Genestier, Guillaume

HAL-MINES ParisTech

SizeChangeTool: A Termination Checker for Rewriting Dependent Types

INRIA a CCSD electronic archive server

HAL Id: hal-02442465https://hal.archives-ouvertes.fr/hal-02442465Submitted on 16 Jan 2020HAL is a multi-disciplinary open accessarchive for the deposit and dissemination of sci-entific research documents, whether they are pub-lished or not. The documents may come fromteaching and research institutions in France orabroad, or from public or private research centers.L’archive ouverte pluridisciplinaire HAL, estdestinée au dépôt et à la diffusion de documentsscientifiques de niveau recherche, publiés ou non,émanant des établissements d’enseignement et derecherche français ou étrangers, des laboratoirespublics ou privés.SizeChangeTool: A Termination Checker for RewritingDependent TypesGuillaume GenestierTo cite this version:Guillaume Genestier. SizeChangeTool: A Termination Checker for Rewriting Dependent Types. HOR2019 - 10th International Workshop on Higher-Order Rewriting, Jun 2019, Dortmund, Germany.pp.14-19. ￿hal-02442465￿SizeChangeTool: A Termination Checker forRewriting Dependent TypesGuillaume Genestier121 LSV, ENS Paris-Saclay, CNRS, Université Paris-Saclay2 MINES ParisTech, PSL University1 IntroductionSizeChangeTool [10] is a fully automated termination checker for the λΠ-calculus modulorewriting. Its development became essential as various libraries were encoded in an implemen-tation of this logic: the logical framework Dedukti [3].A logical framework allows the user to define the logic they want to reason with and thenuse it to actually write proofs. To define a logic in Dedukti, the user provides a set of rewritingrules. Those rules do not only define functions, but can also define types. However, to ensurethat the defined type system has good properties, like logical consistency or decidability, therules must satisfy some properties: termination, confluence and type preservation.Many criteria have been created to check termination of first-order rewriting. For instance,dependency pairs [2], which evolved in a complete framework [21] or size-change termination[18], just to mention those appearing in this work. The dynamism of this research area isillustrated by the numerous tools participating in the various first-order categories of the ter-mination competition [20]. For higher-order rewriting too, criteria have been crafted, many ofthem can be found in [15] and a category exists in the competition. However, one can deplorethe small number of participants in this category: Only 2 in 2019, including SizeChangeTool!This lack of implementations is even more visible for rewriting with dependent types, forwhich criteria have been developed [5, 14], but as far as the author knows, none of them havebeen implemented.Outline After presenting the logical system and examples of programs in Sec. 2, we present thecriterion used by the tool in Sec. 3. Sec. 4 details the implementation choices of SizeChange-Tool and Sec. 5 compares it with the others termination checkers.2 The λΠ-calculus Modulo RewritingThe λΠ-calculus modulo rewriting (λΠ/R for short) is an extension of the logical frameworkLF [12]. It is a system of dependent types where types are identified not only modulo theβ-conversion of λ-calculus, but also by user-given rewriting rules.Definition 1. λΠ/R extends the Pure Type System λP [4] with a finite signature F and a setof rules R = (∆, f l̄ → r) such that f ∈ F, FV(r) ⊆ FV(l̄) and ∆ is a context associating atype to every variable of l̄. →R is the closure by substitution and context of R.The conversion rule is enriched to take into account rewriting rules:Γ ` t : A Γ ` B : s A↔∗βR B (conv)Γ ` t : BSizeChangeTool: A Termination Checker for Higher-Order Rewriting with Dependent Types G. GenestierNote that the constraints on the rewriting rules are very loose. In particular, we do notenforce the rules to be orthogonal, meaning that overlapping or non-linear rules are allowed. Letus give two examples, highlighting the possibilities offered by the system. A more comprehensiveexample can be found in [7].Example 2 (Summation of variable arity). Rewriting rules at type level allow us for instanceto define F n as the type Nat ⇒ Nat ⇒...⇒ Nat with n arrows. With it, we can type thefunction sum which is such that sum n l1...ln = l1 +...+ ln1.symbol Nat : TYPEsymbol const 0 : Nat symbol const s : Nat ⇒ Natsymbol plus : Nat ⇒ Nat ⇒ Nat set infix "+" := plusrule 0 + &y → &y rule (s &x) + &y → s (&x + &y)symbol F : Nat ⇒ TYPErule F 0 → Nat rule F (s &n) → Nat ⇒ F &nsymbol sum : ∀ n: Nat , F nrule sum 0 → 0 rule sum (s 0) → λx, xrule sum (s (s &n)) → λx y, sum (s &n) (x + y)Example 3 (Simply-typed λ-calculus). A simple instance of encoding of logic in Dedukti isthe simply-typed λ-calculus, which is presented here with the type typ for code of types and Twhich decodes an element of typ into a type of Dedukti.symbol typ : TYPE symbol arrow : typ ⇒ typ ⇒ typsymbol T : typ ⇒ TYPEsymbol lambda : ∀(a b : typ), (T a ⇒ T b) ⇒ T (arrow a b)symbol appli : ∀(a b : typ), T (arrow a b) ⇒ T a ⇒ T brule appli &a &b (lambda _ _ &f) &x → &f &xWe are interested in the strong normalization of →βR= (→β ∪ →R).3 Dependency Pairs and Size-Change TerminationDependency pairs are at the core of all the state-of-the-art automated termination proversfor first-order term rewriting systems. Arts and Giesl [2] proved that a first-order rewritingrelation is terminating if and only if there is no infinite chain, that is sequence of dependencypairs interleaved with reductions in the arguments. This notion of dependency pair has beenextended to higher order [6, 9], however those extensions do not include dependent types, whichis a compulsory feature when we are developing a logical framework.Definition 4 (Dependency pairs). Let f l̄ > g m̄ iff there is a rule f l̄ → r ∈ R, g is the headof the left-hand side of a rule and g m̄ is a subterm of r maximally applied.f t1 . . . tp >̃ g u1 . . . uq iff there are a dependency pair f l1 . . . li > gm1 . . .mj with i 6 p andj 6 q and a substitution σ such that, for all k 6 i, tk →∗βR lkσ and, for all k 6 j, mkσ = uk.1& is used in Dedukti to identify pattern variables in rewriting rules.2SizeChangeTool: A Termination Checker for Higher-Order Rewriting with Dependent Types G. GenestierOne criterion for first-order rewriting is Lee, Jones and Ben-Amram size-change terminationcriterion (SCT) [18]. It consists in following the arguments through sequences of recursive callsand checking that, in every potential loop, one of them strictly decreases.Definition 5 (Size-Change Termination). Let  be a well-founded order on terms. The callgraph G(R,) associated to R is the directed labeled graph on the symbols of F such that thereis an edge between f and g iff there is a dependency pair f l1 . . . lp > gm1 . . .mq. This edge islabeled with the matrix (ai,j)i≤ar(f),j≤ar(g) where:• if li mj, then ai,j = −1; • if li = mj, then ai,j = 0;• otherwise ai,j =∞ (in particular if i > p or j > q).R is size-change terminating for  if, in the transitive closure of G(R,) (using the min-plus semi-ring to multiply the matrices labeling the edges), all idempotent matrices labeling aloop have some −1 on their diagonal.In [7], we present an adaptation of dependency pairs to λΠ/R and prove that (under someconditions) the absence of infinite chains implies the termination of→βR. After Wahlstedt [22],we used an adaptation of SCT to check the absence of infinite chains of dependency pairs.Definition 6 (Well-Structured System). We consider a pre-order  on F such that if g occursin the type of f or in the right-hand side of a rewriting rule defining f , then f  g. R iswell-structured if for every rule (∆, f l̄ → r), if f is of type Π(x̄ : T̄ ).U , then ∆ ` r : U [x̄ → l̄]is derivable using only symbols smaller or equal to f .The result of [7] is:Theorem 7. The relation →βR terminates on terms typable in λΠ/R if →βR is locally conflu-ent and preserves typing, R is well-structured, size-change terminating for the subterm orderingand plain-function passing.where “plain-function passing” is a quite restrictive condition on the variable allowed tooccur in the right-hand side of rules.In SizeChangeTool, the criterion used is a (still unpublished) extension of this resultwhere we replace the plain-function passing hypothesis by a condition analogous to strict posi-tivity of inductive types and use the structural ordering introduced in [8] for checking size-changetermination.Extension 8. The relation →βR terminates on terms typable in λΠ/R if →βR is locallyconfluent and preserves typing, R is well-structured, is size-change terminating for the structuralordering and there is a pre-order between types such that for every rule (∆, f l̄ → r) and everyc ∈ F occurring in a li, the type of c is strictly positive for this pre-order.4 Implementation and interaction with the type-checkerSizeChangeTool takes as input Dedukti files or XTC files, the format of the terminationcompetition [20]. However, XTC does not include dependent types now, hence we proposed abackward compatible extension of the format. In fact, the tool accepts this format extension.Checking that the provided rules are confluent with β is left to the user. To check it auto-matically, Dedukti offers an export to the format of the confluence competition. SizeChange-Tool performs check of the 4 remaining hypotheses, to use the extension 8 of Thm. 7.1. type preservation is checked by Dedukti assuming that the provided rewrite rules areconfluent with β. This algorithm can be found in [3].3SizeChangeTool: A Termination Checker for Higher-Order Rewriting with Dependent Types G. GenestierAST representationXTC FileDedukti FileDedukti signature Type preservationSymbols order Pruned signature Well-structuringCall graph Size-change terminationType ordering graphType ordering constraintsStrict positivity→ Parser→ Translation to Dedukti→ Rule analyzerFigure 1: SizeChangeTool Workflow2. well-structuring requires to construct the pre-order described in Def. 6. Once this pre-order is computed, Dedukti is reused to check if it is possible to type the right-hand sideof every rule using the pruned signature where symbols greater than the one defined areremoved.3. size-change termination requires to analyze every rule in order to extract the dependencypairs. Then the call-graph is constructed. To perform size-change termination checking,one must compute the transitive closure of the call graph and verify the presence of a−1 on the diagonal of every idempotent matrix labeling a loop. This check has beenimplemented by Lepigre and Raffalli for the language PML2 [19]. SizeChangeToolreuses their work to analyze the call graph.4. the strict positivity condition requires to have a pre-order on type constructors. Theuser is not asked to provide this order. While analyzing the rules, SizeChangeToolconstructs a graph whose vertices are type constructors and arrows means “is smaller orequal to” as well as a list of constraints of the form “Type constructor A is strictly greaterthan type constructor B.” To check that this relation is a pre-order, one checks that forevery constraint “A is strictly smaller than B.” there is no arrow between A and B in thetransitive closure of the graph.For the sake of simplicity, representation of terms and rules are mainly shared betweenDedukti and SizeChangeTool. So the red arrows on Fig. 1 are (almost) the identity.However those translation functions are made explicit, since one could imagine plugging anothertype-checker on the rule analyzer offered by SizeChangeTool.5 Comparison with other toolsAs far as the author knows, there are no other termination checker combining dependent typesand non-orthogonal rewriting rules. However, dropping one of these features and restrictingourselves to simply-typed higher-order rewriting systems or to dependently-typed orthogonalsystems permits comparison with existing tools.For simply-typed systems, the termination competition [20] proposes a category “higher-order rewriting union beta”. In 2019, there were only two tools competing in this category:SizeChangeTool and Wanda [17]. Wanda uses multiple techniques to prove termination:4SizeChangeTool: A Termination Checker for Higher-Order Rewriting with Dependent Types G. Genestierdependency pairs, polynomial interpretations, HORPO. . . [15]. Unsurprisingly, the sole criterionused in SizeChangeTool cannot prove as many examples as this wide range of techniques.However, on the bench of the competition, SizeChangeTool is 11 times faster thanWanda. The speed of SizeChangeTool permits it to show in less than 0.1 second ter-mination of 3 examples on which Wanda is unable to answer with a timeout of 300 seconds:Mixed_HO_10/deriv.xml encodes derivation of usual mathematical functions, like:2rule der (λx, (&F x) + (&G x)) → λx: real , (der &F x) + (der &G x)rule der (λx, ln (&F x)) → λx: real , (der &F x) / (&F x)Hamana_17/churchNum.xml and Hamana_17/churchNum2.xml, contain the Church encoding ofnatural numbers, with rules like:rule two (λx, &I x) (λx, &J x) (λx, &F1 x) &Y1→ &I (&I (λy, &J y)) (λy, &F1 y) &Y1The very low time consumption of the presented criterion suggests that Wanda would improvesignificantly its efficiency by implementing this technique.If we restrict ourselves to orthogonal systems, it is then possible to compare our techniqueto the ones implemented in Coq and Agda. Coq essentially implements a higher-order versionof primitive recursion [11], whereas Agda uses subterm criterion (a criterion very similar tosize-change termination) [1]. Hence, Coq cannot handle function definitions with permutedarguments in function calls, which is not a problem for Agda and SizeChangeTool. Agdarecently added the possibility of declaring rewriting rules but this feature is highly experimentaland no check is performed on the rules. In particular, Agda termination checker does not handlerewriting rules.6 Conclusion and future workFor now on, the accepted input files are restricted to Dedukti and XTC files. One couldimagine extending it to other input formats, for instance the rewriting rules offered in Agda.Following the approach adopted by Wanda, one could also just study truly higher-orderrules, use a state-of-the-art first-order prover for the remaining rules and then rely on a modu-larity theorem to conclude. This strategy would improve the performance of SizeChangeToolin the competition, since, according to C. Kop: “about half the benchmarks now do little morethan test the strength of the first-order back-end that some higher-order tools use.” [16].One could also think of various enhancement of the criterion, for instance to handle ruleswith a local increase of the size of the arguments like in:rule f &x → g (s &x) rule g (s (s &x)) → f &xHyvernat proposed such an extension of SCT for constructor-based first-order languages [13].Adapting other so-called “dependency pairs processors” [9] to the λΠ/R is of course anotheractive subject of study and would improve the tool.Now that a higher-order rewriting with dependent types termination prover has been de-veloped, one can hope such development will emulate other researches. The adoption of anextension of XTC and the creation of a category for λΠ/R in the competition, would probablysupport the creation of such new implementations.2For sake of readability, examples are presented in Dedukti syntax and some η-reduction are performed.5SizeChangeTool: A Termination Checker for Higher-Order Rewriting with Dependent Types G. GenestierReferences[1] A. Abel. foetus – Termination Checker for Simple Functional Programs. 1998.[2] T. Arts, J. Giesl. Termination of term rewriting using dependency pairs. TCS 236:133–178, 2000.[3] A. Assaf, G. Burel, R. Cauderlier, D. Delahaye, G. Dowek, C. Dubois, F. Gilbert, P. Halmagrand,O. Hermant, R. Saillard. Dedukti: a Logical Framework based on the λΠ-Calculus Modulo Theory.[4] H. Barendregt. Lambda calculi with types. In Handbook of logic in computer science. Volume 2.Background: computational structures, p. 117–309. Oxford University Press, 1992.[5] F. Blanqui. Definitions by rewriting in the calculus of constructions. MSCS 15(1):37–92, 2005.[6] F. Blanqui. Higher-order dependency pairs. WST, 2006.[7] F. Blanqui, G. Genestier, O. Hermant. Dependency Pairs Termination in Dependent Type TheoryModulo Rewriting. FSCD, 2019.[8] T. Coquand. Pattern matching with dependent types. TYPES, 1992.[9] C. Fuhs, C. Kop. A Static Higher-Order Dependency Pair Framework. ESOP, LNCS, 2019.[10] G. Genestier. SizeChangeTool. https://github.com/Deducteam/SizeChangeTool, 2018.[11] E. Giménez. Codifying Guarded Definitions with Recursive Schemes. TYPES 1994.[12] R. Harper, F. Honsell, G. Plotkin. A framework for defining logics. JACM 40(1):143–184, 1993.[13] P. Hyvernat. The size-change termination principle for constructor based languages. LMCS 2014.[14] J.-P. Jouannaud, J. Li. Termination of Dependently Typed Rewrite Rules. TLCA, 2015.[15] C. Kop. Higher order termination. PhD thesis, VU University Amsterdam, 2012.[16] C. Kop. Mail to the termtools list. higher-order union beta category in the TPDB. 19/03/2019.[17] C. Kop. Wanda. http://wandahot.sourceforge.net/.[18] C. S. Lee, N. Jones, A. Ben-Amram. The size-change principle for program termination. POPL’01.[19] R. Lepigre. PML2. https://github.com/rlepigre/pml, 2017.[20] Termination Competition. http://termination-portal.org/wiki/Termination_Competition.[21] R. Thiemann. The DP framework for proving termination of term rewriting. PhD thesis, RWTHAachen University, 2007. Technical Report AIB-2007-17.[22] D. Wahlstedt. Dependent type theory with first-order parameterized data types and well-foundedrecursion. PhD thesis, Chalmers University of Technology, 2007.6

Archive Ouverte en Sciences de l'Information et de la Communication

https://hal.archives-ouvertes.fr/hal-02442465/document

SizeChangeTool: A Termination Checker for Rewriting Dependent Types

Abstract

Similar works

Full text

Available Versions

HAL-MINES ParisTech

INRIA a CCSD electronic archive server

Archive Ouverte en Sciences de l'Information et de la Communication