Verifying haskell programs using constructive type theory

This paper describes a fibrational categorical semantics for the modal necessity-only fragment of constructive modal type theory, both with and without dependent types. Constructive type theory does not usually discuss logical modalities, and modalities tend to be mostly studied within classical logic, not within type theory. But modalities should be very useful in type theory, as they are very useful in modelling theoretical computing systems. Providing constructive versions of modal logics and their associated Curry-Howard modal type theories is also a very productive program, e.g. helpful when dealing with computational effects, staged computation, and functional reactive types, for example. There seems to be renewed interest in the notion of constructive modal type theory (and in notions of linear type theory), in part because of the interest in homotopy type theory. The modal type theory presented here uses dependent types, in the style of Ritter's categorical models of the Calculus of Constructions. To build up to these, we first discuss the kinds of constructive modal type theory in the literature. Then we provide a non-dependent modal type theory, introduced in previous work, that we generalize to dependent types in the following section. Dependent type theories are usually but not always given categorical semantics in terms of fibrations. We provide semantics in terms of fibrations for both the non-dependent and the dependent type systems discussed and prove them sound and complete, thereby providing evidence that the type theory is meaningful. These fibrational models should be also applicable to the homotopy type theory setting.

In this article we continue the work started in [Ernesto Copello, Álvaro Tasistro, Nora Szasz, Ana Bove, and Maribel Fernández. Alpha-structural induction and recursion for the λ-calculus in constructive type theory. Electronic Notes in Theoretical Computer Science, 323:109–124, 2016], deriving in Constructive Type Theory new induction principles for the λ-calculus, using (the historical) first order syntax with only one sort of names for both bound and free variables, and with α-conversion based upon name swapping. The principles provide a flexible framework for mimicking pen-and-paper proofs within the rigorous formal setting of a proof assistant. We here report on one successful application, namely a complete proof of the Church-Rosser Theorem. The whole development has been machine-checked using the system Agda [Ulf Norell. Towards a Practical Programming Language Based on Dependent Type Theory. PhD thesis, Department of Computer Science and Engineering, Chalmers University of Technology, September 2007].

It is well-known that simple type theory is complete with respect to non-standard models. Completeness for standard models only holds when increasing the class of models, e.g., to cartesian closed categories. Similarly, dependent type theory is complete for locally cartesian closed categories. However, it is usually difficult to establish the coherence of interpretations of dependent type theory, i.e., to show that the interpretations of equal expressions are indeed equal. Several classes of models have been used to remedy this problem. We contribute to this investigation by giving a semantics that is both coherent and sufficiently general for completeness while remaining relatively easy to compute with. Our models interpret types of Martin-Lof's extensional dependent type theory as sets indexed over posets or, equivalently, as fibrations over posets. This semantics can be seen as a generalization to dependent type theory of the interpretation of intuitionistic first-order logic in Kripke models. This yields a simple coherent model theory with respect to which simple and dependent type theory are sound and complete.

Quotient topologies in constructive set theory and type theory

We give two finite axiomatizations of indexed inductive-recursive definitions in intuitionistic type theory. They extend our previous finite axiomatizations of inductive-recursive definitions of sets to indexed families of sets and encompass virtually all definitions of sets which have been used in intuitionistic type theory. The more restricted of the two axiomatization arises naturally by considering indexed inductive-recursive definitions as initial algebras in slice categories, whereas the other admits a more general and convenient form of an introduction rule.The class of indexed inductive-recursive definitions properly contains the class of indexed inductive definitions (so called “inductive families”). Such definitions are ubiquitous when using intuitionistic type theory for formalizing mathematics and program correctness. A side effect of the present paper is to get compact finite axiomatizations of indexed inductive definitions in intuitionistic type theory as special cases.Proper indexed inductive-recursive definitions (those which do not correspond to indexed inductive definitions) are useful in intuitionistic metamathematics, and as an example we formalize Tait-style computability predicates for dependent types. We also show that Palmgren’s prooftheoretically strong construction of higher-order universes is an example of a proper indexed inductive-recursive definition. A third interesting example is provided by Bove and Capretta’s definition of termination predicates for functions defined by nested recursion.Our axiomatizations form a powerful foundation for generic programming with dependent types by introducing a type of codes for indexed inductive-recursive definitions and making it possible to define generic functions by recursion on this type.KeywordsDependent type theoryMartin-Löf Type Theoryinductive definitionsinductive-recursive definitionsinductive familiesinitial algebrasnormalization proofsgeneric programming

Constructs that involve taking a quotient are commonplace in mathematics. Here I will consider how they are treated within dependent type theory. The notion of quotient type has its origins in the Nuprl theorem-proving system [R. L. Constable et al., 1986] for extensional type theory. Later Hofmann formulated a version for intensional type theory in his thesis [M. Hofmann, 1995]. This depends on having a pre-existing notion of intensional identity type. Hofmann used Martin-Löf’s notion, the indexed family inductively generated from proofs of reflexivity [B. Nordström et al., 1990]. The recent homotopical view of identity in terms of path types [The Univalent Foundations Program, 2013] gives a more liberal perspective and has brought with it the notion of higher inductive type (HIT) [P. L. Lumsdaine and M. Shulman, 2019], subsuming both inductive and quotient types. Inductively defined indexed families of types (in all their various forms) are perhaps the most useful concept that dependent type theory has contributed to the practice of computer assistance for formalizing mathematical proofs. However, it is often the case that a particular application of such types needs not only to inductively generate a collection of objects, but also to make identifications between the objects. In classical mathematics one can first generate and then identify, using the Axiom of Choice to lift infinitary constructions to the quotient. HITs can allow one to avoid such non-constructive uses of choice by inter-twining generation and identification. Perhaps more important than the constructive/non-constructive issue is that simultaneously declaring how to generate and how to identify can be a very natural way of defining some construct from the user’s point of view. This is why HITs promise to be so useful, once we have robust and convenient mechanisms in theorem-proving systems for defining HITs and defining functions out of HITs. Although some HITs have been axiomatized in various systems, at the moment the only system I know of with built in support for defining quite general forms of HIT and using them is the implementation of cubical type theory [C. Cohen et al., 2018] within recent versions of the Agda system [A. Vezzosi et al., 2019]. The higher dimensional aspect of identity in cubical type theory is fascinating; nevertheless, the simpler one-dimensional version of identity, in which one has uniqueness of identity proofs (UIP), is adequate for many applications. Although some regard UIP as a bug of early versions of Agda with it’s original form of dependent pattern matching [T. Coquand, 1992], it is by choice a feature of the Lean prover [J. Avigad et al., 2020]. Altenkirch and Kaposi [T. Altenkirch and A. Kaposi, 2016] have termed the one-dimensional version of HITs quotient inductive types (QITs) and they promise to be very useful even in the setting of type theory with UIP. In this talk I survey some of these developments, including a recent reduction of QITs to quotients [M. P. Fiore et al., 2020], and the prospects for better support in theorem-provers for quotient constructions.

The aim of this book is to show how constructive type theory, in the form developed by Per Martin-Löf, helps us to understand the structure of natural language. The study of similar questions within simple (=classical) type theory was inaugurated by Frege and given a standard of technical detail by Montague. The point of shifting to constructive type theory is not in the constructivist criticism against classical reasoning, but in the positive observation that constructive type theory has new things to say. Some of the problems to which grammars based on classical type theory have not found satisfactory solutions will be shown to require precisely these new things. These problems appear in a simple form in what is known, since Geach, as donkey sentences. But they are repeated in other guises, for example, in the functioning of tenses, and in a larger scale, such as in the progressive structure of texts, and in the significance of context in communication.

Proof assistants are getting more widespread use in research and industry to provide certified and independently checkable guarantees about theories, designs, systems and implementations. However, proof assistant implementations themselves are seldom verified, although they take a major share of the trusted code base in any such certification effort. In this area, proof assistants based on Higher-Order Logic enjoy stronger guarantees, as self-certified implementations have been available for some years. One cause of this difference is the inherent complexity of dependent type theories together with their extensions with inductive types, universe polymorphism and complex sort systems, and the gap between theory on paper and practical implementations in efficient programming languages. MetaCoq is a collaborative project that aims to tackle these difficulties to provide the first fully-certified realistic implementation of a type checker for the full calculus underlying the Coq proof assistant. To achieve this, we refined the sometimes blurry, if not incorrect, specification and implementation of the system. We show how theoretical tools from this community such as bidirectional type-checking, Tait-Martin-L\"of/Takahashi's confluence proof technique and monadic and dependently-typed programming can help construct the following artefacts: a specification of Coq's syntax and type theory, the Polymorphic Cumulative Calculus of (Co)-Inductive Constructions (PCUIC); a monad for the manipulation of raw syntax and interaction with the Coq system; a verification of PCUIC's metatheory, whose main results are the confluence of reduction, type preservation and principality of typing; a realistic, correct and complete type-checker for PCUIC; a sound type and proof erasure procedure from PCUIC to untyped lambda-calculus, i.e., the core of the extraction mechanism of Coq.

A Simple Nominal Type Theory

In recent years, we have seen several new models of dependent type theory extended with some form of modal necessity operator, including nominal type theory, guarded and clocked type theory and spatial and cohesive type theory. In this paper, we study modal dependent type theory: dependent type theory with an operator satisfying (a dependent version of) the K axiom of modal logic. We investigate both semantics and syntax. For the semantics, we introduce categories with families with a dependent right adjoint (CwDRA) and show that the examples above can be presented as such. Indeed, we show that any category with finite limits and an adjunction of endofunctors give rise to a CwDRA via the local universe construction. For the syntax, we introduce a dependently typed extension of Fitch-style modal λ-calculus, show that it can be interpreted in any CwDRA, and build a term model. We extend the syntax and semantics with universes.

This paper presents the design, the implementation, and experiments of the integration of syntactic, conditional possibly associative-commutative term rewriting into proof assistants based on constructive type theory. Our approach is called external because it consists in performing term rewriting in a specific and efficient environment and checking the computations later in a proof assistant. Two typical systems are considered in this work: ELAN, based on the rewriting calculus, as the term rewriting-based environment, and Coq, based on the calculus of inductive constructions as the proof assistant. We first formalize the proof terms for deduction by rewriting and strategies in ELAN using the rewriting calculus with explicit substitutions. We then show how these proof terms can soundly be translated into Coq syntax where they can be directly type checked. For the method to be applicable for rewriting modulo associativity and commutativity, we provide an effective method to prove equalities modulo these axioms in Coq using ELAN. These results have been integrated into an ELAN-based rewriting tactic in Coq.

This is the first of two articles dedicated to the notion of constructive set. In them we attempt a comparison between two different notions of set which occur in the context of the foundations for constructive mathematics. We also put them under perspective by stressing analogies and differences with the notion of set as codified in the classical theory Zermelo–Fraenkel. In the current article we illustrate in some detail the notion of set as expressed in Martin–L¨of type theory and present the essential characters of this theory. In a second article we shall explore a distinct notion of set, as arising in the context of intuitionistic versions of Zermelo–Fraenkel set theory. The theory we shall analyse there is Aczel’s CZF (Constructive Zermelo– Fraenkel) and we shall supplement its exposition by a succinct account of Aczel’s interpretation of CZF in type theory. This will enable us to compare the two notions in a more precise sense.

We propose a representation of interactive systems in dependent type theory. This is meant as a basis for an execution environment for dependently typed programs, and for reasoning about their construction. The inspiration is the ‘I/O-monad’ of Haskell. The fundamental notion is an I/O-tree; its definition is parameterised over a general notion of dependently typed, command-response interactions called a world. I/O-trees represent strategies for one of the parties in a command/response interaction - the notion is not confined to functional programming. We present I/O-trees in two forms. The first form, which is simpler, is suitable for Turing-complete functional programming languages with general recursion, but is non-normalising. The second is definable within (ordinary) normalising type theory and we identify programs written in it as ‘normalising I/O-programs’. We define new looping constructs (while and repeat), and a new refinement construct (redirect), which permits the implementation of libraries. We introduce a bisimulation relation between interactive programs, with respect to which we prove the monad laws and defining equations of while. Most definitions in this article make essential use of the expressive strength of dependent typing.KeywordsFunctional programmingreactive programminginteractiondependent typesmonadic I/Orepetition constructsrefinement

Many programmers use dependently typed languages such as Coq to machine-verify high-assurance software. However, existing compilers for these languages provide no guarantees after compiling, nor when linking after compilation. Type-preserving compilers preserve guarantees encoded in types and then use type checking to verify compiled code and ensure safe linking with external code. Unfortunately, standard compiler passes do not preserve the dependent typing of commonly used (intensional) type theories. This is because assumptions valid in simpler type systems no longer hold, and intensional dependent type systems are highly sensitive to syntactic changes, including compilation. We develop an A-normal form (ANF) translation with join-point optimization—a standard translation for making control flow explicit in functional languages—from the Extended Calculus of Constructions (ECC) with dependent elimination of booleans and natural numbers (a representative subset of Coq). Our dependently typed target language has equality reflection, allowing the type system to encode semantic equality of terms. This is key to proving type preservation and correctness of separate compilation for this translation. This is the first ANF translation for dependent types. Unlike related translations, it supports the universe hierarchy, and does not rely on parametricity or impredicativity.

The project entitled “Formalization of Formal Topology by means of the interactive theorem prover Matita” is an official bilateral project between the Universities of Padova and Bologna, funded by the former, active from March 2008 until August 2010. The project aimed to bring together and exploit the synergic collaboration of two communities of researchers, both centered around constructive type theory: on one side the Logic Group at the University of Padova, focused on developing formal, pointfree topology within a constructive and predicative framework; on the other side, the Helm group at the University of Bologna, developing the Matita Interactive Theorem Prover [2], a young proof assistant based on the Calculus of Inductive Constructions as its logical foundation.