Pourquoi Coq a Prop?

35

Coq a le type Prop de preuve des propositions non pertinentes qui sont rejetées lors de l'extraction. Quelle est la raison de cela si nous utilisons Coq uniquement pour les preuves. Prop est imprédicatif, donc Prop: Prop, cependant, Coq déduit automatiquement les index d'univers et nous pouvons utiliser le type (i) à la place partout. Il semble que Prop complique beaucoup tout.

J'ai lu qu'il y avait des raisons philosophiques pour séparer Set et Prop dans le livre de Luo, cependant, je ne les ai pas trouvées dans le livre. Que sont-ils?

Konstantin Solomatov
la source
6
“Si nous utilisons Coq uniquement pour les preuves”: Je pense que vous avez identifié un point clé ici. Le Coq n'est pas utilisé que pour les preuves.
Gilles, arrête d'être méchant.

Réponses:

34

est très utile pour l'extraction de programme car il nous permet de supprimer des parties de code inutiles. Par exemple, pour extraire un algorithmetri nous prouvons la déclaration « pour chaque liste il y a une liste k tel que k est ordonnée et k est un permutatiom de ». Si nous écrivons ceci en Coq et extrayons sans utiliser P r o p , nous aurons:PropkkkProp

  1. « pour tous il y a k » nous donnera une carte qui prend des listes de listes,ksort
  2. "tel que soit ordonné" donnera une fonction qui traversekverify et vérifie qu'elle est triée, etk
  3. « est une permutation de » donnera une permutation qui prend à k . Notez qu'il ne s'agit pas simplement d'une cartographie, mais également d'une cartographie inverse et de programmes vérifiant que les deux cartes sont réellement des inverses.kpikpi

Bien que le contenu supplémentaire ne soit pas totalement inutile, dans de nombreuses applications, nous souhaitons nous en débarrasser et le conserver sort. Ceci peut être accompli si nous utilisons à l' état « k est ordonnée » et « k est une permutation de », mais pas « pour tous il y a k ».Propkkk

En général, une manière commune au code extrait est de considérer une déclaration de la forme x:A.y:B.ϕ(x,y) where x is input, y is output, and ϕ(x,y) explains what it means for y to be a correct output. (In the above example A and B are the types of lists and ϕ(,k) is "k is ordered and k is a permutation of .") If ϕ is in Prop then extraction gives a map f:AB such that ϕ(x,f(x)) holds for all xA. If ϕ is in Set then we also get a function g such that g(x) is the proof that ϕ(x,f(x)) holds, for all xA. Often the proof is computationally useless and we prefer to get rid of it, especially when it is nested deeply inside some other statement. Prop gives us the possibility to do so.

PropProp. Here is a simpe example, where Σ means that we are in Type and means we are in Prop. If we extract from

Πn:NΣb:{0,1}Σk:Nn=2k+b
nbk
Πn:NΣb:{0,1}k:Nn=2k+b
then the program will only compute the lowest bit b. The machine cannot tell which is the correct one, the user has to tell it what he wants.
Andrej Bauer
la source
1
I'm slightly confused. Are you saying that without Prop it'd be impossible to recognize in the extracted program that g(x) doesn't contribute to the output (i.e. that it merely verifies it)? Are there scenarios where one wouldn't be able to pull out such useless code through the usual means available to code optimizers?
user
1
From the extracted program one could say, "I want k," and backtrack from there. I haven't been able to come up with a scenario so entangled that we couldn't optimize away anything that doesn't directly contribute to determining the permutation without it in fact being necessary for computing said permutation (from a global optimization standpoint, anyway).
user
1
You do not have the information "I want k". That is an extra assumption, and obviously once they tell you which particular result they want, you can just optimize away dead code. Actually, I thought of a better answer: it is a design question which things to put in Prop. You need to know what the user wants, and he tells you what he wants by using Prop. It is easy to come up with examples where there are several options. I will add one to my answer.
Andrej Bauer
2
As far as I know nobody can really tell how to extract anything from (1)-types. It's clear that they contain some computational content, but not what this might be.
Andrej Bauer
3
Ah, okay. Using Prop as a way of specifying design decisions makes a lot more sense to me than as a way of deleting useless code.
user
19

Prop is impredicative, which create a very expressive proof system. However it is "too" expressive in the following sense:

impredicative Prop+large elimination+excluded middle

is inconsistent. Usually you want to keep the possibility to add the excluded middle, so one solution is to keep large elimination and make Prop predicative. The other is to suppress large elimination.

Coq did both! They renamed the predicative Prop to Set, and disabled large elimination in Prop.

The expressiveness gained by impredicativity is "reassuring" in the sense 99% of "reasonable" mathematics can be formalized with it, and it is known to be consistent relative to set theory. This makes it likely they won't weaken it to something like Agda, which only has predicative universes.

cody
la source
8
Oh and I forgot to mention: it is not the case that Prop : Prop, that would be inconsistent. Rather quantifications over all propositions is again a proposition.
cody
Could you point me to any more resources about this? Everything I can find seems very scattered.
user833970
1
@user833970 any specific things you'd like pointers to? I'm afraid there isn't really an all encompassing reference for meta theory of dependent types. This discussion (which points back here!) might be useful: github.com/FStarLang/FStar/issues/360
cody
thank, I'm working through the Berardi paradox paper now, I think that will clear up my confusion.
user833970
14

Even if you are not interested in extracting programs, the fact that Prop is impredicative allows you to build some models which you can't build using a predicative tower of universes. IIRC Thorsten Altenkirch has a model of System F using Coq's impredicativity.

gallais
la source