Logical Frameworks

1. FORMALWARE Engineering CISM Udine (Italy), September 24-28, 2001 Logical Frameworks Furio Honsell Professor of Foundations of Informatics Università di Udine, Italyhonsell@dimi.uniud.it

2. Outline of the Course • Some introductory reflections on Logical Frameworks • Theoretical and Practical motivations for computerized proof assistants based on Constructive Type Theory • Encoding formal systems and Program Logics and Calculi in Type Theory • Higher Order Abstract Syntax and Higher Order Natural Deduction • Applications using the proof assistant for CIC: COQ

3. The epistemological and technological milieu • Dramatic need for dependable IT - e.g. life-critical software, mass-produced embedded software, “digital woes” (Wiener) • Running tests is not enough – how can we achieve greater reliability? Absolute validation? • The only viable answer appears to be through rigorous analysis based on formal proofs using formal logic validated by mathematical models. • Hence, the plethoric (?) multitude of Formal Methods in Computer Science: specification languages, program logics and calculi, denotational and operational models, automata, etc.

4. A brief (western) history of proofs • Plato (427-347 BC): Meno’s slave is made to recall a proof of an instance of Pythagoras Theorem(500 BC) • Thales (546 BC), Aristotle (384-322 BC), Euclid (325-265 BC) • Crucial in Mathematics and Logic, but not an object of formal mathematical study itself until the early XXth century: Frege, Hilbert, Gentzen • It becomes a first-class mathematical citizen only with Intuitionism (ca 1920) and Constructive Mathematics: Brouwer, Heyting, Bishop • De Bruijn (1968): Computer Assisted Formal Proof Checking • Martin-Löf (1982): Computational contents of Proofs.

5. Absolute vs relative reliability • Complete certainty is utopian: Formal Methods can only increase our confidence • At best we can prove formally that a given piece of software meets its formal specifications • The exact correspondence of the formal specification to the real world is beyond any formal justification

6. Automated Deduction vs CAFR • CAFR i.e. Computer Aided Formal Reasoning • Building proofs, let alone formal proofs, is a creative activity, hence very difficult to automate. • On the other hand, formal proof checking is routine, although it is a highly error-prone activity for the human mind, because of the often tedious and unperspicuous logical granularity. • Semi-automated interactive proof assistants, such as Coq, are a good compromise: • Coq official site: http://coq.inria.fr

7. Universal vs special-purpose formal systems • There are a number of universal computational models and Turing complete languages • But experience in FM has indicated that there is no chance to come up with the ultimate, unique logical system. • We have to give up any hope of finding a Reductionist Paradise in Computer Science • We have to learn to live, with a multitude of different models/calculi/logics and special-purpose formalisms, and we have to be ready to develop new conceptually irreducibile frameworks. • E.g. formalisms for concurrency, security, mobility, in the era of global computing

8. A plethora of formal systems • l-calculus (Church 1936), p-calculus (Milner, Parrow, Walker 1992), n-calculus (Pitts,Stark 1993), spi-calculus (Abadi,Gordon 1997), Ambient calculus (Cardelli,Gordon 1998), blu calculus etc. • Process Algebras, CCS, CSP, Petri Nets • Operational, Denotational, Logical Semantics • Hoare’s, Modal, and Temporal Logics • Constructive Type Theories • We do not want to start over from first principles the meta-theory of each and everyone of these, nor to re-implement from scratch interactive tools for each of these.

9. How many abstraction levels? • It appears to be convenient to distinguish at least twometalevels above the object one where hardware and software systems live. • The semantical and syntactical formal systems, in the previous slide, which are normally used to specify and analyze the object level systems appear on this first metalevel. • If we want to avoid duplication of efforts in carrying out proofs of metatheoretical properties of such systems or in developing tools for manipulating them, we need to conceive formal systems at yet a higher metalevel

10. Computational Metamodels • This is the level where commonalities across different systems can be factored out and focused. This is the level where Computational Metamodels or Logical Frameworks live. • But, even at this level uniqueness cannot be achieved. If we want to keep the mathematical overhead in representations to a minimum and have simple and transparent encodings we have to entertain more than one computational metamodel.

11. Metamodels, examples • Logical Frameworks based on Constructive Type Theory (Martin-Lof, Plotkin, Harper, Honsell – 1880’s) • ASM (Gurevich 1990’s) • Action Structures and Calculi (Milner 1990’s), • PVS (Shankar) • Rewriting Logics (Meseguer), • Graph Grammars, as general term rewriting systems (Montanari, Ehrig), • Many different kinds of double and enriched categories: tiles (Montanari)

12. Framework theories • Why not use FOL, HOL, Category Theory, Set Theory, as computational frameworks? • Of course, these could be utilized, and indeed have been: FOL, HOL, SETL, … • But such a broad generalty brings about yet more opaque encodings. It appears to be more convenient to focus on computation-specific pervasive ideas, especially if we want to keep an eye at building interactive tools. Some mechanisms are best factored out, i.e. abstracted away, or highlighted.

13. Pervasive concepts • The inferential machinery of (higher order) rule application and hypothetico-general derivation combined with the generalization of algebraic context-free grammars, known as Higher Order Abstract Syntax (HOAS), in the case of Logical Frameworks • Labeled Transition Systems and observation semantics based on bisimulation in the case of Action Calculi, Co-algebraic and Final Semantics, Tile Logics • Term rewriting in the case of Graph Grammars • ASM ? PVS?