Since Automath and LCF, many proof systems have been designed and used to develop computer-checked mathematics, for example Matita, Coq, HOL4, HOL Light, Isabelle/HOL… These systems sometimes implement different logics. In each of them, proving Fermat’s little theorem requires proving about lemmas which contribute to the arithmetic library of the system. Developing such a library can be tiresome and we may want, instead of recreating it again and again in different systems, to translate this library from one system to another.
The aim of this paper is to present the logic STT, an extension of Simple Type Theory that is powerful enough to express easily arithmetic theorems, but weak enough so that it is easy to export theorems from this logic to several other systems, making this logic suitable for interoperability. STT has been implemented in the logical framework Dedukti . In order to illustrate its adequacy for exporting theorems, we have successfully implemented a translation from STT to Coq and Matita, and in order to target proof systems based on HOL (Higher-Order Logic), we have also implemented a translation from STT to OpenTheory , which is a proof system for interoperability between the provers of the HOL family. Then, we applied our translations on an arithmetic library that was available in STT. The translation from STT to OpenTheory is interesting because even if these two systems are very close, they are based on different design choices that make the translation harder than expected. The description of STT and its translation to OpenTheory are the two main contributions of this paper.
1.1 Logical Frameworks and Interoperability
Sharing proofs between systems is not always possible since some logics are more expressive than others. For example, one may quantify over proofs in the Calculus of Constructions but not in Higher-Order Logic. Moreover, it is not conceivable to develop, for every pair of proof systems, a specific translation because there would be a quadratic number of translations.
Logical frameworks offer an approach to overcoming these two issues. They are a special kind of proof systems in which different logics and proof systems can be specified. Using a logical framework, there are two ways of sharing proofs. Suppose that the proof of a theorem expressed in a logic needs a proof of a theorem already proven in the logic . A first solution explored, for instance, by Cauderlier and Dubois  is to have the combined proof inside the logical framework by encoding the proofs of and in it. In this solution, proofs are not exported outside of the logical framework.
Another solution is to translate directly from to . This process can be decomposed in three steps. The first step translates from to the encoding of in the logical framework denoted by . The second step translates from to . Finally, the third step translates from to the proof system . While the first and last steps are total functions, the second step is, in general, a partial function since the translation is not always possible: For example, proof irrelevance is not expressible in HOL but it is in the Calculus of Constructions.
This is the solution we used to import an arithmetic library in Dedukti[STT]. Originally, this library has been implemented in the proof system Matita. The translation process that goes from Dedukti[Matita] to Dedukti[STT] is described in a separate paper .
1.2 How interoperability should work
The definition of a function or a type might differ between several proof systems. For example, in Coq, inductive types such as are primitive while in HOL they are encoded. This is a problem for a generic translation:
The definition of a type is not unique. For example, in Coq, natural numbers have at least three different definitions. Which one should be used?
If one uses an intermediate system to translate these proofs, the encoding from the first system to the intermediate may degrade the original definition. Recreating the original type or function definition might be difficult. For example, the translation of the inductive type is translated in Dedukti as four declarations (, , and the recursor) with two rewrite rules. But from these declarations and the rewrite rules, it is difficult to identify the definition of an inductive type.
This implies that types and functions in general will be axiomatized during the transformations. For example, the arithmetic library we export into OpenTheory comes with constants and axioms to define. Fortunately, all of these axioms can be proven easily. Among these axioms, one can find
Thus, the users of the library have to instantiate once the library with the definitions they want to use. We claim that this is the way interoperability should work because this is very flexible: There is no need to regenerate the whole library if the user wants to change one definition.
The contributions of this paper are presented in Figure 1 and detailed below:
We introduce a new logic namely STT (Section 2) as well as its encoding in Dedukti;
We give a translation from STT to OpenTheory (Section 3);
We describe the embedding from STT to Coq and Matita (Section 4);
We describe the translation of an arithmetic library from Dedukti[STT] to OpenTheory, Coq and Matita (Section 5).
As we will see in Section 2, Dedukti[STT] and STT define the same logic. To simplify the presentation of the translation of this logic to OpenTheory, we choose to describe it as a translation from STT even if the actual implementation is a translation from Dedukti[STT].
2 Dedukti and STT
Dedukti is a logical framework that implements the  , a calculus that extends the calculus (also known as LF)  with rewrite rules. These rules can be used for the convertibility test. The syntax is the following:
|Terms||::=||| | | | | x|
and the type system of are respectively presented in Figure 2. For simplicity, we do not present how to derive the judgment here, but it can be found in Saillard’s thesis . Roughly, a rewrite rule is well typed when the types of and are convertible. One advantage of using rewrite rules is that more systems can be encoded in Dedukti using a shallow encoding where by shallow we mean an encoding having the two following properties: 1) a binder of the source language is translated as a binder in the second language (using HOAS (Higher-Order Abstract Syntax)  for example), and 2) the typing judgment in the source language is translated as a typing judgment in Dedukti. This means that we can use the type checker of Dedukti to check directly if a term from the source language encoded in Dedukti is well typed. The next two paragraphs are dedicated to the STT system and its shallow encoding in Dedukti.
STT is an extension of Simple Type Theory with prenex polymorphism and type operators. A type operator is constructed using a name and an arity. This allows to declare types such as bool, nat or list. The polymorphism of STT is restricted to prenex polymorphism as full polymorphism would make this logic inconsistent222Coquand’s paper  shows also that omitting types annotations for polymorphic types would make the logic inconsistent . The STT syntax is presented in Fig. 3. The type of propositions and the type of functions , could be declared as type operators, of arity and respectively. Since they have a particular meaning for the typing judgment, we add them explicitly. Also, STT allows to declare and define constants. Declaring constants is better for interoperability as discussed in section 1.2 but increases the number of axioms that need to be ultimately instantiated. The typing system and the proof system are presented in Fig. 4 and Fig. 5. Finally, we point out that we identify in STT the terms and if they are convertible up to and (unfolding of constants).
|Monotype||| | ||
|Monoterm||| | | | | ||
|Typing Context||| ||
|Constant Context||| | ||
|Typing ctx well-formed|
|Constant ctx well-formed|
STT is sound and type checking is decidable. The proofs are provided in annex of this paper.
STT is sound: the judgment is not provable.
We construct a set-theoretical model of STT. ∎
Type checking and proof checking in STT are decidable.
We only have to show that is decidable. This property follows from the fact that is a convergent term rewriting system. ∎
2.2.1 Equality in STT
In order to give further insights into STT, we give here an example that expresses polymorphic Leibniz equality denoted by in STT. Its type will be and it can be implemented by the term . From this definition, it is possible to prove that is reflexive, which is expressed by the statement , proved on the right.
The purpose of this section is to describe a shallow encoding of STT in Dedukti. Thanks to HOAS , such a shallow encoding exists in Dedukti. In Figure 6, we present the signature used to encode terms from STT. The translation function is given in annexes.
For the types, we declare in Dedukti two symbols and that are used to encode monomorphic types and polymorphic types of STT. Therefore every type of STT will be encoded as an object of Dedukti. That is why we use the symbol to encode a STT type to a Dedukti type. We add in the signature a symbol to coerce a monomorphic type to a polymorphic type. Then we need symbols to represent type constructors of STT: The Dedukti’s symbol encodes while encodes . Each type constructor of arity is encoded as a new Dedukti symbol of type with occurrences of . Finally, to encode at the type level, we use the Dedukti symbol .
For the terms, since the encoding is shallow, we do not need symbols for abstractions and applications. In contrast, we need the two symbols and that encode respectively the connectives and . Then, we add the symbol to encode polymorphic propositions. To encode a proposition into a Dedukti type, we use the symbol . Finally, rewrite rules transform a deep representation of STT syntax to a shallow one, for instance the Dedukti rule allows the Dedukti term to be the type of a Dedukti’s abstraction.
2.3.1 A proof of reflexivity in Dedukti[STT]:
The translation of Leibniz equality in Dedukti[STT] is as follow. First, the type of 333also written in its prenex form is translated as:
then its definition is translated as
Finally, the proof of refl is translated as
that is of type
which is the translation of
HOL is a logic that is implemented in several systems with some minor differences. OpenTheory  is a tool that allows to share proofs between several implementations of HOL. Since we are targeting OpenTheory, we will mostly refer to the logic defined by OpenTheory. The logic behind OpenTheory comes from , a classical logic taking only equality as a primitive logical connective. Terms are those of Simply Typed Lambda Calculus with an equality symbol while the type system extends the one of the Simply Typed Lambda Calculus by declaring type operators and prenex polymorphism. The syntax and the proof system of OpenTheory can be found respectively in Fig. 7 and Fig. 8. The syntax being very similar to the one of STT, we have omitted the definitions of typing judgments.
|Types||X | | ||
|Terms||t,u||x | c | | | ||
3.1 Stt vs OpenTheory
One may notice that STT and OpenTheory are quite similar. However, there are some differences that makes the translation from STT and OpenTheory not so easy:
Terms in OpenTheory are only convertible up to conversion while in STT it is up to conversion
All the connectives of OpenTheory are defined from the equality symbol, while in STT they are defined from and connectives
Prenex polymorphism in OpenTheory is implicit: All free type variables in OpenTheory are implicitly quantified while in STT all quantifications are explicit
These differences lead to three different proof transformations:
Encode the and connectives using the equality of OpenTheory
Explicit each application of the conversion rule
Finally, get rid of the type quantifier
OpenTheory is a classical logic while STT is intuitionistic. This is not an issue here since intuitionistic logic is a fragment of classical logic.
3.2 From STT to OpenTheory
3.2.1 Encoding and using the equality
A first idea to encode STT proofs in OpenTheory would be to axiomatize all the rules of STT and then translate the proofs using these axioms. But translating a rule to an axiom in OpenTheory requires the use of implication. Since OpenTheory does not know what an implication is, such axioms would not be usable since it would not be possible to use the modus ponens to eliminate the implication itself. Therefore, one must find an encoding of the and connectives such that the rules of STT are admissible. Such encoding is already known from . This encoding is presented below and uses two other connectives that are and that can be defined as axiom in OpenTheory:
We stress here that it is really important to axiomatize these definitions and not to define new constants. The difference is that it will be possible to instantiate later these connectives by the true connectives of HOL as long as these axioms can be proved regardless of their definition in HOL. These axioms are not too strong to satisfy because in HOL, extensionality of predicates444 is admissible. Using this encoding, it is possible to derive all the rules of STT in OpenTheory using the four axioms above. Below, we prove the admissibility of the S rule
* x ／∈C C ⊢ using the derivation tree below, is the translation of in OpenTheory555In OpenTheory, free variables such as do not need to appear inside the context..
* Γ⊢⊤ Γ⊢t = ⊤ Γ⊢λx^. t = λx^. ⊤
* * Γ⊢ = (λx^. t = λx^. ⊤) Γ⊢(λx^. t = λx^. ⊤) = Γ⊢
The right branch is closed thanks to the axiom defining .
All the rules of STT can be derived in a similar way. At the end of this translation, the syntax of the term is changed: becomes a new connective, while and become defined constants.
3.2.2 Eliminate reductions
In STT, the terms and are convertible, but not in OpenTheory. The convertibility test in STT will unfold the definition of once, then it will apply twice a -reduction. However, in OpenTheory, it is possible to prove
The purpose of this section is to explain how it is possible to derive a proof of in OpenTheory when in STT. The decidability of type checking in STT relies on the decidability of the conversion rule S Conv. Since the term rewriting system defined by and is convergent, we can decide whether by computing their normal forms and , then checking they are equal up to -conversion. OpenTheory has two rules to handle and conversion: *[Right=delta] Γ⊢c = t *[Right=beta] Γ⊢λx^. t u = t[x:=u] Hence, one rewrite step will be translated as an equality. The same is true for a sequence of rewrite steps thanks to transitivity of equality. Therefore, the main difficulty is to show how to derive the OpenTheory judgment from the STT judgment .
In general, the OT beta and OT delta rules will be applied inside a term. Thus, we need to show that for any context , the rule below is admissible: *[Right=ctxrule] Γ⊢t ↪βδ u Γ⊢C[t] ↪βδ C[u] the base case being either the rule OT beta or OT delta. In our setting, contexts can be defined by the following grammar:
Notice that our definition of contexts does not depend on the previous translation. However, to prove the admissibility of the rule ctxrule for the case for example, we will need to use its definition from equality.
For every context , the rule ctxrule is admissible.
This is done inductively on the structure of . There are already two contextual rules in OpenTheory for equality to handle abstractions and applications. We need to derive the other contextual rules to handle STT connectives that are: and .
We show here the admissibility of the contextual rule for but the derivations for all the other rules are in annex.
Γ⊢p = p’
* Γ⊢q = q’ Γ⊢p ⇒q = p’ ⇒q’
Γ, p⇒q ⊢p ⇒q
* * Γ, p’ ⊢p’
* * Γ⊢p = p’ Γ⊢p’ = p Γ, p’ ⊢p Γ, p⇒q, p’ ⊢q
* Γ⊢q = q’ Γ, p ⇒q, p’ ⊢q’ Γ, p ⇒q ⊢p’ ⇒q’
* ⋮ Γ⊢(p ⇒q) = (p’ ⇒q’) Half of the proof is omitted here but the derivation tree is symmetric. This rule can be used to solve two context cases. In the case where , we instantiate and by . Hence, the right premise is closed by the OpenTheory rule OT refl. The case can be instantiated in a symmetric way. All the other cases can be derived in a similar way. ∎
3.2.3 Suppressing type quantifiers
OpenTheory implicitly quantifies over free types variables while in STT this is done explicitly thanks to the on types. This implies that substitution in STT is handled by the system while in OpenTheory, the user has to manage substitution to avoid capturing free type variables. For example, the following type in STT
is equal to while in OpenTheory, the same type is equal to using the OT subst rule with the substitution . This mechanism forces us to replace each bound variable by a fresh variable each time the bound variable is substituted. In STT, there are two rules that are concerned by this: S cst app and S . Renaming bound variables can be done easily using the subst rule of OpenTheory. For example, the rule S
*[right=S ] C ⊢
FV(A)⊆ΓC ⊢τ[X:=A] is translated as the OpenTheory proof *[Right=subst] *[Right=subst] C ⊢τ
Z fresh C ⊢τ[X:=Z] C ⊢τ[Z:= A]
The same thing can be done for the rule cst app each time a constant is applied to a type inside the definition of a constant for example. The rule S is just removed because there is no need to introduce a quantifier anymore.
4 From Dedukti[STT] to Coq and Matita
Going from STT to Coq or Matita is easy since the Calculus of Inductive Constructions with universes can be seen as an extension of STT. Only three universes are needed for the translation: the impredicative universe for , for monotypes and for polytypes. The three forall constructions of STT, the arrow on types and the implication all translates to an instantiation of the product rule of the Calculus of Inductive of Constructions. Introduction rules can be implemented as abstractions while elimination rules as applications. Finally, type operators can be encoded as parameters of type : . As an example, we show the result of our reflexivity proof from STT to Coq666 is also denoted Prop in Coq. Using Coq floating universes, we omit indices for universes. The equality will be translated as
coq Definition =L : forall X:Type, X -> X -> Prop := fun (X:Type) (x y:X) => forall (P:X -> Prop), P x -> P y. while the proof of reflexivity will be translated as the following definition
coq Definition refl= : forall X:Type, forall x:X, x =L x := fun X:Type => fun x:X => fun h:(P x) => h.
5 The arithmetic library
We have implemented these transformations to an arithmetic library that comes from Matita . From this library, we have extracted all the lemmas needed to prove the Fermat’s little theorem (about lemmas). In this library, we can find basic definitions of operators such as but also the definition of a permutation over natural numbers or the definition of big operator such as or . This library also proves basic results related to these definitions such as the commutativity of or basic results related to prime numbers. In table 1, we give some results related to the export of this library to OpenTheory, Coq and Matita.
|translation time (s)||-||18||3||3|
|checking time (s)||0.1||13||6||2|
These results show that the type checking time in OpenTheory is longer than in Dedukti, Coq or Matita. We suppose that this is mostly due to making the and conversions explicit. In order to illustrate the usability of the translated library, we give below the translation of Fermat’s little theorem in Coq:
coq Definition congruentexppredSO : forall p a : nat, prime p -> Not (divides p a) -> congruent (exp a (pred p)) (S O) p.
The constants coqprime, coqcongruent and coqpred come with a definition while the constants coqexp, coqNot, coqO and coqS are axiomatized and should be defined by the user. Our tool produces a functor that the user should instantiate whose parameters are the axiomatization of those notions. The user should instantiate it with reasonable definitions, proving the axioms. Then the theorem is ready to use. For example, the definition of coqexp has to satisfy the two following axioms: coq Axiom symeqexpbody0 : forall n : nat, (S O) = (exp n O). Axiom symeqexpbodyS : forall n m : nat, (times (exp n m) n) = (exp n (S m)).
The following definition (that comes from the standard library) satisfy those definitions:
coq Fixpoint exp (n m : nat) : Datatypes.nat := match m with | O => S O | S m => n * exp n m end
For this arithmetic library, one has to define about constants and prove about axioms. All the constants definitions can be guessed from their name or from the axioms they have to satisfy, and hence the axioms are then easy to prove. This instantiation has been made in Coq .
6 Related Work
Cauderlier and Dubois already used Dedukti for interoperability in . Their goal was to prove the sieve of Eratosthenes using HOL and Coq in combination. The main advantage of their work is that there is no need to export proofs outside the logical framework, instead everything is checked in Dedukti. However, mathematical objects in Dedukti, such as natural numbers, may have different representation, and therefore this approach may require theorems to transfer results about one representation to results about another representation.
In , Keller and Werner made a translation from HOL Light to Coq. Despite the fact that their source logic and their target logic is different from ours, they did not use any logical framework.
OpenTheory  in itself is an interoperability tool between the HOL family provers. However, OpenTheory is focused for systems that all implement a variant of Higher-Order Logic while this work aims to be more general.
Beluga  is an extension of LF that handles open terms thanks to contextual types. Beluga aims to be useful for interoperability since it is easier to write proof transformations in it.
The Foundational Proof Certificate project  aims at defining a generic methods for checking proofs. The approach seems more tuned towards self-contained proofs produced by, e.g., automated theorem provers, rather than libraries developed in proof assistants and rich logics developed in the rich logics of proof assistants.
In this paper, we showed how STT is a simple logic that can be easily represented in the logical framework Dedukti and is powerful enough to express arithmetic proofs. We defined translations from STT to other systems such as OpenTheory and implemented these translations from Dedukti. We applied it to an arithmetic library containing a proof of Fermat’s little theorem. The differences between OpenTheory and STT reveal three difficulties which we addressed in different phases of the translation. In contrast, we showed how the translation to Coq and Matita is easy since STT can be seen as a subsystem of the Calculus of Inductive Constructions.
We would like to export this library to other proof systems such as PVS or Agda. While for Agda, the translation should be similar to the one of Coq or Matita, for PVS this is a challenge since there is no proof term but only tactics. In other word, each rule should be translated by an application of one or more tactics. We are also interested to import more proofs in Dedukti[STT] that could then be exported.
Finally, we hope that this work is the beginning of a process that could lead to a standardization of libraries, starting with the arithmetic one (naming conventions, constants definitions or statement of important lemmas).
-  Peter B. Andrews (1986): An introduction to mathematical logic and type theory - to truth through proof. Computer science and applied mathematics, Academic Press.
-  Andrea Asperti, Wilmer Ricciotti, Claudio Sacerdoti Coen & Enrico Tassi (2011): The Matita Interactive Theorem Prover. In Nikolaj Bjørner & Viorica Sofronie-Stokkermans, editors: Automated Deduction - CADE-23 - 23rd International Conference on Automated Deduction, Wroclaw, Poland, July 31 - August 5, 2011. Proceedings, Lecture Notes in Computer Science 6803, Springer, pp. 64–69. Available at https://doi.org/10.1007/978-3-642-22438-6_7.
-  Raphaël Cauderlier & Catherine Dubois (2017): FoCaLiZe and Dedukti to the Rescue for Proof Interoperability. In Mauricio Ayala-Rincón & César A. Muñoz, editors: Interactive Theorem Proving - 8th International Conference, ITP 2017, Brasília, Brazil, September 26-29, 2017, Proceedings, Lecture Notes in Computer Science 10499, Springer, pp. 131–147. Available at https://doi.org/10.1007/978-3-319-66107-0_9.
-  Zakaria Chihani, Dale Miller & Fabien Renaud (2013): Foundational Proof Certificates in First-Order Logic. In Maria Paola Bonacina, editor: Automated Deduction - CADE-24 - 24th International Conference on Automated Deduction, Lake Placid, NY, USA, June 9-14, 2013. Proceedings, Lecture Notes in Computer Science 7898, Springer, pp. 162–177. Available at https://doi.org/10.1007/978-3-642-38574-2_11.
-  Thierry Coquand (1986): An Analysis of Girard’s Paradox. In: Proceedings of the Symposium on Logic in Computer Science (LICS ’86), Cambridge, Massachusetts, USA, June 16-18, 1986, IEEE Computer Society, pp. 227–236.
-  Denis Cousineau & Gilles Dowek (2007): Embedding Pure Type Systems in the Lambda-Pi-Calculus Modulo. In Simona Ronchi Della Rocca, editor: Typed Lambda Calculi and Applications, 8th International Conference, TLCA 2007, Paris, France, June 26-28, 2007, Proceedings, Lecture Notes in Computer Science 4583, Springer, pp. 102–117. Available at http://dx.doi.org/10.1007/978-3-540-73228-0_9.
-  Robert Harper, Furio Honsell & Gordon D. Plotkin (1993): A Framework for Defining Logics. J. ACM 40(1), pp. 143–184. Available at http://doi.acm.org/10.1145/138027.138060.
-  Joe Hurd (2011): The OpenTheory Standard Theory Library. In Mihaela Bobaru, Klaus Havelund, Gerard J. Holzmann & Rajeev Joshi, editors: Third International Symposium on NASA Formal Methods (NFM 2011), Lecture Notes in Computer Science 6617, Springer, pp. 177–191. Available at https://doi.org/10.1007/3-540-60275-5_76.
-  Chantal Keller & Benjamin Werner (2010): Importing HOL Light into Coq. In Matt Kaufmann & Lawrence C. Paulson, editors: Interactive Theorem Proving, First International Conference, ITP 2010, Edinburgh, UK, July 11-14, 2010. Proceedings, Lecture Notes in Computer Science 6172, Springer, pp. 307–322. Available at https://doi.org/10.1007/978-3-642-14052-5_22.
-  F. Pfenning & C. Elliott (1988): Higher-order Abstract Syntax. SIGPLAN Not. 23(7), pp. 199–208. Available at http://doi.acm.org/10.1145/960116.54010.
-  Brigitte Pientka (2008): A type-theoretic foundation for programming with higher-order abstract syntax and first-class substitutions. In: 35th Annual ACM Symposium on Principles of Programming Languages (POPL’08), ACM, pp. 371–382. Available at https://doi.org/10.1145/1328438.1328483.
-  Ronan Saillard (2015): Typechecking in the lambda-Pi-Calculus Modulo : Theory and Practice. (Vérification de typage pour le lambda-Pi-Calcul Modulo : théorie et pratique). Ph.D. thesis, Mines ParisTech, France. Available at https://tel.archives-ouvertes.fr/tel-01299180.
-  The Coq Development Team (2017): The Coq Proof Assistant, version 8.7.1. Available at https://doi.org/10.5281/zenodo.1133970.
-  The Matita development team (2018): Arithmetic library. Available at https://github.com/LPCIC/matita/tree/master/matita/matita/lib/arithmetics.
-  François Thiré (2018): Interoperability in Dedukti: From the Calculus of Inductive Constructions to an extension of HOL. http://www.lsv.fr/~fthire/research/interop/index.php.
-  François Thiré (2018): Sharing a library between proof assistants: reaching out to the HOL family. http://www.lsv.fr/~fthire/research/sttforall/index.php.