Mercurial > cpdt > repo

comparison src/Hoas.v @ 252:3c4ed57c9907

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Hoas intro
author Adam Chlipala <adamc@hcoop.net>
date Wed, 16 Dec 2009 10:39:22 -0500
parents 13620dfd5f97
children 0d77577e5ac0
comparison
equal deleted inserted replaced
251:621010c9522f 252:3c4ed57c9907
16 (* end hide *) 16 (* end hide *)
17 17
18 18
19 (** %\chapter{Higher-Order Abstract Syntax}% *) 19 (** %\chapter{Higher-Order Abstract Syntax}% *)
20 20
21 (** TODO: Prose for this chapter *) 21 (** In many cases, detailed reasoning about variable binders and substitution is a small annoyance; in other cases, it becomes the dominant cost of proving a theorem formally. No matter which of these possibilities prevails, it is clear that it would be very pragmatic to find a way to avoid reasoning about variable identity or freshness. A well-established alternative to first-order encodings is %\textit{%#<i>#higher-order abstract syntax#</i>#%}%, or HOAS. In mechanized theorem-proving, HOAS is most closely associated with the LF meta logic and the tools based on it, including Twelf.
22 22
23 23 In this chapter, we will see that HOAS cannot be implemented directly in Coq. However, a few very similar encodings are possible and are in fact very effective in some important domains. *)
24 (** * Parametric Higher-Order Abstract Syntax *) 24
25
26 (** * Classic HOAS *)
27
28 (** The motto of HOAS is simple: represent object language binders using meta language binders. Here, "object language" refers to the language being formalized, while the meta language is the language in which the formalization is done. Our usual meta language, Coq's Gallina, contains the standard binding facilities of functional programming, making it a promising base for higher-order encodings.
29
30 Recall the concrete encoding of basic untyped lambda calculus expressions. *)
31
32 Inductive uexp : Set :=
33 | UVar : string -> uexp
34 | UApp : uexp -> uexp -> uexp
35 | UAbs : string -> uexp -> uexp.
36
37 (** The explicit presence of variable names forces us to think about issues of freshness and variable capture. The HOAS alternative would look like this. *)
38
39 Reset uexp.
40
41 (** [[
42 Inductive uexp : Set :=
43 | UApp : uexp -> uexp -> uexp
44 | UAbs : (uexp -> uexp) -> uexp.
45
46 ]]
47
48 We have avoided any mention of variables. Instead, we encode the binding done by abstraction using the binding facilities associated with Gallina functions. For instance, we might represent the term $\lambda x. \; x \; x$#<tt>\x. x x</tt># as [UAbs (fun x => UApp x x)]. Coq has built-in support for matching binders in anonymous [fun] expressions to their uses, so we avoid needing to implement our own binder-matching logic.
49
50 This definition is not quite HOAS, because of the broad variety of functions that Coq would allow us to pass as arguments to [UAbs]. We can thus construct many [uexp]s that do not correspond to normal lambda terms. These deviants are called %\textit{%#<i>#exotic terms#</i>#%}%. In LF, functions may only be written in a very restrictive computational language, lacking, among other things, pattern matching and recursive function definitions. Thus, thanks to a careful balancing act of design decisions, exotic terms are not possible with usual HOAS encodings in LF.
51
52 Our definition of [uexp] has a more fundamental problem: it is invalid in Gallina.
53
54 [[
55 Error: Non strictly positive occurrence of "uexp" in
56 "(uexp -> uexp) -> uexp".
57
58 ]]
59
60 We have violated a rule that we considered before: an inductive type may not be defined in terms of functions over itself. Way back in Chapter 3, we considered this example and the reasons why we should be glad that Coq rejects it. Thus, we will need to use more cleverness to reap similar benefits.
61
62 The root problem is that our expressions contain variables representing expressions of the same kind. Many useful kinds of syntax involve no such cycles. For instance, it is easy to use HOAS to encode standard first-order logic in Coq. *)
63
64 Inductive prop : Type :=
65 | Eq : forall T, T -> T -> prop
66 | Not : prop -> prop
67 | And : prop -> prop -> prop
68 | Or : prop -> prop -> prop
69 | Forall : forall T, (T -> prop) -> prop
70 | Exists : forall T, (T -> prop) -> prop.
71
72 Fixpoint propDenote (p : prop) : Prop :=
73 match p with
74 | Eq _ x y => x = y
75 | Not p => ~ (propDenote p)
76 | And p1 p2 => propDenote p1 /\ propDenote p2
77 | Or p1 p2 => propDenote p1 \/ propDenote p2
78 | Forall _ f => forall x, propDenote (f x)
79 | Exists _ f => exists x, propDenote (f x)
80 end.
81
82 (** Unfortunately, there are other recursive functions that we might like to write but cannot. One simple example is a function to count the number of constructors used to build a [prop]. To look inside a [Forall] or [Exists], we need to look inside the quantifier's body, which is represented as a function. In Gallina, as in most statically-typed functional languages, the only way to interact with a function is to call it. We have no hope of doing that here; the domain of the function in question has an arbitary type [T], so [T] may even be uninhabited. If we had a universal way of constructing values to look inside functions, we would have uncovered a consistency bug in Coq!
83
84 We are still suffering from the possibility of writing exotic terms, such as this example: *)
85
86 Example true_prop := Eq 1 1.
87 Example false_prop := Not true_prop.
88 Example exotic_prop := Forall (fun b : bool => if b then true_prop else false_prop).
89
90 (** Thus, the idea of a uniform way of looking inside a binder to find another well-defined [prop] is hopelessly doomed.
91
92 A clever HOAS variant called %\textit{%#<i>#weak HOAS#</i>#%}% manages to rule out exotic terms in Coq. Here is a weak HOAS version of untyped lambda terms. *)
93
94 Parameter var : Set.
95
96 Inductive uexp : Set :=
97 | UVar : var -> uexp
98 | UApp : uexp -> uexp -> uexp
99 | UAbs : (var -> uexp) -> uexp.
100
101 (** We postulate the existence of some set [var] of variables, and variable nodes appear explicitly in our syntax. A binder is represented as a function over %\textit{%#<i>#variables#</i>#%}%, rather than as a function over %\textit{%#<i>#expressions#</i>#%}%. This breaks the cycle that led Coq to reject the literal HOAS definition. It is easy to encode our previous example, $\lambda x. \; x \; x$#<tt>\x. x x</tt>#: *)
102
103 Example self_app := UAbs (fun x => UApp (UVar x) (UVar x)).
104
105 (** What about exotic terms? The problems they caused earlier came from the fact that Gallina is expressive enough to allow us to perform case analysis on the types we used as the domains of binder functions. With weak HOAS, we use an abstract type [var] as the domain. Since we assume the existence of no functions for deconstructing [var]s, Coq's type soundness enforces that no Gallina term of type [uexp] can take different values depending on the value of a [var] available in the typing context, %\textit{%#<i>#except#</i>#%}% by incorporating those variables into a [uexp] value in a legal way.
106
107 Weak HOAS retains the other disadvantage of our previous example: it is hard to write recursive functions that deconstruct terms. As with the previous example, some functions %\textit{%#<i>#are#</i>#%}% implementable. For instance, we can write a function to reverse the function and argument positions of every [UApp] node. *)
108
109 Fixpoint swap (e : uexp) : uexp :=
110 match e with
111 | UVar _ => e
112 | UApp e1 e2 => UApp (swap e2) (swap e1)
113 | UAbs e1 => UAbs (fun x => swap (e1 x))
114 end.
115
116 (** However, it is still impossible to write a function to compute the size of an expression. We would still need to manufacture a value of type [var] to peer under a binder, and that is impossible, because [var] is an abstract type. *)
117
118
119 (** * Parametric HOAS *)
25 120
26 Inductive type : Type := 121 Inductive type : Type :=
27 | Nat : type 122 | Nat : type
28 | Arrow : type -> type -> type. 123 | Arrow : type -> type -> type.
29 124