adamc@227: (* Copyright (c) 2009, Adam Chlipala
adamc@227:  * 
adamc@227:  * This work is licensed under a
adamc@227:  * Creative Commons Attribution-Noncommercial-No Derivative Works 3.0
adamc@227:  * Unported License.
adamc@227:  * The license text is available at:
adamc@227:  *   http://creativecommons.org/licenses/by-nc-nd/3.0/
adamc@227:  *)
adamc@227: 
adamc@227: (* begin hide *)
adamc@227: Require Import DepList.
adamc@227: 
adamc@227: Set Implicit Arguments.
adamc@227: (* end hide *)
adamc@227: 
adamc@227: 
adamc@227: (** %\chapter{Universes and Axioms}% *)
adamc@227: 
adamc@227: (** Many traditional theorems can be proved in Coq without special knowledge of CIC, the logic behind the prover.  A development just seems to be using a particular ASCII notation for standard formulas based on set theory.  Nonetheless, as we saw in Chapter 4, CIC differs from set theory in making it possible to define the usual logical connectives as derived notions.  The foundation of it all is a dependently-typed functional programming language, based on dependent function types and inductive type families.  By using the facilities of this language directly, we can accomplish some things much more easily than in mainstream math.
adamc@227: 
adamc@227:    Gallina, which adds features to the more theoretical CIC, is the logic implemented in Coq.  It has a relatively simple foundation that can be defined rigorously in a page or two of formal proof rules.  Still, there are some important subtleties that have practical ramifications.  This chapter focuses on those subtleties, avoiding formal metatheory in favor of example code. *)
adamc@227: 
adamc@227: 
adamc@227: (** * The [Type] Hierarchy *)
adamc@227: 
adamc@227: (** Every object in Gallina has a type. *)
adamc@227: 
adamc@227: Check 0.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   0
adamc@227:      : nat
adamc@227:  
adamc@227:      ]]
adamc@227: 
adamc@227:   It is natural enough that zero be considered as a natural number. *)
adamc@227: 
adamc@227: Check nat.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   nat
adamc@227:      : Set
adamc@227:  
adamc@227:      ]]
adamc@227: 
adamc@227:   From a set theory perspective, it is unsurprising to consider the natural numbers as a "set." *)
adamc@227: 
adamc@227: Check Set.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   Set
adamc@227:      : Type
adamc@227:  
adamc@227:      ]]
adamc@227: 
adamc@227:   The type [Set] may be considered as the set of all sets, a concept that set theory handles in terms of %\textit{%#<i>#classes#</i>#%}%.  In Coq, this more general notion is [Type]. *)
adamc@227: 
adamc@227: Check Type.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   Type
adamc@227:      : Type
adamc@227:  
adamc@227:      ]]
adamc@227: 
adamc@227:   Strangely enough, [Type] appears to be its own type.  It is known that polymorphic languages with this property are inconsistent.  That is, using such a language to encode proofs is unwise, because it is possible to "prove" any theorem.  What is really going on here?
adamc@227: 
adamc@227:   Let us repeat some of our queries after toggling a flag related to Coq's printing behavior. *)
adamc@227: 
adamc@227: Set Printing Universes.
adamc@227: 
adamc@227: Check nat.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   nat
adamc@227:      : Set
adamc@227:      ]] *)
adamc@227: 
adamc@227: (** printing $ %({}*% #(<a/>*# *)
adamc@227: (** printing ^ %*{})% #*<a/>)# *)
adamc@227: 
adamc@227: Check Set.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   Set
adamc@227:      : Type $ (0)+1 ^
adamc@227: 
adamc@227:      ]] *)
adamc@227: 
adamc@227: Check Type.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   Type $ Top.3 ^
adamc@227:      : Type $ (Top.3)+1 ^
adamc@227:  
adamc@227:      ]]
adamc@227: 
adamc@227:   Occurrences of [Type] are annotated with some additional information, inside comments.  These annotations have to do with the secret behind [Type]: it really stands for an infinite hierarchy of types.  The type of [Set] is [Type0], the type of [Type0] is [Type1], the type of [Type1] is [Type2], and so on.  This is how we avoid the "[Type : Type]" paradox.  As a convenience, the universe hierarchy drives Coq's one variety of subtyping.  Any term whose type is [Type] at level [i] is automatically also described by [Type] at level [j] when [j > i].
adamc@227: 
adamc@227:   In the outputs of our first [Check] query, we see that the type level of [Set]'s type is [(0)+1]. Here [0] stands for the level of [Set], and we increment it to arrive at the level that %\textit{%#<i>#classifies#</i>#%}% [Set].
adamc@227: 
adamc@227:   In the second query's output, we see that the occurrence of [Type] that we check is assigned a fresh %\textit{%#<i>#universe variable#</i>#%}% [Top.3].  The output type increments [Top.3] to move up a level in the universe hierarchy.  As we write code that uses definitions whose types mention universe variables, unification may refine the values of those variables.  Luckily, the user rarely has to worry about the details.
adamc@227: 
adamc@227:   Another crucial concept in CIC is %\textit{%#<i>#predicativity#</i>#%}%.  Consider these queries. *)
adamc@227: 
adamc@227: Check forall T : nat, fin T.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   forall T : nat, fin T
adamc@227:      : Set
adamc@227:      ]] *)
adamc@227: 
adamc@227: Check forall T : Set, T.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   forall T : Set, T
adamc@227:      : Type $ max(0, (0)+1) ^
adamc@227:      ]] *)
adamc@227: 
adamc@227: Check forall T : Type, T.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   forall T : Type $ Top.9 ^ , T
adamc@227:      : Type $ max(Top.9, (Top.9)+1) ^
adamc@227:  
adamc@227:      ]]
adamc@227: 
adamc@227:   These outputs demonstrate the rule for determining which universe a [forall] type lives in.  In particular, for a type [forall x : T1, T2], we take the maximum of the universes of [T1] and [T2].  In the first example query, both [T1] ([nat]) and [T2] ([fin T]) are in [Set], so the [forall] type is in [Set], too.  In the second query, [T1] is [Set], which is at level [(0)+1]; and [T2] is [T], which is at level [0].  Thus, the [forall] exists at the maximum of these two levels.  The third example illustrates the same outcome, where we replace [Set] with an occurrence of [Type] that is assigned universe variable [Top.9].  This universe variable appears in the places where [0] appeared in the previous query.
adamc@227: 
adamc@227:   The behind-the-scenes manipulation of universe variables gives us predicativity.  Consider this simple definition of a polymorphic identity function. *)
adamc@227: 
adamc@227: Definition id (T : Set) (x : T) : T := x.
adamc@227: 
adamc@227: Check id 0.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   id 0
adamc@227:      : nat
adamc@227:  
adamc@227: Check id Set.
adamc@227: 
adamc@227: Error: Illegal application (Type Error):
adamc@227: ...
adamc@227: The 1st term has type "Type (* (Top.15)+1 *)" which should be coercible to "Set".
adamc@227:  
adamc@227:   ]]
adamc@227: 
adamc@227:   The parameter [T] of [id] must be instantiated with a [Set].  [nat] is a [Set], but [Set] is not.  We can try fixing the problem by generalizing our definition of [id]. *)
adamc@227: 
adamc@227: Reset id.
adamc@227: Definition id (T : Type) (x : T) : T := x.
adamc@227: Check id 0.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   id 0
adamc@227:      : nat
adamc@227:      ]] *)
adamc@227: 
adamc@227: Check id Set.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   id Set
adamc@227:      : Type $ Top.17 ^
adamc@227:   ]] *)
adamc@227: 
adamc@227: Check id Type.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   id Type $ Top.18 ^
adamc@227:      : Type $ Top.19 ^
adamc@227:   ]] *)
adamc@227: 
adamc@227: (** So far so good.  As we apply [id] to different [T] values, the inferred index for [T]'s [Type] occurrence automatically moves higher up the type hierarchy.
adamc@227: 
adamc@227:    [[
adamc@227: Check id id.
adamc@227: 
adamc@227: Error: Universe inconsistency (cannot enforce Top.16 < Top.16).
adamc@227:  
adamc@227:    ]]
adamc@227: 
adamc@227:   This error message reminds us that the universe variable for [T] still exists, even though it is usually hidden.  To apply [id] to itself, that variable would need to be less than itself in the type hierarchy.  Universe inconsistency error messages announce cases like this one where a term could only type-check by violating an implied constraint over universe variables.  Such errors demonstrate that [Type] is %\textit{%#<i>#predicative#</i>#%}%, where this word has a CIC meaning closely related to its usual mathematical meaning.  A predicative system enforces the constraint that, for any object of quantified type, none of those quantifiers may never be instantiated with the object itself.  Impredicativity is associated with popular paradoxes in set theory, involving inconsistent constructions like "the set of all sets that do not contain themselves."  Similar paradoxes result from uncontrolled impredicativity in Coq. *)
adamc@227: 
adamc@227: 
adamc@227: (** ** Inductive Definitions *)
adamc@227: 
adamc@227: (** Predicativity restrictions also apply to inductive definitions.  As an example, let us consider a type of expression trees that allows injection of any native Coq value.  The idea is that an [exp T] stands for a reflected expression of type [T].
adamc@227: 
adamc@227:    [[
adamc@227: Inductive exp : Set -> Set :=
adamc@227: | Const : forall T : Set, T -> exp T
adamc@227: | Pair : forall T1 T2, exp T1 -> exp T2 -> exp (T1 * T2)
adamc@227: | Eq : forall T, exp T -> exp T -> exp bool.
adamc@227: 
adamc@227: Error: Large non-propositional inductive types must be in Type.
adamc@227:  
adamc@227:    ]]
adamc@227: 
adamc@227:    This definition is %\textit{%#<i>#large#</i>#%}% in the sense that at least one of its constructors takes an argument whose type has type [Type].  Coq would be inconsistent if we allowed definitions like this one in their full generality.  Instead, we must change [exp] to live in [Type].  We will go even further and move [exp]'s index to [Type] as well. *)
adamc@227: 
adamc@227: Inductive exp : Type -> Type :=
adamc@227: | Const : forall T, T -> exp T
adamc@227: | Pair : forall T1 T2, exp T1 -> exp T2 -> exp (T1 * T2)
adamc@227: | Eq : forall T, exp T -> exp T -> exp bool.
adamc@227: 
adamc@227: (** This definition is accepted.  We can build some sample expressions. *)
adamc@227: 
adamc@227: Check Const 0.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   Const 0
adamc@227:      : exp nat
adamc@227:      ]] *)
adamc@227: 
adamc@227: Check Pair (Const 0) (Const tt).
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   Pair (Const 0) (Const tt)
adamc@227:      : exp (nat * unit)
adamc@227:      ]] *)
adamc@227: 
adamc@227: Check Eq (Const Set) (Const Type).
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   Eq (Const Set) (Const Type (* Top.59 *))
adamc@227:      : exp bool
adamc@227:  
adamc@227:      ]]
adamc@227: 
adamc@227:   We can check many expressions, including fancy expressions that include types.  However, it is not hard to hit a type-checking wall.
adamc@227: 
adamc@227:   [[
adamc@227: Check Const (Const O).
adamc@227: 
adamc@227: Error: Universe inconsistency (cannot enforce Top.42 < Top.42).
adamc@227:  
adamc@227:   ]]
adamc@227: 
adamc@227:   We are unable to instantiate the parameter [T] of [Const] with an [exp] type.  To see why, it is helpful to print the annotated version of [exp]'s inductive definition. *)
adamc@227: 
adamc@227: Print exp.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227: Inductive exp
adamc@227:               : Type $ Top.8 ^ ->
adamc@227:                 Type
adamc@227:                 $ max(0, (Top.11)+1, (Top.14)+1, (Top.15)+1, (Top.19)+1) ^ :=
adamc@227:     Const : forall T : Type $ Top.11 ^ , T -> exp T
adamc@227:   | Pair : forall (T1 : Type $ Top.14 ^ ) (T2 : Type $ Top.15 ^ ),
adamc@227:            exp T1 -> exp T2 -> exp (T1 * T2)
adamc@227:   | Eq : forall T : Type $ Top.19 ^ , exp T -> exp T -> exp bool
adamc@227:  
adamc@227:   ]]
adamc@227: 
adamc@227:   We see that the index type of [exp] has been assigned to universe level [Top.8].  In addition, each of the four occurrences of [Type] in the types of the constructors gets its own universe variable.  Each of these variables appears explicitly in the type of [exp].  In particular, any type [exp T] lives at a universe level found by incrementing by one the maximum of the four argument variables.  A consequence of this is that [exp] %\textit{%#<i>#must#</i>#%}% live at a higher universe level than any type which may be passed to one of its constructors.  This consequence led to the universe inconsistency.
adamc@227: 
adamc@227:   Strangely, the universe variable [Top.8] only appears in one place.  Is there no restriction imposed on which types are valid arguments to [exp]?  In fact, there is a restriction, but it only appears in a global set of universe constraints that are maintained "off to the side," not appearing explicitly in types.  We can print the current database. *)
adamc@227: 
adamc@227: Print Universes.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227: Top.19 < Top.9 <= Top.8
adamc@227: Top.15 < Top.9 <= Top.8 <= Coq.Init.Datatypes.38
adamc@227: Top.14 < Top.9 <= Top.8 <= Coq.Init.Datatypes.37
adamc@227: Top.11 < Top.9 <= Top.8
adamc@227:  
adamc@227: ]]
adamc@227: 
adamc@227: [Print Universes] outputs many more constraints, but we have collected only those that mention [Top] variables.  We see one constraint for each universe variable associated with a constructor argument from [exp]'s definition.  [Top.19] is the type argument to [Eq].  The constraint for [Top.19] effectively says that [Top.19] must be less than [Top.8], the universe of [exp]'s indices; an intermediate variable [Top.9] appears as an artifact of the way the constraint was generated.
adamc@227: 
adamc@227: The next constraint, for [Top.15], is more complicated.  This is the universe of the second argument to the [Pair] constructor.  Not only must [Top.15] be less than [Top.8], but it also comes out that [Top.8] must be less than [Coq.Init.Datatypes.38].  What is this new universe variable?  It is from the definition of the [prod] inductive family, to which types of the form [A * B] are desugared. *)
adamc@227: 
adamc@227: Print prod.
adamc@227: (** %\vspace{-.15in}% [[
adamc@227: Inductive prod (A : Type $ Coq.Init.Datatypes.37 ^ )
adamc@227:           (B : Type $ Coq.Init.Datatypes.38 ^ )
adamc@227:             : Type $ max(Coq.Init.Datatypes.37, Coq.Init.Datatypes.38) ^ :=
adamc@227:     pair : A -> B -> A * B
adamc@227:  
adamc@227:     ]]
adamc@227: 
adamc@227:   We see that the constraint is enforcing that indices to [exp] must not live in a higher universe level than [B]-indices to [prod].  The next constraint above establishes a symmetric condition for [A].
adamc@227: 
adamc@227:   Thus it is apparent that Coq maintains a tortuous set of universe variable inequalities behind the scenes.  It may look like some functions are polymorphic in the universe levels of their arguments, but what is really happening is imperative updating of a system of constraints, such that all uses of a function are consistent with a global set of universe levels.  When the constraint system may not be evolved soundly, we get a universe inconsistency error.
adamc@227: 
adamc@227:   %\medskip%
adamc@227: 
adamc@227:   Something interesting is revealed in the annotated definition of [prod].  A type [prod A B] lives at a universe that is the maximum of the universes of [A] and [B].  From our earlier experiments, we might expect that [prod]'s universe would in fact need to be %\textit{%#<i>#one higher#</i>#%}% than the maximum.  The critical difference is that, in the definition of [prod], [A] and [B] are defined as %\textit{%#<i>#parameters#</i>#%}%; that is, they appear named to the left of the main colon, rather than appearing (possibly unnamed) to the right.
adamc@227: 
adamc@227:   Parameters are not as flexible as normal inductive type arguments.  The range types of all of the constructors of a parameterized type must share the same indices.  Nonetheless, when it is possible to define a polymorphic type in this way, we gain the ability to use the new type family in more ways, without triggering universe inconsistencies.  For instance, nested pairs of types are perfectly legal. *)
adamc@227: 
adamc@227: Check (nat, (Type, Set)).
adamc@227: (** %\vspace{-.15in}% [[
adamc@227:   (nat, (Type $ Top.44 ^ , Set))
adamc@227:      : Set * (Type $ Top.45 ^ * Type $ Top.46 ^ )
adamc@227:  
adamc@227:   ]]
adamc@227: 
adamc@227:   The same cannot be done with a counterpart to [prod] that does not use parameters. *)
adamc@227: 
adamc@227: Inductive prod' : Type -> Type -> Type :=
adamc@227: | pair' : forall A B : Type, A -> B -> prod' A B.
adamc@227: 
adamc@227: (** [[
adamc@227: Check (pair' nat (pair' Type Set)).
adamc@227: 
adamc@227: Error: Universe inconsistency (cannot enforce Top.51 < Top.51).
adamc@227:  
adamc@227: ]]
adamc@227: 
adamc@227: The key benefit parameters bring us is the ability to avoid quantifying over types in the types of constructors.  Such quantification induces less-than constraints, while parameters only introduce less-than-or-equal-to constraints. *)