Remark. Some material in this lecture is from << Software Foundation >> volume 1 and volume 2.

Review: Program Expression's Denotational Semantics

We have learnt how to define integer expression's denotational semantics. We can define it by recursion. In this Coq description, state means the set of program states and every program state is a function from program variables to integer values, i.e. var -> Z.

Recall that fold_constants_aexp folds constant computation in integer expressions.

Which statements are correct?

• 1 + 2 + X will be turned into 3 + X;
• 1 - 1 + X will be turned into X;
• X + 1 - 1 will be turned into X + 0;
• X + 1 * 1 will be turned into X + 1.

Answer:

• Correct;
• Incorrect;
• Incorrect;
• Correct.

Higher-Order Thinking

Let's take another look of our previous definition of aeval. What is its Coq type?

It is a binary function. It takes two arguments, a program state and an integer expression, then generates one integer value. At the same time, we can treate it as a special single-argument function, whose argument type is state and whose result type is aexp -> Z, i.e. a function from integer expressions to integer values.

Now, let's take another definition.

This time, we swap the order of two arguments. As a result, aexp_eval can be interpreted as a two-argument function, or a one-argument function which maps integer expresions into functions from program states to integers. Sometimes we say that the denotation of an integer expression a is a function from program states to integer values. To be more explicit, we can redefine it as follows via function operations.

Here, we define Func.add to be the sum of two functions. In Coq, we use fun a ⇒ ... to represent a function which takes st as its argument. The right hand side expression of fun a ⇒ represents the function value given this specific argument a. In summary, add is a function which takes two arguments. These two arguments and the function value are themselves functions. The function value is define using fun a ⇒ ... in Coq. Functions that manipulate other functions are often called higher-order functions (高阶函数). Thus, Func.add is a higher-order function. In hand written math, we sometimes use f(x) to represent a function and sometimes use f(x) to represent a specific value: the result of applying function f to a specific value x. Moreover, we write f(x) + g(x) to represent the sum of two functions, or two values, which is usually unambiguous from context. In comparison, f+g is not used very often. In Coq, f x + g x is the sum of two numbers while fun x ⇒ f x + g x is the sum of two functions. In these definitions, we sometimes use braces "{}" instead of parentheses "()". When braces are used, those arguments are called implicit arguments, i.e. you do not need to write those arguments when you use a function. For using Func.add we do not need to feed that argument A explicitly. Coq can infer that from the context. We also define the subtraction and multiplication of two functions in a similar way. Based on that, the denotation of an aexp can be defined as:

Higher-order thinking is critical here. Remember, the denotation of an aexp is a function. Func.add computes the sum of two functions, which is used to define the meaning of APlus, the "+" symbol in expressions.

More Higher-order Objects

Do-it-three-times

The argument f here is itself a function (from X to X); the body of doit3times applies f three times to some value n.

What is the following computations' result?

Computing sets from functions

In Coq, we can use A -> Prop to represent subsets of A. Here, a mapping from A to Prop means a criterion judging whether every element of A is in this set.

Higher-order Properties

Here is a lemma about function equivalence.

Obviously, Func.equiv and Sets.equiv are equivalent relations, i.e. they are both reflexive (自反的), symmetric (对称的) and transitive (传递的).

Reflexive is defined in Coq standard library. We can unfold its definitions.

Moreover, Func.equiv is preserved by Func.add, Func.sub and Func.mul. You may want to state a lemma as follows:

Coq suggests you use Proper to describe such preservation theorems.

The following line exposes Proper's meaning.

Why using Proper is better than Func_add_equiv_naive? Coq supports rewriting via Proper!

The first rewrite is sound because Func.equiv is transitive. The second and third rewrite are sound because Func.equiv is preserved by Func.add and Func.equiv is reflexive. Coq reasons about that automatically according to the registrations of Existing Instances. Again, do not drown in Coq's details! But try to understand higher-order functions and their higher-order properties. This example shows how higher order objects help describing nontrivial theories in an abstract and intuitive way.

Evaluating Boolean Expressions

We will use higher-order objects to define boolean expressions' denotations. Before that, we need more definitions about sets.

Recall that our syntax trees of boolean expressions are: b ::= true | false | a == a | a <= a | ! b | b && b

Evaluating Command

Next we need to define what it means to evaluate a command. One idea is to define such evaluation as a function from beginning state and command to ending state. But the fact that WHILE loops don't necessarily terminate means that such evaluating function cannot be a total function; it must be a partial function. Although such definition is no problem in theory, computer scientists choose not to do this since it is less extensible. Also, if you try do write it in Coq, it is nontrivial. Usually, computer scientists use a set of state pairs S to represent a program c's denotation. Specifically, if a program state pair (st₁, st₂) is an element of S, then executing c from state st₁ may terminate with state st₂. In other words, the denotation of a program has type state -> state -> Prop in Coq. Remark: this is different from Hoare triples. Hoare triples are about assertion pairs but a program's denotation is about program state pairs. A set of program state pairs is also called a binary relation between program states. In Coq, we can use state -> state -> Prop to present such type. It is like using A -> Prop to describe subsets of A. As a preparation, we first define some basic concepts about relations.

Using these basic definitions about relation, we can easily define the denotation of empty commands, assignment commands, sequential composition and if-then-else commands.