SlideShare a Scribd company logo

Liquid Haskell: Theorem Proving for All

Facultad de Informática UCM, profile picture
Facultad de Informática UCM

The document discusses theorem proving using Haskell and refinement types, particularly focusing on the 'take' function and its implications for safety and performance in code. It highlights the importance of static checks to avoid issues like buffer over-reads, exemplified by the Heartbleed bug, and elaborates on how refinement types can help enforce safe programming practices. Additionally, it showcases a series of theorems and proofs within Haskell that demonstrate the connection between proofs as programs and the expressiveness of types.

Engineering
1 of 72
Download to read offline
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
Theorem Proving for All Niki Vazou
+ Haskell Refinement Types =
take :: [a] -> Int -> [a] > take [1,2,3] 2 > [1,2] Haskell
> take [1,2,3] 500 > ??? take :: [a] -> Int -> [a] Haskell
Refinement Types take :: xs:[a] -> {i:Int | i < len xs} -> [a]
> take [1,2,3] 500 > Refinement Type Error! take :: xs:[a] -> {i:Int | i < len xs} -> [a]
II. Application: Speed up Parsing III. Expressiveness: Theorem Proving I. Static Checks: Fast & Safe CodeStatic Checks Expressiveness
I. Static Checks: Fast & Safe CodeStatic Checks
Buffer overread in OpenSSL. 2015 The Heartbleed Bug
in
module Data.Text where take :: t:Text -> i:Int -> Text > take "hat" 500 > *** Exception: Out Of Bounds!
take :: t:Text -> i:Int -> Text take i t | i < len t = Unsafe.takeWord16 i t take i t = error “Out Of Bounds!” take :: t:Text -> i:Int -> Text take t i | i < len t = Unsafe.take t i take t i = error “Out Of Bounds!” Runtime Checks Safe, but slow!
take :: t:Text -> i:Int -> Text take i t | i < len t = Unsafe.takeWord16 i t take i t = error “Out Of Bounds!” take :: t:Text -> i:Int -> Text take t i | i < len t = Unsafe.take t i take t i = error “Out Of Bounds!” No Checks Fast, but unsafe!
No Checks > take "hat" 500 > “hat584562594SOHNUL… Overread take :: t:Text -> i:Int -> Text take i t | i < len t = Unsafe.takeWord16 i t take i t = error “Out Of Bounds!” take :: t:Text -> i:Int -> Text take t i | i < len t = Unsafe.take t i take t i = error “Out Of Bounds!”
take :: t:Text -> i:Int -> Text take i t | i < len t = Unsafe.takeWord16 i t take i t = error “Out Of Bounds!” take :: t:Text -> i:Int -> Text take t i | i < len t = Unsafe.take t i take t i = error “Out Of Bounds!” i < len t Static Checks
take :: t:Text -> i:Int -> Text take i t | i < len t = Unsafe.takeWord16 i t take i t = error “Out Of Bounds!” take :: t:Text -> i:Int -> Text take t i | i < len t = Unsafe.take t i take t i = error “Out Of Bounds!” Static Checks take :: t:Text -> i:{i < len t} -> Texti < len t
take :: t:Text -> i:Int -> Text take i t | i < len t = Unsafe.takeWord16 i t take i t = error “Out Of Bounds!” take :: t:Text -> i:Int -> Text take t i | i < len t = Unsafe.take t i take t i = error “Out Of Bounds!” Static Checks take :: t:Text -> i:{i < len t} -> Texti < len t
Static Checks take :: t:Text -> i:Int -> Text take i t | i < len t = Unsafe. = error “Out Of Bounds!” take :: t:Text -> i:{i < len t} -> Text take t i = Unsafe.take t i
take :: t:Text -> i:Int -> Text take i t | i < len t = Unsafe. = error “Out Of Bounds!” take :: t:Text -> i:{i < len t} -> Text take t i = Unsafe.take t i Static Checks > take "hat" 500 Type Error
OK Error Code Checks valid arguments, under facts. Refinement Types
take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts. len x = 3 => v = 500 => v < len x
len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts.
len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts.
len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts.
len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts.
len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts.
len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts. SMT- query
len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts. SMT- invalid
len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts. Checker reports Error
len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts. Checker reports Error
Checker reports Error len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts. 2 2 OK SMT- valid
Checks valid arguments, under facts. Static Checks OK Error Code
I. Static Checks: Fast & Safe Code II. Application: Speed up Parsing III. Expressiveness: Theorem Proving Static Checks
II. Application: Speed up Parsing III. Expressiveness: Theorem Proving I. Static Checks: Fast & Safe CodeStatic Checks Application: Speed up Parsing
II. Application: Speed up ParsingApplication: Speed up Parsing DEMO
Provably Correct & Faster Code! Application: Speed up Parsing SMT-Automatic Verification
SMT-Automatic Verification How expressive can we get?
II. Application: Speed up Parsing III. Expressiveness: Theorem Proving I. Static Checks: Fast & Safe CodeStatic Checks Expressiveness
III. Expressiveness: Theorem ProvingExpressiveness
Proof is in pen-and-paper :( reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED Theorem: For any x, Proof. reverse [x] = [x]
reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED Proof is not machine checked. Theorem: For any x, reverse [x] = [x] Proof.
reverse [x] — obviously! = [x] QED Proof is not machine checked. Theorem: For any x, reverse [x] = [x] Proof.
Proof is not machine checked. reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED Theorem: For any x, reverse [x] = [x] Check it with Liquid Haskell! Proof.
Theorems as Refinement Types Theorem: For any x, reverse [x] = [x] x:a ! { v:() | reverse [x] = [x] } Refinement Type: SMT equality
x:a ! { reverse [x] = [x] } Theorems as Refinement Types Theorem: For any x, reverse [x] = [x] Refinement Type:
Proof. reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED x:a ! { reverse [x] = [x] } How to connect theorem with proof?
Proofs are programs Theorems are types — Curry & Howard
reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED Proof as a Haskell function singletonP :: x:a ! { reverse [x] = [x] }x:a ! { reverse [x] = [x] } singletonP x = — applying ++ on [] and [x] ==. [x] *** QED
reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED singletonP x = reverse [x] — applying reverse on [x] ==. reverse [] ++ [x] — applying reverse on [] ==. [] ++ [x] — applying ++ on [] and [x] ==. [x] *** QED Proof as a Haskell function singletonP :: x:a ! { reverse [x] = [x] }x:a ! { reverse [x] = [x] }
reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED singletonP x = reverse [x] — applying reverse on [x] ==. reverse [] ++ [x] — applying reverse on [] ==. [] ++ [x] — applying ++ on [] and [x] ==. [x] *** QED singletonP :: x:a ! { reverse [x] = [x] } How to encode equality? x:a ! { reverse [x] = [x] }
Equational Operator in (Liquid) Haskell (==.) :: x:a -> y:{ a | x = y } -> {v:a | v = x && v = y } x ==. y = y checks both arguments are equal returns 2nd argument, to continue the proof!
reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED singletonP x = reverse [x] — applying reverse on [x] ===. reverse [] ++ [x] — applying reverse on [] ==. [] ++ [x] — applying ++ on [] and [x] ==. [x] *** QED singletonP :: x:a ! { reverse [x] = [x] }x:a ! { reverse [x] = [x] }
reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED singletonP x = reverse [x] — applying reverse on [x] ===. reverse [] ++ [x] — applying reverse on [] ==. [] ++ [x] — applying ++ on [] and [x] ==. [x] *** QED singletonP :: x:a ! { reverse [x] = [x] }x:a ! { reverse [x] = [x] }
reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED singletonP x = reverse [x] — applying reverse on [x] ===. reverse [] ++ [x] — applying reverse on [] ==. [] ++ [x] — applying ++ on [] and [x] ==. [x] *** QED singletonP :: x:a ! { reverse [x] = [x] } How to encode QED? x:a ! { reverse [x] = [x] }
Define QED as data constuctor… (***) :: a -> QED -> () _ *** QED = () data QED = QED … that casts anything into a proof (i.e., a unit value).
reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED singletonP x = reverse [x] — applying reverse on [x] ===. reverse [] ++ [x] — applying reverse on [] ==. [] ++ [x] — applying ++ on [] and [x] ==. [x] *** QED singletonP :: x:a ! { reverse [x] = [x] } Theorem Proving in Haskell x:a ! { reverse [x] = [x] }
singletonP :: x:a ! { reverse [x] = [x] } Theorems are Types Theorem Application is Function Call singletonP 1 :: { reverse [1] = [1] } x:a ! { reverse [x] = [x] }
singletonP1 :: { reverse [1] = [1] } singletonP1 = reverse [1] ? singletonP 1 ==. [1] *** QED Theorem Application is Function Call (?) :: a -> () -> a x ? _ = x
Reasoning about Haskell Programs in Haskell! Equational operators (==., ?, QED, ***) Theorem Proving for All let us encode proofs as Haskell functions checked by Liquid Haskell.
How to encode inductive proofs? Theorem Proving for All Reasoning about Haskell Programs in Haskell!
Theorem: For any list x, reverse (reverse x) = x. Proof. involutionP [] = reverse (reverse []) — applying inner reverse = reverse [] — applying reverse = [] QED involutionP (x:xs) = reverse (reverse (x:xs)) — applying inner reverse = reverse (reverse xs ++ [x]) — distributivity on (reverse xs) [x] = reverse [x] ++ reverse (reverse xs) — involution on xs = reverse [x] ++ xs — singleton on x = [x] ++ xs — applying ++ = x:([] ++ xs) — applying ++ = (x:xs) QED Base Case: Inductive Case:
Theorem: For any list x, reverse (reverse x) = x. Proof. involutionP [] = reverse (reverse []) — applying inner reverse = reverse [] — applying reverse = [] QED involutionP (x:xs) = reverse (reverse (x:xs)) — applying inner reverse = reverse (reverse xs ++ [x]) — distributivity on (reverse xs) [x] = reverse [x] ++ reverse (reverse xs) — involution on xs = reverse [x] ++ xs — singleton on x = [x] ++ xs — applying ++ = x:([] ++ xs) — applying ++ = (x:xs) QED Base Case: Inductive Case: Step 1: Define a recursive function!
Step 1: Define a recursive function! Proof. involutionP [] == reverse (reverse []) — applying inner reverse = reverse [] — applying reverse = [] QED involutionP (x:xs) == reverse (reverse (x:xs)) — applying inner reverse = reverse (reverse xs ++ [x]) — distributivity on (reverse xs) [x] = reverse [x] ++ reverse (reverse xs) — involution on xs = reverse [x] ++ xs — singleton on x = [x] ++ xs — applying ++ = x:([] ++ xs) — applying ++ = (x:xs) QED Step 2: Use equational operators Theorem: For any list x, reverse (reverse x) = x.
Proof. involutionP [] ==.=reverse (reverse []) — applying inner reverse ==. reverse [] — applying reverse ==. [] *** QED involutionP (x:xs) ==. reverse (reverse (x:xs)) — applying inner reverse ==. reverse (reverse xs ++ [x]) — distributivity on (reverse xs) [x] ==. reverse [x] ++ reverse (reverse xs) — involution on xs ==. reverse [x] ++ xs — singleton on x ==. [x] ++ xs — applying ++ ==. x:([] ++ xs) — applying ++ ==. (x:xs) *** QED Step 3: Lemmata are function calls!Step 2: Use equational operators Theorem: For any list x, reverse (reverse x) = x.
Proof. Step 3: Lemmata are function calls! involutionP [] ==.=reverse (reverse []) — applying inner reverse ==. reverse [] — applying reverse ==. [] *** QED involutionP (x:xs) ==. reverse (reverse (x:xs)) — applying inner reverse ==. reverse (reverse xs ++ [x]) ? distributivityP (reverse xs) [x] ==. reverse [x] ++ reverse (reverse xs) ? involutionP xs ==. reverse [x] ++ xs ? singletonP x ==. [x] ++ xs — applying ++ ==. x:([] ++ xs) — applying ++ ==. (x:xs) *** QED Theorem: For any list x, reverse (reverse x) = x.
Proof. involutionP [] ==.=reverse (reverse []) — applying inner reverse ==. reverse [] — applying reverse ==. [] *** QED involutionP (x:xs) ==. reverse (reverse (x:xs)) — applying inner reverse ==. reverse (reverse xs ++ [x]) ? distributivityP (reverse xs) [x] ==. reverse [x] ++ reverse (reverse xs) ? involutionP xs ==. reverse [x] ++ xs ? singletonP x ==. [x] ++ xs — applying ++ ==. x:([] ++ xs) — applying ++ ==. (x:xs) *** QED Note: Inductive hypothesis is recursive call! Theorem: For any list x, reverse (reverse x) = x.
Proof. involutionP [] ==.=reverse (reverse []) — applying inner reverse ==. reverse [] — applying reverse ==. [] *** QED involutionP (x:xs) ==. reverse (reverse (x:xs)) — applying inner reverse ==. reverse (reverse xs ++ [x]) ? distributivityP (reverse xs) [x] ==. reverse [x] ++ reverse (reverse xs) ? involutionP xs ==. reverse [x] ++ xs ? singletonP x ==. [x] ++ xs — applying ++ ==. x:([] ++ xs) — applying ++ ==. (x:xs) *** QED Question: Is the proof well founded? Theorem: For any list x, reverse (reverse x) = x.
Used to encode pen-and-pencil proofs https://bit.ly/2yjvJo3 “Theorem Proving for All”, Haskell’18 and function optimizations.
“LWeb: Information Flow Security for Multi-Tier Web Applications”, POPL’19 https://bit.ly/2EcyDAh Used to encode pen-and-pencil proofs or even sophisticated security proofs.
“Liquidate your assets” https://bit.ly/2Ht3uIG Used to encode pen-and-pencil proofs or encode resource analysis. To be presented at IMDEA: by Martin Handley Tue March 19 @10.45
Used to encode pen-and-pencil proofs But, proof interaction is missing.
II. Application: Speed up Parsing III. Expressiveness: Theorem Proving I. Static Checks: Fast & Safe Code Thanks! Theorem Proving for All @nikivazou

More Related Content

ODP
Promise
guest1826aa7
 
DOCX
Java binary subtraction
Charm Sasi
 
PDF
The Ring programming language version 1.5.1 book - Part 23 of 180
Mahmoud Samir Fayed
 
PDF
ゲーム理論NEXT 期待効用理論第6回 -3つの公理と期待効用定理-
ssusere0a682
 
PDF
Automated theorem proving for special functions: the next phase
Lawrence Paulson
 
PPTX
2.7 chain rule short cuts
math265
 
PDF
The Chain Rule, Part 2
Pablo Antuna
 
PDF
The Ring programming language version 1.5.3 book - Part 77 of 184
Mahmoud Samir Fayed
 
Promise
guest1826aa7
 
Java binary subtraction
Charm Sasi
 
The Ring programming language version 1.5.1 book - Part 23 of 180
Mahmoud Samir Fayed
 
ゲーム理論NEXT 期待効用理論第6回 -3つの公理と期待効用定理-
ssusere0a682
 
Automated theorem proving for special functions: the next phase
Lawrence Paulson
 
2.7 chain rule short cuts
math265
 
The Chain Rule, Part 2
Pablo Antuna
 
The Ring programming language version 1.5.3 book - Part 77 of 184
Mahmoud Samir Fayed
 

What's hot (20)

PDF
Derivatives of Trigonometric Functions, Part 2
Pablo Antuna
 
PPTX
String in .net
Larry Nung
 
PPTX
Oh Composable World!
Brian Lonsdorf
 
PDF
The Ring programming language version 1.6 book - Part 38 of 189
Mahmoud Samir Fayed
 
PDF
The Ring programming language version 1.3 book - Part 50 of 88
Mahmoud Samir Fayed
 
KEY
関数潮流(Function Tendency)
riue
 
PDF
The Ring programming language version 1.4 book - Part 18 of 30
Mahmoud Samir Fayed
 
PDF
Mx/G(a,b)/1 With Modified Vacation, Variant Arrival Rate With Restricted Admi...
IJRES Journal
 
KEY
Haskellで学ぶ関数型言語
ikdysfm
 
PPTX
Millionways
Brian Lonsdorf
 
PDF
kan r_ifels
皓丞 王
 
PDF
Program Language - Fall 2013
Yun-Yan Chi
 
PDF
Some properties of two-fuzzy Nor med spaces
IOSR Journals
 
PDF
The Chain Rule, Part 1
Pablo Antuna
 
PDF
The Ring programming language version 1.5.2 book - Part 24 of 181
Mahmoud Samir Fayed
 
PDF
The Ring programming language version 1.3 book - Part 16 of 88
Mahmoud Samir Fayed
 
PPTX
Recurrent Networks and LSTM deep dive
Alex Kalinin
 
PDF
Dirac demo (quantum mechanics with C++). Please note: There is a problem with...
Russell Childs
 
PDF
Digital Electronics
Benesh Selvanesan
 
PDF
Clojure functions midje
Jackson dos Santos Olveira
 
Derivatives of Trigonometric Functions, Part 2
Pablo Antuna
 
String in .net
Larry Nung
 
Oh Composable World!
Brian Lonsdorf
 
The Ring programming language version 1.6 book - Part 38 of 189
Mahmoud Samir Fayed
 
The Ring programming language version 1.3 book - Part 50 of 88
Mahmoud Samir Fayed
 
関数潮流(Function Tendency)
riue
 
The Ring programming language version 1.4 book - Part 18 of 30
Mahmoud Samir Fayed
 
Mx/G(a,b)/1 With Modified Vacation, Variant Arrival Rate With Restricted Admi...
IJRES Journal
 
Haskellで学ぶ関数型言語
ikdysfm
 
Millionways
Brian Lonsdorf
 
kan r_ifels
皓丞 王
 
Program Language - Fall 2013
Yun-Yan Chi
 
Some properties of two-fuzzy Nor med spaces
IOSR Journals
 
The Chain Rule, Part 1
Pablo Antuna
 
The Ring programming language version 1.5.2 book - Part 24 of 181
Mahmoud Samir Fayed
 
The Ring programming language version 1.3 book - Part 16 of 88
Mahmoud Samir Fayed
 
Recurrent Networks and LSTM deep dive
Alex Kalinin
 
Dirac demo (quantum mechanics with C++). Please note: There is a problem with...
Russell Childs
 
Digital Electronics
Benesh Selvanesan
 
Clojure functions midje
Jackson dos Santos Olveira
 
Ad

Similar to Liquid Haskell: Theorem Proving for All (20)

PDF
Refinement Types for Haskell
Martin Ockajak
 
PDF
[Expert Fridays] Александр Чичигин - Как перестать бояться и полюбить COQ
Provectus
 
PDF
Reasoning about laziness
Johan Tibell
 
PDF
Intro To Agda
Larry Diehl
 
PDF
Functional programming with haskell
faradjpour
 
ODP
03. haskell refresher quiz
Sebastian Rettig
 
PDF
Scope Graphs: A fresh look at name binding in programming languages
Eelco Visser
 
PDF
Introduction to Functional Languages
suthi
 
PDF
Refined types (FP-Syd)
Dom De Re
 
PPTX
Dependent Types with Idris
Abdulsattar Mohammed
 
PDF
[FLOLAC'14][scm] Functional Programming Using Haskell
Functional Thursday
 
PDF
Introduction to idris
Conor Farrell
 
PPTX
Introduction to Dependently Types: Idris
Abdulsattar Mohammed
 
KEY
An Introduction to Functional Programming using Haskell
Michel Rijnders
 
KEY
Programming haskell chapter10
Kousuke Ruichi
 
PDF
Compiler Construction | Lecture 5 | Transformation by Term Rewriting
Eelco Visser
 
PDF
Real World Haskell: Lecture 6
Bryan O'Sullivan
 
PDF
SAT/SMT solving in Haskell
Masahiro Sakai
 
PPT
Pl vol1
Aarsh Ps
 
PPT
Pl vol1
Aarsh Ps
 
Refinement Types for Haskell
Martin Ockajak
 
[Expert Fridays] Александр Чичигин - Как перестать бояться и полюбить COQ
Provectus
 
Reasoning about laziness
Johan Tibell
 
Intro To Agda
Larry Diehl
 
Functional programming with haskell
faradjpour
 
03. haskell refresher quiz
Sebastian Rettig
 
Scope Graphs: A fresh look at name binding in programming languages
Eelco Visser
 
Introduction to Functional Languages
suthi
 
Refined types (FP-Syd)
Dom De Re
 
Dependent Types with Idris
Abdulsattar Mohammed
 
[FLOLAC'14][scm] Functional Programming Using Haskell
Functional Thursday
 
Introduction to idris
Conor Farrell
 
Introduction to Dependently Types: Idris
Abdulsattar Mohammed
 
An Introduction to Functional Programming using Haskell
Michel Rijnders
 
Programming haskell chapter10
Kousuke Ruichi
 
Compiler Construction | Lecture 5 | Transformation by Term Rewriting
Eelco Visser
 
Real World Haskell: Lecture 6
Bryan O'Sullivan
 
SAT/SMT solving in Haskell
Masahiro Sakai
 
Pl vol1
Aarsh Ps
 
Pl vol1
Aarsh Ps
 
Ad

More from Facultad de Informática UCM (20)

PDF
¿Por qué debemos seguir trabajando en álgebra lineal?
Facultad de Informática UCM
 
PDF
TECNOPOLÍTICA Y ACTIVISMO DE DATOS: EL MAPEO COMO FORMA DE RESILIENCIA ANTE L...
Facultad de Informática UCM
 
PDF
DRAC: Designing RISC-V-based Accelerators for next generation Computers
Facultad de Informática UCM
 
PDF
uElectronics ongoing activities at ESA
Facultad de Informática UCM
 
PDF
Tendencias en el diseño de procesadores con arquitectura Arm
Facultad de Informática UCM
 
PDF
Formalizing Mathematics in Lean
Facultad de Informática UCM
 
PDF
Introduction to Quantum Computing and Quantum Service Oriented Computing
Facultad de Informática UCM
 
PPTX
Computer Design Concepts for Machine Learning
Facultad de Informática UCM
 
PDF
Inteligencia Artificial en la atención sanitaria del futuro
Facultad de Informática UCM
 
PDF
Design Automation Approaches for Real-Time Edge Computing for Science Applic...
Facultad de Informática UCM
 
PDF
Estrategias de navegación para robótica móvil de campo: caso de estudio proye...
Facultad de Informática UCM
 
PPTX
Fault-tolerance Quantum computation and Quantum Error Correction
Facultad de Informática UCM
 
PDF
Cómo construir un chatbot inteligente sin morir en el intento
Facultad de Informática UCM
 
PDF
Automatic generation of hardware memory architectures for HPC
Facultad de Informática UCM
 
PDF
Type and proof structures for concurrency
Facultad de Informática UCM
 
PDF
Hardware/software security contracts: Principled foundations for building sec...
Facultad de Informática UCM
 
PDF
Jose carlossancho slidesLa seguridad en el desarrollo de software implementad...
Facultad de Informática UCM
 
PDF
Do you trust your artificial intelligence system?
Facultad de Informática UCM
 
PDF
Redes neuronales y reinforcement learning. Aplicación en energía eólica.
Facultad de Informática UCM
 
PDF
Challenges and Opportunities for AI and Data analytics in Offshore wind
Facultad de Informática UCM
 
¿Por qué debemos seguir trabajando en álgebra lineal?
Facultad de Informática UCM
 
TECNOPOLÍTICA Y ACTIVISMO DE DATOS: EL MAPEO COMO FORMA DE RESILIENCIA ANTE L...
Facultad de Informática UCM
 
DRAC: Designing RISC-V-based Accelerators for next generation Computers
Facultad de Informática UCM
 
uElectronics ongoing activities at ESA
Facultad de Informática UCM
 
Tendencias en el diseño de procesadores con arquitectura Arm
Facultad de Informática UCM
 
Formalizing Mathematics in Lean
Facultad de Informática UCM
 
Introduction to Quantum Computing and Quantum Service Oriented Computing
Facultad de Informática UCM
 
Computer Design Concepts for Machine Learning
Facultad de Informática UCM
 
Inteligencia Artificial en la atención sanitaria del futuro
Facultad de Informática UCM
 
Design Automation Approaches for Real-Time Edge Computing for Science Applic...
Facultad de Informática UCM
 
Estrategias de navegación para robótica móvil de campo: caso de estudio proye...
Facultad de Informática UCM
 
Fault-tolerance Quantum computation and Quantum Error Correction
Facultad de Informática UCM
 
Cómo construir un chatbot inteligente sin morir en el intento
Facultad de Informática UCM
 
Automatic generation of hardware memory architectures for HPC
Facultad de Informática UCM
 
Type and proof structures for concurrency
Facultad de Informática UCM
 
Hardware/software security contracts: Principled foundations for building sec...
Facultad de Informática UCM
 
Jose carlossancho slidesLa seguridad en el desarrollo de software implementad...
Facultad de Informática UCM
 
Do you trust your artificial intelligence system?
Facultad de Informática UCM
 
Redes neuronales y reinforcement learning. Aplicación en energía eólica.
Facultad de Informática UCM
 
Challenges and Opportunities for AI and Data analytics in Offshore wind
Facultad de Informática UCM
 

Recently uploaded (20)

PDF
Unit I ESSENTIAL OF DIGITAL MARKETING.pdf
Nitin Shelake
 
PDF
Mitigating Risks through Effective Management for Enhancing Organizational Pe...
IJAEMSJORNAL
 
PDF
Evaluating the Democratization of the Turkish Armed Forces from a Normative P...
jpsjournal1
 
PPTX
UNIT-1 - COAL BASED THERMAL POWER PLANTS
Chandra Kumar S
 
PPTX
UNIT 4 Total Quality Management .pptx
gokuld13012005
 
PPTX
MET 305 2019 SCHEME MODULE 2 COMPLETE.pptx
VinayB68
 
PPTX
Lecture Notes Electrical Wiring System Components
eedgecbhojpur
 
PDF
July 2025 - Top 10 Read Articles in International Journal of Software Enginee...
sebastianku31
 
PPTX
Safety Seminar civil to be ensured for safe working.
DILJEETKUMAR8
 
PPTX
Artificial Intelligence
dikshendrasarpate2
 
PPT
Introduction, IoT Design Methodology, Case Study on IoT System for Weather Mo...
MariaRufina4
 
PPT
Project quality management in manufacturing
BarMusaTetik
 
PPTX
Foundation to blockchain - A guide to Blockchain Tech
Davies Chacko
 
PPT
Mechanical Engineering MATERIALS Selection
arsalanahmad705384
 
PDF
Operating System & Kernel Study Guide-1 - converted.pdf
mranoninvisib16
 
DOCX
573137875-Attendance-Management-System-original
AYUSHMANAV
 
PDF
TFEC-4-2020-Design-Guide-for-Timber-Roof-Trusses.pdf
AinieButt1
 
PPTX
bas. eng. economics group 4 presentation 1.pptx
kiribakimoses1993
 
PDF
The CXO Playbook 2025 – Future-Ready Strategies for C-Suite Leaders Cerebrai...
Cerebraix Technologies
 
PDF
Digital Logic Computer Design lecture notes
CHINNASUNKAIAH1
 
Unit I ESSENTIAL OF DIGITAL MARKETING.pdf
Nitin Shelake
 
Mitigating Risks through Effective Management for Enhancing Organizational Pe...
IJAEMSJORNAL
 
Evaluating the Democratization of the Turkish Armed Forces from a Normative P...
jpsjournal1
 
UNIT-1 - COAL BASED THERMAL POWER PLANTS
Chandra Kumar S
 
UNIT 4 Total Quality Management .pptx
gokuld13012005
 
MET 305 2019 SCHEME MODULE 2 COMPLETE.pptx
VinayB68
 
Lecture Notes Electrical Wiring System Components
eedgecbhojpur
 
July 2025 - Top 10 Read Articles in International Journal of Software Enginee...
sebastianku31
 
Safety Seminar civil to be ensured for safe working.
DILJEETKUMAR8
 
Artificial Intelligence
dikshendrasarpate2
 
Introduction, IoT Design Methodology, Case Study on IoT System for Weather Mo...
MariaRufina4
 
Project quality management in manufacturing
BarMusaTetik
 
Foundation to blockchain - A guide to Blockchain Tech
Davies Chacko
 
Mechanical Engineering MATERIALS Selection
arsalanahmad705384
 
Operating System & Kernel Study Guide-1 - converted.pdf
mranoninvisib16
 
573137875-Attendance-Management-System-original
AYUSHMANAV
 
TFEC-4-2020-Design-Guide-for-Timber-Roof-Trusses.pdf
AinieButt1
 
bas. eng. economics group 4 presentation 1.pptx
kiribakimoses1993
 
The CXO Playbook 2025 – Future-Ready Strategies for C-Suite Leaders Cerebrai...
Cerebraix Technologies
 
Digital Logic Computer Design lecture notes
CHINNASUNKAIAH1
 

Liquid Haskell: Theorem Proving for All

  • 1. Theorem Proving for All Niki Vazou
  • 3. take :: [a] -> Int -> [a] > take [1,2,3] 2 > [1,2] Haskell
  • 4. > take [1,2,3] 500 > ??? take :: [a] -> Int -> [a] Haskell
  • 5. Refinement Types take :: xs:[a] -> {i:Int | i < len xs} -> [a]
  • 6. > take [1,2,3] 500 > Refinement Type Error! take :: xs:[a] -> {i:Int | i < len xs} -> [a]
  • 7. II. Application: Speed up Parsing III. Expressiveness: Theorem Proving I. Static Checks: Fast & Safe CodeStatic Checks Expressiveness
  • 8. I. Static Checks: Fast & Safe CodeStatic Checks
  • 9. Buffer overread in OpenSSL. 2015 The Heartbleed Bug
  • 10. in
  • 11. module Data.Text where take :: t:Text -> i:Int -> Text > take "hat" 500 > *** Exception: Out Of Bounds!
  • 12. take :: t:Text -> i:Int -> Text take i t | i < len t = Unsafe.takeWord16 i t take i t = error “Out Of Bounds!” take :: t:Text -> i:Int -> Text take t i | i < len t = Unsafe.take t i take t i = error “Out Of Bounds!” Runtime Checks Safe, but slow!
  • 13. take :: t:Text -> i:Int -> Text take i t | i < len t = Unsafe.takeWord16 i t take i t = error “Out Of Bounds!” take :: t:Text -> i:Int -> Text take t i | i < len t = Unsafe.take t i take t i = error “Out Of Bounds!” No Checks Fast, but unsafe!
  • 14. No Checks > take "hat" 500 > “hat584562594SOHNUL… Overread take :: t:Text -> i:Int -> Text take i t | i < len t = Unsafe.takeWord16 i t take i t = error “Out Of Bounds!” take :: t:Text -> i:Int -> Text take t i | i < len t = Unsafe.take t i take t i = error “Out Of Bounds!”
  • 15. take :: t:Text -> i:Int -> Text take i t | i < len t = Unsafe.takeWord16 i t take i t = error “Out Of Bounds!” take :: t:Text -> i:Int -> Text take t i | i < len t = Unsafe.take t i take t i = error “Out Of Bounds!” i < len t Static Checks
  • 16. take :: t:Text -> i:Int -> Text take i t | i < len t = Unsafe.takeWord16 i t take i t = error “Out Of Bounds!” take :: t:Text -> i:Int -> Text take t i | i < len t = Unsafe.take t i take t i = error “Out Of Bounds!” Static Checks take :: t:Text -> i:{i < len t} -> Texti < len t
  • 17. take :: t:Text -> i:Int -> Text take i t | i < len t = Unsafe.takeWord16 i t take i t = error “Out Of Bounds!” take :: t:Text -> i:Int -> Text take t i | i < len t = Unsafe.take t i take t i = error “Out Of Bounds!” Static Checks take :: t:Text -> i:{i < len t} -> Texti < len t
  • 18. Static Checks take :: t:Text -> i:Int -> Text take i t | i < len t = Unsafe. = error “Out Of Bounds!” take :: t:Text -> i:{i < len t} -> Text take t i = Unsafe.take t i
  • 19. take :: t:Text -> i:Int -> Text take i t | i < len t = Unsafe. = error “Out Of Bounds!” take :: t:Text -> i:{i < len t} -> Text take t i = Unsafe.take t i Static Checks > take "hat" 500 Type Error
  • 20. OK Error Code Checks valid arguments, under facts. Refinement Types
  • 21. take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts. len x = 3 => v = 500 => v < len x
  • 22. len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts.
  • 23. len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts.
  • 24. len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts.
  • 25. len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts.
  • 26. len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts.
  • 27. len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts. SMT- query
  • 28. len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts. SMT- invalid
  • 29. len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts. Checker reports Error
  • 30. len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts. Checker reports Error
  • 31. Checker reports Error len x = 3 => v = 500 => v < len x take :: t:Text -> {v | v < len t} -> Text heartbleed = let x = "hat" in take x 500 Checks valid arguments, under facts. 2 2 OK SMT- valid
  • 32. Checks valid arguments, under facts. Static Checks OK Error Code
  • 33. I. Static Checks: Fast & Safe Code II. Application: Speed up Parsing III. Expressiveness: Theorem Proving Static Checks
  • 34. II. Application: Speed up Parsing III. Expressiveness: Theorem Proving I. Static Checks: Fast & Safe CodeStatic Checks Application: Speed up Parsing
  • 35. II. Application: Speed up ParsingApplication: Speed up Parsing DEMO
  • 36. Provably Correct & Faster Code! Application: Speed up Parsing SMT-Automatic Verification
  • 38. II. Application: Speed up Parsing III. Expressiveness: Theorem Proving I. Static Checks: Fast & Safe CodeStatic Checks Expressiveness
  • 39. III. Expressiveness: Theorem ProvingExpressiveness
  • 40. Proof is in pen-and-paper :( reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED Theorem: For any x, Proof. reverse [x] = [x]
  • 41. reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED Proof is not machine checked. Theorem: For any x, reverse [x] = [x] Proof.
  • 42. reverse [x] — obviously! = [x] QED Proof is not machine checked. Theorem: For any x, reverse [x] = [x] Proof.
  • 43. Proof is not machine checked. reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED Theorem: For any x, reverse [x] = [x] Check it with Liquid Haskell! Proof.
  • 44. Theorems as Refinement Types Theorem: For any x, reverse [x] = [x] x:a ! { v:() | reverse [x] = [x] } Refinement Type: SMT equality
  • 45. x:a ! { reverse [x] = [x] } Theorems as Refinement Types Theorem: For any x, reverse [x] = [x] Refinement Type:
  • 46. Proof. reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED x:a ! { reverse [x] = [x] } How to connect theorem with proof?
  • 47. Proofs are programs Theorems are types — Curry & Howard
  • 48. reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED Proof as a Haskell function singletonP :: x:a ! { reverse [x] = [x] }x:a ! { reverse [x] = [x] } singletonP x = — applying ++ on [] and [x] ==. [x] *** QED
  • 49. reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED singletonP x = reverse [x] — applying reverse on [x] ==. reverse [] ++ [x] — applying reverse on [] ==. [] ++ [x] — applying ++ on [] and [x] ==. [x] *** QED Proof as a Haskell function singletonP :: x:a ! { reverse [x] = [x] }x:a ! { reverse [x] = [x] }
  • 50. reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED singletonP x = reverse [x] — applying reverse on [x] ==. reverse [] ++ [x] — applying reverse on [] ==. [] ++ [x] — applying ++ on [] and [x] ==. [x] *** QED singletonP :: x:a ! { reverse [x] = [x] } How to encode equality? x:a ! { reverse [x] = [x] }
  • 51. Equational Operator in (Liquid) Haskell (==.) :: x:a -> y:{ a | x = y } -> {v:a | v = x && v = y } x ==. y = y checks both arguments are equal returns 2nd argument, to continue the proof!
  • 52. reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED singletonP x = reverse [x] — applying reverse on [x] ===. reverse [] ++ [x] — applying reverse on [] ==. [] ++ [x] — applying ++ on [] and [x] ==. [x] *** QED singletonP :: x:a ! { reverse [x] = [x] }x:a ! { reverse [x] = [x] }
  • 53. reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED singletonP x = reverse [x] — applying reverse on [x] ===. reverse [] ++ [x] — applying reverse on [] ==. [] ++ [x] — applying ++ on [] and [x] ==. [x] *** QED singletonP :: x:a ! { reverse [x] = [x] }x:a ! { reverse [x] = [x] }
  • 54. reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED singletonP x = reverse [x] — applying reverse on [x] ===. reverse [] ++ [x] — applying reverse on [] ==. [] ++ [x] — applying ++ on [] and [x] ==. [x] *** QED singletonP :: x:a ! { reverse [x] = [x] } How to encode QED? x:a ! { reverse [x] = [x] }
  • 55. Define QED as data constuctor… (***) :: a -> QED -> () _ *** QED = () data QED = QED … that casts anything into a proof (i.e., a unit value).
  • 56. reverse [x] — applying reverse on [x] = reverse [] ++ [x] — applying reverse on [] = [] ++ [x] — applying ++ on [] and [x] = [x] QED singletonP x = reverse [x] — applying reverse on [x] ===. reverse [] ++ [x] — applying reverse on [] ==. [] ++ [x] — applying ++ on [] and [x] ==. [x] *** QED singletonP :: x:a ! { reverse [x] = [x] } Theorem Proving in Haskell x:a ! { reverse [x] = [x] }
  • 57. singletonP :: x:a ! { reverse [x] = [x] } Theorems are Types Theorem Application is Function Call singletonP 1 :: { reverse [1] = [1] } x:a ! { reverse [x] = [x] }
  • 58. singletonP1 :: { reverse [1] = [1] } singletonP1 = reverse [1] ? singletonP 1 ==. [1] *** QED Theorem Application is Function Call (?) :: a -> () -> a x ? _ = x
  • 59. Reasoning about Haskell Programs in Haskell! Equational operators (==., ?, QED, ***) Theorem Proving for All let us encode proofs as Haskell functions checked by Liquid Haskell.
  • 60. How to encode inductive proofs? Theorem Proving for All Reasoning about Haskell Programs in Haskell!
  • 61. Theorem: For any list x, reverse (reverse x) = x. Proof. involutionP [] = reverse (reverse []) — applying inner reverse = reverse [] — applying reverse = [] QED involutionP (x:xs) = reverse (reverse (x:xs)) — applying inner reverse = reverse (reverse xs ++ [x]) — distributivity on (reverse xs) [x] = reverse [x] ++ reverse (reverse xs) — involution on xs = reverse [x] ++ xs — singleton on x = [x] ++ xs — applying ++ = x:([] ++ xs) — applying ++ = (x:xs) QED Base Case: Inductive Case:
  • 62. Theorem: For any list x, reverse (reverse x) = x. Proof. involutionP [] = reverse (reverse []) — applying inner reverse = reverse [] — applying reverse = [] QED involutionP (x:xs) = reverse (reverse (x:xs)) — applying inner reverse = reverse (reverse xs ++ [x]) — distributivity on (reverse xs) [x] = reverse [x] ++ reverse (reverse xs) — involution on xs = reverse [x] ++ xs — singleton on x = [x] ++ xs — applying ++ = x:([] ++ xs) — applying ++ = (x:xs) QED Base Case: Inductive Case: Step 1: Define a recursive function!
  • 63. Step 1: Define a recursive function! Proof. involutionP [] == reverse (reverse []) — applying inner reverse = reverse [] — applying reverse = [] QED involutionP (x:xs) == reverse (reverse (x:xs)) — applying inner reverse = reverse (reverse xs ++ [x]) — distributivity on (reverse xs) [x] = reverse [x] ++ reverse (reverse xs) — involution on xs = reverse [x] ++ xs — singleton on x = [x] ++ xs — applying ++ = x:([] ++ xs) — applying ++ = (x:xs) QED Step 2: Use equational operators Theorem: For any list x, reverse (reverse x) = x.
  • 64. Proof. involutionP [] ==.=reverse (reverse []) — applying inner reverse ==. reverse [] — applying reverse ==. [] *** QED involutionP (x:xs) ==. reverse (reverse (x:xs)) — applying inner reverse ==. reverse (reverse xs ++ [x]) — distributivity on (reverse xs) [x] ==. reverse [x] ++ reverse (reverse xs) — involution on xs ==. reverse [x] ++ xs — singleton on x ==. [x] ++ xs — applying ++ ==. x:([] ++ xs) — applying ++ ==. (x:xs) *** QED Step 3: Lemmata are function calls!Step 2: Use equational operators Theorem: For any list x, reverse (reverse x) = x.
  • 65. Proof. Step 3: Lemmata are function calls! involutionP [] ==.=reverse (reverse []) — applying inner reverse ==. reverse [] — applying reverse ==. [] *** QED involutionP (x:xs) ==. reverse (reverse (x:xs)) — applying inner reverse ==. reverse (reverse xs ++ [x]) ? distributivityP (reverse xs) [x] ==. reverse [x] ++ reverse (reverse xs) ? involutionP xs ==. reverse [x] ++ xs ? singletonP x ==. [x] ++ xs — applying ++ ==. x:([] ++ xs) — applying ++ ==. (x:xs) *** QED Theorem: For any list x, reverse (reverse x) = x.
  • 66. Proof. involutionP [] ==.=reverse (reverse []) — applying inner reverse ==. reverse [] — applying reverse ==. [] *** QED involutionP (x:xs) ==. reverse (reverse (x:xs)) — applying inner reverse ==. reverse (reverse xs ++ [x]) ? distributivityP (reverse xs) [x] ==. reverse [x] ++ reverse (reverse xs) ? involutionP xs ==. reverse [x] ++ xs ? singletonP x ==. [x] ++ xs — applying ++ ==. x:([] ++ xs) — applying ++ ==. (x:xs) *** QED Note: Inductive hypothesis is recursive call! Theorem: For any list x, reverse (reverse x) = x.
  • 67. Proof. involutionP [] ==.=reverse (reverse []) — applying inner reverse ==. reverse [] — applying reverse ==. [] *** QED involutionP (x:xs) ==. reverse (reverse (x:xs)) — applying inner reverse ==. reverse (reverse xs ++ [x]) ? distributivityP (reverse xs) [x] ==. reverse [x] ++ reverse (reverse xs) ? involutionP xs ==. reverse [x] ++ xs ? singletonP x ==. [x] ++ xs — applying ++ ==. x:([] ++ xs) — applying ++ ==. (x:xs) *** QED Question: Is the proof well founded? Theorem: For any list x, reverse (reverse x) = x.
  • 68. Used to encode pen-and-pencil proofs https://bit.ly/2yjvJo3 “Theorem Proving for All”, Haskell’18 and function optimizations.
  • 69. “LWeb: Information Flow Security for Multi-Tier Web Applications”, POPL’19 https://bit.ly/2EcyDAh Used to encode pen-and-pencil proofs or even sophisticated security proofs.
  • 70. “Liquidate your assets” https://bit.ly/2Ht3uIG Used to encode pen-and-pencil proofs or encode resource analysis. To be presented at IMDEA: by Martin Handley Tue March 19 @10.45
  • 71. Used to encode pen-and-pencil proofs But, proof interaction is missing.
  • 72. II. Application: Speed up Parsing III. Expressiveness: Theorem Proving I. Static Checks: Fast & Safe Code Thanks! Theorem Proving for All @nikivazou