Towards Certified Meta-Programming with Typed Template-Coq
Template-Coq (https://template-coq.github.io/template-coq) is a plugin for Coq, originally implemented by Malecha , which provides a reifier for Coq terms and global declarations, as represented in the Coq kernel, as well as a denotation command. Initially, it was developed for the purpose of writing functions on Coq’s AST in Gallina. Recently, it was used in the CertiCoq certified compiler project , as its front-end language, to derive parametricity properties , and to extract Coq terms to a CBV \(\lambda \)-calculus . However, the syntax lacked semantics, be it typing semantics or operational semantics, which should reflect, as formal specifications in Coq, the semantics of Coq’s type theory itself. The tool was also rather bare bones, providing only rudimentary quoting and unquoting commands. We generalize it to handle the entire Calculus of Inductive Constructions (CIC), as implemented by Coq, including the kernel’s declaration structures for definitions and inductives, and implement a monad for general manipulation of Coq’s logical environment. We demonstrate how this setup allows Coq users to define many kinds of general purpose plugins, whose correctness can be readily proved in the system itself, and that can be run efficiently after extraction. We give a few examples of implemented plugins, including a parametricity translation. We also advocate the use of Template-Coq as a foundation for higher-level tools.
Meta-programming is the art of writing programs (in a meta-language) that produce or manipulate programs (written in an object language). In the setting of dependent type theory, the expressivity of the language permits to consider the case were the meta and object languages are actually the same, accounting for well-typedness. This idea has been pursued in the work on inductive-recursive (IR) and quotient inductive-inductive types (QIIT) in Agda to reflect a syntactic model of a dependently-typed language within another one [2, 9]. These term encodings include type-correctness internally by considering only well-typed terms of the syntax, i.e. derivations. However, the use of IR or QIITs complicates considerably the meta-theory of the meta-language which makes it difficult to coincide with the object language represented by an inductive type. More problematically in practice, the concision and encapsulation of the syntactic encoding has the drawback that it is very difficult to use because any function from the syntax can be built only at the price of a proof that it respects typing, conversion or any other features described by the intrinsically typed syntax right away.
Other works have taken advantage of the power of dependent types to do meta-programming in a more progressive manner, by first defining the syntax of terms and types; and then defining out of it the notions of reduction, conversion and typing derivation [11, 26] (the introduction of  provides a comprehensive review of related work in this area). This can be seen as a type-theoretic version of the functional programming language designs such as Template Haskell  or MetaML . This is also the approach taken by Malecha in his thesis , where he defined Template-Coq, a plugin which defines a correspondence—using quoting and unquoting functions—between Coq kernel terms and inhabitants of an inductive type representing internally the syntax of the calculus of inductive constructions (CIC), as implemented in Coq. It becomes thus possible to define programs in Coq that manipulate the representation of Coq terms and reify them as functions on Coq terms. Recently, its use was extended for the needs of the CertiCoq certified compiler project , which uses it as its front-end language. It was also used by Anand and Morissett  to formalize a modified parametricity translation, and to extract Coq terms to a CBV \(\lambda \)-calculus . All of these translations however lacked any means to talk about the semantics of the reified programs, only syntax was provided by Template-Coq. This is an issue for CertiCoq for example where both a non-deterministic small step semantics and a deterministic call-by-value big step semantics for CIC terms had to be defined and preserved by the compiler, without an “official” specification to refer to.
This paper proposes to remedy this situation and provides a formal semantics of Coq’s implemented type theory, that can independently be refined and studied. The advantage of having a very concrete untyped description of Coq terms (as opposed to IR or QIITs definitions) together with an explicit type checker is that the extracted type-checking algorithm gives rise to an OCaml program that can directly be used to type-check Coq kernel terms. This opens a way to a concrete solution to bootstrap Coq by implementing the Coq kernel in Coq. However, a complete reification of CIC terms and a definition of the checker are not enough to provide a meta-programming framework in which Coq plugins could be implemented. One needs to get access to Coq logical environments. This is achieved using a monad that reifies Coq general commands, such as lookups and declarations of constants and inductive types.
As far as we know this is the only reflection framework in a dependently-typed language allowing such manipulations of terms and datatypes, thanks to the relatively concise representation of terms and inductive families in CIC. Compared to the MetaCoq project , Lean ’s tactic monad , or Agda ’s reflection framework , our ultimate goal is not to interface with Coq’s unification and type-checking algorithms, but to provide a self-hosted, bootstrappable and verifiable implementation of these algorithms. On one hand, this opens the possibility to verify the kernel’s implementation, a problem tackled by Barras  using set-theoretic models. On the other hand we also advocate for the use of Template-Coq as a foundation on which higher-level tools can be built: meta-programs implementing translations, boilerplate-generating tools, domain-specific proof languages, or even general purpose tactic languages.
Plan of the Paper. In Sect. 2, we present the complete reification of Coq terms, covering the entire CIC and define in Sect. 3 the type-checking algorithm of Coq reified terms in Coq. In Sect. 4, we show the definition of a monad for general manipulation of Coq’s logical environment and use it to define plugins for various translations from Coq to Coq (Sect. 5). Finally, we discuss related and future work in Sect. 6.
2 Reification of Coq Terms
Constructor Open image in new window represents variables bound by abstractions (introduced by Open image in new window ), dependent products (introduced by Open image in new window ) and local definitions (introduced by Open image in new window ), the natural number is a De Bruijn index. The Open image in new window is a printing annotation.
Quoting and Unquoting of Terms. Template-Coq provides a lifting from concrete syntax to reified syntax (quoting) and the converse (unquoting). It can reify and reflect all kernel Coq terms.
Reification of Environment. In Coq, the meaning of a term is relative to an environment, which must be reified as well. Environments consist of three parts: (i) a graph of universes (ii) declarations of definitions, axioms and inductives (iii) a local context registering types of De Bruijn indexes.
Finally, local contexts are just list of local declarations: a type for lambda bindings and a type and a body for let bindings.
Quoting and Unquoting the Environment. Template-Coq provides the command Open image in new window to quote an environment. This command crawls the environment and quote all declarations needed to typecheck a given term.
More examples of use of quoting/unquoting commands can be found in the file Open image in new window .
3 Type Checking Coq in Coq
In Fig. 2, we present (an excerpt of) the specification of the typing judgment of the kernel of Coq using the inductive type Open image in new window . It represents all the typing rules of Coq1. This includes the basic dependent lambda calculus with lets, global references to inductives and constants, the Open image in new window construct and primitive projections. Universe polymorphic definitions and the well-formedness judgment for global declarations are dealt with as well.
The only ingredients missing are the guard check for fixpoint and productivity of cofixpoints and the positivity condition of mutual (co-) inductive types. They are work-in-progress.
The typing judgment Open image in new window is mutually defined with Open image in new window to account for n-ary applications. Untyped reduction Open image in new window and cumulativity Open image in new window can be defined separately.
Implementation. To test this specification, we have implemented the basic algorithms for type-checking in Coq, that is, we implement type inference: given a context and a term, output its type or produce a type error. All the rules of type inference are straightforward except for cumulativity. The cumulativity test is implemented by comparing head normal forms for a fast-path failure and potentially calling itself recursively, unfolding definitions at the head in Coq’s kernel in case the heads are equal. We implemented weak-head reduction by mimicking Coq’s kernel implementation, which is based on an abstract machine inspired by the KAM. Coq’s machine optionally implements a variant of lazy, memoizing evaluation (which can have mixed results, see Coq’s PR #555 for example), that feature has not been implemented yet.
The main difference with the OCaml implementation is that all of the functions are required to be shown terminating in Coq. One possibility could be to prove the termination of type-checking separately but this amounts to prove in particular the normalization of CIC which is a complex task. Instead, we simply add a fuel parameter to make them syntactically recursive and make Open image in new window a type error, i.e., we are working in a variant of the option monad.
4 Reification of Coq Commands
Coq plugins need to interact with the environment, for example by repeatedly looking up definitions by name, declaring new constants using fresh names, or performing computations. It is desirable to allow such programs to be written in Coq (Gallina) because of the two following advantages. Plugin-writers no longer need to understand the OCaml implementation of Coq and plugins are no longer sensitive to changes made in the OCaml implementation. Also, when plugins implementing syntactic models are proven correct in Coq, they provide a mechanism to add axioms to Coq without compromising consistency (Sect. 5.3).
Main Template-Coq commands
Reified command with its arguments
Returns the evaluation of Open image in new window following the evaluation strategy Open image in new window ( Open image in new window , Open image in new window , Open image in new window , Open image in new window or Open image in new window )
Returns Open image in new window if Open image in new window is a constant in the current environment and Open image in new window is the corresponding global reference. Returns Open image in new window otherwise.
Returns the syntax of Open image in new window and all the declarations on which it depends
Returns the declaration of the inductive Open image in new window
Declares the inductive denoted by the declaration Open image in new window
Open image in new window is an inductive family (Fig. 3) such that Open image in new window represents a program which will finally output a term of type Open image in new window . There are special constructor Open image in new window and Open image in new window to provide (freely) the basic monadic operations. We use the monadic syntactic sugar Open image in new window for Open image in new window .
The other operations of the monad can be classified in two categories: the traditional Coq operations ( Open image in new window to declare a new definition, ...) and the quoting and unquoting operations to move between Coq term and their syntax or to work directly on the syntax ( Open image in new window to declare a new inductive from its syntax for instance). An overview is given in Table 1.
A program Open image in new window of type Open image in new window can be executed with the command Open image in new window . This command is thus an interpreter for Open image in new window , implemented in OCaml as a traditional Coq plugin. The term produced by the program is discarded but, and it is the point, a program can have many side effects like declaring a new definition or a new inductive type, printing something, ....
5 Writing Coq Plugins in Coq
The reification of syntax, typing and commands of Coq allow writing a Coq plugin directly inside Coq, without requiring another language like OCaml and an external compilation phase.
In this section, we describe three examples of such plugins: (i) a plugin that adds a constructor to an inductive type, (ii) a re-implementation of Lasson ’s parametricity plugin3, and (iii) an implementation of a plugin that provides an extension of CIC—using a syntactic translation—in which it is possible to prove the negation of functional extensionality .
5.1 A Plugin to Add a Constructor
Our first example is a toy example to show the methodology of writing plugins in Template-Coq. Given an inductive type Open image in new window , we want to declare a new inductive type Open image in new window which corresponds to Open image in new window plus one more constructor.
It works in the following way. First the inductive type Open image in new window is quoted, the obtained term Open image in new window is expected to be a Open image in new window constructor otherwise the function fails. Then the declaration of this inductive is obtained by calling Open image in new window , the constructor is reified too, and an auxiliary function is called to add the constructor to the declaration. After evaluation, the new inductive type is added to the current context with Open image in new window .
The declaration of the block of mutual inductive types is a record. The field Open image in new window contains the list of declarations of each inductive of the block. We see that most of the fields of the records are propagated, except for the names which are translated to add some primes and Open image in new window the list of types of constructors, for which, in the case of the relevant inductive ( Open image in new window is its number), the new constructor is added.
5.2 Parametricity Plugin
We now show how Template-Coq permits to define a parametricity plugin that computes the translation of a term following Reynolds’ parametricity [21, 25]. We follow the already known approaches of parametricity for dependent type theories [7, 15], and provide an alternative to Keller and Lasson’s plugin.
The definition in the unary case is described in Fig. 4. The soundness theorem ensures that, for a term t of type A, \([t]_1\) computes a proof of parametricity of \([t]_0\) in the sense that it has type \([A]_1\, [t]_0\). The definition of the plugin goes in two steps: first the definition of the translation on the syntax of Open image in new window in Template-Coq and then the instrumentation to connect it with terms of Coq using the Open image in new window . It can be found in the file Open image in new window .
On Fig. 4, the translation is presented in a named setting, so the introduction of new variables does not change references to existing ones. That’s why, \([\ ]_0\) is the identity. In the De Bruijn setting of Template-Coq, the translation has to take into account the shift induced by the duplication of the context. Therefore, the implementation Open image in new window of \([\ ]_0\) is not the identity anymore. The argument Open image in new window of Open image in new window represents the De Bruijn level from which the variables have been duplicated. There is no need for such an argument in Open image in new window , the implementation of \([\ ]_1\), because in this function all variables are duplicated.
5.3 Intensional Function Plugin
Note that we could also define another translation, e.g. the setoid translation, in which FunExt is inhabited. This is not contradictory as the two translations induce two different logical extensions of Coq, which can not be combined.
6 Related Work and Future Work
Meta-Programming is a whole field of research in the programming languages community, we will not attempt to give a detailed review of related work here. In contrast to most work on meta-programming, we provide a very rough interface to the object language: one can easily build ill-scoped and ill-typed terms in our framework, and staging is basic. However, with typing derivations we provide a way to verify meta-programs and ensure that they do make sense.
The closest cousin of our work is the Typed Syntactic Meta-Programming  proposal in Agda, which provides a well-scoped and well-typed interface to a denotation function, that can be used to implement tactics by reflection. We could also implement such an interface, asking for a proof of well-typedness on top of the Open image in new window primitive of our monad.
Intrinsically typed representations of terms in dependent type-theory is an area of active research. Most solutions are based on extensions of Martin-Löf Intensional Type Theory with inductive-recursive or quotient inductive-inductive types [2, 9], therefore extending the meta-theory. Recent work on verifying soundness and completeness of the conversion algorithm of a dependent type theory (with natural numbers, dependent products and a universe) in a type theory with IR types  gives us hope that this path can nonetheless be taken to provide the strongest guarantees on our conversion algorithm. The intrinsically-typed syntax used there is quite close to our typing derivations.
Another direction is taken by the Œuf certified compiler , which restricts itself to a fragment of Coq for which a total denotation function can be defined, in the tradition of definitional interpreters advocated by Chlipala . This setup should be readily accommodated by Template-Coq.
The translation + plugin technique paves the way for certified translations and the last piece will be to prove correctness of such translations. By correctness we mean computational soundness and typing soundness (see ), and both can be stated in Template-Coq. Anand has made substantial attempts in this direction to prove the computational soundness, in Template-Coq, of a variant of parametricity providing stronger theorems for free on propositions . This included as a first step a move to named syntax that could be reused in other translations.
When performance matters, we can extract the translation to OCaml and use it like any ordinary Coq plugin. This relies on the correctness of extraction, but in the untyped syntax + typing judgment setting, extraction of translations is almost an identity pretty-printing phase, so we do not lose much confidence. We can also implement a template monad runner in OCaml to run the plugins outside Coq. Our first experiments show that we could gain a factor 10 for the time needed to compute the translation of a term. Another solution would be to use the certified CertiCoq compiler, once it supports a kind of foreign function interface, to implement the Open image in new window evaluation.
The last direction of extension is to build higher-level tools on top of the syntax: the unification algorithm described in  is our first candidate. Once unification is implemented, we can look at even higher-level tools: elaboration from concrete syntax trees, unification hints like canonical structures and type class resolution, domain-specific and general purpose tactic languages. A key inspiration in this regard is the work of Malecha and Bengston  which implemented this idea on a restricted fragment of CIC.
We do not treat metavariables which are absent from kernel terms and require a separate environment for their declarations.
In Coq, a proof obligation is a goal which has to be solved to complete a definition. Obligations were introduced by Sozeau  in the Program mode.
Note that there is a similar issue with applications and projections, but which can be circumvented this time using (untyped) primitive projections.
This work is supported by the CoqHoTT ERC Grant 64399 and the NSF grants CCF-1407794, CCF-1521602, and CCF-1646417.
- 2.Altenkirch, T., Kaposi, A.: Type theory in type theory using quotient inductive types. In: POPL 2016, pp. 18–29. ACM, New York (2016). http://doi.acm.org/10.1145/2837614.2837638
- 3.Anand, A., Morrisett, G.: Revisiting parametricity: inductives and uniformity of propositions. In: CoqPL 2018, Los Angeles, CA, USA (2018)Google Scholar
- 4.Anand, A., Appel, A., Morrisett, G., Paraskevopoulou, Z., Pollack, R.,Belanger, O.S., Sozeau, M., Weaver, M.: CertiCoq: a verified compiler for Coq. In: CoqPL, Paris, France (2017). http://conf.researchr.org/event/CoqPL-2017/main-certicoq-a-verified-compiler-for-coq
- 5.Armand, M., Grégoire, B., Spiwack, A., Théry, L.: Extending Coq with imperative features and its application to SAT verification. In: Kaufmann, M., Paulson, L.C. (eds.) ITP 2010. LNCS, vol. 6172, pp. 83–98. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-14052-5_8CrossRefGoogle Scholar
- 6.Barras, B.: Auto-validation d’un système de preuves avec familles inductives. Thèse de doctorat, Université Paris 7, November 1999Google Scholar
- 8.Boulier, S., Pédrot, P.M., Tabareau, N.: The next 700 syntactical models of type theory. In: CPP 2017, pp. 182–194. ACM, Paris (2017)Google Scholar
- 9.Chapman, J.: Type theory should eat itself. Electron. Notes Theor. Comput. Sci. 228, 21–36 (2009). Proceedings of LFMTP 2008. http://www.sciencedirect.com/science/article/pii/S157106610800577XCrossRefGoogle Scholar
- 11.Devriese, D., Piessens, F.: Typed syntactic meta-programming. In: ICFP 2013, vol. 48, pp. 73–86. ACM (2013). http://doi.acm.org/10.1145/2500365.2500575
- 12.Ebner, G., Ullrich, S., Roesch, J., Avigad, J., de Moura, L.: A metaprogramming framework for formal verification, pp. 34:1–34:29, September 2017Google Scholar
- 13.Forster, Y., Kunze, F.: Verified extraction from Coq to a lambda-calculus. In: Coq Workshop 2016 (2016). https://www.ps.uni-saarland.de/forster/coq-workshop-16/abstract-coq-ws-16.pdf
- 14.Jaber, G., Lewertowski, G., Pédrot, P.M., Sozeau, M., Tabareau, N.: The definitional side of the forcing. In: LICS 2016, New York, NY, USA, pp. 367–376 (2016). http://doi.acm.org/10.1145/2933575.2935320
- 15.Keller, C., Lasson, M.: Parametricity in an impredicative sort. CoRR abs/1209.6336 (2012). http://arxiv.org/abs/1209.6336
- 18.Malecha, G.M.: Extensible proof engineering in intensional type theory. Ph.D. thesis, Harvard University (2014)Google Scholar
- 19.Mullen, E., Pernsteiner, S., Wilcox, J.R., Tatlock, Z., Grossman, D.: Œuf: minimizing the Coq extraction TCB. In: Proceedings of CPP 2018, pp. 172–185 (2018). http://doi.acm.org/10.1145/3167089
- 20.Pédrot, P., Tabareau, N.: An effectful way to eliminate addiction to dependence. In: LICS 2017, Reykjavik, Iceland, pp. 1–12 (2017). https://doi.org/10.1109/LICS.2017.8005113
- 21.Reynolds, J.C.: Types, abstraction and parametric polymorphism. In: IFIP Congress, pp. 513–523 (1983)Google Scholar
- 23.Sozeau, M.: Programming finger trees in Coq. In: ICFP 2007, pp. 13–24. ACM, New York (2007). http://doi.acm.org/10.1145/1291151.1291156
- 24.Taha, W., Sheard, T.: Multi-stage programming with explicit annotations. In: PEPM 1997, pp. 203–217. ACM, New York (1997). http://doi.acm.org/10.1145/258993.259019
- 25.Wadler, P.: Theorems for free! In: Functional Programming Languages and Computer Architecture, pp. 347–359. ACM Press (1989)Google Scholar
- 27.Ziliani, B., Dreyer, D., Krishnaswami, N.R., Nanevski, A., Vafeiadis, V.: Mtac: a monad for typed tactic programming in Coq. J. Funct. Program. 25 (2015). https://doi.org/10.1017/S0956796815000118
- 28.Ziliani, B., Sozeau, M.: A comprehensible guide to a new unifier for CIC including universe polymorphism and overloading. J. Funct. Program. 27, e10 (2017). http://www.irif.univ-paris-diderot.fr/sozeau/research/publications/drafts/unification-jfp.pdfMathSciNetCrossRefGoogle Scholar
Open Access This chapter is licensed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license and indicate if changes were made.
The images or other third party material in this chapter are included in the chapter's Creative Commons license, unless indicated otherwise in a credit line to the material. If material is not included in the chapter's Creative Commons license and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.