Keywords: B Method, Set theory, Zenon Modulo, Automated deduction, Deduction modulo theory, Tableau method, Sequent calculus, Polymorphism, Dedukti, λΠ-calculus modulo theory, Proof certiĄcation

The B Method is a formal method heavily used in the railway industry to specify and develop safety-critical software. It allows the development of correct-by-construction programs, thanks to a reĄnement process from an abstract speciĄcation to a deterministic implementation of the program. The soundness of the reĄnement steps depends on the validity of logical formulas called proof obligations, expressed in a speciĄc typed set theory.

Typical industrial projects using the B Method generate thousands of proof obligations, thereby relying on automated tools to discharge as many as possible proof obligations. A speciĄc tool, called Atelier B, designed to implement the B Method and provided with a theorem prover, helps users verify the validity of proof obligations, automatically or interactively.

Improving the automated veriĄcation of proof obligations is a crucial task for the speed and ease of development. The solution developed in our work is to use Zenon, a Ąrst-order logic automated theorem prover based on the tableaux method. The particular feature of Zenon is to generate proof certiĄcates, i.e. proof objects that can be veriĄed by external tools. The B Method is based on Ąrst-order logic and a speciĄc typed set theory. To improve automated theorem proving in this theory, we extend the proof-search algorithm of Zenon to polymorphism and deduction modulo theory, leading to a new tool called Zenon Modulo which is the main contribution of our work.

The extension to polymorphism allows us to deal with problems combining several sorts, like booleans and integers, and generic axioms, like B set theory axioms, without relying on encodings. Deduction modulo theory is an extension of Ąrst-order logic with rewriting both on terms and propositions. It is well suited for proof search in axiomatic theories, as it turns axioms into rewrite rules. This way, we turn proof search among ABSTRACT axioms into computations, avoiding unnecessary combinatorial explosion, and reducing the size of proofs by recording only their meaningful steps. To certify Zenon Modulo proofs, we choose to rely on Dedukti, a proof-checker used as a universal backend to verify proofs coming from diferent theorem provers, and based on deduction modulo theory. This work is part of a larger project called BWare, which gathers academic entities and industrial companies around automated theorem proving for the B Method. These industrial partners provide to BWare a large benchmark of proof obligations coming from real industrial projects using the B Method and allowing us to test our tool Zenon Modulo.

The experimental results obtained on this benchmark are particularly conclusive since Zenon Modulo proves more proof obligations than state-of-the-art Ąrst-order provers. In addition, all the proof certiĄcates produced by Zenon Modulo on this benchmark are well checked by Dedukti, increasing our conĄdence in the soundness of our work.

Résumé

La Méthode B est une méthode formelle de spéciĄcation et de développement de logiciels critiques largement utilisée dans lŠindustrie ferroviaire. Elle permet le développement de programmes dit corrects par construction, grâce à une procédure de rainements successifs dŠune spéciĄcation abstraite jusquŠà une implantation déterministe du programme. La correction des étapes de rainement est garantie par la vériĄcation de la correction de formules mathématiques appelées obligations de preuve et exprimées dans la théorie des ensembles de la Méthode B. Les projets industriels utilisant la Méthode B génèrent généralement des milliers dŠobligation de preuve. La faisabilité et la rapidité du développement dépendent donc fortement dŠoutils automatiques pour prouver ces formules mathématiques.

Un outil logiciel, appelé Atelier B, spécialement développé pour aider au développement de projet avec la Méthode B, permet aux utilisateurs de décharger les obligations de preuve, automatiquement ou interactivement. Améliorer la vériĄcation automatique des obligations de preuve est donc une tâche importante. La solution que nous proposons est dŠutiliser Zenon, un outils de déduction automatique pour la logique du premier ordre et qui met en oeuvre la méthode des tableaux.

La particularité de Zenon est de générer des certiĄcats de preuve, des preuves écrites dans un certain format et qui peuvent être vériĄées automatiquement par un outil tiers.

La théorie des ensembles de la Méthode B est une théorie des ensembles en logique du premier ordre qui fait appel à des schémas dŠaxiomes polymorphes. Pour améliorer la preuve automatique avec celle-ci, nous avons étendu lŠalgorithme de recherche de preuve de Zenon au polymorphisme et à la déduction modulo théorie. Ce nouvel outil, qui constitue le coeur de notre contribution, est appelé Zenon Modulo. LŠextension de Zenon au polymorphisme nous a permis de traiter, eicacement et sans RÉSUMÉ encodage, les problèmes utilisant en même temps plusieurs types, par exemple les booléens et les entiers, et des axiomes génériques, tels ceux de la théorie des ensembles de B. La déduction modulo théorie est une extension de la logique du premier ordre à la réécriture des termes et des propositions. Cette méthode est adaptée à la recherche de preuve dans les théories axiomatiques puisquŠelle permet de transformer des axiomes en règles de réécriture.

Par ce moyen, nous passons dŠune recherche de preuve dans des axiomes à du calcul, réduisant ainsi lŠexplosion combinatoire de la recherche de preuve en présence dŠaxiomes et compressant la taille des preuves en ne gardant que les étapes intéressantes. La certiĄcation des preuves de Zenon Modulo, une autre originalité de nos travaux, est faite à lŠaide de Dedukti, un vériĄcateur universel de preuve qui permet de certiĄer les preuves provenant de nombreux outils diférents, et basé sur la déduction modulo théorie.

Ce travail fait partie dŠun projet plus large appelé BWare, qui réunit des organismes de recherche académiques et des industriels autour de la démonstration automatique dŠobligations de preuve dans lŠAtelier B. Les partenaires industriels ont fourni à BWare un ensemble dŠobligation de preuve venant de vrais projets industriels utilisant la Méthode B, nous permettant ainsi de tester notre outil Zenon Modulo. Les résultats expérimentaux obtenus sur cet ensemble de référence sont particulièrement convaincants puisque Zenon Modulo prouve plus dŠobligation de preuve que les outils de déduction automatique de référence au premier ordre. De plus, tous les certiĄcats de preuve produits par Zenon Modulo ont été validés par Dedukti, nous permettant ainsi dŠêtre très conĄant dans la correction de notre travail.

Introduction

The year 2016 will be remembered as a milestone in the rise of autonomous vehicles.

While the web company Google has started Google Car, its project of autonomous cars, several years ago Ű the Ćeet of vehicles has already been tested on almost three million kilometers Ű, oicial disclosures of new projects of autonomous cars were released in the Ąrst half of 2016. Most of the worldwide automobile manufacturers released statements about the advent of self-driving cars within Ąve years. For instance, the US automaker Ford announced in August a fully automated driverless car Ű without a steering wheel or pedals Ű for 2021 [START_REF] Sage | Ford Plans Self-Driving Car for Ride Share Fleets in 2021[END_REF]. In the city of Pittsburgh, PA, the transportation network company Uber released in August a Ćeet of self-driving test-cars to transport clients, along with safety drivers for the moment [START_REF] Chafkin | UberŠs First Self-Driving Fleet Arrives in Pittsburgh This Month[END_REF]].

The rise of self-driving cars is surely a good news, and it will be a relief for a large number of persons, in particular those sufering from reduced mobility. Once released, this new means of transportation should quickly outpace the old-fashioned car. But all these positive aspects should not hide some legitimate concerns about safety, a self-driving car being clearly a life-critical system. An autonomous car relies on dozens of sensors, microchips and embedded software to operate it. The development of software for safetycritical system requires speciĄc expertise and painstakingness, which seems to lack in the automotive industry.

The recent Toyota Şunintended accelerationŤ afair, as reported by Bagnara in the 12th Workshop on Automotive Software & Systems in 2014 [START_REF] Bagnara | On the Toyota UA Case and the RedeĄnition of Product Liability for Embedded Software[END_REF]], reveals questionable practices. In 2000, the car manufacturer Toyota adopted an Electronic Throttle Control System (ETCS for short) for most of its new car models, replacing a mechanically operated throttle pedal by an electronic one. In 2010, the National Highway INTRODUCTION Traic Safety Administration reported that 89 deaths may be linked to this afair, in addition to thousands of car accidents. In 2013, the Ąrst trial in which the plaintifs alleged that the unintended acceleration was caused by a malfunction of the ETCS system, has used the testimony of Baar [START_REF] Barr | Camry L4 Software Analysis[END_REF]], an embedded software expert, and Koopman [START_REF] Koopman | A Case Study of Toyota Unintended Acceleration and Software Safety[END_REF]], professor at Carnegie Mellon University, who were both allowed to investigate the source code of the ETCS embedded software. Their conclusions revealed that the software was, at least, very far from the expected standards for safety-critical systems. For instance, they reported that the development process did not follow strictly the MISRA-C guidelines Ű a discretionary standard developed by the Motor Industry Software Reliability Association.

They also described the C source code as Şspaghetti codeŤ, containing more than 10,000 read/write global variables. Finally, they pointed out the lack of certiĄcation requirements for software in safety-critical systems for US automakers.

In 2014, Toyota reached a $1.2 billion settlement with the US Department of Justice, ending a criminal investigation into the unintended acceleration afair. All the consequences of this afair are not yet fully documented sixteen years after the release of the ETCS system. But it can already be considered as a relevant case study and a turning point for functional safety in critical software systems.

An interesting conclusion of this story, which goes beyond the limited context of this case, is the lack of mandatory standards for US automotive industry when developing safety-critical software. Other transportation sectors, like aeronautic and railway industries, have successfully performed their electronic revolutions thirty years ago. For instance, the aircraft manufacturer Airbus released in 1984 the A320, the Ąrst airliner to Ćy with an all-digital Ćy-by-wire control system [START_REF] Favre | Fly-by-wire for Commercial Aircraft: the Airbus Experience[END_REF]]. In the railway industry, the Ąrst autonomous vehicles, a new fully automatic and driverless subway line in the city of Lille in France, appeared in 1983 [START_REF] Lardennois | VAL Automated Guided Transit Characteristics and Evolutions[END_REF]].

The high level of safety in these two sectors has been achieved with the application of speciĄc mandatory standards for electronic devices and embedded software. The standard IEC 61508 is the generic international standard for electrical, electronic and programmable safety-related systems, published by the International Electrotechnical Commission. It INTRODUCTION has been speciĄed for each particular sector. For instance in the railway industry, the standard EN 50128 applies to safety-related software for railway control and protection systems. One of the important notions deĄned by this standard is the Safety Integrity Level (SIL for short), a quantity that measures the relative level of risk-reduction provided by a safety function. The standard deĄnes four SIL levels, from SIL 1 (the lowest level of risk reduction) to SIL 4 (the highest level of risk reduction).

Safety functions of a system that requires a SIL 4 certiĄcation level are typically the most critical of the whole system, for instance the speed control system of a fully automatic driverless train. In software engineering, a large family of development methods, called formal methods, have been designed to develop highly trusted software. The general idea of formal methods is to prove that a program satisĄes some particular mathematical properties. These mathematical properties translate the desired behaviour of a system, and are gathered into the speciĄcation, a formal model of the system. The notion of speciĄcation is a central concept in formal methods, because all these methods allow us to prove only relative correctness of a program with respect to a speciĄcation. Thus, speciĄcations must be described in a formal language, typically a language without ambiguity, like logic-based languages, unlike natural languages. There exists a large number of diferent formal methods, covering all or part of the development cycle, from speciĄcation of a system to implementation.

The B Method is a formal method developed by Abrial and presented in its reference book, called the B-Book and published in 1996 [START_REF] Abrial | The B-Book, Assigning Programs to Meanings[END_REF]]. The B Method is based on previous work of Hoare and Dijkstra about the correctness of programs. It is mainly used in the railway industry to specify and develop safety-critical software. For instance, it has been successfully used to develop the command control system of the fully automatic driverless trains of the subway line 14 in the city of Paris in France in 1998 [START_REF] Behm | METEOR: A Successful Application of B in a Large Project[END_REF]. The B Method covers all the development cycle of a program, from the formal speciĄcation of a system, called the abstract machine, to a deterministic implementation of the program. The resulting programs are said correct-by-construction, thanks to a reĄnement process from the abstract machine to the last and fully deterministic INTRODUCTION B machine, called B0. The last stage of source code extraction consists in a mere syntactic translation of the B0 machine. The soundness of the reĄnement steps depends on the validity of logical formulae, called proof obligations, expressed in the speciĄc B set theory.

Common industrial projects using the B Method generate thousands of proof obligations, thereby relying on automated tools to discharge as many proof obligations as possible.

A speciĄc tool, called Atelier B [ClearSy 2013], designed to implement the B Method and provided with a theorem prover, helps users verify the validity of proof obligations, automatically or interactively. The automated theorem prover (ATP for short) of Atelier B proves around 85% of proof obligations in common industrial projects, letting thousands of proof obligations requiring a human interaction to be proved. This lack of automation in the B Method is a major cost factor for industrials, slowing its wide difusion.

Our work aims to improve the automated veriĄcation of B proof obligations, with a particular focus on the soundness of the generated proofs. Our main contribution consists in the development of a Ąrst-order ATP called Zenon Modulo. This tool extends Zenon [START_REF] Bonichon | Zenon: An Extensible Automated Theorem Prover Producing Checkable Proofs[END_REF], a Ąrst-order ATP based on the Tableau method. The Tableau method [START_REF] Dšagostino | Handbook of Tableau Methods[END_REF] is an automatic proof search algorithm for the sequent calculus without cuts. In proof theory, sequent calculus [START_REF] Gentzen | Untersuchungen über das logische Schließen[END_REF]] is a family of syntax-directed formal systems used to write formal proofs. It is deĄned by a set of inference rules, logical objects deĄning a syntactic relation between a set of formulae called premises and another set of formulae called conclusions, and corresponding to an elementary deduction step. These kinds of system are called proof systems. Tableau method proofs can be easily translated into sequent calculus proofs, as it is just a syntactic reformulation.

We do not need in our work to deal with all the B Method notions, in particular those related to the B language. We focus only on the mathematical reasoning of the B Method, consisting mainly in the B set theory. Improving the proof search algorithm of Zenon for the B Method leads to the development of two extensions, the former being an extension to Ąrst-order logic with polymorphic types, the latter being an extension to deduction modulo theory. The motivation of these two extensions is to deal eiciently with the B set theory.

INTRODUCTION

The B Method set theory difers from other ones, like the Zermelo-Fraenkel set theory.

The main diference consists in the addition of typing constraints to expressions, embedded into a set theoretic level, in the sense that there is no syntactical distinction between types and sets. To verify the well-typedness of expressions, the B-Book provides a set of typing inference rules, deĄning a type-checking procedure, which has to be applied once before proving. We show in Chap. 4 that B axioms and hypotheses can be seen as polymorphic formulae, in the sense that they are deĄned for generic types. Once the proof obligation Ű which is not polymorphic Ű is Ąxed, the generic types of axioms and hypotheses have to be instantiated with types coming from the proof obligation.

The B set theory is made of six axioms, in addition to a large number of derived constructs. These derived constructs, like the union between sets, the domain of a relation and the set of total injective functions, are important in the B Method since they are well represented in proof obligations. Therefore, it is crucial to deal eiciently with these constructs. We choose to beneĄt from deduction modulo theory [START_REF] Dowek | Theorem Proving Modulo[END_REF]] to improve proof search in the B set theory. Deduction modulo theory is a formalism that extends Ąrst-order logic with rewrite rules on both terms and propositions, and improves proof search in axiomatic theories by turning axioms into rewrite rules. It allows us to distinguish deduction and computation steps, and to reason over equivalence classes of formulae under a congruence generated by the rewrite system.

ATPs are generally large software, using sophisticated functionalities and complex optimizations. For instance, Zenon Modulo is made of more than 40,000 lines of OCaml code. Hazard growing up with size and complexity, potential causes of bugs and malfunctions exist in ATPs. When verifying proof obligations for the development of safety-critical software, guaranteeing the soundness of proofs is a very crucial task. Barendregt and Barendsen [START_REF] Barendregt | Autarkic Computations in Formal Proofs[END_REF] proposed to rely on the concept of proof certiĄcate, a proof object that contains a statement and its formal proof, and that can be veriĄed by an external tool. The originality of this approach is to separate the generation of the proof certiĄcate, made by the ATP, and the veriĄcation of the soundness of the proof, made by an external proof checker. Ideally, the proof checker should be built on a light and auditable kernel. From this point of view, another important contribution INTRODUCTION to Zenon Modulo is the development of a backend that generates proof certiĄcates for the proof checker Dedukti [START_REF] Assaf | Dedukti: a Logical Framework based on the λΠ-Calculus Modulo Theory[END_REF]. Dedukti is a lightweight implementation of the λΠ-calculus modulo theory, an extension of the simply typed λ-calculus with dependent types and rewriting. Dedukti is commonly used as a backend to verify proofs coming from ATPs, like Zenon Modulo, and also proof assistants, like Coq [START_REF] Bertot | Interactive Theorem Proving and Program Development: CoqŠArt: the Calculus of Inductive Constructions[END_REF].

Concerns may legitimately arise about the relevance of using Zenon Modulo, an ATP whose underlying logic is polymorphic Ąrst-order logic (Poly-FOL for short), to prove B proof obligations expressed in a speciĄc set theory. We answer this issue in an original way by deĄning an encoding of B formulae into Poly-FOL, where one of the particularities resides in the generation of type information in the resulting Poly-FOL expressions. This was made possible thanks to an externally deĄned type inference procedure for B bound variables. Then, we give a syntactic translation function of Zenon Modulo sequent calculus proofs into B natural deduction. Finally, we show that the resulting B proof is a proof of the original proof obligation. This closes the loop and gives us additional conĄdence in the correctness of our approach. This work is part of the BWare project [START_REF] Delahaye | The BWare Project: Building a Proof Platform for the Automated VeriĄcation of B Proof Obligations[END_REF],

an industrial research project supported by the ŞAgence Nationale de la RechercheŤ (French Research National Agency). BWare intends to provide a mechanized framework to help the automated veriĄcation of proof obligations coming from the development of industrial applications using the B Method. The BWare consortium gathers academic entities (Cedric, LRI and Inria) as well as industrial partners (Mitsubishi Electric R&D, ClearSy and OCamlPro).

The methodology of the BWare project consists in building a generic platform of veriĄcation relying on diferent deduction tools, such as Ąrst-order ATPs, and SatisĄability Modulo Theory (SMT for short) solvers. This platform is built upon Why3 [START_REF] Bobot | Why3: Shepherd Your Herd of Provers[END_REF], a platform for deductive program veriĄcation. The deduction tools used in the BWare framework are the ATP Zenon Modulo, the ATP iProver Modulo [START_REF] Burel | Experimenting with Deduction Modulo[END_REF]] and the SMT solver Alt-Ergo [START_REF] Bobot | The Alt-Ergo Automated Theorem Prover[END_REF]. The diversity of these theorem provers aims to allow a wide panel INTRODUCTION proof obligations to be automatically veriĄed by the platform. Beyond the multi-tool aspect of this methodology, the originality of BWare resides in the requirement for the deduction tools to produce proof certiĄcates. To test the BWare platform, a large collection of proof obligations is provided by the industrial partners of the project, which develop tools implementing the B Method and applications involving the use of the B Method. This has allowed us to perform an experiment over this benchmark, where we have compared our tool Zenon Modulo with the other BWare tools and state-of-the-art ATPs. This manuscript is organized as follows. In Chap. 1, we introduce the logic of the B Method. In particular, we present its proof system, set theory and type system. In Chap. 2, we present a type inference procedure for B bound variables. This procedure allows us to annotate variables with their types, an information required in the following. We also present a sound elimination procedure of sets deĄned by comprehension. In Chap. 3, we introduce polymorphic Ąrst-order logic, denoted Poly-FOL, and present LLproof, the typed sequent calculus used by Zenon to output proofs. In Chap. 4, we deĄne an encoding of B formulae into Poly-FOL, and show how to rebuild B proofs from Zenon proofs. In Chap. 5, we show the soundness of LLproof ≡ , the extension of LLproof to deduction modulo theory, with respect to LLproof. In Chap. 6, we present Zenon and its extension to polymorphism and deduction modulo theory, resulting in our new tool Zenon Modulo. In Chap. 7, we introduce Dedukti and the λΠ-calculus modulo theory. Then, we present the encodings of Poly-FOL and LLproof ≡ into the λΠ-calculus modulo theory. Finally, in Chap. 8, we present the BWare project. Then, we give the rewrite system corresponding to the B set theory and used in BWare. We conclude this last chapter with the experimental results obtained over the BWare benchmark.

Chapter 1

The B Method This chapter presents the logic of the B Method, i.e. its syntax, proof system, set theory and type system.

It is a faithful presentation of the core logic of the B Method as presented in the Ąrst two chapters of the B-Book [START_REF] Abrial | The B-Book, Assigning Programs to Meanings[END_REF]], dealing with mathematical reasoning and set theory. It does not contain any new contribution.

Presentation

The B Method is a formal method that covers all the development process of programs, from the formal speciĄcation of a system to its actual implementation in a programming language. The formal speciĄcation, called an abstract machine, is described using the B language, a high level language that manipulates programs using the concept of generalized substitutions, a central notion of the B Method to describe the dynamic parts of B machines.

The evolution from a speciĄcation to an implementation is done step-by-step by a reĄnement process of B machines that removes indeterminism from the machines. At the end of the reĄnement process, the last B machine, called B0, uses fully deterministic algorithms and data structures that are close to programming language ones, allowing us to generate the source code of the program by a mere syntactic translation.

The consistency of abstract machines and the soundness of the reĄnement steps depend on the validity of mathematical formulae called proof obligations. These formulae are expressed in the framework of Ąrst-order logic with set theory. But, as we shall see later, the set theory behind the B Method is rather speciĄc, compared to common set theory like the Zermelo-Fraenkel set theory.

The work presented in this manuscript deals with the mathematical aspects of the B Method. In particular, we focus on the provability of proof obligations with respect to the B set theory, without any concern about the upstream concepts of B machines and generalized substitutions.

Logic

In this section, we present the syntax, the proof system, the set theory and the type system, which form the core logic of the B Method.

Syntax

We present in Fig. 1.1 the syntax of the B Method. It is made of four syntactic categories, i.e. formulae, expressions, variables and sets.

A formula P is built from the logical connectives conjunction, implication and negation and the universal quantiĄcation. A formula may also be the result of a substitution in a formula, an equality between two expressions or membership to a set.

An expression E may be a variable, the result of a substitution in an expression, an ordered pair, an arbitrary element in a set or a set.

A variable x is either an identiĄer or a list of variables.

Finally, a set s is built using the elementary set constructs, i.e. the cartesian product, the powerset and the comprehension set, or may be the inĄnite set BIG (axiomatized below).

Remark

In the B Method, common constructs like existential quantiĄcation, disjunction, equivalence and subset are deĄned as syntactic sugar. The B-Book gives the following rewrite rules as deĄnitions:

E → → F := E, F ∃x • P := ¬∀x • ¬P P ∨ Q := ¬P ⇒ Q P ⇔ Q := (P ⇒ Q) ∧ (Q ⇒ P ) s ⊆ t := s ∈ P(t) s ⊂ t := s ⊆ t ∧ s ̸ = t P ::= P 1 ∧ P 2 (conjunction) ♣ P 1 ⇒ P 2 (implication) ♣ ¬P (negation) ♣ ∀x • P (universal quantiĄcation) ♣ [x := E]P (substitution) ♣ E 1 = E 2 (equality) ♣ E ∈ s (membership) E ::= x (variable) ♣ [x := E 1 ]E 2 (substitution) ♣ E 1 , E 2 (ordered pair) ♣ choice(s) (choice function) ♣ s (set)
x ::= identif ier (variable identiĄer) ♣

x 1 , x 2 (list of variables)

s ::= s 1 × s 2 (cartesian product) ♣ P(s) (powerset) ♣ ¶x ♣ P ♢ (comprehension set) ♣ BIG (inĄnite set)
Figure 1.1: The B Method Syntax

Non-Freeness

In the B Method, non-freeness provisos are often used. For instance, inference rules of the B proof system (see Fig. 1.3), axioms of the set theory (see Fig. 1.4) and inference rules of the type system (see Fig. 1.10) use non-freeness properties.

A variable x is said to have a free occurrence in a formula or in an expression if: (1) it is present in such a formula and (2) it is present in a sub-formula which is not under the scope of a quantiĄer ranging over x itself.

A variable x is said to be non-free in a formula or in an expression if: (1) it is not present in such a formula or (2) it is only present in sub-formulae under the scope of some quantiĄer.

We present in Fig. 1.2 the rules that deĄne the notion of non-freeness for all syntactic constructs of the B Method.

In the following, a context, denoted Γ, is a set of formulae to the veriĄcation of proof obligations, we do not need to introduce them here. We can make the legitimate assumption that expressions are already normalized in the context of proof obligations.

Proof System

The proof system of the B Method is an adaptation of Natural Deduction [START_REF] Gentzen | Untersuchungen über das logische Schließen[END_REF]] with sequents to the syntax of the B Method. In addition to this proof system, the B-Book deĄnes derived rules used in a decision procedure to prove formulae. In the following, we focus only on the original proof system of the B Method, as presented in [START_REF] Abrial | The B-Book, Assigning Programs to Meanings[END_REF]].

The rules are summarized in Fig. 1.3.

BR1 P ⊢ B P Γ ⊢ B P Γ ❁ Γ ′ BR2 Γ ′ ⊢ B P P Ű ❁ Γ BR3 Γ ⊢ B P Γ ⊢ B P Γ, P ⊢ B Q BR4 Γ ⊢ B Q Γ ⊢ B P Γ ⊢ B P ⇒ Q MP Γ ⊢ B Q Γ ⊢ B P Γ ⊢ B Q R1 Γ ⊢ B P ∧ Q Γ ⊢ B P ∧ Q R2 Γ ⊢ B P Γ ⊢ B P ∧ Q R2 ′ Γ ⊢ B Q Γ, P ⊢ B Q R3 Γ ⊢ B P ⇒ Q Γ ⊢ B P ⇒ Q R4 Γ, P ⊢ B Q Γ, ¬Q ⊢ B P Γ, ¬Q ⊢ B ¬P R9 Γ ⊢ B [x := F ]P R10 Γ ⊢ B E = E Figure 1.3: The Proof System of the B Method

B Set Theory

As presented in the B-Book, the B Method set theory is a simpliĄcation of standard set theory [START_REF] Abrial | The B-Book, Assigning Programs to Meanings[END_REF]]. Some common axioms, like the foundation axiom, are not needed in this context (see Sec. 1.3), leading to a theory made only of six axioms. Actually, axioms presented below are axiom schemata that have to be instantiated with proper expressions.

The Ąrst column represents non-freeness proviso.

It should be noted that the axiom SET3, which have an implicit quantiĄcation over a predicate symbol P , is not pure Ąrst-order logic. Such issues have already been studied, we can mention the theory of classes [START_REF] Kirchner | A Finite First-Order Theory of Classes[END_REF]] for instance. We explain in Sec. 2.3 how we deal with this axiom in our work.

E, F ∈ s × t ⇔ (E ∈ s ∧ F ∈ t) SET1 x\(s, t) s ∈ P(t) ⇔ ∀x • (x ∈ s ⇒ x ∈ t) SET2 x\s E ∈ ¶x ♣ x ∈ s ∧ P ♢ ⇔ (E ∈ s ∧ [x := E]P ) SET3 x\(s, t) ∀x • (x ∈ s ⇔ x ∈ t) ⇒ s = t SET4 x\s ∃x • (x ∈ s) ⇒ choice(s) ∈ s SET5 infinite(BIG) SET6 Figure 1.4: The B Set Theory

Example

As an example of a proof in the B set theory, we prove, given a set u, the property:

u ∈ P(u)
We need the instance of the axiom SET2:

u ∈ P(u) ⇔ ∀x • (x ∈ u ⇒ x ∈ u)
which will be abbreviated by Ax in the following.

The resulting proof is:

BR3 Ax, x ∈ u ⊢ B x ∈ u R3 Ax ⊢ B x ∈ u ⇒ x ∈ u R7 Ax ⊢ B ∀x • (x ∈ u ⇒ x ∈ u) BR1 Ax ⊢ B Ax R2 ′ Ax ⊢ B ∀x • (x ∈ u ⇒ x ∈ u) ⇒ u ∈ P(u) MP u ∈ P(u) ⇔ ∀x • (x ∈ u ⇒ x ∈ u) ⊢ B u ∈ P(u)

Derived Constructs, Binary Relations and Functions

The B Method relies on various usual set theory constructs, derived from the basic ones previously introduced. It should be noted that these new constructs are syntactic sugar and can always be replaced by their deĄnitions. Thus, these deĄnitions may be seen also as rewrite rules.

Basic Derived Constructs

First, we introduced in Fig. 1.5 the basic set theory constructs for the union, the intersection, the diference of two sets, then the empty set, sets deĄned by extension and Ąnally the set of non-empty subset of a set.

In the following, s and t are two sets such that they are both subsets of the same set u.

The Ąrst four deĄnitions use an external set called u. This set is used to guarantee that the set deĄned by comprehension is well typed. This notion is explained in Sec. 1.3.

The deĄnition of the empty set uses the diference between BIG and itself, because it is the only set explicitly given so far. Using the extensionality axiom, we can show that the empty set can be deĄned using any set.

s ∪ t := ¶a ♣ a ∈ u ∧ (a ∈ s ∨ a ∈ t)♢ (union) s ∩ t := ¶a ♣ a ∈ u ∧ (a ∈ s ∧ a ∈ t)♢ (intersection) s -t := ¶a ♣ a ∈ u ∧ (a ∈ s ∧ a ̸ ∈ t)♢ (diference) ¶E♢ := ¶a ♣ a ∈ u ∧ a = E♢ (singleton) ¶L, E♢ := ¶L♢ ∪ ¶E♢ (extension) ∅ := BIG -BIG (empty set) P 1 (s) := P(s) - ¶∅♢
(non-empty powerset)

Figure 1.5: Basic B Set Theory Derived Constructs

Binary Relation Constructs: First Series

In the B Method, binary relations are important to modelize data structures. We present in Fig. 1.6, the Ąrst series of constructs dealing with binary relations.

The Ąrst deĄnition is the set of binary relations from one set s to another set t, denoted by s ↔ t. Since a relation is a set, all the previous constructs dealing with sets can be applied to relations. Then, we introduce the notions of the inverse of a relation, the domain and the range of a relation. Then, we present the composition and the backward composition of relations, the identity relation and various forms of relational restrictions of relations.

In the following, u, v and w are sets, a, and c are some distinct variables, and p, q, s and t are such that:

p ∈ u ↔ v q ∈ v ↔ w s ⊆ u t ⊆ v u ↔ v := P(u × v) (relation set) p -1 := ¶b, a ♣ (b, a) ∈ v × u ∧ (a, b) ∈ p♢ (inverse) dom(p) := ¶a ♣ a ∈ u ∧ ∃b • (b ∈ v ∧ (a, b) ∈ p)♢ (domain) ran(p) := dom(p -1 ) (range) p; q := ¶a, c ♣ (a, c) ∈ u × w ∧ ∃b • (b ∈ v ∧ (a, b) ∈ p ∧ (b, c) ∈ q)♢ (composition) q • p := p; q (backward composition) id(u) := ¶a, b ♣ (a, b) ∈ u × u ∧ a = b♢ (identity) s ✁ p := id(s); p (domain restriction) p ✄ t := p; id(t) (range restriction) s ✁ -p := (dom(p) -s) ✁ p (domain subtraction) p ✄ -t := p ✄ (ran(p) -t)
(range subtraction) In the following, s, t, u and v are sets, a, b and c are distinct variables, and p, w, q, f , g, h and k are such that:

p ∈ s ↔ t w ⊆ s q ∈ s ↔ t f ∈ s ↔ u g ∈ s ↔ v h ∈ s ↔ u k ∈ t ↔ u p[w] := ran(w ✁ p) (image) q ✁ -p := (dom(p) ✁ -q) ∪ p (overriding) f ⊗ g := ¶a, (b, c) ♣ a, (b, c) ∈ s × (u × v) ∧ (a, b) ∈ f ∧ (a, c) ∈ g♢ (composition) prj 1 (s, t) := (id(s) ⊗ (s × t)) -1 (projection 1) prj 2 (s, t) := ((t × s) ⊗ id(t)) -1 (projection 2) h ♣♣ k := (prj 1 (s, t); h) ⊗ (prj 2 (s, t); k) (parallel product)
Figure 1.7: Binary Relation Constructs (Part 2)

Functions

In the B Method, a function is a special case of relation where two diferent elements of the range cannot be related to the same element of the domain. We present in Fig. 1.8 the diferent sets of functions, where s and t are sets, and r and f are variables.

s → t := ¶r ♣ r ∈ s ↔ t ∧ (r -1 ; r) ⊆ id(t)♢ (partial function) s → t := ¶f ♣ f ∈ s → t ∧ dom(f ) = s♢ (total function) s ↣ t := ¶f ♣ f ∈ s → t ∧ f -1 ∈ t → s♢ (partial injection) s ↣ t := s ↣ t ∩ s → t (total injection) s ↠ t := ¶f ♣ f ∈ s → t ∧ ran(f ) = t♢ (partial surjection) s ↠ t := s ↠ t ∩ s → t (total surjection) s ↣ ↠ t := s ↣ t ∩ s ↠ t (partial bijection) s ↣ ↠ t := s ↣ t ∩ s ↠ t (total bijection)
Figure 1.8: Sets of Functions

Type System

The B Method set theory difers from other ones, like the Zermelo-Fraenkel set theory.

The main diference consists in the addition of typing constraints to expressions, and the application of a type-checking procedure before proving. This avoids ill-formed formulae such as ∃x • (x ∈ x), whose negation is provable in Zermelo-Fraenkel set theory, thanks to the foundation axiom, unlike for the B Method.

A Hierarchy in Set Inclusion

The proposed typing discipline relies on the monotonicity of set inclusion. For instance, if we have an expression E and two sets s and t such that E ∈ s and s ⊆ t, then E ∈ t.

Going further with another set u such that t ⊆ u, we have then E ∈ u. The idea, as explained in the B-Book, is that, given a formula to be type checked, there exists an upper limit for such set containment. This upper limit is called the superset of s and the type of E. Then, if u is the superset of s, we obtain the typing information E ∈ u and s ∈ P(u).

Type Checking Syntax

The type checking procedure presented below uses two syntactic categories T ype and T ype_P red as presented in Fig. 1.9. The former corresponds to the diferent kinds of types of expressions. The later may be seen as the type of propositions.

In the following, we use ty, su and ch as abbreviations for the keywords type, super and check respectively.

As stated in the B-Book, the type of an expression E is either an identiĄer (see the notion of given set below), the powerset of a type or the cartesian product of two types;

and for the particular case of sets, the type of a set is necessarily the powerset of some type.

If E is an expression, s is a set and P a formula, ty(E) is the type of the expression E, su(s) is the superset of s Ű i.e. the largest set that contains s Ű and ch(P ) veriĄes that P is a formula.

T ype

::= type(E) (type of expression) ♣ super(s) (superset of set) ♣ T ype × T ype (product type) ♣ P(T ype) (powerset type) ♣ identif ier (given set)
T ype_P red ::= check(P ) (type of a predicate) ♣

T ype ≡ T ype (equality of type)

Figure 1.9: B Type-Checking Syntax

Type Checking

Type checking is performed by applying, in a backward way, the inference rules presented in Fig. 1.10. In addition, the B-Book requires to follow the numerical order of rules, in the sense that rules with a lower number have priority. This allows us to have a deterministic procedure. For rules T9 to T18, i.e. those with a particular typing expression on the left-hand side of the typing equivalence symbol ≡ and with an arbitrary expression on the right-hand side, the B-Book deĄnes the symmetric rule where the conclusion is inverted with respect to symbol of equivalence. These rules are denoted with the same name primed and are not presented in Fig. 1.10.

For instance, the rule T9 ′ is deĄned as follows:

x ∈ s Ű ❁ ∆ ∆ ⊢ tc U ≡ su(s) T9 ′ ∆ ⊢ tc U ≡ ty(x)
If this decision procedure terminates and does not fail, then the formula is said to be well-typed.

The type system of Fig. 1.10 is divided in three categories of inference rules. The Ąrst set of inference rules, from T1 to T8 ′ , allows us to decompose the logical connectives of formulae. The second set of inference rules, from T9 to T18 and the primed versions, allows us to eliminate the typing constructors ty and su. Finally, the third set, made of the three last rules T19, T20 and T21, deals with the set theory constructs.

The B-Book does not give us some usual properties about the type system that we might expect, like the completeness and the unicity of typing Ű there exists a unique and valid typing derivation for all well-typed formulae.

We do not need such strong properties in the context of our work, in particular completeness. But we still need to state the unicity of typing. Since the type inference procedure proposed in the next chapter occurs only after the veriĄcation of well-typedness, we can consider only formulae that are well-typed and which have a valid typing derivation.

Proposition 1.3.1

Given a well-formed formula P , if the type checking decision procedure terminates well, then the corresponding typing derivation is unique.

Proof The ordering for rule application implies that the type checking decision procedure is deterministic, leading to the unicity of typing derivation.

Notion of Given Sets

A type-checking sequent like ∆ ⊢ tc ch(P ) means that, within the environment ∆, the formula P is well-typed. The environment ∆ is made of atomic formulae of the form x ∈ s,

∆ ⊢ tc ch(P ) ∆ ⊢ tc ch(Q) T1 ∆ ⊢ tc ch(P ∧ Q) ∆ ⊢ tc ch(P ) ∆ ⊢ tc ch(Q) T2 ∆ ⊢ tc ch(P ⇒ Q) ∆ ⊢ tc ch(P ) T3 ∆ ⊢ tc ch(¬P ) x\s x\∆ ∆, x ∈ s ⊢ tc ch(P ) T4 ∆ ⊢ tc ch(∀x • (x ∈ s ⇒ P )) ∆ ⊢ tc ch(∀x • (x ∈ s ⇒ ∀y • (y ∈ t ⇒ P ))) T5 ∆ ⊢ tc ch(∀(x, y) • (x, y ∈ s × t ⇒ P )) ∆ ⊢ tc ch(∀x • (P ⇒ (Q ∧ R))) T6 ∆ ⊢ tc ch(∀x • ((P ∧ Q) ⇒ R)) ∆ ⊢ tc ty(E) ≡ ty(F ) T7 ∆ ⊢ tc ch(E = F ) ∆ ⊢ tc ty(E) ≡ su(s) T8 ∆ ⊢ tc ch(E ∈ s) ∆ ⊢ tc su(s) ≡ su(t) T8 ′ ∆ ⊢ tc ch(s ⊆ t) x ∈ s Ű ❁ ∆ ∆ ⊢ tc su(s) ≡ U T9 ∆ ⊢ tc ty(x) ≡ U ∆ ⊢ tc ty(E) × ty(F ) ≡ U T10 ∆ ⊢ tc ty(E, F ) ≡ U ∆ ⊢ tc su(s) ≡ U T11 ∆ ⊢ tc ty(choice(s)) ≡ U ∆ ⊢ tc P(su(s)) ≡ U T12 ∆ ⊢ tc ty(s) ≡ U x ∈ s Ű ❁ ∆ ∆ ⊢ tc su(s) ≡ P(U ) T13 ∆ ⊢ tc su(x) ≡ U ∆ ⊢ tc su(s) × su(t) ≡ U T14 ∆ ⊢ tc su(s × t) ≡ U ∆ ⊢ tc P(su(s)) ≡ U T15 ∆ ⊢ tc su(P(s)) ≡ U gi(I) Ű ❁ ∆ ∆ ⊢ tc I ≡ U T17 ∆ ⊢ tc su(I) ≡ U ∆ ⊢ tc ch(∀x • (x ∈ s ⇒ P )) ∆ ⊢ tc su(s) ≡ U T16 ∆ ⊢ tc su( ¶x ♣ x ∈ s ∧ P ♢) ≡ U ∆ ⊢ tc su(s) ≡ P(U ) T18 ∆ ⊢ tc su(choice(s)) ≡ U ∆ ⊢ tc T ≡ U T19 ∆ ⊢ tc P(T ) ≡ P(U ) ∆ ⊢ tc T ≡ U ∆ ⊢ tc V ≡ W T20 ∆ ⊢ tc T × V ≡ U × W gi(I) Ű ❁ ∆ T21 ∆ ⊢ tc I ≡ I Figure 1
.10: The Type System of the B Method where x is non-free in s. All free variables in P have to be associated with some atomic formula in ∆. The only exception is for variables in P representing some abstract given sets, introduced at a meta-level discourse like: ŞGiven a set s ...Ť. Such a given set s, which will be used to type other sets, is introduced in the environment ∆ by the keyword given(s) (gi(s) for short), telling us that s is free in the formula to be type-checked, and has the speciĄc property that su(s) = s.

Example

Given two sets s and t, the formula P ex :

P ex := ∀(a, b) • (a, b ∈ P(s × t) × P(s × t) ⇒ ¶x ♣ x ∈ a ∧ x ∈ b♢ ⊆ s × t)
will be used as a running example in the following.

We want to verify that this formula is well-typed, i.e. verify that the following sequent is derivable:

gi(s), gi(t) ⊢ tc ch(∀(a, b) • (a, b ∈ P(s × t) × P(s × t) ⇒ ¶x ♣ x ∈ a ∧ x ∈ b♢ ⊆ s × t))
Using the following notations:

∆ := gi(s), gi(t), a ∈ P(s × t), b ∈ P(s × t) ∆ ′ := gi(s), gi(t), a ∈ P(s × t), b ∈ P(s × t), x ∈ a
And denoting Π 1 the following derivation:

T21 ∆ ⊢ tc s ≡ s T17 ′ ∆ ⊢ tc s ≡ su(s) T17 ∆ ⊢ tc su(s) ≡ su(s) T21 ∆ ⊢ tc t ≡ t T17 ′ ∆ ⊢ tc t ≡ su(t) T17 ∆ ⊢ tc su(t) ≡ su(t) T20 ∆ ⊢ tc su(s) × su(t) ≡ su(s) × su(t) T14 ∆ ⊢ tc su(s × t) ≡ su(s) × su(t) T19 ∆ ⊢ tc P(su(s × t)) ≡ P(su(s) × su(t)) T15 ∆ ⊢ tc su(P(s × t)) ≡ P(su(s) × su(t)) T13 ∆ ⊢ tc su(a) ≡ su(s) × su(t) Π 1
We obtain, by applying the rules of Fig. 1.10, the following typing tree:

T21 ∆ ′ ⊢ tc s ≡ s T17 ′ ∆ ′ ⊢ tc s ≡ su(s) T17 ∆ ′ ⊢ tc su(s) ≡ su(s) T21 ∆ ′ ⊢ tc t ≡ t T17 ′ ∆ ′ ⊢ tc t ≡ su(t) T17 ∆ ′ ⊢ tc su(t) ≡ su(t) T20 ∆ ′ ⊢ tc su(s) × su(t) ≡ su(s) × su(t) T14 ′ ∆ ′ ⊢ tc su(s) × su(t) ≡ su(s × t) T14 ∆ ′ ⊢ tc su(s × t) ≡ su(s × t) T19 ∆ ′ ⊢ tc P(su(s × t)) ≡ P(su(s × t)) T15 ′ ∆ ′ ⊢ tc P(su(s × t)) ≡ su(P(s × t)) T13 ′ ∆ ′ ⊢ tc su(s × t) ≡ su(b) T19 ∆ ′ ⊢ tc P(su(s × t)) ≡ P(su(b)) T15 ∆ ′ ⊢ tc su(P(s × t)) ≡ P(su(b)) T13 ∆ ′ ⊢ tc su(a) ≡ su(b) T9 ∆ ′ ⊢ tc ty(x) ≡ su(b) T8 ∆, x ∈ a ⊢ tc ch(x ∈ b) T4 ∆ ⊢ tc ch(∀x • (x ∈ a ⇒ x ∈ b)) Π 1 T16 ∆ ⊢ tc su( ¶x ♣ x ∈ a ∧ x ∈ b♢) ≡ su(s) × su(t) T14 ′ ∆ ⊢ tc su( ¶x ♣ x ∈ a ∧ x ∈ b♢) ≡ su(s × t) T8 ′ gi(s), gi(t), a ∈ P(s × t), b ∈ P(s × t) ⊢ tc ch( ¶x ♣ x ∈ a ∧ x ∈ b♢ ⊆ s × t) T4 gi(s), gi(t), a ∈ P(s × t) ⊢ tc ch(∀b • (b ∈ P(s × t) ⇒ ¶x ♣ x ∈ a ∧ x ∈ b♢ ⊆ s × t)) T4 gi(s), gi(t) ⊢ tc ch(∀a • (a ∈ P(s × t) ⇒ ∀b • (b ∈ P(s × t) ⇒ ¶x ♣ x ∈ a ∧ x ∈ b♢ ⊆ s × t))) T5 gi(s), gi(t) ⊢ tc ch(∀(a, b) • (a, b ∈ P(s × t) × P(s × t) ⇒ ¶x ♣ x ∈ a ∧ x ∈ b♢ ⊆ s × t))
Chapter 2

Type Inference for B Variables

This chapter introduces some modiĄcations of the B Method syntax that will be used in the following chapters. In particular, we present in Sec. 2.2 a type inference procedure for bound variables, and in Sec. 2.3 a skolemization procedure to eliminate sets deĄned by comprehension. These contributions are a personal work and they have been published

in [START_REF] Halmagrand | Soundly Proving B Method Formulae Using Typed Sequent Calculus[END_REF]].

A Lack of Information

As can be seen in Sec. 1.3, the B Method is based on a typed set theory, in the sense that we have to verify that a formula is well-typed before proving it. To achieve this, the B Method provides a decision procedure made of a set of inference rules (see Fig. 1.10).

Unfortunately, these rules do not provide the actual type of expressions, in particular variables. For instance, the rule T16:

∆ ⊢ tc ch(∀x • (x ∈ s ⇒ P )) ∆ ⊢ tc su(s) ≡ U T16 ∆ ⊢ tc su( ¶x ♣ x ∈ s ∧ P ♢) ≡ U
decomposes comprehension sets and generates two branches, the former checking that a universally quantiĄed formula is well-typed, the later verifying some typing constraints about a particular set coming from the comprehension set. As we can see, the type of the bound variable x is not given explicitly. This is because the type system of Fig. 1.10 is a decision procedure that veriĄes the well-typedness of formulae, unlike a type inference procedure that gives the type of expressions.

For the rest of this manuscript, we need to carry more typing information about expressions in B formulae. In particular, we need that bound variables carry their type for the embedding of B formulae into Ąrst-order logic with polymorphic types presented in Sec. 3.2.

Type Annotation for B Variables

We present in the sequel of this section a type inference procedure for bound variables.

This method is performed right after type-checking if this latter step succeeds.

Bound Variables

In the B syntax presented in Sec. 1.2.1, two constructs introduce new bound variables:

universal quantiĄcation ∀x • P and comprehension set ¶x ♣ P ♢. It should be noted that the typing rules T4 and T16 dealing with these two syntactical constructs use the speciĄc forms ∀x • x ∈ s ⇒ P and ¶x ♣ x ∈ s ∧ P ♢. Thus, in practice, all the comprehension sets and universally quantiĄed formulae have to be of this speciĄc form to be type-checked.

The reason is that they must mention explicitly the set that contains the bound variable introduced. The formula x ∈ s is therefore used to type the bound variable x:

x\s x\∆ ∆, x ∈ s ⊢ tc ch(P ) T4 ∆ ⊢ tc ch(∀x • (x ∈ s ⇒ P ))
The rule T4 is the only one that adds new variables in typing contexts ∆ Ű T16 relies on a further application of T4 to do so.

New Syntactic Category for Types

We deĄne a new syntactic category T for types:

T ::= identif ier (given set) ♣ T 1 × T 2
(product type constructor) ♣ P(T ) (powerset type constructor)

And we introduce the notation x T meaning that the variable x has type T .

This new syntactic category is based on the type-checking syntax presented in Fig. 1.9.

We just keep the three constructs that denote types, i.e. identiĄers, product of types and powerset of type. The other cases are not needed. In particular, the two keywords type and super (which respectively compute the type of an expression and a set in the type-checking algorithm presented in Fig. 1.10) and the T ype_P red category are not type constructors.

Typing Contexts

The annotation procedure given below will use the environments ∆, also called typing contexts, to annotate variables. We need to go further than the B-Book, and formalize the structure of these typing contexts.

Syntax

Typing contexts ∆ contain two kinds of declarations: given sets (see Sec. 1.3.4) and variables. They follow the syntax:

∆ ::= ∅ (empty context) ♣ ∆, gi(s) (given set) ♣ ∆, x ∈ s (bound variable)
In the formula x ∈ s, s is necessarily a set. It can therefore only be a composition of the two type constructors P and × applied to sets. In the following, we denote by the symbol k of arity n arbitrary compositions of the two type constructors P and ×. The formula x ∈ s can be written in a more precise way:

x ∈ k(s 1 , . . . , s n )
where s 1 , . . . , s n are all set variables or given sets already declared in ∆.

Well-Formedness

Typing contexts ∆ are augmented only by the rule T4, thus they grow following an introduction order. Contexts are then ordered sets, thus they can be seen as lists.

We say that a typing context ∆ is well-formed if it satisĄes the following property.

When a formula x ∈ k(s 1 , . . . , s n ) is added, then it must not be already declared in ∆, and all s 1 , . . . , s n have to be already declared in ∆ Ű in particular because of rules T9 and T13 Ű, as a given set or in a formula like s i ∈ P(k(t 1 , . . . , t n )) such that the context ∆ at this time is well-formed.

Annotated Typing Contexts

The annotation procedure transforms all the leaf typing contexts ∆, i.e. the typing contexts of the leaves of a typing derivation that follows the rules of Fig. 1.10, into annotated typing contexts ∆ ⋆ , where all variables and given sets are annotated with their type. Then it uses these annotated typing contexts to rebuild the typing tree by applying the same typing derivation but in a forward way, allowing us to obtain the annotated initial formula at the end.

Here is the syntax of the annotated typing contexts ∆ ⋆ : ) is k(T 1 , . . . , T n ). Also, the identiĄers used in types T 1 , . . . , T n are only given sets.

∆ ⋆ ::= ∅ (empty context) ♣ ∆ ⋆ , gi(s P(s) ) (annotated given set) ♣ ∆ ⋆ , x k(T 1 ,...,

Annotation Procedure

We can now introduce the annotation procedure:

1. For all the leaf typing contexts ∆:

1.1. For all gi(s), we annotate s by its type P(s), and then substitute all occurrences of s in ∆ by s P(s) ; 1.2. Following the introduction order in ∆, for all x ∈ k(s

P(T 1 ) 1 , . . . , s P(Tn) n
), we annotate x with its type k(T 1 , . . . , T n ), and we substitute all occurrences of x in ∆ by x k(T 1 ,...,Tn) ; 2. Rebuild the (annotated) initial formula by applying the type-checking tree in a forward way, i.e. from the leaves to the root.

We deĄne inductively the relation which associates respectively to an expression E and a formula P , the expression E ⋆ and formula P ⋆ where all variables are annotated. We have, for instance (P 1 ∧ P 2 ) ⋆ = P ⋆ 1 ∧ P ⋆ 2 , P(s) ⋆ = P(s ⋆ ) and x ⋆ = x T where T is the type of x.

Proposition 2.2.1 (Conservativity of the Annotation Procedure)

The annotation procedure preserves well-typedness.

We have, for any two expressions A and B and any formula P :

1. If ∆ ⊢ tc A ≡ B, then ∆ ⋆ ⊢ tc A ⋆ ≡ B ⋆ . 2. If ∆ ⊢ tc ch(P ), then ∆ ⋆ ⊢ tc ch(P ⋆ ).

Proof

This property is correct because the annotation procedure does not change the structure of formulae or the type of expressions. Thus, we can apply the same typing derivation on type-checking sequents where expressions have annotated variables.

Item 1. If ∆ ⊢ tc A ≡ B, then there exists a typing derivation Π such that:

Π ∆ ⊢ tc A ≡ B
We prove by induction on the structure of Π that there exists a typing derivation Π ⋆ , which is exactly the same derivation than Π where all expressions have annotated variables.

The base case is when Π is an application of rule T21.

Π := gi(s) Ű ❁ ∆ T21 ∆ ⊢ tc s ≡ s
Then, we obtain the following typing tree:

Π ⋆ := gi(s P(s) ) Ű ❁ ∆ ⋆ T21 ∆ ⋆ ⊢ tc s P(s) ≡ s P(s)
The generalization deals with rules T9 to T20. We present the case of rule T9.

Π := x ∈ s Ű ❁ ∆ Π ′ ∆ ⊢ tc su(s) ≡ U T9 ∆ ⊢ tc ty(x) ≡ U
Then, we obtain the following typing tree:

Π ⋆ := x T ∈ s ⋆ Ű ❁ ∆ ⋆ IH Π ′ ⋆ ∆ ⋆ ⊢ tc su(s ⋆ ) ≡ U ⋆ T9 ∆ ⋆ ⊢ tc ty(x T ) ≡ U ⋆
Item 2. The proof of the second property follows exactly the proof of item 1. The base cases are now rules T7 and T8, where premises use results of item 1. The generalization deals with rules T1 to T6. We do not present the proof which is straightforward.

Proposition 2.2.2 (Soundness of the Annotation Procedure)

The annotation is sound, in the sense that we annotate variables with their very type. We have, for a variable x:

If x T is declared in ∆ ⋆ , then ∆ ⋆ ⊢ tc ty(x T ) ≡ T ⋆ .

Proof

We perform a proof by induction on the structure of ∆. We give in 1. the base case for given sets, then we present in 2. the particular case where the variable is a set typed using only given sets, and Ąnally in 3. the general case for all kind of variables.

1. If x is a given set, we denote it by s, and it is then declared in ∆ ⋆ with gi(s P(s) ). We obtain the following derivation:

T21 ∆ ⋆ ⊢ tc s P(s) ≡ s P(s) T17 ∆ ⋆ ⊢ tc su(s P(s) ) ≡ s P(s)

T19

∆ ⋆ ⊢ tc P(su(s P(s) )) ≡ P(s P(s) ) T12 ∆ ⋆ ⊢ tc ty(s P(s) ) ≡ P(s P(s) ) 2. If x is a variable which is a set and typed only by given sets, we have:

x P(k(s 1 ,...,sn)) ∈ P(k(s

P(s 1 ) 1 , . . . , s P(sn) n )) Ű ❁ ∆ ⋆
Then, we obtain the following derivation: ))

T9

∆ ⋆ ⊢ tc ty(x P(k(s 1 ,...,sn)) ) ≡ P(k(s P(s 1 ) 1

, . . . , s

P(sn) n ))
where the decomposition of the sequent ∆ ⋆ ⊢ tc su(k(s

P(s 1 ) 1 , . . . , s P(sn) n )) ≡ k(s P(s 1 ) 1 , . . . , s P(sn) n ) into the n sequents ∆ ⋆ ⊢ tc su(s P(s i ) i ) ≡ s P(s i ) i
is performed by applying the chains T14 -T20 for ×, and T15 -T19 for P.

3. Now, we make the induction hypothesis that all the variables declared in ∆ ⋆ are well annotated, i.e. that we have, for all variables x i :

∆ ⋆ ⊢ tc ty(x T i i ) ≡ T ⋆ i
In particular, if a variable x i is a set, we denote it s i and we have:

∆ ⋆ ⊢ tc ty(s P(T i ) i ) ≡ P(T ⋆ i )
which reduces to:

∆ ⋆ ⊢ tc su(s

P(T i ) i ) ≡ T ⋆ i
because, by the deterministic nature of the type-checking procedure, we know that rules T12 and T19 have been applied.

Then, for the following well-formed context:

∆ ⋆ , x k(T 1 ,...,Tn) ∈ k(s

P(T 1 ) 1 , . . . , s P(Tn) n )
we obtain the derivation: IH ∆ ⋆ ⊢ tc su(s

P(T 1 ) 1 ) ≡ T ⋆ 1 . . . • • • IH ∆ ⋆ ⊢ tc su(s P(Tn) n ) ≡ T ⋆ n . . . ∆ ⋆ ⊢ tc su(k(s P(T 1 ) 1 , . . . , s P(Tn) n )) ≡ k(T ⋆ 1 , . . . , T ⋆ n ) T9 ∆ ⋆ ⊢ tc ty(x k(T 1 ,...,Tn) ) ≡ k(T ⋆ 1 , . . . , T ⋆ n ) Universal Closure
Once the annotation procedure is done, we take the universal closure of all free variables corresponding to given sets in axioms and hypotheses, and consider them as constants in goals.

In the following, the notation P ⋆ denotes the universal closure of the annotated formula.

Provability

The B proof system of Fig. 1.3 is neutral with respect to variable annotation, and it is always possible to apply the same proof derivation to an annotated formula. The provability of well-typed formulae is then preserved. We have:

Γ ⊢ B P if Γ ⋆ ⊢ B P ⋆
Example Going back to the running example of Sec. 1.3.5, we obtained the following environment ∆ ′ for the leave of the left branch:

∆ ′ := gi(s), gi(t), a ∈ P(s × t), b ∈ P(s × t), x ∈ a
It leads to the annotated environment ∆ ′ ⋆ , where only the Ąrst occurrence of a variable is annotated:

∆ ′ ⋆ := gi(s P(s) ), gi(t P(t) ), a P(s×t) ∈ P(s × t), b P(s×t) ∈ P(s × t), x s×t ∈ a
Finally, we obtain the annotated formula (P ex ) ⋆ :

∀(a P(s×t) , b P(s×t) ) • (a, b ∈ P(s P(s) × t P(t) ) × P(s × t) ⇒ ¶x s×t ♣ x ∈ a ∧ x ∈ b♢ ⊆ s × t)

Annotated Set Theory

Axioms SET5 and SET6 are introduced in the B Method set theory for theoretical reasons, like deĄning function evaluation and building natural numbers, and are never used in practice, in particular in proof obligations. So, we remove them from our work.

We now deĄne in Fig. 2.1 the annotated version of the axioms presented in Fig. 1.4. In addition, we take the universal closure for all free variables.

∀s P(u) • (∀t

P(v) • (∀x u • (∀y v • (x, y ∈ s × t ⇔ (x ∈ s ∧ y ∈ t))))) SET1 ⋆ ∀s P(u) • (∀t P(u) • (s ∈ P(t) ⇔ ∀x u • (x ∈ s ⇒ x ∈ t))) SET2 ⋆ ∀s P(u) • (∀y u • (y ∈ ¶x u ♣ x ∈ s ∧ P ♢ ⇔ (y ∈ s ∧ [x := y]P ))) SET3 ⋆ ∀s P(u) • (∀t P(u) • (∀x u • (x ∈ s ⇔ x ∈ t) ⇒ s = t)) SET4 ⋆

Dealing with Comprehension Sets

Comprehension sets are very useful to deĄne sets, in particular in the B Method, where many derived constructs use them. Unfortunately, comprehension sets cannot be directly embedded into Ąrst-order logic, due to the presence of a predicate symbol into it.

A Skolemization of Comprehension Sets

We propose an elimination procedure of comprehension sets inside formulae, based on the deĄnition of new function symbols. The idea to skolemize comprehension sets is not new, see for instance [START_REF] Dowek | Cut elimination for Zermelo set theory[END_REF][START_REF] Jacquel | Proof Automation for Atelier B Rules VeriĄcation. Theses, Conservatoire national des arts et metiers -CNAM[END_REF].

Given an annotated formula P ⋆ , if u is a subexpression of P ⋆ of the form:

u = ¶y T ♣ Q(y, s T 1 1 , . . . , s Tn n )♢
we apply the following procedure:

1. Generate a fresh function symbol f P(T ) of arity n and annotated by P(T );

2. Add to the B set theory, the axiom:

∀s ′ 1 T 1 • (. . . • (∀s ′ n Tn • (∀x T • (x ∈ f P(T ) (s ′ 1 , . . . , s ′ n ) ⇔ Q(x, s ′ 1 , . . . , s ′ n )))))
3. Replace all the occurrences of u by f P(T ) (s 1 , . . . , s n ).

The resulting skolemized formula is then denoted P ⋆s .

Lemma 2.3.1

Given a well-typed and annotated formula P ⋆ containing a subexpression u = ¶y T ♣ Q(y, s T 1 1 , . . . , s Tn n )♢, if we denote f the generated fresh function symbol, we can prove, in B:

f P(T ) (s T 1 1 , . . . , s Tn n ) = ¶y T ♣ Q(y, s T 1 1 , . . . , s Tn n )♢

Proof

In the following, we denote s 1 , . . . , s n the n sets s T 1 1 , . . . , s Tn n . Axiom SET3 ⋆ tells us that:

∀x T • (x ∈ ¶y T ♣ Q(y, s 1 , . . . , s n )♢ ⇔ [y := x]Q(y, s 1 , . . . , s n ))
We have:

∀x T • (x ∈ ¶y T ♣ Q(y, s 1 , . . . , s n )♢ ⇔ Q(x, s 1 , . . . , s n ))
In addition, we know that:

∀x T • (x ∈ f P(T ) (s 1 , . . . , s n ) ⇔ Q(x, s 1 , . . . , s n ))
We deduce that:

∀x T • (x ∈ f P(T ) (s 1 , . . . , s n ) ⇔ x ∈ ¶y T ♣ Q(y, s 1 , . . . , s n )♢)
Using axiom SET4 ⋆ , we obtain:

f P(T ) (s 1 , . . . , s n ) = ¶y T ♣ Q(y, s 1 , . . . , s n )♢ Proposition 2.3.2 (Soundness)
The skolemization procedure of comprehension sets is sound.

Given a well-typed and annotated formula P ⋆ and a set of well-typed and annotated formulae Γ ⋆ containing the axiom SET3 ⋆ , we have:

Γ ⋆s ⊢ B P ⋆s ⇒ Γ ⋆ ⊢ B P ⋆
where Γ ⋆s is the union of Γ ⋆ and all the axioms added by the skolemization procedure.

Proof

Let f 1 , . . . , f n be the n function symbols deĄned by the skolemization procedure.

If we denote Π s the proof: Π s Γ ⋆s ⊢ B P ⋆s we want to replace all applications of functions symbols in the proof Π s by the corresponding comprehension sets. This is done using rewriting.

First, we deĄne the rewrite system:

f 1 (x 1 1 , . . . , x 1 m 1 ) -→ ¶y ♣ Q 1 (y, x 1 1 , . . . , x 1 m 1 )♢ . . . f n (x n 1 , . . . , x n mn ) -→ ¶y ♣ Q n (y, x n 1 , . . . , x n mn )♢
This rewrite system is conĆuent because of the absence of critical pair Ű fresh head symbol and trivial pattern with only variables Ű and it is terminating for the strategy that applies rewrite rules following the reverse numerical order, from

f n to f 1 Ű since Q 1 , . . . , Q k do not contain f k , . . . , f n .
We prove by induction over the structure of Π s that there exists a proof Π such that:

Π Γ ⋆ ⊢ B P ⋆
where we have replaced all the applications of function symbols f i by the corresponding comprehension sets. The induction is straightforward because the B proof system presented in Fig. 1.3 is stable with respect to the conĆuent and terminating rewrite system deĄned above.

Remark Unfortunately, the skolemization of comprehension sets is not complete: it is no more possible to deĄne a new set by comprehension during proof search if we drop axiom SET3 ⋆ , only to deal with the ones at hand (the Skolem symbols).

Example Applying skolemization to the running example leads to add the following axiom to the theory:

∀a P(s×t) • (∀b P(s×t) • (∀x s×t • (x ∈ f P(s×t) (a, b) ⇔ x ∈ a ∧ x ∈ b)))
And we obtain the skolemized formula (P ex ) ⋆s :

∀(a P(s×t) , b P(s×t) ) • (a, b ∈ P(s P(s) × t P(t) ) × P(s × t) ⇒ f P(s×t) (a, b) ⊆ s × t)
Remark The skolemization of comprehension sets presented here is applied to annotated formulae, as for the elimination of skolem symbol in the proof above. The extension of both the skolemization and its elimination to non-annotated formulae is straightforward.

Updated Syntax and Proof System

To conclude this chapter, we present the new version of the B syntax in Fig. 2.2, with annotated variables, function symbols and without comprehension sets, choice function or BIG. In addition, we suppose that expressions are normalized in the sense that substitutions are reduced, as it is for proof obligations. We also merge the two categories for expressions and sets in a single category called E.

To lighten the B proofs in the next chapters, we introduce the new symbols ⊥ and ⊤ deĄned as follows:

⊥ := P ∧ ¬P ⊤ := ¬⊥
where P is a Ąxed closed formula.

Finally, we enrich the B proof system of Fig. 1.3 with the two derived basic rules BR5 and BR6 dealing with ⊥ and ⊤:

BR5 Γ, ⊥ ⊢ B Q := BR3 Γ, P ∧ ¬P, ¬Q ⊢ B P ∧ ¬P R2 Γ, P ∧ ¬P, ¬Q ⊢ B P BR3 Γ, P ∧ ¬P, ¬Q ⊢ B P ∧ ¬P R2 ′ Γ, P ∧ ¬P, ¬Q ⊢ B ¬P R5 Γ, P ∧ ¬P ⊢ B Q BR6 Γ ⊢ B ⊤ := BR5 Γ, ⊥ ⊢ B Q BR5 Γ, ⊥ ⊢ B ¬Q R6 Γ ⊢ B ¬⊥ T ::= identif ier (type identiĄer) ♣ T 1 × T 2 (product type) ♣ P(T ) (powerset type) P ::= ⊥ (false) ♣ ⊤ (true) ♣ P 1 ∧ P 2 (conjunction) ♣ P 1 ⇒ P 2 (implication) ♣ ¬P (negation) ♣ ∀x T • P (universal quantiĄcation) ♣ E 1 = E 2 (equality) ♣ E 1 ∈ E 2 (membership) E ::= x T (variable) ♣ E 1 , E 2 (ordered pair) ♣ E 1 × E 2 (product set) ♣ P(E) (powerset) ♣ f P(T ) (E 1 , . . . , E n ) (function symbol application) x ::= identif ier (variable identiĄer) ♣ x 1 , x 2 (list of variables) Figure 2.2: ModiĄed B Method Syntax
Chapter 3

Polymorphically Typed Sequent Calculus

This chapter presents a typed sequent calculus called LLproof and polymorphically typed Ąrst-order logic, denoted by Poly-FOL, and used by LLproof.

In Sec. 3.2, we introduce the syntax and the type system of Poly-FOL. This section is In Sec. 3.3, we present the typed sequent calculus LLproof. This proof system is an extension to Poly-FOL of the initial LLproof proof system of the automated theorem prover

Zenon, as presented in [START_REF] Bonichon | Zenon: An Extensible Automated Theorem Prover Producing Checkable Proofs[END_REF]. This contribution is a collaborative work and it has been published in [START_REF] Cauderlier | Checking Zenon Modulo Proofs in Dedukti[END_REF].

First-Order Logic and Types

Reasoning with several theories together may sometimes be necessary. For instance, in the B Method, proof obligations often combine set theory, booleans and arithmetic. Then, some theory-speciĄc axioms can be deĄned; for instance, a legitimate axiom about booleans could be:

∀x. x = true ∨ x = false
Instantiating this axiom with a term that is not of type bool leads to an unsound formula. To prevent this issue, a solution is to provide type information to terms. For instance, we can change the previous axiom by the following one:

∀x : bool. x = true ∨ x = false
where the notation x : bool means that x is of type bool.

This kind of logic is usually called a monomorphic and many-sorted logic. In this logic, we deal with a Ąnite set of sorts, like bool or int, and all terms are typed.

In set theory, we usually want to deĄne some generic axioms, in the sense that we can instantiate them with diferent types. For instance, we could deĄne membership to the union of two sets as follows:

∀s : set(α). ∀t : set(α). ∀x : α. x ∈ s ∪ t ⇔ x ∈ s ∨ x ∈ t
where α is a type variable, set a type constructor, and s : set(α) means that s is a set of objects of type α. We call this logic a polymorphic logic.

In the following, we denote polymorphic Ąrst-order logic by Poly-FOL, monomorphic/manysorted Ąrst-order logic by Sorted-FOL, and untyped Ąrst-order logic by FOL (also called monomorphic/mono-sorted Ąrst-order logic sometimes).

Poly-FOL: Polymorphic First-Order Logic

In this section, we present Poly-FOL. This presentation is inspired by [START_REF] Christian Blanchette | Encoding Monomorphic and Polymorphic Types[END_REF][START_REF] Blanchette | TFF1: The TPTP Typed First-Order Form with Rank-1 Polymorphism[END_REF].

Syntax

Poly-FOL Signature

We start by Ąxing a countably inĄnite set A of type variables, usually denoted by α, and a countably inĄnite set V of term variables , usually denoted by x.

We call a Poly-FOL signature a triple Σ = (T , F, P), where:

• T is a countable set of type constructors T with their arity m, denoted by T :: m

• F is a countable set of function symbols f with their type signature σ, denoted by f : σ

• P is a countable set of predicate symbol P with their type signature σ, denoted by P : σ

Type

The set T ype Σ is the set of types τ in signature Σ, built inductively with type variables α from A and type constructors T from T . We deĄne Type, which is meant to be the type of the elements of T ype Σ . We suppose that all types in T ype Σ are inhabited. By convention, nullary type constructors are called type constants, or sorts. We say that a type is polymorphic if it contains type variables; and monomorphic or ground otherwise.

τ ::= α (type variable) ♣ T (τ 1 , . . . , τ m )
(type constructor application)

Type Signature

Type signatures σ of function and predicate symbols are type schemes, using type quan-tiĄcation Π over a list of type variables α 1 . . . α m Ű sometimes denoted by ⃗ α when m is known from the context Ű and a list of types τ 1 × . . . × τ n Ű sometimes denoted by ⃗ τ Ű, and returning a type τ for function symbol and the pseudo-type omicron, denoted by o, for predicate symbols. Omicron is a pseudo-type because we do not want to instantiate type variables with it. In the following, we do not allow the overloading of diferent arities for function and predicate symbols. In addition, we may sometimes omit type arguments ⃗ α to function and predicate symbols when it is clear from context.

σ ::= Πα 1 . . . α m . τ 1 × . . . × τ n → τ (function type signature) ♣ Πα 1 . . . α m . τ 1 × . . . × τ n → o (predicate type signature)

Term

A term t can be a (term) variable x from V or the application of a function symbol f from F to m type arguments and n term arguments at once. To help reading formulae, we use a semicolon to separate type and term arguments in function and predicate symbols.

t ::= x (variable) ♣ f (τ 1 , . . . , τ m ; t 1 , . . . , t n ) (function application)

Formula

A formula φ can be built from ⊤ and ⊥, an equality between two terms t 1 and t 2 having the same type τ , or the application of a predicate symbol P to m type arguments and n term arguments. It can also be built inductively by the logical connectives for negation ¬, conjunction ∧, disjunction ∨, implication ⇒ and equivalence ⇔. Finally, a formula can be built using universal quantiĄcation ∀ and existential quantiĄcation ∃ over term variables.

By convention and without loss of generality, we assume that (type and term) variables are bound only once in a formula.

φ ::= ⊤ ♣ ⊥ (true, false) ♣ t 1 = τ t 2 (term equality) ♣ P (τ 1 , . . . , τ m ; t 1 , . . . , t n ) (predicate application) ♣ ¬φ (negation) ♣ φ 1 ∧ φ 2 (conjunction) ♣ φ 1 ∨ φ 2 (disjunction) ♣ φ 1 ⇒ φ 2 (implication) ♣ φ 1 ⇔ φ 2 (equivalence) ♣ ∃x : τ. φ (existential quantiĄcation) ♣ ∀x : τ. φ (universal quantiĄcation)

Type-Quantified Formula

A type-quantiĄed formula φ T is built using universal quantiĄcation over type variables.

φ T ::= φ (formula) ♣ ∀α. φ T (type quantiĄcation)
It should be noted that this inductive presentation guarantees that quantiĄcation over type variables is always universal and at the top of the formula. Thus, we say that type quantiĄcation is prenex. In the following, we may sometimes call formula both formulae and type-quantiĄed formulae, when it is clear from the context. In addition, we call expression, denoted by e, both terms and formulae.

Local Context

We also deĄne the notion of local context Γ L , which is a set of pairs made of a type variable α and its type Type, denoted by α : Type, or a (term) variable x and its type τ , denoted by

x : τ . Γ L ::= ∅ (empty context) ♣ Γ L , α : Type (type variable declaration) ♣ Γ L , x : τ (term variable declaration)

Global Context

Finally, a global context Γ G is a set containing the declarations of type constructors T with their arity m and function and predicate symbols f and P with their type signatures σ.

Γ G ::= ∅ (empty context) ♣ Γ G , T :: m (type constructor declaration) ♣ Γ G , f : σ (function declaration) ♣ Γ G , P : σ (predicate declaration)
Remark In the following, we sometimes denote by Γ the pair of contexts Γ G ; Γ L . In addition, if f is either a function symbol or a predicate symbol, Γ, f :

σ denotes Γ G , f : σ; Γ L .
Finally, Γ, α : Type and Γ, x : τ denote Γ G ; Γ L , α : Type and Γ G ; Γ L , x : τ respectively.

In addition, if x is either a type or a term variable, we denote by x ∈ Γ L (respectively

x ̸ ∈ Γ L ) the fact that the variable x is declared in Γ L (respectively not declared). This notation is extended to global contexts Γ G with type constructors T , function symbols f and predicate symbols P .

Example

To illustrate this presentation of Poly-FOL, we introduce a global context Γ G made of a nullary type constructor T , a unary type constructor set, a function symbol for powerset P, a predicate symbol for membership ∈ and a constant u. In addition, we deĄne a polymorphic formula φ ax which is an axiom deĄning membership to the powerset and a monomorphic formula φ gl which can be seen as a goal.

Γ G :=              T :: 0 set :: 1 P : Πα. set(α) → set(set(α)) ∈ : Πα. α × set(α) → o u : set(T ) φ ax := ∀α. ∀s : set(α), t : set(α). ∈ (set(α); s, P(α; t)) ⇔ (∀x : α. ∈ (α; x, s) ⇒ ∈ (α; x, t)) φ gl := ∈ (set(T ); u, P(T ; u))
Later in this manuscript, we will often use an inĄx notation with subscript type parameters when dealing with standard symbols, like the predicate symbol ∈ or the function symbol P.

The presentation of the previous example shall then be:

Γ G :=              T :: 0 set :: 1 P(-) : Πα. set(α) → set(set(α)) -∈ -: Πα. α × set(α) → o u : set(T ) φ ax := ∀α. ∀s, t : set(α). s ∈ set(α) P α (t) ⇔ (∀x : α. x ∈ α s ⇒ x ∈ α t) φ gl := u ∈ set(T ) P T (u)

Typing System

Free Variable

We denote by FV T (e) the set of type variables occurring freely in an expression e, either in type arguments of polymorphic symbols or in the types of variables. We denote by FV(e) the set of term variables occurring freely in an expression e.

Monomorphic/Polymorphic Formula

A formula φ is said to be monomorphic if it is not a type-quantiĄed formula and if FV T (φ) is empty. Otherwise, the formula is said to be polymorphic. A formula φ is said to be closed if both FV T (φ) and FV(φ) are empty.

Type Substitution

We call type substitution a mapping ρ := [α 1 /τ 1 , . . . , α m /τ m ] that associates type variables α 1 , . . . , α m with types τ 1 , . . . , τ m .

We deĄne the predicate symbol wf(Γ G ; Γ L ) meaning that the context Γ := Γ G ; Γ L is well-formed.

A typing judgment Γ ⊢ t : τ means that the term t is well-typed of type τ in the well-formed context Γ.

A typing judgment Γ ⊢ φ : o means that the formula φ is well-typed in the well-formed context Γ.

We present in Fig. 3.1 the inference rules for well-formedness of contexts, and in Fig. 3.2 the inference rules of the type system of Poly-FOL. In addition, in rules of Fig. 3.2 dealing with term variables like Var or ∀, we do not impose to verify that τ is a type in x : τ since this is guaranteed by rule WF 2 .

WF 1 wf(∅; ∅) x ̸ ∈ Γ L Γ G ; Γ L ⊢ τ : Type WF 2 wf(Γ G ; Γ L , x : τ ) α ̸ ∈ Γ L wf(Γ G ; Γ L ) WF 3 wf(Γ G ; Γ L , α : Type) T ̸ ∈ Γ G wf(Γ G ; ∅) WF 4 wf(Γ G , T :: m; ∅) f ̸ ∈ Γ G Γ G ; α 1 : Type, . . . , α m : Type ⊢ τ i : Type, i = 1 . . . n Γ G ; α 1 : Type, . . . , α m : Type ⊢ τ : Type WF 5 wf(Γ G , f : Πα 1 . . . α m . τ 1 × . . . × τ n → τ ; ∅) P ̸ ∈ Γ G Γ G ; α 1 : Type, . . . , α m : Type ⊢ τ i : Type, i = 1 . . . n WF 6 wf(Γ G , P : Πα 1 . . . α m . τ 1 × . . . × τ n → o; ∅)

Lemma 3.2.1 (Unicity of Typing)

Given a well-formed context Γ, for all typable terms t, there exists only one type τ such that:

Γ ⊢ t : τ
Proof By induction on the typing relation.

If t is a variable, it is true thanks to rules Var and WF 2 .

If t is the application of a function symbol f (τ ′ 1 , . . . , τ ′ m ; t 1 , . . . , t n ), by the rule Fun, t 1 , . . . , t n are well typed, and by induction hypothesis, each t 1 , . . . , t n has a unique type. If we have

f : Πα 1 . . . α m . τ 1 × . . . × τ n → τ ′ , then, τ = τ ′ ρ where ρ = [α 1 /τ ′ 1 , . . . , α m /τ ′ m ], thus τ is unique.
Example We want to verify that the formula φ gl introduced in the previous example is well-typed.

α : Type ∈ Γ TVar Γ ⊢ α : Type x : τ ∈ Γ Var Γ ⊢ x : τ T :: m ∈ Γ Γ ⊢ τ i : Type, i = 1 . . . m TConstr Γ ⊢ T (τ 1 , . . . , τ m ) : Type f : Πα 1 . . . α m .τ 1 × . . . × τ n → τ ∈ Γ ρ = [α 1 /τ ′ 1 , . . . , α m /τ ′ m ] Γ ⊢ τ ′ i : Type, i = 1 . . . m Γ ⊢ t i : τ i ρ, i = 1 . . . n Fun Γ ⊢ f (τ ′ 1 , . . . , τ ′ m ; t 1 , . . . , t n ) : τ ρ
Remark We say that Poly-FOL uses an explicit typing syntax in the sense that we provide to function and predicate symbols their type parameters.

This logic is a simpliĄed version of ML-polymorphism, which is known to have a decidable type inference [START_REF] Strachey | Fundamental Concepts in Programming Languages[END_REF]]. So, we could have chosen to use an implicit typing syntax, i.e. without type parameters.

LLproof: A Typed Sequent Calculus

We present in Fig. 3.3 and Fig. 3.4 the typed sequent calculus LLproof used by the automated theorem prover Zenon to output proofs. This proof system is an extension to polymorphic types of the initial sequent calculus LLproof of Zenon presented in [START_REF] Bonichon | Zenon: An Extensible Automated Theorem Prover Producing Checkable Proofs[END_REF].

A Tableau-Like Proof System

This sequent calculus is close to a Tableau method: all formulae are on the left-hand side of the sequent and we are looking for a contradiction, given the negation of the goal as an hypothesis along with the regular hypotheses. In addition, we always keep the main formula as an hypothesis for each rule, therefore leading to a growing context Γ, and removing the need for an explicit contraction rule.

Dealing With Special Rules

In Fig. 3.4, we deĄne only one special rule called Subst, unlike the initial presentation of LLproof in [START_REF] Bonichon | Zenon: An Extensible Automated Theorem Prover Producing Checkable Proofs[END_REF], where there were Ąve distinct rules.

It should be noted that the three rules called Def, Ext and Lemma in [START_REF] Bonichon | Zenon: An Extensible Automated Theorem Prover Producing Checkable Proofs[END_REF] are not necessary for our work.

The following two rules called Pred and Fun in [START_REF] Bonichon | Zenon: An Extensible Automated Theorem Prover Producing Checkable Proofs[END_REF] are admissible from Subst. These rules allow us to identify subterms of predicate and function symbols if their type parameters are equal.

∆, t 1 ̸ = τ ′ 1 u 1 ⊢ ⊥ • • • ∆, t n ̸ = τ ′ n u n ⊢ ⊥ Pred Γ, P (τ 1 , . . . , τ m ; t 1 , . . . , t n ), ¬P (τ 1 , . . . , τ m ; u 1 , . . . , u n ) ⊢ ⊥ Closure and QuantiĄer-free Rules ⊥ Γ, ⊥ ⊢ ⊥ ¬⊤ Γ, ¬⊤ ⊢ ⊥ Ax Γ, P, ¬P ⊢ ⊥ ̸ = Γ, t ̸ = τ t ⊢ ⊥ Sym Γ, t = τ u, u ̸ = τ t ⊢ ⊥ Γ, P ⊢ ⊥ Γ, ¬P ⊢ ⊥ Cut Γ ⊢ ⊥ Γ, ¬¬P, P ⊢ ⊥ ¬¬ Γ, ¬¬P ⊢ ⊥ Γ, P ∧ Q, P, Q ⊢ ⊥ ∧ Γ, P ∧ Q ⊢ ⊥ Γ, ¬(P ∧ Q), ¬P ⊢ ⊥ Γ, ¬(P ∧ Q), ¬Q ⊢ ⊥ ¬∧ Γ, ¬(P ∧ Q) ⊢ ⊥ Γ, P ∨ Q, P ⊢ ⊥ Γ, P ∨ Q, Q ⊢ ⊥ ∨ Γ, P ∨ Q ⊢ ⊥ Γ, ¬(P ∨ Q), ¬P, ¬Q ⊢ ⊥ ¬∨ Γ, ¬(P ∨ Q) ⊢ ⊥ Γ, P ⇒ Q, ¬P ⊢ ⊥ Γ, P ⇒ Q, Q ⊢ ⊥ ⇒ Γ, P ⇒ Q ⊢ ⊥ Γ, ¬(P ⇒ Q), P, ¬Q ⊢ ⊥ ¬ ⇒ Γ, ¬(P ⇒ Q) ⊢ ⊥ Γ, P ⇔ Q, ¬P, ¬Q ⊢ ⊥ Γ, P ⇔ Q, P, Q ⊢ ⊥ ⇔ Γ, P ⇔ Q ⊢ ⊥ Γ, ¬(P ⇔ Q), ¬P, Q ⊢ ⊥ Γ, ¬(P ⇔ Q), P, ¬Q ⊢ ⊥ ¬ ⇔ Γ, ¬(P ⇔ Q) ⊢ ⊥ Figure 3.3: LLproof Inference Rules of Zenon (Part 1) where ∆ := Γ ∪ P (τ 1 , . . . , τ m ; t 1 , . . . , t n ), ¬P (τ 1 , . . . , τ m ; u 1 , . . . , u n ) ∆, t 1 ̸ = τ ′ 1 u 1 ⊢ ⊥ • • • ∆, t n ̸ = τ ′ n u n ⊢ ⊥ Fun Γ, f (τ 1 , . . . , τ m ; t 1 , . . . , t n ) ̸ = τ f (τ 1 , . . . , τ m ; u 1 , . . . , u n ) ⊢ ⊥ where ∆ := Γ ∪ f (τ 1 , . . . , τ m ; t 1 , . . . , t n ) ̸ = τ f (τ 1 , . . . , τ m ; u 1 , . . . , u n )
In the following, we give the derivation of an application of the inference rule Pred QuantiĄer Rules Γ, ∀α. P (α),

P (τ ) ⊢ ⊥ ∀ type Γ, ∀α. P (α) ⊢ ⊥
where τ is any ground type Γ, ∃x : τ. P (x),

P (c) ⊢ ⊥ ∃ Γ, ∃x : τ. P (x) ⊢ ⊥ Γ, ¬∀x : τ. P (x), ¬P (c) ⊢ ⊥ ¬∀ Γ, ¬∀x : τ. P (x) ⊢ ⊥ where c : τ is a fresh constant Γ, ∀x : τ. P (x), P (t) ⊢ ⊥ ∀ Γ, ∀x : τ. P (x) ⊢ ⊥ Γ, ¬∃x : τ. P (x), ¬P (t) ⊢ ⊥ ¬∃ Γ, ¬∃x : τ. P (x) ⊢ ⊥ where t : τ is any ground term Special Rule Γ, P (t), t ̸ = τ u ⊢ ⊥ Γ, P (t), P (u) ⊢ ⊥ Subst Γ, P (t) ⊢ ⊥ Figure 3.4: LLproof Inference Rules of Zenon (Part 2)
using n applications of the rule Subst. To lighten the presentation, we do not repeat the contexts.

Π 1 t 1 ̸ = τ ′ 1 u 1 ⊢ ⊥ Π 2 t 2 ̸ = τ ′ 2 u 2 ⊢ ⊥ • • • Π n t n ̸ = τ ′ n u n ⊢ ⊥ Pred P (τ 1 , . . . , τ m ; t 1 , t 2 , . . . , t n ), ¬P (τ 1 , . . . , τ m ; u 1 , u 2 , . . . , u n ) ⊢ ⊥ := Π 1 t 1 ̸ = τ ′ 1 u 1 ⊢ ⊥ Π 2 t 2 ̸ = τ ′ 2 u 2 ⊢ ⊥ Π n t n ̸ = τ ′ n u n ⊢ ⊥ Ax P (τ 1 , . . . , τ m ; u 1 , u 2 , . . . , u n ) ⊢ ⊥ Subst P (τ 1 , . . . , τ m ; u 1 , u 2 , . . . , u n-1 , t n ) ⊢ ⊥ . . . P (τ 1 , . . . , τ m ; u 1 , u 2 , . . . , t n ) ⊢ ⊥ Subst P (τ 1 , . . . , τ m ; u 1 , t 2 , . . . , t n ) ⊢ ⊥ Subst P (τ 1 , . . . , τ m ; t 1 , t 2 , . . . , t n ), ¬P (τ 1 , . . . , τ m ; u 1 , u 2 , . . . , u n ) ⊢ ⊥
The case of the rule Fun is also straightforward. Here is the derivation for an application of the rule Fun:

Π 1 t 1 ̸ = τ ′ 1 u 1 ⊢ ⊥ • • • Π n t n ̸ = τ ′ n u n ⊢ ⊥ Fun f (τ 1 , . . . , τ m ; t 1 , t 2 , . . . , t n ) ̸ = τ f (τ 1 , . . . , τ m ; u 1 , u 2 , . . . , u n ) ⊢ ⊥ := Π 1 t 1 ̸ = τ ′ 1 u 1 ⊢ ⊥ Π n t n ̸ = τ ′ n u n ⊢ ⊥ ̸ = f (τ 1 , . . . , τ m ; u 1 , . . . , u n ) ̸ = f (τ 1 , . . . , τ m ; u 1 , . . . , u n ) ⊢ ⊥ . . . Subst f (τ 1 , . . . , τ m ; u 1 , . . . , t n ) ̸ = τ f (τ 1 , . . . , τ m ; u 1 , . . . , u n ) ⊢ ⊥ Subst f (τ 1 , . . . , τ m ; t 1 , . . . , t n ) ̸ = τ f (τ 1 , . . . , τ m ; u 1 , . . . , u n ) ⊢ ⊥

Admissibility of Rules Dealing with ∨, ⇔ and ∃

In the B Method, logical connectives ∨ and ⇔, and existential quantiĄcation ∃ are derived from other symbols (see Sec. 1.2.1):

P ∨ Q := ¬P ⇒ Q P ⇔ Q := (P ⇒ Q) ∧ (Q ⇒ P ) ∃x • P := ¬∀x • ¬P
Thus, in Sec. 4.2.2, we consider LLproof rules except ∨, ¬∨, ⇔, ¬ ⇔, ∃ and ¬∃, and we show the admissibility of these rules here. It should be noted that B goals and formulae will never contains such connectives/quantiĄers. In the following, we omit to repeat the contexts.

Inference Rules ∨ and ¬∨

For the disjunction, we have P ∨ Q := ¬P ⇒ Q. We obtain the following derivations:

P ⊢ ⊥ ¬¬ ¬¬P ⊢ ⊥ Q ⊢ ⊥ ⇒ ¬P ⇒ Q ⊢ ⊥ ¬P, ¬Q ⊢ ⊥ ¬ ⇒ ¬(¬P ⇒ Q) ⊢ ⊥

Inference Rules ⇔ and ¬ ⇔

For the equivalence, we have P ⇔ Q := (P ⇒ Q) ∧ (Q ⇒ P ). We obtain the following derivations:

¬P, ¬Q ⊢ ⊥ Ax ¬P, P ⊢ ⊥ ⇒ ¬P, Q ⇒ P ⊢ ⊥ Ax Q, ¬Q ⊢ ⊥ Q, P ⊢ ⊥ ⇒ Q, Q ⇒ P ⊢ ⊥ ⇒ P ⇒ Q, Q ⇒ P ⊢ ⊥ ∧ (P ⇒ Q) ∧ (Q ⇒ P ) ⊢ ⊥ P, ¬Q ⊢ ⊥ ¬ ⇒ ¬(P ⇒ Q) ⊢ ⊥ Q, ¬P ⊢ ⊥ ¬ ⇒ ¬(Q ⇒ P ) ⊢ ⊥ ¬∧ ¬((P ⇒ Q) ∧ (Q ⇒ P )) ⊢ ⊥

Inference Rules ∃ and ¬∃

For the existential quantiĄcation, we have ∃x. P := ¬∀x. ¬P . We obtain the following derivations:

P (c) ⊢ ⊥ ¬¬ ¬¬P (c) ⊢ ⊥ ¬∀ ¬∀x : τ. ¬P (x) ⊢ ⊥ ¬P (t) ⊢ ⊥ ∀ ∀x : τ. ¬P (x) ⊢ ⊥ ¬¬ ¬¬∀x : τ. ¬P (x) ⊢ ⊥ Chapter 4

Proving in B through Sequent Calculus

This chapter shows how to use the typed sequent calculus LLproof to prove B formulae. This is done using an encoding of B formulae into Poly-FOL, followed by a mere syntactic translation of LLproof proofs into B Natural Deduction proofs. This chapter is a personal contribution and it has been published in [START_REF] Halmagrand | Soundly Proving B Method Formulae Using Typed Sequent Calculus[END_REF]].

Translating B Formulae into Poly-FOL

This section presents the encoding of B Method formulae into Poly-FOL. We Ąrst give in Sec. 4.1.1 the type signatures of the primitive constructs, followed in Sec. 4.1.2 by the general encoding function.

Type Signatures of Primitive Constructs

We start by deĄning a general skeleton for the type signatures of the B basic constructs.

We introduce two type constructors set and tup corresponding respectively to the B type constructors P and ×. Then, we deĄne the function symbols (-, -) for ordered pairs, P(-) for powersets and -× -for product sets. Finally, we deĄne a predicate symbol for membership.

For easier reading, we use an inĄx notation with subscript type arguments (see Ex. 3.2.1).

T ske :=                  set :: 1 tup :: 2 (-, -) : Πα 1 α 2 . α 1 × α 2 → tup(α 1 , α 2 ) P(-) : Πα. set(α) → set(set(α)) -× -: Πα 1 α 2 . set(α 1 ) × set(α 2 ) → set(tup(α 1 , α 2 )) -∈ -: Πα. α × set(α) → o

Encoding of B Formulae into Poly-FOL

In the following, P , E and T denote respectively a B formula, a B expression and a B type. In addition, we suppose that formulae are well-typed and that the annotation procedure of Sec. 2.2 and the skolemization of Sec. 2.3 have been applied successfully.

We present in Fig. 4.1 the encoding functions ⟨P ⟩ f , ⟨E⟩ e and ⟨T ⟩ t which translate respectively B formulae, expressions and types into Poly-FOL formulae, terms and types.

In addition, we deĄne a function θ which returns the Poly-FOL type of a B expression.

The roles of ∆ and Ω in Fig. 4.1 are detailed in Sec. 4.1.2.1.

Target Theory

During the translation of a set of B formulae, we carry a target Poly-FOL theory T containing the skeleton T ske deĄned in Sec. 4.1.1, and previously translated formulae. In addition, we increase it by new type constructors when translating new type identiĄers in a goal, and new type signatures in two cases, when translating a symbol that is not declared in the local context ∆ of bound variables Ű then it is a constant (a given set) Ű, and when translating a function symbol. Also, for each formula to be translated, we carry a set Ω for type variables and type constructors (see Sec. 4.1.2.2), and a Poly-FOL local context ∆ of bound variables and their type.

Once a B formula P is translated, we take the universal closure of the translation of P with respect to the type variables of Ω, denoted ⟨P ⟩:

⟨P ⟩ := ∀ α∈Ω ⃗ α. ⟨P ⟩ f θ(E) ∆ = match E with ♣ x T → ∆(x) ♣ E 1 , E 2 → tup(θ(E 1 ) ∆ , θ(E 2 ) ∆ ) ♣ E 1 × E 2 → set(tup(θ(E 1 ) ∆ , θ(E 2 ) ∆ )) ♣ P(E) → set(θ(E) ∆ ) ♣ f T (. . .) → ⟨T ⟩ t ⟨T ⟩ t = match T with ♣ id when f lag = ax → if id ̸ ∈ Ω then Ω := Ω, (id, α) return Ω(id) ♣ id when f lag = gl → if id ̸ ∈ Ω then T := T , T :: 0; Ω := Ω, (id, T ) return Ω(id) ♣ T 1 × T 2 → tup(⟨T 1 ⟩ t , ⟨T 2 ⟩ t ) ♣ P(T ) → set(⟨T ⟩ t ) ⟨E⟩ ∆ e = match E with ♣ x T → if x ̸ ∈ ∆ then T := T , x : ⟨T ⟩ t return x ♣ E 1 , E 2 → (⟨E 1 ⟩ ∆ e , ⟨E 2 ⟩ ∆ e )  τ 1 ,  τ 2 ♣ E 1 × E 2 → ⟨E 1 ⟩ ∆ e ×  τ 1 ,  τ 2 ⟨E 2 ⟩ ∆ e ♣ P(E) → P  τ (⟨E⟩ ∆ e ) ♣ f T (E 1 , . . . , E n ) → if f : Πα 1 . . . α m . τ 1 × . . . × τ n → τ ̸ ∈ T then T := T , f : Sig(f T (E 1 , . . . , E n )) return f (  τ ′ 1 , . . . ,  τ ′ m ; ⟨E 1 ⟩ ∆ e , . . . , ⟨E n ⟩ ∆ e ) ⟨P ⟩ ∆ f = match P with ♣ ⊥ → ⊥ ♣ ⊤ → ⊤ ♣ P 1 ∧ P 2 → ⟨P 1 ⟩ ∆ f ∧ ⟨P 2 ⟩ ∆ f ♣ P 1 ⇒ P 2 → ⟨P 1 ⟩ ∆ f ⇒ ⟨P 2 ⟩ ∆ f ♣ ¬P → ¬ ⟨P ⟩ ∆ f ♣ ∀x T • P → ∀x : ⟨T ⟩ t . ⟨P ⟩ ∆,x:⟨T ⟩ t f ♣ ∀(x T 1 1 , x T 2 2 ) • P → ∀x 1 : ⟨T 1 ⟩ t .∀x 2 : ⟨T 2 ⟩ t . ⟨P ⟩ ∆,x 1 :⟨T 1 ⟩ t ,x 2 :⟨T 2 ⟩ t f ♣ E 1 = E 2 → ⟨E 1 ⟩ ∆ e =  τ ⟨E 2 ⟩ ∆ e ♣ E 1 ∈ E 2 → ⟨E 1 ⟩ ∆ e ∈  τ ⟨E 2 ⟩ ∆ e

B Type Identifier Translation

One important point in this encoding is the interpretation given to B type identiĄers coming from the type annotation procedure (see Sec. 2.2).

When starting to translate a formula, we deĄne a set Ω that contains pairs of B identiĄer and Poly-FOL type variable or type constructor.

For axioms and hypotheses, we interpret B type identiĄers as type variables. For a new identiĄer id, we generate a fresh type variable symbol α and store the pair (id, α) into Ω.

Once the translation of an axiom is done, we take the universal closure with respect to all the type variables stored in Ω.

For B goals, i.e. formulae that we want to prove, B type identiĄers are interpreted as type constants, i.e. nullary type constructors. For a new identiĄer id, we generate a fresh type constructor symbol T and store the pair (id, T ) in Ω.

This allows us to get polymorphic axioms in Poly-FOL and a monomorphic manysorted goal. To achieve this, we add to all B formulae to translate a Ćag ax for axioms and hypotheses and gl for the goal.

Generation of Type Signature for Function Symbols

The skolemization of sets deĄned by comprehension presented in Sec. 2.3 generates new function symbols. In addition, it generates new axioms deĄning the membership to the set corresponding to (the application of) these function symbols.

We suppose that the translation of a set of formulae starts with these axioms. During the translation of these axioms, we have to add to the Poly-FOL theory the type signatures of the new function symbols. We deĄne a function called Sig(f (. . .)), where f is a B function symbol, that computes the type signature of f .

We extend the function FV(e), returning the free variables of an expression e, to a list of expressions e 1 , . . . , e n , denoted FV n 1 (e i ) and returning the union of all the sets of free variables.

Sig(f T (E 1 , . . . , E n )) = Π α∈FV n 1 (θ(E i )) ⃗ α. θ(E 1 ) × . . . × θ(E n ) → θ(T )

Type Parameters for Function and Predicate Symbols

When translating function and predicate symbols, like P, we have to Ąnd the proper type parameters for the corresponding Poly-FOL symbol. For instance, if we have to translate the B term P(a), where a is a variable declared in ∆ such that a : set(T ) for a type constant T , we want to Ąnd τ such that we obtain the Poly-FOL term P τ (a).

We know that the function θ will give us θ(a) ∆ = set(T ), and that we have P(-) :

Πα. set(α) → set(set(α)), leading to solve the equation set(α) = set(T ).
This is a standard syntactic uniĄcation problem that we have to perform each time we need to Ąnd the type parameters. When we translate a

B term f (E 1 , . . . , E n ) into a Poly-FOL term f (τ ′ 1 , . . . , τ ′ m ; ⟨E 1 ⟩ ∆ e , . . . , ⟨E n ⟩ ∆ e )
, where the Poly-FOL f is such that f : Πα 1 . . . α m . τ 1 × . . . × τ n → τ , we perform a syntactic uniĄcation to solve the system:

       θ(E 1 ) ∆ = τ 1 . . . θ(E n ) ∆ = τ n
in order to Ąnd the type parameters τ ′ 1 , . . . , τ ′ m .

In Fig. 4.1, we use the notation  τ to denote that the type τ has been found that way.

Example

We want to apply this encoding to the B formulae of the running example of Chap. 2.

We have a B theory made of the axioms SET1 ⋆ , SET2 ⋆ and SET4 ⋆ , the axiom coming from the skolemization and the goal (P ex ) ⋆s (see Ex. 2.3.1):

∀s P(u) • ∀t P(v) • ∀x u • ∀y v • (x, y ∈ s × t ⇔ (x ∈ s ∧ y ∈ t)) ∀s P(u) • ∀t P(u) • (s ∈ P(t) ⇔ ∀x u • (x ∈ s ⇒ x ∈ t)) ∀s P(u) • ∀t P(u) • (∀x u • (x ∈ s ⇔ x ∈ t) ⇒ s = t) ∀a P(s×t) • ∀b P(s×t) • ∀x s×t • (x ∈ f P(s×t) (a, b) ⇔ x ∈ a ∧ x ∈ b) ∀(a P(s×t) , b P(s×t) ) • (a, b ∈ P(s P(s) × t P(t) ) × P(s × t) ⇒ f P(s×t) (a, b) ⊆ s × t)
We Ąrst obtain the three set theory axioms ⟨SET1 ⋆ ⟩, ⟨SET2 ⋆ ⟩ and ⟨SET4 ⋆ ⟩:

∀α 1 , α 2 . ∀s : set(α 1 ), t : set(α 2 ), x : α 1 , y : α 2 . (x, y) α 1 ,α 2 ∈ tup(α 1 ,α 2 ) s × α 1 ,α 2 t ⇔ (x ∈ α 1 s ∧ y ∈ α 2 t) ∀α. ∀s : set(α), t : set(α). s ∈ set(α) P α (t) ⇔ (∀x : α. x ∈ α s ⇒ x ∈ α t) ∀α. ∀s : set(α), t : set(α). (∀x : α. x ∈ α s ⇔ x ∈ α t) ⇒ s = set(α) t
The remainder of the theory, i.e. the declaration of the two type constants T 1 and T 2 coming from the translation of the goal, the signatures of the two constants s and t (the given sets), the signature of f and the axiom deĄning f , is:

T 1 :: 0 T 2 :: 0 s : set(T 1 ) t : set(T 2 ) f : Πα 1 α 2 . set(tup(α 1 , α 2 )) × set(tup(α 1 , α 2 )) → set(tup(α 1 , α 2 )) ∀α 1 , α 2 . ∀a : set(tup(α 1 , α 2 )), b : set(tup(α 1 , α 2 )), x : tup(α 1 , α 2 ). x ∈ tup(α 1 ,α 2 ) f α 1 ,α 2 (a, b) ⇔ (x ∈ tup(α 1 ,α 2 ) a ∧ x ∈ tup(α 1 ,α 2 ) b)
Finally, the translation of the goal ⟨(P ex ) ⋆s ⟩ Ű we unfold the ⊆ deĄnition and remove the subscript type arguments of function and predicate symbols to lighten the formula Ű is:

∀a : set(tup(T 1 , T 2 )), b : set(tup(T 1 , T 2 )). (a, b) ∈ P(s × t) × P(s × t) ⇒ f (a, b) ∈ P(s × t)

Translation of LLproof Proofs into B Proofs

The last section of this chapter presents the translation of LLproof proofs into B Method Natural Deduction proofs. This translation of proofs relies on an encoding of Poly-FOL into B, restricted to monomorphic formulae.

Encoding of Poly-FOL into B

In the following, φ is a monomorphic Poly-FOL formula and t is a monomorphic Poly-FOL term. In Fig. 4.2, we present the two encoding functions ⟨φ⟩ -1 f and ⟨t⟩ -1 e which translate respectively monomorphic Poly-FOL formulae and terms into B formulae and terms.

Lemma 4.2.1

For any B expression E and any B formula P such that ⟨E ⋆s ⟩ e and ⟨P ⋆s ⟩ f are monomorphic, we can prove, in B:

⟨⟨E ⋆s ⟩ e ⟩ -1 e = E s ⟨⟨P ⋆s ⟩ f ⟩ -1 f ⇔ P s
where E s and P s correspond respectively to E ⋆s and P ⋆s where we erase type annotations on variables. This is in particular the case for B goals.

⟨t⟩ -1 e = match t with ♣ x → x ♣ (t 1 , t 2 ) τ 1 ,τ 2 → ⟨t 1 ⟩ -1 e , ⟨t 2 ⟩ -1 e ♣ t 1 × τ 1 ,τ 2 t 2 → ⟨t 1 ⟩ -1 e × ⟨t 2 ⟩ -1 e ♣ P τ (t) → P(⟨t⟩ -1 e ) ♣ f (τ ′ 1 , . . . , τ ′ m ; t 1 , . . . , t n ) → f (⟨t 1 ⟩ -1 e , . . . , ⟨t n ⟩ -1 e ) ⟨φ⟩ -1 f = match φ with ♣ ⊥ → ⊥ ♣ ⊤ → ⊤ ♣ φ 1 ∧ φ 2 → ⟨φ 1 ⟩ -1 f ∧ ⟨φ 2 ⟩ -1 f ♣ φ 1 ⇒ φ 2 → ⟨φ 1 ⟩ -1 f ⇒ ⟨φ 2 ⟩ -1 f ♣ ¬φ → ¬ ⟨φ⟩ -1 f ♣ ∀x : τ. φ → ∀x • ⟨φ⟩ -1 f ♣ t 1 = τ t 2 → ⟨t 1 ⟩ -1 e = ⟨t 2 ⟩ -1 e ♣ t 1 ∈ τ t 2 → ⟨t 1 ⟩ -1 e ∈ ⟨t 2 ⟩ -1 e

Proof

The proof, by induction on the structure of expressions and formulae, is straightforward because the translation of Fig. 4.2 just erase type information of Poly-FOL monomorphic expressions and formulae. As we will see, the only case that modify the actual shape of expressions and formulae is the quantiĄcation over list of variables.

For expressions, we have:

 x T  e  -1 e → x ⟨⟨E ⋆s 1 , E ⋆s 2 ⟩ e ⟩ -1 e → ⟨⟨E ⋆s 1 ⟩ e ⟩ -1 e , ⟨⟨E ⋆s 2 ⟩ e ⟩ -1 e ⟨⟨E ⋆s 1 × E ⋆s 2 ⟩ e ⟩ -1 e → ⟨⟨E ⋆s 1 ⟩ e ⟩ -1 e × ⟨⟨E ⋆s 2 ⟩ e ⟩ -1 e ⟨⟨P(E ⋆s )⟩ e ⟩ -1 e → P(⟨⟨E ⋆s ⟩ e ⟩ -1 e )  f P(T ) (E ⋆s 1 , . . . , E ⋆s n )  e  -1 e → f (⟨⟨E ⋆s 1 ⟩ e ⟩ -1 e , . . . , ⟨⟨E ⋆s n ⟩ e ⟩ -1 e )
By induction on E Ű where x is the base case Ű we have

⟨⟨E ⋆s ⟩ e ⟩ -1 e = E s
For formulae, we have:

⟨⟨⊥⟩ f ⟩ -1 f → ⊥ ⟨⟨⊤⟩ f ⟩ -1 f → ⊤ ⟨⟨P ⋆s 1 ∧ P ⋆s 2 ⟩ f ⟩ -1 f → ⟨⟨P ⋆s 1 ⟩ f ⟩ -1 f ∧ ⟨⟨P ⋆s 2 ⟩ f ⟩ -1 f ⟨⟨P ⋆s 1 ⇒ P ⋆s 2 ⟩ f ⟩ -1 f → ⟨⟨P ⋆s 1 ⟩ f ⟩ -1 f ⇒ ⟨⟨P ⋆s 2 ⟩ f ⟩ -1 f ⟨⟨¬P ⋆s ⟩ f ⟩ -1 f → ¬ ⟨⟨P ⋆s ⟩ f ⟩ -1 f  ∀x T • P ⋆s  f  -1 f → ∀x • ⟨⟨P ⋆s ⟩ f ⟩ -1 f  ∀(x T 1 1 , x T 2 2 ) • P ⋆s  f  -1 f → ∀x 1 • ∀x 2 • ⟨⟨P ⋆s ⟩ f ⟩ -1 f ⟨⟨E ⋆s 1 = E ⋆s 2 ⟩ f ⟩ -1 f → ⟨⟨E ⋆s 1 ⟩ e ⟩ -1 e = ⟨⟨E ⋆s 2 ⟩ e ⟩ -1 e ⟨⟨E ⋆s 1 ∈ E ⋆s 2 ⟩ f ⟩ -1 f → ⟨⟨E ⋆s 1 ⟩ e ⟩ -1 e ∈ ⟨⟨E ⋆s 2 ⟩ e ⟩ -1 e
We remark that, without considering type annotation erasure, the only case that modiĄes the syntax is the quantiĄcation over a list of variables, here over two variables:

 ∀(x T 1 1 , x T 2 2 ) • P ⋆s  f  -1 f → ∀x 1 • ∀x 2 • ⟨⟨P ⋆s ⟩ f ⟩ -1 f But the Theorem 1.5.
⟨⟨E ⋆s ⟩ mono e ⟩ -1 e = E s ⟨⟨P ⋆s ⟩ mono f ⟩ -1 f ⇔ P s
where ⟨E ⋆s ⟩ mono This is in particular the case for B axioms.

Translation of LLproof Proofs Into B Proofs

We Ąrst extend to LLproof sequents the translation from Poly-FOL to B:

⟨P 1 , . . . , P n ⊢ LL Q⟩ -1 → ⟨P 1 ⟩ -1 , . . . , ⟨P n ⟩ -1 ⊢ B ⟨Q⟩ -1
Then, we give in Fig. 4.3 and Fig. 4.4 the translations for each LLproof proof node.

Each node can be translated into a B derivation where all LLproof sequents are translated into B sequents, leading to a B proof tree. To lighten the presentation, we omit to indicate the context Γ and useless formulae Ű removable by applying BR2 Ű on the left-hand side of sequents, and we use ⊢ for ⊢ LL . For instance, the translation of the LLproof Axiom rule is actually:

BR3 ⟨Γ, P, ¬P, ¬⊥ ⊢ LL P ⟩ -1 BR3 ⟨Γ, P, ¬P, ¬⊥ ⊢ LL ¬P ⟩ -1 R5 ⟨Γ, P, ¬P ⊢ LL ⊥⟩ -1
Remark The translation is straightforward because of the use of the cut rule BR4 almost systematically. Otherwise, it would require an induction on the proof tree. The problem of cut elimination in the Ąnal B proofs is not relevant here since we only care about having valid B proofs.

In addition, we do not present the translations for LLproof rules dealing with ∨, ⇔ and ∃ since these symbols are not primitive in B. We have previously given the LLproof derivations for these rules in Sec. 3.3.3. We suppose that we have a LLproof proof Π such that:

Conservativity of Provability

Π ⟨Γ ⋆s ⟩ , ¬ ⟨P ⋆s ⟩ ⊢ LL ⊥ 2.
Given the proof Π of the sequent ⟨Γ ⋆s ⟩ , ¬ ⟨P ⋆s ⟩ ⊢ LL ⊥, there exists a proof Π Kleene of the same sequent, starting with all applications of ∀ type rules on polymorphic

Axiom BR3 ⟨P ⊢ P ⟩ -1 BR3 ⟨¬P ⊢ ¬P ⟩ -1 R5 ⟨P, ¬P ⊢ ⊥⟩ -1 ̸ = R10 ⟨⊢ t = τ t⟩ -1 BR3 ⟨¬(t = τ t) ⊢ ¬(t = τ t)⟩ -1 R5 ⟨¬(t = τ t) ⊢ ⊥⟩ -1 Sym BR3 ⟨¬(u = τ t) ⊢ ¬(u = τ t⟩ -1 BR3 ⟨t = τ u ⊢ t = τ u⟩ -1 R10 ⟨⊢ t = τ t⟩ -1 R9 ⟨t = τ u ⊢ u = τ t⟩ -1 R5 ⟨t = τ u, ¬(u = τ t) ⊢ ⊥⟩ -1 ¬¬ BR3 ⟨¬P ⊢ ¬P ⟩ -1 BR3 ⟨¬¬P ⊢ ¬¬P ⟩ -1 R5 ⟨¬¬P ⊢ P ⟩ -1 ⟨¬¬P, P ⊢ ⊥⟩ -1 BR4 ⟨¬¬P ⊢ ⊥⟩ -1 ∧ BR3 ⟨P ∧ Q ⊢ P ∧ Q⟩ -1 R2 ⟨P ∧ Q ⊢ P ⟩ -1 BR3 ⟨P ∧ Q ⊢ P ∧ Q⟩ -1 R2 ′ ⟨P ∧ Q ⊢ Q⟩ -1 ⟨P ∧ Q, P, Q ⊢ ⊥⟩ -1 BR4 ⟨P ∧ Q, P ⊢ ⊥⟩ -1 BR4 ⟨P ∧ Q ⊢ ⊥⟩ -1 ⇒ ⟨P ⇒ Q, ¬P ⊢ ⊥⟩ -1 BR6 ⟨⊢ ¬⊥⟩ -1 R5 ⟨P ⇒ Q ⊢ P ⟩ -1 BR3 ⟨P ⇒ Q ⊢ P ⇒ Q⟩ -1 MP ⟨P ⇒ Q ⊢ Q⟩ -1 ⟨P ⇒ Q, Q ⊢ ⊥⟩ -1 BR4 ⟨P ⇒ Q ⊢ ⊥⟩ -1 Figure 4.3: Translation of LLproof Rules into B Proof System (Part 1) ¬∧ ⟨¬(P ∧ Q), ¬P ⊢ ⊥⟩ -1 BR6 ⟨⊢ ¬⊥⟩ -1 R5 ⟨¬(P ∧ Q) ⊢ P ⟩ -1 ⟨¬(P ∧ Q), ¬Q ⊢ ⊥⟩ -1 BR6 ⟨⊢ ¬⊥⟩ -1 R5 ⟨¬(P ∧ Q) ⊢ Q⟩ -1 R1 ⟨¬(P ∧ Q) ⊢ P ∧ Q⟩ -1 Π R5 ⟨¬(P ∧ Q) ⊢ ⊥⟩ -1
where Π : We apply the idea of permutation of inference rules of [START_REF] Cole | Permutability Of Inferences In Gentzens Calculi LK And LJ[END_REF]. It is possible because type variable quantiĄcation is prenex, thus we can permute these inference nodes to shift them down to the root. As an example, we give below the permutation for a ¬∧ node when both premises are ∀ type nodes. The generalization to all LLproof inference rules is straightforward.

= BR3 ⟨¬(P ∧ Q) ⊢ ¬(P ∧ Q)⟩ -1 ¬ ⇒ ⟨¬(P ⇒ Q), P, ¬Q ⊢ ⊥⟩ -1 BR6 ⟨⊢ ¬⊥⟩ -1 R5 ⟨¬(P ⇒ Q), P ⊢ Q⟩ -1 R3 ⟨¬(P ⇒ Q) ⊢ P ⇒ Q⟩ -1 BR3 ⟨¬(P ⇒ Q) ⊢ ¬(P ⇒ Q)⟩ -1 R5 ⟨¬(P ⇒ Q) ⊢ ⊥⟩ -1 ¬∀ ⟨¬∀x : τ. P (x), ¬P (c) ⊢ ⊥⟩ -1 BR6 ⟨⊢ ¬⊥⟩ -1 R5 ⟨¬∀x : τ. P (x) ⊢ P (c)⟩ -1 R7 ⟨¬∀x : τ. P (x) ⊢ ∀x : τ. P (x)⟩ -1 BR3 ⟨¬∀x : τ. P (x) ⊢ ¬∀x : τ. P (x)⟩ -1 R5 ⟨¬∀x : τ. P (x) ⊢ ⊥⟩ -1 ∀ BR3 ⟨∀x : τ. P (x) ⊢ ∀x : τ. P (x)⟩ -1 R8 ′ ⟨∀x : τ. P (x) ⊢ P (t)⟩ -1 ⟨∀x : τ. P (x), P (t) ⊢ ⊥⟩ -1 BR4 ⟨∀x : τ. P (x) ⊢ ⊥⟩ -1 Subst ⟨P (t), ¬(t = τ u) ⊢ ⊥⟩ -1 BR6 ⟨⊢ ¬⊥⟩ -1 R5 ⟨P (t) ⊢ t = τ u⟩ -1 BR3 ⟨P (t) ⊢ P (t)⟩ -1 R9 ⟨P (t) ⊢ P (u)⟩ -1 ⟨P (t), P (u) ⊢ ⊥⟩ -1 BR4 ⟨P (t) ⊢ ⊥⟩ -1
The proof node (we omit to repeat the contexts):

Π 1 ¬Q, P (τ 1 ) ⊢ LL ⊥ ∀ type ∀α. P (α), ¬Q, ⊢ LL ⊥ Π 2 ¬R, P (τ 2 ) ⊢ LL ⊥ ∀ type ∀α. P (α), ¬R ⊢ LL ⊥ ¬∧ Γ, ∀α. P (α), ¬(Q ∧ R) ⊢ LL ⊥ is transformed into: Π 1 P (τ 1 ), P (τ 2 ), ¬Q ⊢ LL ⊥ Π 2 P (τ 1 ), P (τ 2 ), ¬R ⊢ LL ⊥ ¬∧ ¬(Q ∧ R), P (τ 1 ), P (τ 2 ) ⊢ LL ⊥ ∀ type ∀α. P (α), ¬(Q ∧ R), P (τ 1 ) ⊢ LL ⊥ ∀ type Γ, ∀α. P (α), ¬(Q ∧ R) ⊢ LL ⊥
3. As all the type instantiations are done at the root of Π Kleene , we take the subproof Π mono of Π Kleene , where we removed all the ∀ type nodes at root and the remaining polymorphic formulae at each nodes.

So, if we denote ⟨Γ ⋆s ⟩ mono the set of monomorphic instances of formulae of ⟨Γ ⋆s ⟩, we have:

Π mono ⟨Γ ⋆s ⟩ mono , ¬ ⟨P ⋆s ⟩ ⊢ LL ⊥
It should be noted that ⟨Γ ⋆s ⟩ mono may contained several monomorphic instances of the same polymorphic formula, see the permutation example above.

4. Using the translation ⟨-⟩ -1 on monomorphic instances of the translation of the B axioms leads to erase type information inside formulae. So, we get back the same B axiom than at the beginning, except for quantiĄcation over a list of variables (see lemma 4.2.1 and corollary 4.2.2). It should be noted that we obtain actually the universal closure of the B axioms (not anymore the axiom schemata) as presented in Sec. 2.2.5 and without type annotations, which are no longer needed.

We obtain:

⟨Π mono ⟩ -1 ⟨⟨Γ ⋆s ⟩ mono , ¬ ⟨P ⋆s ⟩ ⊢ LL ⊥⟩ -1 where ⟨Π mono ⟩ -1 is a B proof.
It leads to:

⟨Π mono ⟩ -1 ⟨⟨Γ ⋆s ⟩ mono ⟩ -1 , ¬ ⟨⟨P ⋆s ⟩⟩ -1 ⊢ B ⊥
Then we have (see lemma 4.2.1 and corollary 4.2.2):

⟨Π mono ⟩ -1 Γ s , ¬P s ⊢ B ⊥
Finally, we have the proof:

⟨Π mono ⟩ -1 Γ, ¬P ⊢ B ⊥ BR6 Γ, ¬P ⊢ B ¬⊥ R5 Γ ⊢ B P
where we eliminate the skolem symbols from the proof by applying the procedure of Prop. 2.3.2.

Example of Proof Translation

The LLproof proof of the example of Sec. 4.1.2.5 is already quite large, the resulting B proof being larger, we cannot present it here. Instead, we present the proof translation of the example of Sec. 1.2.3.1.

Given a set u, we want to prove the goal P :

u ∈ P(u)
By applying the annotation procedure of Sec. 2.2, we obtain P ⋆ :

u P(u) ∈ P(u)
We also need the axiom SET2 ⋆ , presented in its annotated and explicitly quantiĄed form:

∀s P(u) • (∀t P(u) • (s ∈ P(t) ⇔ ∀x u • (x ∈ s ⇒ x ∈ t)))
The former leads to the type declarations:

T :: 0 u : set(T )
and the monomorphic Poly-FOL formula ⟨P ⋆ ⟩:

u ∈ set(T ) P T (u)
And the latter leads to the polymorphic Poly-FOL formula ⟨SET2 ⋆ ⟩:

∀α. ∀s : set(α), t : set(α). s ∈ set(α) P α (t) ⇔ (∀x : α. x ∈ α s ⇒ x ∈ α t)
We obtain the LLproof proof, given that A ⇔ B is considered as a notation for (A ⇒ B) ∧ (B ⇒ A), and that x ̸ ∈ s is an abbreviation for ¬(x ∈ s):

Ax c ∈ T u, c ̸ ∈ T u ⊢ LL ⊥ ¬ ⇒ ¬(c ∈ T u ⇒ c ∈ T u) ⊢ LL ⊥ ¬∀ ¬(∀x : T. x ∈ T u ⇒ x ∈ T u) ⊢ LL ⊥ Ax u ∈ set(T ) P T (u) ⊢ LL ⊥ ⇒ (∀x : T. x ∈ T u ⇒ x ∈ T u) ⇒ u ∈ set(T ) P T (u) ⊢ LL ⊥ ∧ u ∈ set(T ) P T (u) ⇔ (∀x : T. x ∈ T u ⇒ x ∈ T u) ⊢ LL ⊥ ∀ ∀t : set(T ). u ∈ set(T ) P T (t) ⇔ (∀x : T. x ∈ T u ⇒ x ∈ T t) ⊢ LL ⊥ ∀ ∀s : set(T ), t : set(T ). s ∈ set(T ) P T (t) ⇔ (∀x : T. x ∈ T s ⇒ x ∈ T t) ⊢ LL ⊥ ∀ type ∀α.∀s : set(α), t : set(α). s ∈ set(α) P α (t) ⇔ (∀x : α. x ∈ α s ⇒ x ∈ α t), u ̸ ∈ set(T ) P T (u) ⊢ LL ⊥
We extract the monomorphic subproof by removing the quantiĄcation over type variables:

Ax c ∈ T u, c ̸ ∈ T u ⊢ LL ⊥ ¬ ⇒ ¬(c ∈ T u ⇒ c ∈ T u) ⊢ LL ⊥ ¬∀ ¬(∀x : T. x ∈ T u ⇒ x ∈ T u) ⊢ LL ⊥ Ax u ∈ set(T ) P T (u) ⊢ LL ⊥ ⇒ (∀x : T. x ∈ T u ⇒ x ∈ T u) ⇒ u ∈ set(T ) P T (u) ⊢ LL ⊥ ∧ u ∈ set(T ) P T (u) ⇔ (∀x : T. x ∈ T u ⇒ x ∈ T u) ⊢ LL ⊥ ∀ ∀t : set(T ). u ∈ set(T ) P T (t) ⇔ (∀x : T. x ∈ T u ⇒ x ∈ T t) ⊢ LL ⊥ ∀ ∀s : set(T ), t : set(T ). s ∈ set(T ) P T (t) ⇔ (∀x : T. x ∈ T s ⇒ x ∈ T t), u ̸ ∈ set(T ) P T (u) ⊢ LL ⊥
We can now translate the proof above to obtain a B proof Π B such that, given a set u:

Π B ∀s • (∀t • (s ∈ P(t) ⇔ (∀x • (x ∈ s ⇒ x ∈ t)))) ⊢ B u ∈ P(u)
It should be noted that the left-hand side of the sequent above is exactly the universal closure of the axiom SET2 (without type annotation) as presented in Sec. 2.2.5, and the right-hand side corresponds to the initial B goal of the example.

Finally, we give in the following the proof Π B resulting in the translation of the monomorphic LLproof proof above, and using the derivations provided in Fig. 4.3 and in Fig. 4.4.

Since the proof is large, we present the translation of the LLproof nodes step-by-step, from the root to the leaves, keeping only the needed formulae on the left-hand side of the sequents. This corresponds to implicit applications of the rule BR2. In addition, we use the symbol ⊢ instead of ⊢ B , and we remove some parentheses.

The B proof starts with:

Π 0 ∀s • ∀t • s ∈ P(t) ⇔ (∀x • x ∈ s ⇒ x ∈ t), u ̸ ∈ P(u) ⊢ ⊥ BR6 ⊢ ¬⊥ R5 ∀s • (∀t • (s ∈ P(t) ⇔ (∀x • (x ∈ s ⇒ x ∈ t)))) ⊢ B u ∈ P(u)
The Ąrst node ∀:

Λ 1 Π 1 ∀t • u ∈ P(t) ⇔ (∀x • x ∈ u ⇒ x ∈ t), u ̸ ∈ P(u) ⊢ ⊥ BR4 ∀s • ∀t • s ∈ P(t) ⇔ (∀x • x ∈ s ⇒ x ∈ t), u ̸ ∈ P(u) ⊢ ⊥ Π 0
where Λ 1 is:

BR3 ∀s • ∀t • s ∈ P(t) ⇔ (∀x • x ∈ s ⇒ x ∈ t) ⊢ ∀s • ∀t • s ∈ P(t) ⇔ (∀x • x ∈ s ⇒ x ∈ t) R8 ′ ∀s • ∀t • s ∈ P(t) ⇔ (∀x • x ∈ s ⇒ x ∈ t) ⊢ ∀t • u ∈ P(t) ⇔ (∀x • x ∈ u ⇒ x ∈ t) Λ 1
The second node ∀:

Λ 2 Π 2 u ∈ P(u) ⇔ (∀x • x ∈ u ⇒ x ∈ u), u ̸ ∈ P(u) ⊢ ⊥ BR4 ∀t • u ∈ P(t) ⇔ (∀x • x ∈ u ⇒ x ∈ t), u ̸ ∈ P(u) ⊢ ⊥ Π 1
where Λ 2 is:

BR3 ∀t • u ∈ P(t) ⇔ (∀x • x ∈ u ⇒ x ∈ t) ⊢ ∀t • u ∈ P(t) ⇔ (∀x • x ∈ u ⇒ x ∈ t) R8 ′ ∀t • u ∈ P(t) ⇔ (∀x • x ∈ u ⇒ x ∈ t) ⊢ u ∈ P(u) ⇔ (∀x • x ∈ u ⇒ x ∈ u) Λ 2
The third node ∧:

Λ 1 3 Λ 2 3 Π 3 (∀x • x ∈ u ⇒ x ∈ u) ⇒ u ∈ P(u), u ̸ ∈ P(u) ⊢ ⊥ BR4 u ∈ P(u) ⇔ (∀x • x ∈ u ⇒ x ∈ u), u ̸ ∈ P(u) ⊢ ⊥ BR4 u ∈ P(u) ⇔ (∀x • x ∈ u ⇒ x ∈ u), u ̸ ∈ P(u) ⊢ ⊥ Π 2
where Λ 1 3 is:

BR3 u ∈ P(u) ⇔ (∀x • x ∈ u ⇒ x ∈ u) ⊢ u ∈ P(u) ⇔ (∀x • x ∈ u ⇒ x ∈ u) R2 u ∈ P(u) ⇔ (∀x • x ∈ u ⇒ x ∈ u) ⊢ u ∈ P(u) ⇒ (∀x • x ∈ u ⇒ x ∈ u) Λ 1 3
and where Λ 2 3 is:

BR3 u ∈ P(u) ⇔ (∀x • x ∈ u ⇒ x ∈ u) ⊢ u ∈ P(u) ⇔ (∀x • x ∈ u ⇒ x ∈ u) R2 ′ u ∈ P(u) ⇔ (∀x • x ∈ u ⇒ x ∈ u) ⊢ (∀x • x ∈ u ⇒ x ∈ u) ⇒ u ∈ P(u) Λ 2 3
The fourth node ⇒:

Π 5 ¬∀x • x ∈ u ⇒ x ∈ u ⊢ ⊥ BR6 ⊢ ¬⊥ R5 ⊢ ∀x • x ∈ u ⇒ x ∈ u Λ 4 MP (∀x • x ∈ u ⇒ x ∈ u) ⇒ u ∈ P(u) ⊢ u ∈ P(u) Π 4 u ∈ P(u), u ̸ ∈ P(u) ⊢ ⊥ BR4 (∀x • x ∈ u ⇒ x ∈ u) ⇒ u ∈ P(u), u ̸ ∈ P(u) ⊢ ⊥ Π 3
where Λ 4 is:

BR3 (∀x • x ∈ u ⇒ x ∈ u) ⇒ u ∈ P(u) ⊢ (∀x • x ∈ u ⇒ x ∈ u) ⇒ u ∈ P(u) Λ 4
The Ąrst (and only) node of the right-hand branch Ax:

BR3 u ∈ P(u) ⊢ u ∈ P(u) BR3 u ̸ ∈ P(u) ⊢ u ̸ ∈ P(u) R5 u ∈ P(u), u ̸ ∈ P(u) ⊢ ⊥ Π 4
The Ąrst node of the left-hand branch ¬∀:

Π 6 ¬(c ∈ u ⇒ c ∈ u) ⊢ ⊥ BR6 ⊢ ¬⊥ R5 ⊢ c ∈ u ⇒ c ∈ u R7 ⊢ ∀x • x ∈ u ⇒ x ∈ u BR3 ¬∀x • x ∈ u ⇒ x ∈ u ⊢ ¬∀x • x ∈ u ⇒ x ∈ u R5 ¬∀x • x ∈ u ⇒ x ∈ u ⊢ ⊥ Π 5
The second node of the left-hand branch ¬ ⇒:

Π 7 c ∈ u, c ̸ ∈ u ⊢ ⊥ BR6 ⊢ ¬⊥ R5 c ∈ u ⊢ c ∈ u R3 ⊢ c ∈ u ⇒ c ∈ u BR3 ¬(c ∈ u ⇒ c ∈ u) ⊢ ¬(c ∈ u ⇒ c ∈ u) R5 ¬(c ∈ u ⇒ c ∈ u) ⊢ ⊥ Π 6
Finally, the third (and last) node of the left-hand branch Ax:

BR3 c ∈ u ⊢ c ∈ u BR3 c ̸ ∈ u ⊢ c ̸ ∈ u R5 c ∈ u, c ̸ ∈ u ⊢ ⊥ Π 7
Remark This proof is larger than the one given in Sec. 1.2.3.1, and it contains some unnecessary steps. This is because we follow rigorously the translation of LLproof nodes given in Figs. 4.3 and 4.4. This method is still scalable to large LLproof proofs since the size of the generated B proofs depends linearly of the size of the LLproof proofs, the growing factor being constant.

Chapter 5

Deduction Modulo B Set Theory

This chapter presents the extension to deduction modulo theory of the typed sequent calculus LLproof, denoted LLproof ≡ . In addition, it shows that LLproof ≡ is sound with respect to LLproof. At the end of this chapter, it becomes possible to build a B proof from a LLproof ≡ proof thanks to the results of Chap. 4.

In Sec. 5.1, we give an informal introduction to the formalism of deduction modulo theory.

In Sec. 5.2, we give some deĄnitions about deduction modulo theory, then we present the extension of LLproof to deduction modulo theory. This section is an extension of results

presented in [START_REF] Dowek | Theorem Proving Modulo[END_REF] to polymorphically typed theories. This contribution is a collaborative work and it has been published in [START_REF] Bury | Automated Deduction in the B Set Theory using Typed Proof Search and Deduction Modulo[END_REF][START_REF] Cauderlier | Checking Zenon Modulo Proofs in Dedukti[END_REF]].

In Sec. 5.3, we show the soundness of LLproof ≡ with respect to LLproof. This contribution is a personal work and it is inspired by [START_REF] Dowek | Theorem Proving Modulo[END_REF]].

In Sec. 5.4, we present the extension of the Poly-FOL version of the B set theory to deduction modulo theory. In particular, we discuss in Sec. 5.4.3 the consequences for the B derived constructs presented in Chap. 1. This contribution is a personal work.

Introduction to Deduction Modulo Theory

Deduction modulo theory [START_REF] Dowek | Theorem Proving Modulo[END_REF]] is a formalism that extends Ąrst-order logic with rewrite rules on both terms and propositions. These rewrite rules can be applied anywhere in a proof and then interleaved with deduction rules. The motivation of deduction modulo is to distinguish deduction and computation in proofs.

Deduction: Inference Rules and Axioms

Generally, we distinguish the concept of logic and the one of theory. We usually characterize a logic by providing a syntax Ű a set of symbols used to write formulae Ű and a proof system Ű a set of inference rules giving an interpretation to these symbols and used to write proofs of the formulae. A logic is a general formalism to write formulae and their proofs.

A theory is generally seen as a more speciĄc framework, dealing with a particular concept, like set theory or arithmetic. It is deĄned by a set of axioms Ű logical formulae assumed to be true.

But this distinction may not be as clear as it seems. For instance, in LLproof, we have the following ¬¬ inference rule:

Γ, P ⊢ ⊥ ¬¬ Γ, ¬¬P ⊢ ⊥ used to erase two negation symbols when trying to prove false. But this rules may be replaced by the axiom scheme, given any formula P : P ⇒ ¬¬P which states exactly the same property.

Actually, this axiom can be proved in LLproof Ű with the restriction that it requires to use the Cut rule Ű, being no more an assumed statement, but a proved lemma:

Ax P, ¬¬¬P, ¬P ⊢ ⊥ Ax P, ¬¬¬P, ¬¬P ⊢ ⊥ Cut P, ¬¬¬P ⊢ ⊥ ¬ ⇒ ¬(P ⇒ ¬¬P ) ⊢ ⊥
On the contrary, we can also interpret axioms as inference rules. This is for instance the idea of super-deduction , proposed by Prawitz, as explained in [START_REF] Brauner | Principles of Superdeduction[END_REF]]. The idea is to enlarge a proof system by adding new inference rules coming from axioms. This technique allows to improve automated proof search, in particular for set theory [START_REF] Jacquel | Tableaux Modulo Theories Using Superdeduction[END_REF].

Computation: Rewrite rules

Deduction modulo theory introduces a third concept in addition to inference rules and axioms: rewrite rules.

The Poincaré principle, as stated by [START_REF] Barendregt | Autarkic Computations in Formal Proofs[END_REF], makes a distinction between deduction and computation. Deduction may be deĄned using a set of inference rules and axioms, while computation consists mainly in simpliĄcation and unfolding of deĄnitions. When dealing with axiomatic theories, keeping all axioms on the deduction side leads to ineicient proof search since the proof-search space grows with the theory. For instance, proving the following statement, in FOL:

fst(a, a) = snd(a, a)
where a is a constant, and fst and snd are deĄned by: ∀x, y. fst(x, y) = x ∀x, y. snd(x, y) = y and with the reĆexivity axiom:

∀x. x = x using a usual automated theorem proving method such as Tableau, will generate useless boilerplate proof steps, whereas a simple unfolding of deĄnitions of fst and snd directly leads to the formula a = a, that should be provable in one reĆexivity step.

Deduction modulo theory was introduced by Dowek, Hardin and Kirchner [START_REF] Dowek | Theorem Proving Modulo[END_REF]] as a logical formalism to deal with axiomatic theories in automated theorem proving. The proposed solution is to remove computational arguments from proofs by reasoning modulo a decidable congruence relation ≡ on formulae. Such a congruence may be generated by a conĆuent and terminating system of rewrite rules.

In our example, the two deĄnitions may be replaced by the rewrite rules:

fst(x, y) -→ x snd(x, y) -→ y
And we obtain the following equivalence between propositions:

(fst(a, a) = snd(a, a)) ≡ (a = a)

Example in Set Theory

Deduction modulo theory strongly reduces the size of proofs in general. For instance in untyped set theory, proving the following statement:

a ⊆ a
where a is a constant set, and given the axiom deĄning the subset predicate:

∀s, t. s ⊆ t ⇔ ∀x. x ∈ s ⇒ x ∈ t
will generate the many-step proof:

Ax c ∈ a, ¬(c ∈ a) ⊢ ⊥ ¬ ⇒ ¬(c ∈ a ⇒ c ∈ a) ⊢ ⊥ ¬∀ ¬∀x. x ∈ a ⇒ x ∈ a ⊢ ⊥ Ax a ⊆ a, ¬(a ⊆ a) ⊢ ⊥ ⇔ a ⊆ a ⇔ ∀x. x ∈ a ⇒ x ∈ a, ¬(a ⊆ a) ⊢ ⊥ ∀ ∀t. a ⊆ t ⇔ ∀x. x ∈ a ⇒ x ∈ t, ¬(a ⊆ a) ⊢ ⊥ ∀ ∀s, t. s ⊆ t ⇔ ∀x. x ∈ s ⇒ x ∈ t, ¬(a ⊆ a) ⊢ ⊥
The deĄnition may be replaced by the rewrite rule:

s ⊆ t -→ ∀x. x ∈ s ⇒ x ∈ t leading to the shorter non-branching proof: Ax c ∈ a, ¬(c ∈ a) ⊢ ⊥ ¬ ⇒ ¬(c ∈ a ⇒ c ∈ a) ⊢ ⊥ ¬∀ ¬∀x. x ∈ a ⇒ x ∈ a ⊢ ⊥ Rewriting ⊆ ¬(a ⊆ a) ⊢ ⊥

5.2

LLproof ≡ : Extension of LLproof to Deduction Modulo Theory

Deduction Modulo Theory

Deduction modulo theory [START_REF] Dowek | Theorem Proving Modulo[END_REF]] reasons over equivalence classes of formulae under a congruence generated by rewrite rules. Compared to [START_REF] Dowek | Theorem Proving Modulo[END_REF], we extend deduction modulo theory to Poly-FOL. The language is that of Sec. 3.2. In the following, we introduce the deĄnitions of term and proposition rewrite rules, and the notion of RE-rewriting.

Rewrite System

A term rewrite rule is a pair of terms l and r together with a local context Γ L and denoted l -→ Γ L r. In addition, we impose that l is not a variable and that we have

FV T (r) ⊆ FV T (l) ⊆ Γ L and FV(r) ⊆ FV(l) ⊆ Γ L .
A proposition rewrite rule is a pair of formulae l and r together with a local context Γ L and denoted l -→ Γ L r. In addition, we impose that l is an atomic formula and that we have FV T (r) ⊆ FV T (l) ⊆ Γ L and FV(r) ⊆ FV(l) ⊆ Γ L .

Rewrite rules are said to be well-formed in a global context Γ G if l and r have the same type in Γ G ; Γ L . We extend the context well-formedness rules of Fig. 3.1 by adding the following rule for rewrite rules:

Γ G ; Γ L ⊢ l : τ Γ G ; Γ L ⊢ r : τ FV T (r) ⊆ FV T (l) ⊆ Γ L FV(r) ⊆ FV(l) ⊆ Γ L WF 7 wf(Γ G , l -→ Γ L r; ∅)
A rewrite system, denoted RE, consists of the union of a set of proposition rewrite rules Ű denoted R Ű and a set of term rewrite rules Ű denoted E. It is well-formed in a global context Γ G if all the rewrite rules are well-formed in Γ G .

RE-Rewriting

Given a global context Γ G and a rewrite system RE that is well-formed in Γ G , a formula φ is said to RE-rewrite to φ ′ , denoted φ -→ RE φ ′ if φ ♣ω = (lρ)σ and φ ′ = φ[(rρ)σ] ω , for some rewrite rule l -→ Γ L r ∈ RE, some occurrence ω in φ, some type substitution ρ, some term substitution σ and where φ ♣ω is the expression at occurrence ω in φ, and φ[(rρ)σ] ω is the expression φ where φ ♣ω has been replaced by (rρ)σ.

The reĆexive-transitive closure of the relation -→ RE is written -→ ⋆ RE . The relation ≡ RE is the congruence generated by RE.

The relation ≡ RE is not decidable in general, but this is in particular the case when -→ RE is conĆuent and (weakly) terminating [START_REF] Dowek | Theorem Proving Modulo[END_REF]].

In the following, when the sets of rewrite rules are clear from the context, we may denote by ≡ the congruence relation ≡ RE .

Extension of LLproof to Deduction Modulo Theory

Given a global typing context Γ G and a rewrite system RE well-formed in Γ G , extending LLproof to deduction modulo theory consists in adding to the proof search rules of Fig. 3.3 and Fig. 3.4, the following conversion rule:

Γ, Q ⊢ ⊥ conv P ≡ RE Q Γ, P ⊢ ⊥
The resulting proof system is called LLproof modulo, and denoted LLproof ≡ .

Example

If we go back to our example of Sec. 4.2.4, given the axiom:

∀α. ∀s : set(α), t : set(α). s ∈ set(α) P α (t) ⇔ ∀x : α. (x ∈ α s ⇒ x ∈ α t)
and the goal:

u ∈ set(T ) P T (u)
for a given sort T and a constant u : set(T ), we obtained the following LLproof proof:

Ax c ∈ T u, c ̸ ∈ T u ⊢ LL ⊥ ¬ ⇒ ¬(c ∈ T u ⇒ c ∈ T u) ⊢ LL ⊥ ¬∀ ¬(∀x : T. x ∈ T u ⇒ x ∈ T u) ⊢ LL ⊥ Ax u ∈ set(T ) P T (u) ⊢ LL ⊥ ⇒ (∀x : T. x ∈ T u ⇒ x ∈ T u) ⇒ u ∈ set(T ) P T (u) ⊢ LL ⊥ ∧ u ∈ set(T ) P T (u) ⇔ (∀x : T. x ∈ T u ⇒ x ∈ T u) ⊢ LL ⊥ ∀ ∀t : set(T ). u ∈ set(T ) P T (t) ⇔ (∀x : T. x ∈ T u ⇒ x ∈ T t) ⊢ LL ⊥ ∀ ∀s : set(T ), t : set(T ). s ∈ set(T ) P T (t) ⇔ (∀x : T. x ∈ T s ⇒ x ∈ T t) ⊢ LL ⊥ ∀ type ∀α.∀s : set(α), t : set(α). s ∈ set(α) P α (t) ⇔ (∀x : α. x ∈ α s ⇒ x ∈ α t), u ̸ ∈ set(T ) P T (u) ⊢ LL ⊥
In deduction modulo, the previous axiom can be replaced by the rewrite rule:

s ∈ set(α) P α (t) -→ (α:Type,s:set(α),t:set(α)) ∀x : α. (x ∈ α s ⇒ x ∈ α t)
Therefore, the proof in LLproof ≡ is:

Ax c ∈ T u, c ̸ ∈ T u ⊢ LL ≡ ⊥ ¬ ⇒ ¬(c ∈ T u ⇒ c ∈ T u) ⊢ LL ≡ ⊥ ¬∀ ¬(∀x : T. x ∈ T u ⇒ x ∈ T u) ⊢ LL ≡ ⊥ conv ¬(u ∈ set(T ) P T (u)) ⊢ LL ≡ ⊥

Soundness of LLproof ≡ with Respect to LLproof

In this section, we show that the proof system LLproof ≡ is sound with respect to LLproof, i.e that if we have a LLproof ≡ proof of a Poly-FOL statement, then we can build a LLproof proof of a certain associated statement.

Generating Theories from Rewrite Systems

Given a set of proposition rewrite rules R and a set of term rewrite rules E, we apply the following procedure for all rewrite rules.

If we have a propositional rewrite rule of the form:

P -→ Γ L Q
where P is an atomic formula, Q is any formula, and FV T (Q) ⊆ FV T (P ) ⊆ Γ L and FV(Q) ⊆ FV(P ) ⊆ Γ L ; we generate the axiom:

∀ α∈FV T (P ) ⃗ α. ∀ x∈FV(P ) ⃗ x. P (⃗ α, ⃗ x) ⇔ Q(♣⃗ α♣, ♣⃗ x♣)
where ♣⃗ α♣ and ♣⃗ x♣ denote respectively the sets FV T (Q) and FV(Q) and satisfy ♣⃗ α♣ ⊆ ⃗ α and

♣⃗ x♣ ⊆ ⃗ x.
If we have a term rewrite rule of the form:

s -→ Γ L t
where s is a term that is not a variable, t is any term, and FV T (t) ⊆ FV T (s) ⊆ Γ L and FV(t) ⊆ FV(s) ⊆ Γ L ; we generate the axiom:

∀ α∈FV T (s) ⃗ α. ∀ x∈FV(s) ⃗ x. s(⃗ α, ⃗ x) = τ t(♣⃗ α♣, ♣⃗ x♣)
where τ is the type of s and t, and where ♣⃗ α♣ and ♣⃗ x♣ denote respectively the sets FV T (t)

and FV(t) and satisfy

♣⃗ α♣ ⊆ ⃗ α and ♣⃗ x♣ ⊆ ⃗ x.
At the end, we have generated a set of axioms, which is the generated theory from the rewrite system RE. We denote this resulting theory T .

Soundness

We show that the conversion rule introduced in Sec. 5.2.2 is admissible, in the sense that we can produce a LLproof derivation of the conversion rule. More precisely, we show that, given a rewrite system RE, the proof system LLproof ≡ is sound with respect to LLproof with the theory T generated by RE. We have the following theorem:

Theorem 5.3.1 (Soundness of LLproof ≡ ) Given a rewrite system RE and a set of formulae Γ, if the sequent:

Γ ⊢ LL ≡ ⊥
is provable and Π is a LLproof ≡ proof of this sequent, then there exists a LLproof proof Π ′ of the sequent:

T , Γ ⊢ LL ⊥
where T is the theory generated from RE.

In order to prove this conservativity theorem, we will incrementally consider the diferent cases of rewriting. Firstly, we consider in Sec. 5.3.3 the case of one step rewriting, i.e. the application of one proposition rewrite rule and for the head symbol. Then, we extend in Sec. 5.3.4 the one step and propositional rewriting to any subformula. We continue in Sec. 5.3.5 with the case of one step rewriting for terms. Finally, we conclude in Sec. 5.3.6

with the Ąnal case of multiple step rewriting for both terms and propositions. Once the admissibility of the full-Ćedged conv rule is proved, the soundness theorem 5.3.1 follows.

One Step, Propositional and Head Rewriting

Lemma 5.3.2

Given a set of proposition rewrite rules R and the theory T generated from R, if P ′ and Q ′ are two formulae that are one-step and head convertible with respect to R (denoted

P ′  ≡ 1 R Q ′ ), we have: If Γ, Q ′ ⊢ LL ≡ ⊥ conv P ′  ≡ 1 R Q ′ Γ, P ′ ⊢ LL ≡ ⊥ Then T , Γ, Q ′ ⊢ LL ⊥ T , Γ, P ′ ⊢ LL ⊥

Proof

If P ′ and Q ′ are one-step and head convertible, then there exists a rewrite rule in R of the shape:

P -→ Γ L Q or Q -→ Γ L P such that P ′ -→ R Q ′ or Q ′ -→ R P ′ .
Without loss of generality, we consider the case P -→ Γ L Q. The theory T generated from R contains the axiom (see Sec. 5.3.1):

∀ α∈FV T (P ) ⃗ α. ∀ x∈FV(P ) ⃗ x. P (⃗ α, ⃗ x) ⇔ Q(♣⃗ α♣, ♣⃗ x♣)
It should be noted that, when writing P ′ -→ R Q ′ , we speak about an instance of the rewrite rule P -→ Γ L Q, where P and Q have been instantiated with some type parameters ⃗ τ and term parameters ⃗ t. So, if we denote respectively ρ = [⃗ α/⃗ τ ] and σ = [⃗ x/ ⃗ t] the type substitution and term substitution, then we have:

P ′ = (P ρ)σ = P (⃗ τ , ⃗ t) and Q ′ = (Qρ)σ = Q(♣⃗ τ ♣, ♣ ⃗ t♣)
We have to following derivation:

Ax T , Γ, ¬P (⃗ τ , ⃗ t), ¬Q(♣⃗ τ ♣, ♣ ⃗ t♣), P ′ ⊢ LL ⊥ T , Γ, Q ′ , ⊢ LL ⊥ T , Γ, P (⃗ τ , ⃗ t), Q(♣⃗ τ ♣, ♣ ⃗ t♣), P ′ ⊢ LL ⊥ ⇔ T , Γ, P (⃗ τ , ⃗ t) ⇔ Q(♣⃗ τ ♣, ♣ ⃗ t♣), P ′ ⊢ LL ⊥ ∀ × n T , Γ, ∀⃗ x. P (⃗ τ , ⃗ x) ⇔ Q(♣⃗ τ ♣, ♣⃗ x♣), P ′ ⊢ LL ⊥ ∀ type × m T , Γ, ∀⃗ α.∀⃗ x. P (⃗ α, ⃗ x) ⇔ Q(♣⃗ α♣, ♣⃗ x♣), P ′ ⊢ LL ⊥

One Step, Propositional and Deep Rewriting

We generalize the previous lemma to rewriting of subformulae. In the following, if P is a subformula of F , we denote F by F [P ], and the replacement of

P by Q in F by F [Q]. Lemma 5.3.3
Given a set of proposition rewrite rules R and the theory T generated from R, if P and Q are two formulae that are one-step and head convertible with respect to R, we have:

If Γ, F [Q] ⊢ LL ≡ ⊥ conv P  ≡ 1 R Q Γ, F [P ] ⊢ LL ≡ ⊥ Then T , Γ, F [Q] ⊢ LL ⊥ T , Γ, F [P ] ⊢ LL ⊥

Proof

First, by applying the Cut rule, we have:

T , Γ, F [P ], F [Q] ⊢ LL ⊥ T , Γ, F [P ], ¬F [Q] ⊢ LL ⊥ Cut T , Γ, F [P ] ⊢ LL ⊥
The left branch corresponds to the premise of the rule:

T , Γ, F [Q] ⊢ LL ⊥ T , Γ, F [P ] ⊢ LL ⊥
So, we have to show that the right-hand branch:

T , Γ, F [P ], ¬F [Q] ⊢ LL ⊥
can be closed. We perform a proof by induction on the structure of F . The base case is:

T , Γ, P, ¬Q ⊢ LL ⊥
and is true since it is a direct consequence of the previous lemma:

Ax T , Γ, Q, ¬Q ⊢ LL ⊥ T , Γ, P, ¬Q ⊢ LL ⊥
The induction hypothesis tells us that the following sequent can be closed:

IH T , Γ, F ′ [P ], ¬F ′ [Q] ⊢ LL ⊥ for F ′ strict subformulae of F .
To lighten the presentation, we may sometime omit some irrelevant parameters like contexts Γ.

F [P ]

:= ¬F ′ [P ]: IH T , Γ, ¬F ′ [P ], F ′ [Q] ⊢ LL ⊥ ¬¬ T , Γ, ¬F ′ [P ], ¬¬F ′ [Q] ⊢ LL ⊥ Since P  ≡ 1 R Q implies Q  ≡ 1
R P , we can apply directly the induction hypothesis in this case.

F [P ]

:= F 1 [P ] ∧ F 2 : IH T , F 1 [P ], F 2 , ¬F 1 [Q] ⊢ LL ⊥ Ax T , F 1 [P ], F 2 , ¬F 2 ⊢ LL ⊥ ¬∧ T , F 1 [P ], F 2 , ¬(F 1 [Q] ∧ F 2 ) ⊢ LL ⊥ ∧ T , F 1 [P ] ∧ F 2 , ¬(F 1 [Q] ∧ F 2 ) ⊢ LL ⊥ 3. F [P ] := F 1 [P ] ⇒ F 2 : IH T , ¬F 1 [P ], F 1 [Q], ¬F 2 ⊢ LL ⊥ Ax T , F 2 , F 1 [Q], ¬F 2 ⊢ LL ⊥ ⇒ T , F 1 [P ] ⇒ F 2 , F 1 [Q], ¬F 2 ⊢ LL ⊥ ¬ ⇒ T , F 1 [P ] ⇒ F 2 , ¬(F 1 [Q] ⇒ F 2 ) ⊢ LL ⊥
4. We do not present the cases for ∨, ⇔ and all the cases where P occurs in F 2 instead of F 1 , since they are very close to the previous ones.

F [P ]

:= ∀x : τ. F ′ [P ] IH T , F ′ [P (c)], ¬F ′ [Q(c)] ⊢ LL ⊥ ∀ T , ∀x : τ. F ′ [P (x)], ¬F ′ [Q(c)] ⊢ LL ⊥ ¬∀ T , ∀x : τ. F ′ [P (x)], ¬∀x : τ. F ′ [Q(x)] ⊢ LL ⊥ Since if P (x)  ≡ 1 R Q(x), then P (c)  ≡ 1 R Q(c).
6. We do not present the case for ∃ which is very close to the previous one.

One Step Term Rewriting

Lemma 5.3.4

Given a set of term rewrite rules E and the theory T generated from E, if s ′ and t ′ are two terms that are one-step convertible with respect to E (denoted s ′ ≡ 1 E t ′ ), we have:

If Γ, F [t ′ ] ⊢ LL ≡ ⊥ conv s ′ ≡ 1 E t ′ Γ, F [s ′ ] ⊢ LL ≡ ⊥ Then T , Γ, F [t ′ ] ⊢ LL ⊥ T , Γ, F [s ′ ] ⊢ LL ⊥

Proof

If s ′ and t ′ are one-step convertible, then there exists a rewrite rule in E of the shape:

s -→ Γ L t or t -→ Γ L s such that s ′ -→ E t ′ or t ′ -→ E s ′ .
Once again, without loss of generality, we consider the case s -→ Γ L t. The theory T generated from R contains the axiom (see Sec. 5.3.1):

∀ α∈FV T (s) ⃗ α. ∀ x∈FV(s) ⃗ x. s(⃗ α, ⃗ x) = τ t(♣⃗ α♣, ♣⃗ x♣)
If we denote respectively ρ = [⃗ α/⃗ τ ] and σ = [⃗ x/⃗ u] the type substitution and the term substitution, we have:

s ′ = (sρ)σ = s(⃗ τ , ⃗ u) and t ′ = (tρ)σ = t(♣⃗ τ ♣, ♣⃗ u♣)
We have the following derivation:

Ax s(⃗ τ , ⃗ u) = τ t(♣⃗ τ ♣, ♣⃗ u♣), s ′ ̸ = τ t ′ ⊢ LL ⊥ ∀ × n ∀⃗ x. s(⃗ τ , ⃗ x) = τ t(♣⃗ τ ♣, ♣⃗ x♣), s ′ ̸ = τ t ′ ⊢ LL ⊥ ∀ type × m ∀⃗ α. ∀⃗ x. s(⃗ α, ⃗ x) = τ t(♣⃗ α♣, ♣⃗ x♣), s ′ ̸ = τ t ′ ⊢ LL ⊥ T , F [t ′ ] ⊢ LL ⊥ Subst T , ∀⃗ α. ∀⃗ x. s(⃗ α, ⃗ x) = τ t(♣⃗ α♣, ♣⃗ x♣), F [s ′ ] ⊢ LL ⊥ Corollary 5.3.5
Given a rewrite system RE and the theory T generated from RE, if F and F ′ are two formulae that are one-step convertible with respect to RE (denoted F ≡ 1 RE F ′ ), we have:

If Γ, F ′ ⊢ LL ≡ ⊥ conv F ≡ 1 RE F ′ Γ, F ⊢ LL ≡ ⊥ Then T , Γ, F ′ ⊢ LL ⊥ T , Γ, F ⊢ LL ⊥

Multiple Step Rewriting

The last case of this section deals with multiple steps rewriting, both for propositions and terms.

Given a rewrite system RE, we remind that two formulae P and Q are convertible with respect to RE (denoted P ≡ RE Q), if there exists a Ąnite number of rewrite rules of RE and n formulae R 1 , . . . , R n such that:

P ≡ 1 RE R 1 ≡ 1 RE . . . ≡ 1 RE R n ≡ 1 RE Q Lemma 5.3.6
Given a rewrite system RE and the theory T generated from RE, if P and Q are two formulae that are convertible with respect to RE (denoted P ≡ RE Q), we have:

If Γ, Q ⊢ LL ≡ ⊥ conv P ≡ RE Q Γ, P ⊢ LL ≡ ⊥ Then T , Γ, Q ⊢ LL ⊥ T , Γ, P ⊢ LL ⊥
Proof The proof is a direct consequence of the deĄnition of conversion. If P ≡ RE Q, then there exists n formulae R 1 , . . . , R n such that:

P ≡ 1 RE R 1 ≡ 1 RE . . . ≡ 1 RE R n ≡ 1 RE Q
Then, we have:

Γ, Q ⊢ LL ≡ ⊥ conv Rn≡ 1 RE Q Γ, R n ⊢ LL ≡ ⊥ . . . Γ, R 1 ⊢ LL ≡ ⊥ conv P ≡ 1 RE R 1 Γ, P ⊢ LL ≡ ⊥
Finally, thanks to the previous corollary 5.3.5, we obtain:

T , Γ, Q ⊢ LL ⊥ T , Γ, R n ⊢ LL ⊥ . . . T , Γ, R 1 ⊢ LL ⊥ T , Γ, P ⊢ LL ⊥

Soundness of LLproof ≡ With Respect to LLproof

We can conclude this section with a straightforward proof of theorem 5.3.1.

Given a rewrite system RE and the theory T generated form RE, we suppose given a

LLproof ≡ proof Π such that:

Π Γ ⊢ LL ≡ ⊥ then, we build a LLproof proof Π ′ such that: Π ′ T , Γ ⊢ LL ⊥
We perform the construction by induction on the structure of Π. All the cases are straightforward since we replace all LLproof ≡ nodes by their corresponding LLproof ones, and use lemma 5.3.6 in case of a conversion. For instance: The derivation of the Cut rule in B Natural Deduction is:

Π Γ, F 1 , F 2 ⊢ LL ≡ ⊥ ∧ Γ, F 1 ∧ F 2 ⊢ LL ≡ ⊥ -→ Π ′ T , Γ, F 1 , F 2 ⊢ LL ⊥ ∧ T , Γ, F 1 ∧ F 2 ⊢ LL ⊥

Translation of

⟨Γ, P ⊢ LL ⊥⟩ -1 BR6 ⟨Γ, P ⊢ LL ¬⊥⟩ -1 R6 ⟨Γ ⊢ LL ¬P ⟩ -1 ⟨Γ, ¬P ⊢ LL ⊥⟩ -1 BR4 ⟨Γ ⊢ LL ⊥⟩ -1

B Set Theory Modulo

Expressing the B Method set theory as a theory modulo consists in building an adequate rewrite system RE such that the theory T generated by RE is equivalent to the B theory.

To do so, we transform whenever possible the axioms and deĄnitions of the Poly-FOL B Method set theory into rewrite rules.

In this section, we present a B theory modulo resulting from the previous translations presented in Sec. 4.1. In this presentation, all the rules of the rewrite system come from the B syntax. Unfortunately, we will see in Chap. 8 that the resulting rules are not well suited for automated theorem proving in practice.

Axiomatic Set Theory

Core Theory The core B set theory consists in the translation into Poly-FOL of the three annotated axioms of Fig. 2.1. We remind in the following the Poly-FOL version of the B set theory signature and axioms as introduced in Sec. 4.1:

set :: 1 tup :: 2 (-, -) : Πα 1 α 2 . α 1 × α 2 → tup(α 1 , α 2 ) P(-) : Πα. set(α) → set(set(α)) -× -: Πα 1 α 2 . set(α 1 ) × set(α 2 ) → set(tup(α 1 , α 2 )) -∈ -: Πα. α × set(α) → o ∀α 1 , α 2 . ∀s : set(α 1 ), t : set(α 2 ), x : α 1 , y : α 2 . (x, y) α 1 ,α 2 ∈ tup(α 1 ,α 2 ) s × α 1 ,α 2 t ⇔ (x ∈ α 1 s ∧ y ∈ α 2 t) SET1 ∀α. ∀s : set(α), t : set(α). s ∈ set(α) P α (t) ⇔ (∀x : α. x ∈ α s ⇒ x ∈ α t) SET2 ∀α. ∀s : set(α), t : set(α). (∀x : α. x ∈ α s ⇔ x ∈ α t) ⇒ s = set(α) t SET4
New Function Symbols In addition, the Poly-FOL version of the B set theory contains axioms coming from the skolemization of the comprehension sets (see Sec. 2.3). These axioms are of the following shape:

∀α 1 . . . . .α m . ∀s 1 : τ 1 . . . . .s n : τ n . ∀x : τ. x ∈ τ f (α 1 , . . . , α m ; s 1 , . . . , s n ) ⇔ φ(α 1 , . . . , α m ; x, s 1 , . . . , s n )
where f is a function symbol with type signature:

f : Πα 1 . . . α m . τ 1 × . . . × τ n → set(τ )
and where φ is a polymorphic formula.

Generated Rewrite System

We obtain the rewrite system (to lighten the presentation, we omit to indicate the local contexts Γ L ): It should be noted that the extensionality axiom has not been turned into a rewrite rule since the left hand side of the rule would be an equality, which may not be eicient in practice. Thus, it is left as an axiom in the theory.

(x, y) α 1 ,α 2 ∈ tup(α 1 ,α 2 ) s × α 1 ,α 2 t -→ x ∈ α 1 s ∧ y ∈ α 2 t s ∈ set(α) P α (t) -→ ∀x : α. x ∈ α s ⇒ x ∈ α t x ∈ α 1 ,...,αm 1 f 1 (α 1 , . . . , α m 1 ; s 1 , . . . , s n 1 ) -→ φ 1 (α 1 , . . . , α m 1 ; x, s 1 , . . . ,
This presentation complies with all the previous result of conservativity presented in this manuscript. So, it is always possible to retrieve an original B proof coming from a

LLproof ≡ proof with this rewrite system.

Unfortunately, this general scheme does not Ąt well for derived construct, as we will see in the following section.

Derived Constructs

The derived constructs presented in Sec. 1.2.3.2 are quite important in the B Method since they are often used in proof obligations. The treatment of those constructs is therefore important.

Derived constructs are mostly deĄned using comprehension sets. Thus, they are translated as function symbols, as presented in Sec. 5.4.2. We show in the following the treatment of the derived constructs with the union operator as an example, where s, t and u are sets such that s ⊆ u and t ⊆ u, and a is an element of u.

In the B Method, the basic set operators union ∪, intersection ∩, set diferenceand singleton ¶ ♢ are deĄned by comprehension (see Sec. 1.2.3.2), therefore they have the shape ¶x ♣ x ∈ u ∧ P ♢. We saw in Sec. 2.2 that the formula x ∈ u represents some typing information used to verify that a formula is well typed. For instance, the union between two sets s and t is deĄned as follows:

s ∪ t := ¶a ♣ a ∈ u ∧ (a ∈ s ∨ a ∈ t)♢
In this deĄnition, u does not provide any logical information. It is here only to guarantee that the variable a has the proper type.

If we apply the annotation procedure described in Sec. 2.2, we obtain:

s P(u) ∪ t P(u) := ¶a u ♣ a ∈ u P(u) ∧ (a ∈ s P(u) ∨ a ∈ t P(u) )♢
Then, the skolemization of comprehension sets presented in Sec. 2.3 leads to:

s P(u) ∪ t P(u) := f P(u) (u P(u) , s P(u) , t P(u) )

and to add the axiom, where as usual we do not repeat the typing annotation on variables:

∀u P(u) • ∀s P(u) • ∀t P(u) • ∀x u • x ∈ f P(u) (u, s, t) ⇔ x ∈ u ∧ (x ∈ s ∨ x ∈ t)
Finally, the translation scheme from B to Poly-FOL presented in Sec. 4.1 gives us the Poly-FOL axiom:

∀α. ∀u : set(α), s : set(α), t : set(α),

x : α. x ∈ α f (α; u, s, t) ⇔ x ∈ α u ∧ (x ∈ α s ∨ x ∈ α t)
where f has the type signature:

f : Πα. set(α) × set(α) × set(α) → set(α)
At the end, the rewrite rule generated for the union between two sets is:

x ∈ α f (α; u, s, t) -→ Γ L x ∈ α u ∧ (x ∈ α s ∨ x ∈ α t)
where Γ L := α : Type, x : α, u : set(α), s : set(α), t : set(α)

As we can see, the left-hand side of this rewrite rule has nothing to do with an intuitive deĄnition of the union between two sets. The left-hand side deals with three diferent sets and the right-hand side starts with a conjunction.

This example illustrates that this approach Ű despite its usefulness in the theoretical part of our work Ű is not well-suited for derived constructs of the B Method in practice.

From a simple deĄnition of the union between two sets, we obtain at the end an axiom deĄning a construct dealing with three diferent variables.

Chapter 6

Automated Deduction:

In Sec. 6.4, we present the experimental results over two diferent benchmarks. In particular we compare the diferent versions of Zenon introduced in this chapter and also

Zenon to other polymorphic deduction tools.

Zenon: A Tableau Method Automated Theorem Prover

In this section, we present the ATP Zenon [START_REF] Bonichon | Zenon: An Extensible Automated Theorem Prover Producing Checkable Proofs[END_REF] and its proof-search method called the Tableau method.

Presentation of the Tableau Method

The Tableau method is an automatic proof search algorithm for the sequent calculus without cut. It is usually seen today as a tree method, proposed by Smullyan in Tableau is a proof by contradiction method. To prove a formula, we have to show that the negation of the formula is unsatisĄable. To do so, the algorithm breaks the logical connectives of the formula until it reaches elementary atomic formulae or negation of atomic formulae. This process generates branches corresponding to diferent possibles cases. Once a contradiction is reached in a branch, i.e. the branch contains an atomic formula and its negation, the branch is said to be closed. A Tableau proof is a tree where all branches are closed.

Common Use of the Tableau Method

In the past few years, the popularity of the Tableau method in Ąrst-order classical logic has decreased, letting other automatic proof-search methods step in. For instance, in the CASC competition [START_REF] Sutclife | The CADE ATP System Competition -CASC[END_REF]], considered as the world-cup competition for Ąrst-order classical logic ATPs, tools using methods like resolution [START_REF] Alan | A Machine-Oriented Logic Based on the Resolution Principle[END_REF] or superposition [START_REF] Nieuwenhuis | Paramodulation-Based Theorem Proving[END_REF] are widely represented, unlike tools using the Tableau method.

Today, the Tableau method is still often used for other kind of logics. In particular, it is very popular for non-classical logics like modal logic [START_REF] Goré | Tableau Methods for Modal and Temporal Logics[END_REF]].

One important advantage of the Tableau method, compared to other methods like resolution or superposition, is its ability to generate strong proof traces [START_REF] Bonichon | Zenon: An Extensible Automated Theorem Prover Producing Checkable Proofs[END_REF].

The Tableau method can be seen as a proof system which corresponds to an upside-down sequent calculus where all formulae are on the left-hand side of the turnstile. Therefore, it is straightforward to generate proof traces in a standard sequent calculus format.

Key Features of Zenon

Zenon [START_REF] Bonichon | Zenon: An Extensible Automated Theorem Prover Producing Checkable Proofs[END_REF] is an ATP for Ąrst-order classical logic with equality and based on the Tableau method. It was originally designed to be the dedicated ATP of the FoCaLiZe environment [START_REF] Hardin | FoCaLiZe-Reference Manual[END_REF],

an object-oriented algebraic speciĄcation and proof system.

The key feature of Zenon is the possibility to generate formal proof certiĄcates that can be veriĄed by the interactive theorem prover Coq [START_REF] Bertot | Interactive Theorem Proving and Program Development: CoqŠArt: the Calculus of Inductive Constructions[END_REF], used as a proof checker in that case. This feature is very speciĄc to Zenon compared to other ATPs.

The beneĄt provided by this approach is to guarantee by an external tool the soundness of the proofs produced by Zenon.

Extension of Zenon to Polymorphism

Most of Ąrst-order automated deduction tools do not implement polymorphism. For the time being and as far as we know, besides our version of Zenon, only three diferent tools deal natively with polymorphism.

Alt-Ergo, a SatisĄability Modulo Theory (SMT for short) solver released in 2008 [START_REF] Bobot | The Alt-Ergo Automated Theorem Prover[END_REF], was designed to be the dedicated tool of the veriĄcation platform Why3 [START_REF] Bobot | Why3: Shepherd Your Herd of Provers[END_REF], which the native language, called WhyML, is based on polymorphism.

The two other tools dealing with polymorphism, one called Zipperposition [START_REF] Cruanes | Extending Superposition with Integer Arithmetic, Structural Induction, and Beyond[END_REF]] and the other one being a prototype [START_REF] Wand | Polymorphic+Typeclass Superposition[END_REF]] based on the ATP SPASS [START_REF] Weidenbach | SPASS: Combining Superposition, Sorts and Splitting[END_REF]], are both based on superposition and were both released in 2014.

It should be noted that some well-known ATPs implement monomorphic/many-sorted Ąrst-order logic (denoted Sorted-FOL), like E [START_REF] Schulz | System Description: E 1.8[END_REF] or Vampire [START_REF] Riazanov | Vampire[END_REF].

Extending Poly-FOL to MLproof

Zenon has two diferent formats to write proofs. The Ąrst, called MLproof, is the proof search format, based on the Tableau method. The second, called LLproof (see Sec. 3.3), is based on the sequent calculus.

Syntax

We present in Fig. 6.1 and Fig. 6.2 the comprehensive syntax for types, type schemes, terms, formulae, type quantiĄed formulae, local contexts and global contexts of MLproof ≡ . This is an extension of the Poly-FOL syntax presented in Sec. 3.2.1.

It should be noted that constructs that were already deĄned in Sec. 3.2.1 do not change.

We add only three constructs in type and term categories called term metavariables, type metavariables and ε-terms. We also add the notion of rewrite rule in global contexts, used later (see Sec. 6.3).

Type System

We present in Fig. 6.3 the rules for well-formedness. The only modiĄcation compared to the presentation in Fig. 3.1 is the addition of the rule WF 7 introduced in Sec. 5.2.1, that deals with rewrite rules.

However, we have to extend the type system of Poly-FOL of Fig. 3.2 by deĄning typing rules for metavariables and ε-terms. We give in Fig. 6.4 the extended type system.

Extension of MLproof to Polymorphism

In this section, we present the proof search system MLproof and discuss about the extension to polymorphism of its original version.

Type

τ ::= α (type variable) ♣ A Type (type metavariable) ♣ T (τ 1 , . . . , τ m ) (type constructor application)
Type Scheme

σ ::= Πα 1 . . . α m . τ 1 × . . . × τ n → τ (function type signature) ♣ Πα 1 . . . α m . τ 1 × . . . × τ n → o (predicate type signature) Term t ::= x (variable) ♣ X τ (metavariable) ♣ ε(x : τ ). φ(x) (ε -term) ♣ f (τ 1 , . . . , τ m ; t 1 , . . . , t n ) (function application) Formula φ ::= ⊤ ♣ ⊥ (true, false) ♣ ¬φ (negation) ♣ φ 1 ∧ φ 2 (conjunction) ♣ φ 1 ∨ φ 2 (disjunction) ♣ φ 1 ⇒ φ 2 (implication) ♣ φ 1 ⇔ φ 2 (equivalence) ♣ t 1 = τ t 2 (term
::= ∅ (empty context) ♣ Γ G , T :: m (type constructor declaration) ♣ Γ G , f : σ (function declaration) ♣ Γ G , P : σ (predicate declaration) ♣ Γ G , l -→ Γ L r (rewrite rule) Figure 6.2: Poly-FOL Syntax Extended for MLproof ≡ (Part 2) WF 1 wf(∅; ∅) x ̸ ∈ Γ L Γ G ; Γ L ⊢ τ : Type WF 2 wf(Γ G ; Γ L , x : τ ) α ̸ ∈ Γ L wf(Γ G ; Γ L ) WF 3 wf(Γ G ; Γ L , α : Type) T ̸ ∈ Γ G wf(Γ G ; ∅) WF 4 wf(Γ G , T :: m; ∅) f ̸ ∈ Γ G Γ G ; α 1 : Type, . . . , α m : Type ⊢ τ i : Type, i = 1 . . . n Γ G ; α 1 : Type, . . . , α m : Type ⊢ τ : Type WF 5 wf(Γ G , f : Πα 1 . . . α m . τ 1 × . . . × τ n → τ ; ∅) P ̸ ∈ Γ G Γ G ; α 1 : Type, . . . , α m : Type ⊢ τ i : Type, i = 1 . . . n WF 6 wf(Γ G , P : Πα 1 . . . α m . τ 1 × . . . × τ n → o; ∅) Γ G ; Γ L ⊢ l : τ Γ G ; Γ L ⊢ r : τ FV T (r) ⊆ FV T (l) ⊆ Γ L FV(r) ⊆ FV(l) ⊆ Γ L WF 7 wf(Γ G , l -→ Γ L r; ∅) Figure 6.3: Context Well-Formedness for Poly-FOL TMeta Γ ⊢ A Type : Type Γ ⊢ τ : Type Meta Γ ⊢ X τ : τ α : Type ∈ Γ TVar Γ ⊢ α : Type x : τ ∈ Γ Var Γ ⊢ x : τ Γ ⊢ τ : Type Γ, x : τ ⊢ φ(x) : o ε Γ ⊢ ε(x : τ ). φ(x) : τ T :: m ∈ Γ Γ ⊢ τ i : Type, i = 1 . . . m TConstr Γ ⊢ T (τ 1 , . . . , τ m ) : Type f : Πα 1 . . . α m .τ 1 × . . . × τ n → τ ∈ Γ ρ = [α 1 /τ ′ 1 , . . . , α m /τ ′ m ] Γ ⊢ τ ′ i : Type, i = 1 . . . m Γ ⊢ t i : τ i ρ, i = 1 . . . n Fun Γ ⊢ f (τ ′ 1 , . . . , τ ′ m ; t 1 , . . . , t n ) : τ ρ Closure Rules ⊥ ⊙ ⊥ ⊙ P, ¬P ⊙ ⊙ ¬R r (τ 1 , . . . , τ m ; a, a) ⊙ r ⊙ ¬⊤ ⊙ ¬⊤ ⊙ R s (τ 1 , . . . , τ m ; a, b), ¬R s (τ 1 , . . . , τ m ; b, a) ⊙ s ⊙ α Rules ¬¬P α ¬¬ P P ∧ Q α ∧ P, Q ¬(P ∨ Q) α ¬∨ ¬P, ¬Q ¬(P ⇒ Q) α ¬⇒ P, ¬Q β Rules P ∨ Q β ∨ P ♣ Q ¬(P ∧ Q) β ¬∧ ¬P ♣ ¬Q P ⇒ Q β ⇒ ¬P ♣ Q P ⇔ Q β ⇔ ¬P, ¬Q ♣ P, Q ¬(P ⇔ Q) β ¬⇔ ¬P, Q ♣ P, ¬Q δ
P (τ 1 , . . . , τ m ; a 1 , . . . , a n ), ¬P (τ 1 , . . . , τ m ; b 1 , . . . , b n ) pred a 1 ̸ = τ ′ 1 b 1 ♣ . . . ♣ a n ̸ = τ ′ n b n f (τ 1 , . . . , τ m ; a 1 , . . . , a n ) ̸ = f (τ 1 , . . . , τ m ; b 1 , . . . , b n ) fun a 1 ̸ = τ ′ 1 b 1 ♣ . . . ♣ a n ̸ = τ ′ n b n R s (τ 1 , . . . , τ m ; a, b), ¬R s (τ 1 , . . . , τ m ; c, d) sym a ̸ = τ d ♣ b ̸ = τ c ¬R r (τ 1 , . . . , τ m ; a, b) ¬reĆ a ̸ = τ b R t (τ 1 , . . . , τ m ; a, b), ¬R t (τ 1 , . . . , τ m ; c, d) trans c ̸ = τ a, ¬R t (τ 1 , . . . , τ m ; c, a) ♣ b ̸ = τ d, ¬R t (τ 1 , . . . , τ m ; b, d) R ts (τ 1 , . . . , τ m ; a, b), ¬R ts (τ 1 , . . . , τ m ; c, d) transsym d ̸ = τ a, ¬R t (τ 1 , . . . , τ m ; d, a) ♣ b ̸ = τ c, ¬R ts (τ 1 , . . . , τ m ; b, c) a = τ b, ¬R t (τ 1 , . . . , τ m ; c, d) transeq c ̸ = τ a, ¬R t (τ 1 , . . . , τ m ; c, a) ♣ ¬R t (τ 1 , . . . , τ m ; c, a), ¬R t (τ 1 , . . . , τ m ; b, d) ♣ b ̸ = τ d, ¬R t (τ 1 , . . . , τ m ; b, d) a = τ b, ¬R ts (τ 1 , . . . , τ m ; c, d) transeqsym d ̸ = τ a, ¬R ts (τ 1 , . . . , τ m ; d, a) ♣ ¬R ts (τ 1 , . . . , τ m ; a, d), ¬R ts (τ 1 , . . . , τ m ; b, c) ♣ b ̸ = τ c, ¬R ts (τ 1 , . . . , τ m ; b, c) Figure 6.6: Proof Search Rules of MLproof (Part 2)

Inference Rules of MLproof

We present in Fig. 6.5 and Fig. 6.6 the inference rules of the proof-search system of Zenon, called MLproof.

A Tableau Method Proof System

The inference rules of MLproof are applied following the standard Tableau method, i.e.

starting with the negation of the goal and by applying the rules in a top-down fashion to build a tree. We use the notation Ş♣Ť to symbolize the separation of two branches, like in rules β.

A branch is said to be closed when it ends with an application of a closure rule, symbolized by Ş⊙Ť. When all branches are closed, the proof tree is closed and this proof tree is a proof of the goal.

The two closure rules ⊙ r and ⊙ s deal with reĆexive R r and symmetric R s relations respectively. For instance, if the reĆexive relation R r is the equality, the rule ⊙ r is then:

a ̸ = τ a ⊙ r ⊙
As mentioned later, the only such relation in the context of our work is actually the equality relation.

An Ordering for Rule Application

The inference rules are divided into Ąve distinct classes which is reĆected in an ordering.

The idea is to minimize the size of the proof tree to reduce the proof search space. The proof-search algorithm of Zenon will apply the rules with the following order relation ≺,

where the relational rules of Fig. 6.6 are identiĄed as β rules:

⊙ ≺ α ≺ δ ≺ β ≺ γ
The reason of this ordering is simple. We always start by trying to close a branch with a ⊙ closure rule. If we cannot close the branch, we try to apply the α rules that deal with logical connectives and that pursue with one branch. The δ rules also continue with one branch and generate an ε-term. Then, we try to apply the β rules which deal with logical connectives but generate two branches. Finally, we apply the γ rules that deal with universal quantiĄcation and generate new metavariables.

The fairness of this procedure is ensured because all formulae are decomposed into atomic formulae at the end, thanks to rules α, β and δ which are terminating Ű and obviously for rules ⊙. The only category of rules that are not terminating is the γ rules which may generate an inĄnite number of new formulae.

It should be noted that this algorithm is applied in a strict depth-Ąrst order: it closes the current branch before starting to work on another branch.

Pruning

Pruning is a method to reduce the size of the proof tree. As explained in [START_REF] Bonichon | Zenon: An Extensible Automated Theorem Prover Producing Checkable Proofs[END_REF], when a branching node N has a closed subtree as one of its branches B, it is possible to determine which formulae are useful. If the formula introduced by N in B is not in the set of useful formulae, Zenon removes N and grafts the subtree at its place since the subtree is a valid refutation of B without N.

A formula is said to be useful in a subtree if it is one of the formulae appearing in the hypotheses of a rule application on that subtree.

We present an example of pruning in Sec. 6.2.2.2.

Metavariables

In the original and untyped version of Zenon, there was only term metavariables. These metavariables, sometimes called free variables in the Tableau-related literature, are not real variables in the sense that they are never substituted with terms inside formulae.

With the original untyped Zenon, when meeting a universally quantiĄed formula of the shape ∀x. P (x), Zenon applies the γ ∀M rule ∀x. P (x) γ ∀M P (X) that introduces a new metavariable X, which is linked to this universal formula, and generates the formula P (X). If Zenon reaches later a state where there is another formula like ¬P (t) Ű or one of its subformula Ű, where t is a closed term, then it reaches a possible contradiction with P (X) Ű or the corresponding subformula. Another common case is ending with a formula of the form X ̸ = t. At this point, Zenon instantiates the original universally quantiĄed formula linked to the metavariable X with the proper term t in the current branch by applying the rule γ ∀inst ∀x. P (x) γ ∀inst P (t)

Since we have extended Zenon to polymorphism, we have universal quantiĄcation over type variables. Then, we need to deĄne also metavariables for type variables and the corresponding rules in MLproof.

We discuss in more detail in Sec. 6.2.2.2 the role of type metavariables and the diference compared to term metavariables during proof search.

Hilbert's ε-Terms

When dealing with existential quantiĄcation, Zenon uses HilbertŠs ε-terms [START_REF] Giese | HilbertŠs ε-Terms in Automated Theorem Proving[END_REF]. For a formula P (x), the term Şε(x). P (x)Ť is an arbitrarily chosen term that satisĄes P (x), if such a term exists. The use of ε-term is an alternative to Skolem terms. The main beneĄt of ε-terms in the context of the proof search of Zenon is to keep the information of the linked formula, unlike for Skolem terms, allowing to reuse the same ε-term at diferent places.

Type Parameters in MLproof Rules

For some closure and relational rules, their application is conditioned by the fact that the predicate symbols are applied to the same list of type parameters. For instance, here is the pred rule:

P (τ 1 , . . . , τ m ; a 1 , . . . , a n ), ¬P (τ 1 , . . . , τ m ; b 1 , . . . , b n ) pred a 1 ̸ = τ ′ 1 b 1 ♣ . . . ♣ a n ̸ = τ ′ n b n
We see that we have P (τ 1 , . . . , τ m ; a 1 , . . . , a n ) and ¬P (τ 1 , . . . , τ m ; b 1 , . . . , b n ), where the type parameters τ 1 , . . . , τ m must be the same. Then, the application of the pred rule generates n branches of the form a i ̸ = τ ′ i b i . It should be noted that the type τ ′ i , which is the type of the two terms a i and b i , has no reason to be the same type than τ i .

The fact that these type parameters have to be equal can be seen as a precondition.

Equality Reasoning

In Fig. 6.6, we present the rules dealing with relations. These rules are deĄned for reĆexive relations denoted R r , symmetric relations denoted R s , transitive relations denoted R t and Ąnally transitive and symmetric relations denoted R ts .

In practice, the only relation that is concerned by these rules in our work is the equality relation.

Dealing with Type Metavariables

In Zenon, term metavariables, introduced by the rule γ ∀M play a special role, as we have seen above. They serve to simulate a closure rule to determine a substitution by uniĄcation.

In presence of polymorphism, type metavariables may also be introduced, by the rules γ ∀M Type and γ ¬∃M Type . But the behavior of type metavariables difers from the behavior of term metavariables, it is no more possible to wait to reach a possible contradiction of the form A Type ̸ = τ .

The role of type metavariables is to generate type instances that allow to apply inference rules bearing conditions on types, like rule pred. Thus, when trying to apply such a rule, we look for a type metavariable substitution that satisĄes the constraints. In case of success, we instantiate the initial formula with rule γ ∀inst Type . This shortcut minimizes both the search space and the size of proof trees.

As an example, consider that we have a type τ : Type, two constants a : τ and b : τ , and a predicate symbol P with signature P : Πα. α × α → o. We assume: ∀α. ∀x, y : α. P (α; x, y) And we want to prove:

P (τ ; a, b)
The proof, before pruning of useless formulae, is given below. ∀α. ∀x, y : α. P (α; x, y), ¬P (τ ; a, b) γ ∀M Type ∀x, y : A Type . P (A Type ; x, y) γ ∀M ∀y : A Type . P (A Type ; X A Type , y)

1 γ ∀M P (A Type ; X A Type , Y A Type ) 2 γ ∀inst Type ∀x, y : τ. P (τ ; x, y) γ ∀M ∀y : τ. P (τ ; X τ , y) 3 γ ∀M P (τ ; X τ , Y τ ) 4 pred X τ ̸ = τ a γ ∀inst ∀y : τ. P (τ ; a, y) γ ∀M P (τ ; a, Y ′ τ ) pred a ̸ = τ a ⊙ r ⊙ Y ′ τ ̸ = τ b γ ∀inst P (τ ; a, b) ⊙ ⊙ Y τ ̸ = τ b
We remark that, 1 when we introduce the formula P (A Type ; X A Type , Y A Type ), we would like to apply the rule pred with ¬P (τ ; a, b). But 2 Zenon needs Ąrst to instantiate the type metavariable A Type with the type τ . Then, 3 it generates some new (term) metavariables X τ and Y τ with the proper type. 4 We Ąnally apply the rule pred and identify the subterms of P (τ ; X τ , T τ ) with the those of ¬P (τ ; a, b), leading to generate two branches.

Then, Zenon reaches a potential contradiction with the formula X τ ̸ = a, thus it instantiates the linked formula of X τ with a. Doing the same with Y τ , Zenon can Ąnally close the local branch.

The proof search is done. Thanks to pruning of useless formulae, the open right-hand branch can be erased, leading to the following proof tree:

∀α. ∀x, y : α. P (α; x, y), ¬P (τ ; a, b) γ ∀inst Type ∀x, y : τ. P (τ ; x, y) γ ∀inst ∀y : τ. P (τ ; a, y) γ ∀inst P (τ ; a, b) ⊙ ⊙

Extension of Zenon to Deduction Modulo Theory

In this section, we discuss the extension of Zenon to deduction modulo theory.

MLproof ≡ and Deduction Modulo Theory

In practice, and unlike the presentation in Sec. 5.2.2 of the extension of LLproof to deduction modulo theory, we do not record the conversion steps by adding an explicit conversion rule. Instead, we merge the conversion rule with all inference rules of MLproof, leading to a deduction modulo theory proof-search system called MLproof ≡ .

Given For instance, the rule β ∨ dealing with the disjunction is:

[P ∨ Q] β ∨ P ♣ Q
We do not present all the MLproof ≡ system since it is straightforward.

Generation of the Rewrite System

Turning axioms into rewrite rules is a crucial point in deduction modulo theory. In

Zenon Modulo, we propose two solutions to achieve that.

User-Defined Rewrite System

When dealing with a speciĄc theory, it is possible to deĄne manually which axiom could be turned into a rewrite rule, in the sense that it is done outside Zenon Modulo. To do that, it is possible to tag axioms in TPTP Ąles using a special keyword ŞrewriteŤ. This solution is used to prove B proof obligations.

Heuristic to Build a Rewrite System

The second solution to turn axioms into rewrite rules is to rely on a heuristic.

The main advantage of the heuristic is to be fully automatic. But it may also generate some inappropriate rewrite rules, leading to a rewrite system that does not enjoy good properties Ű like conĆuence and termination Ű and that does not allow to have an eicient proof search.

We present in the following a heuristic, implemented in Zenon Modulo, that allows to generate both term and propositional rewrite rules.

The main idea is to transform into term rewrite rules, axioms of the shape:

∀⃗ α. ∀⃗ x. t = u
where t is a term that is not a variable and u is any term; and to transform into propositional rewrite rules, axioms of the shape:

∀⃗ α. ∀⃗ x. P ⇔ φ
where P is a predicate symbol and φ is any formula.

But we have to be more restrictive to avoid catching some particular kind of axioms, like those expressing commutativity properties of symbols Ű it would lead to immediate non-termination.

In the following, P denotes a predicate symbol which is not an equality, φ denotes an arbitrary formula, t a term which is not a variable and u an arbitrary term. In addition, we denote FV(φ) and FV(t) the union of the free term and type variables of φ and t respectively.

For propositional rewrite rules, we let:

∀⃗ α. ∀⃗ x. P ✄ P -→ ⊤ ∀⃗ α. ∀⃗ x. ¬P ✄ P -→ ⊥ ∀⃗ α. ∀⃗ x. P ⇔ φ ✄ P -→ φ
The last transformation rule is under the proviso that FV(φ) ⊆ FV(P ) ⊆ ⃗ α ∪ ⃗ x and that P is not uniĄable with φ or any subformula of φ.

For term rewrite rules, we let:

∀⃗ α. ∀⃗ x. t = u ✄ t -→ u provided that FV(u) ⊆ FV(t) ⊆ ⃗ α ∪ ⃗
x and that t is not uniĄable with u or any subterm of u.

Verifying that the left-hand side of a rewrite rule is not uniĄable with any subformula/subterm of the right-hand side allows us to eliminate some trivial cases of non-termination.

Unfortunately, it does not guarantee that our Ąnal rewrite system is terminating, since we do not test this criterion for all the rewrite rules. But this heuristic is terminating and rather eicient, thus we consider it as a good compromise.

Rewriting Algorithm

The implementation of deduction modulo theory into Zenon Modulo consists in performing normalization of formulae during proof search. This step of normalization is done after the application of each inference rule to all the formulae newly generated.

The normalization procedure goes as follows:

1. We normalize only the literals, i.e. atomic formulae or their negation;

2. We normalize with respect to term rewrite rules;

3. We apply one step of propositional rewriting;

4. If the formula is still unchanged, we quit; otherwise we go back to item 1.

This algorithm allows us to normalize an atomic formula up to the point, when we have either a normal form with respect to the rewrite system, or a non-atomic formula.

Experimental Results

Presentation of TFF1

TPTP [START_REF] Sutclife | The TPTP Problem Library and Associated Infrastructure: The FOF and CNF Parts, v3.5.0[END_REF]] is a well-established project for the automated theorem proving community. It provides a large library of problems Ű around 20,000 problems all categories together Ű to test and benchmark automated deduction tools. It also promotes the use of standard syntaxes for problems and proofs. The most known format is called FOF and deals with untyped Ąrst-order logic (denote FOL). We can also cite the format TFF0 for monomorphic/many-sorted Ąrst-order logic (denoted Sorted-FOL). The syntax of TFF1 is close to the presentation of Poly-FOL in Sec. 3.2.1. This format is used by Zenon Modulo as its input format for polymorphic problems.

Encoding of Poly-FOL into FOL

A solution to use untyped provers with polymorphic theories is to rely on encodings In the following, we present the encodings into TFF1 and FOF of the example of Sec. 4.2.4.

A Polymorphic Problem in WhyML

The syntax of WhyML is close to the syntax of Poly-FOL. ( mem ( set ( A ) , S , power (A , T ) ) <= > ![ X : A ]: ( mem (A , X , S ) = > mem (A , X , T ) ) ) ) . tff ( example , conjecture , mem ( set ( t ) , u , power (t , u ) ) ) .

Translation of the Problem into FOF using t??

The default encoding, called featherweight tags t??, of Poly-FOL into FOF deĄnes two new function symbols sort Ű which allows to verify the type of expressions Ű and witness Ű that states the existence of a witness. Then, it changes the original axiom by adding some constraints to verify the types of expressions. (( sort (A , X ) = X ) = > ( mem (A , X , S ) = > mem (A , X , T ) ) ) = > mem ( set ( A ) , S , power (A , T ) ) ) ) ) . fof ( u_sort , axiom , ( sort ( set ( t ) , u ) = u ) ) . fof ( example , conjecture , mem ( set ( t ) , u , power (t , u ) ) ) .

Translation of the Problem into FOF using g??

The second encoding implemented in Why3, called featherweight guards g??, of Poly-FOL into FOF is very close to the previous one. This time the newly deĄned symbol sort is a predicate symbol. ( sort (A , X ) = > ( mem (A , X , S ) = > mem (A , X , T ) ) ) = > mem ( set ( A ) , S , power (A , T ) ) ) ) ) . fof ( u_sort , axiom , sort ( set ( t ) , u ) ) . fof ( example , conjecture , mem ( set ( t ) , u , power (t , u ) ) ) .

Remarks about the Encoding

The two encodings of Poly-FOL into FOF presented above have two main consequences on the input theory:

1. It increases the number of axioms leading to a larger search space, from one to four axioms in our examples;

2. It modiĄes the shape of the original axioms, adding some conditions that have to be fulĄlled.

3. The TFF1 version of the axiom mem_power is well-suited to be turned into a rewrite rule using the heuristic presented above, unlike the two FOF versions that cannot be turned into rewrite rules.

Thus, the main reason to extend Zenon to polymorphism is to be able to use deduction modulo theory.

Experimental Results

To test our new tool Zenon Modulo dealing with Poly-FOL and rewriting, we perform an experiment over two diferent benchmarks, the former coming from the TPTP TFF1 library and the later from the B set theory.

In the following, we call Zenon FOF the original untyped version of Zenon, Zenon TFF1

the extension of Zenon to polymorphism, and Zenon Modulo the extension to deduction modulo theory of Zenon TFF1.

All these versions of Zenon are actually the same tool Zenon Modulo 0.4.2, using diferent options of the command line. The source code of Zenon Modulo is freely accessible at:

http://zenon.gforge.inria.fr/

TPTP TFF1

We select all the polymorphic problems of the TFF1 library with status ŞtheoremŤ Ű those which are known to be provable Ű leading to a benchmark made of 356 problems.

We present in Tab. 6.1 and Tab. 6.2 the experimental results.

In Tab. 6.1, we compare Zenon FOF with the two encoding t?? and g?? presented in Sec. 6.4.2, Zenon TFF1 and Zenon Modulo with the heuristic presented in Sec. 6.3.2.2.

We indicate the number of problems proved by each provers, and between parentheses the number of problems that are proved only by the concerned prover. In the second line, we give the mean time spent to prove problems. Finally, the third line gives the number of proved problems that are well-checked by Dedukti [START_REF] Assaf | Dedukti: a Logical Framework based on the λΠ-Calculus Modulo Theory[END_REF]

The B Set Theory

We build a benchmark in the WhyML format, made of 320 Poly-FOL problems coming from the B-Book. These problems are B set theory lemmas stated in the chapter 2 of the B-Book, and dealing with all the B operators deĄned. In addition, we deĄne directly in WhyML the B set theory.

In Tab. 6.3, we compare the same versions of Zenon, than in Tab. 6.1, between each other. In Tab. 6.4, we compare Zenon Modulo with the heuristic to the ATP Zipperposition and the SMT Alt-Ergo.

The results of Tab. 6.3 show that Zenon Modulo with the heuristic is much more eicient than the other versions of Zenon. The diference is very signiĄcant, both for the number of proved formulae and for the mean time.

The results of Tab. 6.4 show that Zenon Modulo with the heuristic is also more eicient than Zipperposition and Alt-Ergo on this benchmark.

The main reason is that the B set theory is made of axioms that Ąt well deduction modulo theory and our heuristic.

Chapter 7

Proof CertiĄcation Using Dedukti

This chapter presents the certiĄcation of the proofs produced by Zenon Modulo using the proof-checker Dedukti. We present in Sec. 7.2 the λΠ-calculus modulo theory, an extension of the simply typed λ-calculus with dependant types and rewriting, and the proof-checker

Dedukti which implements the λΠ-calculus modulo theory. This presentation of Dedukti is inspired by [START_REF] Assaf | Dedukti: a Logical Framework based on the λΠ-Calculus Modulo Theory[END_REF][START_REF] Cauderlier | Object-Oriented Mechanisms for Interoperability between Proof Systems[END_REF][START_REF] Saillard | Typechecking in the lambda-Pi-Calculus Modulo : Theory and Practice[END_REF]].

In Sec. 7.3, we present the encoding of Poly-FOL into the λΠ-calculus modulo theory.

This contribution (and its corresponding implementation) is a collaborative work and it has been published in [START_REF] Cauderlier | Checking Zenon Modulo Proofs in Dedukti[END_REF]].

In Sec. 7.4, we present the encoding of Zenon Modulo proofs in Dedukti, and we provide an example of proof certiĄcate. This contribution (and its corresponding implementation) is a collaborative work and it has been published in [START_REF] Cauderlier | Checking Zenon Modulo Proofs in Dedukti[END_REF].

A Proof Checker Dealing with Rewriting

A key feature of Zenon, compared to other ATPs, is its certifying approach (see Sec. 6.1.3). It consists in generating proof certiĄcates that can be veriĄed by external proof-checkers.

The original version of Zenon Ű without polymorphism and deduction modulo theory Ű uses the proof assistant Coq [START_REF] Bertot | Interactive Theorem Proving and Program Development: CoqŠArt: the Calculus of Inductive Constructions[END_REF] as a proof checker.

The extension of Zenon to deduction modulo theory leads to introduce rewriting steps inside proofs. In addition, these rewriting steps are not recorded in order to reduce the size of proofs.

Coq is not well-suited to check proofs using rewriting techniques. This would require to rebuild all the rewriting steps formally, and provided them to the proof certiĄcates, leading to unnecessary larger Ąles.

Instead, we choose to use another proof checker, called Dedukti [START_REF] Assaf | Dedukti: a Logical Framework based on the λΠ-Calculus Modulo Theory[END_REF], which deals natively with rewriting.

The λΠ-Calculus Modulo Theory and Dedukti

The λΠ-calculus is an extension of the simply typed λ-calculus with dependent types [START_REF] Hendrik | Lambda Calculus with Types[END_REF]. It is commonly used as a logical framework to encode logics [START_REF] Harper | A Framework for DeĄning Logics[END_REF].

The λΠ-calculus modulo theory, denoted by λΠ ≡ in the following, is an extension of the λΠ-calculus to rewriting. We do not claim to give a rigorous and exhaustive presentation of λΠ ≡ here, since it is out of the scope of our work. We only introduce the basic notions needed for the certiĄcation of Zenon Modulo proofs. An inquisitive reader should have a look at [START_REF] Assaf | Dedukti: a Logical Framework based on the λΠ-Calculus Modulo Theory[END_REF][START_REF] Saillard | Typechecking in the lambda-Pi-Calculus Modulo : Theory and Practice[END_REF]] for a comprehensive presentation of λΠ ≡ .

Syntax of λΠ ≡

We present in Fig. 7.1 the syntax of λΠ ≡ .

In this calculus, types are not syntactically distinguished from terms. Only two terms, Type and Kind, are deĄned in a particular syntactic category and are called sorts, denoted s.

Type is the sort of the types used to type terms. For instance, if we have the typing judgment Γ ⊢ t : A where t is a term and A is its type, then we have Γ ⊢ A : Type. In this case, we say that t is an object.

s ::= Type (sort of types) ♣ Kind (sort of Type)

t ::= x (variable) ♣ t 1 t 2 (term application) ♣ λx : t 1 . t 2 (lambda abstraction) ♣ Πx : t 1 . t 2 (product) ♣ s (type) ∆ ::= ∅ (empty local context) ♣ ∆, x : t (variable declaration) Γ ::= ∅ (empty global context) ♣ Γ, x : t (variable declaration) ♣ Γ, t 1 ↩→ ∆ t 2 (rewrite rule declaration)
Figure 7.1: The Syntax of the λΠ-Calculus Modulo Theory

The second sort Kind is introduced to type Type (see rule Sort in Fig. 7.2), and other types built using Type, like A → Type, ... Thus, if we have the two typing judgments Γ ⊢ A : B and Γ ⊢ B : Kind, we say that A is a type.

A term t is either a variable x, or built inductively from term application, lambda abstraction and product. It should be noted that the arrow type → is a particular case of the product type. For instance, A → B is actually Πx : A. B where x does not occur freely in B. Finally, a term can also be a sort.

In λΠ ≡ , local contexts, denoted ∆, are used to type variables which occur freely in terms of a rewrite rules. A local context ∆ is a set of variable declarations, i.e. pairs made of an identiĄer of a variable and its type.

The last category in Fig. 7.1 is the global context Γ, containing variable declarations and rewrite rules.

Typing Rules

We present in Fig. 7.2 the typing rules of λΠ ≡ .

Well-formedness It should be noted that we factorize some rules. For instance, in rule Abs, in the premise Γ, x : A ⊢ B : s the sort s may be either Type or Kind.

Empty wf(∅) wf(Γ) Γ ⊢ A : s x ̸ ∈ Γ Decl wf(Γ, x : A) Γ, ∆ ⊢ l : A Γ, ∆ ⊢ r : A Γ, ∆ ⊢ A : Type FV(r) ⊆ FV(l) ⊆ ∆ Rew wf(Γ, l ↩→ ∆ r) Γ ⊢ t : A Γ ⊢ B : s A ≡ βΓ B Conv Γ ⊢ t : B
In typing rule App, the notation B[x/t 2 ] denotes the substitution in B of x by t 2 . The most interesting rule is the rule Conv which tells us that we can replace a type A by another type B if these two types are βΓ-convertible.

The particularity of λΠ ≡ resides in this rule Conv. Γ contains all the rewrite rules deĄned, thus the βΓ-convertibility deals with both β-reduction and reduction with respect to the custom rewrite system. When this rewrite system is both strongly normalizing and conĆuent, each term gets a unique normal form (up to α-conversion), and both conversion

Dedukti

Dedukti is a proof-checker for the λΠ ≡ , developed by Saillard [START_REF] Saillard | Typechecking in the lambda-Pi-Calculus Modulo : Theory and Practice[END_REF]] and made of around 2,000 lines of OCaml code. It is used as a backend to verify proofs coming from ATPs, like Zenon Modulo and iProver Modulo [START_REF] Burel | Experimenting with Deduction Modulo[END_REF][START_REF] Burel | A Shallow Embedding of Resolution and Superposition Proofs into the λΠ-Calculus Modulo[END_REF], and from proof assistants, like Coq [BoespĆug and [START_REF] Boespćug | CoqInE: Translating the Calculus of Inductive Constructions into the λΠ-calculus modulo[END_REF], HOL [START_REF] Assaf | Translating HOL to Dedukti[END_REF] and FoCaLiZe [START_REF] Cauderlier | Object-Oriented Mechanisms for Interoperability between Proof Systems[END_REF]].

Dedukti implements some powerful features, like higher-order rewriting, making it highly expressive. In addition, experiments show that its implementation is quite efective in practice, allowing us to verify proofs quickly.

Encoding of Poly-FOL into λΠ ≡

In this section, we present the embedding of Poly-FOL into λΠ ≡ . This work is an extension of the embedding of FOL into λΠ ≡ proposed by Burel [START_REF] Burel | A Shallow Embedding of Resolution and Superposition Proofs into the λΠ-Calculus Modulo[END_REF]].

This embedding relies on two encodings: a deep encoding, denoted ♣φ♣ for a Poly-FOL formula φ, in which logical connectives are simply declared as Dedukti constants; and a shallow encoding, denoted ∥φ∥ := prf ♣φ♣ for a Poly-FOL formula φ, using a decoding function prf to translate connectives to their impredicative encodings. We present in Sec. 7.3.2, the deep embedding and in Sec. 7.3.3 the shallow embedding of Poly-FOL into λΠ ≡ .

Remarks about Poly-FOL and LLproof ≡

In the following, when speaking about Poly-FOL, we are referring to the syntax extended to deduction modulo theory, with rewrite rules, but without metavariables and ε-terms.

So, it corresponds to the syntax presented in Fig. 6.1 and Fig. 6.2, without type and term metavariables and without ε-terms.

In addition, the considered proof system LLproof ≡ does not have an explicit conversion rule (like in Sec. 5.2.2), instead we merge the conversion rule with all inference rules of LLproof ≡ (as for MLproof ≡ in Sec. 6.3.1).

Deep embedding

We present in Fig. 7.3 the declarations of Poly-FOL symbols as Dedukti constants, corresponding to a deep embedding of Poly-FOL. We call Γ 0 the set of declarations of

⊤ : Prop ⊥ : Prop ¬-: Prop → Prop -∧ -: Prop → Prop → Prop -∨ -: Prop → Prop → Prop -⇒ -: Prop → Prop → Prop -⇔ -: Prop → Prop → Prop ∀--: Πα : type. (term α → Prop) → Prop ∃--: Πα : type. (term α → Prop) → Prop ∀ type -: (type → Prop) → Prop -= --: Πα : type. term α → term α → Prop

Shallow Embedding

We present in Fig. 7.4 the shallow deĄnitions of the Dedukti constants declared in Fig. 7.3. In Dedukti, deĄnitions are given as rewrite rules, denoted with the symbol ↩→. The translation from Poly-FOL into λΠ ≡ presented in Fig. 7.5 is correct in the sense that:

Translation of Types

τ ♣α♣ := α ♣T (τ 1 , . . . , τ m )♣ := T ♣τ 1 ♣ . . . ♣τ m ♣ Translation of Type Schemes σ ♣Πα 1 . . . α m . τ 1 × . . . × τ n → τ ♣ := Πα 1 : type . . . α m : type. term ♣τ 1 ♣ → . . . → term ♣τ n ♣ → term ♣τ ♣ ♣Πα 1 . . . α m . τ 1 × . . . × τ n → o♣ := Πα 1 : type . . . α m : type. term ♣τ 1 ♣ → . . . → term ♣τ n ♣ → Prop Translation of Terms t ♣x♣ := x ♣f (τ 1 , . . . , τ m ; t 1 , . . . , t n )♣ := f ♣τ 1 ♣ . . . ♣τ m ♣ ♣t 1 ♣ . . . ♣t n ♣ Translation of Formulae φ ♣⊤♣ := ⊤ ♣⊥♣ := ⊥ ♣¬φ♣ := ¬ ♣φ♣ ♣φ 1 ∧ φ 2 ♣ := ♣φ 1 ♣ ∧ ♣φ 2 ♣ ♣φ 1 ∨ φ 2 ♣ := ♣φ 1 ♣ ∨ ♣φ 2 ♣ ♣φ 1 ⇒ φ 2 ♣ := ♣φ 1 ♣ ⇒ ♣φ 2 ♣ ♣φ 1 ⇔ φ 2 ♣ := ♣φ 1 ♣ ⇔ ♣φ 2 ♣ ♣t 1 = τ t 2 ♣ := ♣t 1 ♣ = ♣τ ♣ ♣t 2 ♣ ♣∀x : τ. φ♣ := ∀ ♣τ ♣ (λx : term ♣τ ♣ . ♣φ♣) ♣∃x : τ. φ♣ := ∃ ♣τ ♣ (λx : term ♣τ ♣ . ♣φ♣) ♣∀α. φ♣ := ∀ type (λα : type. ♣φ♣) ♣P (τ 1 , . . . , τ m ; t 1 , . . . , t n )♣ := P ♣τ 1 ♣ . . . ♣τ m ♣ ♣t 1 ♣ . . . ♣t n ♣ Figure 7.5: Translation Functions from Poly-FOL into λΠ ≡ (Part 1) Translation of Local Contexts Γ L ♣∅♣ := ∅ ♣Γ L , α : Type♣ := ♣Γ L ♣ , α : type ♣Γ L , x : τ ♣ := ♣Γ L ♣ , x : term ♣τ ♣ Translation of Global Contexts Γ G ♣∅♣ := Γ 0 ♣Γ G , T :: m♣ := ♣Γ G ♣ , T : m times    type → . . . → type → type ♣Γ G , f : σ♣ := ♣Γ G ♣ , f : ♣σ♣ ♣Γ G , P : σ♣ := ♣Γ G ♣ , P : ♣σ♣ ♣Γ G , l -→ Γ L r♣ := ♣Γ G ♣ , ♣l♣ ↩→ ♣Γ L ♣ ♣r♣
1. If Γ G , Γ L ⊢ τ : Type, then ♣Γ G ♣ , ♣Γ L ♣ ⊢ ♣τ ♣ : type 2. If Γ G , Γ L ⊢ t : τ , then ♣Γ G ♣ , ♣Γ L ♣ ⊢ ♣t♣ : term ♣τ ♣ 3. If Γ G , Γ L ⊢ φ : o, then ♣Γ G ♣ , ♣Γ L ♣ ⊢ ♣φ♣ : Prop
Remark It should be noted that in Prop. 7.3.1, the three typing judgments:

Γ G , Γ L ⊢ τ : Type Γ G , Γ L ⊢ t : τ Γ G , Γ L ⊢ φ : o
refer to the Poly-FOL typing system of Fig. 6.4, whereas the three others:

♣Γ G ♣ , ♣Γ L ♣ ⊢ ♣τ ♣ : type ♣Γ G ♣ , ♣Γ L ♣ ⊢ ♣t♣ : term ♣τ ♣ ♣Γ G ♣ , ♣Γ L ♣ ⊢ ♣φ♣ : Prop
♣Γ G ♣ , ♣Γ L ♣ ⊢ T ♣τ 1 ♣ . . . ♣τ m ♣ : type 2.
We perform a proof by induction on the structure of t.

The base case is Γ G , Γ L ⊢ x : τ . a. By rule Var x : τ ∈ Γ L thus the translation implies x : term ♣τ ♣ ∈ ♣Γ L ♣ b. Thus we have ♣Γ G ♣ , ♣Γ L ♣ ⊢ x : term ♣τ ♣ The general case is Γ G , Γ L ⊢ f (τ 1 , . . . , τ m ; t 1 , . . . , t n ) : τ a. By rule Fun, we have f : Πα 1 . . . α m . τ ′ 1 × . . . × τ ′ n → τ ′ ∈ Γ G and Γ G , Γ L ⊢ τ i : Type for i = 1, . . . , m b. By translation, we have f : Πα 1 : type . . . α m : type. term ♣τ ′ 1 ♣ → . . . → term ♣τ ′ n ♣ → term ♣τ ′ ♣ ∈ ♣Γ G ♣ c. By item 1. we have ♣Γ G ♣ , ♣Γ L ♣ ⊢ ♣τ i ♣ : type d. By rule Fun, we have also, for i = 1, . . . , n Γ G , Γ L ⊢ t i : τ ′ i [α 1 /τ 1 , . . . , α m /τ m ]
e. Thus, by induction hypothesis

♣Γ G ♣ , ♣Γ L ♣ ⊢ ♣t i ♣ : term ♣τ ′ i [α 1 /τ 1 , . . . , α m /τ m ]♣ f. And by rule App ♣Γ G ♣ , ♣Γ L ♣ ⊢ f ♣τ 1 ♣ . . . ♣τ m ♣ ♣t 1 ♣ . . . ♣t n ♣ : term ♣τ ′ [α 1 /τ 1 , . . . , α m /τ m ]♣ g. τ = τ ′ [α 1 /τ 1 , . . . , α m /τ m ] thus, ♣Γ G ♣ , ♣Γ L ♣ ⊢ f ♣τ 1 ♣ . . . ♣τ m ♣ ♣t 1 ♣ . . . ♣t n ♣ : term ♣τ ♣
3. We perform a proof by induction on the structure of φ.

The base cases ⊤ and ⊥ are direct and cases for logical connectives and the equality are straightforward.

We present the universal quantiĄcation:

Γ G , Γ L ⊢ ∀x : τ. φ : o We have to show that ♣Γ G ♣ , ♣Γ L ♣ ⊢ ∀ ♣τ ♣ (λx : term ♣τ ♣ . ♣φ♣) : Prop a. We have ∀ : Πα : type. (term α → Prop) → Prop b. By rule App it is equivalent to show that ♣Γ G ♣ , ♣Γ L ♣ ⊢ λx : term ♣τ ♣ . ♣φ♣ : term ♣τ ♣ → Prop c. By rule Abs, we have to verify that ♣Γ G ♣ , ♣Γ L ♣ ⊢ ♣φ♣ : Prop d.
Which is true by induction hypothesis

Translation of Zenon Modulo Proofs into Dedukti

In this section, we present the embedding of Zenon Modulo proofs into Dedukti. Once again, we deĄne Ąrst the Dedukti constants corresponding to the inference rules of LLproof ≡ , then we give the deĄnitions of these constants in Dedukti by means of rewrite rules.

Deep Embedding of LLproof ≡ into λΠ ≡

We present in Fig. 7.7 and in Fig. 7.8 the deep embedding of LLproof ≡ into λΠ ≡ . This is done by deĄning constants for each inference rule.

Remark

The types of the Dedukti constants declared in Fig. 7.7 and Fig. 7.8 translate exactly the corresponding LLproof ≡ inference rules. If we see sequents as typing contexts, then Γ ⊢ ⊥ is prfA 1 → . . . → prfA n → prf⊥ and the deduction rule itself is seen as a function that associates the conclusion with the premises.

Below, we present the correspondence between the inference rule ∨ and the Dedukti constant R ∨ . In this example, we do not consider contexts, the general case will be done later.

Closure Rules and Cut Given two propositions P and Q, proving the Poly-FOL sequent:

R ⊥ : prf⊥ → prf⊥ R ¬⊤ : prf(¬⊤) → prf⊥ R Ax : ΠP : Prop. prfP → prf(¬P ) → prf⊥ R ̸ = : Πα : type. Πt : term α. prf(t ̸ = α t) → prf⊥ R Sym : Πα : type. Πt, u : term α. prf(t = α u) → prf(u ̸ = α t) → prf⊥ R Cut : ΠP : Prop. (prfP → prf⊥) → (prf(¬P ) → prf⊥) → prf⊥ QuantiĄer-free Rules R ¬¬ : ΠP : Prop. (prfP → prf⊥) → prf(¬¬P ) → prf⊥ R ∧ : ΠP, Q : Prop. (prfP → prfQ → prf⊥) → prf(P ∧ Q) → prf⊥ R ∨ : ΠP, Q : Prop. (prfP → prf⊥) → (prfQ → prf⊥) → prf(P ∨ Q) → prf⊥ R ⇒ : ΠP, Q : Prop. (prf(¬P ) → prf⊥) → (prfQ → prf⊥) → prf(P ⇒ Q) → prf⊥ R ⇔ : ΠP, Q : Prop. (prf(¬P ) → prf(¬Q) → prf⊥) → (prfP → prfQ → prf⊥) → prf(P ⇔ Q) → prf⊥ R ¬∧ : ΠP, Q : Prop. (prf(¬P ) → prf⊥) → (prf(¬Q) → prf⊥) → prf(¬(P ∧ Q)) → prf⊥ R ¬∨ : ΠP, Q : Prop. (prf(¬P ) → prf(¬Q) → prf⊥) → prf(¬(P ∨ Q)) → prf⊥ R ¬⇒ : ΠP, Q : Prop. (prfP → prf(¬Q) → prf⊥) → prf(¬(P ⇒ Q)) → prf⊥ R ¬⇔ : ΠP, Q : Prop. (prf(¬P ) → prfQ → prf⊥) → (prfP → prf(¬Q) → prf⊥) → prf(¬(P ⇔ Q)) → prf⊥
P ∨ Q ⊢ ⊥
is done in LLproof ≡ by applying the ∨ rule, resulting in the proof node:

P ⊢ ⊥ Q ⊢ ⊥ ∨ P ∨ Q ⊢ ⊥
Then, we have to prove the two sequents P ⊢ ⊥ and Q ⊢ ⊥.

QuantiĄer and Special Rules

R ∀

: Πα : type. ΠP : (term α → Prop). Πt : term α.

(prf

(P t) → prf⊥) → prf(∀ α P ) → prf⊥ R ¬∃ : Πα : type. ΠP : (term α → Prop). Πt : term α. (prf(¬(P t)) → prf⊥) → prf(¬(∃ α P )) → prf⊥ R ∃ : Πα : type. ΠP : (term α → Prop). (Πt : term α. prf(P t) → prf⊥) → prf(∃ α P ) → prf⊥ R ¬∀ : Πα : type. ΠP : (term α → Prop). (Πt : term α. prf(¬(P t)) → prf⊥) → prf(¬(∀ α P )) → prf⊥ R ∀type : ΠP : (type → Prop). Πα : type. (prf(P α) → prf⊥) → prf(∀ type P ) → prf⊥ R Subst : Πα : type. ΠP : (term α → Prop). Πt 1 , t 2 : term α. (prf(t 1 ̸ = α t 2 ) → prf⊥) → (prf(P t 2 ) → prf⊥) → prf(P t 1 ) → prf⊥ Figure 7.8: Deep Embedding of LLproof ≡ into λΠ ≡ (Part 2)
The corresponding Dedukti constant R ∨ has type:

R ∨ : ΠP, Q : Prop. (prfP → prf⊥) → (prfQ → prf⊥) → prf(P ∨ Q) → prf⊥
As an informal explanation, we can identify the turnstile ⊢ with the logical implication.

This means that, for two given propositions P and Q, if we give to R ∨ a proof that P implies ⊥ and a proof that Q implies ⊥, then we obtain a proof that P ∨ Q implies ⊥.

Shallow Embedding of LLproof

≡ into λΠ ≡
We present in Fig. 7.9 and Fig. 7.10 and Fig. 7.11 the shallow embedding of LLproof ≡ derivation rules into λΠ ≡ . This amounts to turn the static constants just deĄned in Fig. 7.7

and Fig. 7.8 into rewrite rules.

Remark

The shallow embedding gives a meaning to constants. For instance, if we consider the constant R ⊥ , the deep embedding of Fig. 7.7 is:

R ⊥ : prf⊥ → prf⊥
The type of this declaration corresponds to the statement Şfalse implies falseŤ. For the moment, this statement is just an axiom.

ExM id(P : Prop) : ΠQ : Prop. (prfP → prfQ) → (prf(¬P ) → prfQ) → prfQ N N P P (P : Prop) : prf(¬¬P ) → prfP := λH 1 : prf(¬¬P ). ExM id P P (λH 2 : prfP. H 2 ) (λH 3 : prf(¬P ). H 1 H 3 P ) We introduce in Fig. 7.9 the constant ExM id, which corresponds to the law of the excluded middle, and we do not provide any deĄnition for it Ű it remains as a type declaration. As λΠ ≡ is a constructive framework, it does not enjoy this property for free, and we must add it as an axiom. This is the only axiom that is added to Dedukti in our work. We need it to prove the lemma called N N P P in Fig. 7.9, a direct corollary that allows us to prove the LLproof ≡ rule ¬∀, a classical rule.

Contr(P : Prop, Q : Prop) : prf(P ⇒ Q) → prf(¬Q ⇒ ¬P ) := λH 1 : prf(P ⇒ Q).
We also deĄne a lemma Contr, corresponding to the law of the contraposition, as a convenience to prove some LLproof ≡ inference rules also.

All the proofs of LLproof ≡ inference rules given in Fig. 7.9 and Fig. 7.10 and Fig. 7.11 have been well checked by Dedukti.

Translation of LLproof ≡ Proofs

We now present the extension of the translation functions of Fig. 7.5 and Fig. 7.6

to LLproof ≡ proofs. We Ąrst introduce the translation of LLproof ≡ sequents into typing contexts.

♣φ 1 , . . . , φ n ⊢ ⊥♣ := x φ 1 : prf ♣φ 1 ♣ , . . . , x φn : prf ♣φ n ♣

The formulae φ 1 , . . . , φ n correspond to the axioms and hypotheses of the problem. The translation of an axiom φ is done by deĄning a new constant x φ which has the type prf ♣φ♣.

empty-set, membership to set diference and equality between sets which have been turned into rewrite rules. It should be noted that the equality considered here is not the common equality =, but a particular predicate symbol deĄned only for sets. We denote it set = and use the extensionality property of it (axiom SET4 of the B theory). Consequently, the signature of set = is diferent than the one of the common equality =.

In the following signatures, We do not indicate type arguments, only term arguments with the symbol -:

set :: 1 -∈ -: Πα. α × set(α) → o - set = -: Πα. set(α) × set(α) → o ∅ : Πα. set(α) ---: Πα. set(α) × set(α) → set(α)
And the rewrite rules, where type arguments are subscripted:

s set = α t -→ (α:Type,s:set(α),t:set(α)) ∀x : α. x ∈ α s ⇔ x ∈ α t x ∈ α ∅ α -→ (α:Type,x:α) ⊥ x ∈ α s -α t -→ (α:Type,s:set(α),t:set(α)) x ∈ α s ∧ x ̸ ∈ α t
We prove the formula, given a type τ :

∀s : set(τ ). s -τ s set = τ ∅ τ
The LLproof ≡ proof tree generated by Zenon Modulo is (we omit to repeat the context Γ):

⊥ ¬(c 2 ∈ τ c 1 -τ c 1 ), c 2 ∈ τ ∅ τ ⊢ ⊥ Ax c 2 ∈ τ c 1 , c 2 ̸ ∈ τ c 1 ⊢ ⊥ ∧ c 2 ∈ τ c 1 -τ c 1 , ¬(c 2 ∈ τ ∅ τ ) ⊢ ⊥ ¬ ⇔ ¬((c 2 ∈ τ c 1 -τ c 1 ) ⇔ (c 2 ∈ τ ∅ τ )) ⊢ ⊥ ¬∀ ¬(c 1 -τ c 1 set = τ ∅ τ ) ⊢ ⊥ ¬∀ ¬(∀s : set(τ ). s -τ s set = τ ∅ τ ) ⊢ ⊥
Remark It should be noted that some normalization steps are hidden in the proof. The Ąrst normalization occurs before the third application from the bottom of rule ¬∀, where the

atomic formula c 1 -τ c 1 set = τ ∅ τ has been rewritten into ∀x : τ. (x ∈ τ c 1 -τ c 1 ) ⇔ (x ∈ τ ∅ τ ).
A second normalization occurs before the application of the closure rule ⊥ on the left-hand branch, and the last one occurs before the application of the rule ∧ on the right-hand branch.

We obtain the Dedukti proof certiĄcate of Fig. 7.12 and Fig. 7.13.

= α t ↩→ ∀(α)(λx : (term α). x ∈ α s ⇔ x ∈ α t) x ∈ α ∅ α ↩→ ⊥ x ∈ α s -α t ↩→ x ∈ α s ∧ x ̸ ∈ α t
= τ ∅ τ ))) → prf⊥ []Goal ↩→ λx 2 : prf(¬(∀(set τ )(λs : (term set τ ).s -τ s set = τ ∅ τ ))). R ¬∀ (set τ ) (λs : (term set τ ).s -τ s set = τ ∅ τ ) (λc 1 : (term set τ ). λx 3 : prf(c 1 -τ c 1 ̸ = set τ ∅ τ ). R ¬∀ (τ ) (λx : (term τ ).(x ∈ τ c 1 -τ c 1 ) ⇔ (x ∈ τ ∅ τ )) (λc 2 : (term τ ). λx 4 : prf(¬((c 2 ∈ τ c 1 -τ c 1 ) ⇔ (c 2 ∈ τ ∅ τ ))). R ¬⇔ (c 2 ∈ τ c 1 -τ c 1 ) (c 2 ∈ τ ∅ τ ) (λx 5 : prf(¬(c 2 ∈ τ c 1 -τ c 1 )). λx 6 : prf(c 2 ∈ τ ∅ τ ). R ⊥ x 6 ) (λx 7 : prf(c 2 ∈ τ c 1 -τ c 1 )
. The methodology of the BWare project consists in building a generic platform of veriĄcation relying on diferent ATPs, such as Ąrst-order provers, and SMT solvers. This platform is built upon Why3 [START_REF] Bobot | Why3: Shepherd Your Herd of Provers[END_REF], a platform for deductive program veriĄcation which provides a rich language for speciĄcation and programming, called WhyML, and that relies on external provers to discharge veriĄcation conditions. The automated deduction tools used in the BWare framework are the ATP Zenon Modulo, the ATP iProver Modulo [START_REF] Burel | Experimenting with Deduction Modulo[END_REF]] and the SMT solver Alt-Ergo [START_REF] Bobot | The Alt-Ergo Automated Theorem Prover[END_REF]. The diversity of these theorem provers aims to allow a wide panel proof obligations to be automatically veriĄed by the platform.

λx 8 : prf(¬(c 2 ∈ τ ∅ τ )). R ∧ (c 2 ∈ τ c 1 ) (c 2 ̸ ∈ τ c 1 ) (λx 9 : prf(c 2 ∈ τ c 1 ). λx 10 : prf(c 2 ̸ ∈ τ c 1 ). R Ax (c 2 ̸ ∈ τ c 1 ) x 10 x 9 x 7 ) x 4 ) x 3 ) x 2 )
Beyond the multi-tool aspect of this methodology, the originality of BWare resides in the requirement for the veriĄcation tools to produce proof objects, which have to be checked independently.

To test the BWare platform, a large collection of proof obligations is provided by the industrial partners of the project, which develop tools implementing the B Method and applications involving the use of the B Method.

The BWare Toolchain

From B proof obligations to proof certiĄcates, the BWare project relies on a series of tools. We present in the following the toolchain involved.

Generating Proof Obligations

The generation of B proof obligations involves two diferent tools, the B integrated development environment Atelier B [ClearSy 2013] and a translation tool called bpo2why [START_REF] Mentré | Discharging Proof Obligations from Atelier B using Multiple Automated Provers[END_REF].

Atelier B

Atelier B [ClearSy 2013] is developed and distributed by ClearSy. This tool implements the B Method and has been designed to cover all the development stages of B projects. In particular, it allows to write speciĄcations and reĄnements, to generate the corresponding proof obligations, to prove these proof obligations automatically or interactively, and Ąnally to extract the resulting source code of a B project.

In the context of BWare, Atelier B is used to generate the proof obligations in their native format, denoted B-PO format.

bpo2why

bpo2why [START_REF] Mentré | Discharging Proof Obligations from Atelier B using Multiple Automated Provers[END_REF] The translation scheme implemented by bpo2why is not a simple syntactic translation.

It performs some non-trivial type inferences on proof obligations to rebuild typed proof obligations in the WhyML format. It also eliminates some non-Ąrst-order B constructions, like sets deĄned by comprehension.

Proving Proof Obligations

The second stage of the BWare toolchain concerns the veriĄcation of proof obligations. Why3 is the central tool of the platform and calls the automated deduction tools Zenon Modulo, iProver Modulo and Alt-Ergo.

The Why3 Platform

Why3 [START_REF] Bobot | Why3: Shepherd Your Herd of Provers[END_REF], a project carried by LRI, is a platform dedicated to program veriĄcation and which relies on external provers. The native language of Why3, called WhyML, is based on polymorphic Ąrst-order logic and is close to . Besides external provers, Why3 is provided with the SMT solver Alt-Ergo.

In the context of BWare, it is used to call provers on proof obligations. It manages the diferent input formats of provers, using particular encodings if needed through drivers.

Deduction Tools

As presented in Sec. Alt-Ergo [START_REF] Bobot | The Alt-Ergo Automated Theorem Prover[END_REF], developed by OCamlPro, is the Ąrst SMT solver to natively deal with polymorphism. It was originally designed to be the dedicated deduction tool of the platform Why3, thus the proof obligations provided by Why3 to Alt-Ergo are in its native format.

Zenon Arith [START_REF] Bury | Integrating Simplex with Tableaux[END_REF]] is an extension of Zenon to linear arithmetic developed by Bury. This extension can be used through Zenon Modulo, as we will see in experimental results in Sec. 8.4.

Proof Checkers

The last stage of the BWare toolchain consists in the proof checker Dedukti. Only Zenon Modulo and iProver Modulo can produce proof certiĄcates for the moment.

The B Set Theory

As shown in Sec. 8.2, the tool bpo2why translates B proof obligations into WhyML. But we did not mention the B set theory yet. We have to provide the theory to Why3 in WhyML format. The solution chosen in BWare is to deĄne the B set theory directly in WhyML. This solution difers from the presentation proposed in Sec. 5.4, therefore it is not consistent with the theoretical results presented in previous chapters. Nevertheless, these theoretical results ensure us that Poly-FOL is a fair candidate to deĄne the B set theory. In addition, a hand-made B theory in WhyML allows us to choose the most efective deĄnitions of B operators while being faithful to the original B deĄnitions (see the discussion at Sec. 5.4.3).

The solution proposed is to deĄne directly the rewrite rules for the derived constructs.

The resulting rewrite rules are mostly propositional and based on the membership predicate symbol. In addition, we preserve the proper typing constraints coming from the real axioms.

The translation of the deĄnition of the union, as presented in Sec. 5.4.3, lead us to deĄne a function symbol f such that we have the rewrite rule:

x ∈ α f (α; u, s, t) -→ Γ L x ∈ α u ∧ (x ∈ α s ∨ x ∈ α t)
where Γ L := (α : Type, x : α, u : set(α), s : set(α), t : set(α)).

In the rewrite rule above, the variable u is not needed anymore to preserve the well typedness, since we have the typing constraints represented in Γ L for x, s and t. So, we choose to deĄne the rewrite rule for set union as follows:

x ∈ α s ∪ α t -→ Γ L x ∈ α s ∨ x ∈ α t
where Γ L := (α : Type, x : α, s : set(α), t : set(α)), and the function symbol ∪(α; s, t) is noted with an inĄx syntax.

We now introduce the hand-made B set theory modulo used by Zenon Modulo in BWare.

The deĄnitions of these rewrite rules are done in the spirit of the example above.

The presentation follows the order of Sec. 1.2.3.2. We give, for all the introduced symbols, its type signature and the corresponding rewrite rule. In addition, we use an inĄx notation and subscript type parameters. For type signatures, we point out the position of term arguments with the symbol Ş-Ť and we do not explicitly write type arguments.

Finally, to lighten the presentation, we do not give local contexts of the rewrite rules since types of arguments are given in type signatures.

The translation tool bpo2why uses a particular predicate symbol for set equality (see Sec. 7.5). This allows us to reduce equality between sets using the extensionality, which is quite efective in practice. In the following, we use:

- set = -: Πα. set(α) × set(α) → o
to denote the set equality, which is supposed to be diferent from the usual equality -= -: Πα. α × α → o

Core Theory

First, we present the signatures of primitive symbols (see Sec. 4.1.1).

set :: 1 tup :: 2 (-, -) : Πα 1 α 2 . α 1 × α 2 → tup(α 1 , α 2 ) P(-) : Πα. set(α) → set(set(α)) -× -: Πα 1 α 2 . set(α 1 ) × set(α 2 ) → set(tup(α 1 , α 2 )) -∈ -: Πα. α × set(α) → o - set = -: Πα. set(α) × set(α) → o
Then, we turn the three axioms SET1, SET2 and SET4 into rewrite rules.

(x, y) α 1 ,α 2 ∈ tup(α 1 ,α 2 ) s × α 1 ,α 2 t -→ x ∈ α 1 s ∧ y ∈ α 2 t s ∈ set(α) P α (t) -→ ∀x : α. x ∈ α s ⇒ x ∈ α t s set = α t -→ ∀x : α. x ∈ α s ⇔ x ∈ α t
We do not remove the axiom SET4 (with the common equality symbol =) from the resulting theory because it may be necessary for some proof obligations.

Set Inclusion

The two constructs for set inclusions can be seen as syntactic sugar, using the membership to the powerset.

-⊆ -: Πα. set(α) × set(α) → o -⊂ -: Πα. set(α) × set(α) → o s ⊆ α t -→ s ∈ set(α) P α (t) s ⊂ α t -→ s ⊆ α t ∧ ¬(s set = α t)

Basic Set Theory Derived Constructs

The following rewrite rules for union, intersection, diference and singleton do not use the typing set u of the original B deĄnition (see Sec. 5.4.3). In addition, we change the deĄnition of the empty-set because we do not want to use the set BIG in practice.

-

∪ -: Πα. set(α) × set(α) → set(α) -∩ -: Πα. set(α) × set(α) → set(α) ---: Πα. set(α) × set(α) → set(α) ¶-♢ : Πα. α → set(α) ∅ : Πα. set(α) P 1 (-) : Πα. set(α) → set(set(α)) x ∈ α s ∪ α t -→ x ∈ α s ∨ x ∈ α t x ∈ α s ∩ α t -→ x ∈ α s ∧ x ∈ α t x ∈ α s -α t -→ x ∈ α s ∧ x ̸ ∈ α t x ∈ α ¶a♢ α -→ x = α a x ∈ α ∅ α -→ ⊥ P 1α (s) -→ P α (s) -set(α) ¶∅ α ♢ set(α)
Binary Relations: First Series

The Ąrst series of constructs related to binary relations. In the following, we omit type parameters to enlighten notation when it is clear from the context.

-

↔ -: Πα 1 α 2 . set(α 1 ) × set(α 2 ) → set(set(tup(α 1 , α 2 ))) --1 : Πα 1 α 2 . set(tup(α 1 , α 2 )) → set(tup(α 2 , α 1 )) dom(-) : Πα 1 α 2 . set(tup(α 1 , α 2 )) → set(α 1 ) ran(-) : Πα 1 α 2 . set(tup(α 1 , α 2 )) → set(α 2 ) -; -: Πα 1 α 2 α 3 . set(tup(α 1 , α 2 )) × set(tup(α 2 , α 3 )) → set(tup(α 1 , α 3 )) -• -: Πα 1 α 2 α 3 . set(tup(α 2 , α 3 )) × set(tup(α 1 , α 2 )) → set(tup(α 1 , α 3 )) id(-) : Πα. set(α) → set(tup(α, α)) -✁ -: Πα 1 α 2 . set(α 1 ) × set(tup(α 1 , α 2 )) → set(tup(α 1 , α 2 )) -✄ -: Πα 1 α 2 . set(tup(α 1 , α 2 )) × set(α 2 ) → set(tup(α 1 , α 2 )) -✁ --: Πα 1 α 2 . set(α 1 ) × set(tup(α 1 , α 2 )) → set(tup(α 1 , α 2 )) -✄ --: Πα 1 α 2 . set(tup(α 1 , α 2 )) × set(α 2 ) → set(tup(α 1 , α 2 )) p ∈ set(tup(α 1 ,α 2 )) u ↔ α 1 ,α 2 v -→ ∀x : α 1 . ∀y : α 2 . (x, y) ∈ tup(α 1 ,α 2 ) p ⇒ x ∈ α 1 u ∧ y ∈ α 2 v (y, x) ∈ tup(α 2 ,α 1 ) p -1 α 2 ,α 1 -→ (x, y) ∈ tup(α 1 ,α 2 ) p x ∈ α 1 dom α 1 ,α 2 (p) -→ ∃b : α 2 . (x, b) ∈ tup(α 1 ,α 2 ) p y ∈ α 2 ran α 1 ,α 2 (p) -→ ∃a : α 1 . (a, y) ∈ tup(α 1 ,α 2 ) p (x, z) ∈ tup(α 1 ,α 3 ) p; α 1 ,α 2 ,α 3 q -→ ∃b : α 2 . (x, b) ∈ tup(α 1 ,α 2 ) p ∧ (b, z) ∈ tup(α 2 ,α 3 ) q q • α 1 ,α 2 ,α 3 p -→ p; α 1 ,α 2 ,α 3 q (x, y) ∈ tup(α,α) id α (u) -→ x ∈ α u ∧ x = α y (x, y) ∈ tup(α 1 ,α 2 ) s ✁ α 1 ,α 2 p -→ (x, y) ∈ tup(α 1 ,α 2 ) p ∧ x ∈ α 1 s (x, y) ∈ tup(α 1 ,α 2 ) p ✄ α 1 ,α 2 t -→ (x, y) ∈ tup(α 1 ,α 2 ) p ∧ y ∈ α 2 t (x, y) ∈ tup(α 1 ,α 2 ) s ✁ -α 1 ,α 2 p -→ (x, y) ∈ tup(α 1 ,α 2 ) p ∧ x ̸ ∈ α 1 s (x, y) ∈ tup(α 1 ,α 2 ) p ✄ -α 1 ,α 2 t -→ (x, y) ∈ tup(α 1 ,α 2 ) p ∧ y ̸ ∈ α 2 t
Binary Relations: Second Series

The second series of constructs related to binary relations.

-

[-] : Πα 1 α 2 . set(tup(α 1 , α 2 )) × set(α 1 ) → set(α 2 ) -+ + + < -: Πα 1 α 2 . set(tup(α 1 , α 2 )) × set(tup(α 1 , α 2 )) → set(tup(α 1 , α 2 )) -⊗ -: Πα 1 α 2 α 3 . set(tup(α 1 , α 2 )) × set(tup(α 1 , α 3 )) → set(tup(α 1 , tup(α 2 , α 3 ))) prj 1 (-) : Πα 1 α 2 . tup(set(α 1 ), set(α 2 )) → set(tup(tup(α 1 , α 2 ), α 1 )) prj 2 (-) : Πα 1 α 2 . tup(set(α 1 ), set(α 2 )) → set(tup(tup(α 1 , α 2 ), α 2 )) -♣♣-: Πα 1 α 2 α 3 α 4 . set(tup(α 1 , α 2 )) × set(tup(α 3 , α 4 )) → set(tup(tup(α 1 , α 3 ), tup(α 2 , α 4 ))) x ∈ α 2 p[w] α 1 ,α 2 -→ ∃a : α 1 . a ∈ α 1 w ∧ (a, x) ∈ tup(α 1 ,α 2 ) p (x, y) ∈ tup(α 1 ,α 2 ) q + + + < α 1 ,α 2 p -→ ((x, y) ∈ tup(α 1 ,α 2 ) q ∧ x ̸ ∈ α 1 dom α 1 ,α 2 (p)) ∨ (x, y) ∈ tup(α 1 ,α 2 ) p (x, (y, z)) ∈ tup(α 1 ,tup(α 2 ,α 3 )) f ⊗ α 1 ,α 2 ,α 3 g -→ (x, y) ∈ tup(α 1 ,α 2 ) f ∧ (x, z) ∈ tup(α 1 ,α 3 ) g ((x, y), z) ∈ tup(tup(α 1 ,α 2 ),α 1 ) prj 1α 1 ,α 2 (s, t) -→ ((x, y), z) ∈ tup(tup(α 1 ,α 2 ),α 1 ) (s × α 1 ,α 2 t) × tup(α 1 ,α 2 ),α 1 s ∧ x = α 1 z ((x, y), z) ∈ tup(tup(α 1 ,α 2 ),α 2 ) prj 2α 1 ,α 2 (s, t) -→ ((x, y), z) ∈ tup(tup(α 1 ,α 2 ),α 2 ) (s × α 1 ,α 2 t) × tup(α 1 ,α 2 ),α 2 t ∧ y = α 2 z ((x, y), (z, w)) ∈ tup(tup(α 1 ,α 3 ),tup(α 2 ,α 4 )) h♣♣ α 1 ,α 2 ,α 3 ,α 4 k -→ (x, z) ∈ tup(α 1 ,α 2 ) h ∧ (y, w) ∈ tup(α 3 ,α 4 )

Function Constructs

The constructs related to functions.

-

→ -: Πα 1 α 2 . set(α 1 ) × set(α 2 ) → set(set(tup(α 1 , α 2 ))) -→ -: Πα 1 α 2 . set(α 1 ) × set(α 2 ) → set(set(tup(α 1 , α 2 ))) -↣ -: Πα 1 α 2 . set(α 1 ) × set(α 2 ) → set(set(tup(α 1 , α 2 ))) -↣ -: Πα 1 α 2 . set(α 1 ) × set(α 2 ) → set(set(tup(α 1 , α 2 ))) -↠ -: Πα 1 α 2 . set(α 1 ) × set(α 2 ) → set(set(tup(α 1 , α 2 ))) -↠ -: Πα 1 α 2 . set(α 1 ) × set(α 2 ) → set(set(tup(α 1 , α 2 ))) -↣ ↠ -: Πα 1 α 2 . set(α 1 ) × set(α 2 ) → set(set(tup(α 1 , α 2 ))) -↣ ↠ -: Πα 1 α 2 . set(α 1 ) × set(α 2 ) → set(set(tup(α 1 , α 2 ))) f ∈ set(tup(α 1 ,α 2 )) s → α 1 ,α 2 t -→ f ∈ set(tup(α 1 ,α 2 )) s ↔ α 1 ,α 2 t∧ (∀x : α 1 . ∀y, z : α 2 . (x, y) ∈ tup(α 1 ,α 2 ) f ∧ (x, z) ∈ tup(α 1 ,α 2 ) f ⇒ y = α 2 z) f ∈ set(tup(α 1 ,α 2 )) s → α 1 ,α 2 t -→ f ∈ set(tup(α 1 ,α 2 )) s → α 1 ,α 2 t ∧ dom α 1 ,α 2 (f ) set = α 1 s f ∈ set(tup(α 1 ,α 2 )) s ↣ α 1 ,α 2 t -→ f ∈ set(tup(α 1 ,α 2 )) s → α 1 ,α 2 t ∧ f -1 α 1 ,α 2 ∈ set(tup(α 1 ,α 2 )) t → α 2 ,α 1 s f ∈ set(tup(α 1 ,α 2 )) s ↣ α 1 ,α 2 t -→ f ∈ set(tup(α 1 ,α 2 )) s ↣ α 1 ,α 2 t ∧ f ∈ set(tup(α 1 ,α 2 )) s → α 1 ,α 2 t f ∈ set(tup(α 1 ,α 2 )) s ↠ α 1 ,α 2 t -→ f ∈ set(tup(α 1 ,α 2 )) s → α 1 ,α 2 t ∧ ran α 1 ,α 2 (f ) set = α 2 t f ∈ set(tup(α 1 ,α 2 )) s ↠ α 1 ,α 2 t -→ f ∈ set(tup(α 1 ,α 2 )) s ↠ α 1 ,α 2 t ∧ f ∈ set(tup(α 1 ,α 2 )) s → α 1 ,α 2 t f ∈ set(tup(α 1 ,α 2 )) s ↣ ↠ α 1 ,α 2 t -→ f ∈ set(tup(α 1 ,α 2 )) s ↣ α 1 ,α 2 t ∧ f ∈ set(tup(α 1 ,α 2 )) s ↠ α 1 ,α 2 t f ∈ set(tup(α 1 ,α 2 )) s ↣ ↠ α 1 ,α 2 t -→ f ∈ set(tup(α 1 ,α 2 )) s ↣ α 1 ,α 2 t ∧ f ∈ set(tup(α 1 ,α 2 )) s ↠ α 1 ,α 2 t

BWare Experimental Results

We present in this section the experimental results obtained over the BWare benchmark.

These results allow to test our tool Zenon Modulo. The lines ŞProofsŤ and ŞRateŤ correspond respectively to the number and the percentage of POs that have been proved by the corresponding tool. The line ŞTimeŤ gives the mean times, in second, taken to prove a PO. Finally, the line ŞUniqueŤ gives the number of POs proved only by the corresponding tool.

The results of Tab. 8.1 are very conclusive. We remark that each extension improves the number of POs being proved.

Our Ąrst contribution, the extension of Zenon to polymorphism, allows to improve the number of proved POs from 337 to 6,251, i.e. an increase of 1,755 %. We can conclude from this result that dealing natively with polymorphism is better than relying on an encoding, at least for this benchmark.

Our second contribution to Zenon, the extension to deduction modulo theory, is also very conclusive. It allows to prove 4,089 more POs, corresponding to an increase of 65 % with respect to polymorphic typed version. We can conclude from this result that deduction modulo theory is quite efective to improve proof search in the B set theory. In addition, if we combine Zenon Modulo and Zenon Arith, we raise the number of proved POs to 12,281,

i.e. a percentage of 95.4 %. This is exactly ten percentage points more than mp, the native prover of Atelier B (which also deals with arithmetic).

The combination of Zenon Modulo and Zenon Arith performs well. We remark that Zenon Mod+Ari proves 1,941 more POs than Zenon Modulo, and that Zenon Arith proves 1,155

POs more than Zenon Typed. Thus, we can deduce that Zenon Modulo helps Zenon Arith to prove 786 POs which need arithmetic reasoning and that it could not prove before. This is an unexpected and satisfying behavior.

It should be noted also that a mean time per PO smaller than 3 seconds is reasonable.

The experimental protocol does not allow us to compare this mean time to the one of mp.

Finally, the last important information provided by these results are the number of We present in Fig. 8.1 the same results than in Tab. 8.1. The goal of this Ągure is to represent the cumulative time spent to prove all the POs. We select only the POs that have been proved, and, for each tool, we ordered them from the fastest to prove to the longest.

We remark that for the four implementations of Zenon using polymorphism, the cumulative time is increasing linearly for around the Ąrst 80 % POs. In fact, the mean time spent for these 80 % POs is less than 0.5 seconds, which is much lower than the 3 seconds of Tab. 8.1.

Remark Zenon Modulo can generate proof certiĄcates for all the 10,340 proofs found. All these 10,340 proofs certiĄcates are checked well by Dedukti (this output was switched of for the benchmark). This is not yet possible to generate proof certiĄcates for Zenon Arith, thus for its combination with Zenon Modulo.

General Results

We compare in Tab. The experimental results obtained over the BWare benchmark, a set made of 12,876 B proof obligations coming from real industrial projects, was very conclusive and allowed us to validate our work on Zenon Modulo. In particular, this experiment showed that each of the two extensions implemented in Zenon Modulo improves strongly the total number of proof obligations that are proved by Zenon Modulo.

To increase the conĄdence in the soundness of the proofs produced by Zenon Modulo, we choose to generate proof certiĄcates, proof objects that have to be veriĄed by external tools. We relied on Dedukti to certify our proofs, an eicient proof checker that implements the λΠ-calculus modulo theory, and which is well-suited to check proofs that use rewriting techniques. This allowed us to verify all the proofs produced by Zenon Modulo in the BWare benchmark.

In Finally, these two ideas could be combined to use Zenon Modulo as a generator of formal B proofs using proof traces from external tools. The main beneĄt from this approach would be its adaptive use in an industrial context. The certiĄcation requirements for an industrial use would only deal with the B proof checker, letting all external tools out of the Ştrusted zoneŤ and allowing us to beneĄt from improvements made by ATP developers.

Résumé de la thèse

  Mots clés : Méthode B, Théorie des ensembles, Zenon Modulo, Déduction automatique, Déduction modulo théorie, Méthode des tableaux, Calcul des séquents, Polymorphisme, Dedukti, λΠ-calcul modulo théorie, CertiĄcation de preuve. My Ąrst thoughts go to my doctoral advisors, David Delahaye, Olivier Hermant and Damien Doligez. I discovered formal methods and proof theory thanks to David, four years ago as a student at Cnam. I would never have started this PhD without meeting you Ąrst David. So I will always be grateful to you for trusting me and helping me during this whole adventure. Thank you very much Olivier for your suitable advice, in particular during the last year and the writing of my manuscript, which I would never have Ąnished without you. This PhD has been an existing journey with both of you, from South Africa to Fiji Islands and Connecticut ! Thank you very much Damien for your help on Zenon and your expert advice about OCaml. I was very lucky to have the three of you as my advisors ! I am very grateful to Stéphane Graham-Lengrand and Dominique Méry for accepting to review my thesis. Thank you very much for the time you spent on my manuscript and your encouraging remarks. I also want to thank Véronique Delebarre, Thérèse Hardin and Régine Laleau for having immediately agreed to be member of my thesis defense jury. These three years would not have been so stimulating without my colleagues of Deducteam. I am very grateful to Gilles Dowek for welcoming me so friendly in his team. The good mood in Deducteam is really thanks to you. I also want to thank the other PhD candidates of Deducteam, Raphaël Cauderlier, Frédéric Gilbert, Guillaume Bury, Ronan Contents Introduction 1 The B Method 1.1 Presentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Logic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.1 Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.2 Proof System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2.3 B Set Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Type System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.1 A Hierarchy in Set Inclusion . . . . . . . . . . . . . . . . . . . . . . 1.3.2 Type Checking Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.3 Type Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.4 Notion of Given Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3.5 Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Type Inference for B Variables 2.1 A Lack of Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Type Annotation for B Variables . . . . . . . . . . . . . . . . . . . . . . . . 2.2.1 Bound Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.2 New Syntactic Category for Types . . . . . . . . . . . . . . . . . . . List of Tables 6.1 Experimental Results over the TPTP TFF1 Benchmark (Part 1) . . . . . . 6.2 Experimental Results over the TPTP TFF1 Benchmark (Part 2) . . . . . . 6.3 Experimental Results over the B-Book Lemmas Benchmark (Part 1) . . . . 6.4 Experimental Results over the B-Book Lemmas Benchmark (Part 2) . . . . 8.1 Experimental Results over the BWare Benchmark (Part 1) . . . . . . . . . . 8.2 Experimental Results over the BWare Benchmark (Part 2) . . . . . . . . . .List of Figures1.1 The B Method Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.2 Non-Freeness Rules for B Constructs . . . . . . . . . . . . . . . . . . . . . . 1.3 The Proof System of the B Method . . . . . . . . . . . . . . . . . . . . . . . 1.4 The B Set Theory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.5 Basic B Set Theory Derived Constructs . . . . . . . . . . . . . . . . . . . . 1.6 Binary Relation Constructs (Part 1) . . . . . . . . . . . . . . . . . . . . . . 1.7 Binary Relation Constructs (Part 2) . . . . . . . . . . . . . . . . . . . . . . 1.8 Sets of Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.9 B Type-Checking Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.10 The Type System of the B Method . . . . . . . . . . . . . . . . . . . . . . . 2.1 The Annotated Axioms of the B Set Theory . . . . . . . . . . . . . . . . . . 2.2 ModiĄed B Method Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1 Context Well-Formedness in Poly-FOL . . . . . . . . . . . . . . . . . . . . . 3.2 Type System of Poly-FOL . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3 LLproof Inference Rules of Zenon (Part 1) . . . . . . . . . . . . . . . . . . . 3.4 LLproof Inference Rules of Zenon (Part 2) . . . . . . . . . . . . . . . . . . . 4.1 Translation from B to Poly-FOL . . . . . . . . . . . . . . . . . . . . . . . . 4.2 Translation from Poly-FOL to B . . . . . . . . . . . . . . . . . . . . . . . .

Figure 1

 1 Figure 1.6: Binary Relation Constructs (Part 1)

Figure 2 . 1 :

 21 Figure 2.1: The Annotated Axioms of the B Set Theory

a

  mere adaptation of [Blanchette, Böhme, Popescu, and Smallbone 2013; Blanchette and Paskevich 2013].

Figure 3

 3 Figure 3.1: Context Well-Formedness in Poly-FOL

Figure 4 . 1 :

 41 Figure 4.1: Translation from B to Poly-FOL

Figure 4 . 2 :

 42 Figure 4.2: Translation from Poly-FOL to B

e

  and ⟨P ⋆s ⟩ mono f are any monomorphic instance of ⟨E ⋆s ⟩ e and ⟨P ⋆s ⟩ f respectively.

Figure 4 . 4 :

 44 Figure 4.4: Translation of LLproof Rules into B Proof System (Part 2)

  LLproof Cut Rule into B In Sec. 5.3.4, we used the LLproof Cut rule to translate LLproof ≡ proofs. So, we need to extend Figs. 4.3 and 4.4 by deĄning the translation of the LLproof Cut rule into B Natural Deduction.

1968[

  [START_REF] Raymond M Smullyan | First-Order Logic[END_REF], that uniĄes and simpliĄes the analytic Tableau method of Beth in 1955[START_REF] Evert | Semantic Entailment and Formal Derivability[END_REF], and the theory of model sets of[START_REF] Hintikka | Form and Content in QuantiĄcation Theory[END_REF][START_REF] Hintikka | Form and Content in QuantiĄcation Theory[END_REF]].

The

  TFF1 format [Blanchette and Paskevich 2013] is a new format proposed to the TPTP community in 2013. It extends the format TFF0 to polymorphic types. The polymorphic problems of TFF1 is not yet an oicial category in the competition CASC.

  of Poly-FOL into FOL. This question was largely studied and leads to many diferent encodings [Blanchette, Böhme, Popescu, and Smallbone 2013]. The veriĄcation platform Why3 [Bobot, Filliâtre, Marché, and Paskevich 2011] implements diferent encodings of Poly-FOL into FOL proposed by Blanchette in [Blanchette, Böhme, Popescu, and Smallbone 2013]. The default encoding is called Şfeatherweight tagsŤ (denoted t??) in [Blanchette, Böhme, Popescu, and Smallbone 2013] and the second one tested in the following is called Şfeatherweight guardsŤ (denoted g??). These encodings are used in the rest of this chapter to compare the untyped version of Zenon to the one using the new extension to polymorphism.

  witness ( A ) ) = witness ( A ) ) ) . fof ( power_sort , axiom , ![ A ]: ![ X ]: ( sort ( set ( set ( A ) ) , power (A , X ) ) = power (A , X ) ) ) . fof ( mem_power , axiom , ![ A ]: ![ S , T ]: (( mem ( set ( A ) , S , power (A , T ) ) = > ![ X ]: ( mem (A , X , S ) = > mem (A , X , T ) ) ) & (![ X ]:

  A , X , S ) = > mem (A , X , T ) ) ) & (![ X ]:

Figure 7 . 2 :

 72 Figure 7.2: The λΠ-Calculus Modulo Theory

Fig

  Fig. 7.3. Primitive Types

Figure 7 . 3 :

 73 Figure 7.3: Dedukti Declarations of Poly-FOL Symbols

Figure 7

 7 Figure 7.6: Translation Functions from Poly-FOL into λΠ ≡ (Part 2)

  refer to λΠ ≡ of Fig. 7.2. Proof 1. We perform a proof by induction on the structure of τ . The base case is Γ G , Γ L ⊢ α : Type. a. By TVar of Fig. 6.4 we have α : Type ∈ Γ L b. The translation of Fig. 7.5 tells us that α : type ∈ ♣Γ L ♣, so ♣Γ L ♣ ⊢ α : type The general case is Γ G , Γ L ⊢ T (τ 1 , . . . , τ m ) : Type a. TConstr of Fig. 6.4 tells us that T :: m ∈ Γ G and Γ G , Γ L ⊢ τ i : Type b. By induction hypothesis, for i = 1, . . . , n ♣Γ G ♣ , ♣Γ L ♣ ⊢ ♣τ i ♣ : type c. By the translation of Fig. 7.5, T : type → . . . → type → type ∈ ♣Γ G ♣ d. Then, rule App of Fig. 7.2 tells us that

Figure 7 . 7 :

 77 Figure 7.7: Deep Embedding of LLproof ≡ into λΠ ≡ (Part 1)

Figure 7 .

 7 Figure 7.11: Shallow Embedding of LLproof ≡ into λΠ ≡ (Part 3)

  set -: type → type τ : type -∈ --: Πα : type. term α → term set α → Prop set = --: Πα : type. set α → set α → Prop ∅ -: Πα : type. set α -α -: Πα : type. set α → set α → set α s set

Figure 7 .

 7 Figure 7.12: Dedukti Proof CertiĄcate in B Set Theory (Part 1)

Figure 7 .

 7 Figure 7.13: Dedukti Proof CertiĄcate in B Set Theory (Part 2)

  is a tool developed by Mitsubishi Electric R&D for the BWare project. It allows to translate proof obligations from the B PO format into WhyML, the language of the Why3 platform. For the moment, bpo2why is a proprietary software.

  8.1, the three automated deduction tools of BWare are Zenon Modulo, iProver Modulo and Alt-Ergo. iProver Modulo [Burel 2011], developed by Burel, is an extension of the resolution and instantiation based Ąrst-order logic ATP iProver [Korovin 2008] to deduction modulo theory. The input Ąles of iProver Modulo are typically in the TPTP FOF format Ű it does not understand polymorphism. The proof obligations provided by Why3 to iProver Modulo are in the TPTP FOF format, resulting in an encoding of polymorphism into untyped Ąrst-order logic (see Sec. 6.4.2).

  Figure 8.2: Cumulative Times According to the Numbers of Proved POs

  machine abstraite, jusquŠà son implémentation concrète. Les programmes informatiques ainsi développés sont dits corrects par construction, grâce à un processus de rainement de la machine abstraite jusquŠà une dernière machine B complètement déterministe, appelée B0. La dernière étape dŠextraction du code source consiste en une traduction pratiquement syntaxique de la machine B0 vers un sous-ensemble dŠun langage impératif de bas niveau tels que les langages C ou ADA. La correction de chacune des étapes de rainement dépend de la validité de formules logiques, appelée obligations de preuve, et exprimées dans une théorie des ensembles spéciĄque à la méthode B.Les projets industriels utilisant la méthode B génèrent en général des milliers dŠobligations de preuve. Ils dépendent donc fortement dŠoutils automatiques pour décharger le plus grand nombre possible dŠobligations de preuve. Un environnement de développement intégré spéciĄque au développement de logiciels avec la méthode B, appelé Atelier B [ClearSy 2013], est fourni avec un outil de démonstration de théorème qui aide les utilisateurs à vériĄer la validité des obligations de preuve, automatiquement ou interactivement. LŠoutil de déduction automatique de lŠAtelier B prouve environ 85% des obligations de preuve des projets industriels communs, laissant ainsi des milliers dŠobligations de preuve à décharger interactivement, cŠest-à-dire avec une intervention humaine. Le manque dŠautomatisation dans le développement de projets en méthode B est un facteur de coût très important pour les industriels, ralentissant ainsi sa difusion et son utilisation.Notre travail vise à améliorer la vériĄcation automatique des obligations de preuve de la méthode B, avec une attention particulière portée sur la correction des preuves produites.Notre principale contribution est le développement dŠun outil de déduction automatique au premier ordre appelé Zenon Modulo. Cet outil étend Zenon[START_REF] Bonichon | Zenon: An Extensible Automated Theorem Prover Producing Checkable Proofs[END_REF], un outil de déduction automatique au premier ordre implémentant la méthode des tabeaux. La méthode des tableaux[START_REF] Dšagostino | Handbook of Tableau Methods[END_REF] est un algorithme de recherche automatique de preuve pour le calcul des séquents sans coupure. En théorie de la preuve, le calcul des séquents[START_REF] Gentzen | Untersuchungen über das logische Schließen[END_REF]] est une famille de systèmes formels dirigés par la syntaxe et utilisés pour écrire des preuves. Un calcul des séquents est déĄni par un ensemble de règles dŠinférence. Une règle dŠinférence est un objet logique déĄnissant une relation syntaxique entre un ensemble de formules, appelées prémisses, et un autre ensemble de formules, appelées conclusions, et correspondant à une étape de déduction élémentaire. Ces types de systèmes sont appelés des systèmes de preuve.Les preuves obtenues par la méthode des tableaux peuvent être facilement traduites dans le calcul des séquents, puisque quŠil ne sŠagit que dŠune reformulation syntaxique.Dans notre travail, nous nŠavons pas besoin de toutes les notions présentes dans la méthode B, en particulier celles relatives au langage B. Nous nous concentrons uniquement sur le raisonnement mathématique dans la méthode B, ce qui consiste principalement à étudier la théorie des ensembles de la méthode B. Améliorer la recherche automatique de preuve de Zenon pour la méthode B nous a mené au développement de deux extensions.La première est une extension de la logique aux types polymorphes et la seconde est une extension à la déduction modulo théorie. La motivation de ces deux extensions est de gérer eicacement la théorie des ensembles de la méthode B.La théorie des ensembles de la méthode B difère des autres telle que la théorie des ensembles de Zermelo-Fraenkel. La principale diférence consiste en lŠaddition de contraintes de typage aux expressions du langage. Ces contraintes de typage sont exprimées à lŠaide des constructions ensemblistes du langage, ce faisant il nŠy a aucune distinction syntaxique entre les types et les ensembles. Pour vériĄer la bon typage des expressions, le B-Book fournit un ensemble de règles dŠinférence de typage, déĄnissant une procédure de vériĄcation de type qui doit être appliquée avant la recherche de preuve. Nous montrons dans le Chap. 4 que les formules de la méthode B qui sont des axiomes et des hypothèses peuvent être interprétées comme des formules polymorphes, au sens où elles sont déĄnies pour des types génériques. Une fois lŠobligation de preuve Ąxée, qui elle nŠest pas polymorphe, les types génériques des axiomes et des hypothèses doivent être instanciés avec les types concrets venant de lŠobligation de preuve.La théorie des ensembles de la méthode B est composée de six axiomes, en plus dŠun grand nombre de constructeurs dérivés. Ces constructeurs dérivés, comme lŠunion de deux ensembles, le domaine dŠune relation et lŠensemble des fonctions injectives totales, ont un rôle majeur dans la méthode B car ils sont très présents dans les obligations de preuve.Ainsi, il est important de traiter eicacement ces constructeurs dérivés. Nous avons choisi dŠutiliser la déduction modulo théorie[START_REF] Dowek | Theorem Proving Modulo[END_REF]] pour améliorer la recherche de preuve dans la théorie des ensembles de la méthode B. La déduction modulo théorie est un formalisme qui étend la logique du premier ordre avec des règles de réécriture sur les termes et les propositions, permettant ainsi dŠaméliorer la recherche de preuve dans les théories axiomatiques en transformant les axiomes en règles de réécriture. Cela nous permet de distinguer les étapes de déduction des étapes de calcul en raisonnant sur des classes dŠéquivalence de formules, modulo une relation de congruence générée par le système de réécriture.Les outils de déduction automatique sont généralement des outils logiciels de taille importante, utilisant des fonctionnalités sophistiquées et implémentant des optimisations complexes. Par exemple, Zenon Modulo est composé de plus de 40.000 lignes de code OCaml. Le risque augmentant avec la taille et la complexité, des sources potentielles de mauvais comportements et de bugs peuvent apparaître dans les outils de déduction automatique. Lorsque lŠon cherche à vériĄer la validité dŠobligations de preuve dans le cadre dŠun développement de logiciel critique, garantir la correction des preuves produites par les outils de déduction automatique est une tache fondamentale.Barendregt et Barendsen[START_REF] Barendregt | Autarkic Computations in Formal Proofs[END_REF] ont proposé de sŠappuyer sur le concept de certiĄcats de preuve, des objets de preuve qui contiennent un énoncé et sa preuve formelle et qui peuvent être vériĄés par des outils externes. LŠoriginalité de cette approche est de séparer la génération des certiĄcats de preuve, efectuée par les outils de déduction automatique, et la vériĄcation de la correction des preuves, déléguée au vériĄcateur externe. Idéalement, le vériĄcateur de preuve utilisé doit être basé sur un noyau léger et auditable, au sens où il doit être sensiblement plus petit que lŠoutil de déduction automatique. De ce point de vue, une autre contribution importante à Zenon Modulo est le développement dŠune sortie qui génère des certiĄcats de preuve pour le vériĄcateur de preuve Dedukti. Dedukti [Assaf, Burel, Cauderlier, Delahaye, Dowek, Dubois, Gilbert, Halmagrand, Hermant, and Saillard 2016] est une implémentation légère du λΠ-calcul modulo théorie, une extension du λ-calcul simplement typé aux types dépendants et à la réécriture. Dedukti a été conçu pour être utilisé comme un vériĄcateur universel de preuve, pouvant provenir autant dŠoutil de déduction automatique tel que Zenon Modulo que dŠassistant de preuve tel que Coq [Bertot and Castéran 2013]. LŠutilisation de Zenon Modulo, dont la logique sous-jacente est la logique du premier ordre avec typage polymorphe, pour prouver des obligations de preuve exprimées dans la logique de la méthode B et sa théorie des ensembles, peut légitimement soulever des questions. Nous avons répondu à cette problématique dŠune manière originale en déĄnissant un encodage des formules B dans la logique du premier ordre avec typage polymorphe. Une des particularités de cet encodage se situe au niveau de la génération des types des expressions dans la logique polymorphe. Cet encodage repose sur une étape dŠinférence des types des variables liées des formules B. De plus, nous avons déĄni une traduction des preuves de Zenon Modulo, exprimées dans un calcul des séquents typé, vers le système de preuve de la méthode B, une adaptation de la déduction naturelle à la syntaxe de la méthode B. EnĄn, nous avons montré que la preuve B ainsi obtenue correspond bien à une preuve de lŠobligation de preuve initiale. Cette méthode nous permet ainsi dŠaugmenter la conĄance globale quant à la correction de notre approche. RÉSUMÉ Notre travail fait partie du projet BWare [Delahaye, Dubois, Marché, and Mentré 2014], un projet de recherche industrielle soutenu par lŠAgence Nationale de la Recherche. BWare a pour objectif de fournir une plateforme intégrée pour la vériĄcation automatique des obligations de preuve provenant du développement de projets industriels utilisant la méthode B. Le consortium qui compose BWare regroupe des centres publics de recherche (Cedric, LRI et Inria) et des industriels utilisant la méthode B (Mitsubishi Electric R&D, ClearSy et OCamlPro). La méthodologie du projet est de construire une plateforme générique de vériĄcation qui repose sur diférents outils de déduction automatique, tels que des outils de déduction automatique au premier ordre et des solveurs satisĄabilité modulo théorie (SMT). La plateforme du projet BWare est basée sur Why3 [Bobot, Filliâtre, Marché, and Paskevich 2011], une plateforme pour la vériĄcation de programme. Les outils de déduction automatique utilisés dans le projet BWare sont les outils au premier ordre Zenon Modulo et iProver Modulo [Burel 2011] et le solveur SMT Alt-Ergo [Bobot, Conchon, Contejean, Iguernelala, Lescuyer, and Mebsout 2013]. La diversité de ces outils de preuve doit permettre la vériĄcation dŠun large panel dŠobligations de preuve. En plus de cette approche multi-outils, une autre originalité de lŠapproche de BWare réside dans lŠexigence pour les outils de déduction de produire des certiĄcats de preuve. EnĄn, pour tester la plateforme BWare, une large bibliothèque dŠobligations de preuve a été fournie par les partenaires industriels du projet qui développent des outils implémentant la méthode B et des applications utilisant la méthode B. Cette bibliothèque nous a permis de faire une comparaison expérimentale de nos outils de déduction avec les autres outils de BWare, ainsi que des outils externes de référence. Ce manuscrit est organisé comme suit. Dans le Chap. 1, nous introduisons la logique de la méthode B. En particulier, nous présentons son système de preuve, sa théorie des ensembles et son système de type. Dans le Chap. 2, nous présentons une procédure dŠinférence de type pour les variables liées des formules B. Cette procédure nous permet dŠannoter les variables avec leur type, une information nécessaire dans les chapitres suivants. Nous présentons aussi une procédure correcte dŠélimination des ensembles déĄnis par compréhension. Dans le Chap. 3, nous introduisons la logique du premier ordre avec typage polymorphe, ainsi que le système de preuve LLproof, un calcul des séquents typé utilisé par Zenon Modulo pour produire des preuves. Dans le Chap. 4, nous déĄnissons un encodage des formules B dans la logique du premier ordre avec typage polymorphe, puis nous montrons comment reconstruire des preuves dans le système de preuve de la méthode B à partir de preuve LLproof. Dans le Chap. 5, nous montrons la correction relative de LLproof ≡ , lŠextension de LLproof à la déduction modulo théorie, par rapport à la correction de LLproof. Dans le Chap. 6, nous présentons lŠoutil de déduction automatique Zenon, puis les deux extensions de Zenon au typage polymorphe et à la déduction modulo théorie, obtenant ainsi le nouvel outil Zenon Modulo. Dans le Chap. 7, nous introduisons le vériĄcateur de preuve Dedukti et le λΠ-calcul modulo théorie. Puis, nous présentons les encodages de la logique du premier ordre avec typage polymorphe et du calcul des séquents avec typage et réécriture LLproof ≡ dans le λΠ-calcul modulo théorie. EnĄn, dans le Chap. 8, nous présentons le projet BWare et les outils outils le composant. Puis, nous donnons le système de réécriture correspondant à la théorie des ensembles de la méthode B et utilisé par Zenon Modulo dans BWare. Nous concluons Ąnalement notre travail en donnant les résultats expérimentaux obtenus avec la bibliothèque dŠobligations de preuve fournie par les partenaires industriels de BWare.ConclusionAméliorer lŠautomatisation des preuves pour la méthode B, tout en garantissant le plus haut niveau de conĄance possible quant à leur correction, a été le principe directeur du travail présenté dans ce manuscrit. Notre principale contribution est le développement de lŠoutil de déduction automatique Zenon Modulo, une extension de lŠoutil au premier ordre implémentant la méthode des tableaux Zenon au typage polymorphe et à la déduction modulo théorie. Nous avons choisi dŠimplémenter ces extensions dans le but dŠobtenir une recherche automatique de preuve eicace dans la théorie des ensembles de la méthode B, dans le cadre du projet BWare.La plateforme du projet BWare nous impose dŠavoir les obligations de preuve B encodées dans la logique du premier ordre avec typage polymorphe du langage WhyML, le langage de la plateforme de vériĄcation de programme Why3. Nous avons étendu Zenon pour traiter directement les problèmes utilisant un typage polymorphe, évitant ainsi de dépendre dŠun encodage externe du polymorphisme qui tend à déstructurer la forme des formules. De plus, nous avons utilisé le formalisme de la déduction modulo théorie, conçu pour améliorer la recherche de preuve dans les théories axiomatiques, et montré que ce formalisme est adapté à la théorie des ensembles de la méthode B.Les résultats expérimentaux obtenus à partir de la bibliothèque dŠobligations de preuve du projet BWare, composé de 12.876 obligations de preuve B provenant de projets industriels, ont été particulièrement concluant, nous permettant ainsi de valider expérimentalement notre travail sur Zenon Modulo. En particulier, cette expérimentation a montré que chacune de deux extensions implémentées dans Zenon Modulo ont fortement augmenté le nombre total dŠobligations de preuve prouvées.Dans le but dŠaugmenter la conĄance dans la correction des preuves produites par Zenon Modulo, nous avons choisi de générer des certiĄcats de preuve, des objets de preuve qui peuvent être vériĄés par un outil externe. Nous avons décidé dŠutiliser le vériĄcateur de preuve Dedukti pour certiĄer les preuves produites par Zenon Modulo, un vériĄcateur universel de preuve implémentant le λΠ-calcul modulo théorie et qui est particulièrement adapté pour vériĄer les preuves utilisant de la réécriture. Cela nous a permis de vériĄer toutes les preuves produites par Zenon Modulo dans lŠexpérimentation sur la bibliothèque dŠobligations de preuve de BWare.En plus de ce travail de développement, nous avons présenté dans ce manuscrit des résultats théoriques à propos de la chaîne amont du projet BWare. Avant dŠêtre prouvées par Zenon Modulo, les obligations de preuve B sont traduites de la logique de la méthode B vers la logique du premier ordre avec typage polymorphe par un outil de traduction. Des questionnements sur la cohérence des preuves de Zenon Modulo par rapport aux obligations de preuve originelles peuvent légitimement apparaître. En pratique, cette traduction est faite par outil propriétaire appelé bpo2why qui efectue des transformations sophistiquées, en particulier de lŠinférence de types des expressions. Il aurait été diicile de certiĄer formellement la correction de cet outil de traduction, même si nous avions pu avoir un accès à son code source. A la place, nous avons montré quŠil est possible de traduire les preuves de Zenon Modulo, exprimées dans un calcul des séquents typé, en preuves dans le RÉSUMÉ système de preuve de la méthode B. Cela a été rendu possible en déĄnissant un encodage des formules de la méthode B vers la logique du premier ordre avec typage polymorphe, puis une traduction syntaxique de sous-preuves monomorphes du calcul des séquents typé de Zenon Modulo vers la déduction naturelle de la méthode B. EnĄn, nous avons montré que les preuves ainsi obtenues correspondent bien à des preuves des obligations de preuve initiales. Cela nous a permis dŠaugmenter la conĄance globale quant à lŠutilisation du langage WhyML pour exprimer les obligations de preuve et la théorie des ensembles de la méthode B. Nous voyons deux perspectives intéressantes à notre travail. La première concerne la traduction des preuves de Zenon Modulo en preuves dans le système de preuve de la méthode B. La seconde perspective concerne lŠutilisation de Zenon Modulo pour certiĄer les traces de preuve provenant dŠautres outils de déduction automatique. Une implémentation concrète de la traduction des preuves de Zenon Modulo en preuves B pourrait être un projet très intéressant. Le principal avantage serait de retirer les diférentes étapes de traduction des obligations de preuve de la Şzone de conĄanceŤ. Pour le moment, la formule initiale est traduite par bpo2why de la méthode B vers WhyML, puis par Why3 de WhyML vers TFF1, le format dŠentrée de Zenon Modulo, puis enĄn par Zenon Modulo de TFF1 vers Dedukti. Une solution serait de produire une preuve B de la formule initiale en B. Avec cette approche, Zenon Modulo recevrait en entrée lŠobligation de preuve traduite, et renverrait un certiĄcat de preuve contenant uniquement la preuve dans le système de preuve de B. Cette méthode nous permettrait dŠutiliser Zenon Modulo comme une véritable boite noire, sans avoir aucune inquiétude quant à la correction des outils qui la compose. Pour cela, il faudrait avoir un vériĄcateur de preuve B, ce qui fait pour le moment défaut. La seconde perspective est une utilisation alternative de Zenon Modulo, inspirée par le travail de Jasmin Blanchette sur Sledgehammer [Blanchette, Böhme, Fleury, Smolka, and Steckermeier 2016]. LŠidée serait de proĄter du travail dŠautres outils de déduction automatique qui savent produire des traces de preuve pour générer des certiĄcats. Par exemple, lŠoutil de déduction automatique E peut générer des traces de preuve dans le format TSTP, un format standard de traces de preuve. Une trace de preuve TSPT est

Theorem 4.2.3 (Proof Translation) For

a set of B formulae Γ and a B goal P , if there exists a LLproof proof of the sequent ⟨Γ ⋆s ⟩ , ¬ ⟨P ⋆s ⟩ ⊢ LL ⊥, then there exists a B proof of the sequent Γ ⊢ B P . Proof 1. Let Γ be a set of B formulae containing axioms and hypotheses, and P a B goal.

  s n 1 ) . . . x ∈ α 1 ,...,αm p f p (α 1 , . . . , α mp ; s 1 , . . . , s np ) -→ φ p (α 1 , . . . , α mp ; x, s 1 , . . . , s np )

where f 1 , . . . , f p are the p new function symbols and φ 1 , . . . , φ p are the corresponding p polymorphic formulae.

  a rewrite system RE and a formula P in normal form with respect to RE, we denote by [P ] any formula congruent to P modulo ≡ RE . Then, we can easily extend the inference rules of MLproof to reason modulo a congruence relation by replacing the hypothesis of a rule P by its class [P ].

2 Translation of the Problem into TFF1 The

  The main diferences are the explicit type variable quantiĄcations in Poly-FOL, which no longer occurs in WhyML, and the type parameters of function and predicate symbol in Poly-FOL, that are not used in WhyML. We say that WhyML uses an implicit typing notation. encoding of the example by Why3 into TFF1 leads to the following code. The syntax of TFF1 is very close to Poly-FOL, $tType and $o being keywords of the language and corresponding to Type and o.

	mem s ( power t )
	<-> ( forall x : 'a . ( mem x s ) -> ( mem x t ) )
	type t
	constant u : ( set t )
	goal example :
	mem u ( power u )
	end
	6.4.2.tff (t , type ,
	t : $tType ) .
	tff (u , type ,
	u : set ( t ) ) .
	tff ( set , type ,
	set : $tType > $tType ) .
	tff ( mem , type ,
	mem : ! >[ A : $tType ]: (( A * set ( A ) ) > $o ) ) .
	tff ( power , type ,
	power : ! >[ A : $tType ]: ( set ( A ) > set ( set ( A ) ) ) ) .
	tff ( mem_power , axiom ,
	The example of Sec. 4.2.4 in WhyML is:
	theory Example
	type set 'a
	predicate mem 'a ( set 'a )
	function power ( set 'a ) : set ( set 'a )
	axiom mem_power :
	forall s t : set 'a .

![ A : $tType ]: ![ S : set ( A ) , T : set ( A ) ]:

  . In Tab. 6.2, we compare Zenon TFF1 to the ATP Zipperposition and the SMT solver Alt-Ergo.These results are not conclusive yet. The results of Tab. 6.1 show that Zenon FOF with encoding g?? and Zenon TFF1 prove more problems than Zenon FOF with encoding t?? and Zenon Modulo with heuristic. Zenon Modulo with the heuristic is not eicient in this benchmark. The reason is that the heuristic generates some non-terminating rewrite system. It should be noted that each of the four versions of Zenon presented here uniquely prove some problems.

	320 Prob.	Zenon FOF with t??	Zenon FOF with g??	Zenon TFF1	Zenon Modulo with heuristic
	Proved (only by)	5 (0)	4 (0)	3 (0)	123 (117)
	356 Prob. Mean Time in seconds	Zenon FOF with t?? 7.5	Zenon FOF with g?? 10.4	Zenon TFF1 26.6	Zenon Modulo with heuristic 1.4
	Proved (only by) Dedukti Checks OK	115 (4)	5	124 (8)	4	124 (6)	3	91 (7) 121
	Mean Time in seconds Table 6.3: Experimental Results over the B-Book Lemmas Benchmark (Part 1) 13.3 13.5 9.7 2.7 Checked by 113 122 117 84 Dedukti 320 Prob. Zenon Modulo with heuristic Zipperposition Alt-Ergo
	Table 6.1: Experimental Results over the TPTP TFF1 Benchmark (Part 1) Proved (only by) 123 (60) 6 (0) 61 (0)
	Mean Time in seconds	1.3		9.7		0.07
	356 Prob.	Zenon TFF1	Zipperposition		Alt-Ergo
	Proved (only by) Table 6.4: Experimental Results over the B-Book Lemmas Benchmark (Part 2) 124 (9) 145 (8) 225 (65)
	Mean Time in seconds		9.7		18.4		4.6
	Table 6.2: Experimental Results over the TPTP TFF1 Benchmark (Part 2)
	The results of Tab. 6.2 show us that Zenon TFF1 proves fewer problems than Zipper-

position and Alt-Ergo. But there are nine problems that are proved only by Zenon TFF1. Also, Zenon is the only prover considered to generate proof certiĄcates.

  λH 2 : prf(¬Q). λH 3 : prfP. H 2 (H 1 H 3 ) Sym α t u ↩→ λH 1 : prf(t = α u). λH 2 : prf(u ̸ = α t). H 2 (λz : (term α → Prop).λH 3 : prf(z u). H 1 (λx : term α. (z x) ⇒ (z t)) (λH 4 : prf(z t). H 4 ) H 3 )[P : Prop] R Cut P ↩→ λH 1 : (prfP → prf⊥). λH 2 : (prf(¬P ) → prf⊥). H 2 H 1 Prop, Q : Prop] R ⇒ P Q ↩→ λH 1 : (prf(¬P ) → prf⊥). λH 2 : (prfQ → prf⊥). λH 3 : prf(P ⇒ Q). H 1 (Contr P Q H 3 H 2 ) [P : Prop, Q : Prop] R ⇔ P Q ↩→ λH 1 : (prf(¬P ) → prf(¬Q) → prf⊥). λH 2 : (prfP → prfQ → prf⊥). λH 3 : prf(P ⇔ Q). H 3 ⊥ (λH 4 : (prfP → prfQ). λH 5 : (prfQ → prfP ). (H 1 (Contr P Q H 4 (λH 6 : prfQ. (H 2 (H 5 H 6 )) H 6 ))) (λH 7 : prfQ. (H 2 (H 5 H 7 )) H 7 )) [P : Prop, Q : Prop] R ¬∧ P Q ↩→ λH 1 : (prf(¬P ) → prf⊥). λH 2 : (prf(¬Q) → prf⊥). λH 3 : prf(¬(P ∧ Q)).H 1 (λH 5 : prfP. H 2 (λH 6 : prfQ. H 3 (λZ : Prop. λH 4 : (prfP → prfQ → prfZ). H 4 H 5 H 6 ))) (Contr P (P ∨ Q) (λH 3 : prfP. λZ : Prop. λH 4 : (prfP → prfZ). λH 5 : (prfQ → prfZ). H 4 H 3 ) H 2 ) (Contr Q (P ∨ Q) (λH 6 : prfQ. λZ : Prop. λH 7 : (prfP → prfZ). λH 8 : (prfQ → prfZ). H 8 H 6 ) H 2 ) [P : Prop, Q : Prop] R ¬⇒ P Q ↩→ λH 1 : (prfP → prf(¬Q) → prf⊥). λH 2 : prf(¬(P ⇒ Q)). H 2 (λH 3 : prfP. (H 1 H 3 ) (λH 4 : prfQ. H 2 (λH 5 : prfP. H 4 )) Q) ⇔ Q)). (λH 4 : prf(¬P ). H 3 (λZ : Prop. λH 5 : (prf(P ⇒ Q) → prf(Q ⇒ P ) → prfZ). H 5 (λH 6 : prfP. H 4 H 6 Q) (λH 7 : prfQ. H 1 H 4 H 7 P ))) (λH 8 : prfP. H 2 H 8 (λH 9 : prfQ. H 3 (λZ : Prop. λH 10 : (prf(P ⇒ Q) → prf(Q ⇒ P ) → prfZ). H 10 (λH 11 : prfP. H 9 ) (λH 12 : prfQ. H 8 )))) type, P : term α → Prop, t : term α] R ∀ α P t ↩→ λH 1 : (prf(P t) → prf⊥). λH 2 : prf(∀ α P ). H 1 (H 2 t) [α : type, P : term α → Prop, t : term α] R ¬∃ α P t ↩→ λH 1 : (prf(¬(P t)) → prf⊥). λH 2 : prf(¬(∃ α P )). H 1 (λH 4 : prf(P t). H 2 (λZ : Prop. λH 3 : (x : term α → prf(P x) → prfZ). H 3 t H 4 )) Prop, α : type] R ∀type P α ↩→ λH 1 : (prf(P α) → prf⊥). λH 2 : prf(∀ type P ). H 1 (H 2 α) [α : type, P : term α → Prop, t 1 : term α, t 2 : term α] R Subst α P t 1 t 2 ↩→ λH 1 : (prf(t 1 ̸ = α t 2 ) → prf⊥). λH 2 : (prf(P t 2 ) → prf⊥). λH 3 : prf(P t 1 ). H 1 (λH 4 : prf(t 1 = α t 2 ). H 2 (H 4 P H 3 ))

	QuantiĄer-free Rules (Sequel) QuantiĄer-free Rules (Sequel)
	[P : Prop, Q : Prop] R ∨ P Q [P : Prop, Q : Prop] R ¬⇔ P Q
	↩→ λH 1 : (prfP → prf⊥). λH 2 : (prfQ → prf⊥). ↩→ λH 1 : (prf(¬P ) → prf(¬Q)). λH 2 : (prfP → prf(¬¬Q)).
	Closure Rules and Cut [ ] R ⊥ ↩→ λH : prf⊥. H λH 3 : prf(P ∨ Q). H 3 ⊥ H 1 H 2 λH 3 : prf(¬(P QuantiĄer Rules and Subst [P : [P : Prop, Q : Prop] R ¬∨ P Q ↩→ λH 1 : (prf(¬P ) → prf(¬Q) → prf⊥). λH 2 : prf(¬(P ∨ Q)). [α : [α : type, P : term α → Prop] R ∃ α P ↩→ λH 1 : (t : term α → prf(P t) → prf⊥). λH 2 : prf(∃ α P ). H 2 ⊥ H 1 [α : type, P : term α → Prop] R ¬∀ α P ↩→ λH 1 : (t : term α → prf(¬(P t)) → prf⊥). λH 2 : prf(¬(∀ α P )). [ ] R QuantiĄer-free Rules [P : Prop] R ¬¬ P ↩→ λH 1 : (prfP → prf⊥). λH 2 : prf(¬¬P ). H 2 H 1 H 2 (λt : term α. N N P P (P t) (H 1 t)) H 1 Figure 7.10: Shallow Embedding of LLproof ≡ into λΠ ≡ (Part 2) [P : type →
	[P : Prop, Q : Prop] R ∧ P Q
	↩→ λH 1 : (prfP → prfQ → prf⊥). λH 2 : prf(P ∧ Q). H 2 ⊥ H 1
	Figure 7.9: Shallow Embedding of LLproof ≡ into λΠ ≡ (Part 1)

¬⊥

↩→ λH 1 : prf(¬⊤). H 1 (λP : Prop. λH 2 : prfP. H 2 )

[P : Prop] R Ax P ↩→ λH 1 : prfP. λH 2 : prf(¬P ). H 2 H 1 [α : type, t : term α] R ̸ = α t ↩→ λH 1 : prf(t ̸ = α t). H 1 (λz : (term α → Prop). λH 2 : prf (z t). H 2 )

[α : type, t : term α, u : term α] R

Table 8 .

 8 1: Experimental Results over the BWare Benchmark (Part 1) column ŞZenon Mod+AriŤ corresponds to the combination of Zenon Modulo and Zenon Arith.

	All Tools (12,738 / 98.9%)

  POs proved only by one tool. We remark that mp proves 329 POs that no version of Zenon manages to prove. But it is also the case for Zenon Modulo (34 POs) and for the combination of Zenon Modulo and Zenon Arith (946 POs). An unexpected behavior of the combination of Zenon Modulo and Zenon Arith is to lose some problems that Zenon Modulo may prove alone.

		30	1 Zenon 2 Zenon Typed				4	5
			3 Zenon Arith
			4 Zenon Modulo
	Time (ks)	20			2	3
		10
			1
		0	2000	4000	6000	8000	10000	12000
				Number of Proved POs

5 Zenon Mod+Ari Figure 8.1: Cumulative Times According to the Numbers of Proved POs

Table 8

 8

				All Tools (12,797/99.4%)
		BWare Tools (12,772/99.2%)		Other Tools
	12,876	mp	Zen M+A	iProv Mod	Alt Ergo	Vamp	E	CVC4	Z3
	Proofs 10,995	12,281	3,695	12,620	10,154	7,919	12,173	10,880
	Rate	85.4%	95.4%	28.7%	98.0%	78.9%	61.2%	94.5%	84.5%
	Time	-	2.6	5.5	0.56	12	4.7	0.69	0.31
	Uniq.1	109	4	0	65
	Uniq.2	84	0	0	13	0	0	1	12

8.2 the results of Zenon Modulo to the tools of BWare on the left-hand side, and to the state-of-the-art provers mentioned in Sec. 8.4.2 on the right-hand side. The BWare provers are mp, the combination of Zenon Modulo and Zenon Arith (denoted .2: Experimental Results over the BWare Benchmark (Part 2)

  addition to this development work, we have presented in this manuscript some theoretical results about the upstream chain of the BWare framework. Before being proved by Zenon Modulo, proof obligations are translated from B logic into polymorphic Ąrst-order logic. Concerns may arise about whether Zenon Modulo proofs are consistent with the original B proof obligations. In practice, the translation is done by a proprietary tool, called bpo2why, which performs some sophisticated transformations, in particular a type inference of expressions. It would have been very diicult to certify the correctness of bpo2why, even if we could have had access to its source code. Instead, we showed that we An efective implementation of the translation of Zenon Modulo proofs into B proofs could be a very interesting project. The main beneĄt would be to remove the several translation steps of the proof obligation from the Ştrusted zoneŤ. Currently, the input formula is translated by bpo2why from B into WhyML, then by Why3 from WhyML into TFF1, and Ąnally by Zenon Modulo from TFF1 into Dedukti. A desired solution would be to produce a B proof of the initial B formula. In this approach, Zenon Modulo would take as input the translated proof obligation, then would eventually Ąnd a proof, and Ąnally it would generate a proof certiĄcate that contains only the proof in the B proof system, i.e. without the input formula. This method would allow us to use the translation chain and Zenon Modulo as a black-box, without any concerns about the correctness of the tools inside. Unfortunately, it is not yet possible to apply this method because it requires to have a proof checker for the B proof system. The second perspective is an alternative use of Zenon Modulo, inspired by the work of Blanchette et al. in Sledgehammer and presented in [Blanchette, Böhme, Fleury, Smolka, and Steckermeier 2016]. The idea is to beneĄt from output of external ATPs to generate formal proof certiĄcates through Zenon Modulo. For instance, the ATP E can generate proof traces in a speciĄc format called TSTP. These proof traces contain the set of axioms needed to prove the statement, and a list of intermediate lemmas. Thus, these proof traces could improve the proof search of Zenon Modulo by reducing the proof-search space with the selected axioms, and by cutting a diicult proof into a list of smaller proofs of the intermediate lemmas. A proof of concept of this idea have already been tested by Pham [Pham 2016], and gave some promising results.

can translate Zenon Modulo proofs into B proofs. This was made possible by deĄning an encoding of B formulae into polymorphic Ąrst-order logic, and a syntactic translation of the typed sequent calculus inference rules of Zenon Modulo into the B natural deduction proof system. Finally, we show that the resulting B proofs are valid proofs of the initial proof obligations. This gives us extra conĄdence that the approach of the BWare project to rely on the WhyML language is relevant.

We see two interesting perspectives of our work. The Ąrst one deals with the translation of Zenon Modulo proofs into B proofs, and the second with an alternative use of Zenon Modulo as a proof certiĄcate generator.

  LŠarrivée des véhicules autonomes est certainement une bonne nouvelle. Ce sera une libération pour un grand nombre de personnes, en particulier ceux soufrant dŠune mobilité réduite. Une fois lancé, ce nouveau moyen de transport prendra une place de plus en plus grande et dépassera rapidement les voitures telles que nous les connaissons. Mais tous ces points positifs ne doivent pas cacher les inquiétudes légitimes que lŠon pourrait avoir quant à la sécurité de ces voitures autonomes. En efet, un véhicule autonome de transport de personne est un système critique, au sens où une défaillance de ce système pourrait mettre en danger des vies humaines. Une voiture autonome utilise des dizaines de capteurs, processeurs et programmes embarqués pour fonctionner. Le développement de logiciels embarqués dans les systèmes critiques exige une rigueur et une expertise spéciĄque, ce qui semble manquer pour le moment dans lŠindustrie automobile.Les fonctions de sécurité dŠun système qui exige un niveau de certiĄcation SIL 4 sont généralement les parties les plus critiques de lŠensemble du système, par exemple le système de contrôle de la vitesse dŠun métro automatique sans conducteur. En génie logiciel, des méthodes de développement logiciel, appelées méthodes formelles, ont été conçues pour développer des logiciels ayant un haut niveau de Ąabilité. LŠidée centrale des méthodes formelles est de prouver quŠun programme informatique vériĄe des propriétés mathématiques particulières. Ces propriétés mathématiques traduisent le comportement souhaité du système et sont regroupées dans la spéciĄcation, une description formelle du système.La notion de spéciĄcation est très importante dans les méthodes formelles, car toutes ces méthodes de développement ne nous permettent que de prouver une correction relative du programme par rapport à sa spéciĄcation. Ainsi, les spéciĄcations doivent être décrites dans un langage formel, typiquement un langage sans ambiguïté tels que les langages logiques, à lŠinverse des langages naturels. Il existe un grand nombre de méthodes formelles diférentes, couvrant tout ou partie du cycle de développement dŠun logiciel, depuis sa spéciĄcation jusquŠà son implémentation.La méthode B est une méthode formelle créée par Jean-Raymond Abrial et présentée dans son livre de référence, appelé le B-Book[START_REF] Abrial | The B-Book, Assigning Programs to Meanings[END_REF]] et publié en 1996. La méthode B sŠinspire des travaux antérieurs de Hoare et Dijkstra à propos de la correction des

	Une conclusion intéressante de cette histoire, et qui va plus loin que son propre contexte,
	est la constatation dŠun manque de normes obligatoires concernant les constructeurs
	La récente afaire des Şaccélérations involontairesŤ de Toyota, telle que rapportée par automobiles dans le développement de logiciels pour des systèmes critiques. DŠautres
	Bagnara pendant le 12th Workshop on Automotive Software & Systems en 2014, révèle secteurs du transport de personnes, telles que les industries aéronautique et ferroviaire,
	des pratiques contestables [Bagnara 2014]. En lŠan 2000, Le constructeur automobile ont efectué avec succès leur révolution électronique trente ans auparavant. Par exemple,
	japonais Toyota a adopté un système électronique de contrôle dŠaccélération (Electronic le constructeur aéronautique européen Airbus lança en 1984 lŠA320, le premier avion de
	Throttle Control System, ETCS) pour la plupart de ses nouveaux modèles de voiture, ligne avec un système de contrôle de vol entièrement numérique [Favre 1994]. Dans
	remplaçant ainsi une pédale dŠaccélération mécanique par un système électronique. En lŠindustrie ferroviaire, les premiers véhicules autonomes, un nouveau système complètement
	2010, lŠagence gouvernementale américaine National Highway Traic Safety Administration automatique et sans conducteur de métro dans la ville française de Lille, apparurent en
	rapporte que 89 décès pourraient être liés à cette afaire des accélérations involontaires, 1983 [Lardennois 1993].
	Ils ont aussi décrit le code source C en question comme étant du Şcode spaghettiŤ, contenant
	plus de 10.000 variables globales en lecture/écriture. Finalement, ils soulignèrent lŠabsence
	de contrainte de certiĄcation des logiciels dans les systèmes critiques pour les constructeurs
	automobiles américains.
	En 2014, Toyota parvint à un accord avec le département de justice du gouvernement
	fédéral américain et régla une amende de 1,2 milliards de dollars américains, mettant ainsi
	Ąn à lŠenquête criminelle à propos de lŠafaire des accélérations involontaires. Toutes les
	conséquences de cette afaire ne sont toujours pas connues seize ans après la sortie du
	système ETCS. Mais elle peut déjà être considérée comme une étude de cas pertinente et
	un tournant pour la sûreté fonctionnelle des systèmes critiques.

Introduction

LŠannée 2016 marque une étape importante dans le développement des véhicules autonomes. Alors que lŠentreprise de technologie de lŠinformation Google a lancé il y a plusieurs années son projet de voitures autonomes Google Car Ű la Ćotte de véhicules a déjà été testée sur près de trois millions de kilomètres Ű, des annonces oicielles de nouveaux projets de voitures autonomes ont été publiées pendant la première moitié de lŠannée 2016. Un grand nombre de constructeurs automobiles de premier plan ont annoncé lŠarrivé de véhicules autonomes dans les cinq prochaines années. Par exemple, le constructeur américain de voiture Ford a annoncé en août la sortie dŠune voiture complètement autonome Ű sans volant ni pédale Ű pour lŠannée 2021

[START_REF] Sage | Ford Plans Self-Driving Car for Ride Share Fleets in 2021[END_REF]

. Dans la ville de Pittsburgh en Pennsylvanie, la société de réseau de transport Uber propose depuis le mois dŠaoût à ses clients dŠutiliser une Ćotte de voitures autonomes, accompagné dŠun conducteur de secours pour le moment

[START_REF] Chafkin | UberŠs First Self-Driving Fleet Arrives in Pittsburgh This Month[END_REF]

].

en plus de milliers dŠaccidents de voiture. En 2013, le premier procès au cours duquel les plaignants airment que les accélérations involontaires ont été causées par un mauvais fonctionnement du système ETCS, fait témoigner lŠexpert en systèmes embarqués Baar

[START_REF] Barr | Camry L4 Software Analysis[END_REF]

] et le professeur Koopman

[START_REF] Koopman | A Case Study of Toyota Unintended Acceleration and Software Safety[END_REF]

de lŠuniversité Carnegie Mellon, tous deux ayant pu examiner le code source du logiciel embarqué dans le système ETCS. Leurs conclusions ont révélé que le logiciel en question était très éloigné des standards attendus pour des logiciels de systèmes critiques. Par exemple, ils rapportèrent que le processus de développement nŠavait pas suivit rigoureusement les recommandations MISRA-C Ű une norme non-contraignante proposée par la Motor Industry Software Reliability Association. Le haut niveau de sécurité de ces deux secteurs industriels a été atteint grâce à lŠapplication de normes obligatoires et spéciĄques pour les composants électroniques et les logiciels embarqués. La norme IEC 61208 est la norme générique internationale pour les systèmes critiques électriques, électroniques et programmables, et publiée par la commission internationale électrotechnique IEC. Cette norme a été spéciĄée pour chaque secteur particulier. Par exemple, dans lŠindustrie ferroviaire, la norme EN 50128 sŠapplique au logiciels critiques des systèmes de contrôle et de protection. Une des notions importantes déĄnies par cette norme est le niveau dŠintégrité de sécurité SIL, une grandeur qui mesure le niveau relatif de réduction des risques fourni par une fonction de sécurité. La norme déĄnit quatre niveaux SIL, de SIL 1 (le plus bas niveau de réduction des risques) à SIL 4 (le plus haut niveau de réduction des risques).

programmes. Cette méthode est principalement utilisée dans lŠindustrie ferroviaire pour spéciĄer et développer des logiciels de systèmes critiques. Par exemple, la méthode B a été utilisée avec succès pour développer le système de contrôle de commande des rames du métro automatique et sans conducteur de la ligne 14 du métro parisien en France en 1998

[START_REF] Behm | METEOR: A Successful Application of B in a Large Project[END_REF]

. La méthode B couvre tout le cycle de développement dŠun logiciel, depuis la spéciĄcation formelle du système, appelée la

R5 Γ ⊢ B Q Γ, Q ⊢ B P Γ, Q ⊢ B ¬P R6 Γ ⊢ B ¬Q x\Γ Γ ⊢ B P R7 Γ ⊢ B ∀x • P Γ ⊢ B ∀x • P R8 Γ ⊢ B [x := E]P Γ ⊢ B E = F Γ ⊢ B [x := E]P

P : Πα 1 . . . α m .τ 1 × . . . × τ n → o ∈ Γ ρ = [α 1 /τ ′ 1 , . . . , α m /τ ′ m ] Γ ⊢ τ ′ i : Type, i = 1 . . . m Γ ⊢ t i : τ i ρ, i = 1 . . . n Pred Γ ⊢ P (τ ′ 1 , . . . , τ ′ m ; t 1 , . . . , t n ) : o ⊤ Γ ⊢ ⊤ : o ⊥ Γ ⊢ ⊥ : o Γ ⊢ φ 1 : o Γ ⊢ φ 2 : o ∧ Γ ⊢ φ 1 ∧ φ 2 : o Γ ⊢ φ 1 : o Γ ⊢ φ 2 : o ∨ Γ ⊢ φ 1 ∨ φ 2 : o Γ ⊢ φ 1 : o Γ ⊢ φ 2 : o ⇒ Γ ⊢ φ 1 ⇒ φ 2 : o Γ ⊢ φ 1 : o Γ ⊢ φ 2 : o ⇔ Γ ⊢ φ 1 ⇔ φ 2 : o Γ ⊢ φ : o ¬ Γ ⊢ ¬φ : o Γ ⊢ t 1 : τ Γ ⊢ t 2 : τ = Γ ⊢ t 1 = τ t 2 : o Γ, x : τ ⊢ φ : o ∃ Γ ⊢ ∃x : τ. φ : o Γ, x : τ ⊢ φ : o ∀ Γ ⊢ ∀x : τ. φ : o Γ, α : Type ⊢ φ T : o ∀ T Γ ⊢ ∀α.φ T : o Figure 3.2: Type System of Poly-FOL We use the following notation Γ = Γ G ; ∅. TConstr Γ ⊢ T : Type TConstr Γ ⊢ set(T ) : Type Var Γ ⊢ u : set(T ) Π Pred Γ ⊢∈ (set(T ); u, P(T ; u)) Where Π is: TConstr Γ ⊢ T : Type Var Γ ⊢ u : set(T ) Fun Γ ⊢ P(T ; u) : set(set(T )) Π

P : Πα 1 . . . α m .τ 1 × . . . × τ n → o ∈ Γ ρ = [α 1 /τ ′ 1 , . . . , α m /τ ′ m ] Γ ⊢ τ ′ i : Type, i = 1 . . . m Γ ⊢ t i : τ i ρ, i = 1 . . . n Pred Γ ⊢ P (τ ′ 1 , . . . , τ ′ m ; t 1 , . . . , t n ) : o ⊤ Γ ⊢ ⊤ : o ⊥ Γ ⊢ ⊥ : o Γ ⊢ φ 1 : o Γ ⊢ φ 2 : o ∧ Γ ⊢ φ 1 ∧ φ 2 : o Γ ⊢ φ 1 : o Γ ⊢ φ 2 : o ∨ Γ ⊢ φ 1 ∨ φ 2 : o Γ ⊢ φ 1 : o Γ ⊢ φ 2 : o ⇒ Γ ⊢ φ 1 ⇒ φ 2 : o Γ ⊢ φ 1 : o Γ ⊢ φ 2 : o ⇔ Γ ⊢ φ 1 ⇔ φ 2 : o Γ ⊢ φ : o ¬ Γ ⊢ ¬φ : o Γ ⊢ t 1 : τ Γ ⊢ t 2 : τ = Γ ⊢ t 1 = τ t 2 : o Γ, x : τ ⊢ φ : o ∃ Γ ⊢ ∃x : τ. φ : o Γ, x : τ ⊢ φ : o ∀ Γ ⊢ ∀x : τ. φ : o Γ, α : Type ⊢ φ T : o ∀ T Γ ⊢ ∀α.φ T : o Figure 6.4: Extended Poly-FOL Type System for MLproof

Typingwf(Γ) Sort Γ ⊢ Type : Kind wf(Γ)x :A ∈ Γ Var Γ ⊢ x : A Γ ⊢ t 1 : Πx : A B Γ ⊢ t 2 : A App Γ ⊢ t 1 t 2 : B[x/t 2 ] Γ ⊢ A : Type Γ, x : A ⊢ t : B Γ, x : A ⊢ B : s Abs Γ ⊢ λx : A. t : Πx : A B Γ ⊢ A : Type Γ, x : A ⊢ B : s Prod Γ ⊢ Πx : A B : s

Acknowledgements

It has been an honor and a great pleasure to spend the three years of my PhD in the Inria Saclay team Deducteam. ACKNOWLEDGEMENTS Saillard, Simon Cruanes, Ali Assaf, François Thiré and Kailiang Ji. We shared a lot of things together: small talks, debates, lunches, cofees, λ-pies, beers, ... and we even worked a little. Thank you very much guys ! I also want to thank Catherine Dubois, Guillaume Burel, Frédéric Blanqui, Simon Martiel and Thida Iem for all these moments we shared in Deducteam and all the help you gave to me. I am very grateful to Stéphane Demri and all the members of the LSV laboratory of the

Zenon Modulo

This chapter presents the automated theorem prover (ATP for short) Zenon and its extensions to polymorphism and deduction modulo theory, resulting to a new tool called Zenon Modulo.

In Sec. 6.1, we present the principles of the Tableau method, the proof-search method used by Zenon. This section is inspired by [Bonichon, Delahaye, and Doligez 2007;DŠAgostino, Gabbay, Hähnle, and Posegga 2013].

In Sec. 6.2, we Ąrst present the extension of the syntax and type system of Poly-FOL to deal with the proof-search format of Zenon, called MLproof. Then, we present the extension of MLproof to polymorphic formulae and discuss the implication on the proof-search algorithm. This contribution (and its corresponding implementation) is a collaborative work and it has been published in [Bury, Cauderlier, and Halmagrand 2015a;Bury, Delahaye, Doligez, Halmagrand, and Hermant 2015b].

In Sec. 6.3, we present the extension of MLproof to deduction modulo theory, denoted MLproof ≡ , an heuristic to automatically transform axioms into rewrite rules and the rewriting algorithm used by Zenon Modulo. This contribution (and its corresponding implementation) is a personal work and it has been published in [Bury, Delahaye, Doligez, Halmagrand, and Hermant 2015b; Delahaye, Doligez, Gilbert, Halmagrand, and Hermant 2013b,a].

Availability

The benchmark is publicly available, under the CeCILL-B license, at: http://bware. lri.fr/. CeCILL is a French free software license, compatible with the GNU GPL (see: http://www.cecill.info/licences.en.html).

Similarly, for universal quantiĄcation, we are encoding Ş∀Ť with the Dedukti ŞΠŤ.

Remark

The main beneĄt of a shallow encoding Ű compared to a deep one Ű is to beneĄt from the computational aspect of Dedukti. In addition, it helps to share proofs coming from diferent systems.

For instance, Burel in [START_REF] Burel | A Shallow Embedding of Resolution and Superposition Proofs into the λΠ-Calculus Modulo[END_REF]] uses a similar encoding to verify proofs coming from the ATP iProver Modulo. So, it should be quite straightforward to combine proofs coming from Zenon Modulo with those of iProver Modulo.

Translation Functions from Poly-FOL into λΠ ≡

We present in Fig. 7.5 and in Fig. 7.6 the translation function of Poly-FOL types, terms, formulae, local contexts and global contexts into Dedukti.

The general function to translate proofs is: For instance, we want to translate the following proof tree:

By applying the translation of Fig. 7.5 and Fig. 7.6 and its extension to proofs given above, we obtain the Dedukti proof term:

It should be noted that we do not have to make a λ abstraction over P ∨ Q again since we already have a constant x P ∨Q coming from a previous λ abstraction or an axiom.

Remark

We check that a LLproof ≡ proof Π is a valid proof of the LLproof ≡ sequent Γ ⊢ ⊥, by checking the λΠ ≡ typing judgment ♣Γ♣ ⊢ ♣Π♣ : prf⊥.

Proof CertiĄcate Example

To illustrate the certiĄcation of proofs with Dedukti, we present an example in B set theory. The Poly-FOL theory T consists of three axioms deĄning membership to the

Chapter 8

The BWare Project

We present in this chapter the BWare project and the experimental results of our work.

We make a short presentation of the BWare project in Sec. 8.1. In Sec. 8.2, we introduce the diferent tools involved in the BWare toolchain.

In Sec. 8.3, we present the B set theory expressed as a Poly-FOL rewrite system. This contribution is a personal work and it has been published in [START_REF] Bury | Automated Deduction in the B Set Theory using Typed Proof Search and Deduction Modulo[END_REF].

In Sec. 8.4, we present the experimental results obtained over the BWare benchmark.

In particular, we compare our tool Zenon Modulo to other state-of-the-art automated deduction tools. These experimental results have been published in [START_REF] Bury | Automated Deduction in the B Set Theory using Typed Proof Search and Deduction Modulo[END_REF].

Presentation of the BWare Project

The BWare project [START_REF] Delahaye | The BWare Project: Building a Proof Platform for the Automated VeriĄcation of B Proof Obligations[END_REF]

The BWare Proof Obligations Benchmark

The set of B proof obligations (POs for short) provided by the industrial partners of the BWare project is a very valuable resource. It is usually diicult for academic researchers to get access to real industrial datas to test their tools.

Presentation

Mitsubishi Electric R&D and ClearSy have provided to BWare a set made of 12,876 proof obligations coming from real industrial projects. These POs have been anonymized, allowing us to use and to distribute them.

After this anonymization and the translations through bpo2why and Why3 drivers, it is diicult to understand the mathematical meaning behind the input Ąles corresponding to POs. But the industrial partners have chosen precisely this set of POs to have a wide spectrum, that reĆects well the diferent kinds of mathematical formulae that appear in B projects. Then, all the B operators deĄned in Sec. 8.3 are represented in this benchmark.

It should be noted that one important challenge represented by these POs are their sizes and their large contexts. For instance, the mean size of input Ąles in TPTP TFF1 format is 515 KiB Ű with a maximum of 2,690 KiB Ű which represents thousands of lines.

In addition, each PO is provided with hundreds of useless axioms and hypotheses, all these formulae being quantiĄed over dozens of variables. Consequently, the proof search space is generally very large, requiring us to implement eicient deduction tools.

All the POs of the benchmark are provable since they have been proved inside Atelier B, automatically or interactively. The automated theorem prover of Atelier B, called Şmain proverŤ and denoted mp, is able to prove automatically 85.4 % of this benchmark, the resulting 14.6 % requiring a human interaction to be proved.

Several formats are proposed and divided into several archives. The considered formats are the following:

• TPTP FOF (regular TPTP format for mono-sorted Ąrst order logic);

• TPTP TFF1 (TPTP format for Ąrst order logic with polymorphic types);

• SMT-LIB v2 (regular SMT format for many-sorted Ąrst order logic);

• Alt-Ergo (input native format of Alt-Ergo).

Experimental Protocol

The experiment was run on an Intel Xeon E5-2660 v2 2.20 GHz computer, with a timeout of 120 s and a memory limit of 1 GiB. For each tool (except mp, which was tested directly over the native format of POs coming from Atelier B, thus not through the Why3 platform), the following input formats and command lines (where %t is the timeout, %m the memory limit, and %f the Ąle name) were used:

• Zenon Modulo 0.4.1 (Zenon with types, deduction modulo, and arithmetic):

Experimental Results

We present in this section the experimental results obtained by Zenon Modulo over the BWare benchmark. First we compare the diferent extensions implemented in Zenon. Then, We compare Zenon Modulo to other deduction tools.

Zenon Extensions

We summarize in Tab. 8.1 the results obtained by the diferent extensions of Zenon over the 12,876 POs of the BWare benchmark.

The Ąrst column gives the results of the Atelier B prover, called mp. Then, we give in the next Ąve columns the results for the diferent versions of Zenon. The results of Tab. 8.2 are once again conclusive. The most important result is that, compared to all the other tools presented in this table, the combination of Zenon Modulo and Zenon Arith is the second prover that proves the most of POs, exceeded only by Alt-Ergo.

The fact that this combination proves more POs than the two SMT solvers CVC4 and Z3, which both deal with arithmetic, is quite unexpected since these two tools are considered as the most eicient tools in their domain. But we remark that CVC4 and Z3 are faster than the combination of Zenon Modulo and Zenon Arith.

The two ATPs Vampire and E, which are known to be the most eicient Ąrst-order theorem provers [START_REF] Sutclife | The CADE ATP System Competition -CASC[END_REF]], do not deal with arithmetic reasoning. Zenon Modulo alone, which proves 10,340 POs, outperforms both Vampire and E, also when looking the time spent to prove POs.

One explanation of these results could be that the extensions of Zenon and Alt-Ergo are the only tools presented here to deal with polymorphism, whereas the other tools rely on encodings.

Finally, we present in Fig. 8.2 the cumulative times spent to prove POs for all the tools of our experiment. It should be noted that, for the SMT solvers, the cumulative time is increasing linearly, unlike for ATPs, which is an expected behavior.

We remark that for the Ąrst ten thousands POs, the combination of Zenon Modulo and Zenon Arith is faster that CVC4. This conĄrms that deduction modulo theory have a strong impact on proof search in axiomatic theories. RÉSUMÉ composée dŠune liste de formules correspondant à la liste des axiomes nécessaires pour prouver le but et éventuellement à une liste de lemmes intermédiaires. La réduction de la taille de lŠespace de recherche, ainsi que les étapes intermédiaires données par les lemmes, constitue une aide potentiellement très intéressante pour améliorer la performance de Zenon Modulo.

EnĄn, ces deux approches pourrait être combinées pour utiliser Zenon Modulo comme un générateur de preuve formelles en B à partir dŠautres outils de déduction automatique. La principale motivation de cette approche serait son adaptabilité dans un contexte industriel.

Les problèmes de certiĄcation des outils logiciels dans un cadre industriel rendent souvent très contraignant les améliorations et les mises à jours des outils certiĄés. En efet, il est souvent nécessaire de recommencer presque intégralement un processus de certiĄcation dŠun outil modiĄé. Dans lŠapproche proposée ci-dessus, seul un vériĄcateur de preuve B devrait être certiĄé, laissant possible toutes modiĄcations des outils de déduction automatique.