An efficient intuitionistic first-order prover integrated into Coq is useful
to replay proofs found by external automated theorem provers. We propose a
two-phase approach: An intuitionistic prover generates a certificate based on
the matrix characterization of intuitionistic first-order logic; the
certificate is then translated into a sequent-style proof.Comment: In Proceedings HaTT 2016, arXiv:1606.0542

Kunze, Fabian

Electronic Proceedings in Theoretical Computer Science

English

arXiv

An efficient intuitionistic first-order prover integrated into Coq is useful to replay proofs found by external automated theorem provers. We propose a two-phase approach: An intuitionistic prover generates a certificate based on the matrix characterization of intuitionistic first-order logic; the certificate is then translated into a sequent-style proof

Fabian Kunze

Directory of Open Access Journals

J.C. Blanchette and C. Kaliszyk:Hammers for Type Theories (HaTT’16)EPTCS 210, 2016, pp. 30–35, doi:10.4204/EPTCS.210.6c© Fabian KunzeTowards the Integration of anIntuitionistic First-Order Prover into CoqFabian KunzeSaarland Universitys9fakunz@stud.uni-saarland.deAn efficient intuitionistic first-order prover integrated into Coq is useful to replay proofs found byexternal automated theorem provers. We propose a two-phaseapproach: An intuitionistic provergenerates a certificate based on the matrix characterization of intuitionistic first-order logic; the cer-tificate is then translated into a sequent-style proof.1 IntroductionSledgehammer [11] and HOLyHammer [5] drastically improvedthe productivity for users of proof assis-tants. They make the capabilities of automated theorem provers (ATPs) available from within interactiveproof assistants.The large, monolithic design of state-of-the-art theorem provers can not be easily trusted to be free ofbugs. Thus invoking theorem provers as an oracle is unacceptabl for most users. Proof assistants aremore trustworthy because all reasoning is checked by a kernel intentionally kept small.To integrate external provers, small yet efficient,certifiedproversintegratedinto the proof assistant areused: Although it is often possible to mechanically translate the proof to a format accepted by the proofassistant, the integrated prover allows for the reconstruction without the full knowledge of all axioms andrules used by the external prover. Thus an integrated proversimplifies the integration of not only one butdifferent external provers.There has been effort to integrate classical provers into Coq, e.g. SMTCoq [1], Satallax [3] and why3[2], but they produce proofs that assume classical axioms. As a fair amount of proof developments avoidsassuming additional axioms, the acceptance of a future ‘CoqHammer’ benefits from the integration ofan efficient,intuitionistic prover.2 Existing Intuitionistic Provers in CoqThe existing intuitionistic first-order provers integrated into Coq are not very strong. We evaluatedfirstorder [4], a built-in tactic based on a sequent calculus, and JProver [14], a plugin available forCoq. Using Coq version8.6pl1, we considered first-order problems that are likely to emerge in a future‘Coq Hammer’.For example, we tested formulas where the instantiate of quantifiers is not immediately determinedusing a goal-driven approach:(∀x,x= x)∧ (∀x,Px∨Qx)∧ (∀xy,x= y∧Px⇒ Ry)∧ (∀xy,x= y∧Qx⇒ Ry)⇒ (∀x,Rx).Fabian Kunze 31On this formula,firstorder was unable to find a proof during the several minutes we run it.JProversucceeded in less than one second.We also invoked both provers on several set-theoretical problems from the ILTP (Intuitionistic LogicTheorem Proving) library [12]. Similar to the intended use case, we only supplied the axioms needed forthe proofs, resulting in problems like(∀ABX,X ∈ A∪B⇔ X ∈ A∨X ∈ B)∧ (∀AB,A= B⇔ A⊆ B∧B⊆ A)∧ (∀AB,A⊆ B⇔∀X,X ∈ A⇒ X ∈ B)⇒ (∀A,A∪A= A).On this and similar problems, bothfirstorder and JProver failed to find proofs before we abortedthem after running several minutes.Therefore, faster intuitionistic provers integrated intoC q are necessary for a ‘Coq Hammer’ used inpractice.3 Proposed ArchitectureWe propose to employ the recent improvements on automated, intuitionistic first-order theorem provingby Otten: ileanCoP [7, 8] and the forthcoming intuitionistic version of nanoCoP [10, 9]. The existingimplementations of both provers verified that the formulas in Section 2 are valid in under a second. Bothprovers are based on the existence of proof certificates for the matrix characterization of (intuitionistic)validity [15], which can be translated to sequent-style proofs [13].This architecture is similar to that of JProver (which uses the same characterization of validity), butuses a more efficient proof search procedure, leading to a higher success rate.3.1 Finding Proof CertificatesThe performance of ileanCoP is well in identifying valid formulas, compared to other intuitionisticprovers [8]. But it does not keep track of the proof found. Furthe more, it is based on aclausalvariantof the matrix characterization for intuitionistic logic. The necessary translation into a non-clausal matrixproof has been sketched in the correctness proof of ileanCoP[7], but to our knowledge has not yet beenimplemented.The classical prover nanoCoP [10] solves both problems: It outputs the proof certificate found anduses the non-clausal matrix characterization of classicalvalidity. Otten is currently extending nanoCoPto an intuitionistic variant by integrating prefix unification [15], a method already employed to deriveileanCoP from the classical prover leanCoP.In our proposed architecture, the proof certificate for a first-o der formulaF consists of amultiplicityµ , a pair of substitutionsσ = (σQ,σJ) and a set of pairs ofσ -complementaryatoms in the formula(connections) thatspans Fµ .We will now give an very informal intuition about this certificate.A Part of the certificate is already needed for the matrix characterization of classical logic: The mul-tiplicity µ takes care of the multiple instances an all-quantified subformula ofF may be needed in theproof. One part of ‘σ -complementary’ ensures that that two atoms in a connectionare identical underthe (non-circular) term substitutionσQ, but have different polarity.The set of connectionspansthe formula if everypath through the formula contains at least oneconnections. In the quantifier-free case, each path correspond to a disjunction in the conjunctive normal32 Towards the Integration of an Intuitionistic First-Order Prover into Coqform. In the case of formulas with quantifiers, each path correspond a branch of a (classical) analytictableaux, where quantifiers are instantiated according toσQ.The main difference in the intuitionistic characterization s the use ofσJ to ensure that the positions ofthe pair of complementary atoms in the formula are ‘compatible’. The position of an atom is defined bystructural recursion on the formula and represented by a string, consisting of fresh constants and freshvariables.An example of this for an intuitionistic valid formula isP ⇒ P, where the two atoms can be madecomplementary: The position of the firstP is described by the stringz with a fresh variablez, while theposition of the secondP is the stringa consisting of a fresh constanta. DefiningσJ(z) = a unifies thosestrings.For the formula¬P∨P, a theorem of classical, but not intuitionistic logic, the two atoms can not bemade complementary: The position of the firstP is described byxa, while the one for the secondP is b.As the second position contains no variable and noa, we can never unify those strings.This concept generalizes to quantified formulas, but for themain idea, it suffices to study the cases fornon-quantified formulas.For a more formal definition and a few more examples, we recommend the first two Sections of [7],and Chapter 8, §4 of [15].It should be noted that one of the main improvements of nanoCoP compared to JProver is the handlingof the multiplicities: nanoCoP adds instances of subformulas during the proof search as needed, whileJProver fixes the multiplicity before searching for an proof; n failure, an additional instance of thewhole formula gets added and the proof is retried. Although both are complete, the first approach ismore goal-driven and thus expected to be more efficient.3.2 Generating Sequence ProofsThe high-level idea is that the proof certificate guaranteeshat on each branch of the sequent-style proof,eventually complementary atoms are found. The difficulty isto traverse the formulas in the right order,which depends onσJ.The translation of a matrix characterisation proof certificate into a sequent-style proof has alreadybeen investigated and implemented for JProver[13]. We intend o adopt this translation, as we expect itto be reasonable fast: In the examples we tried and where JProver succeeded, the sequence-style proofproduced was rather short. In the cases where JProver did notsucceed in an acceptable time, it did noteven reach the sequence-proof generation. Thus we concludethat the bottleneck of JProver, at least inthe examples we tried, is the proof certificate search.4 DiscussionModular vs MonolithicWe explicitly want to use a modular implementation for the two phases, possibly written in multiplelanguages. The Prolog version of the intuitionistic variant of nanoCoP is expected to materialize soonand there is already an implementation of the sequence proofgenerating algorithm integrated into Coq.Thus we expect no challenge in creating a prototype of the suggested architecture using the Prologprogram. This would allow us to test whether the proposed setup is suitable for the intended use case.In the longer term, it would be desirable to have a native OCaml implementation of the proof searchprocedure, allowing for a deployment within Coq, without additional binaries. The classical leanCoPFabian Kunze 33has been ported to OCaml for the HOL light proof assistant, with performence comparable to the Prologversion[6]. This port can serve as a starting point for a native OCaml version of the forthcoming intu-itionistic nanoCoP. Then, the modular approach allows to opionally use external proof procedures. Thisallows to evaluate improvements to the Prolog proof procedure before porting them.Also, a modular design allows to more easily use parts an imple entation this for other, intuitionisticproof assistants. This additional usage should be kept in mind while developing this, and other, toolstowards Hammers in Type Theory.Explicit Proofs vs ReflectionOne approach in proof automation in Coq is ‘proof by reflection’: Some or all parts of the the proofsearch procedure are written in Coq, including a correctness proof. The proof of a statement thenis thecall to this Coq procedure.One argument for ‘proof by reflection’ in Coq is the efficiency. But this is just a benefit comparedto an implementation using Ltac, the tactic language in Coq:The evaluation of native Coq terms isheavily optimized to the extend of native machine code compilation and execution. In contrast, Ltac isjust interpreted on top of several layers of abstraction. Aswe propose to use OCaml, not Ltac, for thecomputationally intense parts, this argument does not apply here.We assume that the search for the proof certificate could be mor easily written, modified, or enrichedwith heuristics, when using a language allowing side effect. This discourages the use of reflection in thefirst part of our proposed architecture.Reflection seems to be more reasonable for the second part, the translation to a sequence proof: Thereis no need to explicitly generate the sequence proof when a certified procedure guarantees that the se-quence proofdoesexist when the certificate satisfies the appropriate conditions.The challenge here would be that the proof certificate must annot ted with type information richenough to reduce to proofs for all formulas we intend to proof: This means that when the terms inthe formula are not single sorted, but have of more complex types, e.g. dependent types, this must beincorporated in the proof certificate, the translation procedure itself and its correctness proof. At first,it seems that a benefit would be that the translation is provento be sound by design. But to check theconditions that a proof certificate is indeed valid is more orless computationally equivalent hard as togenerating a sequence-style proof.Another aspect to consider is that some usage, a formula thatis no first-order can be transformed intoan first-order formula such that a proof of the later formula can be translated back to a proof of the formerformula. In a reflective proof reconstruction, this intermediate steps may can not type-check.Intuitionistic vs ClassicalAutomated theorem proving in intuitionistic logic is computationally harder than in classical logic. Fordevelopments assuming classical axioms, the intuitionistic part of both phases can be made optional,resembling the classical proof search of nanoCoP without significant overhead.Note that the proof search in this proposed architecture does neither need skolemization nor clausalnormal forms. Thus more structure of the different lemmas and parts of the formulas is preserved and insome sense, this approach is closer to humans reasoning. Further investigation of this architecture couldlead to insights useful for automated reasoning in proof assistants of classical logic.34 Towards the Integration of an Intuitionistic First-Order Prover into CoqAcknowledgementsWe thank Jens Otten for his helpful discussions and suggestions, and Jasmin Blanchette and the anony-mous reviewers for their comments on this extended abstract.References[1] Michael Armand, Germain Faure, Benjamin Grégoire, Chantal Keller, Laurent Théry & Benjamin Werner(2011): Certified Programs and Proofs: First International Conferenc , CPP 2011, Kenting, Tai-wan, December 7-9, 2011. Proceedings, chapter A Modular Integration of SAT/SMT Solvers to Coqthrough Proof Witnesses, pp. 135–150. Springer Berlin Heidelberg, Berlin, Heidelberg. Available athttp://dx.doi.org/10.1007/978-3-642-25379-9_12.[2] François Bobot, Jean-Christophe Filliâtre, Claude Marché & Andrei Paskevich (2011):Why3: Shepherd YourHerd of Provers. In K. Rustan M. Leino & Michał Moskal, editors:Boogie 2011, pp. 53–64.[3] Chad E. Brown (2012):Satallax: An Automatic Higher-Order Prover. In Bernhard Gramlich, Dale Miller& Uli Sattler, editors: Automated Reasoning—6th International Joint Conference,IJCAR 2012, Manch-ester, UK, June 26-29, 2012. Proceedings, Lecture Notes in Computer Science7364, Springer, pp. 111–117.Available athttp://dx.doi.org/10.1007/978-3-642-31365-3_11.[4] Pierre Corbineau (2004): First-Order Reasoning in the Calculus of Inductive Construc-tions, pp. 162–177. Springer Berlin Heidelberg, Berlin, Heidelberg. Available athttp://dx.doi.org/10.1007/978-3-540-24849-1_11.[5] Cezary Kaliszyk & Josef Urban (2015):HOL(y)Hammer: Online ATP Service for HOL Light. Mathematicsin Computer Science9(1), pp. 5–22. Available athttp://dx.doi.org/10.1007/s11786-014-0182-0.[6] Cezary Kaliszyk, Josef Urban & Jiři Vyskočil (2015): Certified Connection Tableaux Proofs for HOL Lightand TPTP. In: Proceedings of the 2015 Conference on Certified Programs andProofs, CPP ’15, ACM, NewYork, NY, USA, pp. 59–66. Available athttp://doi.acm.org/10.1145/2676724.2693176.[7] Jens Otten (2005):Clausal Connection-Based Theorem Proving in Intuitionistic First-Order Logic. In Bern-hard Beckert, editor:Automated Reasoning with Analytic Tableaux and Related Methods: 14th InternationalConference, TABLEAUX 2005, Koblenz, Germany, September 14-17, 2005. Proceedings, Springer BerlinHeidelberg, Berlin, Heidelberg, pp. 245–261. Available athttp://dx.doi.org/10.1007/11554554_19.[8] Jens Otten (2008):leanCoP 2.0 and ileanCoP 1.2: High Performance Lean TheoremProving in Classi-cal and Intuitionistic Logic (System Descriptions). In Alessandro Armando, Peter Baumgartner & GillesDowek, editors:Automated Reasoning: 4th International Joint Conference,IJCAR 2008 Sydney, Australia,August 12-15, 2008 Proceedings, Springer Berlin Heidelberg, Berlin, Heidelberg, pp. 283–291. Available athttp://dx.doi.org/10.1007/978-3-540-71070-7_23.[9] Jens Otten (2016): personal communication.[10] Jens Otten (2016):nanoCoP: A Non-clausal Connection Prover. In: Automated Reasoning: 8th InternationalJoint Conference, IJCAR 2016 Coimbra, Portugal, June 27 -July 2, 2016 Proceedings. To appear.[11] Lawrence C. Paulson & Jasmin Christian Blanchette (2010): Three years of experience with Sledgeham-mer, a Practical Link Between Automatic and Interactive Theorem Provers. In Geoff Sutcliffe, StephanSchulz & Eugenia Ternovska, editors:The 8th International Workshop on the Implementation of Logics,IWIL 2010, Yogyakarta, Indonesia, October 9, 2011, EPiC Series2, EasyChair, pp. 1–11. Available athttp://www.easychair.org/publications/?page=820355915.[12] Thomas Raths, Jens Otten & Christoph Kreitz (2007):The ILTP Problem Library for Intuitionis-tic Logic: Release v1.1 Journal of Automated Reasoning38(1-3), pp. 261–271. Available athttp://dx.doi.org/10.1007/s10817-006-9060-z.Fabian Kunze 35[13] Stephan Schmitt & Christoph Kreitz (1996):Converting non-classical matrix proofs into sequent-style sys-tems. In: Automated Deduction — Cade-13: 13th International Conference on Automated Deduction NewBrunswick, NJ, USA, July 30 – August 3, 1996 Proceedings, Springer Berlin Heidelberg, Berlin, Heidelberg,pp. 418–432. Available athttp://dx.doi.org/10.1007/3-540-61511-3_104.[14] Stephan Schmitt, Lori Lorigo, Christoph Kreitz & Alexey Nogin (2001): JProver : Integrating Connection-based Theorem Proving into Interactive Proof Assistants. In R. Gore, A. Leitsch & T. Nipkow, editors:Inter-national Joint Conference on Automated Reasoning, Lecture Notes in Artificial Intelligence2083, SpringerVerlag, pp. 421–426, doi:10.1007/3-540-45744-5_34.[15] Lincoln Wallen (1990):Automated Deduction in Nonclassical Logics. MIT Press, Cambridge, MA, USA.

Towards the Integration of an Intuitionistic First-Order Prover into Coq

Abstract

Similar works

Full text

Available Versions

Directory of Open Access Journals