500 '
CIS Software Foundations Fall 2004 29 September
&
CIS 500, 29 September
1
'
Announcements
Upcoming CIS Colloquia related to programming languages Tuesdays, 3:00-4:30, Levine 101 Oct 19 - Andy Gordon, MSR Cambridge Nov 16 - Greg Morrisett, Harvard University Nov 23 - Jeanette Wing, CMU
&
CIS 500, 29 September
2
'
Encoding recursion
Today
Proving properties by induction Variable substitution and alpha-equivalence Program equivalence
&
CIS 500, 29 September
3
'
Recursion in the Lambda Calculus
&
CIS 500, 29 September
4
'
Iterated Application
Suppose f is some -abstraction, and consider the following term: Yf = (x. f (x x)) (x. f (x x))
&
CIS 500, 29 September
5
'
Iterated Application
Suppose f is some -abstraction, and consider the following term: Yf = (x. f (x x)) (x. f (x x))
Now the pattern of divergence becomes more interesting: Yf = (x. f (x x)) (x. f (x x)) f ((x. f (x x)) (x. f (x x))) f (f ((x. f (x x)) (x. f (x x)))) f (f (f ((x. f (x x)) (x. f (x x)))))
5-a
&
CIS 500, 29 September
'
Yf is still not very useful, since (like omega), all it does is diverge.
Is there any way we could slow it down?
&
CIS 500, 29 September
6
'
Delaying Divergence
poisonpill = y. omega
Note that poisonpill is a value it it will only diverge when we actually apply it to an argument. This means that we can safely pass it as an argument to other functions, return it as a result from functions, etc. (p. fst (pair p fls) tru) poisonpill fst (pair poisonpill fls) tru poisonpill tru omega
&
CIS 500, 29 September
7
'
A delayed variant of omega
Here is a variant of omega in which the delay and divergence are a bit more tightly intertwined: omegav = y. (x. (y. x x y)) (x. (y. x x y)) y
Note that omegav is a normal form. However, if we apply it to any argument v, it diverges: omegav v = (y. (x. (y. x x y)) (x. (y. x x y)) y) v (x. (y. x x y)) (x. (y. x x y)) v (y. (x. (y. x x y)) (x. (y. x x y)) y) v = omegav v
8
&
CIS 500, 29 September
'
Another delayed variant
Suppose f is a function. Dene Zf = y. (x. f (y. x x y)) (x. f (y. x x y)) y
This term combines the added f from Yf with the delayed divergence of omegav.
&
CIS 500, 29 September
9
'
If we now apply Zf to an argument v, something interesting happens: Zf v = (y. (x. f (y. x x y)) (x. f (y. x x y)) y) v (x. f (y. x x y)) (x. f (y. x x y)) v f (y. (x. f (y. x x y)) (x. f (y. x x y)) y) v = f Zf v
Since Zf and v are both values, the next computation step will be the reduction of f Zf that is, before we diverge, f gets to do some computation. Now we are getting somewhere.
&
CIS 500, 29 September
10
'
Let f =
Recursion
fct. n. if n=0 then 1 else n * (fct (pred n))
f looks just the ordinary factorial function, except that, in place of a recursive call in the last time, it calls the function fct, which is passed as a parameter.
N.b.: for brevity, this example uses real numbers and booleans, inx syntax, etc. It can easily be translated into the pure lambda-calculus (using Church numerals, etc.).
11
&
CIS 500, 29 September
'
We can use Z to tie the knot in the denition of f and obtain a real recursive factorial function: Z f 3 f Zf 3 = (fct. n. ...) Zf 3 if 3=0 then 1 else 3 * (Zf (pred 3)) 3 * (Zf (pred 3))) 3 * (Zf 2) 3 * (f Zf 2)
&
CIS 500, 29 September
12
'
If we dene
A Generic Z
Z i.e., Z =
=
f. Zf
f. y. (x. f (y. x x y)) (x. f (y. x x y)) y
then we can obtain the behavior of Zf for any f we like, simply by applying Z to f. Z f Zf
&
CIS 500, 29 September
13
'
For example: fact = Z ( fct. n. if n=0 then 1 else n * (fct (pred n)) )
&
CIS 500, 29 September
14
'
Technical note:
The term Z here is essentially the same as the fix discussed the book. Z fix = = f. y. (x. f (y. x x y)) (x. f (y. x x y)) y f. (x. f (y. x x y)) (x. f (y. x x y))
Z is hopefully slightly easier to understand, since it has the property that Z f v f (Z f) v, which fix does not (quite) share.
&
CIS 500, 29 September
15
'
Proofs about the Lambda Calculus
&
CIS 500, 29 September
16
'
Two induction principles
Like before, we have mentioned two ways to prove properties are true of the untyped lambda calculus. Structural induction Induction on derivation of t t . Lets do an example of the latter.
&
CIS 500, 29 September
17
'
Induction principle
Recall the induction principle for the small-step evaluation relation. We can show a property P is true for all derivations of t t , when P holds for all derivations that use the rule E-AppAbs. P holds for all derivations that end with a use of E-App1 assuming that P holds for all subderivations. P holds for all derivations that end with a use of E-App2 assuming that P holds for all subderivations.
&
CIS 500, 29 September
18
'
Example
We can formally dene the set of free variables in a -term as follows: FV(x) = {x} FV(x.t1 ) = FV(t1 )/{x} FV(t1 t2 ) = FV(t1 ) FV(t2 ) Theorem: if t t then FV(t) FV(t ).
&
CIS 500, 29 September
19
'
Induction on derivation
We want to prove, for all derivations of t t , that FV(t) FV(t ). We have three cases.
&
CIS 500, 29 September
20
'
Induction on derivation
We want to prove, for all derivations of t t , that FV(t) FV(t ). We have three cases. The derivation of t t could just be a use of E-AppAbs. In this case, t is (x.u)v which steps to [xv]u. FV(t) = FV((x.u)v) = FV(u)/{x} FV(v) FV([xv]u) = FV(t )
&
CIS 500, 29 September
20-a
'
The derivation could end with a use of E-App1. In other words, we have a derivation of t1 t1 and we use it to show that t1 t2 t1 t2 .
By induction FV(t1 ) FV(t1 ). FV(t) = FV(t1 t2 ) = FV(t1 ) FV(t2 ) FV(t1 ) FV(t2 ) = FV(t1 t2 ) = FV(t )
&
CIS 500, 29 September
21
'
The derivation could end with a use of E-App1. In other words, we have a derivation of t1 t1 and we use it to show that t1 t2 t1 t2 .
By induction FV(t1 ) FV(t1 ). FV(t) = FV(t1 t2 ) = FV(t1 ) FV(t2 ) FV(t1 ) FV(t2 ) = FV(t1 t2 ) = FV(t )
The derivation could end with a use of E-App2. Here, we have a derivation of t2 t2 and we use it to show that t1 t2 t1 t2 . This case is analogous to the previous case.
&
CIS 500, 29 September
21-a
'
More about bound variables
&
CIS 500, 29 September
22
'
Substitution
Our denition of evaluation was based on the substitution of values for free variables within terms. E-AppAbs (x.t12 ) v2 [x v2 ]t12 But what is substitution, really? How do we dene it?
&
CIS 500, 29 September
23
'
Formalizing Substitution
Consider the following denition of substitution: [x s]x = s [x s]y = y [x s](y.t1 ) = y. ([x s]t1 ) [x s](t1 t2 ) = ([x s]t1 )([x s]t2 ) What is wrong with this denition? if x = y
&
CIS 500, 29 September
24
'
Formalizing Substitution
Consider the following denition of substitution: [x s]x = s [x s]y = y [x s](y.t1 ) = y. ([x s]t1 ) [x s](t1 t2 ) = ([x s]t1 )([x s]t2 ) What is wrong with this denition? It substitutes for free and bound variables! [x y](x. x) = x.y if x = y
This is not what we want.
24-a
&
CIS 500, 29 September
'
[x s]x = s [x s]y = y
Substitution, take two
if x = y if x = y
[x s](y.t1 ) = y. ([x s]t1 ) [x s](x.t1 ) = x. t1 [x s](t1 t2 ) = ([x s]t1 )([x s]t2 ) What is wrong with this denition?
&
CIS 500, 29 September
25
'
[x s]x = s [x s]y = y
Substitution, take two
if x = y if x = y
[x s](y.t1 ) = y. ([x s]t1 ) [x s](x.t1 ) = x. t1 [x s](t1 t2 ) = ([x s]t1 )([x s]t2 ) What is wrong with this denition? It suers from variable capture! [x y](y.x) = x. x
This is also not what we want.
25-a
&
CIS 500, 29 September
'
[x s]x = s [x s]y = y
Substitution, take three
if x is not y if x = y, y FV(s)
[x s](y.t1 ) = y. ([x s]t1 ) [x s](x.t1 ) = x. t1 [x s](t1 t2 ) = ([x s]t1 )([x s]t2 ) What is wrong with this denition?
&
CIS 500, 29 September
26
'
[x s]x s = [x s]y = y
Substitution, take three
if x is not y if x = y, y FV(s)
[x s](y.t1 ) = y. ([x s]t1 ) [x s](x.t1 ) = x. t1 [x s](t1 t2 ) = ([x s]t1 )([x s]t2 ) What is wrong with this denition? Now substition is a partial function! [x y](y.x) is undened. But we want an answer for every substitution.
&
CIS 500, 29 September
26-a
'
Bound variable names shouldnt matter
Its annoying that that the names of bound variables are causing trouble with our denition of substitution. Intuition tells us that there shouldnt be a dierence between the functions x.x and y.y. Both of these functions will do the same thing. Because they dier only in the names of their bound variables, wed like to think that these are the same function. We call such terms alpha-equivalent.
&
CIS 500, 29 September
27
'
Alpha-equivalence classes
In fact, we can create equivalence classes of terms that dier only in the names of bound variables. When working with the lambda calculus, it is convenient to think about these equivalence classes, instead of raw terms. For example, when we write x.x we mean not just this term, but the class of terms that includes y.y and z.z.
Unfortunately, we have to be more clever when implementing the lambda calculus in ML... (cf. TAPL chapters 6 and 7)
28
&
CIS 500, 29 September
'
Substitution, for alpha-equivalence classes
Now consider substitution as an operation over alpha-equivalence classes of terms: [x s]x = s [x s]y = y [x s](y.t1 ) = y. ([x s]t1 ) [x s](t1 t2 ) = ([x s]t1 )([x s]t2 ) Examples: [x y](y.x) must give the same result as [x y](z.x). We know the latter is z.y, so that is what we will use for the former. [x y](x.z) must give the same result as [x y](w.z). We know the latter is w.z so that is what we use for the former. if x = y if x = y, y FV(s)
&
CIS 500, 29 September
29
'
Equivalence of Lambda Terms
&
CIS 500, 29 September
30
'
Program Equivalence
Syntactic equivalence - Are the terms the same letter by letter? Not that useful. Alpha-equivalence - Are the terms equivalent up to renaming of bound variables? Beta/eta-equivalence - Can we use specic program transformations to convert one term into another? Behavioral equivalence - If both terms are placed in the same context, will they produce the same result?
&
CIS 500, 29 September
31
'
Why is program equivalence important?
&
CIS 500, 29 September
32
'
Why is program equivalence important?
Used to catch cheaters in low-level programming classes. Used to prove the correctness of embeddings. (Why should we believe that Church encodings represent natural numbers?) Used to prove the correctness of compiler optimizations. Used to show that updates to a program do not break it.
&
CIS 500, 29 September
32-a
'
Representing Numbers
We have seen how certain terms in the lambda-calculus can be used to represent natural numbers.
c0 c1 c2 c3 = = = = s. s. s. s. z. z. z. z. z s z s (s z) s (s (s z))
Other lambda-terms represent common operations on numbers:
scc = n. s. z. s (n s z)
&
CIS 500, 29 September
33
'
Representing Numbers
We have seen how certain terms in the lambda-calculus can be used to represent natural numbers.
c0 c1 c2 c3 = = = = s. s. s. s. z. z. z. z. z s z s (s z) s (s (s z))
Other lambda-terms represent common operations on numbers:
scc = n. s. z. s (n s z)
In what sense can we say this representation is correct? In particular, on what basis can we argue that scc on church numerals corresponds to ordinary successor on numbers?
&
CIS 500, 29 September
33-a
'
One possibility:
The naive approach
For each n, the term scc cn evaluates to cn+1 .
&
CIS 500, 29 September
34
'
One possibility:
The naive approach... doesnt work
For each n, the term scc cn evaluates to cn+1 . Unfortunately, this is false. E.g.: scc c2 = = = (n. s. z. s (n s z)) (s. z. s (s z)) s. z. s ((s. z. s (s z)) s z) s. z. s (s (s z)) c3
&
CIS 500, 29 September
34-a
'
A better approach
Recall the intuition behind the church numeral representation: a number n is represented as a term that does something n times to something else scc takes a term that does something n times to something else and returns a term that does something n + 1 times to something else I.e., what we really care about is that scc c2 behaves the same as c3 when applied to two arguments.
&
CIS 500, 29 September
35
'
scc c2 v w = c3 v w = (n. s. z. s (n s z)) (s. z. s (s z)) v w (s. z. s ((s. z. s (s z)) s z)) v w (z. v ((s. z. s (s z)) v z)) w v ((s. z. s (s z)) v w) v ((z. v (v z)) w) v (v (v w))
(s. z. s (s (s z))) v w (z. v (v (v z))) w v (v (v w)))
&
CIS 500, 29 September
36
'
A More General Question
We have argued that, although scc c2 and c3 ...