Remark. Some material in this lecture is from << Software Foundation >> volume 1 and volume 2.

Review: Programs' Denotational Semantics

We have learnt how to define integer expression's denotational semantics. We can define it using Coq's recursive function.

Soppose then_branch and else_branch are denotations of the then-branch and else-branch of an if-command. Here, the first clause of union the set of program state pairs (st₁, st₂) such that:

• (st₁, st₂) belongs to then_branch and b is true on st₁

And similarly, the second clause of union the set of program state pairs (st₁, st₂) such that:

• (st₁, st₂) belongs to else_branch and b is false on st₁

The union of them is the semantics of an if-command.

Suppose loop_body is the denotation of loop body, then defines the begining-ending-program-state pairs of excuting the loop body for exactly n times. And defines whole while-loop's semantics.

Adding all components up, we can define denotational semantics of progrmas and program equivalence.

Bourbaki-Witt Theorem

For now, we have successfully defined a fixpoint construction loop_sem which satisfies the recursive equation loop_recur:

This lemma that we proved last time is actually one special case of Bourbaki-Witt fixpoint theorem.

Partial Order

A partial order (偏序) on a set A is a binary relation R (usually written as ≤) which is reflexive (自反), transitive (传递), and antisymmetric (反对称). Formally, The least element of A w.r.t. a partial order ≤ is also called bottom:

Chain

A subset of elements in A is called a chain w.r.t. a partial order ≤ if any two elements in this subset are comparable. For example, if a sequence xs: nat → A is monotonically increasing: then it forms a chain. A partial order ≤ is called complete if every chain has its least upper bound lub and greatest lower bound glb. In short, the set A (companied with order ≤) is called a complete partial ordering, CPO (完备偏序集). Some text books require chains to be nonempty. We do not put such restriction on chain's definition here. Thus, the empty set is a chain. Its least upper bound is the least element of A, in other words, bot.

Monotonic and Continuous Functions

Given two CPOs A, ≤A= and B, ≤B=, a function F: A → B is called monotonic (单调) if it preserves order. Formally, A function F: A → B is called continuous (连续) if it preserves lub. Formally, Here, the lub function on the left hand side means the least upper bound defined by B and the one on the right hand side is defined by A. The definition of continuous does not require the preservation of glb becasue CPOs are usually defined in a direction that larger elements are more defined .

Least fixpoint

Given a CPO A, we can always construct a sequence of elements as follows: Obviously, bot ≤ F(bot) is true due to the definition of bot. If F is monotonic, it is immediately followed by F(bot) ≤ F(F(bot)). Similarly, In other words, if F is monotonic, this sequence is a chain. Main theorem: given a CPO A, if it has a least element, then every monotonic continuous function F has a fixpoint and the least fixpoint of F is: Proof. On one hand, this least upper bound is a fixpoint: The first equality is true because F is continuous. The second equality is true because bot is less than or equal to all other elements in the sequence. On the other hand, this fixpoint is the least one. For any other fixpoint x, in other words, suppose F(x) = x. Then, Thus, due to the fact that F is monotonic and x is a fixpoint. And so on, That means, x is an upper bound of bot, F(bot), F(F(bot)), .... It must be greater than or equal to QED.

Denotation of Loops as Bourbaki-Witt Fixpoint

Our definition loop_sem is actually a Bourbaki-Witt fixpoint of the recursive equation defined by loop_recur. In this case, set A is the set of binary relations between program stats, i.e. A := state → state → Prop. The equivalence relation defined on A is com_dequiv. The partial order defined on A is the subset relation, i.e. We can easily show that this binary relation is actually a partial order, i.e., it is reflexive, transitive and antisymmetric. Moreoever, this partial ordering is a CPO. The least upper bound, lub, of a chain is the union of all binary relations in the chain. Specifically, omega_union defines the lub of a sequence of relations. In the end, the function that maps d to is monotonic and continuous. And loop_sem is exactly the Bourbaki-Witt fixpoint of this function.

Program Equivalence

For examples of command equivalence, let's start by looking at some trivial program transformations involving Skip:

Also, we can prove that adding a Skip after a command results in an equivalent program.

Now we show that we can swap the branches of an IF if we also negate its guard.

The next line tauto reads "tautology" (重言式). This tactic can be used to reason able normal logic connectives, including implication, conjunction, disjuction, negation and logical equivalence.

An interesting fact about While commands is that any number of copies of the body can be "unrolled" without changing meaning. Loop unrolling is a common transformation in real compilers.

Usually, we do not distinguish (c₁;;c₂);;c₃ with c₁;;(c₂;;c₃) when we write real programs. We do not have to because they have the same behavior.

The following theorem says, if two expressions are equivalent, then assigning their value into the same variable has the same behavior.

We will verify that the equivalence on coms really are equivalences — i.e., that they are reflexive, symmetric, and transitive. The proofs are all easy.

Behavioral equivalence is also a congruence. That is, the equivalence of two subprograms implies the equivalence of the larger programs in which they are embedded. The main idea is that the congruence property allows us to replace a small part of a large program with an equivalent small part and know that the whole large programs are equivalent without doing an explicit proof about the non-varying parts — i.e., the "proof burden" of a small change to a large program is proportional to the size of the change, not the program. We will prove the congruence property for loops in class. Other congruence properties' proofs will be left as homework. Theorem: Equivalence is a congruence for WHILE — that is, if c is equivalent to c', then While b Do c EndWhile is equivalent to While b Do c' EndWhile.

Hmmm, it seems that we need an auxilliary lemma for iter_loop_body's congruence.

Here, we need to do induction over n.

Hmm, it would be better if we have auxilliary lemmas for relation operators.

Here, we first prove that concat has congruence property.

Also, intersection has congruence property.

Third, union has congruence property. Its proof is similar.

In addition, we prove the congruence property of omega_union.

Now, we are ready to prove the congruence property of iter_loop_body.

And eventually, we will prove our main theorem.