## The Theory of LEGO - A Proof Checker for the Extended Calculus of Constructions (1994)

Citations: | 69 - 10 self |

### BibTeX

@TECHREPORT{Pollack94thetheory,

author = {Robert Pollack},

title = {The Theory of LEGO - A Proof Checker for the Extended Calculus of Constructions},

institution = {},

year = {1994}

}

### OpenURL

### Abstract

LEGO is a computer program for interactive typechecking in the Extended Calculus of Constructions and two of its subsystems. LEGO also supports the extension of these three systems with inductive types. These type systems can be viewed as logics, and as meta languages for expressing logics, and LEGO is intended to be used for interactively constructing proofs in mathematical theories presented in these logics. I have developed LEGO over six years, starting from an implementation of the Calculus of Constructions by G erard Huet. LEGO has been used for problems at the limits of our abilities to do formal mathematics. In this thesis I explain some aspects of the meta-theory of LEGO's type systems leading to a machine-checked proof that typechecking is decidable for all three type theories supported by LEGO, and to a verified algorithm for deciding their typing judgements, assuming only that they are normalizing. In order to do this, the theory of Pure Type Systems (PTS) is extended and f...

### Citations

1631 | The Definition of Standard ML
- Milner, Tofte, et al.
- 1997
(Show Context)
Citation Context ...with Harper, I started working on operational semantics to describe LEGO features such as argument synthesis, typical ambiguity, and the refinement proof tactic, with something like the SML semantics =-=[MTH90]-=- in mind; that is, a semi-formal explanation of all, or most, of LEGO's operation. I was especially encouraged by Bob Harper and Furio Honsell. My occasional trips to Paris to visit Coquand and Huet o... |

558 | Lambda calculi with types
- Barendregt
- 1992
(Show Context)
Citation Context ...omething about which rules might be used to derive it, and hence something about the immediate subderivations of any derivation. We call the lemmas that express this property generation lemmas (after =-=[Bar92]-=-), while Christine Paulin-Mohring calls them inversion properties [DFH + 93]. As they are very useful, the generation lemmas are among the first things we prove about an inductively defined relation. ... |

295 |
The Lambda Calculus: Its Syntax and Semantics, volume 103
- Barendregt
- 1984
(Show Context)
Citation Context ...n). The usual argument now is to show that parredn is (extensionally) the same relation as ordinary many-step beta-reduction, hence the CR theorem holds for ordinary beta-reduction (e.g. see p. 62 in =-=[Bar84]-=-). Ordinary one-step beta-reduction, red1, is defined informally in table 3--8 and formally in table 3--9; Redn is the reflexive-transitive closure of red1. Inductive [Redn:Trm-?Trm-?Prop] Constructor... |

276 |
Programming in Martin-Löf’s Type Theory. An Introduction
- Nordström, Petersson, et al.
- 1990
(Show Context)
Citation Context ... contexts, : : : ) and the relations on that syntax (reduction, conversion, typing, : : : ). 1.1.3 Logical Frameworks This idea appears in Automath [dB80], and is clarified and studied by Martin-Lsof =-=[NPS90]-=- and by Plotkin et. al. [HHP92,AHMP92,Pym90,Gar92]. Here the type system used as a meta theory may be very weak (e.g. consistency of the Edinburgh Logical Framework (LF) can be proved in PRA), althoug... |

207 |
A proof generating system for higher-order logic
- Gordon
- 1988
(Show Context)
Citation Context ...tandard logical system. 1.1.2 Direct Inductive Representation of an Object Theory Some formal systems represent inductively defined objects of some sort. Impredicative systems such as CC, ECC, or HOL =-=[Gor88] can expre-=-ss "the smallest set (type, relation) containings: : : ". Some systems (e.g. Coq [PM93]), even predicative ones (e.g. the Martin-Lsof framework [Dyb94] and Feferman's framework [Fef88]), hav... |

172 | Inductive definitions in the system Coq – rules and properties
- Paulin-Mohring
- 1993
(Show Context)
Citation Context ...ems represent inductively defined objects of some sort. Impredicative systems such as CC, ECC, or HOL [Gor88] can express "the smallest set (type, relation) containings: : : ". Some systems =-=(e.g. Coq [PM93]-=-), even predicative ones (e.g. the Martin-Lsof framework [Dyb94] and Feferman's framework [Fef88]), have explicit forms of controlled inductive definition. Such formal systems can be used as a formal ... |

120 | C.: Inductively defined types - Coquand, Paulin - 1990 |

114 |
Computation and reasoning. A type theory for computer science., volume 11
- Luo
- 1994
(Show Context)
Citation Context ...ry, give a (parameterized) typechecking algorithm and prove it correct for all three type systems supported by LEGO. This entire theory is developed in the formal language of ECC with inductive types =-=[Luo94]-=-, and machine checked using LEGO. This is an important contribution because correctness of typechecking is central for the approach to proof checking based on the type theoretic representation of logi... |

111 | An algorithm for testing conversion in type theory - Coquand - 1991 |

88 | Logics and Type Systems
- Geuvers
- 1993
(Show Context)
Citation Context ...ved form, is published as a section in [vBJMP94]. Here I present a similar development, extended to a class of type systems including ECC as well. The concept is also used, for different purposes, in =-=[Geu93]-=-, where it is credited to [vBJMP94]. Chapter 5. Semi-Full and Cumulative PTS : Typechecking ECC 99 Inductive [sfts:Cxt-?Trm-?Trm-?Prop] NoReductions Constructors [sfAx:--s1,s2---SS --sc:ax s1 s2 sfts ... |

87 | ECC: An Extended Calculus of Constructions
- Luo
- 1990
(Show Context)
Citation Context ...ssumed for cnv. 4.5.1 The Typing Lemma I want to mention, because of its beauty, a lemma that explains the possible variations in the type of a given term. This lemma is originally due to Luo for ECC =-=[Luo90a]-=-, where it explains cumulativity. A very similar result was found independently by Jutting [vBJ93] in his work to prove strengthening for PTS . I state it informally, and have not formalized the proof... |

85 | Using Typed Lambda Calculus to Implement Formal Systems on a Machine - Honsell, Pollack - 1992 |

85 |
an Introduction
- Intuitionism
- 1956
(Show Context)
Citation Context ...-de Bruijn Isomorphism This is undoubtedly the best known relationship between intuitionistic logic and type theory. Often called "propositions-as-types" this idea is based on the Heyting ex=-=planation [Hey71]-=- of the intuitionistic connectives. For example, a proof of A and B is a pair of a proof of A and a proof of B , so the logical notion, conjunction, can be represented by the type theoretic notion of ... |

78 | Elf: a language for logic definition and verified metaprogram- ming
- Pfenning
- 1989
(Show Context)
Citation Context ...l90], and LEGO has syntax, using ---, to indicate positions for term synthesis: [id = [A---Prop][x:A]x]; Chapter 2. Warming Up To LEGO 14 Now (id id) and (id three)have their expected types. Both ELF =-=[Pfe89]-=- and F-sub [Car91] have similar features, although with different syntax and slightly different semantics. There is also recent work on this idea [HT94]. With id defined as above, (id nat) is not well... |

77 | Inductive sets and families in Martin-Löf’s type theory and their set-theoretic semantics - Dybjer - 1991 |

76 |
Constructions : A Higher Order Proof System for Mechanizing Mathematics
- COQUAND, HUET
- 1985
(Show Context)
Citation Context ..., and along the way learn a little about type theory. It took less than a week to code a CC typechecker in Prolog, my first lambda calculus implementation, and I began working through the examples in =-=[CH85]-=-. In autumn 1986, at the University of Texas, Austin, my typechecker was received with enthusiastic interest from Bob Boyer, J Moore, and the logic seminar meeting at Boyer's house. In spring 1987, G ... |

70 | Inductive families
- Dybjer
- 1994
(Show Context)
Citation Context ...cative systems such as CC, ECC, or HOL [Gor88] can express "the smallest set (type, relation) containings: : : ". Some systems (e.g. Coq [PM93]), even predicative ones (e.g. the Martin-Lsof =-=framework [Dyb94]-=- and Feferman's framework [Fef88]), have explicit forms of controlled inductive definition. Such formal systems can be used as a formal meta theory in which one can directly represent the inductive de... |

62 | Isabelle's reference manual
- Paulson
- 1997
(Show Context)
Citation Context ...ed as a meta theory may be very weak (e.g. consistency of the Edinburgh Logical Framework (LF) can be proved in PRA), although stronger systems are also used as meta logics in this way, e.g. Isabelle =-=[Pau93a]-=-, an impredicative higher order logic. An object system is represented as a signature of constants for its language, axioms and rules. The inductive structure of object theories is not represented by ... |

45 | Set theory for verification: II. Induction and recursion
- Paulson
- 1995
(Show Context)
Citation Context ...ction Principles In set theory well-founded induction, based on the well-foundedness of 2 , is taken as primary and not only structural induction, but structure itself, is (laboriously) defined. (See =-=[Pau93b]-=- for a formalization of this approach.) In Type Theory we take structural induction as primary, and derive other induction principles from it. This approach follows the ideas of Per MartinLsof, which ... |

44 | and Gérard Huet. The calculus of constructions - Coquand - 1988 |

38 |
proof development system: User’s manual
- LEGO
- 1992
(Show Context)
Citation Context ...ith inductive types. P and CC [Bar91], viewed as subsystems of ECC, are also supported, and they may also be extended with inductive types. LEGO is freely available by ftp, along with a User's Manual =-=[LP92]-=-, some documentation on recent changes [JP93,JP94], a library of definitions and theorems about some basic types [JM93], and some examples. For more details than contained in this chapter see [LP92,JP... |

33 | A notation for lambda terms: A generalization of environments
- Nadathur, Wilson
- 1998
(Show Context)
Citation Context ...rete representation. However, there is some recent work on the problem of "intensional representations" with efficient Chapter 5. Semi-Full and Cumulative PTS : Typechecking ECC 129 computat=-=ion, e.g. [NW93]-=-, and there is no reason why a proofchecker cannot be much better than LEGO in this regard. Finally, andmost difficult in the long term, is the problem of efficiently executing the computational conte... |

29 |
Nordström: A short description of Another Logical Framework
- Augustsson, Coquand, et al.
- 1990
(Show Context)
Citation Context ...n. By that time, however, inductive types had become a hot topic in implementation as well as in theory. I had seen Martin-Lsof's "encoding" of inductive types implemented in the first versi=-=on of ALF [ACN90]-=- and, after discussions with Coquand and Luo, had a crude implementation of inductive types in LEGO by spring 1991. (I should have also discussed it with Paulin-Mohring, because I didn't understand ab... |

29 |
Type dependence and constructive mathematics
- Berardi
- 1990
(Show Context)
Citation Context ... Pure Calculus of Constructions (CC), then gets down to some machine-checked examples. CC is beautiful, the most successful formulation to date of the logicistic program for founding mathematics (see =-=[Ber90b]-=- for that Chapter 1. Introduction 5 story). CC is also syntactically simple, so I thought I could write a computer program for checking judgements in this logic, use it to experiment with formal mathe... |

29 | Checking Algorithms for Pure Type Systems
- Jutting, S, et al.
- 1993
(Show Context)
Citation Context ...ctness of types, and subject reduction (closure under reduction) are proved. 1 Chapter 1. Introduction 2 specific to type checking: Here we develop new mathematics (some of it previously published in =-=[vBJMP94]-=-) solving the difficulties encountered in extending previously understood techniques of typechecking to the type theories of LEGO. Although the material on general type theory mentioned above is based... |

26 | Type checking with universes
- Harper, Pollack
- 1991
(Show Context)
Citation Context ...ined too. I've still only begun to outline the the questions that actually come up in implementing a proofchecker. In 1988, Bob Harper and I addressed the problem of typechecking cumulative universes =-=[HP91]-=-; we were far from formalizing our definitions and theorems, let alone their proofs, but we reasoned about complex algorithmic issues in terms of formal systems (i.e. inductively defined relations), a... |

24 | Finitary Inductively Presented Logics
- Feferman
- 1988
(Show Context)
Citation Context ...r HOL [Gor88] can express "the smallest set (type, relation) containings: : : ". Some systems (e.g. Coq [PM93]), even predicative ones (e.g. the Martin-Lsof framework [Dyb94] and Feferman's =-=framework [Fef88]-=-), have explicit forms of controlled inductive definition. Such formal systems can be used as a formal meta theory in which one can directly represent the inductive definition of derivations of an obj... |

24 | Deliverables: A categorical approach to program development in type theory - McKinna, Burstall - 1993 |

22 | Representing Logics in Type Theory - Gardner - 1992 |

22 | Implicit syntax
- Pollack
- 1990
(Show Context)
Citation Context ...tions on the state of the proof, such as natural deduction discharge of assumptions, weakening and strengthening. As a pragmatic system, LEGO has "syntactic sugar", what I've called "Im=-=plicit Syntax" [Pol90]-=-, such as LEGO's argument synthesis, typical ambiguity, and universe polymorphism; these features have to be explained too. I've still only begun to outline the the questions that actually come up in ... |

22 | Closure Under AlphaConversion
- Pollack
- 1993
(Show Context)
Citation Context ...escribed mathematically and proven correct? (This involves not just a type theory, but a represenation of a type theory; for example the Constructive Engine's translation into nameless representation =-=[Pol94]-=-.) Could the Constructive Engine be extended to a type theory with universes [Hue87,HP91]? Type checking is only the start of the problem. For example, LEGO supports definitions, assigning a name to a... |

21 | Pure Type Systems with definitions
- SEVERI, POLL
- 1994
(Show Context)
Citation Context ...rt of the problem. For example, LEGO supports definitions, assigning a name to a (typed) term; do global definitions preserve normalizability of CC? Do local definitions also preserve normalizability =-=[SP94]-=-? LEGO also uses meta-variables to implement refinement proof. Are they handled correctly? Are LEGO's algorithms correct for testing conversion of types (with definitions) in a lazy manner, and for un... |

19 |
The death of proof
- Horgan
- 1993
(Show Context)
Citation Context ...find an error, your brain may disappear because of the Heisenberg uncertainty principle, and be replaced by a new brain that thinks the proof is correct. Leonid A. Levin, Boston University, quoted in =-=[Hor93]-=- This chapter is entirely informal, and somewhat tentative. It expresses my currently held opinion about some questions underlying the whole enterprise of mechanized mathematics. In previous chapters ... |

18 | and Computation in General Logic - Proofs - 1990 |

18 | The independence of Peano’s fourth axiom from Martin-Löf ’s type theory without Universes
- Smith
- 1988
(Show Context)
Citation Context ...a so-called large elimination rule in the entire formalization, and the extra strength is used only to prove Goal ttnotff: not (Q tt ff); which is not provable in ECC without a large elimination rule =-=[Smi88]-=- 1 . BB has the usual classical boolean operators, conjunction andd, disjunction orr and conditionalsif, together with the lifting functions istt and isff, which convert booleans to (decidable) propos... |

17 | Formulation of Martin-Lof's theory of types with explicit substitutions
- Tasistro
- 1993
(Show Context)
Citation Context ...more subtly, withwhere the line is drawn, below which we may identify entities as being different instances of the same symbol, and above which we distinguish them. In his recent system, described in =-=[Tas93]-=-, this line is at a very concrete level. Chapter 1. Introduction 8 By spring 1992 I had formalized some basic theory of PTS in Coquand's named representation, but was really stuck on the Thinning Lemm... |

16 |
A plea for weaker frameworks
- Bruijn
- 1991
(Show Context)
Citation Context ... the subject matter and the underlying formal logic is much more explicit than in most mathematics. By working with inductively defined notions where intensional equality coincides with book equality =-=[dB91]-=- of the object theory (e.g. see the comment in section 3.1.1 on equality), I have restricted myself to subject matter that fits very well with the underlying logic, ECC, and for this reason the underl... |

13 |
Algorithm development in the Calculus of Constructions
- Mohring
- 1986
(Show Context)
Citation Context ...ely, I understood nothing else about it. In spring of 1986, for Albert Meyer's Type Theory seminar, I read Christine Paulin-Mohring's paper on "Algorithm Development in the Calculus of Constructi=-=ons" [Moh86]-=-. In less than two pages she gives the language and typing judgement of the Pure Calculus of Constructions (CC), then gets down to some machine-checked examples. CC is beautiful, the most successful f... |

13 |
Pure Type Sytems formalized
- McKinna, Pollack
- 1993
(Show Context)
Citation Context ...version. The major formal results in this chapter are the Church-Rosser (CR) Theorems for reduction and conversion. Acknowledgement This chapter and much of the next are joint work with James McKinna =-=[MP93]-=-. 3.1 Pure Languages A Pure Language (PL) is a triple (PP; VV; SS) where ffl PP is an infinite set of parameters, ranged over by p , q . Parameters are the global, or free, variables. ffl VV is an inf... |

12 | Inductive Types and Strong Normalization - Constructions - 1993 |

10 |
Towards checking proof checkers
- Boyer, Dowek
- 1993
(Show Context)
Citation Context ...oduce proof objects that are checkable in some elementary and formally specified way, such as syntactically matching with the rules of the object logic. This is not a completely new idea (for example =-=[DB93]), but I m-=-ean to take it as part of a serious answer to the question of surveyability of formal proofs. If you want to believe that some judgement constructed in such a prover is "really" derivable, y... |

10 | On the idea of a general proof theory - Prawitz - 1974 |

8 |
Representing Algebra in LEGO
- Bailey
- 1993
(Show Context)
Citation Context ... partially correct typechecker on the currently distributed LEGO is that LEGO is very slow at computing in its object languages. Sorting short lists has been known to take hours; an enterprising user =-=[Bai93]-=- actually burned 56 hours on a big workstation factoring a small polynomial. One reason for this is that LEGO, built to be an interactive proofchecker, does not use internal representation selected fo... |

7 | A formalization of the strong normalization proof for system f in lego - Altenkirch - 1993 |

7 |
de Bruijn. A survey of the project AUTOMATH
- Nicolas
- 1980
(Show Context)
Citation Context ...ions are used to represent the object syntax (terms, contexts, : : : ) and the relations on that syntax (reduction, conversion, typing, : : : ). 1.1.3 Logical Frameworks This idea appears in Automath =-=[dB80]-=-, and is clarified and studied by Martin-Lsof [NPS90] and by Plotkin et. al. [HHP92,AHMP92,Pym90,Gar92]. Here the type system used as a meta theory may be very weak (e.g. consistency of the Edinburgh ... |

7 | Towards a foundation of a general proof theory - Prawitz - 1973 |

6 | On implicit arguments
- Hagiya, Toda
- 1995
(Show Context)
Citation Context ... (id three)have their expected types. Both ELF [Pfe89] and F-sub [Car91] have similar features, although with different syntax and slightly different semantics. There is also recent work on this idea =-=[HT94]-=-. With id defined as above, (id nat) is not well typed (because nat is a proposition, not an inhabitant of a proposition), so LEGO also has syntax to override implicit application: (id---nat) has type... |

5 |
the system
- F-sub
- 1991
(Show Context)
Citation Context ... syntax, using ---, to indicate positions for term synthesis: [id = [A---Prop][x:A]x]; Chapter 2. Warming Up To LEGO 14 Now (id id) and (id three)have their expected types. Both ELF [Pfe89] and F-sub =-=[Car91]-=- have similar features, although with different syntax and slightly different semantics. There is also recent work on this idea [HT94]. With id defined as above, (id nat) is not well typed (because na... |

5 | Extending the calculus of constructions with Type:Type. unpublished manuscript - Huet - 1987 |

5 | Completing the rationals and metric spaces in LEGO - Jones - 1992 |