Locally nameless representation with cofinite quantificationThe locally nameless representation with cofinite quantification is a pratical technique for representing binders in a formal settings. The locally nameless representation avoids the need for alphaconversion and the need for shifting de Bruijn indices. The cofinite quantification is used to obtain strong induction principles. This approach has been successfully applied to formalize many type systems. Download
Related publicationsTutorial
Details on the tactics and automation techniques used can be found here. Main developments
Additional tutorial examples
Formal representation of variable bindingProving theorems about programming language semantics or types systems usually involves long and tedious proofs, with many uninteresting cases. However, the slightest mistake in a proof can easily compromise the soundness of the entire system. Machinechecked proofs appear as an ideal solution: they eliminate the possibility for errors in proofs, and easy proof cases can be automatically handled by bruteforce proof search. Yet, the formalization of programming languages requires a formal representation of variable bindings. In paper proofs, alphaconversion is easily dealt with by adopting Barendregt's convention (1992). Reproducing a similar style of reasoning in formal proofs has been a longstanding challenge. In 2005, based on the observation that no existing technique was practical and general enough for formally reasoning about binders, a number of researchers proposed the POPLMark challenge as a way to stimulate new research on the topic (Aydemir et al 2005). This challenge, which received a lot of attention in the community, led to two the development of two new approaches: the nominal approach, mainly developed by Urban (2005), and another approach called locally nameless with cofinite quantification. I have developed the latter during an internship at UPenn in 2006, with Benjamin Pierce and Stephanie Weirich as advisors. Brian Aydemir and Randy Pollack then joined us in 2007 and contributed to the formal developments and to the proof of adequacy, respectively. Locally nameless with cofinite quantificationThe first ingredient is the locally nameless representation, in which bound variables are represented using de Bruijn indices, whereas free variables are represented using names. This representation, whose possibility has been mentioned by de Bruijn himself (1972), is a variant of the locally named approach of McKinna and Pollack (1993). Gordon (1994) first employed the locally nameless representation, and Leroy (2005) experimented it on the POPLMark challenge . The second ingredient is the cofinite quantification, which plays a key role in making it possible to directly obtain strong induction principles. Without it, a large number of renaming lemmas are required, as experienced by Leroy in his POPLMark solution. The cofinite quantification plays a similar role as in Gabbay and Pitts' nominal logic (1999), with the difference that it is here used in a standard logic and that is is introduced directly in inductive definitions. The particular way in which we combine these two ingredients leads to concise developments that remain quite faithful to the presentation of conventional paper proofs. We have illustrated the applicability of this technique on four major developments: the formalization of ML with datatypes, references and exceptions, the formalization of System F with subtyping, the formalization of the Calculus of Constructions, and the formalization of the CPS translation. The locally nameless approach has already been adopted by dozens of researchers. A nonexhaustive list can be found at the bottom of this page. Example proof scriptAn excerpt from the formalization of simplytyped lambdacalculus. (* Definition of the grammar of terms *) Inductive trm : Type :=  trm_bvar : nat > trm (* bound variable in de Bruijn style *)  trm_fvar : var > trm (* free variable in named style *)  trm_abs : trm > trm  trm_app : trm > trm > trm. (* Definition of the typing relation *) Inductive typing : ctx > trm > typ > Prop :=  typing_var : forall E x T, binds x T E > ok E > E = (trm_fvar x) ~: T  typing_abs : forall L E U T t1, (forall x, x \notin L > (* < cofinite quantification *) (E & x ~ U) = (t1 ^ x) ~: T) > E = (trm_abs t1) ~: (typ_arrow U T)  typing_app : forall S T E t1 t2, E = t1 ~: (typ_arrow S T) > E = t2 ~: S > E = (trm_app t1 t2) ~: T where "E = t ~: T" := (typing E t T). (* Proof of the substitution lemma *) Lemma typing_subst : forall F E t T x v U, (E & (x ~ U) & F) = t ~: T > E = v ~: U > (E & F) = ([x ~> v]t) ~: T. Proof. introv Typt Typu. gen_eq G: (E & x ~ U & F). gen F. induction Typt; intros G Equ; subst; simpl subst. (* var case: testing equality of a free variable with x *) case_var. binds_get H0. apply_empty* typing_weaken. binds_cases H0; apply* typing_var. (* abs case: has a cofinitelyquantified induction hypothesis *) apply_fresh typing_abs as y. rewrite* subst_open_var. apply_ih_bind* H0. (* app case: trivial *) apply* typing_app. Qed. Users (nonexhaustive list)
