proof assistants as a tool for thought

138
Proof assistants as a tool for thought Katherine Ye Tools for thought workshop, March ’16 @hypotext

Upload: others

Post on 28-Dec-2021

2 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: Proof assistants as a tool for thought

Proof assistants as a tool for thought

Katherine Ye

Tools for thought workshop, March ’16

@hypotext

Page 2: Proof assistants as a tool for thought

circa 1700

Page 3: Proof assistants as a tool for thought

Disputants unable to agree would not waste much time in futile argument...

Leibniz (Harrison)

Page 4: Proof assistants as a tool for thought

Calculemus!

Page 5: Proof assistants as a tool for thought

1. universal language2. calculus for reasoning

Page 6: Proof assistants as a tool for thought

Proof assistant: Coq

Page 7: Proof assistants as a tool for thought

1. universal language2. calculus for reasoning

Page 8: Proof assistants as a tool for thought

1. universal language2. calculus for reasoning

3. rich environment

Page 9: Proof assistants as a tool for thought

High-assurance cryptographyNew foundations for math

Program synthesisVerifying hardwareProofs as stories

Formally verifying that God exists...

Page 10: Proof assistants as a tool for thought
Page 11: Proof assistants as a tool for thought

Example 1:math, induction

Credit to “Software Foundations,” Pierce et al.

Page 12: Proof assistants as a tool for thought

Say we want to prove something about

adding natural numbers.

Page 13: Proof assistants as a tool for thought

Inductive  nat  :  Set  :=    |  O  :  nat    |  S  :  nat  -­‐>  nat.

Fixpoint  plus  (x  y  :  nat)  :=    match  x  with    |  O  =>  y    |  S  x'  =>  S  (plus  x'  y)    end.

Natural number = either 0

or 1 + a nat

Page 14: Proof assistants as a tool for thought

Inductive  nat  :  Set  :=    |  O  :  nat    |  S  :  nat  -­‐>  nat.

Fixpoint  plus  (x  y  :  nat)  :=    match  x  with    |  O  =>  y    |  S  x'  =>  S  (plus  x'  y)    end.

0 + y = y(1 + x’) + y = 1 + (x’ + y)

Page 15: Proof assistants as a tool for thought

Inductive  nat  :  Set  :=    |  O  :  nat    |  S  :  nat  -­‐>  nat.

Fixpoint  plus  (x  y  :  nat)  :=    match  x  with    |  O  =>  y    |  S  x'  =>  S  (plus  x'  y)    end.

(*  O  =  0,  S  O  =  1,  S  (S  O)  =  2  *)Eval  compute  in  (plus  O  O).          (*  0  +  0  =  0  *)

“Unit tests”

Page 16: Proof assistants as a tool for thought

Inductive  nat  :  Set  :=    |  O  :  nat    |  S  :  nat  -­‐>  nat.

Fixpoint  plus  (x  y  :  nat)  :=    match  x  with    |  O  =>  y    |  S  x'  =>  S  (plus  x'  y)    end.

Page 17: Proof assistants as a tool for thought

“Unit tests” aren't enough. Now we want prove that our

computational `plus` satisfies the properties of the mathematical +.

Page 18: Proof assistants as a tool for thought

Theorem  add0_left_id  :  forall  (n  :  nat),  plus  O  n  =  n.Proof.    intros  n.    simpl.    reflexivity.Qed.

0 is a left identity

Page 19: Proof assistants as a tool for thought

Theorem  add0_left_id  :  forall  (n  :  nat),  plus  O  n  =  n.Proof.    intros  n.    simpl.    reflexivity.Qed.

Fixpoint  plus  (x  y  :  nat)  :=    match  x  with    |  O  =>  y    |  S  x'  =>  S  (plus  x'  y)    end.

By definition

Page 20: Proof assistants as a tool for thought

Theorem  add0_left_id  :  forall  (n  :  nat),  plus  O  n  =  n.Proof.    intros  n.    simpl.    reflexivity.Qed.

Fixpoint  plus  (x  y  :  nat)  :=    match  x  with    |  O  =>  y    |  S  x'  =>  S  (plus  x'  y)    end.

Page 21: Proof assistants as a tool for thought

0 is a right identityFixpoint  plus  (x  y  :  nat)  :=    match  x  with    |  O  =>  y    |  S  x'  =>  S  (plus  x'  y)    end.

Page 22: Proof assistants as a tool for thought
Page 23: Proof assistants as a tool for thought
Page 24: Proof assistants as a tool for thought
Page 25: Proof assistants as a tool for thought
Page 26: Proof assistants as a tool for thought
Page 27: Proof assistants as a tool for thought
Page 28: Proof assistants as a tool for thought
Page 29: Proof assistants as a tool for thought
Page 30: Proof assistants as a tool for thought
Page 31: Proof assistants as a tool for thought

Exercise for the reader:

Theorem  plus_commutativity  :forall  (n  m  :  nat),  plus  n  m  =  plus  m  n.

Page 32: Proof assistants as a tool for thought

Example 2: large real-world

verification

Page 33: Proof assistants as a tool for thought
Page 34: Proof assistants as a tool for thought

1. Functional correctness (logic, program analysis)

2. Security (math, probability, program analysis)

Page 35: Proof assistants as a tool for thought
Page 36: Proof assistants as a tool for thought

5+ months of work by 4 authors

~15,000 lines of Coq code, most of which will not be read by other people

Page 37: Proof assistants as a tool for thought

Time for cognitive dissonance!

Page 38: Proof assistants as a tool for thought

The house believes that Coq is an incredible

tool for thought.

Page 39: Proof assistants as a tool for thought

The house believes that Coq is a terrible tool

for thought.

Page 40: Proof assistants as a tool for thought

The house believes that Coq is an incredible

tool for thought.

Page 41: Proof assistants as a tool for thought

Built on top of:

written notation

Page 42: Proof assistants as a tool for thought

Built on top of:

written notationtext editors

Page 43: Proof assistants as a tool for thought

Built on top of:

written notationtext editorsGallina

Page 44: Proof assistants as a tool for thought

Built on top of:

written notationtext editorsGallinaLtac

Page 45: Proof assistants as a tool for thought

Built on top of:

written notationtext editorsGallinaLtacchecker

Page 46: Proof assistants as a tool for thought

Built on top of:

written notationtext editorsGallinaLtaccheckerREPL/IDE

Page 47: Proof assistants as a tool for thought

Started from the bottom, now we here

Page 48: Proof assistants as a tool for thought

Proof entrepreneur: fail fast,

minimum viable proof...

Page 49: Proof assistants as a tool for thought

Proof state bookkeeping: assumptions, definitions, goals

Page 50: Proof assistants as a tool for thought

Computation, evaluation, automation

Page 51: Proof assistants as a tool for thought

Try

Brain says:this isn’t right... I think

Fail Fix

Maybe right?

Maybe right?

Page 52: Proof assistants as a tool for thought

Try

Coq says:This is locally wrong!

Wrong type /Can’t prove it /

Can’t use tactic /Strange computation

Fail Fix

Page 53: Proof assistants as a tool for thought

Sketching with lemmas

Page 54: Proof assistants as a tool for thought

Goal

Lemma 1 Lemma 2

Lemma 4 Lemma 5

Lemma 3

Coq: OK!

admitted admitted admitted

admitted

admitted admitted

Coq: OK! Coq: OK!

Coq: OK! Coq: OK!

Page 55: Proof assistants as a tool for thought

Goal

Lemma 1 Lemma 2

Lemma 4 Lemma 5

Lemma 3

Coq: OK!

QED

Coq: OK! Coq: OK!

Coq: OK! Coq: OK!

QED QED

QED

QED QED

Page 56: Proof assistants as a tool for thought

Math as a game

Page 57: Proof assistants as a tool for thought

You don’t have to remember all the rules

yourself.

Page 58: Proof assistants as a tool for thought

x + 20 = y

x = y - 20

Page 59: Proof assistants as a tool for thought

x + 20 = yx + 20 - 20 = y - 20

x = y - 20

Page 60: Proof assistants as a tool for thought

Civilization advances by extending the number of important operations which can be performed without thinking about them. Whitehead

Page 61: Proof assistants as a tool for thought

Goal: beat the level.Proof state: inventory.

Tactics: moves.Checker: walls.

Page 62: Proof assistants as a tool for thought
Page 63: Proof assistants as a tool for thought

We need Coq in order to keep doing math.

Page 64: Proof assistants as a tool for thought

A technical argument by a trusted author ... is hardly ever checked in detail.

VoevodskyFields medalist

Page 65: Proof assistants as a tool for thought

The only real long-term solution to the problem is to start using computers in the verification of mathematical reasoning.

VoevodskyFields medalist

Page 66: Proof assistants as a tool for thought

We need proofs that are less error-prone and more ... mechanically verifiable.

Bellarecryptographer

Page 67: Proof assistants as a tool for thought

Many proofs in cryptography have become essentially unverifiable. Our field may be approaching a crisis of rigor.

Bellarecryptographer

(100+ citations!)

Page 68: Proof assistants as a tool for thought

1. Programmer affordances2. Math as a game3. “Crisis of rigor”

Pro-Coq:

Page 69: Proof assistants as a tool for thought

The house believes that Coq is a terrible tool

for thought.

Page 70: Proof assistants as a tool for thought

Calculemus?

Page 71: Proof assistants as a tool for thought

Games are designed for humans to solve.

Math isn’t!

Page 72: Proof assistants as a tool for thought

What could go wrong?

Page 73: Proof assistants as a tool for thought

Your theorem is: too specific, so you need to generalizestraight-up wrong, so you need a counterexampletrue, but you need to be creativetrue, but you discarded the One Ring

Page 74: Proof assistants as a tool for thought

Your theorem is: too specific, so you need to generalizestraight-up wrong, so you need a counterexampletrue, but you need to be creativetrue, but you discarded the One Ring

Page 75: Proof assistants as a tool for thought

Your theorem is: too specific, so you need to generalizestraight-up wrong, so you need a counterexampletrue, but you need to be creativetrue, but you discarded the One Ring

Page 76: Proof assistants as a tool for thought

Your theorem is: too specific, so you need to generalizestraight-up wrong, so you need a counterexampletrue, but you need to be creativetrue, but you discarded the One Ring

Page 77: Proof assistants as a tool for thought
Page 78: Proof assistants as a tool for thought

Work on paper first, then in computer :(

Page 79: Proof assistants as a tool for thought

Coq blindfolds the intuition.We’re not “Coq natives”!

Page 80: Proof assistants as a tool for thought

Built on top of:

written notationtext editorsGallinaLtaccheckerIDE

Page 81: Proof assistants as a tool for thought

Started from the bottom...now we’re back.

Page 82: Proof assistants as a tool for thought

Try

Coq says:This is locally wrong!

Wrong type /Can’t prove it /

Can’t use tactic /Strange computation

Fail FixTry

Fail Fix

Try

Fail Fix

Fail Fix

Try

Fix

Coq says:This is locally wrong!

Wrong type /Can’t prove it /

Can’t use tactic /Strange computation

Coq says:This is locally wrong!

Wrong type /Can’t prove it /

Can’t use tactic /Strange computation

Coq says:This is locally wrong!

Wrong type /Can’t prove it /

Can’t use tactic /Strange computation

Coq says:This is locally wrong!

Wrong type /Can’t prove it /

Can’t use tactic /Strange computation

Try

Coq says:This is locally wrong!

Wrong type /Can’t prove it /

Can’t use tactic /Strange computation

Coq says:This is locally wrong!

Wrong type /Can’t prove it /

Can’t use tactic /Strange computation

Coq says:This is locally wrong!

Wrong type /Can’t prove it /

Can’t use tactic /Strange computation

????

Page 83: Proof assistants as a tool for thought

REPLs are aliveand make us reactive

Page 84: Proof assistants as a tool for thought

Try

Brain says:this isn’t right...

I think.

Fail Fix

Page 85: Proof assistants as a tool for thought

Paper is calmand makes us active

Page 86: Proof assistants as a tool for thought

Paper forces us to figure out what’s going on,

formulate a hypothesis

Page 87: Proof assistants as a tool for thought

So, Coq makes proofs harder to write.

Page 88: Proof assistants as a tool for thought

...and harder to read!

Page 89: Proof assistants as a tool for thought

“write-only”

Page 90: Proof assistants as a tool for thought
Page 91: Proof assistants as a tool for thought

what are we trying to prove??

Page 92: Proof assistants as a tool for thought

Check  fcf_oracle_eq_until_bad.Locate  fcf_oracle_eq_until_bad.

Page 93: Proof assistants as a tool for thought

Why applied with these arguments?

Page 94: Proof assistants as a tool for thought

What are all of these subgoals?

Page 95: Proof assistants as a tool for thought

What hypothesis did I use?

Page 96: Proof assistants as a tool for thought

Wait, that proved the theorem???!!

Page 97: Proof assistants as a tool for thought

No sense of hierarchy, importance, narrative. Where’s the intuition?

Page 98: Proof assistants as a tool for thought

Written by computers, for computers

Page 99: Proof assistants as a tool for thought

Intuition Intuition

Proof

Page 100: Proof assistants as a tool for thought

Intuition Intuition

Proof

Ok Ok

???

Page 101: Proof assistants as a tool for thought

The role of the human is not to understand,

but to trust.

Page 102: Proof assistants as a tool for thought

Text is a double-edged sword.

Page 103: Proof assistants as a tool for thought

Powerful ways to manipulate and search

text...

Page 104: Proof assistants as a tool for thought

...but not pictures.

Page 105: Proof assistants as a tool for thought

Machine Checkable Pictorial Mathematics

Proof by ASCII art

Page 106: Proof assistants as a tool for thought

The house believes that Coq is an incredible

tool for thought.

Page 107: Proof assistants as a tool for thought

Programmers’ affordances: precise language, instant feedback (correctness

checking, REPL)

Page 108: Proof assistants as a tool for thought

“You don’t have to know all the rules.”

Page 109: Proof assistants as a tool for thought

Our only hope.

Page 110: Proof assistants as a tool for thought

The house believes that Coq is a terrible tool

for thought.

Page 111: Proof assistants as a tool for thought

By computers, for computers.

Page 112: Proof assistants as a tool for thought

Destroys intuition.

Page 113: Proof assistants as a tool for thought

Built on top of:

written notationtext editorsGallinaLtaccheckerIDE

Page 114: Proof assistants as a tool for thought

How can we make proof assistants

“intuition assistants”?

Page 115: Proof assistants as a tool for thought

Incremental improvements

Page 116: Proof assistants as a tool for thought

Visualize theorem dependency tree

Page 117: Proof assistants as a tool for thought
Page 118: Proof assistants as a tool for thought

“Explanatory,” human-readable proofs:

diff proof states

Page 119: Proof assistants as a tool for thought

Translate proofs into Englishor a better tactic language

Page 120: Proof assistants as a tool for thought

A Declarative Language For The Coq Proof Assistant, Corbineau

Page 121: Proof assistants as a tool for thought

Different interfaces for different areas of math

Page 122: Proof assistants as a tool for thought

One visual interface: Ancient Greek Geometry

Page 123: Proof assistants as a tool for thought

Calculemus is necessary—but not sufficient!

Page 124: Proof assistants as a tool for thought

Thanks!Katherine Ye@hypotext

Page 125: Proof assistants as a tool for thought

Appendix

Page 126: Proof assistants as a tool for thought

Example 3: program equivalence

Page 127: Proof assistants as a tool for thought
Page 128: Proof assistants as a tool for thought
Page 129: Proof assistants as a tool for thought
Page 130: Proof assistants as a tool for thought
Page 131: Proof assistants as a tool for thought
Page 132: Proof assistants as a tool for thought
Page 133: Proof assistants as a tool for thought
Page 134: Proof assistants as a tool for thought
Page 135: Proof assistants as a tool for thought
Page 136: Proof assistants as a tool for thought
Page 137: Proof assistants as a tool for thought
Page 138: Proof assistants as a tool for thought