Remark. Some material in this lecture is from << Software Foundation >> volume 1 and volume 2.

Review: Programs' Denotation

In the last lecture, we learnt to define expressions' denotations. Specifically, an integer expression's denotation is a function from program states to integers, and a boolean expression's denotation is a subset of program states. Sometimes, we will also write [[ ]] to describe expression denotation. For example, our definition of aeval and beval partly say: For programs, we use binary relations between program states to represent their denotations.

Soppose then_branch and else_branch are denotations of the then-branch and else-branch of an if-command. Here, the first clause of union the set of program state pairs (st₁, st₂) such that:

• (st₁, st₂) belongs to then_branch and b is true on st₁

And similarly, the second clause of union the set of program state pairs (st₁, st₂) such that:

• (st₁, st₂) belongs to else_branch and b is false on st₁

The union of them is the semantics of an if-command.

Here, a pair (st₁, st₂) is inside the denotation of c if and only if ceval c st₁ st₂ holds. The following notation and lemmas may help you understand.

Loops' Denotations

Loops' semantics is comparatively nontrivial. One understanding is: While b Do c EndWhile will test b first then either do Skip or execute c ;; While b Do c EndWhile. Another understanding is: a loop means executing the loop body zero time, one time, two times, or etc. The first understanding is kind of self-defined. We choose the second one. The following recursive function defines the semantics of executing the loop body for exactly n times. In Coq, nat represents nature numbers. Coq users can write functions recursively on nature numbers. Specifically, a natural number n is either zero O (the "O" of Omega) or the successor of another natural number n', written as S n'.

In short, iter_loop_body b loop_body n is defined as:

• if n = 0, identity relation with the restriction that b is not true;
• if n = n' + 1, first do loop_body then do iter_loop_body b loop_body n' with the restriction that b is true at beginning.

The union of these binary relations is exactly the meaning of while loops. The following relation operator omega_union defines the union of countably many relations.

With loop_sem which is just defined, we are eventually ready to complete our definition of ceval.

The following five lemmas are only presented for Coq proofs' convenience.

Application Of Denotational Semantics

Will this program terminate? No.

Will this program terminate? Yes. This time, the only formal description we can use is via denotational semantics and we can prove it the following statement in Coq. You can read its Coq proof after class.

Additional Readings

This time, we need to do constructive reasoning, i.e. construct an ending state from the beginning state.

Here, we define a program state, i.e. a new function from program variables to integers. This program state is almost the same as st but only differs with st on X's value. X's new value will be v. The Coq expression if (Nat.eq_dec X Y) then _ else _ says, if X and Y are the same variable, do the calculation described by then; otherwise do the calculation defined by else. In proofs, we can write destruct (Nat.eq_dec X Y) to do case analysis on whether X and Y are the same variable. It is worth one more sentence emphasizing that Nat.eq_dec X Y is not to tell whether their values are the same; it tells whether they are the same variable. You might be curious why Nat appears here. Here is some explanation. You do not need understand all of this. You can freely skip it if you want. If you take a look at how "variables" are formalized in Imp, you would find that they are just names! And different variables are just represented by different natural numbers, i.e. 1st variable, 2nd variable, etc. That is why to determine whether two variable names are the same is to determine whether two natural numbers are the same.

Semantic Equivalence

An Equivalence Between Integer Expressions

One week ago, we have defined semantic equivalence between integer expressions by:

• Two expressions a₁ and a₂ are equivalent if evaluating them on st has the same result for every program state st.

Now, using higher-order understanding, we can restate it as follows:

• Two expressions a₁ and a₂ are equivalent if their denotations are equivalent functions.

Formally:

It is a equivalence relation.

Moreover, it is a congruence (同余关系). That is, the equivalence of two subexpressions implies the equivalence of the larger expressions in which they are embedded. The main idea is that the congruence property allows us to replace a small part of a large expression with an equivalent small part and know that the whole large expressions are equivalent without doing an explicit proof about the non-varying parts — i.e., the "proof burden" of a small change to a large expression is proportional to the size of the change, not the expression.

An Equivalence Between Boolean Expressions

Then we will establish the theory of boolean expression's equivalence.

We need the following auxiliary lemmas.

Similar to integer expressions' equivalence, boolean expressions' equivalence is also an equivalence relation and a congruence relation.

An Equivalence Between Programs

For program equivalence, we need to define equivalence between relations first.

Here is its properties.

Then we define program equivalence and prove its properties.

This just says, two programs c₁ and c₂ are equivalent when c₁ turns st₁ to st₂ if and only if c₂ also turns st₁ to st₂, for any st₁ and st₂. This relation is also an equivalence and congruence.

Program equivalence is the theoretical foundation of compiler optimization. Let's take a look at some typical examples. For examples of general equivalence schema, let's start by looking at some trivial program transformations involving Skip:

Also, we can prove that adding a Skip after a command results in an equivalent program.

Now we show that we can swap the branches of an IF if we also negate its guard.

An interesting fact about While commands is that any number of copies of the body can be "unrolled" without changing meaning. Loop unrolling is a common transformation in real compilers.

This is not easy to prove. Let's isolate it.

Bourbaki-Witt Theorem

For now, we have successfully proved that loop_sem is a fixpoint constructor which satisfies the recursive equation loop_sem_unrolling. Remember, x is a fixpoint of f when x = f x. Here, loop_sem b R is a solution of the following equation:

• X = (if_sem b (concat R X) id) .

Our proof is actually one special case of Bourbaki-Witt fixpoint theorem.

Partial Order

A partial order (偏序) on a set A is a binary relation R (usually written as ≤) which is reflexive (自反), transitive (传递), and antisymmetric (反对称). Formally, The least element of A w.r.t. a partial order ≤ is also called bottom:

Chain

A subset of elements in A is called a chain w.r.t. a partial order ≤ if any two elements in this subset are comparable. For example, if a sequence xs: nat -> A is monotonically increasing: then it forms a chain. A partial order ≤ is called complete if every chain has its least upper bound lub and greatest lower bound glb. In short, the set A (companied with order ≤) is called a complete partial ordering, CPO (完备偏序集). Some text books require chains to be nonempty. We do not put such restriction on chain's definition here. Thus, the empty set is a chain. Its least upper bound is the least element of A, in other words, bot.

Monotonic and Continuous Functions

Given two CPOs A, ≤A= and B, ≤B=, a function F: A -> B is called monotonic (单调) if it preserves order. Formally, A function F: A -> B is called continuous (连续) if it preserves lub. Formally, Here, the lub function on the left hand side means the least upper bound defined by B and the one on the right hand side is defined by A. The definition of continuous does not require the preservation of glb becasue CPOs are usually defined in a direction that larger elements are more defined .

Least fixpoint

Given a CPO A, we can always construct a sequence of elements as follows: Obviously, bot ≤ F(bot) is true due to the definition of bot. If F is monotonic, it is immediately followed by F(bot) ≤ F(F(bot)). Similarly, In other words, if F is monotonic, this sequence is a chain. Main theorem: given a CPO A, if it has a least element, then every monotonic continuous function F has a fixpoint and the least fixpoint of F is: Proof. On one hand, this least upper bound is a fixpoint: The first equality is true because F is continuous. The second equality is true because bot is less than or equal to all other elements in the sequence. On the other hand, this fixpoint is the least one. For any other fixpoint x, in other words, suppose F(x) = x. Then, Thus, due to the fact that F is monotonic and x is a fixpoint. And so on, That means, x is an upper bound of bot, F(bot), F(F(bot)), .... It must be greater than or equal to QED.

Denotation of Loops as Bourbaki-Witt Fixpoint

Our definition loop_sem is actually a Bourbaki-Witt fixpoint of the recursive equation defined by loop_sem_unrollong. In this case, set A is the set of binary relations between program stats, i.e. A := state->state->Prop. The equivalence relation defined on A is Rel.equiv. The partial order defined on A is the subset relation, i.e. Rel.le. This partial ordering is a CPO. The least upper bound, lub, of a chain is the union of all binary relations in the chain. Specifically, omega_union defines the lub of a sequence of relations. In the end, the function that maps X to if_sem b (concat R X) id) is monotonic and continuous. And loop_sem is exactly the Bourbaki-Witt fixpoint of this function.