(Γ) = Γ0 The unify used in both the theorems above refers to the firstorder unification algorithm. Existing literature on machinecertified correctness proofs of type reconstruction algorithms have axiomatized the behavior of unification algorithm as a set of four axioms. We have generalized the standard presentation of those axioms to specify the MGU of a list of equational constraints and we have formally verified that the unification algorithm does satisfies those axioms [4].

3.

CURRENT STATUS AND FUTURE WORK

The entire exercise has currently exceeded 8000 lines of Coq specification and tactics. So far we have proved the soundness. Interestingly, the concept of freshness is not needed in the soundness. The completeness proof turns out to be much more complicated to reason about. We are sure about the proof argument, but it is still a work-in-progress. We believe the proofs of MGU axioms will come in handy. As of now, the types do not require binders. Therefore, binding has not been an issue. This will change when we do the correctness proof of an extension of Wand’s type reconstruction algorithm, since polymorphic-let introduces a universally quantified type constructor to the language of types. Other important steps in the correctness proof of our extension are a formalization of the replacement lemma [10] and verification of the ptol transformation [5], a type and value preserving desugaring of polymorphic let.

4.

REFERENCES

[1] T. Coq development team. The Coq proof assistant reference manual. INRIA, LogiCal Project, 2007. Version 8.1.3.

[2] C. Dubois and V. M. Morain. Certification of a type inference tool for ML: Damas–milner within Coq. J. Autom. Reason., 23(3):319–346, 1999. [3] B. Heeren. Top Quality Type Error Messages. PhD thesis, Universitiet Utrecht, 2005. [4] S. Kothari and J. Caldwell. A machine checked model of MGU axioms: applications of finite maps and functional induction. 2009. To be presented at UNIF’09. [5] S. Kothari and J. L. Caldwell. On Extending Wand’s Type Reconstruction Algorithm to Handle Polymorphic Let. Local Proceedings of the Fourth Conference on Computability in Europe, 15(5):795–825, June 2008. [6] W. Naraschewski and T. Nipkow. Type Inference Verified: Algorithm W in Isabelle/HOL. J. Autom. Reason., 23(3):299–318, 1999. [7] F. Pottier and D. R´emy. The essence of ML type inference. In B. C. Pierce, editor, Advanced Topics in Types and Programming Languages, chapter 10, pages 389–489. MIT Press, 2005. [8] C. Urban and T. Nipkow. From Semantics to Computer Science, chapter Nominal verification of algorithm W. Cambridge University Press, Not yet published 2009. [9] M. Wand. A Simple Algorithm and Proof for Type Inference. Fundamenta Informaticae, 10:115–122, 1987. [10] A. K. Wright and M. Felleisen. A Syntactic Approach to Type Soundness. Information and Computation, 115(1):38–94, 1994.

## Toward a machine-certified correctness proof of Wand's ...

verified the MGU axioms using the Coq's finite map library. 1. ... tions, the library is powerful and expressive. .... inference tool for ML: Damasâmilner within Coq.

#### Recommend Documents

Correctness proof of a new protocol for selfishness nodes ... - LSI
The resource limitation of nodes used in the ad hoc network, particulary the energy ... Definition 4 (Host state:) A host state Mh is a marking reachable from any ... have just to prove that when the monitoring node A sends n packets to B, then if ..

Correctness proof of a new protocol for selfishness nodes ... - LSI
E â mail: [email protected] ... E â mail: [email protected] ... Definition 4 (Host state:) A host state Mh is a marking reachable from any marking M ...

Proof Without Words: A Trigonometric Proof of the Arithmetic Mean ...
We prove wordlessly the arithmetic mean-geometric mean inequality for two positive numbers by an equivalent trigonometric inequality. Reference. 1. L. Tan, Proof without words: Eisenstein's duplication formula, Math. Mag. 71 (1998) 207, http:// · dx.

Toward a phylogenetic system of bioiogkal ... - ScienceDirect.com
development of a phylogenetic system of nomenclature requires reformulating these concepts and principles so that they are no longer based on the Linnean.

Toward a Biology of Collectivism.pdf
... below to open or edit this item. Toward a Biology of Collectivism.pdf. Toward a Biology of Collectivism.pdf. Open. Extract. Open with. Sign In. Main menu.

Toward a Model of Mobile User Engagement
conceptual framework for studying mobile information interaction. ... aesthetic appeal, and endurability for the mobile environment. .... mobile devices for social networking purposes. However, .... of perceived visual aesthetics of Web sites.

Toward a Poetics of Code
Brooklyn, NY USA [email protected] .... developers do not always understand their work with code as taking place within this sphere. Reports, such as ...

Correctness of Gossip-Based Membership under Message Loss
not made or distributed for profit or commercial advantage and that copies bear this notice ..... An important advantage ...... Wireless Ad Hoc Networks. In ACM ...

Context Lemma and Correctness of ... - Research at Google
Jan 13, 2006 - In contrast to other approaches our syntax as well as semantics does not make use of ..... (letrec x1 = s1,...,xi = (letrec Env2 in si),...,xn = sn in r).

Correctness of Gossip-Based Membership under ...
networks over the Internet, in data centers, and computation grids. ...... [6] F. Bonnet, Performance analysis of Cyclon, an inexpensive membership management ...

A Synthetic Proof of Goormaghtigh's Generalization of ...
Jan 24, 2005 - Câ respectively the reflections of A, B, C in the side BC, CA, AB. The following interesting theorem was due to J. R. Musselman. Theorem 1 (Musselman [2]). The circles AOA. â. , BOB. â. , COC. â meet in a point which is the inv

A simple proof of the nonconcavifiability of functions ...
journal homepage: www.elsevier.com/locate/jmateco. Short communication ... have shown that such a quasiconcave function is not concavifiable,. i.e., that no ...

Correctness of Gossip-Based Membership under ...
SIGCOMM Comput. Commun. Rev.,. 29(4):289â299, 1999. [23] S. Voulgaris, D. Gavidia, and M. van Steen. CYCLON: Inexpensive Membership Management for ...

Proof of pudding.pdf
Page. 1. /. 1. Loadingâ¦ Page 1 of 1. Page 1 of 1. Proof of pudding.pdf. Proof of pudding.pdf. Open. Extract. Open with. Sign In. Main menu. Displaying Proof of pudding.pdf. Page 1 of 1.

EUPHEMISMS AND POLITICAL CORRECTNESS (1).pdf ...
EUPHEMISMS AND POLITICAL CORRECTNESS (1).pdf. EUPHEMISMS AND POLITICAL CORRECTNESS (1).pdf. Open. Extract. Open with. Sign In.

Political Correctness as Anti-Herding
The idea behind this proposition is the fact that in an informative equilibrium the message sent carries some ... period so that her voice is heard in the next period. ..... Professional advice. Journal of Economic Theory. 126, 120-142.41. [13] Ottav

Verifying the Correctness of FPGA Logic Synthesis Algorithms
Though verification is significantly easier for FPGA-based digital systems than .... synthesis algorithms. The standard methods for ensuring software quality involve regression tests, algorithm and code reviews, assertions and cross-check code and mu

Correctness of Gossip-Based Membership under Message Loss
and have a bounded degree (number of neighbors). Addition- ally, the âholy grailâ for ...... Inexpensive Membership Management for Unstructured. P2P Overlays.

TOWARD A POLITICAL ECONOMY OF BASIC ...
BY. WENDY OLSON. A dissertation submitted in partial fulfillment of the requirements for the degree of ..... admissions at CUNY in the 1970s, as the birth of basic writing as a field. And, to an extent ...... New Jersey: Princeton. University Press .

Toward a Theory of Regulation for Developing Countries
Aug 24, 2009 - and management have not improved perfor- mance ..... the firm's control, such as factor prices or ...... to adjust the pricing of energy they need to.

Toward a simulation-based tool for the treatment of ... - ScienceOpen
May 2, 2011 - the most common illnesses that affects voice production is partial weakness of the ..... of the IBM can be found in Reference (Mittal et al., 2008). To minimize the use ...... access article subject to a non-exclusive license between ..