Liam O'Connor https://liamoc.net/forest/index/ index /forest/index/ Liam O'Connor false https://liamoc.net/forest/liamoc/liamoc/forest/liamoc/Liam O'ConnorPersonhttps://liamoc.netAustralian National University0000-0003-2765-4269Senior LecturerI am a Senior Lecturer in Foundations at the Australian National University School of Computing, on Ngunnawal and Ngambri country. I'm also an Honorary Fellow at the University of Edinburgh Laboratory for Foundations of Computer Science, where I worked until 2024.Lately, my research has been focused on property-based testing, semantics and temporal logic, but I have very broad research interests. See my personal bibliography for a full list of my work.Previously, I lectured courses at UNSW Sydney, where I did my PhD with Gabriele Keller and the Trustworthy Systems Team lead by Gernot Heiser, focusing on the Cogent project.Full details about me can be found on my curriculum vitæ, which includes a list of students. My contact details can be found here.I'm also an experienced liturgical singer and cantor. I journal my experiences in church music at the Church Music Corner. Liam O'Connorhttps://liamoc.net/forest/loc-000E/loc-000E/forest/loc-000E/About this websiteThis website is a "forest" created using the Forester tool, a system of evergreen hypertext notes developed by, among others, Jon Sterling and Kento Okura. To search my forest, press Ctrl+K. Liam O'ConnorLecture notesDomain theory Interactive theorem proving Liam O'Connorhttps://liamoc.net/forest/news/news/forest/news/NewsSee also Weeknotes 26.03.01 Kai Phan starts her PhD this week, and Edwin Park starts his honours project. 26.02.20 I have accepted an invitation to serve on the PC of POPL ’27: 54th ACM SIGPLAN Symposium on Principles of Programming Languages. 26.01.16 My student Kai Phan will start her PhD with me this semester. 26.01.15 I have agreed to join the supervision panel for Fabian Mühlböck's student, Carlo Zancanaro. 25.12.17 I have agreed to join the supervision panel for Nisansala Yatapanage's student, Ali Nosherwan Hamed. 25.12.01 My course on Interactive theorem proving is running this week. 25.09.19 I have agreed to teach COMP1110 Structured Programming in 2026 Semester 1. 25.09.18 I will be teaching at the ANU Logic Summer School 2025 this December. 25.09.12 I have been made a member of IFIP Working Group 2.1: Algorithmic Languages and Calculi. 25.09.08 The ICFP '25 Programming Contest has successfully concluded. 25.08.22 Xin Lu starts her PhD with me and Peter Höfner today. 25.07.22 Selene's paper, Memory Safety: Uniqueness as Separation, has been accepted to APLAS '25: 23rd Asian Symposium on Programming Languages and Systems! 25.07.20 Mio Wu and Josh Brown are starting their Honours projects with me this semester, working on the next generation of the Holbert proof assistant. 25.05.30 Xin Lu will be starting her PhD with me and Peter Höfner in a few months. 25.05.16 I have completed the domain theory lecture notes. 25.05.01 I have agreed to co-supervise Yi Yao, a new PhD student with Peter Höfner. 25.03.22 I have joined the PC for Haskell '25: 18th ACM SIGPLAN Haskell Symposium. 25.03.13 I have joined the PC for FProPer '25: 2nd ACM SIGPLAN Workshop on Functional Programming for Productivity and Performance. 25.02.04 Jack Bashford has joined me for a semester project working on Holbert. 25.01.08 I have joined the PC for APLAS '25: 23rd Asian Symposium on Programming Languages and Systems. 24.11.05 I have joined the PC for ICFP '25: 29th ACM SIGPLAN International Conference on Functional Programming. 24.10.22 I have joined the PC for PLDI '25: 46th ACM SIGPLAN International Conference on Programming Language Design and Implementation. 24.09.17 I have agreed to organise the ICFP '25 Programming Contest. 24.09.30 I was delighted to spend a week with the WG2.1 folks here at the ANU. 24.09.09 Our student Rayhana Amjad has published her first paper, Semantics for Linear-time Temporal Logic with Finite Observations at EXPRESS/SOS. 24.07.30 I have taken a new position as a Senior Lecturer at the Australian National University. References Pilar Selene Linares Arévalo Vincent Jackson Arthur Azevedo de Amorim Liam O'Connor Peter Schachte Christine Rizkallah 2025 10 27 https://liamoc.net/forest/linares-dajosr-2025/ linares-dajosr-2025 /forest/linares-dajosr-2025/ Memory Safety: Uniqueness as Separation Reference APLAS '25: 23rd Asian Symposium on Programming Languages and Systems Programming languages with uniqueness type systems prevent pointer aliasing, simplifying memory safety reasoning. However, code implemented in these languages often interoperates through foreign function interfaces with external components implemented in languages lacking the same level of static safety guarantees. To verify safe updates in a combined system, one must manually verify that the external components preserve the safety invariants of the uniqueness type system. In particular, recent work showed that one can manually discharge such obligations on C components from a cross-language Cogent-C system by directly reasoning about the C code in higher-order logic. However, even for simple examples, discharging the uniqueness safety obligations, known as frame conditions, within a logic not specifically designed for direct reasoning in terms of heaps and pointers was not ideal. Separation logic is an established logic that facilitates reasoning about imperative programs by localising reasoning to the parts of the heap that the program mutates. This raises a vital question. Can we use separation logic to discharge the safety obligations imposed by uniqueness types? The answer is yes. This paper demonstrates that the frame conditions can be inferred from particular separation logic triples and, hence, discharged by reasoning using separation logic. We identify and verify the soundness of specific separation logic triples that imply the frame conditions imposed by a uniqueness type system. To appear. Rayhana Amjad Rob van Glabbeek Liam O'Connor 2024 11 22 https://liamoc.net/forest/amjad-vanglabbeek-oconnor-2024/ amjad-vanglabbeek-oconnor-2024 /forest/amjad-vanglabbeek-oconnor-2024/ Semantics for Linear-time Temporal Logic with Finite Observations Reference EXPRESS/SOS '24: Combined 31st International Workshop on Expressiveness in Concurrency and 21st Workshop on Structural Operational Semantics 10.4204/EPTCS.412.4 Proofs on AFP LTL3 is a multi-valued variant of Linear-time Temporal Logic for runtime verification applications. The semantic descriptions of LTL3 in previous work are given only in terms of the relationship to conventional LTL. Our approach, by contrast, gives a full model-based inductive accounting of the semantics of LTL3, in terms of families of definitive prefix sets. We show that our definitive prefix sets are isomorphic to linear-time temporal properties (sets of infinite traces), and thereby show that our semantics of LTL3 directly correspond to the semantics of conventional LTL. In addition, we formalise the formula progression evaluation technique, popularly used in runtime verification and testing contexts, and show its soundness and completeness up to finite traces with respect to our semantics. All of our definitions and proofs are mechanised in Isabelle/HOL. Liam O'Connor Rayhana Amjad 2022 10 17 https://liamoc.net/forest/oconnor-amjad-2022/ oconnor-amjad-2022 /forest/oconnor-amjad-2022/ Holbert: Reading, Writing, Proving and Learning in the Browser Reference HATRA '22: Human Aspects of Types and Reasoning Assistants 2022 10.48550/arXiv.2210.11411 https://liamoc.net/hatra-2022/ https://www.youtube.com/watch?v=Rdb7P5MJZLw This paper presents Holbert: a work-in-progress pedagogical proof assistant and online textbook platform, aimed at the educational use-case, specifically for the teaching of programming language theory. Holbert allows proof exercises and rule definitions to be embedded directly in an online textbook, where proofs and rules can be manipulated using a graphical interface. We give an overview of the logical foundations of Holbert, examples of its use, and give an update as to its current implementation status. Context Backlinks Related Liam O'Connor https://liamoc.net/forest/dt-001Y/ dt-001Y /forest/dt-001Y/ Domain theory Lecture Notes These lecture notes are based on the material I used to teach the Domain Theory (TypeSIG) course at the University of Edinburgh in 2024. Liam O'Connorhttps://liamoc.net/forest/dt-0005/dt-0005/forest/dt-0005/Semantics and recursionLectureThis lecture is based on material from Graham Hutton, Dana Scott, Joseph Stoy, Carl Gunter, and Glynn Winskel.Liam O'Connorhttps://liamoc.net/forest/dt-0003/dt-0003/forest/dt-0003/Denotational semanticsIn this course we are concerned with programming languages, which, as with natural languages, consist of a syntax and semantics. The syntax of a language is, for our purposes, merely an inductively-defined tree structure (i.e. abstract syntax).Liam O'Connorhttps://liamoc.net/forest/dt-0000/dt-0000/forest/dt-0000/The Language (without loops)Definition Using notation similar to Backus-Naur Form (BNF): In the language above, there are three syntactic classes: , , and .Liam O'Connorhttps://liamoc.net/forest/dt-0001/dt-0001/forest/dt-0001/Denotational semanticsDefinitionA denotational semantics consists of, for each syntactic class in a language: A semantic domain which can be any set of mathematical objects (although, as we will see later, it is helpful if it obeys certain properties). A valuation function . We require that this function be a homomorphism, that is that it is compositional. This means that the valuation (or denotation) of an expression should be made from the denotation of its components. In other words, for each syntactic constructor , we should have a mathematical operation such that the denotation of can be defined as: Liam O'Connorhttps://liamoc.net/forest/dt-0002/dt-0002/forest/dt-0002/RemarkThe choices of semantic domain and valuation function are, essentially, arbitrary: we choose objects that reflect those aspects of our programs that we are interested in. For most of the simple languages we will examine, we are only concerned with the results of the computation, which is a semantics suitable for reasoning about program behaviour and correctness. However, there also exist denotational cost models that compositionally assign a measure of program performance to syntax. This measure is just another kind of denotational semantics.Liam O'Connorhttps://liamoc.net/forest/dt-0004/dt-0004/forest/dt-0004/Denotational semantics for the language (without loops)ExampleWe shall first select a semantic domain for each syntactic class: Here, represents the set of states, which contains the values assigned to all variables: Now, we define our valuation functions, : and : and : Liam O'Connorhttps://liamoc.net/forest/dt-000L/dt-000L/forest/dt-000L/RecursionSo far, our semantic domains have just been (functions of) sets. While these have the advantage of being mathematically simple and intuitive, two language features make these sets insufficient for our purposes: Recursively defined programs, for dealing with recursion and loops, and Recursively defined semantic domains, for dealing with higher-order programs.Liam O'Connorhttps://liamoc.net/forest/dt-0006/dt-0006/forest/dt-0006/Recursively defined programs Suppose we extended the language with a while loop construct: The intuitive way to assign a semantics would be to use a recursive function: However, such an equation is not a good definition. If we consider the trivial infinite loop program , and compute its semantics, we end up with: This equation is satisfied by any function , so it doesn't tell us which function corresponds to the program .More generally, allowing our functions to be (generally) recursive causes these issues. The loop program gives rise to the recursive equation , which has an infinite number of solutions. If we add recursion to our programming language, we could have programs that give rise to more complex recursive equations like . By contrast to , has no solutions (assuming operates on integers). Liam O'ConnorUpshot We need an explicit notion of "non-termination" on the semantics level, to properly deal with general recursion (or iteration). Liam O'Connorhttps://liamoc.net/forest/dt-0007/dt-0007/forest/dt-0007/Recursively defined semantic domainsSuppose we extend our notion of expressions in the language with parameterless higher-order procedures: Liam O'ConnorUsing higher-order proceduresExampleWe can store procedures in variables, so the program: has the same effects on the variable as the program: For our denotational semantics, our domains now take this form ( parts are new vs. Example ), where denotes disjoint union: Liam O'Connorhttps://liamoc.net/forest/dt-000P/dt-000P/forest/dt-000P/ExerciseGive a semantics to the construct: Liam O'ConnorSolution Unfolding the definition of , we end up with a recursive equation for the definition of : Such equations have no set-theoretic solution, even if we weaken equality to mere set isomorphism (here notated ). Liam O'ConnorA simpler equation with no solutionExampleConsider the recursive equation . Cantor's theorem says that there is no set such that (where is the power set of ), and seeing as it follows that has no solution.Any kind of higher-order construct leads to such recursive domain equations. Liam O'ConnorUpshot There are no (nontrivial) set-theoretic solutions to the recursive domain equations that arise from higher-order language constructs. We will return to this problem later on! For now, let's focus on representing non-termination.Liam O'Connorhttps://liamoc.net/forest/dt-0009/dt-0009/forest/dt-0009/Flat domains and information orderingLiam O'Connorhttps://liamoc.net/forest/dt-000A/dt-000A/forest/dt-000A/The bottom valueFollowing Scott, we introduce a special bottom value to our semantic domains. Liam O'Connorhttps://liamoc.net/forest/dt-0008/dt-0008/forest/dt-0008/Flat domainDefinitionGiven a set , the flat domain (or lifted set) is just the set (where ).Liam O'Connorhttps://liamoc.net/forest/dt-000B/dt-000B/forest/dt-000B/Information orderingDefinitionAn information ordering is a partial order on denotations, written . This indicates that is approximated by, or carries more information than, or is more well-defined than . Naturally, the bottom value, being totally uninformative, is always the least element in this ordering.Liam O'Connorhttps://liamoc.net/forest/dt-000C/dt-000C/forest/dt-000C/Information ordering for flat domainsExampleConsider a flat domain . There is a natural information ordering on :Formally, we say iff . Liam O'ConnorWarningDon't confuse the information ordering on numbers, i.e. on , with the numerical ordering on . We know , but and are not comparable in our flat information ordering. Liam O'Connorhttps://liamoc.net/forest/dt-000D/dt-000D/forest/dt-000D/Combining domainsSome of our semantics may depend on the combination of multiple domains, i.e. semantic functions of multiple arguments. As an example, the semantics of an statement combines the semantics of the condition and the semantics of each of the two branches. In such scenarios, our domains are no longer flat — we must generalise to pointed posets.Liam O'Connorhttps://liamoc.net/forest/dt-000G/dt-000G/forest/dt-000G/Pointed posetDefinitionA pointed poset is a partially ordered set with a bottom value.Liam O'Connorhttps://liamoc.net/forest/dt-000E/dt-000E/forest/dt-000E/Product of two pointed posetsConstructionGiven two pointed posets and , the product poset is ordered as follows: Intuitively, this says that "the information content of a pair of values is increased by increasing the information of either or both of its component values".This product poset is also pointed, with bottom value being .Liam O'Connorhttps://liamoc.net/forest/dt-000F/dt-000F/forest/dt-000F/The domain ExampleAs can be seen above, the domain is not flat, but it is still a pointed poset.Liam O'Connorhttps://liamoc.net/forest/dt-000H/dt-000H/forest/dt-000H/Monotonic functionsIf we model our semantic domains for values with pointed posets, then programs are modelled by functions between such posets. But, not all functions are suitable:Liam O'Connorhttps://liamoc.net/forest/dt-000I/dt-000I/forest/dt-000I/The halting queryExampleThe function seems to let us solve the halting problem, assuming represents non-termination: It stands to reason that the amount of information we get out of our functions should grow as we increase the amount of information we put into them. Such functions are called monotonic with respect to our information ordering.Liam O'Connorhttps://liamoc.net/forest/dt-000J/dt-000J/forest/dt-000J/MonotonicityDefinitionA function between posets and is monotone (or monotonic) if, for all : Liam O'Connorhttps://liamoc.net/forest/dt-000K/dt-000K/forest/dt-000K/StrictnessDefinitionA function on pointed posets and is strict if it preserves the bottom value, i.e. . Liam O'ConnorThesisComputable functions are monotonic (observe that is not). Liam O'Connorhttps://liamoc.net/forest/dt-000N/dt-000N/forest/dt-000N/ExerciseConsider the functions . Which ones are monotonic? There are a total of 27 such functions but only three significant classes. Liam O'ConnorSolutionThe three classes are the nine strict functions (which map to ), which are all monotonic, the two non-strict constant functions (which ignore their input and return and respectively), which are also monotonic, and the 16 non-monotonic functions.Liam O'Connorhttps://liamoc.net/forest/dt-000O/dt-000O/forest/dt-000O/ExerciseLet denote the chain of values where implies . There is one monotonic function :,thick] (a) edge[bend left] (b); \end {tikzpicture}]]>And there are three monotonic functions :,thick] (a) edge (b); \draw [thick] (b) edge (b1); \draw [thick] (a) edge (a1); \draw [->,thick] (a1) edge (b1); \end {tikzpicture}$\quad $ \begin {tikzpicture} \node (a) at (0,0) {$\bullet $}; \node (b) at (1,0) {$\bullet $}; \node (a1) at (0,1) {$\bullet $}; \node (b1) at (1,1) {$\bullet $}; \draw [thick] (b) edge (b1); \draw [->,thick] (a) edge (b); \draw [thick] (a) edge (a1); \draw [->,thick] (a1) edge (b); \end {tikzpicture}$\quad $ \begin {tikzpicture} \node (a) at (0,0) {$\bullet $}; \node (b) at (1,0) {$\bullet $}; \node (a1) at (0,1) {$\bullet $}; \node (b1) at (1,1) {$\bullet $}; \draw [->,thick] (a) edge (b1); \draw [thick] (a) edge (a1); \draw [thick] (b) edge (b1); \draw [->,thick] (a1) edge (b1); \end {tikzpicture} ]]> Write down the monotonic functions . Liam O'ConnorSolutionWhen drawn as a diagram like the above, the monotonic functions are all those whose lines do not cross. Write a simple recursive program to calculate the number of monotonic functions . Liam O'ConnorSolutionIn Haskell:monotonics :: Int -> Int -> Int monotonics n 1 = 1 monotonics n m = sum [monotonics (n-x) (m-1) | x <- [0..n]]Liam O'Connorhttps://liamoc.net/forest/dt-000U/dt-000U/forest/dt-000U/Fixed pointsLiam O'Connorhttps://liamoc.net/forest/dt-000R/dt-000R/forest/dt-000R/From recursion to fixed points Consider our recursive loop semantics from § : How do we ensure that solutions exist for such recursive equations? And, if multiple solutions exist, how do we decide which one to pick? To address these questions, let's factor out everything in our definition except the recursion into a separate (higher-order) function: Looking at it this way, we can see that any solution to this equation must be an element of our semantic domain such that . In other words, the problem of finding solutions to our recursive equations can be cast as the problem of finding a fixed point for non-recursive higher-order functions. Liam O'Connorhttps://liamoc.net/forest/dt-000S/dt-000S/forest/dt-000S/Fixed pointDefinitionA value is a fixed point of a function if . Liam O'Connorhttps://liamoc.net/forest/dt-000T/dt-000T/forest/dt-000T/Monotonicity is insufficientLiam O'Connorhttps://liamoc.net/forest/dt-000Q/dt-000Q/forest/dt-000Q/ExerciseGive an example of a poset and a monotonic function such that doesn't have a fixed point. Liam O'ConnorSolutionIn the poset , the function has no fixed points. Give an example of a poset and a monotonic function such that has multiple fixed points. Liam O'ConnorSolutionIn the poset , the function has infinitely many fixed points. Liam O'ConnorProblemNot all monotonic functions on posets have fixed points, and some have multiple fixed points!So, requiring our functions to be monotonic is insufficient to guarantee that a single "best" solution exists. Liam O'Connorhttps://liamoc.net/forest/dt-000Y/dt-000Y/forest/dt-000Y/Chains and UnfoldingIntuitively, recursive programs are executed by "unfolding" as much as necessary to get a result. We would like to characterise our domains to ensure that solutions always exist, and to allow us to pick the solutions that are "minimal" in the sense that they rely on a minimal amount of unfolding.After converting a recursive program into a non-recursive monotonic higher order function , the fixed point we desire would intuitively be the limit of the ascending Kleene chain of , i.e. : https://liamoc.net/forest/dt-000X/dt-000X/forest/dt-000X/Ascending Kleene chainExample Given a pointed poset and a monotonic function , the ascending Kleene chain is the -chain: Because is the bottom element, we know that . Each subsequent step in the chain exists because of monotonicity. Each successive element of this chain is another "unfolding" of the recursion.Liam O'Connorhttps://liamoc.net/forest/dt-000V/dt-000V/forest/dt-000V/ChainDefinition A chain in a poset is a totally ordered subset of . That is, a subset is a chain iff: Liam O'Connorhttps://liamoc.net/forest/dt-000W/dt-000W/forest/dt-000W/-chainDefinition An -chain is a chain that is countable. In other words, it is a sequence of elements such that: Liam O'Connorhttps://liamoc.net/forest/dt-000Z/dt-000Z/forest/dt-000Z/From chains to directed setsWhile -chains are technically sufficient for denotational semantics, for our purposes it is a little more convenient to think in terms of directed sets rather than chains.Liam O'Connorhttps://liamoc.net/forest/dt-0010/dt-0010/forest/dt-0010/Directed setDefinition Formally, a non-empty subset of a poset is directed iff: The above is an upper bound of and . Hence, a non-empty set is directed iff every pair of values has an upper bound in the set.Intuitively, directed sets are "going somewhere" — given two elements we can always find a "greater" one in the set.https://liamoc.net/forest/dt-0011/dt-0011/forest/dt-0011/Power sets are directedExampleThe power set of any set is directed under .Below: : Liam O'Connorhttps://liamoc.net/forest/dt-0012/dt-0012/forest/dt-0012/Chain → DirectedTheoremAll non-empty chains are directed. Liam O'ConnorProofLet be a chain. Then, given two elements we know from totality that either or . If , then is the upper bound, otherwise is the upper bound. https://liamoc.net/forest/dt-0013/dt-0013/forest/dt-0013/Consistent subsetDefinition A subset of a poset is consistent iff Such an is called an upper bound of . ,thick] (foo) edge[bend right] (1.2,0); \node (a) at (4.2,0) {$\bullet $}; \node (b) at (5.8,0) {$\bullet $}; \node (x) at (4.2,1) {$\bullet $}; \node (y) at (5.8,1) {$\bullet $}; \node (c) at (5,-1) {$\bullet $}; \draw [thick] (c) -- (a) (c) -- (b) (a) -- (x) (a) -- (y) (b) -- (x) (b) -- (y); \draw [dashed, rounded corners=0.4cm] (3.8,-0.4) rectangle (6.2,0.4); \node (foo) at (7,-1.2) {a \emph {consistent} set}; \draw [->,thick] (foo) edge[bend right] (6.2,0); \node (foo) at (2,1) {upper bound}; \draw [->,thick] (foo) edge[bend left] (x); \draw [->,thick] (foo) edge[bend left] (y); \end {tikzpicture} ]]>Liam O'Connorhttps://liamoc.net/forest/dt-0014/dt-0014/forest/dt-0014/Alternative characterisation of directednessTheoremA subset of a poset is directed iff every finite subset of has an upper bound in . Liam O'ConnorProof⇐: Every pair of elements has an upper bound simply by taking the upper bound of the set ⇒: Given a finite set , we can show it has an upper bound by an inductive process, first taking the upper bound of and , and then taking the upper bound of that an and so on until we have an upper bound for the whole set. This induction works because the set is finite. Liam O'Connorhttps://liamoc.net/forest/dt-0015/dt-0015/forest/dt-0015/CorollaryFrom Theorem we can see that a finite set is directed iff it has a top element , i.e. .Liam O'Connorhttps://liamoc.net/forest/dt-0016/dt-0016/forest/dt-0016/Least upper boundsLiam O'Connorhttps://liamoc.net/forest/dt-0017/dt-0017/forest/dt-0017/Least upper boundDefinitionLet be a subset of a poset . An element is a least upper bound (or lub) for iff: It is an upper bound: It is less than any other upper bound: It follows that lubs are unique if they exist. We write the lub of a set as , and usually write as a shorthand for . Liam O'Connorhttps://liamoc.net/forest/dt-0018/dt-0018/forest/dt-0018/Properties of Corollary When lubs exist, the binary operator is idempotent, commutative, and associative. Also, we have that iff . Liam O'Connorhttps://liamoc.net/forest/dt-0019/dt-0019/forest/dt-0019/Pointedness via lubsTheorem A poset is pointed iff exists, as the lub of an empty set is just the bottom element in the poset, i.e. . https://liamoc.net/forest/dt-001A/dt-001A/forest/dt-001A/Information intuitionWhen the poset from Definition is ordered by our information ordering, the intuition of the lub is that it combines all of the information content of all the elements of but it does not add any additional information (hence least).https://liamoc.net/forest/dt-001B/dt-001B/forest/dt-001B/Lubs in the domain Example does not exist.https://liamoc.net/forest/dt-001C/dt-001C/forest/dt-001C/Exercise What is the lub operator on subsets of the poset ? SolutionThe lub operator is maximum.Liam O'Connorhttps://liamoc.net/forest/dt-001E/dt-001E/forest/dt-001E/Complete partial ordersLiam O'Connorhttps://liamoc.net/forest/dt-001D/dt-001D/forest/dt-001D/Complete partial orderDefinitionA complete partial order or cpo (more specifically a directed complete partial order or dcpo) is a poset where lubs exist for the empty set and for all directed subsets. That is, a cpo is a poset such that: has a bottom element , that is the lub of the empty set, and exists for all directed .Liam O'Connorhttps://liamoc.net/forest/dt-001F/dt-001F/forest/dt-001F/Other kinds of completenessAsideIn Definition we defined cpos in terms of directed completeness. We may consider chain completeness instead, where, rather than require lubs for every directed subset of our poset , we require lubs for every chain . We know from Theorem that all chains are directed, so every directed complete cpo is also chain complete. It is also known that every chain complete cpo is also directed complete, so the notions are equivalent, although the proof is non-trivial, relying on transfinite induction (see these lecture notes for details).If we weaken our completeness requirement to require lubs only for the countable -chains and not necessarily all chains, we get what is called an -cpo. All -chains are chains and are therefore directed, but not all chains are -chains.Working with just -cpos is common in denotational semantics practice, but working with directed completeness simplifies some of the properties we will discuss later.Liam O'Connorhttps://liamoc.net/forest/dt-001G/dt-001G/forest/dt-001G/ExerciseFor each of the following posets, determine if it is a cpo or not. If it is, describe the lubs. If it is not, give a directed set which has no lub. A finite pointed poset for some set A flat domain for some set . Liam O'ConnorSolution A finite pointed poset is a cpo, as all directed subsets will be finite and therefore have a lub. is a cpo as the lub is just the union. is not a cpo, as the -chain has no lub. is a cpo, as is the lub of any non-repeating chain. is a cpo with maximum as the lub. is not a cpo, as the set has a lub of . is not a cpo, and not just because it lacks a lub for itself, but also it doesn't contain , which can be expressed as the lub of an infinite sequence of rational approximations. A flat domain for some set is a cpo, as the largest chains have two elements, and we always pick the non- one as the lub. https://liamoc.net/forest/dt-001H/dt-001H/forest/dt-001H/Lubs of chainsRemarkThe limit of the ascending Kleene chain of a monotonic function is the same as the least upper bound of the set (where is the -fold self-composition of the function ). If we require that our semantic domain is a cpo, we know that this limit exists. ThesisOur semantic domains are cpos, ensuring the presence of these limits.Liam O'Connorhttps://liamoc.net/forest/dt-001X/dt-001X/forest/dt-001X/ExerciseShow that if and are posets and is directed (by the ordering in Construction ), then the subsets and (defined below) are also directed. Liam O'ConnorSolutionGiven two elements , we know that there exists such that and . Because is directed, we can conclude that there exists an upper bound where and . As , is an upper bound in for both and and thus is directed. The proof for is analogous. Give an example of a set such that and are directed, but is not. Liam O'ConnorSolution is not directed as the two elements are not comparable, but which is directed as . Show that if and are cpos and is directed, then Note: Together with this shows that the Cartesian product of two cpos is itself a cpo. Liam O'ConnorSolution Let . Because of the ordering in Construction , is certainly a upper bound of the directed set . To show it is the least upper bound, assume for the sake of contradiction that is not the least upper bound of . Then, there must be a such that . But then, would be a lesser upper bound for than , which is supposed to be the lub. Thus there is a contradiction, and must be the lub of . Liam O'Connorhttps://liamoc.net/forest/dt-001I/dt-001I/forest/dt-001I/Continuity and Fixed PointsBy choosing a cpo for our semantic domain, we can ensure that the Kleene chain has a limit. However, it is not guaranteed that the limit we find will be a fixed point to our monotonic function .Liam O'Connorhttps://liamoc.net/forest/dt-001K/dt-001K/forest/dt-001K/Monotonicity is insufficientProblemConsider this monotonic function defined over a cpo : Note this function is not continuous at 0. Starting from our element , we can see that the limit of the ascending Kleene chain is : But ! — the lub of the Kleene chain is not a fixed point! To address this problem, we shall strengthen our requirement on functions from mere monotonicity to continuity.Liam O'Connorhttps://liamoc.net/forest/dt-001J/dt-001J/forest/dt-001J/ContinuityDefinitionA function on cpos and is continuous iff for all directed , exists, and , i.e., preserves lubs. The intuition behind continuity is that "nothing is suddenly invented at infinity": our function will behave analogously at the limit as it does for each element in our chain. Liam O'Connorhttps://liamoc.net/forest/dt-001L/dt-001L/forest/dt-001L/Continuity implies monotonicityTheoremAll continuous functions are monotonic. Liam O'ConnorProofConsider two elements of a cpo where . Then is directed with a lub of . By the second condition in Definition , we get which is equivalent to .Liam O'Connorhttps://liamoc.net/forest/dt-001M/dt-001M/forest/dt-001M/Monotonic but not continuousExampleConsider this function from , defined by: This function is monotonic, but, taking (which is a directed subset of the cpo ), then , but . Thus, this function is not continuous. Liam O'Connorhttps://liamoc.net/forest/dt-001N/dt-001N/forest/dt-001N/ExerciseShow that if a function on cpos is monotonic, then exists for any directed (i.e.the first condition for continuity in Definition ).Hint: It suffices to show that is directed. Liam O'ConnorSolutionBecause is a cpo, it suffices to show that is directed. Let . Let be the values that maps to and respectively, i.e. and . Because is directed, an upper bound of and exists in . Call this upper bound . Because and , we know that and by monotonicity of . Also, because . Therefore, because two arbitrary elements in have an upper bound within the set, the set is directed. Liam O'Connorhttps://liamoc.net/forest/dt-001O/dt-001O/forest/dt-001O/Alternative characterisation of continuityTheoremA function on cpos and is continuous iff: is monotonic, and , for all directed Liam O'ConnorProofThe second condition here is identical to that of Definition . The monotonicity requirement is equivalent to the first condition of Definition , with one direction shown by Theorem , and the other shown by the solution of Exercise . ThesisComputable functions are continuous functions on cpos.Liam O'Connorhttps://liamoc.net/forest/dt-001W/dt-001W/forest/dt-001W/ExerciseShow that if a function on cpos and is monotonic and is finite, then is continuous. Hint: Finite directed sets contain their lub Liam O'ConnorSolutionBecause of Theorem , it suffices to show the second condition of continuity, as is monotonic. Because is finite, any directed subset is also finite, and therefore . Because is monotone, for all . The solution to Exercise shows that is directed and therefore contains its upper bound . Because is monotone, must be (else it would contradict the above).Therefore , as required. https://liamoc.net/forest/dt-001P/dt-001P/forest/dt-001P/The Kleene fixed point theoremTheoremLet be a cpo and be a continuous function. Then the lub of the Kleene chain is the least fixed point of . ProofWe apply continuity to show that it is a fixed point: To see that it is the least fixed point: Let be a fixed point of . We know that by definition of . Taking of both sides, we get . We can continue this inductively and thus we know that, for all , . Because is, therefore, an upper bound of the ascending Kleene chain, it must also be at least as large as the lub of that chain. Liam O'Connorhttps://liamoc.net/forest/dt-001Q/dt-001Q/forest/dt-001Q/The operatorDefinitionLet denote the least fixed point of the continuous function , that is , guaranteed to exist by Theorem .Liam O'Connorhttps://liamoc.net/forest/dt-001S/dt-001S/forest/dt-001S/ExerciseWhat is where is the identity function on ? Liam O'ConnorSolution What is where is the constant function that always returns ? Liam O'ConnorSolution What is where (where denotes Haskell-style lazy lists of )? Liam O'ConnorSolution Here would be the semantics of the recursive definition .Liam O'Connorhttps://liamoc.net/forest/dt-001R/dt-001R/forest/dt-001R/Semantics with fixed pointsLiam O'Connorhttps://liamoc.net/forest/dt-001V/dt-001V/forest/dt-001V/Semantics of loopsArmed with the operator, we can return to our semantics of loops from § and § , and at last define their semantics without relying on dubious recursive definitions: Proof that is continuous is technically required but is omitted here.Liam O'Connorhttps://liamoc.net/forest/dt-001U/dt-001U/forest/dt-001U/Semantics of recursive functionsExampleConsider the function , given by: Looking at the first few elements of our Kleene chain, we get: Continuing on, we see that the th approximation to is the function that gives for all up to , and diverges () for all other arguments. Hence the limit is the factorial function on ! Liam O'Connorhttps://liamoc.net/forest/dt-001T/dt-001T/forest/dt-001T/ExerciseWrite down the first few approximations to , where the higher order function is given by: What is ? What is ? Liam O'ConnorSolutionThe approximations are . The limit is a function that, given a natural number , produces the infinite list of natural numbers starting from . Repeat the same process, but this time for a new higher order function given by: Liam O'ConnorSolutionThe th approximation returns if the input number is non-negative, even and less than , otherwise it diverges (returns ). The limit returns for any non-negative even number, and diverges otherwise. Liam O'Connorhttps://liamoc.net/forest/dt-001Z/dt-001Z/forest/dt-001Z/Constructions on cpos and PCFLectureThis lecture is based on material from Graham Hutton, John Longley, Dana Scott, Joseph Stoy, Carl Gunter, and Glynn Winskel.Liam O'Connorhttps://liamoc.net/forest/dt-002K/dt-002K/forest/dt-002K/ProductsRecall Construction , which showed that the product of two pointed posets is itself a pointed poset. In Exercise you may also have shown that is also a cpo if and are cpos, with this definition for lubs: This definition can be made a little more comprehensible by defining it in terms of the two projection operators for pairs: Liam O'Connorhttps://liamoc.net/forest/dt-0020/dt-0020/forest/dt-0020/Projection operators for productsDefinitionDestruction of pairs is captured by the two projection operators, defined as follows: Liam O'Connorhttps://liamoc.net/forest/dt-0021/dt-0021/forest/dt-0021/Product of cposConstructionGiven cpos and , the product is itself a cpo, ordered by with bottom value being . Least upper bounds are found by taking the lubs of each component:Liam O'Connorhttps://liamoc.net/forest/dt-0022/dt-0022/forest/dt-0022/Continuity of projection operationsTheoremThe projection functions and are continuous.Liam O'Connorhttps://liamoc.net/forest/dt-0023/dt-0023/forest/dt-0023/The split functionDefinition Construction of pairs is captured by the split function: If and , then split, written , is defined as: Liam O'Connorhttps://liamoc.net/forest/dt-0024/dt-0024/forest/dt-0024/Continuity of splitTheoremFor continuous functions and , the split function is continuous. Liam O'ConnorProofUsing the alternative characterisation of continuity: is monotonic. Let . Then: preserves lubs of directed sets. Let be directed. Then: These building blocks can be used to make many functions on products (thereby ensuring continuity): Liam O'Connorhttps://liamoc.net/forest/dt-0025/dt-0025/forest/dt-0025/The functionDefinition Liam O'Connorhttps://liamoc.net/forest/dt-0026/dt-0026/forest/dt-0026/Product of functionsDefinitionGiven and , we overload the operator for products to denote the combined function , given below: Liam O'Connorhttps://liamoc.net/forest/dt-002G/dt-002G/forest/dt-002G/ExerciseExpress the function using just our primitive combinators for projection and split. Liam O'ConnorSolution Liam O'Connorhttps://liamoc.net/forest/dt-0027/dt-0027/forest/dt-0027/Pictorial PropertiesThe following properties of our projection and split functions follow from the pictorial reasoning we see on the right: Liam O'Connorhttps://liamoc.net/forest/dt-0028/dt-0028/forest/dt-0028/ExerciseProve that the three properties in § are equivalent to the universal property for products Liam O'ConnorSolution Showing in both directions: The three properties follow from the universal property: The first two properties follow from the universal property where is set to . The third property follows from the universal property where is set to and is set to . The universal property follows from the universal property: In the direction of the universal property follows from the third property, and the direction follows from the first two. Liam O'Connorhttps://liamoc.net/forest/dt-0029/dt-0029/forest/dt-0029/Universal property for cpo productsDefinitionAs commuting diagram on the category :Liam O'Connorhttps://liamoc.net/forest/dt-002A/dt-002A/forest/dt-002A/Category theoryAsideLiam O'Connorhttps://liamoc.net/forest/dm-000G/dm-000G/forest/dm-000G/CategoryDefinitionA category consists of a collection of things (objects) and a collection of arrows between these things (morphisms). If there is a morphism and a morphism , we also have the composed morphism . This composition operator must be associative. Additionally each object has an identity morphism , such that for an arrow , . Liam O'Connorhttps://liamoc.net/forest/dm-000H/dm-000H/forest/dm-000H/The category Example The category is the category where the objects are (small) sets, the morphisms are functions between these sets, composition is function composition () and identity is just the identity function . Liam O'Connorhttps://liamoc.net/forest/dm-000I/dm-000I/forest/dm-000I/The category Example The category is the category where the objects are (small) sets, the morphisms are relations between these sets, composition is relational composition: and identity is the diagonal relation (equality). Liam O'Connorhttps://liamoc.net/forest/dt-002B/dt-002B/forest/dt-002B/The category Example The category is the category where the objects are cpos, the morphisms are continuous functions between these cpos, composition is function composition () and identity is just the identity function . Liam O'Connorhttps://liamoc.net/forest/dm-000J/dm-000J/forest/dm-000J/FunctorDefinition A functor from a category to a category consists of an object mapping that maps objects of to objects of , and a morphism mapping that maps morphisms of to morphisms of such that: For each in , we have a morphism in . For each object in , the equation holds in . For a pair of morphism in , the equation holds in . Liam O'Connorhttps://liamoc.net/forest/dm-000K/dm-000K/forest/dm-000K/The category Example The category is the category where the objects are themselves (small) categories, the morphisms are structure-preserving maps between these categories, i.e., functors. Liam O'Connorhttps://liamoc.net/forest/dm-000L/dm-000L/forest/dm-000L/Commutative diagramsWhen working in a category, we can state many theorems compactly using commutative diagrams, such as this diagram for products: In these diagrams, the objects are vertices in the diagram, and the morphisms are the arrows in the diagram (we typically omit identity morphisms and morphisms that are just compositions of other morphisms). Looking at the above diagram, we can equate the two paths from to and the two paths from to , and produce the equations and . We adopt the convention that dotted lines indicate uniqueness, meaning that, from the diagram above, we can also infer the law: Liam O'Connorhttps://liamoc.net/forest/dt-002C/dt-002C/forest/dt-002C/Derived properties of cpo productsCorollary The universal property is called such because all the familiar properties of products follow from it – thinking in pictures helps to see how (Indeed, the universal property characterises products up to isomorphism): These last two statements and show that is a bifunctor on the category , i.e., a functor . Liam O'Connorhttps://liamoc.net/forest/dt-002I/dt-002I/forest/dt-002I/ExerciseShow using the universal property that Liam O'ConnorSolution Instantiating the universal property where , , and : Simplifying using the pictorial properties in § (shown equivalent to the universal property in Exercise ): By logical simplifications, we arrive at as required. Liam O'Connorhttps://liamoc.net/forest/dt-002D/dt-002D/forest/dt-002D/Isomorphisms for cpo productsLiam O'Connorhttps://liamoc.net/forest/dt-002E/dt-002E/forest/dt-002E/Cpo isomorphismDefinitionAn isomorphism between two cpos and is a bijection between and such that preserves the cpo structure, i.e., that and are continuous. We say two cpos and are isomorphic, written , iff an isomorphism exists between them.Liam O'Connorhttps://liamoc.net/forest/dt-002H/dt-002H/forest/dt-002H/Commutative monoid structure for cposTheoremCpos form a commutative monoid "up to isomorphism" under and (the cpo consisting of only one element ). That is, for all cpos and : Liam O'ConnorProof The isomorphisms required are the projection , the function from Exercise , and the swap function. Liam O'Connorhttps://liamoc.net/forest/dt-002F/dt-002F/forest/dt-002F/The set of continuous functionsDefinition Let denote just the continuous functions from cpo to cpo : Liam O'Connorhttps://liamoc.net/forest/dt-002J/dt-002J/forest/dt-002J/TheoremThere is an isomorphism between pairs of continuous functions and continuous functions that output pairs: Liam O'ConnorProof Proof follows from the universal property after setting up the isomorphism with functions and . Liam O'ConnorUpshot Because we have the functor on that satisfies the properties of products described above, the category therefore has binary products. Liam O'Connorhttps://liamoc.net/forest/dt-002Z/dt-002Z/forest/dt-002Z/FunctionsPreviously, such as in Example , we already implicitly assumed that the set of continuous functions on cpos is itself a cpo. In this section, we will formalise this construction.Liam O'Connorhttps://liamoc.net/forest/dt-002L/dt-002L/forest/dt-002L/The cpo of functionsConstructionIf and are cpos, the set of continuous functions is a cpo under the pointwise ordering: The intuition of this ordering in terms of information is that we increase the information content of a function overall by increasing the information content of any (or many) argument values. To prove this, we must show: has a least element. is the constant function that returns , i.e. . exists for all directed . Our lub of a set of continuous functions is the function where: We must show a number of properties of this lub . Specifically: exists in . Liam O'ConnorProofWe want to show that the set is directed. Take two values . Since is directed, there exists a function such that and . By applying the definition of for functions above, we have and . Thus is an upper bound of these two values , and thus is directed, and thus its lub exists since is a cpo. is continuous. Liam O'ConnorProofUsing the alternative characterisation of continuity Monotonicity is similar to prove. is an upper bound for . Liam O'ConnorProof Let . Then for any we have . Now, by 2a and lubs, we have , which by the definition of gives . Hence, by the definition of on functions, we can conclude . is the least upper bound for . Liam O'ConnorProof Let be an upper bound for . Then (using on functions) is an upper bound for for all . Now, by 2a and lubs, we have , i.e. , which, by the definition of on functions, allows us to conclude .Liam O'Connorhttps://liamoc.net/forest/dt-002M/dt-002M/forest/dt-002M/The space Example] (b) edge[bend right] (tl) (tl) edge[loop above] (tl) (tr) edge[bend right=1.3em] (tl); \end {tikzpicture} } && && && {\begin {tikzpicture} \draw [rounded corners, thick, fill=white] (-0.8,-0.7) rectangle (0.8,1.39); \node (tr) at (0.5,0.5) {$\bullet $}; \node (tl) at (-0.5,0.5) {$\bullet $}; \node (b) at (0,-0.5) {$\bullet $}; \draw [thick] (b) -- (tr) (b) -- (tl); \draw [thick,draw=blue,->] (b) edge[bend right] (tr) (tl) edge[bend left=1.3em] (tr) (tr) edge[loop above] (tr); \end {tikzpicture} } \\ {\begin {tikzpicture} \draw [rounded corners, thick, fill=white] (-0.8,-1.2) rectangle (0.8,0.9); \node (tr) at (0.5,0.5) {$\bullet $}; \node (tl) at (-0.5,0.5) {$\bullet $}; \node (b) at (0,-0.5) {$\bullet $}; \draw [thick] (b) -- (tr) (b) -- (tl); \draw [thick,draw=blue,->] (b) edge[loop below] (b) (tl) edge[loop below] (tl) (tr) edge[bend right=1.3em] (tl); \end {tikzpicture} }\ar [u,ultra thick,-] && {\begin {tikzpicture} \draw [rounded corners, thick, fill=white] (-0.8,-1.2) rectangle (0.8,0.9); \node (tr) at (0.5,0.5) {$\bullet $}; \node (tl) at (-0.5,0.5) {$\bullet $}; \node (b) at (0,-0.5) {$\bullet $}; \draw [thick] (b) -- (tr) (b) -- (tl); \draw [thick,draw=blue] (b) edge[loop below,->] (b) (tl) edge[loop below,->] (tl) (tr) edge[loop below] (tr); \end {tikzpicture} } && {\begin {tikzpicture} \draw [rounded corners, thick, fill=white] (-0.8,-1.2) rectangle (0.8,0.9); \node (tr) at (0.5,0.5) {$\bullet $}; \node (tl) at (-0.5,0.5) {$\bullet $}; \node (b) at (0,-0.5) {$\bullet $}; \draw [thick] (b) -- (tr) (b) -- (tl); \draw [thick,draw=blue,->] (b) edge[loop below] (b) (tr) edge[bend left=1.3em] (tl) (tl) edge[bend left=1.3em] (tr); \end {tikzpicture} } && {\begin {tikzpicture} \draw [rounded corners, thick, fill=white] (-0.8,-1.2) rectangle (0.8,0.9); \node (tr) at (0.5,0.5) {$\bullet $}; \node (tl) at (-0.5,0.5) {$\bullet $}; \node (b) at (0,-0.5) {$\bullet $}; \draw [thick] (b) -- (tr) (b) -- (tl); \draw [thick,draw=blue,->] (b) edge[loop below] (b) (tl) edge[bend left=1.3em] (tr) (tr) edge[loop below] (tr); \end {tikzpicture} }\ar [u,ultra thick,-] \\ {\begin {tikzpicture} \draw [rounded corners, thick, fill=white] (-0.8,-1.2) rectangle (0.8,0.9); \node (tr) at (0.5,0.5) {$\bullet $}; \node (tl) at (-0.5,0.5) {$\bullet $}; \node (b) at (0,-0.5) {$\bullet $}; \draw [thick] (b) -- (tr) (b) -- (tl); \draw [thick,draw=blue,->] (b) edge[loop below] (b) (tl) edge[loop right] (tl) (tr) edge[bend left] (b); \end {tikzpicture} }\ar [u,ultra thick,-]\ar [urr,ultra thick,-] && {\begin {tikzpicture} \draw [rounded corners, thick, fill=white] (-0.8,-1.2) rectangle (0.8,0.9); \node (tr) at (0.5,0.5) {$\bullet $}; \node (tl) at (-0.5,0.5) {$\bullet $}; \node (b) at (0,-0.5) {$\bullet $}; \draw [thick] (b) -- (tr) (b) -- (tl); \draw [thick,draw=blue,->] (b) edge[loop below] (b) (tl) edge[bend right] (b) (tr) edge[bend right=1.3em] (tl); \end {tikzpicture} }\ar [ull,ultra thick,-]\ar [urr,ultra thick,-] && {\begin {tikzpicture} \draw [rounded corners, thick, fill=white] (-0.8,-1.2) rectangle (0.8,0.9); \node (tr) at (0.5,0.5) {$\bullet $}; \node (tl) at (-0.5,0.5) {$\bullet $}; \node (b) at (0,-0.5) {$\bullet $}; \draw [thick] (b) -- (tr) (b) -- (tl); \draw [thick,draw=blue,->] (b) edge[loop below] (b) (tr) edge[bend left] (b) (tl) edge[bend left=1.3em] (tr); \end {tikzpicture} }\ar [u,ultra thick,-]\ar [urr,ultra thick,-] && {\begin {tikzpicture} \draw [rounded corners, thick, fill=white] (-0.8,-1.2) rectangle (0.8,0.9); \node (tr) at (0.5,0.5) {$\bullet $}; \node (tl) at (-0.5,0.5) {$\bullet $}; \node (b) at (0,-0.5) {$\bullet $}; \draw [thick] (b) -- (tr) (b) -- (tl); \draw [thick,draw=blue,->] (b) edge[loop below] (b) (tl) edge[bend right] (b) (tr) edge[loop left] (tr); \end {tikzpicture} }\ar [u,ultra thick,-]\ar [ullll,ultra thick,-] \\ &\qquad &&{\begin {tikzpicture} \draw [rounded corners, thick, fill=white] (-0.8,-1.2) rectangle (0.8,0.9); \node (tr) at (0.5,0.5) {$\bullet $}; \node (tl) at (-0.5,0.5) {$\bullet $}; \node (b) at (0,-0.5) {$\bullet $}; \draw [thick] (b) -- (tr) (b) -- (tl); \draw [thick,draw=blue,->] (b) edge[loop below] (b) (tl) edge[bend right] (b) (tr) edge[bend left] (b); \end {tikzpicture} }\ar [ul, ultra thick,-] \ar [ur, ultra thick,-] \ar [ulll, ultra thick,-] \ar [urrr, ultra thick,-] &&\qquad \end {tikzcd} ]]> At each step "upwards" on this cpo, one arrow that ends in now points to a non- value (moving up the cpo ).Liam O'Connorhttps://liamoc.net/forest/dt-002P/dt-002P/forest/dt-002P/Primitive functions for functionsLiam O'Connorhttps://liamoc.net/forest/dt-002N/dt-002N/forest/dt-002N/The functionDefinitionThe function simply applies a given function to a given argument: Liam O'Connorhttps://liamoc.net/forest/dt-002Q/dt-002Q/forest/dt-002Q/ExerciseShow that is continuous.Hint: A function is continuous iff it is continuous in each argument separately, i.e., iff is continuous, and is continuous. Liam O'ConnorSolution First showing is continuous for some continuous , using the alternative characterisation is monotonic: Given where , we can see that by the monotonicity of . preserves lubs: Given a directed , we can see that follows from the continuity of . Next, showing is continuous for some fixed : is monotonic: Given where , we can see that by the pointwise ordering of functions. preserves lubs: Given a directed , we can see that follows from the lub definition for functions. Liam O'Connorhttps://liamoc.net/forest/dt-002O/dt-002O/forest/dt-002O/The functionDefinitionThe function transforms a function that takes two arguments all at once (as a product) into a function that takes the arguments one at a time. That is, if then: Liam O'Connorhttps://liamoc.net/forest/dt-002S/dt-002S/forest/dt-002S/Continuity of Theorem is continuous on . , given continuous , is continuous on . , given continuous and , is continuous on .Liam O'Connorhttps://liamoc.net/forest/dt-002R/dt-002R/forest/dt-002R/Exercise What is the common (functional programming) name for ? Liam O'ConnorSolutionLiam O'Connorhttps://liamoc.net/forest/dt-002T/dt-002T/forest/dt-002T/Universal property for functionsDefinitionLiam O'Connorhttps://liamoc.net/forest/dt-002U/dt-002U/forest/dt-002U/The currying isomorphismTheorem Liam O'ConnorProof Follows from the universal property for functions when set up with the isomorphism from curry and its inverse, the function in Exercise . Liam O'Connorhttps://liamoc.net/forest/dt-002V/dt-002V/forest/dt-002V/Why the function arrow is not a covariant bifunctorRemark For the operator on cpos (Definition ) to be the object mapping for a bifunctor like is (see Corollary ), we would need to define a morphism mapping that, given two functions and , gives a function . But such a function is not implementable: In the above hole , and . Given the value , none of our functions or take elements of , so there would be no way to produce the value required. This is because our function goes the wrong way. If were a function , things would be a lot easier. Liam O'Connorhttps://liamoc.net/forest/dm-000Q/dm-000Q/forest/dm-000Q/Dual categoryDefinitionThe dual of a category , written , is a category with the same objects as but the arrows are reversed, that is, for each morphism in , there is a morphism in .Liam O'Connorhttps://liamoc.net/forest/dt-002W/dt-002W/forest/dt-002W/The function arrow is a bifunctorThe operator introduced in Definition is is the object mapping for a binary functor: The category is the dual category to . Thus, a morphism in the category is a continuous function . Thus, the morphism mapping for our functor must take two functions (the morphism from ) and (the morphism from ), and produce . As with products, we will overload the notation for this mapping as well. Liam O'Connorhttps://liamoc.net/forest/dt-002X/dt-002X/forest/dt-002X/Morphism mapping for Definition Given and , we have: Liam O'Connorhttps://liamoc.net/forest/dt-002Y/dt-002Y/forest/dt-002Y/Theorem The two functor laws follow as a consequence of the universal property for functions: Liam O'ConnorUpshotOur category has exponentials.Liam O'Connorhttps://liamoc.net/forest/dt-0030/dt-0030/forest/dt-0030/SumsLiam O'Connorhttps://liamoc.net/forest/dt-0031/dt-0031/forest/dt-0031/Sum of cposConstruction The sum construct on cpo denotes a disjoint union of two cpos with a new, dedicated value: This construct is a cpo under the ordering: Intuitively, this says that the ordering on is the same as and separately, except that is less than anything. The only directed sets are those that do not contain a mixture of elements from both and from , so the least upper bound operator is essentially the same as the least upper bounds for and for . Formally: Liam O'Connorhttps://liamoc.net/forest/dt-003D/dt-003D/forest/dt-003D/Primitive functions for sumsLiam O'Connorhttps://liamoc.net/forest/dt-0032/dt-0032/forest/dt-0032/Constructors for sumsDefinitionFor constructing sums, we use two primitive constructor functions, and : Liam O'Connorhttps://liamoc.net/forest/dt-0033/dt-0033/forest/dt-0033/Continuity of sum constructorsTheoremThe constructor functions and are continuous.Liam O'Connorhttps://liamoc.net/forest/dt-0034/dt-0034/forest/dt-0034/The case functionDefinitionElimination of sums is captured by the case function , made from functions and . This function is defined by: Liam O'Connorhttps://liamoc.net/forest/dt-0035/dt-0035/forest/dt-0035/Exercise Prove that the case function is, given continuous functions and , continuous on its argument . Liam O'ConnorSolution As mentioned in Construction , the only directed subsets of are those that contain entirely values of the format and optionally , or those that contain entirely values of the format and optionally . Call this directed subset . When : This means that as is always the least element. From Definition , we have: This discharges both requirements in Definition for this case. When : This means that consists of at least one value plus possibly , that is for some nonempty . We have the following, using the continuity of : When : Similar to the case but using rather than . Liam O'Connorhttps://liamoc.net/forest/dt-0039/dt-0039/forest/dt-0039/Locality of sumsWe can see by the definitions of case and our constructors that and , or, in a commutative diagram:Note that this diagram is like the dual of the diagram seen in the universal property for products — the arrows are reversed. That is because, generally speaking, sums are dual to products. However, because of our additional value, our cpo sums are only weakly universal — the arrow is not unique. Liam O'Connorhttps://liamoc.net/forest/dt-003A/dt-003A/forest/dt-003A/Weak universality of cpo sumsExample Consider this scenario with the cpos and : In this case, setting the function makes the diagram commute, but due to the different handling of . Liam O'Connorhttps://liamoc.net/forest/dt-003B/dt-003B/forest/dt-003B/Weak universal property for cpo sumsDefinitionThis property is called weak because it uses only the information ordering rather than equality on the right hand side.Liam O'Connorhttps://liamoc.net/forest/dt-003C/dt-003C/forest/dt-003C/Failure of sum isomorphismsWarning The weakness of the universal property for sums means that many common isomorphisms for sums in other contexts do not hold: Liam O'Connorhttps://liamoc.net/forest/dt-0036/dt-0036/forest/dt-0036/Sums form a bifunctorWith these, we can define the morphism mapping for the sum bifunctor . Just as with products and functions, we will overload the notation for morphisms as well as objects in the category .Liam O'Connorhttps://liamoc.net/forest/dt-0037/dt-0037/forest/dt-0037/Sum of functionsDefinition Given functions and , we have: Liam O'Connorhttps://liamoc.net/forest/dt-0038/dt-0038/forest/dt-0038/Theorem is a lawful bifunctor, that is: Liam O'ConnorUpshot Our category has only local sums. Liam O'Connorhttps://liamoc.net/forest/dt-003E/dt-003E/forest/dt-003E/Strict ConstructionsWhen giving a semantics to a call-by-name (or "lazy") language, the constructions for functions, for products and for sums are exactly what we want. To properly capture call-by-value (or "strict") languages, however, we also need strict versions of these constructions.Liam O'Connorhttps://liamoc.net/forest/dt-003F/dt-003F/forest/dt-003F/The cpo of strict continuous functionsConstructionThe ordering and lubs are, mutatis mutandis, as with the non-strict Construction .Liam O'Connorhttps://liamoc.net/forest/dt-003G/dt-003G/forest/dt-003G/Smash products of cposConstructionThe ordering and lubs are, mutatis mutandis, as with the non-strict Construction . This operator is called a smash product because the two values from and are "smashed" into one value.Liam O'Connorhttps://liamoc.net/forest/dt-003H/dt-003H/forest/dt-003H/Smash sums of cposConstructionThe ordering and lubs are, mutatis mutandis, as with the non-strict Construction . This operator is called a smash sum because the two values from and are "smashed" into one value.Liam O'Connorhttps://liamoc.net/forest/dt-003J/dt-003J/forest/dt-003J/Isomorphisms with strict constructionsTheorem The strict cpo constructions satisfy all the usual isomorphisms, including: Liam O'Connorhttps://liamoc.net/forest/dt-003I/dt-003I/forest/dt-003I/The category Definition The category is the category where the objects are cpos, the morphisms are strict continuous functions between these cpos, and composition and identity are as in . Liam O'ConnorUpshot The category has products, exponentials, and sums (as it doesn't suffer from the problem that does). Liam O'Connorhttps://liamoc.net/forest/dt-003K/dt-003K/forest/dt-003K/The lifting operator for cposDefinition The lifting operator adds a new value to a cpo. That is, for a cpo : For all (including ), our new bottom value . Liam O'Connorhttps://liamoc.net/forest/dt-003L/dt-003L/forest/dt-003L/Isomorphisms with liftingTheoremWith the lifting operator, we can relate the lazy constructions like product and sum with strict constructions like smash product and sum via isomorphism: Liam O'Connorhttps://liamoc.net/forest/dt-003T/dt-003T/forest/dt-003T/PCFFor most purposes in semantics, describing semantics in terms of (continuous functions on) cpos is enough. To demonstrate, we will give semantics to PCF: a Turing-complete, higher order functional programming language. We will then extend PCF to include more features, namely pairs (product types) and sum types.Liam O'Connorhttps://liamoc.net/forest/dt-003M/dt-003M/forest/dt-003M/The language PCFDefinition The language for Programming Computable Functions (PCF) is a variant of typed -calculus with minimal extensions to be Turing-complete. Liam O'Connorhttps://liamoc.net/forest/dt-003N/dt-003N/forest/dt-003N/Typing rules for PCFDefinitionLiam O'Connorhttps://liamoc.net/forest/dt-003O/dt-003O/forest/dt-003O/Type-dependent denotations Because PCF is typed, we shall assign denotations only to well-typed expressions. The range of our denotation function for expressions is determined by the type of its input expression. That is, the denotation of a type is the cpo whose elements will be the denotations of expressions of type . The denotation of the type , then, is merely the flat domain of the natural numbers : And, the denotation of the function type is the domain of continuous functions on cpos: A closed term with no free variables denotes an element of , so we might be tempted to define our denotation function for expressions like so: However, if involves free variables from our context , the valuation of will depend on the values assigned to all the variables. Thus, the denotation of a typed expression is defined instead as a continuous function: where the meaning of a context will be a a big -tuple of the values assigned to each variable: Liam O'Connorhttps://liamoc.net/forest/dt-003Q/dt-003Q/forest/dt-003Q/Notation for -tuplesDefinitionGiven an -tuple, i.e. elements of the -ary product , we typically denote the entire -tuple as in vector notation: And individual elements of the tuple are accessed with numeric subscripts: Liam O'Connorhttps://liamoc.net/forest/dt-003P/dt-003P/forest/dt-003P/Semantics of PCFDefinition Liam O'ConnorTypes Liam O'ConnorExpressions For , we have defined as follows: 0 \\ \llbracket e_3 \rrbracket _\Gamma (\vec {z}) & \text {if}\ \llbracket e_1 \rrbracket _\Gamma (\vec {z}) = 0 \\ \bot & \text {if}\ \llbracket e_1 \rrbracket _\Gamma (\vec {z}) = \bot \end {cases}\\ \llbracket \mathsf {fix}\ x : \tau .\ e \rrbracket _\Gamma (\vec {z}) &= & \mathbf {fix}(\boldsymbol {\lambda } v \in \llbracket \tau \rrbracket .\ \llbracket e\rrbracket _{\Gamma , x : \tau }(\vec {z}, v)) \end {array} ]]> In the above definitions a boldface lambda is used for an anonymous continuous function — boldface to distinguish it from the lambda in the syntax of PCF. Verifying that these functions are indeed continuous is straightforward, but is necessary to justify the use of the operator. Liam O'Connorhttps://liamoc.net/forest/dt-003R/dt-003R/forest/dt-003R/Extending PCF with product typesWe shall extend the syntax of PCF with a new type former, and three expression-level constructs for constructing and deconstructing pairs: Adding to our typing rules similarly: To extend our semantics, we make the product type denote the product cpo , and our expression semantics are expressed straightforwardly using our projection and split operations for products: Liam O'Connorhttps://liamoc.net/forest/dt-003S/dt-003S/forest/dt-003S/Extending PCF with sum typesWe shall extend the syntax of PCF with a new type former, and three expression-level constructs for constructing and deconstructing sums: Adding to our typing rules similarly: To extend our semantics, we make the sum type denote the sum cpo , and our expression semantics are expressed using our primitive functions for sums. Liam O'Connorhttps://liamoc.net/forest/dt-004Z/dt-004Z/forest/dt-004Z/Recursively defined domains and -calculusLectureThis lecture is based on material from Graham Hutton, John Longley, Dana Scott, Joseph Stoy, Carl Gunter, and Glynn Winskel.Liam O'Connorhttps://liamoc.net/forest/dt-004J/dt-004J/forest/dt-004J/Why we need recursively defined domains We saw recursive domain equations with higher-order procedures in § , but there are numerous other examples where they come up. Liam O'Connorhttps://liamoc.net/forest/dt-004L/dt-004L/forest/dt-004L/Recursive algebraic data typesSuppose we have a language with recursive data types, such as this type in Haskell-style syntax: As in PCF, the denotation of a type is the domain which contains all the denotations of all closed expressions of type . What, then, is the domain that corresponds to ? We need a cpo that satisfies the below equation (where is the cpo containing just one element ): Liam O'Connorhttps://liamoc.net/forest/dt-004M/dt-004M/forest/dt-004M/Untyped higher-order languages If we take PCF, discard the type system, , natural number primitives and any other superfluous features, and just boil our language down to a minimal, Turing-complete subset, we end up with the untyped -calculus — a language consisting only of untyped functions.Liam O'Connorhttps://liamoc.net/forest/dt-004K/dt-004K/forest/dt-004K/Untyped -calculusDefinition Untyped -calculus consists only of untyped (higher-order) functions: Trying to give a semantics to the untyped calculus poses an issue: we can no longer rely on the type of an expression to select an appropriate semantic domain. Instead, we we must pick a single domain which, since functions can be applied to themselves, must apparently include the set of functions : How can we find solutions to such recursive equations? How can we guarantee the existence of a (least) solution? We can start by generalising the fixed point approach we used for values (i.e. elements of cpos) to domains (i.e. cpos themselves).Liam O'Connorhttps://liamoc.net/forest/dt-004N/dt-004N/forest/dt-004N/Recursive domain equations as endofunctorsExampleThis recursive equation for lists: Can be expressed as the least fixed point of this mapping (specifically an endofunctor) on cpos: To ensure that least fixed points exist, and to give us a means of finding them, we must now generalise all of the concepts we used for least fixed points on values (information ordering, least upper bounds, continuity etc.) to domains themselves. Liam O'Connorhttps://liamoc.net/forest/dt-004O/dt-004O/forest/dt-004O/From a cpo to the category Liam O'ConnorProblem The following definitions are insufficient when using function constructions in our domain equations ( and ), but it will suffice for our purposes for now. Let us say (for now) that a cpo approximates a cpo (i.e. ) iff there is a continuous function . Then, there is a least element for this ordering: the one-element cpo , as the continuous function exists for any cpo . Liam O'ConnorInitialityCategorical AsideThe category has no initial object. The cpo is terminal; but also serves as a "pseudo" initial object due to the above. Liam O'Connorhttps://liamoc.net/forest/dt-004P/dt-004P/forest/dt-004P/Colimits in the category Liam O'Connorhttps://liamoc.net/forest/dt-004Q/dt-004Q/forest/dt-004Q/-chains of cpos in the category DefinitionAn -chain of cpos in the category consists of a family of cpos , together with a family of continuous functions , shown below:https://liamoc.net/forest/dt-004R/dt-004R/forest/dt-004R/Upper bounds in the category DefinitionA cpo is an upper bound of an -chain of cpos in the category if there is a family of continuous functions such that the following diagram commutes (i.e. for all ):Liam O'Connorhttps://liamoc.net/forest/dt-004S/dt-004S/forest/dt-004S/Least upper bounds in the category DefinitionA cpo is the least upper bound of an -chain of cpos if is both an upper bound and if there exists a unique for any other upper bound such that the following diagram commutes (i.e. for all ):The least upper bound of such an -chain is also called its colimit.Note: Uniqueness of lubs is up to isomorphism. That is, if and are both colimits of our -chain, then .Liam O'Connorhttps://liamoc.net/forest/dt-004T/dt-004T/forest/dt-004T/Endofunctors on DefinitionAn endofunctor on the category is a functor , i.e. a mapping on cpos together with a mapping on continuous functions, such that:If then Liam O'Connorhttps://liamoc.net/forest/dt-004U/dt-004U/forest/dt-004U/Remark Observe that, given the information ordering for cpos where if there exists a continuous function , the functor laws necessarily imply monotonicity for all endofunctors . https://liamoc.net/forest/dt-004V/dt-004V/forest/dt-004V/Cocontinuous endofunctorsDefinitionAn endofunctor is cocontinuous iff it preserves colimits of -chains of cpos. That is, given a chain where is a colimit: Then is a colimit for the following chain: ] \ar [uurrr,"\mathcal {F}(g_0)"near start] & \mathcal {F}(A_1) \ar [r,thick,"\mathcal {F}(f_1)"',->]\ar [uurr,"\mathcal {F}(g_1)"near start] & \mathcal {F}(A_2) \ar [r,thick,"\mathcal {F}(f_2)"',->] \ar [uur,"\mathcal {F}(g_2)"near start] & \mathcal {F}(A_3) \ar [uu,"\mathcal {F}(g_3)"near start] \ar [r,thick,-,dotted] & \quad \end {tikzcd} ]]>Liam O'Connorhttps://liamoc.net/forest/dt-004W/dt-004W/forest/dt-004W/Fixed points of endofunctors on DefinitionA fixed point of an endofunctor on cpos is a cpo such that . Liam O'ConnorNoteIn Scott's approach, which we follow here, our fixed points are up to isomorphism (suitable for languages with isorecursive types), but there are other approaches where they are equalities (suitable for languages with equirecursive types). Liam O'Connorhttps://liamoc.net/forest/dt-004X/dt-004X/forest/dt-004X/Fixed point theorem for endofunctors on Theorem Every cocontinuous endofunctor on cpos has a least fixed point, given by the colimit of the -chain:Liam O'Connorhttps://liamoc.net/forest/dt-004Y/dt-004Y/forest/dt-004Y/Binary NumbersExample Consider the Haskell-style data type: So, e.g. . The recursive domain equation is, expressed as a fixed point: We wish to show that is a cocontinuous endofunctor.We have a mapping on cpos (objects of the category ), but for it to be a functor we additionally need a mapping on continuous functions (morphisms of the category ). Recalling our sum construction, we may remember that sums are already a bifunctor (Theorem ). Thus, our mapping on continuous functions can be derived from our mapping on cpos by using the morphism mapping from the sum construction (Definition ). Given a continuous function , our morphism mapping is:Proof that this endofunctor is cocontinuous is left for the reader. Hence the semantics of the type , i.e. is the least fixed point of , i.e. the colimit of the -chain:Let us visualise this chain. Here the sum injections have been written as rather than (combinations of) and to keep the connection with the Haskell data type clear. ,ultra thick,dotted] (6,1.5) -- (10.5,1.5); \draw [fill=white!95!black, rounded corners=2em] (6,-1) -- (10,3.5) -- (2,3.5) -- cycle; \draw [fill=white!97!black, rounded corners=2em,dashed] (6,-0.8) -- (8.1,1.5) -- (3.9,1.5) -- cycle; \draw [->,ultra thick] (2,0.5) -- (4.8,0.5); \draw [fill=white!97!black, rounded corners=2em] (2,-0.8) -- (3.8,1.5) -- (0.2,1.5) -- cycle; \node [draw, fill=white, dashed, rounded corners] (b2) at (2,0) {$\bot $}; \draw [->,ultra thick] (b1) -- (b2); \node (a1) at (1.2,1) {$\mathsf {Z}(\bot )$}; \node (a2) at (2,1.04) {$\mathsf {E}$}; \node (a3) at (2.8,1) {$\mathsf {O}(\bot )$}; \draw [-] (b2) -- (a2); \draw [-] (b2) -- (a3); \draw [-] (b2) -- (a1); \node (b2) at (6,0) {$\bot $}; \node (a1) at (5,1) {$\mathsf {Z}(\bot )$}; \node (a2) at (6,1.04) {$\mathsf {E}$}; \node (a3) at (7,1) {$\mathsf {O}(\bot )$}; \draw [-] (b2) -- (a2); \draw [-] (b2) -- (a3); \draw [-] (b2) -- (a1); \node (c1) at (3.3,3) {\footnotesize $\mathsf {Z}(\mathsf {Z}(\bot ))$}; \node (c2) at (4.3,3) {\footnotesize $\mathsf {Z}(\mathsf {E})$}; \node (c3) at (5.3,3) {\footnotesize $\mathsf {Z}(\mathsf {O}(\bot ))$}; \draw [-] (a1) -- (c2); \draw [-] (a1) -- (c3); \draw [-] (a1) -- (c1); \node (c1) at (6.7,3) {\footnotesize $\mathsf {O}(\mathsf {Z}(\bot ))$}; \node (c2) at (7.7,3) {\footnotesize $\mathsf {O}(\mathsf {E})$}; \node (c3) at (8.7,3) {\footnotesize $\mathsf {O}(\mathsf {O}(\bot ))$}; \draw [-] (a3) -- (c2); \draw [-] (a3) -- (c3); \draw [-] (a3) -- (c1); \end {tikzpicture} ]]>Thus, the th cpo in the chain contains binary numbers with at most defined digits. The colimit of the chain contains all binary numbers (finite, partial, and infinite!). Liam O'Connorhttps://liamoc.net/forest/dt-005M/dt-005M/forest/dt-005M/Exercise Show that and (using our operator for functions) define an endofunctor , i.e. that they satisfy the functor laws. Liam O'ConnorSolution We must show . We must show . Liam O'Connorhttps://liamoc.net/forest/dt-0050/dt-0050/forest/dt-0050/Constructing endofunctorsIf we have a mapping on cpos that is made up of the primitives , , , , and , we can generate a corresponding morphism mapping on continuous functions by using the corresponding morphism mappings of each of these operators. Thus any such mapping can be turned into an endofunctor.Liam O'Connorhttps://liamoc.net/forest/dt-0051/dt-0051/forest/dt-0051/Making endofunctors for algebraic data typesExampleLiam O'Connorhttps://liamoc.net/forest/dt-005N/dt-005N/forest/dt-005N/Exercise The lazy natural numbers, also called conats, are defined as the least solution to the equation . Sketch the first four approximations to the least fixed point. Call the two sum injections and . Liam O'ConnorSolution Repeat this exercise assuming: is strict (i.e. ) Liam O'ConnorSolution is strict (i.e. ) Liam O'ConnorSolution Liam O'Connorhttps://liamoc.net/forest/dt-0052/dt-0052/forest/dt-0052/From to Liam O'Connorhttps://liamoc.net/forest/dt-0053/dt-0053/forest/dt-0053/Contravariance in the function arrowProblemWe cannot get morphism mappings in the category as easily as § when our object mapping makes use of the function operators and , as they are contravariant in their first argument. This means the functor that they extend to is not but , where is the dual category of . The morphisms end up the wrong way around. As an example, consider . Then, recalling the morphism mapping of the functor: We can generate a morphism mapping for : However, this mapping has the wrong type. For , then , which is , not the required . This is because the generated functor is contravariant, not covariant. Liam O'Connorhttps://liamoc.net/forest/dt-005O/dt-005O/forest/dt-005O/Exercise Show that, in contrast to from Problem , the mapping can be extended to continuous functions giving a covariant endofunctor on . Liam O'ConnorSolution Given a continuous function , we must produce a continuous function , defined as follows: Composition of continuous functions preserves continuity. The functor laws can be shown straightforwardly. Liam O'Connorhttps://liamoc.net/forest/dt-0054/dt-0054/forest/dt-0054/Retraction pairDefinitionA retraction pair on cpos to consists of two continuous functions such that: (i.e. ) (i.e. ) In this retraction pair, is called a embedding and is called a projection. Retraction pairs are weakenings of isomorphisms. Intuitively, going , all information is preserved due to requirement 1, but going , we may lose some information (hence the use of in requirement 2). Liam O'Connorhttps://liamoc.net/forest/dt-0055/dt-0055/forest/dt-0055/Examples and counterexamples of retraction pairsExampleHere are two examples of retraction pairs: ] \\ b \ar [r,thick,<->] & y \ar [u,-] \\ a\ar [u,-]\ar [r,thick,<->] & x \ar [u,-] \end {tikzcd} $\quad \qquad \qquad $ \begin {tikzcd} & z \ar [dl, thick,<->] \\ b & y \ar [dl, thick,->] \ar [u,-] \\ a\ar [u,-]\ar [r,thick,<->] & x \ar [u,-] \end {tikzcd}]]> (this demonstrates that there can be many retraction pairs )The following, however, are not retraction pairs : ] \\ b \ar [r,thick,<-] & y \ar [u,-] \\ a\ar [u,-]\ar [r,thick,<->] & x \ar [u,-] \end {tikzcd} ]]> ] \\ b \ar [dr, thick,->] & y \ar [l, thick,->] \ar [u,-] \\ a\ar [u,-]\ar [r,thick,<->] & x \ar [u,-] \end {tikzcd} ]]> ( but ) ( but ) Liam O'Connorhttps://liamoc.net/forest/dt-0056/dt-0056/forest/dt-0056/Composition of retraction pairsDefinitionWe can compose retraction pairs by composing their embedding and projection:https://liamoc.net/forest/dt-0057/dt-0057/forest/dt-0057/Derived products of retraction pairsCorollaryIt follows from the definition of retraction pairs that, for a pair : and are strict, i.e. and . is uniquely determined by and vice-versa, so if another retraction pair exists, then . To see why, remember that and must be continuous and therefore monotonic. is isomorphic to the range of , i.e. .Liam O'Connorhttps://liamoc.net/forest/dt-0058/dt-0058/forest/dt-0058/The category DefinitionThe category is the category where the objects are cpos, the morphisms are retraction pairs, composition is as in Definition and identity is just the retraction pair . Liam O'Connorhttps://liamoc.net/forest/dt-0059/dt-0059/forest/dt-0059/Information ordering in Definition The third point in Corollary suggests a notion of approximation, or information ordering, for cpos. Rather than say, as we did in § , that for cpos and , iff there exists a continuous function , we now say: iff there exists a retraction pair Liam O'Connorhttps://liamoc.net/forest/dt-005A/dt-005A/forest/dt-005A/Generalising to All of our other notions for naturally generalise to a setting with retraction pairs : least elements, -chains, upper bounds, colimits, cocontinuous endofunctors and so on.Liam O'Connorhttps://liamoc.net/forest/dt-005C/dt-005C/forest/dt-005C/-chains of cpos in the category DefinitionAn -chain of cpos in the category consists of a family of cpos , together with a family of retraction pairs , shown below:,yshift=0.2em]\ar [r,"g_0"', <-,yshift=-0.2em] & D_1 \ar [r,"f_1",->,yshift=0.2em]\ar [r,"g_1"', <-,yshift=-0.2em] & D_2 \ar [r,"f_2",->,yshift=0.2em]\ar [r,"g_2"', <-,yshift=-0.2em] & D_3 \ar [r,-,dashed,yshift=0.2em]\ar [r,dashed,-,yshift=-0.2em] & \cdots \end {tikzcd} ]]>Liam O'Connorhttps://liamoc.net/forest/dt-005D/dt-005D/forest/dt-005D/Endofunctors on DefinitionAn endofunctor on the category is a functor , i.e. a mapping on cpos together with a mapping on retraction pairs, such that:If is a retraction pair then is a retraction pair (where is composition of retraction pairs) https://liamoc.net/forest/dt-005G/dt-005G/forest/dt-005G/Upper bounds in the category DefinitionA cpo is an upper bound of an -chain of cpos in the category if there is a family of retraction pairs such that the following diagram commutes (i.e. for all , , where is composition of retraction pairs):,"g_0",xshift=-0.2em] \ar [ddl,<-,"g_1",xshift=-0.35em]\ar [ddl,->,"f_1"',xshift=0.1em] \ar [dd,<-,"f_2"',xshift=-0.1em]\ar [dd,->,"g_2",xshift=0.3em] \\ &&&\cdots \\ A_0 \ar [r,"s_0",->,yshift=0.2em]\ar [r,"t_0"', <-,yshift=-0.2em] & A_1 \ar [r,"s_1",->,yshift=0.2em]\ar [r,"t_1"', <-,yshift=-0.2em] & A_2 \ar [r,-,dotted,yshift=0.2em]\ar [r,dotted,-,yshift=-0.2em]& \cdots \end {tikzcd} ]]>Liam O'Connorhttps://liamoc.net/forest/dt-005F/dt-005F/forest/dt-005F/Colimits in the category DefinitionA cpo is the colimit of an -chain of cpos if is both an upper bound, i.e. there exists retraction pairs , and for any other upper bound , for which there will exist retraction pairs , there exists a unique retraction pair such that for all , where is composition of retraction pairs. Viewed diagramatically, it is the same as Definition where continuous functions are replaced by retraction pairs.https://liamoc.net/forest/dt-005E/dt-005E/forest/dt-005E/Cocontinuous endofunctors on DefinitionAn endofunctor is cocontinuous iff it preserves colimits of -chains of cpos. That is, given a chain where is a colimit: ,xshift=-0.2em] \ar [ddl,<-,xshift=-0.35em]\ar [ddl,->,xshift=0.1em] \ar [dd,<-,xshift=-0.1em]\ar [dd,->,xshift=0.3em] \\ &&&\cdots \\ D_0 \ar [r,"f_0",->,yshift=0.2em]\ar [r,"g_0"', <-,yshift=-0.2em] & D_1 \ar [r,"f_1",->,yshift=0.2em]\ar [r,"g_1"', <-,yshift=-0.2em] & D_2 \ar [r,-,dotted,yshift=0.2em]\ar [r,dotted,-,yshift=-0.2em]& \cdots \end {tikzcd} ]]> Then is a colimit for the following chain: ,xshift=-0.2em] \ar [ddl,<-,xshift=-0.35em]\ar [ddl,->,xshift=0.1em] \ar [dd,<-,xshift=-0.1em]\ar [dd,->,xshift=0.3em] \\ &&&\cdots \\ \mathcal {F}(D_0) \ar [r,"\mathcal {F}(f_0)",->,yshift=0.2em]\ar [r,"\mathcal {F}(g_0)"', <-,yshift=-0.2em] & \mathcal {F}(D_1) \ar [r,"\mathcal {F}(f_1)",->,yshift=0.2em]\ar [r,"\mathcal {F}(g_1)"', <-,yshift=-0.2em] & \mathcal {F}(D_2) \ar [r,-,dotted,yshift=0.2em]\ar [r,dotted,-,yshift=-0.2em]& \cdots \end {tikzcd} ]]>Liam O'Connorhttps://liamoc.net/forest/dt-005I/dt-005I/forest/dt-005I/Extending cpo Mappings to endofunctors on If is a mapping on cpos built up from basic cpos using the constructions , , , , , as well as and , then extends to a (covariant!) cocontinuous functor on . We shall detail the construction for products and functions here, but the other constructions are all similar.Liam O'Connorhttps://liamoc.net/forest/dt-005J/dt-005J/forest/dt-005J/ operation for retraction pairsDefinition Given two retraction pairs and , our retraction pair for their product is just the product of their embedding and projection, i.e. , using our product operation on continuous functions: Liam O'Connorhttps://liamoc.net/forest/dt-005K/dt-005K/forest/dt-005K/ operation for retraction pairsDefinition We are given two retraction pairs and . To define a suitable covariant functor, we define our morphism mapping in terms of our operation on continuous functions: Note that the positions of and are swapped in the above definition. Unlike with the category , this functor is not contravariant but covariant: Note the positions of and are not swapped! https://liamoc.net/forest/dt-005B/dt-005B/forest/dt-005B/Fixed point theorem for endofunctors on TheoremEvery cocontinuous endofunctor on has a least fixed point, given by the colimit of the ascending -chain: ,yshift=0.2em]\ar [r,"g_0"', <-,yshift=-0.2em] & \mathcal {F}(\mathbf {1}) \ar [r,"f_1",->,yshift=0.2em]\ar [r,"g_1"', <-,yshift=-0.2em] & \mathcal {F}(\mathcal {F}(\mathbf {1})) \ar [r,"f_2",->,yshift=0.2em]\ar [r,"g_2"', <-,yshift=-0.2em] & \mathcal {F}(\mathcal {F}(\mathcal {F}(\mathbf {1}))) \ar [r,-,dashed,yshift=0.2em]\ar [r,dashed,-,yshift=-0.2em] & \cdots \end {tikzcd}]]> Where the retraction pairs are defined by: Liam O'Connorhttps://liamoc.net/forest/dt-005H/dt-005H/forest/dt-005H/The colimit ConstructionGiven an -chain:,yshift=0.2em]\ar [r,"g_0"', <-,yshift=-0.2em] & D_1 \ar [r,"f_1",->,yshift=0.2em]\ar [r,"g_1"', <-,yshift=-0.2em] & D_2 \ar [r,"f_2",->,yshift=0.2em]\ar [r,"g_2"', <-,yshift=-0.2em] & D_3 \ar [r,-,dashed,yshift=0.2em]\ar [r,dashed,-,yshift=-0.2em] & \cdots \end {tikzcd} ]]>The colimit (or inverse limit) is the cpo of -tuples: That is, it is countable sequence of elements, one for each domain , where each element is consistent with earlier elements.Ordering: The ordering is the pointwise ordering of products, naturally generalised to -tuples. Under this ordering, is a cpo. In fact if each is a Scott domain, so is . Liam O'ConnorProof We shall prove that is an upper bound of the -chain. Proof that it is the least upper bound is straightforward but tedious, and is omitted. We must construct a family of retraction pairs: such that the following diagram commutes: ,xshift=-0.2em] \ar [ddl,<-,xshift=-0.35em]\ar [ddl,->,xshift=0.1em] \ar [dd,<-,xshift=-0.1em]\ar [dd,->,xshift=0.3em] \\ &&&\cdots \\ D_0 \ar [r,"f_0",->,yshift=0.2em]\ar [r,"g_0"', <-,yshift=-0.2em] & D_1 \ar [r,"f_1",->,yshift=0.2em]\ar [r,"g_1"', <-,yshift=-0.2em] & D_2 \ar [r,-,dotted,yshift=0.2em]\ar [r,dotted,-,yshift=-0.2em]& \cdots \end {tikzcd} ]]> Defining the projection of the retraction pair is straightforward: However, to define the embedding requires us to, for a given value , produce an -tuple of values consistent with in every domain . We do this by defining in terms of helper functions : The helper functions are defined by composing sequences of embeddings (s) or projections (s), depending on whether or . For example, when : Liam O'Connorhttps://liamoc.net/forest/dt-005L/dt-005L/forest/dt-005L/Semantics of untyped -calculus Recall the untyped calculus: Liam O'Connorhttps://liamoc.net/forest/dt-004K/dt-004K/forest/dt-004K/Untyped -calculusDefinition Untyped -calculus consists only of untyped (higher-order) functions: We mentioned before that the semantic domain of this language must be a cpo such that In other words, solutions to this equation are fixed points of . The least such fixed point can expressed, by Theorem , as the colimit of the -chain: ,yshift=0.2em]\ar [r,"g_0"', <-,yshift=-0.2em] & \mathcal {F}(\mathbf {1}) \ar [r,"f_1",->,yshift=0.2em]\ar [r,"g_1"', <-,yshift=-0.2em] & \mathcal {F}(\mathcal {F}(\mathbf {1})) \ar [r,"f_2",->,yshift=0.2em]\ar [r,"g_2"', <-,yshift=-0.2em] & \mathcal {F}(\mathcal {F}(\mathcal {F}(\mathbf {1}))) \ar [r,-,dashed,yshift=0.2em]\ar [r,dashed,-,yshift=-0.2em] & \cdots \end {tikzcd} ]]> But, the least solution to this equation is trivial: , because . A non-trivial solution is obtained by starting the chain at , the cpo containing just , rather than . ,yshift=0.2em]\ar [r,"g_0"', <-,yshift=-0.2em] & \mathcal {F}(\mathbf {2}) \ar [r,"f_1",->,yshift=0.2em]\ar [r,"g_1"', <-,yshift=-0.2em] & \mathcal {F}(\mathcal {F}(\mathbf {2})) \ar [r,"f_2",->,yshift=0.2em]\ar [r,"g_2"', <-,yshift=-0.2em] & \mathcal {F}(\mathcal {F}(\mathcal {F}(\mathbf {2}))) \ar [r,-,dashed,yshift=0.2em]\ar [r,dashed,-,yshift=-0.2em] & \cdots \end {tikzcd} ]]> We will now sketch a proof of the retraction pair between and , by providing two functions, and its inverse . Observe that each element of (for 0]]>) is a function . Therefore, an element of the colimit is an -tuple of such functions. To define , we must essentially "apply" each function in the element (viewed as an -tuple of functions) to the element (viewed as an -tuple of values). More specifically, we say that is an -tuple , as follows: To define , we are given a (continuous) function and must construct the -tuple of approximations at every . We do this by projecting the action of down to . We say that is an -tuple where: Liam O'ConnorDenotations for untyped -calculusDefinition Using the new functions and , it is now straightforward to define a semantics for untyped -calculus, where is an environment : This semantics does not distinguish non-terminating computations from terminating ones. To model call-by-value more faithfully, we could use the equation instead, and for call-by-name we could use . The constructions are very similar. Liam O'Connorhttps://liamoc.net/forest/dt-005V/dt-005V/forest/dt-005V/Monadic semantics, Scott domains and nondeterminismLectureThis lecture is based on material from Carl Gunter, Glynn Winskel, Graham Hutton, Kai Engelhardt, Dexter Kozen, Andrew Myers, John Longley, Dana Scott, and Joseph Stoy.Liam O'Connorhttps://liamoc.net/forest/dt-005Z/dt-005Z/forest/dt-005Z/Generalising our semanticsWe return to the language we saw previously:Liam O'Connorhttps://liamoc.net/forest/dt-005R/dt-005R/forest/dt-005R/The LanguageDefinition Using notation similar to Backus-Naur Form (BNF): If we wish to add other kinds of effects (beyond mutation of state) to our language, this will necessarily affect the semantic domain. Rather than rewrite the entire semantics for each possible setting, we will generalise the semantics to work over any instance of an algebraic structure, called a monad.Liam O'Connorhttps://liamoc.net/forest/dm-000U/dm-000U/forest/dm-000U/MonadDefinition A monad on the category consists of an endofunctor and two operations (natural transformations) for all -objects : and , such that the following diagrams commute: In equational form, these laws are In computer science, is sometimes called unit, pure, or return, and is usually called join. Liam O'Connorhttps://liamoc.net/forest/dt-005P/dt-005P/forest/dt-005P/Flat domains as monadsExampleThe flat domain lifting operation forms a monad, where the endofunctor , the operation collapses the two values, and is simply .Sometimes it is more convenient to work with the Kleisli composition operator, rather than the operations and directly.Liam O'Connorhttps://liamoc.net/forest/dm-000T/dm-000T/forest/dm-000T/Kleisli categoryDefinitionFor a monad over the category , the Kleisli category has the same objects as , but the morphisms are those morphisms of that have the form . Composition is defined as follows, for morphisms and : Identity morphisms for this category are just . Liam O'Connorhttps://liamoc.net/forest/dt-005Q/dt-005Q/forest/dt-005Q/Monadic semantics for DefinitionWe define our semantics generically in terms of a monad , using the Kleisli composition operator for : Liam O'Connorhttps://liamoc.net/forest/dt-005S/dt-005S/forest/dt-005S/Instantiating with the lifting monadExample Instantiating our monadic semantics where the monad is flat domain lifting, we recover our original semantics of . Liam O'Connorhttps://liamoc.net/forest/dt-005T/dt-005T/forest/dt-005T/Instantiating with exceptionsExample Let us instantiate our monadic semantics with the monad , where the added value (from ) is called . The operation collapses the two possible values to and the two possible values to , and the operation is the straightforward injection.Then we may extend our language with lightweight exception constructs: and define their semantics, leaving our existing semantics unchanged: Liam O'ConnorNondeterminismLiam O'Connorhttps://liamoc.net/forest/dt-005U/dt-005U/forest/dt-005U/Introduction to nondeterminismWhen modelling programming languages we sometimes require a way to be imprecise about some aspects of a program — usually, this takes the form of non-determinism. Non-determinism can be hard for beginners to grasp, but it typically has to be employed when modelling real programs. For example, suppose we had a greeting program that differed depending on the physical location of the computer: If we wanted to mathematically model the behaviour of this program, it would be frightfully inconvenient to include the geography of Earth and the computer's physical location in our model. That's where non-determinism comes in. If we abstract away from the geographical details, and instead regard the program as choosing between the two options based on some unspecified criteria, then we can get away with modelling less, at the cost of some detail: Such underspecified conditionals are usually called non-deterministic choice, where our conditional is written simply as .While we tend to view our physical machines as deterministic automata, the state upon which each decision is deterministically made includes a number of external things which are tedious to model mathematically. We can also use non-determinism to ignore details that we don't care about for our particular domain — a common example is memory allocation, where it is very convenient (for some programs) to think of memory as infinite, and allocation as an operation that can potentially fail, without specifying exactly when and how this failure can occur. This is normally modelled as a choice between successful allocation and a failure state. Liam O'Connorhttps://liamoc.net/forest/dt-0060/dt-0060/forest/dt-0060/Instantiating our semantics for nondeterminism Our initial semantics for (without loops) was functions on states . When adding loops, we used a cpo for our semantic domain. Since non-deterministic programs can have more than one outcome, a natural choice of semantic domain would be , i.e., functions from an initial state to a non-empty set of possible outcomes. We can provide and operations for our proposed monad for non-determinism : And, with this semantics, we can easily add a denotation for a non-deterministic choice operator, in terms of union: Unfortunately this is only the beginning of our troubles. While we have given a valuation function above, its definition uses , and therefore our domain must be a cpo, and all our operations continuous. It is not clear how to order elements of . A natural choice of ordering would be subset inclusion . However, as we lack , there is no least element for this ordering. Furthermore, simply using as our ordering would mean that the deterministic, terminating program that always returns a single state would be considered less informative than the program that may diverge . This would make most of our operations non-continuous. Instead, we shall examine three separate orderings on this set, each of which carries a different view of non-determinism. More generally, we wish to come up with a construction analogous to the powerset operator , but for our semantic domains — a powerdomain. However, for these orderings to produce valid partial orders, we require a certain theorem that only applies to a certain class of cpos, called "algebraic" cpos. Thus, we will first introduce a richer class of cpos, called Scott domains, and then return to the problem of non-determinism.Liam O'Connorhttps://liamoc.net/forest/dt-005W/dt-005W/forest/dt-005W/Scott domainsLiam O'Connorhttps://liamoc.net/forest/dt-0040/dt-0040/forest/dt-0040/Compactness and FinitenessWe begin by formalising the notion of an element in a cpo representing a finite amount of information. Liam O'Connorhttps://liamoc.net/forest/dt-003W/dt-003W/forest/dt-003W/Boring and interesting setsDefinition There are two kinds of directed sets: Boring sets contain their lub. Example: Finite directed sets are boring (but boring sets aren't all finite!). Interesting sets don't contain their lub. Example: in the chain is interesting. Following the above intuition, we might be tempted to say that the "infinite" elements of a cpo are those which are the lub of an interesting set, but this notion is too weak. Consider this cpo : By the above definition, the only infinite element would be , but if we consider the following isomorphic cpo, ordered by subset inclusion: Then the set cannot be a finite set, as any finite set would be a subset of one of the finite sets in the chain . Thus, it makes more sense for us to call an "infinite" element as well.Liam O'Connorhttps://liamoc.net/forest/dt-003U/dt-003U/forest/dt-003U/CompactnessDefinition Let be a cpo. Then is compact (a.k.a. finite) iff for all directed : In English: A compact element will approximate some element of a directed set if it approximates the lub. We write for the set of compact elements of , i.e.: In the example cpo above, all the elements except and would be compact. Thus, compactness better captures our notion of an element representing a finite amount of information. This understanding of compact elements is a generalisation of the notion of a finite element from the theory of algebraic lattices.Liam O'Connorhttps://liamoc.net/forest/dt-003V/dt-003V/forest/dt-003V/Compact elementsExampleEvery element in a finite cpo is compact. More generally, every element of a cpo of finite height (e.g. ) is compact. This is because finite directed sets are always boring. Take the cpo of subsets of ordered by inclusion , as seen in Exercise . The compact elements of are those of finite cardinality. Take the cpo of partial functions on the natural numbers, ordered by inclusion of graphs. The compact elements of are the functions which are defined only for finite domains. Liam O'Connorhttps://liamoc.net/forest/dt-003X/dt-003X/forest/dt-003X/Compact elements with infinitely many approximations Example Compact elements may still have an infinite number of approximations. Consider the cpo , where we have tacked on an additional top element to our normal cpo of natural numbers extended with infinity. Then, while is not compact, is compact — it is not the lub of an interesting directed set. If is the lub of a set then must be in the set . Nonetheless, there are an infinite number of approximations to , i.e., elements such that .As an aside, requiring that our compact elements have a truly finite number of approximations is the basis for the theory of Berry domains and stable functions.Liam O'Connorhttps://liamoc.net/forest/dt-003Y/dt-003Y/forest/dt-003Y/Submonoids as a cpoTheoremThe submonoids of a monoid form a cpo under , where union gives the lub.Liam O'Connorhttps://liamoc.net/forest/dt-003Z/dt-003Z/forest/dt-003Z/Both infinite and compactExerciseFind a set in the cpo of submonoids of that is both infinite and compact. Liam O'ConnorSolution Take . Let be directed and . Since there must exist such that . Since is a monoid, every positive multiple of is also in , thus and therefore is compact. Seeing as compact elements are also sometimes called finite, this is surprising as is an infinite set. The reason it is nonetheless compact is that is finitely generated — it is the smallest submonoid of such that the finite set . In fact, the compact submonoids of are precisely the finitely generated ones. Liam O'Connorhttps://liamoc.net/forest/dt-005X/dt-005X/forest/dt-005X/Algebraicity and idealsLiam O'Connorhttps://liamoc.net/forest/dt-0041/dt-0041/forest/dt-0041/AlgebraicityDefinitionA cpo is algebraic iff every element is the lub of its compact approximations. That is, a cpo is algebraic iff for all , is directed; Note: It's common in semantics to consider only algebraic cpos with a countable set of compact elements. Such cpos are called -algebraic.Aside: Plotkin provides an equivalent definition of -algebraic cpos in which directed sets are replaced with -chains throughout. Hutton claims this is less appealing, as the definition speaks of an -chain of compact approximations, rather than the directed set of such.Liam O'Connorhttps://liamoc.net/forest/dt-0042/dt-0042/forest/dt-0042/-algebraic cposExample Many standard examples of cpos are -algebraic cpos: finite cpos, subsets of a set , partial functions and submonoids of a monoid. In general, any cpo of subalgebras (e.g. subgroups of a group, subrings of a ring etc.) is -algebraic. This is the origin of the terminology. Liam O'Connorhttps://liamoc.net/forest/dt-0043/dt-0043/forest/dt-0043/Non-algebraic cpoCounterexample In the cpo on the right (seen also in § ), the element is not the lub of its compact approximations. The only compact element that approximates is , and the least upper bound of the set is just , not . That is: but: Liam O'Connorhttps://liamoc.net/forest/dt-0045/dt-0045/forest/dt-0045/Nothing suddenly invented at infinityTheoremLet and be algebraic cpos. Then a function is continuous iff, for all : In other words, in an algebraic cpo, continuous functions are completely defined by their behaviour for compact arguments.This makes precise our earlier slogan in Definition , that continuous functions don't suddenly behave differently for infinite (i.e. non-compact) elements. Liam O'ConnorProof First, assuming is continuous, we show that : It remains to show that if , then is continuous. Using the alternative definition, we shall first show that is monotone. Let for . Then and thus , therefore: Next, let be directed. Liam O'Connorhttps://liamoc.net/forest/dt-0044/dt-0044/forest/dt-0044/ExerciseLet be a continuous function between algebraic cpos. Define: Then for all , prove that: Liam O'ConnorSolution This is powerful. For example, the continuous function on an uncountable cpo is completely determined by the countable relation .Liam O'Connorhttps://liamoc.net/forest/dt-0047/dt-0047/forest/dt-0047/Down-closureDefinition Given a poset , a set is down-closed iff, for all , any is in .Liam O'Connorhttps://liamoc.net/forest/dt-0048/dt-0048/forest/dt-0048/IdealDefinition A set is ideal iff it is both down-closed and directed.Liam O'Connorhttps://liamoc.net/forest/dt-0046/dt-0046/forest/dt-0046/Ideal completionDefinitionThe ideal completion of a set , written sometimes as , is the set of all ideal subsets of , i.e.: Liam O'Connorhttps://liamoc.net/forest/dt-0049/dt-0049/forest/dt-0049/Representation theorem for algebraic cposTheorem Every algebraic cpo is isomorphic to the ideal completion of its compact elements, ordered by subset inclusion. That is, is an algebraic cpo such that . Liam O'Connorhttps://liamoc.net/forest/dt-005Y/dt-005Y/forest/dt-005Y/Getting closureLiam O'Connorhttps://liamoc.net/forest/dt-004A/dt-004A/forest/dt-004A/BasisDefinitionA set of compact elements is a basis for a cpo iff for all , . Liam O'Connorhttps://liamoc.net/forest/dt-004B/dt-004B/forest/dt-004B/Compact basis for algebraic cposTheorem If is a basis for , then is algebraic and . Liam O'ConnorProof If , then where , as is a basis. Since is compact, for some . But since is the lub of , as well. By antisymmetry , hence . Thus , so and is algebraic. Liam O'Connorhttps://liamoc.net/forest/dt-004C/dt-004C/forest/dt-004C/Closure of algebraic cpos under productTheoremIf and are algebraic cpos, then so is their product construction . Liam O'ConnorProof In the following proof, we show that is a basis for the product and thereby show via Theorem that is algebraic if and are. : Let . To show that is compact, let us assume that where is directed. We must show that there exists some element of such that our . As , by the definition of lub on products we can conclude that: Here we use the notation to indicate the image of a function on a set, i.e. . Since and are both compact, there must exist and such that and . While it does not follow that , we know that there must exist a pair such that and as is directed. Hence can be our element that is approximated by , i.e. . is directed for all : Because and are algebraic, and are directed. As directedness is closed under product, is directed too. Starting from the right hand side: Liam O'ConnorProblem -algebraic cpos are closed under all of our constructions (products and sums, including strict versions of these) except functions and strict functions ! Liam O'Connorhttps://liamoc.net/forest/dt-004D/dt-004D/forest/dt-004D/Scott's original solution: using complete latticesAsideThe lack of closure of algebraicity under the (continuous) function arrow, strict or non-strict, is not satisfying as it means that our semantic domains are not guaranteed to be algebraic even if they are composed from algebraic cpos. Instead, we must replace algebraic cpos with something stronger still.Scott's original solution to this lack of closure was to use a complete lattice instead of cpos, i.e. requiring lubs for all subsets, not just directed ones. This solves the problem with but introduces new problems: Complete lattices need a top element , but adding a fictitious top (representing inconsistent information) to cpos like is strange. Extending the functions that capture our primitive semantic operations to complete lattices can spoil nice algebraic properties. Consider these two possible implementations of , the function for the semantics of an expression: Either of these solutions results in the failure of useful and expected laws for expressions. For example, the left definition above results in the failure of the common equation to eliminate unreachable cases: And the second definition above results in the failure of this equation that removes redundant checks: The powerdomain construction does not generalise to complete lattices, so semantics for non-deterministic programs are difficult in this setting. Liam O'Connorhttps://liamoc.net/forest/dt-004E/dt-004E/forest/dt-004E/Consistent completenessDefinitionA poset is consistent complete (or bounded complete) iff exists for all consistent . That is, any set with an upper bound (a consistent set) has a least upper bound.Liam O'Connorhttps://liamoc.net/forest/dt-004F/dt-004F/forest/dt-004F/Consistent completeness vs directed completenessExample consistent complete not consistent complete not directed complete directed complete Liam O'Connorhttps://liamoc.net/forest/dt-004G/dt-004G/forest/dt-004G/Scott domainDefinitionA cpo is a Scott domain iff: is -algebraic, is consistent complete, In other words, Scott domains can be summed up by the acronym: Liam O'Connorhttps://liamoc.net/forest/dt-004H/dt-004H/forest/dt-004H/RemarkThe second requirement in Definition can, in light of the first, be expressed equivalently as: exists for all consistent . This is useful when needing to show that a given cpo is a Scott domain.Liam O'Connorhttps://liamoc.net/forest/dt-004I/dt-004I/forest/dt-004I/Closure of Scott domainsTheoremScott domains are closed under all our cpo constructions, including sums , products , continuous functions , smash sums , smash products and strict functions . Liam O'ConnorThesisOur semantic domains are Scott domains.Liam O'Connorhttps://liamoc.net/forest/dt-0061/dt-0061/forest/dt-0061/The Hoare powerdomainWe write to denote finite non-empty subsets of . Let be finite, non-empty sets of compact elements of a Scott domain . The Hoare powerdomain construction is based on the following ordering: The intuition behind this is that "Anything can do, can do better". This ordering has some desirable properties: The least element is , as we might expect. It also satisfies the equation , which intuitively means that a non-deterministic choice is considered to have more information than any of its components. When specialised to the case where is a flat domain like , it simplifies to: This is, however, not a proper order, but a preorder, as it fails antisymmetry. Even in the flat domain case, and but they are not equal. However, any preorder does induce an equivalence relation, where iff and . Furthermore, if we take the ideal completion of with respect to the preorder (i.e., the set of all -downwards-closed directed subsets of ), we can order them by inclusion to obtain an algebraic domain with compact elements which correspond to equivalence classes of elements under . We have a lub operation for these ideals: Liam O'Connorhttps://liamoc.net/forest/dt-0062/dt-0062/forest/dt-0062/Hoare powerdomain of Example Let us find the Hoare powerdomain of . Note that is a flat domain so all elements are compact, i.e. . Let us find examine the -ideal subsets of . If and both contain , then iff . As ideal subsets are downwards closed, we can identify an ideal with its union . The ideals of are then isomorphic to domain of all subsets of under subset inclusion. Liam O'Connorhttps://liamoc.net/forest/dt-0063/dt-0063/forest/dt-0063/Angelic nondeterminismRemark Consider the following three programs: Given a state , let . Then, the possible results of these programs are , , and respectively. Because the Hoare construction identifies -equivalent sets, the Hoare powerdomain semantics will consider programs 1 and 3 to be the same. That is, the non-determinism is angelic. The bad outcome () is only said to happen if it is inevitable. Liam O'Connorhttps://liamoc.net/forest/dt-0064/dt-0064/forest/dt-0064/The Smyth powerdomainAs before, let be finite, non-empty sets of compact elements of a Scott domain . The Smyth powerdomain construction is based on the following preorder: The intuition here is "Everything can do, can do worse". It satisfies the equation , which intuitively means that a non-deterministic choice is considered to have less information than any of its components. When applied to a flat domain, it simplifies to: As with the Hoare powerdomain, this fails to be a partial order, but we can use the same ideal completion trick to induce an algebraic domain where compact elements correspond to equivalence classes of elements under (where is, as with , just defined as ). Liam O'Connorhttps://liamoc.net/forest/dt-0065/dt-0065/forest/dt-0065/Smyth powerdomain of ExampleFirstly note that, as ideals are downwards-closed, any -ideal subsets of will contain all finite subsets of that contain . Let us call those sets trivial. So, a set in is non-trivial if it does not contain and an ideal subset of is non-trivial if it contains a non-trivial set. Observe that for non-trivial sets and , iff . Thus, we can identify an ideal with the down-closure of the intersection of its non-trivial elements. The smaller this set is, the larger the ideal . Hence, and confusingly, the non-trivial ideals in the powerdomain (ordered by subset inclusion) correspond to finite subsets of ordered by superset inclusion. As all trivial sets are identified, we just need to throw in the unique trivial ideal, and we can see that the Smyth powerdomain of is isomorphic to the domain of sets ordered by subset inclusion.Liam O'Connorhttps://liamoc.net/forest/dt-0066/dt-0066/forest/dt-0066/Demonic nondeterminismRemarkNote that all sets that contain are considered equivalent by the Smyth construction . Thus, this models demonic non-determinism: Of the three programs in Remark , the Smyth semantics considers 2 and 3 to be the same. Thus, the possibility of divergence is no different from inevitable divergence. Liam O'Connorhttps://liamoc.net/forest/dt-0067/dt-0067/forest/dt-0067/The Plotkin powerdomainAs before, let be finite, non-empty sets of compact elements of a Scott domain . The Plotkin powerdomain construction is based on the following preorder, simply combining the orderings from the Hoare and Smyth constructions: This ordering is also called the Egli-Milner ordering. On a flat domain, it simplifies to: Note that this is antisymmetric in the case of a flat domain, and the lub of a chain of sets can be found by taking the union of all elements of the chain if all elements contain If not, then the element without will be the least upper bound. The failures of antisymmetry can only be observed in domains of height higher than one. Consider a set containing two elements. According to the induced equivalence from this preorder , this set would be considered equal to the set that contains those two elements plus any elements that lie between them on the information ordering: The Plotkin powerdomain is sometimes called the convex powerdomain, due to the similarity of this to the geometric definition of convexity. Thus, we use the ideal completion trick (as with the Hoare and Smyth constructions) here to arrive at a definition of powerdomain that distinguishes between all three programs outlined in Remark . Liam O'ConnorAside There is a beautiful algebraic characterisation of Plotkin powerdomains in Matthew Hennessy Gordon Plotkin's paper, Full abstraction for a simple parallel programming language. Liam O'Connor https://liamoc.net/forest/isa-0001/ isa-0001 /forest/isa-0001/ Interactive theorem proving Lecture Notes These notes are the basis of my short course at the ANU Logic Summer School 2025. Liam O'Connor 2025 11 25 https://liamoc.net/forest/isa-0002/ isa-0002 /forest/isa-0002/ Building up HOL Lecture Liam O'Connor 2025 11 25 https://liamoc.net/forest/isa-0003/ isa-0003 /forest/isa-0003/ Isabelle and HOL These lectures introduce theorem proving using the proof assistant Isabelle. Isabelle supports many logics, but by far the most popular is Higher Order Logic, the focus of these notes. Isabelle comes pre-packaged with its HOL libraries, as well as a proof editor (based on jEdit) and various other tools. The proof developments shown in these notes are all developed with Isabelle 2024, but Isabelle 2025 (the latest version at time of writing) is largely backwards compatible with it. I have not upgraded due to some proof automation regressions in Isabelle 2025 that do not affect the content of these notes. Liam O'Connor 2025 11 30 https://liamoc.net/forest/isa-0013/ isa-0013 /forest/isa-0013/ Installing Isabelle See dedicated instructions for Windows, Mac and Linux Liam O'Connor 2025 12 2 https://liamoc.net/forest/isa-0016/ isa-0016 /forest/isa-0016/ Definining Theories An Isabelle file is called a theory, and they consist of mathematical definitions (of types and terms), lemmas and proofs. Isabelle theories start with a theory name and a declaration of all the theories on which it depends. The theory name must match the file name, so the code from this lecture should be saved into a file called HOLFromScratch.thy. theory HOLFromScratch imports Pure begin We imported the theory Pure, which contains only the very basic built-in structures that define Isabelle's logic. Liam O'Connor 2025 12 2 https://liamoc.net/forest/isa-0017/ isa-0017 /forest/isa-0017/ HHFs and Isabelle/Pure Isabelle's logical framework consists of terms (), types () and formulae (). Each term must have a type , written . In the below code, we define a new type called bool, and we declare that terms of type bool can be used as judgments in our formulae. The details of the judgment command are not important for now. typedecl bool judgment Trueprop :: "bool ⇒ prop" (‹(_)› 5) Formulae in Isabelle are hereditary Harrop formulae, defined as:In Isabelle's syntax, formulae, terms, and types are typically surrounded by quote marks "" or cartouches ‹› — the two are equivalent. Liam O'Connor 2025 12 2 https://liamoc.net/forest/isa-0018/ isa-0018 /forest/isa-0018/ Isabelle's Syntax for HHFs Example Consider the following rule: This is encoded as an Isabelle formula as follows: Because is right-associative, we can remove some parentheses: We can also combine the meta-quantifiers: Isabelle includes special syntax which is equivalent to . Isabelle will also automatically add quantifiers to unknown variables, so we can drop the meta-quantifiers from the outermost part of the formula: Liam O'Connor 2025 11 25 https://liamoc.net/forest/isa-0005/ isa-0005 /forest/isa-0005/ Conjunction Definition axiomatization conj :: "bool ⇒ bool ⇒ bool" (infixr "∧" 35) where conjI : "⟦ A ; B ⟧ ⟹ (A ∧ B)" and conjunct1 : "A ∧ B ⟹ A" and conjunct2 : "A ∧ B ⟹ B" Liam O'Connor 2025 12 2 https://liamoc.net/forest/isa-0019/ isa-0019 /forest/isa-0019/ Isabelle axiomatizations Isabelle's basic mechanism to define new things is the axiomatization command. axiomatization (* constants *) where (* axioms *) This defines the constants (with their types) in the constants section, and assumes the formulae stated in the axioms section. Liam O'Connor2025122Problem Isabelle does nothing to stop you from assuming false theorems as axioms in axiomatization commands, which can easily render the logic unsound. We shall later see safer ways to define new constants, which should be preferred over axiomatization in most cases. Liam O'Connor 2025 12 2 https://liamoc.net/forest/isa-001C/ isa-001C /forest/isa-001C/ Isabelle Terms Terms in Isabelle are essentially terms of the (polymorphic) typed lambda calculus. When we declare a constant like: conj :: "bool ⇒ bool ⇒ bool" (infixr "∧" 35) We are introducing a new constant called conj that has type bool ⇒ bool ⇒ bool — that is, a function that takes two values of type bool and produces another bool. The infixr annotation on the right hand side lets us use familiar notation A ∧ B instead of writing conj A B, but the meaning of A ∧ B is identical to conj A B.Liam O'Connor2025122CurryingAsideFunctions of multiple parameters in Isabelle are typically curried, meaning that a function of type bool ⇒ bool ⇒ bool is actually a function of type bool ⇒ (bool ⇒ bool) — a function that, given a bool value, produces a function of type bool ⇒ bool. Liam O'Connor 2025 11 28 https://liamoc.net/forest/isa-000Z/ isa-000Z /forest/isa-000Z/ rule Proof Method Given a goal and a theorem r (commonly an introduction rule), apply (rule r) replaces the goal with subgoals: Liam O'Connor20251128AsideTechnically, the conclusion of the rule and the goal do not have to be exactly equal, but they must be unifiable – that is, there must be some substitution to schematic variables that makes the conclusion of the rule and the goal equal. Liam O'Connor 2025 11 28 https://liamoc.net/forest/isa-0010/ isa-0010 /forest/isa-0010/ frule and drule Proof Method Given a goal and a theorem r, apply (frule r) replaces the goal with subgoals: The method drule is the same as frule except that it also deletes the assumption from the last subgoal. Liam O'Connor 2025 11 25 https://liamoc.net/forest/isa-000C/ isa-000C /forest/isa-000C/ Conjunction Elimination Theorem lemma conjE : ‹⟦ A ∧ B ; ⟦ A ; B ⟧ ⟹ C ⟧ ⟹ C› Liam O'Connor20251125Solution apply (rule impI) apply (frule conjunct1) apply (drule conjunct2) apply (assumption) done Liam O'Connor 2025 11 25 https://liamoc.net/forest/isa-0006/ isa-0006 /forest/isa-0006/ Implication Definition axiomatization implies :: "bool ⇒ bool ⇒ bool" (infixr "⟶" 25) where impI : "(A ⟹ B) ⟹ (A ⟶ B)" and mp : "⟦ A ⟶ B ; A ⟧ ⟹ B" Liam O'Connor 2025 11 25 https://liamoc.net/forest/isa-000D/ isa-000D /forest/isa-000D/ Implication Elimination Theorem lemma impE: ‹⟦ P ⟶ Q; P ; Q ⟹ R ⟧ ⟹ R› Liam O'Connor20251125Solution apply (drule mp) apply assumption apply assumption done Liam O'Connor 2025 11 28 https://liamoc.net/forest/isa-0011/ isa-0011 /forest/isa-0011/ erule Proof Method Given a goal and a theorem r (typically an elimination rule where the conclusion is just a variable, easily unified with ), apply (erule r) replaces the goal with subgoals: Liam O'Connor 2025 11 25 https://liamoc.net/forest/isa-0009/ isa-0009 /forest/isa-0009/ Example lemma ‹A ∧ B ⟶ B ∧ A› Liam O'Connor20251125Solution apply (rule impI) apply (erule conjE) apply (rule conjI) apply assumption apply assumption done Liam O'Connor 2025 11 25 https://liamoc.net/forest/isa-0007/ isa-0007 /forest/isa-0007/ False and True Definition axiomatization False :: "bool" and True :: "bool" where FalseE : "False ⟹ C" and TrueI : "True" Liam O'Connor 2025 11 25 https://liamoc.net/forest/isa-0008/ isa-0008 /forest/isa-0008/ Negation Definition axiomatization not :: "bool ⇒ bool" ("¬ _" [40] 40) where notI : "(A ⟹ False) ⟹ ¬ A" and notE : "⟦ ¬ A ; A ⟧ ⟹ R" Liam O'Connor 2025 11 25 https://liamoc.net/forest/isa-000A/ isa-000A /forest/isa-000A/ Example lemma ‹X ⟶ ¬ ¬ X› Liam O'Connor20251125Solution apply (rule impI) apply (rule notI) apply (erule notE) apply assumption done Liam O'Connor 2025 11 25 https://liamoc.net/forest/isa-0004/ isa-0004 /forest/isa-0004/ Disjunction Definition axiomatization disj :: "bool ⇒ bool ⇒ bool" (infixr "∨" 30) where disjI1 : "A ⟹ (A ∨ B)" and disjI2 : "B ⟹ (A ∨ B)" and disjE : "⟦ A ∨ B ; A ⟹ C ; B ⟹ C ⟧ ⟹ C" Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000M/ isa-000M /forest/isa-000M/ Example lemma disjCI: "¬ A ⟶ B ⟹ A ∨ B" Liam O'Connor20251127Solution apply (rule ccontr) apply (erule impE) apply (rule notI) apply (erule notE) apply (rule disjI1) apply assumption apply (erule notE) apply (rule disjI2) apply assumption done Liam O'Connor 2025 11 25 https://liamoc.net/forest/isa-000B/ isa-000B /forest/isa-000B/ Exercise lemma ‹(X ⟶ Y ⟶ ¬ X) ⟶ X ⟶ ¬ Y› Liam O'Connor20251125Solution apply (rule impI) apply (rule impI) apply (erule impE) apply assumption apply (rule notI) apply (erule impE) apply assumption apply (erule notE) apply assumption done Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000E/ isa-000E /forest/isa-000E/ Classical Axiom Definition axiomatization where classical: ‹⟦ ¬ P ⟹ P ⟧ ⟹ P› Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000F/ isa-000F /forest/isa-000F/ Proof by Contradiction Theorem lemma ccontr: "⟦ ¬ P ⟹ False ⟧ ⟹ P" Liam O'Connor20251127Solution apply (rule classical) apply (rule FalseE) by (assumption) Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000G/ isa-000G /forest/isa-000G/ Example lemma ‹¬ ¬ X ⟶ X› Liam O'Connor20251127Solution apply (rule impI) apply (rule ccontr) apply (erule notE) apply assumption done Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000H/ isa-000H /forest/isa-000H/ Example lemma ‹¬ (A ⟶ B) ⟶ A› Liam O'Connor20251127Solution apply (rule impI) apply (rule ccontr) apply (erule notE) apply (rule impI) apply (erule notE) apply assumption done Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000I/ isa-000I /forest/isa-000I/ Exercise lemma ‹¬ (A ∧ B) ⟶ ¬ A ∨ ¬ B› Liam O'Connor20251127Solution apply (rule impI) apply (rule ccontr) apply (erule notE) apply (rule conjI) apply (rule ccontr) apply (erule notE) apply (rule disjI1) apply assumption apply (rule ccontr) apply (erule notE) apply (rule disjI2) apply assumption done Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000J/ isa-000J /forest/isa-000J/ Exercise lemma ‹¬ A ∧ ¬ B ⟶ ¬ (A ∨ B)› Liam O'Connor20251127Solution apply (rule impI) apply (erule conjE) apply (rule notI) apply (erule disjE) apply (erule notE, assumption) apply (erule notE, assumption) done Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000K/ isa-000K /forest/isa-000K/ Exercise lemma ‹¬ (A ∨ B) ⟶ ¬ A ∧ ¬ B› Liam O'Connor20251127Solution apply (rule impI) apply (rule conjI) apply (rule notI) apply (erule notE) apply (rule disjI1) apply (assumption) apply (rule notI) apply (erule notE) apply (rule disjI2) apply (assumption) done Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000L/ isa-000L /forest/isa-000L/ Exercise lemma ‹(A ⟶ B) ⟶ ((B ⟶ C) ⟶ A) ⟶ B› Liam O'Connor20251127Solution apply (intro impI) apply (rule ccontr) apply (erule impE) apply (drule mp) apply (rule impI) apply (erule notE) apply assumption apply assumption apply (erule notE) apply assumption done Liam O'Connor 2025 11 25 https://liamoc.net/forest/isa-000N/ isa-000N /forest/isa-000N/ Universal Quantifiers Definition axiomatization All :: ‹('a ⇒ bool) ⇒ bool› (binder "∀" 10) where allI : ‹⟦ ⋀x. P x ⟧ ⟹ ∀ x. P x› and spec : ‹∀ a. P a ⟹ P x› Liam O'Connor 2025 11 28 https://liamoc.net/forest/isa-001A/ isa-001A /forest/isa-001A/ rule_tac, erule_tac, drule_tac, frule_tac Proof Method The typical rule, erule, drule, frule methods rely entirely on unification to determine how to instantiate the variables in the provided rule. Sometimes, it is useful to state explicitly how to instantiate some variables in the rule, particularly when dealing with quantifiers, or when there are multiple possible candidates. apply (rule_tac x = "term" in exI) Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000P/ isa-000P /forest/isa-000P/ Universal Quantifier Elimination Theorem lemma allE : ‹⟦ ∀a. P a; P x ⟹ R ⟧ ⟹ R› Liam O'Connor20251127Solution apply (drule_tac x = x in spec) apply assumption done Liam O'Connor 2025 11 25 https://liamoc.net/forest/isa-000O/ isa-000O /forest/isa-000O/ Existential Quantifiers Definition axiomatization Ex :: ‹('a ⇒ bool) ⇒ bool› (binder "∃" 10) where exI : ‹⟦ P x ⟧ ⟹ ∃a. P a› and exE : ‹⟦ ∃ x. P x ; ⋀a. P a ⟹ R ⟧ ⟹ R› Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000Q/ isa-000Q /forest/isa-000Q/ Example lemma ‹∀x. ¬ P x ⟹ ¬ (∃x. P x)› Liam O'Connor20251127Solution apply (rule notI) apply (erule exE) apply (erule_tac x = a in allE) apply (erule notE) apply assumption done Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000R/ isa-000R /forest/isa-000R/ Example lemma ‹¬ (∃x. P x) ⟹ ∀x. ¬ P x› Liam O'Connor20251127Solution apply (intro allI notI) apply (erule notE) apply (rule exI) apply assumption done Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000S/ isa-000S /forest/isa-000S/ Example lemma ‹∃ x y. P x y ⟹ ∃ y x. P x y› Liam O'Connor20251127Solution apply (elim exE) apply (intro exI) apply assumption done Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000T/ isa-000T /forest/isa-000T/ Exercise lemma ‹∃ x. P x ⟶ Q ⟹ (∀ x. P x) ⟶ Q› Liam O'Connor20251127Solution apply (intro impI) apply (elim exE) apply (drule_tac x = a in spec) apply (drule mp, assumption) apply assumption done Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000U/ isa-000U /forest/isa-000U/ Exercise lemma ‹(∀ x. P x) ⟶ Q ⟹ ∃ x. P x ⟶ Q› Liam O'Connor20251127Solution apply (rule ccontr) apply (elim impE) apply (intro allI) apply (rule ccontr) apply (erule notE) apply (rule_tac x = x in exI) apply (rule impI) apply (erule notE) apply assumption apply (erule notE) apply (intro exI) apply (rule impI) apply assumption done Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000V/ isa-000V /forest/isa-000V/ Exercise lemma ‹(∀ x. P x) ⟶ (∃ x. Q x) ⟹ ∃ x. P x ⟶ Q x› Liam O'Connor20251127Solution apply (rule ccontr) apply (elim impE) apply (intro allI) apply (rule ccontr) apply (erule notE) apply (rule_tac x = x in exI) apply (rule impI) apply (erule notE) apply assumption apply (erule notE) apply (erule exE) apply (intro exI) apply (rule impI) apply assumption done Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000W/ isa-000W /forest/isa-000W/ Exercise lemma ‹ ∃ x. P x ⟶ Q x ⟹ (∀ x. P x) ⟶ (∃ x. Q x)› Liam O'Connor20251127Solution apply (rule impI) apply (elim exE) apply (drule_tac x = a in spec) apply (drule mp, assumption) apply (rule exI) apply assumption done Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000X/ isa-000X /forest/isa-000X/ Exercise lemma ‹∀ x. ¬ R x ⟶ R (M x) ⟹ ∀ x. R x ∨ R (M x)› Liam O'Connor20251127Solution apply (intro allI) apply (erule_tac x = x in allE) apply (rule ccontr) apply (erule impE) apply (rule notI) apply (erule notE) apply (rule disjI1) apply assumption apply (erule notE) apply (rule disjI2) apply assumption done Liam O'Connor 2025 11 27 https://liamoc.net/forest/isa-000Y/ isa-000Y /forest/isa-000Y/ Exercise lemma ‹⟦∀ x. ¬ R x ⟶ R (M x); ∃ x. R x ⟧ ⟹ ∃ x. R x ∧ R (M (M x))› Liam O'Connor20251127Solution apply (erule exE) apply (rename_tac a) apply (frule_tac x = a in spec) apply (frule_tac x = "M a" in spec) apply (drule_tac x = "M (M a)" in spec) apply (drule disjCI) apply (drule disjCI) apply (drule disjCI) apply (elim disjE;rule exI; rule conjI; assumption) done Liam O'Connor 2025 12 2 https://liamoc.net/forest/isa-001B/ isa-001B /forest/isa-001B/ Definitions, Datatypes, Induction, Functions Lecture theory Definitions imports Main begin Unlike in Lecture , we import Main here rather than Pure. Almost all theories developed in Isabelle/HOL import Main, which contains all of the axioms and connectives introduced in Lecture , as well as a host of other theories, including:Axioms for defining equality. Try the following: thm refl thm sym thm trans thm iffI thm ssubst A theory of sets. A theory of natural numbers A theory of lists And much more!Liam O'Connor2025122https://liamoc.net/forest/isa-001G/isa-001G/forest/isa-001G/Isabelle definitionsThe Isabelle definition command is a safer way to define constants than the axiomatization command. The syntax is similiar: definition my_const :: "type" where (* equation *) However, there are several differences:Only one constant (my_const above) can be defined. Only one axiom can be defined, and it must be an equation of the format my_const ... = ..., describing the meaning of my_const in terms of other, already-defined constants.If no name is given to the defining equation, the default name produced by appending _def to the name of the constant is used (e.g. my_const_def)Liam O'Connor2025122https://liamoc.net/forest/isa-001D/isa-001D/forest/isa-001D/A nand connectiveDefinition definition nand :: ‹bool ⇒ bool ⇒ bool› where ‹nand a b = (¬ (a ∧ b))› Liam O'Connor2025122https://liamoc.net/forest/isa-001F/isa-001F/forest/isa-001F/unfoldProof MethodGiven a theorem r (typically a defining equation given by the definition command), apply (unfold r) replaces every occurrence of in the current goal with .If the theorem r has premises, then all of those premises must be directly satisfied by assumptions in the current goal for unfold to succeed.Liam O'Connor2025122https://liamoc.net/forest/isa-001E/isa-001E/forest/isa-001E/Proving the axioms for nandExampleWe use the unfold method with the lemma generated by Definition to replace nand with its definition in our goal: lemma nandI1: ‹¬A ⟹ nand A B› Liam O'Connor2025122Solution apply (unfold nand_def) apply (rule notI) apply (erule conjE) apply (erule notE) apply assumption done lemma nandI2: ‹¬B ⟹ nand A B› Liam O'Connor2025122Solution apply (unfold nand_def) apply (rule notI) apply (erule conjE) apply (erule notE) apply assumption done lemma nandE: ‹⟦ nand A B; ¬ A ⟹ C; ¬ B ⟹ C ⟧ ⟹ C› Liam O'Connor2025122Solution apply (unfold nand_def) apply (rule ccontr) apply (erule notE) apply (rule conjI) apply (rule ccontr) apply (erule notE) apply assumption apply (rule ccontr) apply (erule notE) apply assumption done Liam O'Connor2025122https://liamoc.net/forest/isa-001H/isa-001H/forest/isa-001H/simpProof MethodThe Isabelle simplifier, or simp, is one of the most powerful proof automation features in Isabelle, but it is a very simple idea. Given a set of equations, apply (simp) will (almost) blindly rewrite the goal by all of those equations (as well as any equations that are local assumptions in the goal) left-to-right. Given a sufficiently expressive set of equations, this allows the simplifier to solve many goals (including all of the theorems in Example ) on its own.The default set of equations that simp uses is called the simpset. We can add theorems to the simpset by attaching the [simp] attribute to them. 2025122https://liamoc.net/forest/isa-001I/isa-001I/forest/isa-001I/Simplifier rules for nandExample Continuing our nand example, we can prove theorems and attach the [simp] attribute simultaneously: lemma nand_t[simp]: ‹nand True A = (¬ A)› apply (unfold nand_def) apply simp done Alternatively, we can add theorems after-the-fact like so: lemma nand_f: ‹nand False A = True› apply (unfold nand_def) apply simp done (* ... *) declare nand_f[simp] Occasionally it becomes useful to remove a theorem from the simp set. This can be achieved by using the declare command and the [simp del] attribute: declare nand_f[simp del] We can also adjust the simpset locally when we invoke the simp method: lemma nand_xt[simp]: ‹nand A True = (¬ A)› by (simp add: nand_def) Liam O'Connor2025122Problem Isabelle does nothing to guarantee that simp will terminate, nor that it will be confluent (i.e. the results can depend on the order in which rewrites are applied). In particular, problems with non-termination can arise if there is a cycle in the equations used for rewriting. In such cases, it can be useful to remove certain lemmas from the simpset locally: apply (simp del: nand_t) Or explicitly list all the theorems to use: apply (simp only: nant_t nand_f) Or disable the simplification and use of local assumptions: apply (simp (no_asm)) Or disable the simplification of (but still use) local assumptions: apply (simp (no_asm_simp)) Or disable the use of (but still simplify) local assumptions: apply (simp (no_asm_use)) Liam O'Connor2025122https://liamoc.net/forest/isa-001K/isa-001K/forest/isa-001K/The datatype commandThe datatype defines a new type (like typedecl) but also defines some special constants, called constructors, which make values of that type. Constructors may optionally take arguments, and these data types may be recursive. datatype type_name = Constructor1 "arg_type1" "arg_type2" (* ... *) | Constructor2 (* ... *) (* ... *) These datatypes are analogous to the algebraic data types found in many functional programming languages.The datatype command automatically proves many lemmas about these types for you, chiefly:Disjointness: Values made with one constructor are not equal to values made with another constructor. Exhaustivity: The only values of this type are those made by the listed constructors. Injectivity: Two values of the same constructor are equal iff their arguments are equal.2025122https://liamoc.net/forest/isa-001J/isa-001J/forest/isa-001J/The oot typeExample datatype oot = ONE | TWO print_theorems This defines a type called oot with two values, ONE : oot and TWO : oot. The print_theorems command here allows us to see all of the theorems automatically created by the datatype command, chiefly that the constants ONE and TWO are disjoint (i.e. ONE ≠ TWO) and exhaustive (i.e. that there are no other values of type oot apart from ONE and TWO) Liam O'Connor2025122https://liamoc.net/forest/isa-001L/isa-001L/forest/isa-001L/case_tacProof MethodThe case_tac method splits the current goal into multiple cases. Given a term t of type , apply (case_tac t) will produce a new goal for each possible case of t according to the .cases theorem for the type .This works for all types defined with datatype, as well as for natural numbers (type nat) and bools — often an easier way to do classical reasoning than using rule ccontr. Liam O'Connor2025122https://liamoc.net/forest/isa-001M/isa-001M/forest/isa-001M/Example lemma lm001M: ‹f (f (f (b::oot))) = f b› Liam O'Connor2025122Solution apply (case_tac b) apply simp apply (case_tac "(f ONE)") apply simp apply simp apply (case_tac "(f TWO)") apply simp apply simp apply (case_tac "(f ONE)") apply simp apply (case_tac "(f TWO)") apply simp apply simp apply simp apply (case_tac "(f TWO)") apply simp apply simp done Liam O'Connor2025123https://liamoc.net/forest/isa-001N/isa-001N/forest/isa-001N/Natural numbers in IsabelleIsabelle/HOL's theory of natural numbers defines natural numbers in a different way, but they behave much as if they were defined with the datatype command. datatype nat = 0 | Suc "nat" Liam O'Connor2025123https://liamoc.net/forest/isa-001O/isa-001O/forest/isa-001O/Defining functions in IsabelleThe fun command can be used to define functions in Isabelle. Unlike definitions, functions can be defined by multiple pattern-matching equations, they may be recursive, and their equations are automatically added to the simpset.Liam O'Connor2025123Fibonacci as a funExample fun fib :: "nat ⇒ nat" where "fib 0 = 0" | "fib (Suc 0) = Suc 0" | "fib (Suc (Suc n)) = fib n + fib (Suc n)" print_theorems The print_theorems command allows us to see all of the lemmas generated by this command. 2025123Problem Isabelle functions must provably terminate. The problem with non-terminating functions can be illustrated by a definition like: fun bad :: "nat ⇒ bool" where "bad x = ¬ (bad x)" If such a non-terminating definition were allowed, this would render our logic inconsistent (as bad x is equal to its own negation). Therefore, Isabelle requires that all functions be accompanied by a proof of termination. The fun command attempts to prove termination automatically. If it does not succeed, it will give an error message and fail to define the function. Manual proofs of termination can be supplied if the function command is used instead, but the function command is beyond the scope of this course. In cases where the recursion and pattern matching follows exactly the structure of the datatype in one argument, primrec can be used instead of fun, which is a bit more efficient:Liam O'Connor2025123https://liamoc.net/forest/isa-001R/isa-001R/forest/isa-001R/Factorial as a primrecExample primrec factorial :: "nat ⇒ nat" where "factorial 0 = Suc 0" | "factorial (Suc n) = Suc n * factorial n" print_theorems Liam O'Connor2025123https://liamoc.net/forest/isa-001P/isa-001P/forest/isa-001P/induct (for structural induction)Proof MethodWhile it is possible to use rule or erule with the generated .induct theorem from a datatype, it is usually much simpler and more convenient to use the induct proof method. Similar to the case_tac method, apply (induct t) splits the goal into various cases, one for each constructor of the type of t. The difference is that for recursive cases of the datatype, we also get an inductive hypothesis added to our assumptions.Liam O'Connor2025123https://liamoc.net/forest/isa-001Q/isa-001Q/forest/isa-001Q/ExampleWe can prove a theorem about our factorial definition: theorem factorial_mult: "factorial n * factorial m ≤ factorial (n + m)" Liam O'Connor2025123Solution apply (induct n) apply simp apply (simp only: factorial.simps add_Suc mult.assoc) apply (rule mult_le_mono) apply simp apply simp done Liam O'Connor2025123https://liamoc.net/forest/isa-001S/isa-001S/forest/isa-001S/Higher-order functionsExample primrec rpt :: ‹('a ⇒ 'a) ⇒ nat ⇒ 'a ⇒ 'a› where ‹rpt f 0 x = x › | ‹rpt f (Suc n) x = f (rpt f n x)› The above function is given another function as an input.Liam O'Connor2025123https://liamoc.net/forest/isa-001T/isa-001T/forest/isa-001T/Exercise definition twice :: ‹('a ⇒ 'a) ⇒ 'a ⇒ 'a› where ‹twice f x = f (f x)› lemma ‹rpt (twice f) n (f (x::oot)) = f x› Liam O'Connor2025123Solution apply (unfold twice_def) apply (induct n) apply simp apply simp apply (rule lm001M) done Using the lemma from Example . Liam O'Connor2025123https://liamoc.net/forest/isa-001U/isa-001U/forest/isa-001U/The oots typeDefinition datatype oots = ONEs "nat" "oots" | TWOs "nat" "oots" | Empty This type encodes a sequence of oot values. For example, the value ONEs 3 (TWOs 2 (ONEs 1 Empty)) encodes the sequence [ONE, ONE, ONE, TWO, TWO, ONE]. Liam O'Connor2025123https://liamoc.net/forest/isa-001V/isa-001V/forest/isa-001V/The prepend functionDefinition fun prepend :: ‹oot ⇒ nat ⇒ oots ⇒ oots› where ‹prepend ONE n Empty = ONEs n Empty› | ‹prepend TWO n Empty = TWOs n Empty› | ‹prepend ONE n (TWOs m r) = ONEs n (TWOs m r)› | ‹prepend TWO n (ONEs m r) = TWOs n (ONEs m r)› | ‹prepend ONE n (ONEs m r) = ONEs (n+m) r› | ‹prepend TWO n (TWOs m r) = TWOs (n+m) r› Liam O'Connor2025123https://liamoc.net/forest/isa-001W/isa-001W/forest/isa-001W/prepend_prependTheorem lemma prepend_prepend: ‹prepend s n (prepend s m r) = prepend s (n + m) r› Liam O'Connor2025123Solution apply (case_tac s) apply simp apply (case_tac r) apply simp apply simp apply simp apply (case_tac r) apply simp apply simp apply simp done Liam O'Connor2025123https://liamoc.net/forest/isa-001X/isa-001X/forest/isa-001X/Combining methods with semicolonsMethods can be combined using the ; operator: apply (m1; m2) This applies m2 to every subgoal that results from applying m1 to the current goal. It can be chained together multiple times. For example, the entire proof of Theorem can be much more succinctly expressed as one line: by (case_tac s; case_tac r; simp) Liam O'Connor2025123https://liamoc.net/forest/isa-001Y/isa-001Y/forest/isa-001Y/The cat functionDefinition fun cat :: ‹oots ⇒ oots ⇒ oots› where ‹cat (ONEs n xs) ys = prepend ONE n (cat xs ys)› | ‹cat (TWOs n xs) ys = prepend TWO n (cat xs ys)› | ‹cat Empty ys = ys› This function uses the prepend function to concatenate two oots sequences together.Liam O'Connor2025123https://liamoc.net/forest/isa-001Z/isa-001Z/forest/isa-001Z/cat_prependTheorem lemma cat_prepend: ‹cat (prepend s n x) y = prepend s n (cat x y)› Liam O'Connor2025123Solution by (case_tac s; case_tac x; simp add: prepend_prepend) Liam O'Connor2025123https://liamoc.net/forest/isa-0021/isa-0021/forest/isa-0021/Lists in IsabelleThe Isabelle/HOL theory of Lists defines lists as follows: datatype 'a list = Nil | Cons "'a" "'a list" This is an example of a polymorphic data type, where the type variable 'a stands for a type. For example, the type nat list is the type of lists of nat, and oot list is the type of a list of oots. The notation x#xs is syntax sugar for Cons x xs and [] is syntax sugar for Nil. Lists can also be written in square brackets, so: [1,2,3] is equivalent to: 1 # 2 # 3 # [] which is equivalent to: Cons 1 (Cons 2 (Cons 3 Nil)) Some provided functions are useful, including replicate :: nat ⇒ 'a ⇒ 'a list, which produces a list of copies of the given value, and append :: 'a list ⇒ 'a list ⇒ 'a list which joins two lists together into one. The append function also has special notation, so a @ b is equivalent to append a bLiam O'Connor2025123https://liamoc.net/forest/isa-0022/isa-0022/forest/isa-0022/The expand functionDefinition primrec expand :: ‹oots ⇒ oot list› where ‹expand (ONEs n r) = replicate n ONE @ expand r› | ‹expand (TWOs n r) = replicate n TWO @ expand r› | ‹expand Empty = []› Liam O'Connor2025123https://liamoc.net/forest/isa-0024/isa-0024/forest/isa-0024/expand_prependTheorem lemma expand_prepend: ‹expand (prepend x n r) = replicate n x @ expand r› Liam O'Connor2025123Solution by (case_tac r; case_tac x; simp add: replicate_add) Liam O'Connor2025123https://liamoc.net/forest/isa-0023/isa-0023/forest/isa-0023/The compress functionDefinition primrec compress :: ‹oot list ⇒ oots› where ‹compress [] = Empty› | ‹compress (x#xs) = prepend x 1 (compress xs)› Liam O'Connor2025123https://liamoc.net/forest/isa-0025/isa-0025/forest/isa-0025/expand_compressTheorem lemma expand_compress: ‹expand (compress xs) = xs› Liam O'Connor2025123Solution by (induct xs;simp add: expand_prepend) Liam O'Connor2025123https://liamoc.net/forest/isa-0026/isa-0026/forest/isa-0026/compress_appendTheorem lemma compress_append: ‹compress (xs @ ys) = cat (compress xs) (compress ys)› Liam O'Connor2025123Solution by (induct xs; simp add: cat_prepend) Liam O'Connor2025123https://liamoc.net/forest/isa-0027/isa-0027/forest/isa-0027/compress_replicate lemmasTheorem lemma compress_replicate_ONE: ‹n > 0 ⟹ compress (replicate n ONE) = ONEs n Empty› Liam O'Connor2025123Solution apply (induct n; simp) apply (case_tac "n > 0"; simp) done lemma compress_replicate_TWO: ‹n > 0 ⟹ compress (replicate n TWO) = TWOs n Empty› Liam O'Connor2025123Solution apply (induct n; simp) apply (case_tac "n > 0"; simp) done Liam O'Connor 2025 12 3 https://liamoc.net/forest/isa-002N/ isa-002N /forest/isa-002N/ Rule Induction, Automation, Structured Proofs Lecture This lecture continues the theory file begun in Lecture . Liam O'Connor 2025 12 3 https://liamoc.net/forest/isa-0028/ isa-0028 /forest/isa-0028/ inductive predicates With the inductive command, we define a predicate by specifying a collection of inference rules, and the inductive predicate is the smallest predicate closed under those rules. In other words: An element satisfies the predicate exactly if it can be derived using the given rules. From the given rules, Isabelle automatically generates an induction principle (.induct) which can be used with the induct method (see Proof Method ) and a cases theorem (.cases) for use with the case_tac method. Liam O'Connor 2025 12 3 https://liamoc.net/forest/isa-002K/ isa-002K /forest/isa-002K/ Even numbers as an inductive Example inductive even :: "nat ⇒ bool" where even0: "even 0" | evenSS: "even n ⟹ even (Suc (Suc n))" Liam O'Connor 2025 12 3 https://liamoc.net/forest/isa-0029/ isa-0029 /forest/isa-0029/ induct (for rule induction) Proof Method You’ve already seen how to use induct for structural induction. Exactly the same induct method can also be used for rule induction, when your induction is over an inductively defined predicate, not over the structure of some datatype.When you define a predicate p with the inductive command, Isabelle automatically produces an induction rule named p.induct. This rule expresses how to perform induction over derivations of p x, one case for each introduction rule of the predicate.Although you could apply the raw rule with rule or erule, it is almost always easier to use: apply (induct rule: p.induct) This behaves just like structural induction: The goal is split into one subgoal per introduction rule of the predicate, and recursive premises of the rules give rise to induction hypotheses, added to your assumptions. Liam O'Connor 2025 12 3 https://liamoc.net/forest/isa-002L/ isa-002L /forest/isa-002L/ Even numbers are multiples of two Exercise lemma "even n ⟹ ∃m. (m * 2 = n)" Liam O'Connor2025123Solution apply (induct rule: even.induct) apply simp apply (erule exE) apply (rule_tac x = ‹Suc m› in exI) apply simp done Liam O'Connor 2025 12 3 https://liamoc.net/forest/isa-002A/ isa-002A /forest/isa-002A/ Wellformedness for oots Example We define well, an inductive wellformedness predicate for oots sequences, that state there are no segments of zero length, and that no two adjacent segments have the same oot value. inductive well :: ‹oots ⇒ bool› where ‹well Empty› | ‹n > 0 ⟹ well (ONEs n Empty)› | ‹n > 0 ⟹ well (TWOs n Empty)› | ‹n > 0 ⟹ well (ONEs m r) ⟹ well (TWOs n (ONEs m r))› | ‹n > 0 ⟹ well (TWOs m r) ⟹ well (ONEs n (TWOs m r))› Liam O'Connor 2025 12 3 https://liamoc.net/forest/isa-002B/ isa-002B /forest/isa-002B/ compress_expand Theorem lemma compress_expand:‹well s ⟹ compress (expand s) = s› Liam O'Connor2025123Solution apply (induct rule: well.induct) apply simp apply (simp add: compress_replicate_ONE) apply (simp add: compress_replicate_TWO) apply (simp add: compress_replicate_ONE compress_replicate_TWO compress_app) apply (simp add: compress_replicate_ONE compress_replicate_TWO compress_app) done Liam O'Connor 2025 12 3 https://liamoc.net/forest/isa-002C/ isa-002C /forest/isa-002C/ List subsequence relation Definition inductive subsequence :: ‹'a list ⇒ 'a list ⇒ bool› where ss_empty: ‹subsequence [] []› | ss_keep: ‹subsequence xs ys ⟹ subsequence (x#xs) (x#ys)› | ss_drop: ‹subsequence xs ys ⟹ subsequence xs (y#ys)› Liam O'Connor 2025 12 3 https://liamoc.net/forest/isa-002D/ isa-002D /forest/isa-002D/ Reflexivity of subsequence Theorem lemma ss_refl: ‹subsequence ls ls› Liam O'Connor2025123Solution apply (induct ls) apply (rule ss_empty) apply (rule ss_keep) apply assumption done Liam O'Connor 2025 12 3 https://liamoc.net/forest/isa-002E/ isa-002E /forest/isa-002E/ Length of subsequence Theorem lemma ss_length : ‹subsequence xs ys ⟹ length xs ≤ length ys› Liam O'Connor2025123Solution apply (induct rule: subsequence.induct) apply simp apply simp apply simp done Liam O'Connor 2025 12 3 https://liamoc.net/forest/isa-002F/ isa-002F /forest/isa-002F/ Controlling backtracking, chaining methods with comma Some methods (like erule when there are multiple matching assumptions) are nondeterministic, producing multiple alternative proof states.The back command interactively explores a different alternative branch produced by the previous step. lemma "C ∧ D ⟹ A ∧ B ⟹ A" apply (erule conjE) (* could apply to either assumption *) back apply assumption done This is useful for interactive exploration, but is very brittle and considered poor style.Instead, we can combine methods with the comma operator ,: The command apply (m1, m2) first runs m1, and then runs m2, accepting only the nondeterministic branches where the second method m2 succeeds. This avoids the need for back: lemma "C ∧ D ⟹ A ∧ B ⟹ A" apply (erule conjE, assumption) done Liam O'Connor 2025 12 3 https://liamoc.net/forest/isa-002G/ isa-002G /forest/isa-002G/ Repeating methods with + For a method m: apply (m)+ Repeatedly applies the m as many times as possible until it fails. It stops automatically when m can no longer make progress; and does not backtrack. Liam O'Connor 2025 12 3 https://liamoc.net/forest/isa-002H/ isa-002H /forest/isa-002H/ Antisymmetry of subsequence Theorem lemma ss_antisym: ‹subsequence ys xs ⟹ subsequence xs ys ⟹ xs = ys› Liam O'Connor2025123Solution apply (induct rule: subsequence.induct) apply simp apply simp apply (erule subsequence.cases, simp, simp, simp) apply (drule ss_length)+ apply (drule sym, simp) apply (drule ss_length)+ apply simp done Liam O'Connor 2025 12 3 https://liamoc.net/forest/isa-002I/ isa-002I /forest/isa-002I/ Generalising the induction hypothesis with arbitrary By default, structural induction induct t produces an induction hypothesis for the variables directly mentioned in t, and rule induction induct rule: p.induct produces a hypothesis for the variables directly mentioned by the eliminated p assumption. Sometimes you need a stronger hypothesis that generalises across additional variables in the goal. The arbitrary option tells the induct method to generalise certain variables, so the induction hypothesis assumes the property holds for all values of those variables. Liam O'Connor 2025 12 3 https://liamoc.net/forest/isa-002M/ isa-002M /forest/isa-002M/ Inequality as an inductive Example inductive myLE :: "nat ⇒ nat ⇒ bool" where base: "myLE 0 n" | step: "myLE m n ⟹ myLE (Suc m) (n+1)" Proving that this implies the normal inequality relation requires the use of variable generalising: lemma "myLE m n ⟹ m ≤ n" apply (induct m arbitrary: n) apply simp apply (erule myLE.cases; simp) done Liam O'Connor 2025 12 3 https://liamoc.net/forest/isa-002J/ isa-002J /forest/isa-002J/ Transitivity of subsequence Theorem lemma ss_trans: ‹subsequence ys zs ⟹ subsequence xs ys ⟹ subsequence xs zs› Liam O'Connor2025123Solution apply (induct ys zs arbitrary: xs rule: subsequence.induct) apply simp apply (erule subsequence.cases) apply simp apply clarsimp apply (erule subsequence.cases) apply simp apply clarsimp apply (rule ss_keep) apply simp apply simp apply clarsimp apply (rule ss_drop) apply simp apply simp apply clarsimp apply (erule subsequence.cases) apply clarsimp apply clarsimp apply (rule ss_keep) apply clarsimp apply clarsimp apply (rule ss_drop) apply clarsimp apply (rule ss_drop) apply simp done Liam O'Connor 2025 12 5 https://liamoc.net/forest/isa-002P/ isa-002P /forest/isa-002P/ blast, fast, slow, and best Proof Method blast is a method for automatic classical first-order reasoning, based on a tableaux prover. apply blast attempts a thorough search using sets of intro and elim rules. Like simp, rules can be annotated with [intro] and [elim] annotations, or they can be passed locally to blast (i.e. apply (blast intro: nandI1 nandI2 elim: nandE)) The methods fast, slow, and best use a different classical proof search engine than blast, each with a different proof search strategy. fast performs a quick, depth-bounded search, and is generally faster. slow is a more exhaustive search and more backtracking, and best performs a best-first search strategy using a heuristic based on the size of the goal. In general, if fast or blast can solve your goal, it will be the most efficient at solving it, whereas slow and best are only used if no other automated technique works. Liam O'Connor 2025 12 5 https://liamoc.net/forest/isa-002O/ isa-002O /forest/isa-002O/ Safe vs Unsafe Rules Rules such as conjI, impI, or disjE that cannot change a provable goal into unprovable goal(s) are called safe. Isabelle's automation strategies like safe rules because they can apply them without fear, or the need for backtracking. You can mark a rule as safe by marking it [intro!] or [elim!]. This can also be done locally when invoking methods like blast, fast, slow, and best. Liam O'Connor 2025 12 5 https://liamoc.net/forest/isa-002Q/ isa-002Q /forest/isa-002Q/ safe and clarify Proof Method The method safe applies only safe rules to the current goal. The method clarify is similar, but it only applies safe rules that do not split the goal into multiple subgoals. Like blast etc., rules can be added to these methods with intro!: etc. Liam O'Connor 2025 12 5 https://liamoc.net/forest/isa-002R/ isa-002R /forest/isa-002R/ clarsimp, slowsimp, bestsimp and fastforce Proof Method clarsimp the combination of clarify and simp, and is very useful when doing exploratory proving. slowsimp is the combination of slow and simp. bestsimp is the combination of best and simp. The combination of fast and simp is, for inexplicable reasons, called fastforce. Liam O'Connor 2025 12 5 https://liamoc.net/forest/isa-002S/ isa-002S /forest/isa-002S/ force and auto Proof Method force is a very thorough proof search that can often solve goals other methods can't. It can be thought of as a very thorough version of blast combined with simp. The method auto, by contrast, is a more lightweight search that attempts to simulateneously solve all goals, rather than just the first one. Unlike the other automated methods, auto will leave behind goals that it is unable to prove. Because the behaviour of auto differs greatly between Isabelle versions and is very sensitive to what theories are loaded, it's considered bad style to use auto as anything but the final step in a proof, but it can nonetheless be useful to see what goals auto outputs to see where it's getting stuck. Liam O'Connor 2025 12 5 https://liamoc.net/forest/isa-002T/ isa-002T /forest/isa-002T/ try and the famous Isabelle sledgehammer. Isabelle includes a feature called the sledgehammer that invokes external proof search procedures (such as SMT solvers) and provides them with lemmas that appear to be relevant. If the tools find a proof, it can often replay them in Isabelle's proof kernel, giving an Isabelle proof that matches what the external proof tool found. To invoke this procedure on a goal, searching automatically for related lemmas, type the word try in an open subgoal. Contributions