Thanks for the clarification on Twelf! I had planned on re-reading your introduction to the system but never got around to it. I’ll insert a note in the article to avoid leading too many people astray.

Regarding forall/exists: it occurs to me that I never showed an example with multiple forall(s). This makes the motivation for exists a little bit more apparent. A simple example would be the header for the preservation theorem for the simply-typed lambda calculus:

theorem preservation:
    forall d: Gamma |- t : T
    forall e: t -> t'
    exists Gamma |- t' : T .

    ...
end theorem

Regarding alloy: I think (and now I’m out of my depth) that Alloy can only declare the absence of counter-examples up to a particular size. So it would be less useful for verifying type systems.

Regarding forall vs exists: “forall” are the “inputs” to the theorem, and “exists” are the outputs. Hence the extra keyword/marker.

There are just two things that look wrong from your examples:
1) Having to explicitly say “_:” for “I won’t name this”;
2) This extra “exists”.
Anyway, I clearly need to read the papers

:-S Like many things in SASyLF, it’s there to bring the syntax more in line with natural-language. I didn’t show it, but if you wanted to prove something using a theorem or lemma, the syntax looks like this:

_: ... by theorem my-cool-theorem

In more complicated proofs, things get very, *very* verbose.

It’s simpler really than what you mean by both. My system is a hierarchical component model (i.e. a component contains instances of other components wired in using connectors). My “inference” allows the required and provided interfaces of ports of composite components (made up of other components) to be determined automatically. You can also represent relationships between ports on implementation components which bear on the composite case.

Whilst not trivial, it’s a long way from specifying something like the Hindley-Milner type equations.

Andrew

Cool! I don’t really understand everything that’s going on in the linked Alloy proof, but to prove a system with full type inference is an impressive feat (I assume you mean “inference” and not “reconstruction”?). SASyLF is nice, but things get horribly ugly if you try to prove the soundness of things involving unification at the type level. For example, you could probably prove the soundness of a Prolog type system (if it had one) in SASyLF, but it would be nasty in the extreme. Alloy looks like it may not suffer from that shortcoming.

As for proving the soundness of a type system — i’m not so sure. It can be used for large and complex examples if needed. I used Alloy to formally specify a fairly large and intense component system with full type inference: http://www.doc.ic.ac.uk/~amcveigh/papers/transfer/alloy.pdf

Cheers,
Andrew