Table Of ContentTexts in Theoretical Computer Science
An EATCS Series
Editors: W. Brauer G. Rozenberg A. Salomaa
On behalf of the European Association
for Theoretical Computer Science (EATCS)
Advisory Board: G. Ausiello M. Broy C.S. Calude
S. Even J. Hartmanis J. Hromkovic N. Jones
T. Leighton M. Nivat C. Papadimitriou D. Scott
Springer-Verlag Berlin Heidelberg GmbH
Yves Bertot · Pierre Casteran
Interactive
Theorem Proving
and Program
Development
Coq' Art: The Calculus
of Inductive Constructions
Foreword by
Gerard Huet and
Christine Paulin-Mohring
, Springer
Authors
Dr. Yves Bertot Dr. Pierre Casteran
Inria Sophia Antipolis LaBRI and Inria Futurs
2004 route des lucioles LabRI
06902 Sophia Antipolis Cedex Universite Bordeaux I
France 351 Cours de la Liberation
[email protected] 33405 Talence Cedex
www-sop.inria.fr/lemme/Yves.Bertot France
[email protected]
www.labri.fr/Perso/-casteran
Series Editors
Prof. Dr. Wilfried Brauer
Institut fiir Informatik der TUM
Boltzmannstr. 3, 85748 Garching, Germany
[email protected]
Prof. Dr. Grzegorz Rozenberg
Leiden Institute of Advanced Computer Science
University of Leiden
Niels Bohrweg 1,2333 CA Leiden, The Netherlands
[email protected]
Prof. Dr. Arto Salomaa
Turku Centre for Computer Science
Lemminkăisenkatu 14A, 20520 Turku, Finland
[email protected]
Library of Congress Cataloging-in-Publication Data applied for
Die Deutsche Bibliothek - CIP-Einheitsaufnahme
Bibliographic information published by Die Deutsche Bibliothek
Die Deutsche Bibliothek lists this publication in the Deutsche Nationalbibliografie;
detailed bibliographic data is available in the Internet at <http://dnb.ddb.de>.
ACM Computing Classification (1998): D.2.4, F.3.1, FA.1, 1.2.3
ISBN 978-3-642-05880-6 ISBN 978-3-662-07964-5 (eBook)
DOI 10.1007/978-3-662-07964-5
This work is subject to copyright. AII rights are reserved, whether the whole or part of the material is
concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broad
casting, reproduction on microfilm or in any other way, and storage in data banks. Duplication of this
publication or parts thereof is permitted only under the provisions of the German Copyright Law of
September 9, 1965, in its current version, and permission for use must always be obtained from
Springer-Verlag Berlin Heidelberg GmbH.
Violations are liable for prosecution under the German Copyright Law.
springeronline.com
© Springer-Verlag Berlin Heidelberg 2004
Originally published by Springer-Verlag Berlin Heidelberg New York in 2004
Softcover reprint of the hardcover 1s t edition 2004
The use of general descriptive names, trademarks, etc. in this publication does not imply, even in the
absence of a specific statement, that such names are exempt from the relevant protective laws and
therefore free for general use.
Cover Design: KiinkelLopka, Heidelberg
Typesetting: Camera-ready by the authors
Printed on acid-free paper 45/31411Tr -5432 1 O
Preface
The Coq system is a computer tool for verifying theorem proofs. These theo
rems may concern usual mathematics, proof theory, or program verification.
Our main objective is to give a practical understanding of the Coq system
and its underlying theory, the Calculus of Inductive Constructions. For this
reason, our book contains many examples, all of which can be replayed by the
reader on a computer. For pedagogical reasons, some examples also exhibit er
roneous or clumsy uses and guidelines to avoid problems. We have often tried
to decompose the dialogues so that the user can reproduce them, either with
pen and paper or directly with the Coq system. Sometimes, we have also in
cluded synthetic expressions that may look impressive at first sight, but these
terms have also been obtained with the help of the Coq proof assistant. The
reader should decompose these expressions in practical experiments, modify
them, understand their structure, and get a practical feeling for them.
Our book has an associated site,l where the reader can download and
replay all the examples of proofs and-in cases of emergency-the solutions
of the 200 exercises of the book. Our book and our site both use Coq VB, 2
released in the beginning of 2004.
The confidence the user can have in theorems proved with the Coq system
relies on the properties of the Calculus of Inductive Constructions, a formalism
that combines several of the recent advances in logic from the point of view
of A-calculus and typing. The main properties of this calculus are presented
herein, since we believe that some knowledge of both theory and practice is
the best way to use Coq's full expressive power.
The Coq language is extremely powerful and expressive, both for reasoning
and for programming. There are several levels of competence, from the ability
to construct simple terms and perform simple proofs to building whole theories
and studying complex algorithms. We annotate chapters and sections with
1 www.labri.fr/Perso/..-.casteran/CoqArt/
2 coq.inria.fr
VI Preface
information about the level of competence required to understand them, as
follows:
(no annotation) accessible at first reading,
* readable by intermediate-level practitioners,
** accessible to expert users able to master complex reasoning and certify
programs,
*** reserved for the specialist who is interested in exploring all the possibilities
of Coq formalization.
A similar annotation pattern is used for the exercises, from the elementary
ones (solved in a few minutes) to the extremely hard ones (which may require
several days of thought). Many of these exercises are simplified versions of
problems we encountered in our research work.
Acknowledgements
Many people have enthusiastically helped us in the compilation of this book.
Special thanks go to Laurence Rideau for her cheerful support and her at
tentive reading, from the very first drafts to the last version. Gerard Huet
and Janet Bertot also invested a lot of their time and efforts in helping us
improve both the technical accuracy and the writing style. We are also espe
cially grateful to Gerard Huet and Christine Paulin-Mohring for the foreword
they contributed.
The Coq development team at large also deserves our gratitude for having
produced such a powerful tool. In particular, Christine Paulin-Mohring, Jean
Christophe Filliatre, Eduardo Gimenez, Jacek Chq:aszcz, and Pierre Letouzey
gave us invaluable insights on the internal consistency of the inductive types,
imperative program representation, co-inductive types, modules, and extrac
tion, and sometimes they also contributed a few pages and a few examples.
Hugo Herbelin and Bruno Barras were key collaborators in helping us make
sure that all the experiments described in this book Can be reproduced by the
reader.
Our knowledge of the domain also grew through the experiments we per
formed with the students we were lucky to teach or to work with. In particular,
some of the ideas described in this book were only understood after teaching
at the Ecole Normale Superieure de Lyon and the University Bordeaux I and
after studying the questions raised and often solved in collaborations with
Davy Rouillard, Antonia Balaa, Nicolas Magaud, Kuntal Das Barman, and
Guillaume Dufay.
Many students and researchers gave some of their time to read early drafts
of this book, use them as teaching or learning support, and suggest improve
ments or alternative solutions. We wish to thank all those who sent us precious
feedback: Hugo Herbelin, Jean-Franc;ois Monin, Jean Duprat, Philippe Nar
bel, Laurent Thery, Gilles Kahn, David Pichardie, Jan Cederquist, Frederique
Preface VII
Guilhot, James McKinna, Iris Loeb, Milad Niqui, Julien Narboux, Solange
Coupet-Grimal, Sebastien Hinderer, Areski Nait-Abdallah, and Simao Melo
de Sousa.
Our respective research environments played a key role in seeing this
project through thanks to their support. We are especially grateful to the
Lemme and Signes teams at INRIA and the University Bordeaux I for their
support and to the European working group Types for the opportunities they
gave us to meet with innovative young researchers like Ana Bove, Venanzio
Capretta, or Conor McBride who also inspired some of the examples detailed
in this book.
We are very grateful to the people of Springer-Verlag who made this book
possible, especially Ingeborg Mayer, Alfred Hofman, Ronan Nugent, Nicolas
Puech, Petra Treiber and Frank Holzwarth. Their encouragement and advice
on content, presentation, editing, and typesetting have been essential. We
also thank Julia Merz of KiinkelLopka GmbH for the cover design with the
beautiful piece of art.
Sophia Antipolis Yves Bertot
Talence Pierre Casteran
March 2004
Foreword
When Don Knuth undertook his masterpiece to lay the foundations of com
puter science in a treatise on programming, he did not choose to entitle his
work "The Science of Computer Programming" but "The Art of Computer
Programming." Accordingly, it took 30 more years of research to really es
tablish a rigorous field on programming and algorithms. In a similar fashion,
the rigorous foundations of the field of formal proof design are still being laid
down. Although the main concepts of proof theory date back to the work of
Gentzen, Godel, and Herbrand in the 1930s, and although Turing himself had
a pioneering interest in automating the construction of mathematical proofs,
it is only during the 1960s that the first experiments in automatic first-order
logic by systematically enumerating the Herbrand domain took place. Forty
years later, the Cog proof assistant is the latest product in a long series of
investigations on computational logic and, in a way, it represents the state of
the art in this field. However, its actual use remains a form of art, difficult
to master and to improve. The book of Yves Bertot and Pierre Casteran is
an invaluable guide, providing beginners with an initial training and regular
practitioners with the necessary expertise for developing the mathematical
proofs that are needed for real-size applications.
A short historical presentation of the Cog system may help to understand
this software and the mathematical notions it implements. The origins of the
underlying concepts may also provide clues to understanding the mechanics
that the user must control, the various points of view to adopt when building
a system's model, the options to consider in case of trouble.
Gerard Huet started working on automatic theorem proving in 1970, us
ing LISP to implement the SAM prover for first-order logic with equality. At
the time, the state of the art was to translate all logical propositions into lists
(conjunctions) of lists (disjunctions) of literals (signed atomic formulas), quan
tification being replaced by Skolem functions. In this representation deduction
was reduced to a principle of pairing complementary atomic formulas modulo
instantiation (so-called resolution with principal unifiers). Equalities gave rise
to unidirectional rewritings, again modulo unification. Rewriting order was
X Foreword
determined in an ad hoc way and there was no insurance that the process
would converge, or whether it was complete. Provers were black boxes that
generated scores of unreadable logical consequences. The standard working
technique was to enter your conjecture and wait until the computer's mem
ory was full. Only in exceptionally trivial cases was there an answer worth
anything. This catastrophic situation was not recognized as such, it was un
derstood as a necessary evil, blamed on the incompleteness theorems. Nev
ertheless, complexity studies would soon show that even in decidable areas,
such as propositional logic, automatic theorem proving was doomed to run
into a combinatorial wall.
A decisive breakthrough came in the 1970s with the implementation of a
systematic methodology to use termination orders to guide rewriting, starting
from the founding paper of Knuth and Bendix. The KB software, implemented
in 1980 by Jean-Marie Hullot and Gerard Huet, could be used to automate
in a natural way decision and semi-decision procedures for algebraic struc
tures. At the same time, the domain of proofs by induction was also making
steady progress, most notably with the NQTHMj ACL of Boyer and Moore.
Another significant step had been the generalization of the resolution tech
nique to higher-order logic, using a unification algorithm for the theory of
simple types, designed by Gerard Huet back in 1972. This algorithm was con
sistent with a general approach to unification in an equational theory, worked
out independently by Gordon Plotkin.
At the same time, logicians (Dana Scott) and theoretical computer sci
entists (Gordon Plotkin, Gilles Kahn, Gerard Berry) were charting a logical
theory of computable functions (computational domains) together with an
effectively usable axiomatization (computational induction) to define the se
mantics of programming languages. There was hope of using this theory to
address rigorously the problem of designing trustworthy software using formal
methods. The validity of a program with respect to its logical specifications
could be expressed as a theorem in a mathematical theory that described the
data and control structures used by the algorithm. These ideas were set to
work most notably by Robin Milner's team at Edinburgh University, who im
plemented the LCF system around 1980. The salient feature of this system
was its use of proof tactics that could be programmed in a meta-language
(ML). The formulas were not reduced to undecipherable clauses and users
could use their intuition and knowledge of the subject matter to guide the
system within proofs that mixed automatic steps (combining predefined and
specific tactics that users could program in the ML language) and easily un
derstandable manual steps.
Another line of investigation was explored by the philosopher Per Martin
Lof, starting from the constructive foundations of mathematics initially pro
posed by Brouwer and extended notably by Bishop's development of con
structive analysis. Martin-Lof's Intuitionistic Theory of Types, designed at
the beginning of the 1980s, provided an elegant and general framework for
the constructive axiomatization of mathematical structures, well suited to
Foreword XI
serve as a foundation for functional programming. This direction was seri
ously pursued by Bob Constable at Cornell University who undertook the
implementation of the NuPRL software for the design of software from formal
proofs, as well as by the "Programming methodology" team headed by Bengt
Nordstrom at Chalmers University in Gothenburg.
All this research relied on the A-calculus notation, initially designed by
the logician Alonzo Church, in its pure version as a language to define recur
sive functionals, and in its typed version as a higher-order predicate calculus
(the theory of simple types, a simpler alternative for meta-mathematics to
the system originally used by Whitehead and Russell in Principia Mathemat
ica). Furthermore, the A-calculus could also be used to represent proofs in
a natural deduction format, thus yielding the famous "Curry-Howard corre
spondence," which expresses an isomorphism between proof structures and
functional spaces. These two aspects of the A-calculus were actually used
in the Automath system for the representation of mathematics, designed by
Niklaus de Bruijn in Eindhoven during the 1970s. In this system, the types of
A-expressions were no longer simple hierarchical layers of functional spaces.
Instead they were actually A-expressions that could express the dependence
of a functional term's result type on the value of its argument-in analogy
with the extension of propositional calculus to first-order predicate calculus,
where predicates take as arguments terms that represent elements of the car
rier domain.
A-calculus was indeed the main tool in proof theory. In 1970, Jean-Yves
Girard proved the consistency of Analysis through a proof of termination for a
polymorphic A-calculus called system F. This system could be generalized to
a calculus Fw with polymorphic functionals, thus making it possible to encode
a class of algorithms that transcended the traditional ordinal hierarchies. The
same system was to be rediscovered in 1974 by John Reynolds, as a proposal
for a generic programming language that would generalize the restricted form
of polymorphism that was present in ML.
In the early 1980s, research was in full swing at the frontier between logic
and computer science, in a field that came to be known as Type Theory.
In 1982 Gerard Huet started the Formel project at INRIA's Rocquencourt
laboratory, jointly with Guy Cousineau and Pierre-Louis Curien from the
computer science laboratory at Ecole Normale Superieure. This team set the
objective of designing and developing a proof system extending the ideas of
the LCF system, in particular by adopting the ML language not only as the
meta-language used to define tactics but also as the implementation language
of the whole proof system. This research and development effort on functional
programming would lead over the years to the Caml language family and,
ultimately, to its latest offspring Objective Caml, still used to this day as the
implementation language for the Coq proof assistant.
At the international conference on types organized by Gilles Kahn in
Sophia Antipolis in 1984, Thierry Coquand and Gerard Huet presented a syn
thesis of dependent types and polymorphism that made it possible to adapt
