Foundational Extensible Corecursion JasminChristianBlanchette AndreiPopescu DmitriyTraytel InriaNancy&LORIA,France DepartmentofComputerScience, TechnischeUniversitätMünchen, Max-Planck-InstitutfürInformatik, SchoolofScienceandTechnology, Germany Saarbrücken,Germany MiddlesexUniversity,UK [email protected] [email protected] [email protected] 5 Abstract falls within this fragment, since each call to natsFrom produces 1 one constructor before entering the nested call. Not only is the 0 Thispaperpresentsaformalizedframeworkfordefiningcorecur- equationconsistent,italsofullyspecifiesthefunction’sbehavior. 2 sivefunctionssafelyinatotalsetting,basedoncorecursionup-to The above definition is legitimate only if objects are allowed andrelationalparametricity.Theendproductisageneralcorecur- n to be infinite. This may be self-evident in a nonstrict functional sor that allows corecursive (and even recursive) calls under well- a language such as Haskell, but in a total setting we must care- behavedoperations,includingconstructors.Corecursivefunctions J fullydistinguishbetweenthewell-foundedinductive(oralgebraic) thatarewellbehavedcanberegisteredassuch,therebyincreasing 2 the corecursor’s expressiveness. The metatheory is formalized in datatypes and the non-well-founded coinductive (or coalgebraic) 2 theIsabelleproofassistantandformsthecoreofaprototypetool. datatypes—oftensimplycalleddatatypesandcodatatypes,respec- The corecursor is derived from first principles, without requiring tively.Recursivefunctionsconsumedatatypevalues,peelingoffa ] newaxiomsorextensionsofthelogic. finite number of constructors as they proceed; corecursive func- L tionsproducecodatatypevalues,consistingoffinitelyorinfinitely P Categories and Subject Descriptors F.3.1 [Logics and Mean- manyconstructors.Andinthesamewaythatinductionisavailable . ingsofPrograms]:SpecifyingandVerifyingandReasoningabout asaproofprincipletoreasonaboutdatatypesandterminatingre- s c Programs—Mechanical verification; F.4.1 [Mathematical Logic cursivefunctions,coinductionsupportsreasoningovercodatatypes [ and Formal Languages]: Mathematical Logic—Mechanical theo- andproductivecorecursivefunctions. remproving,Modeltheory Despite their reputation for esotericism, codatatypes have an 1 important role to play in both the theory and the metatheory of v GeneralTerms Algorithms,Theory,Verification programming. On the theory side, they allow a direct embedding 5 of a large class of nonstrict functional programs in a total logic. 2 Keywords (Co)recursion,parametricity,proofassistants, In conjunction with interactive proofs and code generators, this 4 higher-orderlogic,Isabelle enablescertifiedfunctionalprogramming[10].Onthemetatheory 5 side,codatatypesconvenientlycaptureinfinite,possiblybranching 0 processes.Majorproofdevelopmentsrelyonthem,includingthose . 1. Introduction associated with a C compiler [33], a Java compiler [34], and the 1 0 Totalfunctionalprogrammingisadisciplinethatensurescomputa- Javamemorymodel[35]. 5 tionsalwaysterminate.Itisinvaluableinaproofassistant,where Codatatypes are supported by an increasing number of proof 1 nonterminatingdefinitionssuchasfx=fx+1canyieldcontradic- assistants,includingAgda,Coq,Isabelle/HOL,Isabelle/ZF,Matita, : tions.Hence,mostassistantswillacceptrecursivefunctionsonlyif and PVS. They are also present in the CoALP dialect of logic v theycanbeshowntoterminate.Similarconcernsariseinspecifi- programming and in the Dafny specification language. But the i cationlanguagesandverifyingcompilers. abilitytointroducecodatatypesisnotworthmuchwithoutadequate X However, some processes need to run forever, without their supportfordefiningmeaningfulfunctionsthatoperateonthem.For r beinginconsistent.Animportantclassoftotalprogramshasbeen mostsystems,thissupportcanbecharacterizedasworkinprogress. a identified under the heading of productive coprogramming [1, 7, The key question they all must answer is: What right-hand sides 51]: These are functions that progressively reveal parts of their canbesafelyallowedinafunctiondefinition? (potentially infinite) output. For example, given a type of infinite Generally,therearetwomainapproachestosupportrecursive streamsconstructedbySCons,thedefinition andcorecursivefunctionsinaproofassistantorsimilarsystem: Theintrinsicapproach: A syntactic criterion is built into the natsFromn=SConsn(natsFrom(n+1)) logic:terminationforrecursivespecifications,productivity(or guardedness)forcorecursivespecifications.Theterminationor productivitycheckerispartofthesystem’strustedcodebase. Thefoundationalapproach: The(co)recursivespecificationsare reducedtoafixpointconstruction,whichpermitsasimpledef- initionoftheformf=...,wheref doesnotoccurintheright- handside.Theoriginalequationsarederivedastheoremsfrom thisinternaldefinition,usingdedicatedprooftactics. Systemsfavoringtheintrinsicapproachincludetheproofassistants Agda and Coq, as well as tools such as CoALP and Dafny. The [Copyrightnoticewillappearhereonce’preprint’optionisremoved.] mainhurdlefortheirusersisthatsyntacticcriteriaareinflexible; 1 2015/1/23 the specification must be massaged so that it falls within a given Thisextensiblecorecursorgracefullyhandlescodatatypeswith syntacticfragment,eventhoughthedesiredproperty(termination nestingthrougharbitrarytypeconstructors(e.g.,forinfinite-depth orproductivity)issemantic.Butperhapsmoretroublinginsystems Rose trees nested through finite or infinite lists). Thanks to the that process theorems, soundness is not obvious at all and very framework’smodularity,functionspecificationscancombinecore- tedious to ensure; as a result, there is a history of critical bugs cursion with recursion, yielding quite expressive mixed fixpoint interminationandproductivitycheckers,aswewillseewhenwe definitions(Section4).ThisisinspiredbytheDafnytool,butour reviewrelatedwork(Section6).Indeed,Abel[2]observedthat approachissemanticallyfoundedandhenceprovablyconsistent. ThecompletemetatheoryisimplementedinIsabelle/HOL,asa Maybethetimeisripetoswitchtoamoresemanticalnotion combinationofagenericproofdevelopmentparameterizedbyar- ofterminationandguardedness.Thesyntacticguardcondi- bitrarytypeconstructorsandatoolforinstantiatingthemetatheory tiongetsyousomewhere,butthenneedsalotofextensions touser-specifiedinstances(Section5,[13]). andpatchingtoworksatisfactoryinpractice.Formalverifi- Techniques such as corecursion and coinduction up-to have cationofitbecomestoodifficult,andonlyintuitivejustifi- been known for years in the process algebra community, before cationispronetoerrors. theywereembracedandperfectedbycategorytheorists(Section6). This work is part of a wider program aiming at bringing insight fromcategorytheoryintoproofassistants[12,49].Themaincon- IncontrasttoAgdaandCoq,proofassistantsbasedonhigher- tributionsofthispaperarethefollowing: orderlogic(HOL),suchasHOL4,HOLLight,andIsabelle/HOL, generally adhere to the foundational approach. Their logic is ex- • Werepresentinhigher-orderlogicanintegratedframeworkfor pressive enough to accommodate the (co)algebraic constructions recursionandcorecursionabletoevolvebyuserinteraction. underlying (co)datatypes and (co)recursive functions in terms of • We identify a sound fragment of mixed recursive–corecursive functors on the category of sets [49]. The main drawback of this specifications,integrateitinourframework,andpresentseveral approachisthatitrequiresalotofwork,bothconceptualandim- examplesthatmotivatethisfeature. plementational.Moreover,itisnotavailableforallsystems,since itrequiresanexpressiveenoughlogic. • WeimplementtheaboveinIsabelle/HOLwithinaninteractive Because every step must be formally justified, foundational loopthatmaintainstherecursive–corecursiveinfrastructure. definitionalprinciplestendtobesimplerandmorerestrictivethan • Weusethisinfrastructuretoautomaticallyderivemanyexam- theirintrinsiccounterparts.Asatellingexample,codatatypeswere plesthatareproblematicinotherproofassistants. introducedinIsabelle/HOLonlyrecently,almosttwodecadesafter A distinguishing feature of our framework is that it does not their inception in Coq, and they are still missing from the other requiretheusertoprovidetypeannotations.Onthedesignspace, HOLsystems;andcorecursionislimitedtotheprimitivecase,in itliesbetweenthehighlyrestrictiveprimitivecorecursionandthe whichcorecursivecallsoccurunderexactlyoneconstructor. morebureaucraticup-toapproachessuchasclockvariables[7,15] That primitive corecursion (or the slightly extended version andsizedtypes[3],combiningexpressivenessandeaseofuse.The supportedbyCoq)istoorestrictiveisanobservationthathasbeen identificationofthis“sweetspot”canalsobeseenasacontribution. made repeatedly by researchers who use corecursion in Coq and nowalsoIsabelle.LochbihlerandHölzldedicatedapaper[36]to ad hoc techniques for defining operations on corecursive lists in 2. MotivatingExamples Isabelle.Onlyafterintroducingalotofmachinerydotheymanage We demonstrate the expressiveness of the corecursor framework to define their central example—lfilter, a filter function on lazy byexamples,adoptingtheuser’sperspective.Thecasestudiesby (coinductive)lists—andderivesuitablereasoningprinciples. Rutten[46]andHinze[21]onstreamcalculiserveasourstarting We contend that it is possible to combine advanced features point.Streamsofnaturalnumberscanbedefinedas as found in Agda and Coq with the fundamentalism of Isabelle. Thelackofbuilt-insupportforcorecursion,anapparentweakness, codatatype Stream=SCons(head:Nat)(tail:Stream) revealsitselfasastrengthasweproceedtointroducerichnotionsof where SCons:Nat→Stream→Stream is the constructor and corecursion,withoutextendingthetypesystemoraddingaxioms. head:Stream→Nat, tail:Stream→Stream are its selectors. In this paper, we formalize a highly expressive corecursion Althoughtheexamplesmayseemsimpleorcontrived,theywere framework that extends primitive corecursion in the following carefullychosentoshowthemaindifficultiesthatariseinpractice. ways:Itallowscorecursivecallsunderseveralconstructors;ital- lowswell-behavedoperatorsinthecontextaroundorbetweenthe 2.1 CorecursionUp-to constructorsandaroundthecorecursivecalls;importantly,itsup- Asourfirstexampleofacorecursivefunctiondefinition,wecon- portsblendingterminatingrecursivecallswithguardedcorecursive siderthepointwisesumoftwostreams: calls.Thisgeneralcorecursorisaccompaniedbyacorresponding, equally general coinduction principle that makes reasoning about xs⊕ys=SCons(headxs+headys)(tailxs⊕tailys) it convenient. Each of the corecursor, mixed recursor–corecursor, The specification is productive, since the corecursive call occurs andthecoinductionprinciplegrowinexpressivenessduringthein- directlyunderthestreamconstructor,whichactsasaguard(shown teractionwiththeuser,bylearningofnewwell-behavedcontexts. underlined). Moreover, it is primitively corecursive, because the Theconstructionsdrawheavilyfromcategorytheory. topmost symbol on the right-hand side is a constructor and the Before presenting the technical details, we first show through corecursivecallappearsdirectlyasanargumenttoit. exampleshowaprimitivecorecursorcanbeincrementallyenriched Thesesyntacticrestrictionscanberelaxedtoallowconditional toaccepteverrichernotionsofcorecursivecallcontext(Section2). statementsand‘let’expressions[12],butdespitesuchtricksprim- This is made possible by the modular bookkeeping of additional itive corecursion remains hopelessly primitive. The syntactic re- structure for the involved type constructors, including a relator strictionforadmissiblecorecursivedefinitionsinCoqismoreper- structure. This structure can be exploited to prove parametricity missiveinthatitallowsforanarbitrarynumberofconstructorsto theorems,whichensurethesuitabilityofoperatorsasparticipants guardthecorecursivecalls,asinthefollowingdefinition: to the call contexts, in the style of coinduction up-to. Each new corecursivedefinitionisapotentialfutureparticipant(Section3). onetwos=SCons1(SCons2onetwos) 2 2015/1/23 OurframeworkachievesthesameresultbyregisteringSConsas supX=SCons((cid:70)(fimageheadX))(sup(fimagetailX)) awell-behavedoperation.Intuitively,anoperationiswellbehaved Here,fimagegivestheimageofafinitesetunderafunction,and ifitneedstodestructatmostoneconstructorofinputtoproduce (cid:70)Xisthemaximumofafinitesetofnaturalsor0ifXisempty. oneconstructorofoutput.Forstreams,suchanoperationmayin- specttheheadandthetail(butnotthetail’stail)ofitsarguments 2.2 NestedCorecursionUp-to beforeproducinganSCons.Becausetheoperationpreservespro- ductivity,itcansafelysurroundtheguardingconstructor. Although we use streams as our main example, the framework The rigorous definition of well-behavedness will capture this generallysupportsarbitrarycodatatypeswithmultiplecurriedcon- intuitioninaparametricitypropertythatmustbedischargedbythe structors and nesting through other type constructors. To demon- user.Inexchange,theframeworkyieldsastrengthenedcorecursor stratethislastfeature,weintroducethetypeoffinitelybranching thatincorporatesthenewoperation. Rosetreesofpotentiallyinfinitedepthwithnumericlabels: TheconstructorSConsiswellbehaved,sinceitdoesnoteven codatatype Tree=Node(val:Nat)(sub:ListTree) needtoinspectitsargumentstoproduceaconstructor.Incontrast, theselectortailisnotwellbehaved—itmustdestructtwolayersof ThetypeTreehasasingleconstructorNode:Nat→ListTree→ constructorstoproduceone: Treeandtwoselectorsval:Tree→Natandsub:Tree→ListTree. TherecursiveoccurrenceofTreeisnestedinthefamiliarpolymor- tailxs=SCons(head(tailxs))(tail(tailxs)) phicdatatypeoffinitelists. The presence of non-well-behaved operations in the corecursive Wefirstdefinethepointwisesumoftwotreesanalogouslyto⊕: call context is enough to break productivity, as in the example t(cid:1)u=Node(valt+valu) stallA=SCons1(tailstallA),whichstallsimmediatelyafterpro- (map(λ(t(cid:48),u(cid:48)).t(cid:48)(cid:1)u(cid:48))(zip(subt)(subu))) ducingoneconstructor,leavingtailstallAunspecified. Another instructive example is the function that keeps every Here,mapisthestandardmapfunctiononlists,andzipconverts otherelementinastream: two parallel lists into a list of pairs, truncating the longer list if necessary. The criterion for primitive corecursion for nested everyOtherxs=SCons(headxs)(everyOther(tail(tailxs))) codatatypes requires the corecursive call to be applied through The function is not well behaved, despite being primitive core- map, which is the case for (cid:1). Moreover, by virtue of being well cursive.Italsobreaksproductivity:stallB=SCons1(everyOther behaved,(cid:1)canbeusedtodefinetheshuffleproductoftrees: stallB)stallsafterproducingtwoconstructors. Goingbacktoourfirstexample,weobservethattheoperation⊕ t(cid:2)u=Node(valxs×valys) (map(λ(t(cid:48),u(cid:48)).(t(cid:2)u(cid:48))(cid:1)(t(cid:48)(cid:2)u))(zip(subt)(subu))) iswellbehaved.Hence,itisallowedtoparticipateincorecursive call contexts when defining new functions. In this respect, the Again, the corecursive call takes place inside map, but this time frameworkismorepermissivethanCoq’ssyntacticrestriction.For alsointhecontextof(cid:1).Thespecificationof(cid:2)iscorecursiveup-to example,wecandefinethestreamofFibonaccinumbersineither andwellbehaved. ofthefollowingtwoways: 2.3 MixedRecursion–Corecursion fibA=SCons0(SCons1fibA⊕fibA) fibB=SCons0(SCons1fibB)⊕SCons0fibB It is often convenient to let a corecursive function perform some finite computation before producing a constructor. With mixed Well-behavedoperationsareallowedtoappearbothunderthecon- recursion–corecursion,afinitenumberofunguardedrecursivecalls structorguard(asinfibA)andaroundit(asinfibB).Noticethattwo performthiscalculationbeforereachingaguardedcorecursivecall. guardsarenecessaryinthesecondexample—oneforeachbranch Theintuitivecriterionforacceptingsuchdefinitionsisthatthe ofthe⊕operator.Incidentally,wearenotawareofanyotherframe- unguardedrecursivecallcouldbeunfoldedtoarbitraryfinitedepth, workthatallowssuchdefinitions.Withoutrephrasingthespecifi- ultimatelyyieldingapurelycorecursivedefinition.Anexampleis cation,fibBcannotbeexpressedinRutten’sformatofbehavioral theprimesfunctiontakenfromDiGianantonioandMiculan[17]: differentialequations[46]orinHinze’ssyntacticrestriction[21], norviaAgdacopatterns[5,6]. primesmn=if(m=0∧n>1)∨gcdmn=1 Manyusefuloperationsarewellbehavedandcanthereforepar- thenSConsn(primes(m×n)(n+1)) ticipateinfurtherdefinitions.FollowingRutten,theshuffleproduct elseprimesm(n+1) ⊗oftwostreamsisdefinedintermsof⊕.Shuffleproductbeing When called with m=1 and n=2, this function computes the itselfwellbehaved,wecanemployittodefinestreamexponentia- streamofprimenumbers.Theunguardedcallintheelsebranch tion,whichalsoturnsouttobewellbehaved: incrementsitssecondargumentnuntilitiscoprimetothefirstargu- xs⊗ys=SCons(headxs×headys) mentm(i.e.,thegreatestcommondivisorofmandnis1).Forany ((xs⊗tailys)⊕(tailxs⊗ys)) positiveintegersmandn,thenumbersmandm×n+1arecoprime, yielding an upper bound on the number of times n is increased. expxs=SCons(2ˆheadxs)(tailxs⊗expxs) Hence,thefunctionwilltaketheelsebranchatmostfinitelyof- Next,weusethedefinedandregisteredoperationstospecifytwo tenbeforetakingthethenbranchandproducingoneconstructor. streams of factorials of natural numbers facA (starting at 1) and Thereisaslightcomplicationwhenm=0andn>1:Withoutthe facB(startingat0): firstdisjunctintheifcondition,thefunctioncouldstall.(Thiscor- nercasewasoverlookedintheoriginalexample[17].) facA=SCons1facA⊗SCons1facA Mixedrecursion–corecursionalsoallowsustogiveadefinition facB=exp(SCons0facB) offactorialswithoutinvolvinganyauxiliarystreamoperations: ComputingthefirstfewtermsoffacAmanuallyshouldconvince facCnai=ifi=0thenSConsa(facC(n+1)1(n+1)) thereaderthatproductivityandefficiencyarenotsynonymous. elsefacCn(a×i)(i−1) Theargumentsofwell-behavedoperationsarenotrestrictedto the Stream type. For example, we can define the well-behaved The recursion in the else branch computes the next factorial by supremumofafinitesetofstreamsbyprimitivecorecursion: meansofanaccumulatoraandadecreasingcounteri.Whenthe 3 2015/1/23 counterreaches0,facCcorecursivelyproducesaconstructorwith distinguished by taking observations (i.e., by applying the head theaccumulatedvalueandresetstheaccumulatorandthecounter. and tail selectors); therefore they must be equal. In other words, Unguardedcallsmayalsooccurunderwell-behavedoperations: equalityisthelargestbisimulation. CreativityisgenerallyrequiredtoinstantiateRwithabisimula- catn=ifn>0thencat(n−1)⊕SCons0(cat(n+1)) tion.However,givenagoall=r,thefollowingcanonicalcandidate elseSCons1(cat1) oftenworks:λst.∃xs.s=l∧t=r,wherexsarevariablesoccur- Thecallcat1computesthestreamofCatalannumbers:C ,C ,..., ringfreeinlorr.Asarehearsal,letusprovethattheprimitively 1 2 whereCi= n+11(cid:0)2nn(cid:1).Thisfactisfarfromobvious.Productivityis corecursiveoperation⊕iscommutative. notentirelyobviouseither,butitisguaranteedbytheframework. Proposition1. xs⊕ys=ys⊕xs. Whenmixingrecursionandcorecursion,itiseasytogetthings wrong in the absence of solid foundations. Consider this appar- Proof. WefirstshowthatR=(λst.∃xsys.s=xs⊕ys∧t=ys⊕ ently unobjectionable specification in which the corecursive call xs) is a bisimulation. We fix two streams s and t for which we isguardedbySConsandtheunguardedcall’sargumentstrictlyde- assumeRst(i.e.,thereexisttwostreamsxsandyssuchthat s= creasestoward0: xs⊕ysandt=ys⊕xs).Next,wemustshowthatheads=headt and R(tail s)(tailt). The first property can be discharged by a nastyn=ifn<2thenSConsn(nasty(n+1)) simplecalculation.Forthesecondone: elseinc(tail(nasty(n−1))) R(tails)(tailt) Here, inc=smap(λx. x+1) and smap is the map function on ←→R(tail(xs⊕ys))(tail(ys⊕xs)) streams. A simple calculation reveals that this specification is in- ←→R(tailxs⊕tailys))(tailys⊕tailxs) consistent because the tail selector before the unguarded call de- ←→∃xs(cid:48)ys(cid:48). tailxs⊕tailys=xs(cid:48)⊕ys(cid:48)∧ structsthefreshlyproducedconstructorfromtheotherbranch: tailys⊕tailxs=ys(cid:48)⊕xs(cid:48) nasty2=inc(tail(nasty1)) Thelastformulacanbeshowntoholdbyselectingxs(cid:48)=tailxsand =inc(tail(SCons1(nasty2))) ys(cid:48)=tailys.Moreover,R(xs⊕ys)(ys⊕xs)holds.Therefore,the =inc(nasty2) thesisfollowsbystructuralcoinduction. Thisisaclosecousinoftheinfamousf x=f x+1examplemen- Ifweattempttoprovethecommutativityof⊗analogously,we tionedintheintroduction.Theframeworkrejectsthisspecification eventuallyencounteraformulaoftheformR(···⊕···)(···⊕···), onthegroundsthatthetailselectorintherecursivecallcontextis because⊗isdefinedintermsof⊕.SinceRmentionsonly⊗but notwellbehaved. not ⊕, we are stuck. An ad hoc solution would be to replace the We conclude this section with a practical example from the canonicalRwithabisimulationthatallowsfordescendingunder⊕. literature.Giventhepolymorphictype However,thiswouldbeneededforalmosteverypropertyabout⊗. codatatype LList(A)= Amorereusablesolutionistostrengthenthecoinductionprin- LNil|LCons(head:A)(tail:LList(A)) ciple upon registration of a new well-behaved operation. The strengthening mirrors the acquired possibility of the new opera- oflazylists,thetaskistodefinethefunctionlfilter:(A→Bool)→ tiontoappearinthecorecursivecallcontext.Itistechnicallyrepre- LList(A)→LList(A)thatfiltersoutallelementsfailingtosatisfy sentedbyacongruenceclosurecl:(Stream→Stream→Bool)→ the given predicate. Thanks to the support for mixed recursion– Stream→Stream→Bool.Thecoinductionup-toprincipleisal- corecursion, the framework transforms what was for Lochbihler mostidenticaltostructuralcoinduction,exceptthatthecorecursive andHölzl[36]aresearchproblemintoaroutineexercise: applicationofRisreplacedbyclR: lfilterPxs=if∀x∈xs.¬Pxs Rlr ∀st.Rst−→heads=headt∧clR(tails)(tailt) thenLNil l=r elseifP(headxs) The principle evolves with every newly registered well-behaved thenLCons(headxs)(lfilterP(tailxs)) operationinthesensethatourframeworkrefinesthedefinitionof elselfilterP(tailxs) thecongruenceclosurecl.(Strictlyspeaking,afreshsymbolcl(cid:48) is The first self-call is corecursive and guarded by LCons, whereas introducedeachtime.)Forexample,afterregisteringSConsand⊕, thesecondself-callisterminating,becausethenumberof“false” clRistheleastreflexive,symmetric,transitiverelationcontainingR elementsuntilreachingthenext“true”element(whoseexistenceis andsatisfyingtherules guaranteedbythefirstifcondition)decreasesbyone. x=y clRxsys clRxsys clRxs(cid:48)ys(cid:48) 2.4 CoinductionUp-to clR(SConsxxs)(SConsyys) clR(xs⊕xs(cid:48))(ys⊕ys(cid:48)) Onceacorecursivespecificationhasbeenacceptedasproductive, After defining and registering ⊗, the relation clR is extended to we normally want to reason about it. In proof assistants, codata- alsosatisfy types are accompanied by a notion of structural coinduction that clRxsys clRxs(cid:48)ys(cid:48) matchesprimitivelycorecursivefunctions.Fornonprimitivespeci- clR(xs⊗xs(cid:48))(ys⊗ys(cid:48)) fications,ourframeworkprovidesthemoreadvancedproofprinci- pleofcoinductionuptocongruence—orsimplycoinductionup-to. Letusapplythestrengthenedcoinductionprincipletoprovethe Thestructuralcoinductionprincipleforstreamsisasfollows: distributivityofstreamexponentiationoverpointwiseaddition: Rlr ∀st. Rst−→heads=headt∧R(tails)(tailt) Proposition2. exp(xs⊕ys)=expxs⊗expys. l=r Proof. WefirstshowthatR=(λst.∃xsys.s=exp(xs⊕ys)∧t= Coinductionallowsustoproveanequalityonstreamsbyproviding expxs⊗expys)isabisimulation.Wefixtwostreams sandtfor a relation R that relates the left-hand side with the right-hand whichweassumeRst(i.e.,thereexisttwostreamsxsandyssuch side (first premise) and that constitutes a bisimulation (second thats=exp(xs⊕ys)andt=expxs⊗expys).Next,weshowthat premise). Streams that are related by a bisimulation cannot be heads=headtandclR(tails)(tailt): 4 2015/1/23 heads=head(exp(xs⊕ys))=2ˆhead(xs⊕ys) • afunctorialactionFmap:∏A,B∈Setn∏ni=1(Ai→Bi)→FA→ =2ˆ(headxs+headys)=2ˆheadxs×2ˆheadys F B, i.e., a polymorphic function of the indicated type that =head(expxs)×head(expys) commuteswithidentityidA:A→Aandcomposition; =head(expxs⊗expys)=headt • a relator Frel : ∏A,B∈Setn∏ni=1(Ai→Bi→Bool) → F A → clR(tails)(tailt) FB→Bool,i.e.,apolymorphicfunctionoftheindicatedtype ←→clR(tail(exp(xs⊕ys)))(tail(expxs⊗expys)) whichcommuteswithbinary-relationidentityandcomposition. ←→clR((tailxs⊕tailys)⊗exp(xs⊕ys)) (expxs⊗(tailys⊗expys)⊕(tailxs⊗expxs)⊗expys) Followingstandardnotationfromcategorytheory,wewriteFin- ←→∗ clR((tailxs⊗exp(xs⊕ys)⊕tailys⊗exp(xs⊕ys)) stead of Fmap. Given binary relations Ri :Ai → Bi →Bool for (tailxs⊗(expxs⊗expys)⊕tailys⊗(expxs⊗expys) 1≤i≤n,wethinkofFrelR:FA→FB→Boolasthenatural ⊕ ←−clR(tailxs⊗exp(xs⊕ys))(tailxs⊗(expxs⊗expys))∧ lifting of R along F; for example, if F is List (and hence n=1), clR(tailys⊗exp(xs⊕ys))(tailys⊗(expxs⊗expys)) Frelliftsarelationonelementstothecomponentwiserelationon ⊗ ←−clR(tailxs)(tailxs)∧clR(tailys)(tailys)∧ lists(alsorequiringequallength).Itiswellknownthatthepositive clR(exp(xs⊕ys))(expxs⊗expys) typeconstructorsdefinedbystandardmeans(basictypes,compo- ←−R(exp(xs⊕ys))(expxs⊗expys) sition,leastorgreatestfixpoints)havecanonicalfunctorialandre- latorstructure.Thisiscrucialforthefoundationalconstructionof Thestepmarkedwith∗appealstoassociativityandcommutativity user-specified(co)datatypesinIsabelle/HOL[49]. of⊕and⊗aswellasdistributivityof⊗over⊕.Theseproperties But even nonpositive type constructors G : Setn → Set ex- arelikewiseprovedbycoinductionup-to.Theimplicationsmarked with⊕and⊗arejustifiedbytherespectivecongruencerules.The hibitarelator-likestructureGrel:∏A,B∈Setn (A→B)→(GA→ GB→Bool) (which need not commute with relation composi- lastimplicationusesreflexivityandexpandsRtoitsclosureclR. tion, though). For example, if G : Set2 → Set is the function- Finally,itiseasytoseethatR(exp(xs⊕ys))(expxs⊗expys) space constructor G (A ,A ) = A → A and f ∈ G (A ,A ), 1 2 1 2 1 2 holds.Therefore,thethesisfollowsbycoinductionup-to. g∈G(B ,B ),R :A →B →Bool,andR :A →B →Bool, 1 2 1 1 1 2 2 2 Theformalizationaccompanyingthispaper[13]alsocontains thenGrelR1R2 f gisdefinedas∀a1∈A1.∀b1∈B1.R1a1b1−→ proofs of facA=facC111=smapfac(natsFrom1), facB= R2 (f a1) (g b1). A polymorphic function c : ∏A∈SetnG A, c SCons1facA,andfibA=fibB,wherefacisthefactorialonNat. is called parametric [41, 52] if ∀A,B ∈ Setn. ∀R : A → B → Nested corecursion up-to is also reflected with a suitable Bool.GrelRc c . The maintenance of relator-like structures is A B strengthened coinduction rule. For Tree, this strengthening takes veryhelpfulforautomatingtheoremtransferalongisomorphisms place under the rel operator on list, similarly to the corecursive andquotients[24].Hereweexploreanadditionalbenefitofmain- callsoccurringnestedinthemapfunction: taining functorial and relator structure for type constructors: the possibilitytoextendthecorecursorinreactiontouserinput. Rlr ∀st.Rst−→vals=valt∧rel(clR)(subs)(subt) Inthissection,weassumethatalltheconsideredtypeconstruc- l=r tors are both functors and relators, that they include basic func- TherelRoperatorliftsthebinarypredicateR:A→B→Boolto torssuchasidentity,constant,sum,andproduct,andthattheyare a predicate ListA→ListB→Bool. More precisely, relRxsys closedunderleastfixpoints(initialalgebras)andgreatestfixpoints holds if and only if xs and ys have the same length and parallel (final coalgebras). Examples of such classes of type constructors elements of xs and ys are related by R. This nested coinduction includethedatafunctors[20],thecontainers[1],andthebounded ruleisconvenientprovidedthereissomeinfrastructuretodescend naturalfunctors[49]. underrel(asisthecaseinIsabelle/HOL).Theformalization[13] Wefocusonthecaseofaunarycodatatype-generatingfunctor establishesseveralarithmeticpropertiesof(cid:1)and(cid:2). F:Set→Set.Thecodatatypeofinterestwillbeitsgreatestfixpoint (orfinalcoalgebra)J=gfpF.Thisgenericsituationalreadycovers 3. ExtensibleCorecursors thevastmajorityofinterestingcodatatypes,sinceFcanrepresent arbitrarilycomplexnesting.Forexample,ifF=(λA.Nat×ListA), Wenowdescribethedefinitionalandproofmechanismsthatsub- thenJcorrespondstotheTreecodatatypepresentedinSection2.2. stantiate flexible corecursive definitions in the style of Section 2. The extension to mutually defined codatatypes is straightforward They are based on the modular maintenance of infrastructure for buttedious.OurexampleswilltakeJtobetheStreamtypefrom thecorecursorassociatedwithacodatatype,withthepossibilityof Section2,withF=(λA.Nat×A). open-endedincrementalimprovement.Wepresenttheapproachfor GivenasetA,itwillbeusefultothinkoftheelementsx∈FAas anarbitrarycodatatypegivenasthegreatestfixpointofanarbitrary consistingofashapetogetherwithcontentthatfillstheshapewith (bounded)functor.Theapproachisquitegeneralanddoesnotrely elementsof A.IfFA=Nat×A,theshapeof x=(n,a)is(n,_) onanyparticulargrammarforspecifyingcodatatypes. andthecontentisa;ifFA=ListA,theshapeof x=[x1,...,xn] Extensibilityisanintegralfeatureoftheframework.Inprinci- isthen-slotcontainer[_,...,_]andthecontentconsistsofthexi’s. ple,animplementationcouldredotheconstructionsfromscratch According to this view, for each f : A → B, the functorial each time a well-behaved operation is registered, but it would actionassociatedwithFsendsany xintoanelementF f xofthe give rise to a quadratic number of definitions, slowing down the same shape as x but with each content item a replaced by f a. proofassistant.Theincrementalapproachisalsomoreflexibleand Technically, this view can be supported by custom notions such future-proof,allowingmixedfixpointsandcompositionwithother ascontainers[1]or,moresimply,viaaparametricfunctionoftype (co)recursors,includingsomethatdonotexistyet. ∏A∈SetFA→SetAthatcollectsthecontentelements[49]. 3.1 FunctorsandRelators 3.2 PrimitiveCorecursion Functionalprogramminglanguagesandproofassistantsnecessar- ilymaintainadatabaseoftheuser-definedtypesor,moregenerally, ThecodatatypethatdefinesJalsointroducestheconstructorand typeconstructors,whichcanbethoughtasfunctionsF:Setn→Set destructorbijectionsctor:FJ→Janddtor:J→FJandtheprim- operatingonsets(orperhapsonorderedsets).Itisoftenusefulto itivecorecursorcorecPrim:∏A∈Set(A→FA)→A→Jcharacter- maintainmorestructurealongwiththesetypeconstructors: izedbytheequationcorecPrimsa=ctor(F(corecPrims)(sa)). 5 2015/1/23 Inelementsx∈FA,theoccurrencesofcontentitemsa∈Ainthe shapeofxcapturesthepositioningofthecorecursivecalls. KiJ fi (cid:47)(cid:47)J(cid:79)(cid:79) Example3. Modulocurrying,thepointwisesumofstreams⊕is definableascorecPrims,bytakings:Stream2→Nat×Stream2 Λ◦Σ(cid:104)id,dtor(cid:105)◦ιi ctor tobeλ(xs,ys).(headxs+headys,(tailxs,tailys)). (cid:15)(cid:15) In Example 3 and elsewhere, we lighten notation by identify F(Σ∗J) Feval (cid:47)(cid:47)FJ thecurriedanduncurriedformsoffunctions,countingonimplicit coercionsbetweenthetwo. Figure1:Thewell-behavednesscondition 3.3 TheCorecursionState GivenanyfunctorΣ:Set→Set,wedefineitsfree-monadfunctor Butwhatguaranteesthatthe fi’sareindeedsafeascontextsfor Σ∗ by Σ∗A=lfp(λB. A+Σ B). We write leaf :A→Σ∗A and corecursivecalls?Inparticular,howcantheframeworkexcludetail op:Σ(Σ∗A)→Σ∗AfortheleftandrightinjectionsintoΣ∗A. whileallowingSCons,⊕,and⊗?Thisiswheretheparametricity Thefunctionsleafandopareinfactpolymorphic;forexample, andwell-behavednessconditionsonthestateenterthepicture. leaf hastype∏A∈SetA→Σ∗A.Weoftenomitthesetparameters Westartwithwell-behavedness.Assumex∈Ki,whichisunam- ofpolymorphicfunctionsiftheycanbeinferredfromthecontext, biguouslyrepresentedinΣasιix.Let j1,..., jm∈Jbethecontent writingleafandopinsteadofleafAandopA. itemsofιix(placedinvariousslotsintheshapeofx).Toevaluate fi Atanygivenmoment,wemaintainthefollowingdataassoci- onx,wefirstcorecursivelydestructthe j’swhilealsokeepingthe l atedwithJ,whichwecallacorecursionstate: originals,thusreplacingeach j with(j,dtor j).Thenweapply l l l the transformation Λ to obtain an element of F(Σ∗J), which has • afinitenumberoffunctorsK1,...,Kn:Set→Setand,foreach anF-shapeatthetop(thefirstproducedobservabledata)andfor Ki,afunction fi:KiJ→J; eachslotinthisshapeanelementofΣ∗J,i.e.,aformal-expression • apolymorphicfunctionΛ:∏A∈SetΣ(A×FA)→F(Σ∗A). treehavingleavesinJandbuiltusingoperationsymbolsfromthe Wecallthe fi’sthewell-behavedoperationsanddefinetheircollec- signature(thecorecursivecontinuation): tiisvtehseigsntaantduarerdfuenmctboerdΣdinasgλoAf.KKi1inAto+Σ··.·+WKencaAll,wΛhtehreecιio:rKeciu→rsoΣr KiJ−ι→i ΣJΣ(cid:104)−id→,dtor(cid:105)Σ(J×FJ)−Λ→F(Σ∗J) seed.Thecorecursionstateissubjecttothefollowingconditions: Insummary,Λisaschematicrepresentationofthemutuallycore- Parametricity: Λisparametric. cursivebehaviorofthewell-behavedoperationsuptotheproduc- tionofthefirstobservabledata.Thisintuitionismadeformalinthe Well-behavedness: Each fisatisfiesthecharacteristicequation well-behavednesscondition,whichstatesthatthediagraminFig- fix=ctor(Feval(Λ(Σ(cid:104)id,dtor(cid:105)(ιix)))) ure1commutesforeach fi.(Wecouldreplacetherightupwardar- rowlabeledbyctorwithadownwardarrowlabeledbydtorwithout Theconvolutionoperator(cid:104)_,_(cid:105)buildsafunction(cid:104)f,g(cid:105):B→C×D changingthediagram’smeaning.However,weconsistentlyprefer fromtwofunctions f :B→Candg:B→D,andeval:Σ∗J→J theconstructorviewinourexposition.) isthecanonicalevaluationfunctiondefinedrecursively(usingthe Intheaboveexplanations,wesawthatitsufficestopeeloffone primitiverecursorassociatedwithΣ∗): layer of the arguments ji (by applying dtor) for a well-behaved eval(leaf j)= j operation fi to produce, via Λ, one layer of the result and to delegate the rest of the computation to a context consisting of a eval(opz) =casezofιit⇒ fi(Kievalt) combinationofwell-behavedoperations(anelementofΣ∗J).But (Notethat,ontherecursivecallontherighteval,isappliedtotvia how to formally express that exploring one layer is enough, i.e., “lifting” it through the functor Ki.) Functions having the type of thatapplyingΛ:J×FJ→F(Σ∗J)to(ji,dtor ji)doesnotresult Λandadditionallyassumedparametric(or,equivalently,assumed in a deeper exploration? An elegant way of capturing this is to to be natural transformations) are known in category theory as requirethatΛ,whichisapolymorphicfunction,operateswithout “abstractGSOSrules.”TheywereintroducedbyTuriandPlotkin analyzing J, i.e., that it operates in the same way on A×FA→ [50] and further studied by Bartels [8], Jacobs [26], Hinze and F(Σ∗A)foranysetA.Thisrequirementispreciselyparametricity. James[22],Miliusetal.[38],andothers. Strictlyspeaking,thewell-behavedoperations f arearedundant Thus, a corecursion state is a triple (K, f,Λ). As we will see pieceofdatainthestate(K, f,Λ),since,assumingΛparametric, in Section 3.6, the state evolves as users define and register new we can prove that there exists a unique tuple f that satisfies the functions.The fi’saretheoperationsthathavebeenregisteredas well-behavednesscondition.Inotherwords,theoperations f could safe for participating in the context of corecursion calls. Since fi bederivedonaper-needbasis. hastypeKiJ→J,wethinkofKiasencodingthearityof fi.Then Σ,thesumoftheKi’s,representsthesignatureconsistingofallthe Example 4. Let J = Stream and assume that SCons : Nat× fi’s.Thus,foreachA,Σ∗Arepresentsthesetofformalexpressions Stream→Streamand⊕:Stream2→Streamaretheonlywell- over Σ and A, i.e., the trees built starting from the “variables” in behaved operations registered so far. Then K1 =(λB. Nat×B), A as leaves byapplying operations symbolscorresponding to the f =SCons,K =(λB.B2),and f =⊕.Moreover,Σ∗=lfp(λB. 1 2 2 fi’s.Finally,evalevaluatesinJtheformalexpressionsofΣ∗Jby A+(Nat×B+B2)) consists of formal-expression trees with applyingthefunctions firecursively. leavesin Aandbuiltusingarity-correctapplicationsofoperation IfthefunctorsKi arerestrictedtobefinitemonomialsλA.Aki, symbols corresponding to SCons and ⊕, denoted by SCons and the functor Σ can be seen as a standard algebraic signature and ⊕. Given n∈Nat and a,b∈ A, an example of such a tree is (Σ∗A,op)asthestandardtermalgebraforthissignature,overthe leaf a ⊕ SCons (n,leaf a ⊕ leaf b). If additionally A=J, then variablesA.However,weallowKitobemoreexotic;forexample, evalappliedtotheabovetreeisa ⊕ SConsn(a ⊕ b). KiA can be ANat (representing an infinitary operation) or one of But what is Λ? As we show below, we need not worry about ListA and FinSetA (representing an operation taking a varying the global definition of Λ, since both Σ and Λ will be updated finitenumberoforderedorunorderedarguments). incrementally when registering new operations as well behaved. 6 2015/1/23 Nonetheless,aglobaldefinitionofΛforSConsand⊕follows: operationswereregistered): Λz=casezof ⊕,everyOther: corecFlex,corecTop,corecPrim ι (n,(a,(m,a(cid:48))) ⇒(n, SCons(m,leafa(cid:48))) onetwos,fibA,⊗,exp,sup: corecFlex,corecTop 1 ι ((a,(m,a(cid:48))), (b,(n,b(cid:48))))⇒(m+n,leafa(cid:48) ⊕ leafb(cid:48)) fibB,facA,facB: corecFlex 2 Informally,SConsand⊕exhibitthefollowingbehaviors: WiththeusualidentificationofUnit→JandJ,wecandefinefibA andfacAasfollows: • toevaluateSConsonanumbernandanitemawith(heada, taila)=(m,a(cid:48)), produce n and evaluate SCons on m and a(cid:48), fibA=corecTop(λu:Unit.(0, SCons(1,leafu) ⊕ (leafu))) i.e.,outputSConsn(SConsma(cid:48))=SConsna; facA=corecFlex(λu:Unit.leaf(1,leafu) ⊗ leaf(1,leafu)) • to evaluate ⊕ on a,b with (head a,tail a) = (m,a(cid:48)) and (headb,tailb)=(n,b(cid:48)), produce m+n and evaluate ⊕ on Let us look at fibA closely, comparing its specification fibA= a(cid:48)andb(cid:48),i.e.,outputSCons(m+n)(a(cid:48)⊕b(cid:48)). SCons 0 (SCons 1 fibA ⊕ fibA) with its definition in terms of corecTop. The outer SCons guard (with 0 as first argument) cor- 3.4 CorecursionUp-to respondstotheouterpair(0,_).TheinnerSConsand⊕areinter- Acorecursionstate(K, f,Λ)foranF-definedcodatatypeJconsists pretedaswell-behavedoperationsandrepresentedbythesymbols of a collection of operations on J, fi :Ki J→J, that satisfy the SCons and ⊕ (cf. Example 4). Finally, the corecursive calls of well-behavedness properties expressed in terms of a parametric fibAarecapturedbyleafu. functionΛ.Wearenowreadytoharvestthecropofthissetting:a The desired specification can be obtained from the corecTop corecursionprinciplefordefiningfunctionshavingJascodomain. formbythecharacteristicequationofcorecTop(forA=Unit)and Theprinciplewillberepresentedbytwocorecursors,corecTop the properties of eval as follows, where we simply write s, fibA, andcorecFlex.Althoughsubsumedbythelatter,theformerisinter- and leaf instead of their applications to the unique element () of estinginitsownrightandwillgiveustheopportunitytoillustrate Unit,namelys(),fibA(),andleaf(): somefinepoints.Belowwelistthetypesofthesecorecursorsalong fibA withthatoftheprimitivecorecursorforcomparison: = {bythecommutativityofFigure2b Primitivecorecursor: withfibA=corecTops} corecPrim:∏A∈Set(A→FA)→A→J ctor(F(eval◦Σ∗fibA)s) = {bythedefinitionsofFands} Top-guardedcorecursorup-to: corecTop:∏A∈Set(A→F(Σ∗A))→A→J =SCons0((eval◦Σ∗fibA)(SC{obnyst(h1e,dleeafifn)it⊕ion(loefafΣ)∗)}) Flexiblyguardedcorecursorup-to: SCons0(eval(SCons(1,leaffibA) ⊕ (leaffibA)) corecFlex:∏A∈Set(A→Σ∗(F(Σ∗A)))→A→J = {bythedefinitionofeval} Figure 2 presents the diagrams whose commutativity properties SCons0(SCons1fibA⊕fibA) givethecharacteristicequationsofthesecorecursors. TheeliminationofthecorecTopinfrastructurereliesonsimplifica- Eachcorecursorimplementsacontractofthefollowingform: tionrulesfortheinvolvedoperatorsandcanbefullyautomatized. If,foreacha∈A,oneprovidestheintendedcorecursivebehavior ofgarepresentedassa,wheresisafunctionfromA,oneobtains Parametricityandwell-behavednessarecrucialforprovingthat thefunctiong:A→J(asthecorrespondingcorecursorappliedto thecorecursorsactuallyexist: s)satisfyingasuitablefixpointequationmatchingthisbehavior. Theorem6. ThereexistthepolymorphicfunctionscorecTopand Thecodomainof sisthekeytounderstandingtheexpressive- corecFlex making the diagrams in Figures 2b and 2c commute. nessofeachcorecursor.Theintendedcorecursivecallsarerepre- Moreover,foreachsofappropriatetype,corecTopsorcorecFlexs sentedbyA,andthecallcontextisrepresentedbythesurrounding istheuniquefunctionmakingitsdiagramcommute. combinationoffunctors(involvingF,Σ∗,orboth): Theorem 6 is a known result from the category theory litera- • for corecPrim, the allowed call contexts consist of a single ture:ThecorecTopsversionfollowsfromtheresultsinBartels’s constructorguard(representedbyF); thesis[9],whereasthecorecFlexsversionwasveryrecently(and • forcorecTop,theyconsistofaconstructorguard(represented independently)provedbyMiliusetal.[38,Theorem2.16]. byF)followedbyanycombinationofwell-behavedoperations fi(representedbyΣ∗); 3.5 InitializingtheCorecursionState • forcorecFlex,theyconsistofanycombinationofwell-behaved The simplest relaxation of primitive corecursion is the allowance operations satisfying the condition that on every path leading of multiple constructors in the call context, in the style of Coq, toacorecursivecallthereexistsatleastoneconstructorguard as in the definition of onetwos (Section 2.1). Since this idea is (representedbyΣ∗(F(Σ∗_))). independent of the choice of codatatype J, we realize it when bootstrappingthecorecursionstate. We can see the computation of ga by following the diagrams in Moreprecisely,upondefiningacodatatypeJ,wetakethefol- Figure2counterclockwisefromtheirleft-topcorners.Theapplica- lowinginitialcorecursionstateinitState=(K, f,Λ): tionsafirstbuildsthecallcontextsyntactically.Thengisapplied corecursively on the leaves. Finally, the call context is evaluated: • Kisasingletonconsistingof(acopyof)F; forcorecPrim,itconsistonlyoftheguard(ctor);forcorecTop,it • f isasingletonconsistingofctor; involvestheevaluationofthewell-behavedoperators(whichmay also include several occurrences of the guard) and ends with the • Λ:∏A∈SetF(A×FA)→F(F∗A)isdefinedasF(op◦Fleaf◦ evaluation of the top guard; for corecFlex, the evaluation of the snd),wheresndisthesecondproductprojection. guardisinterspersedwiththatoftheotherwell-behavedoperations. Recall that the seed Λ is designed to schematically represent the Example5. ForeachexamplefromSection2.1,wegivethecore- corecursive behavior of the registered operations by describing cursors that can handle it (assuming the necessary well-behaved how they produce one layer of observable data. The definition in 7 2015/1/23 corecTops (cid:47)(cid:47) corecFlexs (cid:47)(cid:47) A J(cid:79)(cid:79) A J(cid:79)(cid:79) s ctor s eval corecPrims (cid:47)(cid:47) (cid:15)(cid:15) (cid:15)(cid:15) A J(cid:79)(cid:79) F(Σ∗A) (cid:59)(cid:59)FJ Σ∗(F(Σ∗A)) Σ∗(cid:79)(cid:79) J s ctor Feval Σ∗ctor (cid:15)(cid:15) F(Σ∗(corecTops)) (cid:37)(cid:37) Σ∗(F(Σ∗(corecFlexs))) (cid:40)(cid:40) FAF(corecPrims)(cid:47)(cid:47)FJ F(Σ∗J) Σ∗(F(Σ∗J))Σ∗(Feval)(cid:47)(cid:47)Σ∗(FJ) (a)Primitivecorecursion (b)Top-guardedcorecursionup-to (c)Flexiblyguardedcorecursionup-to Figure2:Thecorecursors g=corecTops (cid:47)(cid:47) KJ J(cid:79)(cid:79) F(A×FA) Λ (cid:47)(cid:47)F(F(cid:79)(cid:79)∗A) K(cid:104)id,dtor(cid:105) (cid:40)(cid:40) ctor s K(J×FJ) (cid:56)(cid:56)FJ Fsnd Fop ρ (cid:15)(cid:15) (cid:15)(cid:15) (cid:118)(cid:118) Feval F(Fleaf)(cid:47)(cid:47) F(Σ∗g) (cid:47)(cid:47) F(FA) F(F(F∗A)) F(Σ∗(KJ)) F(Σ∗J) (a)DefinitionofΛfortheinitialstate (b)Anewwell-behavedoperationg Figure3:DefinitionsofΛandg Figure 3a depicts this for ctor and instantiates to the schematic Theorem8. If(K, f,Λ)isawell-formedcorecursionstate,sois behaviorofSConspresentedattheendofExample4. nextStateg(K, f,Λ). Theorem7. initStateisawell-formedcorecursionstate—i.e.,it In summary, we have the following scenario triggering the satisfiesparametricityandwell-behavedness. state’sadvancement: 3.6 AdvancingtheCorecursionState 1. Onedefinesanewoperationg=corecTops. Theroleofacorecursionstate(K, f,Λ)forJistoprovideinfras- 2. Oneshowsthat sfactorsthroughaparametricfunctionρand tructureforflexiblecorecursivedefinitionsoffunctionsgbetween K(cid:104)id,dtor(cid:105)(asinFigure3b);inotherwords,oneshowsthatg’s arbitrary sets A and J. If nothing else is known about A, this is corecursivebehavior sdecomposesintoaone-stepdestruction theendofthestory.However,assumethatJisacomponentofA, of the arguments and a parametric transformation (which is inthatAisconstructedfromJ(possiblyalongwithothercompo- independentofJ). nents).Forexample,AcouldbeListJ,orJ×(Nat→ListJ).We 3. ThecorecursionstateisupdatedbynextStateg. capturethisabstractlybyassumingA=KJforsomefunctorK. Inthiscase,wehaveafruitfulsituationofwhichwecanprofit Example 9. The operations onetwos, ⊕, ⊗, and exp from Sec- forimprovingthecorecursionstate,andhenceimprovingtheflex- tion 2.1 are covered by this scenario. For example, assume that ibilityoffuturecorecursivedefinitions.Undersomeuniformityas- SConsand⊕areregisteredaswellbehavedatthetimeofdefin- sumptions,gitselfcanberegisteredaswellbehaved. ing⊗(cf.Example4).ThenK=(λA.A2)and⊗=corecTops, More precisely, assume that g:KJ→J is defined by g= where corecTopsandthatscanbeprovedtobeuniforminthefollowing s=(λ(xs,ys).(headxs×headys, sFen(Σse∗:T(KheAre))exsiusctshathpaatrasm=etρric◦fKun(cid:104)cidti,odntoρr:(cid:105)∏(FAi∈gSuerteK3(bA).×TFheAn)w→e leaf(xs,tailys) ⊕ leaf(tailxs,ys))) can integrate g as a well-defined operation as follows. We define Thefunctionsdecomposesintoρ◦K(cid:104)id,(cid:104)head,tail(cid:105)(cid:105),where nasex(tKS(cid:48)t,aft(cid:48)e,gΛ(K(cid:48)),,wf,hΛer)e, the “next” corecursion state triggered by g, ρ:∏A∈Set(A×(Nat×A))2→Nat×Σ∗(A2) • fKo(cid:48)r=the(Ks1ig,n..a.tu,rKenf,uKn)ct(osrimofilaKrl(cid:48)y; ntooteΣthvaetrswues eKs,sewnetiawllryitehaΣve(cid:48) iwshdiecfihniesdcbleyaρrl(y(ap,a(rmam,ae(cid:48)t)r)ic,.(bT,h(en,abc(cid:48)t))o)f=de(tmer×mnin,i(nag,bρ(cid:48))fr⊕om(a(cid:48)s,ba)n)d, Σ(cid:48)=Σ+K); K(cid:104)id,(cid:104)head,tail(cid:105)(cid:105)issyntax-directed. • f(cid:48)=(f1,..., fn,g); 3.7 CoinductionUp-to • Λ(cid:48):∏A∈SetΣ(cid:48)(A×FA)→F(Σ(cid:48)∗A)isdefinedas[Λ◦FembL, Inaproofassistant,specificationmechanismsarenotveryuseful ρ◦FembR]where[_,_]isthecaseoperatoronsums,which unlesstheyarecomplementedbysuitablereasoninginfrastructure. buildsafunction[u,v]:B+C→Dfromtwofunctionsu:B→ Thenaturalcounterpartofcorecursionup-toiscoinductionup-to. Dandv:C→D,andembL:Σ∗A→Σ(cid:48)∗A,embR:Σ∗(KA)→ In our incremental framework, the expressiveness of coinduction Σ(cid:48)∗AarethenaturalembeddingsintoΣ(cid:48)∗A. up-togrowstogetherwiththatofcorecursionup-to. 8 2015/1/23 Westartwithstructuralcoinduction[45],allowingtoprovetwo Σ∗[leaf,flat], where flat:∏A∈SetΣ∗(Σ∗A)→A is the stan- elementsofJequalbyexhibitinganF-bisimulation,i.e.,abinary dardjoinoperationoftheΣ∗-monad. relation R on J such that whenever two elements j1 and j2 are • eval evaluatesalltheformaloperationsofΣ∗: related,theirdtor-unfoldingsarecomponentwiserelatedbyR. _(F_+_) eval =eval◦Σ∗([ctor◦Feval,eval]) R j j ∀j j ∈J.R j j −→FrelR(dtor j )(dtor j ) _(F_+_) 1 2 1 2 1 2 1 2 j1= j2 Theorem11. Ifthereexists(aunique)g:A→Σ∗(F(Σ∗A))such Recall that our type constructors are not only functors but also that the diagram in Figure 4a commutes, there exists (a unique) relators.Thenotionof“componentwiserelationship”referstoF’s f :A→JsuchthatthediagraminFigure4bcommutes,namely, relatorstructureFrel. corecFlexg. Uponintegratinganewoperationg(Section3.6),thecoinduc- Thetheoremcertifiesthefollowingprocedureformakingsense tionruleismademoreflexiblebyallowingthedtor-unfoldingsto ofamixedfixpointdefinitionofafunction f: becomponentwiserelatednotonlybyRbutmoregenerallybya closureofRthattakesgintoaccount. 1. Separatetheguardedandtheunguardedcalls(asshowninthe For a corecursion state (K, f,Λ) and a relation R:J→J→ codomainΣ∗(F(Σ∗A)+Σ∗A)ofs). Bool,wedefinecl R,the f-congruenceclosureofR,asthesmall- 2. Provethattheunguardedcallseventuallyterminateorleadto f estequivalencerelationthatincludesRandiscompatiblewitheach guardedcalls(aswitnessedbyg). fi:KiJ→J: 3. Pass the unfolded guarded calls to the corecursor—i.e., take ∀z ,z ∈K J.Krel Rz z −→cl R(f z )(f z ) f =corecFlexg. 1 2 i i 1 2 f i 1 i 2 whereKreliistherelatorassociatedwithKi. Example12. TheaboveprocedurecanbeappliedtodefinefacC, The next theorem supplies the reasoning counterpart of the primes:Nat→Nat→Stream, and cat:Nat→Stream, while definition principle stated in Theorem 6. It can be inferred from avoidingtheunsoundnasty(Section2.3).Asimpleanalysisreveals recent,moreabstractresults[43]. thatthefirstself-calltoprimesisguardedwhilethesecondisnot. Wedefineg:Nat×Nat→Σ∗(Nat×Σ∗(Nat×Nat))by Theorem10. Thefollowingcoinductionruleupto f holdsinthe corecursionstate(K, f,Λ): g(m,n)=if(m=0∧n>1)∨gcdmn=1 thenleaf(n,leaf(m×n,n+1)) R j j ∀j j ∈J.R j j −→Frel(cl R)(dtor j )(dtor j ) 1 2 1 2 1 2 f 1 2 elseg(m,n+1) j = j 1 2 Inessence,gbehaveslike(theintended) f exceptthattheguarded Coinductionupto f istheidealabstractionforprovingequal- callsareleftsymbolic,whereastheunguardedcallsareinterpreted ities involving functions defined by corecursion up to f: For ex- as actual calls to g. One can show that g is well defined by a ample, a proof of commutativity for ⊗ naturally relies on con- standardterminationargument.Thischaracteristicequationofgis textsinvolving⊕,because⊗’scorecursivebehavior(i.e.,⊗’sdtor- thecommutativityofthediagramdeterminedbysasinFigure4a, unfolding)dependson⊕. where s:Nat×Nat→Σ∗(Nat×Σ∗(Nat×Nat)+Σ∗(Nat× Nat))isdefinedasfollows(withInlandInrbeingtheleftandright sumembeddings): 4. MixedFixpoints Whenwewritefixpointequationstodefineafunction f,weoften s(m,n)=if(m=0∧n>1)∨gcdmn=1 want to distinguish corecursive calls from calls that are sound thenleaf(Inl(leaf(n,leaf(m×n,n+1)))) for other reasons—for example, if they terminate. We model this elseleaf(Inr(leaf(m,n+1))) situationabstractlybyafunctions:A→Σ∗(F(Σ∗A)+Σ∗A).As Settingprimes=corecFlexgyieldsthedesiredcharacteristicequa- usualforeacha,theshapeofsarepresentsthecallingcontextfor tionforprimesaftersimplification(cf.Example4). f a,withtheoccurrencesofthecontentitemsa(cid:48)insarepresenting callsto f a(cid:48).Thenewtwististhatwenowdistinguishguardedcalls Theprimesexamplehasallunguardedcallsintailform,which (capturedbytheleft-handsideof+)frompossiblyunguardedones makestheassociatedfunctiongtail-recursive.Thisneednotbethe (theright-handsideof+). case,asshownbythecatexample,whoseunguardedcallsoccur Wewanttodefineafunction f withthebehaviorindicatedby underthewell-behavedoperation⊕.However,wedorequirethat s,i.e.,makingthediagraminFigure4bcommute.Inthefigure,+ theunguardedcallsoccurincontextsformedbywell-behavedop- denotes the map function u+v:B+C→D+E built from two erationsalone.Afterunfoldingalltheunguardedcalls,theresulting functions u:B→D and v:C→E. In the absence of pervasive contextthatistobehandledcorecursivelymustbewellbehaved— guards, we cannot employ the corecursors directly to define f. thisprecludesunsounddefinitionslikenasty. However,ifwecanshowthatthenoncorecursivecallseventually lead to a corecursive call, we will be able to employ corecFlex. 5. FormalizationandImplementation Thispreconditioncanbeexpressedintermsofafixpointequation. WeformalizedinIsabelle/HOLthemetatheoryofSections3and4. According to Figure 4a, the call to g (shown on the base arrow) Essentially,thismeansthattheresultshavebeenprovedinhigher- happensonlyontheright-handsideof+,meaningthattheintended order logic with Infinity, Choice, and a mechanism for defining corecursivecallsareignoredwhen“computing”thefixpointg.Our typesbyexhibitingnon-emptysubsetsofexistingtypes.Thelogic goalistoshowthattheremainingcallsbehaveproperly. iscomparabletoZermelosettheorywithChoice(ZC)butweaker The functions reduce and eval that complete the diagrams of thanZFC.Thedevelopmentwouldworkforanyclassoffunctors Figure4aretheexpectedones: that are relators (or closed under weak pullbacks), contain basic • The elements of Σ∗(F(Σ∗A)) are formal-expression trees functors(identity,(co)products,etc.)andareclosedunderintersec- guarded on every path to the leaves, and so are the elements tion,composition,andhaveinitialalgebrasandfinalcoalgebrathat Σ∗(F(Σ∗A)+Σ∗(Σ∗(F(Σ∗A)))),butwithamorerestricted canberepresentedinhigher-orderlogic.However,ourIsabellede- shape;reduceembedsthelatterintheformer:reduce=flat◦ velopmentfocusesonaspecificclass[49]. 9 2015/1/23 A g (cid:47)(cid:47)Σ∗(F((cid:79)(cid:79)Σ∗A)) A f=corecFlexg (cid:47)(cid:47)J(cid:79)(cid:79) s reduce s eval_(F_+_) (cid:15)(cid:15) (cid:15)(cid:15) Σ∗(id+Σ∗g)(cid:47)(cid:47) Σ∗(F(Σ∗f)+Σ∗f)(cid:47)(cid:47) Σ∗(F(Σ∗A)+Σ∗A) Σ∗(F(Σ∗A)+Σ∗(Σ∗(F(Σ∗A))))) Σ∗(F(Σ∗A)+Σ∗A) Σ∗(F(Σ∗J)+Σ∗J) (a)Assumption (b)Conclusion Figure4:Mixedfixpoint Theformalizationconsistsoftwoparts:Thebasederivesacore- 4. Extractapolymorphicfunctionρfromthespecificationoff. cursorup-tofromaprimitivecorecursor;thestepstartswithacore- 5. Automaticallyproveρparametricorpasstheproofobligation cursorup-toandintegratesanadditionalwell-behavedoperation. totheuser. ThebasepartstartsbyaxiomatizingafunctorFanddefinesa codatatype with nesting through F: codatatype J = ctor(FJ). 6. Derivethenewstrengthenedcorecursoranditsnewcoinduction (Ingeneral,Jcoulddependontypevariables,butthisisanorthog- principle. onalconcernthatwouldonlycluttertheformalization.)Thenthe Thecoreccommandwillbecomplementedbyanadditionalcom- formalizationdefinesthefreealgebraoverFandthebasiccorecur- mand,tentativelycalledwell_behaved_for_corec,forregistering sorseedΛforinitializingthestatewithctoraswellbehaved(Sec- arbitraryoperationsf(notnecessarilydefinedusingcorec)aswell tion3.5).ItalsoneedstoliftΛtothefreealgebra,atechnicalitythat behaved.Thecommandwillasktheusertoprovideacorecursive wasomittedinthepresentation.Thenitdefinesevalandothernec- specificationoff asalemmaoftheformf x=Cons ... andthen essarystructure(Section3.3).Finally,itintroducescorecTopand perform steps 4 to 6. The corec command will become stronger corecFlex(Section3.4)andderivesthecorrespondingcoinduction andstrongerasmorewell-behavedoperationsareregistered. principle(Section3.7). The following Isabelle theory fragment gives a flavor of the Fromahigh-levelpointofview,thestepparthasasomewhat envisionedfunctionalityfromtheuser’spointofview: similar structure to the base. It axiomatizes a domain functor K andaparametricfunctionρassociatedwiththenewwell-behaved codatatype StreamA=SCons(head:A)(tail:StreamA) operation g to integrate. Then it extends the signature to include K, defines the extended corecursor seed Λ(cid:48), and lifts Λ(cid:48) to the corec(well_behaved)⊕:Stream→Stream→Stream xs⊕ys=SCons(headxs+headys)(tailxs⊕tailys) free algebra. Next, it defines the parameterized evalg and other infrastructure (Section 3.6). Finally, it introduces corecTop and corec(well_behaved)⊗:Stream→Stream→Stream corecFlexforthenewstateandderivesthecoinductionprinciple. xs⊗ys=SCons(headxs×headys) The process of instantiating the metatheory to particular user- ((xs⊗tailys)⊕(tailxs⊗ys)) specified codatatypes is automated by a prototype tool: the user pointstoaparticularcodatatype(typicallydefinedusingIsabelle’s lemma⊕_commute: xs⊕ys=ys⊕xs existing(co)datatypespecificationlanguage[12]),andthenthetool by(coinductionarbitrary:xsysrule:stream.coinduct)auto takesoverandinstantiatesthegenericcorecursortotheindicated lemma⊗_commute: xs⊗ys=ys⊗xs type, provinding the concrete corecursion and mixed recursion- proof(coinductionarbitrary:xsysrule:stream.coinduct_upto) corecursiontheorems.Thestreamandtreeexamplespresentedin caseEq_stream Section 2 have all been obtained with this tool. As a larger case thus?caseunfoldingtail_⊗ study, we formalized all the examples from the extended version by(subst⊕_commute)(autointro:stream.cl_⊕) ofHinzeandJames’sstudy[22].Theparametricityproofobliga- qed tionsweredischargedbyIsabelle’sparametricityprover[24].The mixedrecursion–corecursiondefinitionsweredoneusingIsabelle’s 6. RelatedWork facilityfordefiningterminatingrecursivefunctions[29]. Unlike Isabelle’s primitive (co)recursion mechanism [12], our Thereisalotofrelevantwork,concerningboththemetatheoryand tool currently lacks syntactic sugar support, so it still requires applicationsinproofassistantsandsimilarsystems.Wereferenced someboilerplatefromtheuser,namelytheexplicinvocationofthe someofthemostcloselyrelatedworkintheearliersections.Here corecursorandtheparametricityprover:thesearejustafewextra isanattemptatamoresystematicoverview. lines of script per definition, and therefore the tool is also usable Category Theory. The notions of corecursion and coinduction inthecurrentform.Followingthedesignofitsprimitiveancestor, up-to started with process algebra [44, 47] before they were re- itsenvisionedfullyuser-friendlyextensionwillreplacetheexplicit castintheabstractlanguageofcategorytheory[8,22,26,28,38, invocation of the corecursor with a corec command, allowing 43,50].Ourapproachowesalottothistheoreticalwork,andin- userstospecifyafunctionfcorecursivelyandthenperformingthe deed formalizes some state-of-the-art category theoretical results followingsteps(cf.Example5): on corecursion and coinduction up-to [38, 43]. Besides adapting 1. Parse the specification of f and synthesize arguments to the existing results to higher-order logic within an incremental core- cursorcycle,wehavealsoextendedthestateoftheartwithasound current,mostpowerfulcorecursor. mechanismformixingrecursionwithcorecursionup-to. 2. Definefintermsofthecorecursor. Categorytheoryprovidesanimpressivebodyofabstractresults 3. Derivetheoriginalspecificationfromthecorecursortheorems. that can be applied to solve concrete problems elegantly. Proof assistants have a lot to benefit from category theory, as we hope Passingthewell_behavedoptiontocorecwilladditionallyinvoke to have demonstrated with this paper. There has been prior work thefollowingprocedure(cf.Example9): onintegratingcoinductionup-totechniquesfromcategorytheory 10 2015/1/23