1 Introduction

Modal logic, originated in Mathematics and Philosophy, plays nowadays an important role in Computer Science. The use of modalities is relevant in the theory of programming languages where modal formulas of the form □A designate a type of encapsulated values, to be considered enhanced, related to ordinary values of type A.

For instance in staged computation [⁸] where □A is the type of run-time generated code that computes values of type A. Another important reading of modal types comes out in mobile computation [²³, ²²] where □A is the type of mobile code of type A. Other relevant interpretations of the necessity modality appear in the analysis of information flow either in computer networks [⁶] or in software security [²¹].

Coming from practical applications in the mentioned areas of computation, attention is focused on abstracting this kind of behaviors from real scenarios through specifications, which generates an outstanding task: the problem of constructing a program from a given specification.

In this paper we tackle a version of this synthesis problem at the foundational level given by lambda-term type-based synthesis. This is an instance of constructive/deductive synthesis [⁴] where a type A, coming from the constructive modal logic S4 for necessity in our case, plays the role of the specification that the sought after lambda-term has to meet together with a context Γ to represent a collection of subcomponents, specified again by their types, considered as already synthetized.

This approach corresponds to the type inhabitation problem: given a context Γ of type declarations for variables and a type A, is it possible to find a term M such that the typing Γ⊢M:A holds? which in turn corresponds, under the Curry-Howard correspondence, to proof-search: given a context of assumptions Γ and a formula A, find a derivation of the sequent Γ⊢A.

This problem has been addressed before in the case of modal logic [¹, ¹³, ²⁶] but not from the point of view we take here, which is an interactive human-driven process reminiscent of the ways of modern proof-assistants (like COQ [⁷]).

Let us show an example of the kind of programs (lambda-terms) we want to synthetize.

The specification □(A→B)→ □A→ □B corresponds to a program K witnessing the fact that encapsulated values are well-behaved under function application. In staged computation this means that taking as inputs run-time generated codes of types A→B and A, program K produces a code of type B:

Here the box constructor signals the encapsulation process: if e denotes an encapsulated value then, e′ denotes its ordinary associated value so that the equality box e′=e holds. The ⋆ operator corresponds to function application of ordinary values retrieved from their encapsulated versions.

The above program K corresponds to the characteristic scheme of the modal logic S4, namely K. This example emphasizes the distinction between the two kinds of values^fn: ordinary and enhanced. The idea behind an enhanced value is that it does not depend on any ordinary value. In summary we will consider two kinds of values and two processes which can be applied to any value, namely encapsulation and retrieval. All these behaviors will be enforced by the syntax and the type system.

We start in Section 2 by discussing the dual-context sequent calculus GS4, as a lambda-term type system. Our interactive program synthesis procedure is presented in Section 3, including an example. The soundness of the synthesis process is developed in Section 4, followed by some final remarks in Section 5.

2 A Dual-Context Sequent Calculus for Interactive Program-Synthesis

There are several discussions and applications involving deductive systems for modal logic, see [²⁷, ¹⁵] for a deep overview. However, to the best of our knowledge, there is no dedicated sequent calculus presentation of constructive S4 with the intention of human-driven proof-search or program synthesis.

Although, there are works on automated proof-search whose formalisms are therefore not suitable for high-level human-reasoning [¹, ²⁶, ¹³, ¹⁵, ¹⁸]. Let us review some proposed rules for S4 present in the literature, adapted here for the case of constructive logic:

Although this left rule is adequate for proof-search, keeping both A and □A in the premise somehow entails redundant information and poses loop problems for automated proof-search, solved by means of sophisticated systems like the one in [²⁶]. In the case of right rules we mention two alternatives:

where Γ□ denotes a context with only boxed formulae and the context Γ° results from Γ by eliminating all the non modal formulae.

Apart from discarding the symmetry between left and right rules, rule (□R2) is not suitable for proof-search, since it restricts the shape of the assumptions to be boxed formulas.

In the case of rule (□R3), the conclusion sequent has the desired general form for proof-search, but in the generated subgoal Γ°⊢A, we can lose important information by passing from Γ to Γ°, although this can be alleviated by a clever decision taken by a human-agent, in order to avoid search flaws.

To mitigate the above mentioned issues and tackle the problem of type-based program synthesis we propose a sequent calculus which handles sequents of the form Δ|Γ⊢M:A where M is a lambda-term and Δ and Γ are contexts. This kind of formalism for modal logic has its origins in systems for linear logic [³] and has been introduced in [²⁴] for reconstructing modal logic in the light of Martin-Löf’s meaning of logical constants and laws [¹⁷]. In this approach, propositions obtain their meaning through judgments without any semantic label (worlds), in particular, modal operators are defined by means of judgments over propositions.

The notion of so-called hypothetical judgments is extended to categorical judgments where a conclusion does not depend on hypotheses about the constructive truth of propositions.

Hence, a distinction of two forms of primitive judgments is essential: ‘A true’ means that we know how to verify A under hypothetical judgments, whereas ‘A valid’ represents the fact that A is a proposition whose truth does not depend on any hypotheses, thus internalizing a categorical judgment as a proposition syntactically represented by the modal formula □A.

A disengagement similar to the context separation in dual-context systems is present in several works, for instance the systems of Fitting [¹⁰]; or the work of Avron et al. [²].

We move now to the technical definitions. The types are generated by the following grammar where ℬ denotes a collection of primitive basic types:

Unlike other presentations, we include disjunction and conjunction. Also note that neither negation nor ⊥ are present. Thus, we are dealing with minimal logic. Variable declaration contexts are defined by means of so-called snoc lists:

these are finite lists built from the empty list, denoted here by ⋅, and a binary constructor that generates a new list from a given one by adding a fresh variable x of type A to its right-end. The concatenation operation is inductively defined as expected and denoted by Γ1;Γ2.

In the below inference rules the idea behind the context separation is that hypotheses in Δ are enhanced (modal), whereas those in Γ are ordinary (intuitionistic). Nevertheless, this idea does not represent a syntactic restriction, for we can have arbitrary types, modal or intuitionistic, in both contexts. This is an important difference with other modal dual-context systems like those of [¹⁶].

Moreover, the context separation is strict, in particular it is forbidden to declare the same variable in both contexts. This is an important difference with [²⁴] where there is only one context with two zones, a choice that requires the use of explicit labels valid, true in the context formulae.

Since their introduction, dual-context modal logics and their type systems have been presented in the sequent-style of natural deduction [¹⁶, ⁸, ²², ⁹].

Such formalisms are not suitable for backward proof-search, reason why we present a sequent calculus GS4, adequate for our purposes. This system is inductively defined by the following inference rules, the corresponding lambda-terms encoding proofs are the target of the synthesis process discussed in detail in the next section:

The left rules come in two versions, one for each context.

The enhanced substitution rule (SUBSTE) is derivable from (SUBST), but we keep both rules for the sake of symmetry. Moreover, it is relevant to mention that this ordinary rule is not admissible. This is not important for our purposes since the reasoning pattern provided by the cut rule is essential for human-driven proof search. A further discussion on this matter has to be presented elsewhere, due to lack of space.

With respect to the left rules for necessity we consider important to emphasize that, since they permit to encapsulate/retrieve values at the hypotheses level, the synthesis process involving an enhanced value can be reduced to one that requires only an ordinary value. This transference process (see [¹¹, Section 4.2]) allows us to reason in a more intuitive and straighforward way, as shown in the example of Section 3.

To finish the section is important to review the more usual elimination rule for □ in dual-context systems presented for instance in [²⁵, ⁸, ¹⁶, ⁹]. This typing rule for a letbox operator is:

We can observe that such rule entails a specific substitution (cut) process that provides the primitive way of using an ordinary value (the assumption x:A) retrieved from an enhanced value (the term M: □A), at the price of requiring an explicit derivation of M. Of course this is characteristic of (generalized) elimination rules in sequent-style natural deduction and can be simulated in GS4 by means of the (□L) and (SUBST) rules. The definition of letb, in concrete syntax, witnessing this simulation is: letb x=M in N=def let y=M in letbox x=y in N.

It is easy to see that in a dual-context natural deduction system, with (□E) as a primitive rule, our rules (□L) and (□LE) can be simulated as well. Thus, both systems turn out to be equivalent (more details are provided in [¹⁹]). Moreover, in [¹¹] we prove that the system of dual-context natural deduction is equivalent to an S4-axiomatic system. Then we can conclude that the present system captures exactly the necessity fragment of the constructive logic S4.

3 Interactive Program Synthesis

The lambda-terms that appear in the sequent calculus typing rules of Section 2, formalize the kind of programs target of the synthesis process. They include modal constructors in the lines of some related languages [²⁵, ⁸, ¹⁶, ⁹] as well as distinct variable binding operators (let or case expressions). Let us collect them precisely.

Definition 3.1. A pseudoterm is an expression generated by the following grammar:

The metavariable M denotes pseudoterms which are classified as right pseudoterms, those generated by the metavariable R; ordinary pseudoterms, generated by O and enhanced pseudoterms, generated by E. A left pseudoterm is either an ordinary or an enhanced pseudoterm. Finally, those generated by P are called strong let-expressions.

As our matter of interest is to synthetize lambda-terms we define pseudoterms, which are expressions corresponding to programs with unknown templates to be filled during the synthesis process. A basic and least informative template is represented by a category of metavariables or search-variables, disjoint from the usual term variables, denoted by a capital X. A pseudoterm M is called a term or a program if M does not contain search variables.

Apart from the usual lambda term constructors for functions, sums and products, we use twin program constructors in order to make explicit the manipulation of ordinary or enhanced values, the only difference being a prefix e indicating the need for an enhanced input (we use an infix application operator ⋆ in the case of an enhanced function). There is no need to have twin constructors for right pseudoterms, due to the fact that an enhanced value can be constructed directly by the box operator.

Let us sketch next our program synthesis technique: given two contexts of type declarations for variables, Δ and Γ (for enhanced and ordinary assumptions respectively) and a type specification A, the goal is to construct a program M such that the typing Δ|Γ⊢M:A holds. The program M is currently unknown and it is represented with a search-variable X. The task is to find a value for X such that Δ|Γ⊢X:A holds.

Analyzing the specific form either of A or of some assumption type; and applying a backward reading of the typing rules, some restrictions on the form of M are generated in order to give a solution for X. These conditions are given by pseudoterm equations which, if solvable, will allow to construct the desired program.

For instance, the search for an X such that ⋅|x:A⊢X:A∨B holds, is reduced to the search for a Y such that ⋅|x:A⊢Y:A holds. The search-variables X and Y are related by the equation X≈inl Y. The last goal is directly solved by the equation Y≈x. By solving these two equations, we obtain that M=definl x verifies ⋅|x:A⊢M:A∨B.

However, let us observe that sequents involving search-variables are not derivable, for, according to Section 2, there is no typing rule for this kind of variables. Such underivable sequents represent synthesis problems, which are program search tasks formalized by the following notion of pseudosequent.

Definition 3.2. A pseudosequent or search-sequent, P, is a 4−tuple of the form Δ|Γ⊢?X:A where X is a search-variable.

For the synthesis process we will need to handle finite sequences of pseudosequents defined as follows:

Definition 3.3. The set of finite sequences of pseudosequents is recursively defined with the grammar:

where • denotes the empty sequence. For clarity, a singleton sequence is identified with its unique element. As for contexts, the semicolon operator ; is used for concatenation of pseudosequents sequences.

The restrictions generated during the program search will be captured by constraint sets defined as follows:

Definition 3.4. A constraint is an equation of the form X≈e where X is a search-variable and e is a pseudoterm. A set of equations:

where all Xi are different, is called a constraint set. According to the category of the pseudoterm e, a constraint can be right, ordinary, enhanced, left or strong.

Next we define what is a solution of a constraint set.

Definition 3.5. Given a constraint set ℛ, a pseudoterm M is solution of the constraint X≈e in ℛ, if M is a term and there is a substitution^fn of search-variables by terms, say σ=[X1,…,Xn/M1,…,Mn], such that M≡eσ (i.e M is syntactically identical to eσ up-to α-equivalence). In such case the solution is written as M=Solℛ(X≈e).

Sequences of pseudosequents interact with constraint sets by means of goals, defined as follows.

Definition 3.6. A goal is a pair S∥ℛ consisting of a sequence of pseudosequents S and a constraint set ℛ. The set of goals is denoted by Goal.

The program synthesis process is defined next by means of a transition system where the goals play the role of states and the transitions, which are called tactics, transform a goal into another goal according to the backward reading of the typing rules. We consider this formal definition and handling of backward lambda-term synthesis as the second main contribution of this paper.

Definition 3.7. The transition system is defined as follows:

In each basic transition, the search-sequent Δ|Γ⊢?X:A dictates the action according to the backward reading of a typing rule, updating the constraint set accordingly.

In the following, we define the transition system axioms according to four synthesis process. In each case we assume that the search-variables introduced in the pseudosequents of the reduct are fresh, that is, do not occur in the redex.

4 Soundness of the Synthesis Process

In this section we prove the soundness of the synthesis process. Given an initial goal Δ|Γ⊢?X:A∥∅ we want to guarantee that: if the transition relation succeeds, that is, if applying the transition rules a finite number of times from this goal, we arrive to a final goal •∥ℛ, then there is a program M, constructed by solving the contraints in ℛ, such that Δ|Γ⊢M:A holds. Let us start by stating a convenient definition for the transitive closure of the transition relation.

Definition 4.1. The transitive closure of the relation ▷, denoted ▷+, is inductively defined by the following rules:

Given an initial goal Δ|Γ⊢?X:A∥∅, let us observe that the transition process succeeds from this goal exactly when there is a constraint set ℛ such that Δ|Γ⊢?X:A∥∅ ▷+•∥ℛ holds.

Definition 4.2. A pseudosequent Δ|Γ⊢?X:A is solvable with respect to a constraint set Q (or Q-solvable), if there is a constraint X≈e∈Q and a program M=SolQ(X≈e) such that the typing Δ|Γ⊢M:A holds.

Given a constraint set Q we say that a goal S∥ℛ is Q-solvable if ℛ⊆Q and all pseudosequents in S are Q-solvable.

We remark that the solution is not unique, moreover, there can be an infinite number of solutions. Thus, it should be the human agent who decides the desired solution as she is conducting the whole process. This rules out some relevant inquiries of automated proof-search like the question of the complexity of the proof-search space.

The next lemma guarantees that the solvability of goals is rearward preserved by the transition relation, this characteristic will imply the desired soundness property.

Lemma 1. Let Q be a constraint set such that ℛ1,ℛ2⊆Q. If S1∥ℛ1 ▷+S2∥ℛ2 and S2∥ℛ2 is solvable with respect to Q then S1∥ℛ1 is solvable with respect to Q.

Proof. Let Q be as required. The proof goes by induction on ▷+. In the base case we have S1∥ℛ1 ▷S2∥ℛ2 and proceed by a nested induction on ▷. We give some cases as example. The remaining are analogous:

For the inductive step, we have that S1∥ℛ1 ▷+S2∥ℛ2 where there is a goal S3∥ℛ3 such that S1∥ℛ1 ▷ S3∥ℛ3 and S3∥ℛ3 ▷+S2∥ℛ2. Assuming that S2∥ℛ2 is solvable with respect to Q the I.H. yields S3∥ℛ3 is solvable with respect to Q, the already proved base case now yields that S1∥ℛ1is solvable with respect to Q, as desired.

Theorem 4.1 (Soundness of the synthesis process). Let Δ|Γ⊢?X:A be a synthesis problem. If Δ|Γ⊢?X:A∥∅ ▷+•∥ℛ then there is a program M such that Δ|Γ⊢M:A.

Proof. It is clear that the goal •∥ℛ is solvable with respect to ℛ, hence, the Lemma 1 yields that Δ|Γ⊢?X:A∥∅ is also solvable with respect to ℛ. This fact ensures the existence of the desired program M.

According to this theorem our type-based synthesis process is correct. This ends our exposition. Let us finish this paper with some remarks.

5 Final Remarks

In this paper we presented a dual-context sequent calculus GS4 for the necessity fragment of the constructive modal logic S4, originated in our previous work [¹⁹], as a type system for lambda-terms. The modal types allow us to make a distinction between values with essentially the same functionality, namely ordinary values (inhabiting the type A) and enhanced values (inhabiting the type □A). This distinction is required by several applications.

The specific left rules for implication and necessity as well as the dual-context feature enable us to define a simple and intuitive sound bottom-up synthesis process involving a left-to-right depth-first proof-search, which, with the help of constraint-sets and the backward reading of the typing rules succeeds in returning a correct-by-construction modal lambda-term.

The procedure is human-driven, in the sense of modern interactive theorem provers, a feature that allows to define the synthesis process without technical modifications of the inference rules, unlike some proposals of automated proof-search [²⁹, ¹, ²⁶].

Towards a more realistic programming environment we intend to extend the current approach to a dual-context sequent calculus for the full modal logic S4, related to our work in [¹²]. Another important task is to extend the here presented results to the classical version of S4. This requires a handling of classical negation suitable for proof-search, in particular the use of a traditional multi conclusion sequent calculus is not convenient.

Some other programming language features, like a detailed study of the operational semantics and the extension of GS4 with recursion and memory references in the lines of [²², ⁸], have to be integrated in this quest.

Another important research topic consists of mechanizing^fn the current results, following our previous work [¹¹]. With respect to other approaches of type-based synthesis in modal logic, we consider important to relate our approach with those involving intersection types, like [¹⁴, ⁹]. This would complicate the constraints, due to the fact that the typing rules for intersection are obviously not syntax-directed. This happens also in other richer type systems, for instance [⁵] involving some kind of polymorphism.

In some cases the constraints might be unsolvable, for example if the constraint-sets are cyclic or contain a recursive constraint. But even if they are solvable, their solutions would certainly require more powerful tools, such as (higher-order) unification.