Remark. Some material in this lecture is from << Software Foundation >> volume 1 and volume 2.

Review: Program Expression's Denotational Semantics

We have learnt how to define integer expression's denotational semantics. We can define it using Coq's recursive function. In this definition, state means the set of program states and every program state is a function from program variables to integer values, i.e. var → Z.

This time, we swap the order of two arguments. As a result, aexp_eval can be interpreted as a two-argument function, or a one-argument function which maps integer expresions into functions from program states to integers. In other words, the denotation of an integer expression a is a function from program states to integer values. To be more explicit, we can redefine it as follows.

Here, we define dadd to be the sum of two functions. In Coq, we use fun st ⇒ ... to represent a function which takes st as its argument. The right hand side expression of fun st ⇒ represents the function value given this specific argument st. In summary, dadd is a function which takes two arguments. These two arguments and the function value are themselves functions. The function value is define using fun st ⇒ ... in Coq.

Similarly, we can define the subtraction and multiplication of two functions. Then, the denotation of an aexp can be defined as:

These two definitions aeval and aeval' are obviously equivalent. We can prove it in Coq.

To prove such a property, we would like to do induction over the syntax tree of a.

Expression Equivalence

Based on this definition, we can define behaviorally equivalence between two aexps.

Definition is another keyword for writing definitions in Coq besides Fixpoint. It can beused to define functions and/or values but recursions are not allowed in such definitions. Here, we define that two aexps are behaviorally equivalent if they evaluate to the same result in every state. We first define the equivalence relation between two denotations (which are functions from program states to integers). Then, we define that two integer expressions are equivalent if their denotations are equivalent. Here are some examples.

The Constant-Folding Transformation

An expression is constant when it contains no variable references. Constant folding is an optimization that finds constant expressions and replaces them by their values.

Here, we see that the match expressions in Coq are very flexible. (1) We can apply pattern matching on not only Coq variables but also any Coq expression whose type is inductively defined. (2) We can apply pattern matching on two expressions at the same time. (3) We can use underscore _ to cover default cases.

Note that this version of constant folding doesn't eliminate trivial additions, etc. — we are focusing attention on a single optimization for the sake of simplicity. It is not hard to incorporate other ways of simplifying expressions; the definitions and proofs just get longer.

Soundness of Constant Folding

Now we need to show that what we've done is correct.

To prove such a property, we would like to do induction over the syntax tree of a.

Here, we have to do case analysis on fold_constants_aexp a₁ and fold_constants_aexp a₂. The tactic destruct can be used to accomplish this. The following line turns the current proof goal into five goals, each of which corresponds to one different kind of fold_constants_aexp a₁. The eqn clauses in the end indicates that an extra assumption Ha₁ will be generated describing what does fold_constants_aexp a₁ equal to.

In the previous case, we duplicate our proof script for many times. The tactic language in Coq provide semicolon ;. Specifically, tac1 ; tac2 says do tac1, then do tac2 in every single proof goal that tac1 generates. Semicolon is right associative.

After proving this soundness property, we want to prove that this optimization really improves something. For stating this property formally, we first need to define the steps of calculation involved in program expressions.

Now, we can prove that an optimized expression never takes more calculation than the original one.

Evaluating Command

Next we need to define what it means to evaluate a command. One idea is to define such evaluation as a function from beginning state and command to ending state. But the fact that WHILE loops don't necessarily terminate means that such evaluating function cannot be a total function; it must be a partial function. Although such definition is no problem in theory, computer scientists choose not to do this since it is less extensible. Also, if you try do write it in Coq, it is nontrivial. Usually, computer scientists use a set of state pairs S to represent a program c's denotation. Specifically, if a program state pair (st₁, st₂) is an element of S, then executing c from state st₁ may terminate with state st₂. Remark: this is different from Hoare triples. Hoare triples are about assertion pairs but a program's denotation is about program state pairs. In other words, the denotation of a program has type state → state → Prop in Coq. Like what we did for integer expressions' denotations, command denotation equivalence can be defined as follows.

A set of program state pairs is also called a binary relation between program states. In Coq, we can use state → state → Prop to present such type. As a preparation, we first define some basic concepts about relations.

In these definitions, we sometimes use braces "{}" instead of parentheses "()". When braces are used, those arguments are called implicit arguments, i.e. you do not need to write those arguments when you use a function.

Using these basic definitions about relation, we can easily define the denotation of empty commands, assignment commands, sequential composition and if-then-else commands. We hope that the evaluation function ceval has the following property: But it is not obvious to find out a definition that satisfies this property. We define it using Bourbaki-Witt fixpoint theorem. Here, we first demonstrate a concrete semantic definition which will fullfill our requirement. Afterwards, we will introduce the general theory for Bourbaki-Witt fixpoint. The following recursive function defines the semantics of executing the loop body for exactly n times. In Coq, nat represents nature numbers. Coq users can write functions recursively on nature numbers as recursively defined on lists. Specifically, a natural number n is either zero O (the "O" of Omega) or the successor of another natural number n', written as S n'.

In short, it says iter_loop_body b loop_body n is defined as:

• if n = 0, identity relation with the restriction that b is not true;
• if n = n' + 1, first do loop_body then do iter_loop_body b loop_body n' with the restriction that b is true at beginning.

The union of these binary relations is exactly the meaning of while loops. The following relation operator omega_union defines the union of countably many relations.

And we can prove that this definition satisfies the recursive equation that we want.

Now we need to do case analysis over whether n is zero or not.

With loop_sem which is just defined, we are eventually ready to complete our definition of ceval.

Bourbaki-Witt Theorem

For now, we have successfully defined a fixpoint construction loop_sem which satisfies the recursive equation loop_recur. It is actually one special case of Bourbaki-Witt fixpoint theorem.

Partial Order

A partial order (偏序) on a set A is a binary relation R (usually written as ≤) which is reflexive (自反), transitive (传递), and antisymmetric (反对称). Formally, The least element of A w.r.t. a partial order ≤ is also called bottom:

Chain

A subset of elements in A is called a chain w.r.t. a partial order ≤ if any two elements in this subset are comparable. For example, if a sequence xs: nat → A is monotonically increasing: then it forms a chain. A partial order ≤ is called complete if every chain has its least upper bound lub and greatest lower bound glb. In short, the set A (companied with order ≤) is called a complete partial ordering, CPO (完备偏序集). Some text books require chains to be nonempty. We do not put such restriction on chain's definition here. Thus, the empty set is a chain. Its least upper bound is the least element of A, in other words, bot.

Monotonic and Continuous Functions

Given two CPOs A, ≤A= and B, ≤B=, a function F: A → B is called monotonic (单调) if it preserves order. Formally, A function F: A → B is called continuous (连续) if it preserves lub. Formally, Here, the lub function on the left hand side means the least upper bound defined by B and the one on the right hand side is defined by A. The definition of continuous does not require the preservation of glb becasue CPOs are usually defined in a direction that larger elements are more defined .

Least fixpoint

Given a CPO A, we can always construct a sequence of elements as follows: Obviously, bot ≤ F(bot) is true due to the definition of bot. If F is monotonic, it is immediately followed by F(bot) ≤ F(F(bot)). Similarly, In other words, if F is monotonic, this sequence is a chain. Main theorem: given a CPO A, if it has a least element, then every monotonic continuous function F has a fixpoint and the least fixpoint of F is: Proof. On one hand, this least upper bound is a fixpoint: The first equality is true because F is continuous. The second equality is true because bot is less than or equal to all other elements in the sequence. On the other hand, this fixpoint is the least one. For any other fixpoint x, in other words, suppose F(x) = x. Then, Thus, due to the fact that F is monotonic and x is a fixpoint. And so on, That means, x is an upper bound of bot, F(bot), F(F(bot)), .... It must be greater than or equal to QED.