Dependently Typed Functional Programsand their Proofs

Conor McBride

Doctor of Philosophy
University of Edinburgh
1999

Abstract
Research in dependent type theories [M-L71a] has, in the past, concentrated on its use
in the presentation of theorems and theorem-proving. This thesis is concerned mainlywith the exploitation of the computational aspects of type theory for programming, ina context where the properties of programs may readily be specified and established.
In particular, it develops technology for programming with dependent inductive families of datatypes and proving those programs correct. It demonstrates the considerable
advantage to be gained by indexing data structures with pertinent characteristic information whose soundness is ensured by typechecking, rather than human effort.
Type theory traditionally presents safe and terminating computation on inductive
datatypes by means of elimination rules which serve as induction principles and, via
their associated reduction behaviour, recursion operators [Dyb91]. In the programming
language arena, these appear somewhat cumbersome and give rise to unappealing code,
complicated by the inevitable interaction between case analysis on dependent types
and equational reasoning on their indices which must appear explicitly in the terms.
Thierry Coquand’s proposal [Coq92] to equip type theory directly with the kind ofpattern matching notation to which functional programmers have become used overthe past three decades [Bur69, McB70] offers a remedy to many of these difficulties.
However, the status of pattern matching relative to the traditional elimination rules has
until now been in doubt. Pattern matching implies the uniqueness of identity proofs,
which Martin Hofmann showed underivable from the conventional definition of equality [Hof95]. This thesis shows that the adoption of this uniqueness as axiomatic issufficient to make pattern matching admissible.
A datatype’s elimination rule allows abstraction only over the whole inductively defined family. In order to support pattern matching, the application of such rules to specific instances of dependent families has been systematised. The underlying analysis
extends beyond datatypes to other rules of a similar second order character, suggesting
they may have other roles to play in the specification, verification and, perhaps, derivation of programs. The technique developed shifts the specificity from the instantiationof the type’s indices into equational constraints on indices freely chosen, allowing theelimination rule to be applied.

Elimination by this means leaves equational hypotheses in the resulting subgoals,
which must be solved if further progress is to be made. The first-order unification
algorithm for constructor forms in simple types presented in [McB96] has been extended to cover dependent datatypes as well, yielding completely automated solution
to a class of problems which can be syntactically defined.
The justification and operation of these techniques requires the machine to construct
and exploit a standardised collection of auxiliary lemmas for each datatype. This is
greatly facilitated by two technical developments of interest in their own right:a more convenient definition of equality, with a relaxed formulation rule allowing
elements of different types to be compared, but nonetheless equivalent to theusual equality plus the axiom of uniqueness;a type theory, O LEG, which incorporates incomplete objects, accounting for their‘holes’ entirely within the typing judgments and, novelly, not requiring any notion of explicit substitution to manage their scopes.
A substantial prototype has been implemented, extending the proof assistant LEGO
[LP92]. A number of programs are developed by way of example. Chiefly, the increased expressivity of dependent datatypes is shown to capture a standard first-orderunification algorithm within the class of structurally recursive programs, removing any
need for a termination argument. Furthermore, the use of elimination rules in specifying the components of the program simplifies significantly its correctness proof.

2

Acknowledgements
Writing this thesis has been a long hard struggle, and I could not have done it without agreat deal of friendship and support. I cannot thank my official supervisor Rod Burstallenough for his constant enthusiasm, even when mine was straining at times. Supervisions with Rod, whatever else they achieved, always managed to make me happy. It has
also been a pleasure to be part of the LEGO group, and indeed, the LFCS as a whole.
My slightly less official supervisors, successively James McKinna, Healf Goguen andMartin Hofmann, deserve my warmest gratitude. I hope I have done them justice. A
word of thanks, too, must go to Randy Pollack for his implementation of LEGO—if itwere not for his code, I could not have built mine.
My friends and family have been a constant source of love and encouragement. Thankyou, all of you. Finally, I cannot express how much I appreciate the flatmates I have
lived with over the last four years. Phil, Carsten, Melanie, even Firkin the cat, your forbearance is something for which I shall always be profoundly grateful. Your friendshipis something I treasure.

Declaration
I declare that this thesis is my own work, not submitted for any previous degree.

Table of Contents

Chapter 1 Introduction

6

1.1

overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

7

1.2

this thesis in context . . . . . . . . . . . . . . . . . . . . . . . . . . .

10

1.3

implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

15

Chapter 2

O LEG, a type theory with holes

16

2.1

the O LEG core . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

17

2.2

the O LEG development calculus . . . . . . . . . . . . . . . . . . . .

25

2.2.1

positions and replacement . . . . . . . . . . . . . . . . . . .

30

2.2.2

the state information order . . . . . . . . . . . . . . . . . . .

32

2.3

life of a hole . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

34

2.4

displaying an O LEG state . . . . . . . . . . . . . . . . . . . . . . . .

35

2.5

basic component manipulations . . . . . . . . . . . . . . . . . . . . .

37

2.6

moving holes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

39

2.7

refinement and unification . . . . . . . . . . . . . . . . . . . . . . .

40

2.8

discharge and other permutations . . . . . . . . . . . . . . . . . . . .

43

2.9

systems with explicit substitution . . . . . . . . . . . . . . . . . . . .

45

2.10 sequences, telescopes, families, triangles . . . . . . . . . . . . . . . .

46

Chapter 3 Elimination Rules for Refinement Proof
3.1

propositional equality (definition deferred) . . . . . . . . . . . . . . .
1

52
54

3.2

anatomy of an elimination rule . . . . . . . . . . . . . . . . . . . . .

55

3.3

examples of elimination rules . . . . . . . . . . . . . . . . . . . . . .

57

3.4

legitimate targets . . . . . . . . . . . . . . . . . . . . . . . . . . . .

61

3.5

scheming with constraints . . . . . . . . . . . . . . . . . . . . . . . .

63

3.5.1

simplification by coalescence . . . . . . . . . . . . . . . . .

66

3.5.2

what to fix, what to abstract . . . . . . . . . . . . . . . . . .

67

3.5.3

abstracting patterns from the goal . . . . . . . . . . . . . . .

69

3.5.4

constraints in inductive proofs . . . . . . . . . . . . . . . . .

70

an elimination tactic . . . . . . . . . . . . . . . . . . . . . . . . . . .

71

3.6.1

preparing the application . . . . . . . . . . . . . . . . . . . .

72

3.6.2

fingering targets . . . . . . . . . . . . . . . . . . . . . . . .

73

3.6.3

constructing the scheme . . . . . . . . . . . . . . . . . . . .

75

3.6.4

proving the goal . . . . . . . . . . . . . . . . . . . . . . . .

77

3.6.5

tidying up . . . . . . . . . . . . . . . . . . . . . . . . . . . .

77

3.6

3.7

an example— 

. . . . . . . . . . . . . . . . . . . . . . . . . . .

3.7.3

 
. . . . . . . . . . . . . . . . . . . . . . .
  
proving. . . . . . . . . . . . . . . . . . . . . . .
   . . . . . . . . . . . . . . . . . . . . . . . .
proving

3.7.4

proving the ‘introduction rules’ . . . . . . . . . . . . . . . .

3.7.1
3.7.2

constructing

Chapter 4 Inductive Datatypes
4.1

78
80
81
83
85
87

construction of inductive datatypes . . . . . . . . . . . . . . . . . . .

89

4.1.1

simple inductive datatypes like. . . . . . . . . . . . . . .

89

4.1.2

parameterised datatypes like 

. . . . . . . . . . . . . . . .

92

4.1.3

datatypes with higher-order recursive arguments, like  

4.1.4

dependent inductive families like the 

4.1.5

inductively defined relations like 
2



. .

94

s . . . . . . . . . . .

96. . . . . . . . . . . . . .

984.1.6

record types . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

4.2

a compendium of inductive datatypes . . . . . . . . . . . . . . . . . 103

4.3

abolishing  -types and reinventing them . . . . . . . . . . . . . . . . 103
4.3.1

4.4

the blunderbuss tactic . . . . . . . . . . . . . . . . . . . . . . 105

constructing Case and Fix . . . . . . . . . . . . . . . . . . . . . . 108
4.4.1

case analysis for datatypes and relations . . . . . . . . . . . . 108

4.4.2

the guarded fixpoint principle . . . . . . . . . . . . . . . . . 110

Chapter 5 Equality and Object-Level Unification
5.1

5.2

117

two nearly inductive definitions of equality . . . . . . . . . . . . . . . 118
5.1.1

Martin-Löf’s identity type . . . . . . . . . . . . . . . . . . . 118

5.1.2

uniqueness of identity proofs . . . . . . . . . . . . . . . . . . 119

5.1.3, or ‘John Major’ equality . . . . . . . . . . . . . . . . . . 119

5.1.4

equality for sequences . . . . . . . . . . . . . . . . . . . . . 120

5.1.5

the relationship between ! and. . . . . . . . . . . . . . . 124

first-order unification for constructor forms . . . . . . . . . . . . . . 127
5.2.1

transition rules for first-order unification . . . . . . . . . . . . 129

5.2.2

an algorithm for constructor form unification problems . . . . 133

5.2.3

conflict and injectivity . . . . . . . . . . . . . . . . . . . . . 136

5.2.4

cycle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140

5.2.5

a brief look beyond constructor form problems . . . . . . . . 149

Chapter 6 Pattern Matching for Dependent Types

152

6.1

pattern matching in ALF . . . . . . . . . . . . . . . . . . . . . . . . 155

6.2

interactive pattern matching in O LEG . . . . . . . . . . . . . . . . . . 157
6.2.1

computational aspects of elimination . . . . . . . . . . . . . . 158

6.2.2

conservativity of pattern-matching over O LEG

6.2.3

constructing programs . . . . . . . . . . . . . . . . . . . . . 166
3. . . . . . . . 162

6.3

6.4

recognising programs . . . . . . . . . . . . . . . . . . . . . . . . . . 173
6.3.1

recursion spotting . . . . . . . . . . . . . . . . . . . . . . . . 174

6.3.2

exact problems . . . . . . . . . . . . . . . . . . . . . . . . . 175

6.3.3

splitting problems . . . . . . . . . . . . . . . . . . . . . . . 176

6.3.4

empty problems . . . . . . . . . . . . . . . . . . . . . . . . . 177

extensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 178
6.4.1

functions with varying arity . . . . . . . . . . . . . . . . . . 178

6.4.2

more exotic recursion . . . . . . . . . . . . . . . . . . . . . . 181

Chapter 7 Some Programs and Proofs
7.1

7.2

7.3

184

concrete categories, functors and monads . . . . . . . . . . . . . . . 184
7.1.1

records for categories . . . . . . . . . . . . . . . . . . . . . . 185

7.1.2

records for functors . . . . . . . . . . . . . . . . . . . . . . . 187

7.1.3

records for ‘concrete’ monads . . . . . . . . . . . . . . . . . 188

substitution for the untyped " -calculus . . . . . . . . . . . . . . . . . 192
7.2.1

#$ , &%'  and (%) +*7.2.2

the substitution monad splits the renaming functor . . . . . . 201. . . . . . . . . . . . . . . . . . . . . . . 194

a correct first-order unification algorithm . . . . . . . . . . . . . . . . 210
7.3.1

optimistic optimisation . . . . . . . . . . . . . . . . . . . . . 212

7.3.2

optimistic unification . . . . . . . . . . . . . . . . . . . . . . 216

7.3.3

dependent types to the rescue . . . . . . . . . . . . . . . . . 217

7.3.4

correctness of ,.-0/

7.3.5

what substitution tells us about the occurs check . . . . . . . 226

7.3.6

positions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230

7.3.7% +* and 12 34 -5

. . . . . . . . . . . . . . . . . . . . . 233

7.3.8

comment . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236. . . . . . . . . . . . . . . . . . . . . . 221

Chapter 8 Conclusion

240
4

8.1

further work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242

Appendix A Implementation

245

Bibliography

247

Index

254

5

Chapter 1
Introduction‘The philosophers have merely interpreted the world in various ways. The(Marx and Engels)point, however, is to change it.’Computer programs are not expected to make sense. In fact, they are seldom expected
to work, which is as much as to say that computer programmers are not expected tomake sense either. This is understandable—programming is primarily a form of giving
orders.
Nonetheless, there are grounds for optimism. This is because programmers do notreally want genuinely stupid orders to be obeyed, and we understand that the more
sense we are able to make, the shorter our orders need be. The benefit comes by taking
the sense within the programmer’s mind and manifesting it explicitly in the program.
From named variables and looping constructs through to functional abstraction andmethod encapsulation, the evolution of programming languages has greatly facilitatedthe programmer who actively seeks to make sense. In particular, type systems now
allow so much sense to be made that they are even becoming compulsory in someindustrial programming languages. Where the purpose of typing in C is to indicate thenumber of bits left an array subscript should be shifted, strongly typed languages likeJava genuinely reduce the gullibility with which machine faces human.
It is with the objective of promoting sense in programs that I have pursued the researchdocumented in this thesis. Its main purpose is to show the advantage a dependent typesystem lends to the cause of principled programming.
Briefly, the principal contributions are these:
O LEG, a type theory with ‘holes’ (or ‘metavariables’) standing for the missing
6

parts of constructions explained entirely within the judgments of the calculus—
the state of a theorem prover may thus be represented as a valid judgment
the identification of what must be added to conventional type theories (such as
those underlying L EGO or C OQ) to facilitate pattern matching for dependent
types (as implemented in ALF)
a systematic view of elimination rules, leading to the use of derived elimination
rules to characterise and indeed specify programs in a compact and powerfulway

1.1 overview
This thesis records my development of technology to support functional programmingover dependent datatypes by pattern matching and structural recursion in an intensional
type theory. This technology also suggests novel tools and techniques for reasoning
about such programs. Let me give an overview, identifying the innovations.
I open with an account of a theorem proving in a type theory, O LEG,1 which is basedon Luo’s ECC [Luo94], but includes an account of ‘holes’2 in terms. There is a lot oftheorem proving in this thesis. Some of it is done by hand. Much of it is done by machines, manufacturing and exploiting standard equipment for working with datatypes
and equational problems. I therefore feel obliged to give a precise treatment not onlyof theorems but also theorem proving.
The novelty is that holes are handled much as other variables and accounted for bybinding entirely within the judgments of the system. This system is workable because
the core calculus of terms is embedded in a ‘development calculus’, which is where
the hole-bindings are to be found—a core term in the scope of a hole may nonethelessrefer to that hole. The effect of the separation is to prevent troublesome interaction
between computation and holes. Consequently, terms (called ‘partial constructions’)
in the development calculus enjoy the property that one may safely be replaced byanother of the same type—remarkably good behaviour for a dependent type system.
As a result, theorem proving in O LEG consists exactly of editing O LEG judgments
in ways which are guaranteed to preserve their derivability. Although O LEG is more
1

The name ‘O LEG’ is a tribute to Randy Pollack’s proof assistant L EGO. The new treatment ofpartial proofs required only a minor rearrangement.
2
also known as ‘metavariables’, ‘existential variables’, ‘question marks’ and many other names besides

7

restrictive than systems with explicit substitution, those restrictions will not hinder us
in the slightest.
The inductive datatypes we shall be concerned with are much like those of L EGO,C OQ[Coq97] or ALF [Mag94]. Their elements are introduced by constructor symbols
whose recursive arguments satisfy a strict positivity condition. Recursive computationand inductive proof are provided in the old-fashioned ‘elimination rule’ style. This
necessitated the innovation of principled tactical support for such rules, documented
in chapter three. However, the technology is not restricted to elimination rules arisingfrom datatypes.
The contribution from this thesis to the methodology of program verification lies in
the use of derived elimination rules to capture the leverage exerted by a given pieceof information on an arbitrary goal. The abstraction of the predicate in an induction
principle or the return type in a datatype fold operator point the way. Given a pieceof information, we have been indoctrinated to ask what we can deduce from it—weshould rather ask how we can deduce what we want from it. The tactics of chapter
three were developed to support datatype elimination rules, but they allow us to exploit
a wide class of rules which similarly abstract the type of their conclusions. I givenumerous examples capturing the behaviour of programs in this way, and I believe I
demonstrate the efficacy of the policy.
Once we understand elimination rules, we may give proper attention to inductive
datatypes. In particular, we may use chapter three’s technology to derive from each‘conventional’ eliminator a pair of alternative eliminators which usefully untangle thetreatment of case analysis and recursion on structurally smaller terms. This gives effectively the same presentation as the Case and Fix constructs which are primitive
notions in C OQ. The equivalence was established by Eduardo Giménez [Gim94]—
only minor adaptations are required to mechanise his construction. Chapter four isreassuringly unremarkable.
Case analysis on a restricted instance of an inductive family (henceforth a subfamily)
inevitably involves equational reasoning. For example, we may define the family oflists indexed by their length—when analysing the instance constrained to contain only
nonempty lists, we rule out the ‘nil’ constructor because the list it generates does notsatisfy that constraint. More generally, for each constructor, we must represent at theobject-level the constraint that its return type unifies with the subfamily under analysis. These constraints are similar to the unification problems which arise in ‘unfolding’transformations for logic programs [TS83, GS91]. My MSc work involved a systematic solution for simply typed problems in constructor form, implemented in the form8

of a tactic [McB96].
Chapter five extends the treatment to dependent types. Of necessity, this requires us
to compare sequences of terms where later elements may have propositionally equal
but computationally distinct types, an area which has always proved troublesome forintensional type theory. I present a new, slightly more relaxed definition of equality
which scales up to sequences without significant attendant clumsiness. It turns out tobe equivalent to the more traditional inductive definition augmented by the axiom that
identity proofs are unique. So equipped, we may easily prove for each datatype its ‘noconfusion’ property—constructors are injective and disjoint—in the form of a single
elimination rule. I also give a systematic proof that each datatype contains no cycles.
It is these lemmas which justify the transitions of the unification tactic.
In [Coq92], Thierry Coquand characterises a class of ‘pattern matching’ programs overdependent types which ensure that patterns cover all possibilities (deterministically)
and that recursion is structural. This is the class of programs made available (withunrestricted recursion) in the ALF system [Mag94]. Chapter six contains the principal
metatheoretic result of this thesis, confirming that the same class of programs can beconstructed from traditional datatype elimination rules, given uniqueness of identity
proofs. The meta-level unification in Coquand’s presentation is performed at the object
level by the tactic developed in chapter five.
By way of illustration, if not celebration, the work of the thesis closes with two substantial examples of verified dependently typed programs. Both concern syntax:
substitution for untyped " -terms, shown to have the properties of a monada structurally recursive first-order unification algorithm, shown to compute mostgeneral unifiers
It is well understood, at least in the type theory community, that we may only reallymake sense of terms relative to a context which explains their free variables. Bothof these examples express that sense directly in their data structures, a gain which isreflected in the correctness proofs.
Neither example is new to the literature of program synthesis and verification. Substitution has been treated recently [BP99, AR99] via polymorphic recursion, and I include
it simply to show that dependent types easily offer the same functionality, without recourse to counterfeiting index data at the type level.
The existing treatments of unification turn on the use of an externally imposed termination ordering. The novelty here is that by indexing terms with the number of vari9

ables which may occur in them, we gain access to computation over that index—thisis enough to capture the program for structural recursion. Witness the benefit from a
program which captures much more precisely the sense of the algorithm it implements.
Both developments adopt the methodology of characterising the behaviour of their subprograms by means of elimination rules. Establishing program correctness becomes
sufficiently easy that in presenting the proofs, I cut corners only where to do otherwise
would be monotonous in the extreme.
I would like to apologise for the length and linearity of this thesis. I hope it is notnearly as much trouble to read as it was to write.

1.2 this thesis in context‘I do press you still to give me an account of yourself, for you certainly
did not spring from a tree or a rock 67676 ’(Penelope. Odyssey, Homer)
I sprang from a little-known Belfast pattern-matcher in 1973. I have spent my whole
life surrounded by pattern matching, I have implemented pattern matching almost every year since 1988, and now I am doing a PhD about pattern matching with Rod
Burstall. Fortunately, my mother was not a computer scientist. Enough about me.
Martin-Löf’s type theory [M-L71a] is a well established and convenient arena in which
computational Christians are regularly fed to logical lions—until relatively recently,
much more emphasis has been placed on type theory as a basis for constructive logic
than for programming. Comparatively boring programs have been written; comparatively interesting theorems have been proven. This is a pity, as the expressiveness oftype theory promises much benefit for both. But things have changed.
Induction on the natural numbers was presented explicitly in different guises by Pascal
and Fermat in the seventeenth century, although it has been used implicitly for a lot
longer. Frege and Dedekind independently gave inductive definitions an explanation in
impredicative set theory. ‘Structural induction’ had been widely used in mathematical
logic [CF58, MP67] by the time Burstall introduced the notion of inductive datatypes
to programming, with elements built from constructor functions and taken apart bycase analysis [Bur69].
Inductive datatypes have escaped from programming languages [McB70, BMS80]3
and arrived in type theory [M-L84, CPM90]. Since then, they have become more
3

My father’s LISP-with-pattern-matching was a programming language which escaped from an inductive datatype.

10

expressive, with the indexing power of dependent type theory giving a natural home toinductive families of types [Dyb91]. For example, as hinted above, the polymorphic
datatype 98 , with constructors? ;78 @ ;=>8   ? @A;=B>8 :8<;=>8can be presented in a usefully indexed way as vectors—lists of a given length:)  CD; 

ECGF


?
)  ;7H   ? @A@A; ; ICKJICL(JTyping is strong enough to tell when a vector is empty, so potentially disastrous destructive operations like ‘head’ and ‘tail’ can be safely defused.
However, there are significant ways in which dependent datatypes are moretroublesome—the question is ‘what datatypes shall we have and how shall we compute with them?’. The datatypes and families proposed by Thierry Coquand, Christine
Paulin-Mohring and Peter Dybjer have been integrated with type theory in a numberof variations.
Zhaohui Luo’s UTT [Luo94] is closest to the traditional presentation, equipping families based on safe ‘strictly positive’ schemata with elimination constants doubling as
induction principles and recursion operators. This is a conservative treatment for which
the appropriate forms of good behaviour were established by Healf Goguen [Gog94].
Unfortunately, recursion operators make somewhat unwieldy instruments for programming, as anyone who has ever added natural numbers in L EGO[Pol94] will tell you.
Thierry Coquand’s 1992 presentation of pattern matching for dependent types [Coq92],
implemented in the ALF system by Lena Magnusson [Mag94], was shown to be nonconservative over conventional type theory by Hofmann and Streicher, since it implies
uniqueness of identity proofs [HoS94]. Pattern matching for the full language of inductive families is contingent on unification, which is needed to check whether a given
constructor can manufacture an element of a given family instance. Unification, once
it escapes from simple first-order syntaxes, becomes frightening to anyone with a welldeveloped instinct for survival, although some do survive.
Subsequent systems in the ALF family, such as Agda [Hal99], have been much morecautious about what datatypes they will allow, in order to be much more generous withfacilities for working with them. In particular, the question of unification is avoided byforbidding datatype constructors to restrict their return types to a portion of the family11

(eg, empty vectors, nonempty vectors). Families are declared in a similar manner todatatypes in functional programming languages:

M5&MN#EM5,.OQPSRT67676UPWVYX GZ RT676[6 Z \^] 67676


The indices PTR_6[676(P`V are distinct variables, indicating that each constructor  , whatZZ \ever its domain types R_6[676 , its range is over the entire family Pattern matching overan instantiated subfamily just instantiates the P ’s in the types of the constructors, rather
than generating an arbitrarily complex unification problem.
This is a sensible restriction with a sound motivation. It is also a serious one, forbidding, for example, the formulation of the identity type—the reflexivity constructor
restricts its return type to the subfamily where the indices are equal. As we decompose
elements of these datatypes, their indices can only become more instantiated—Agda
datatype indices only ‘go up’.
Some of the power lost in this way is recaptured by computing types from data. For
example, the type of vectors, although not a datatype in Agda can be computed fromthe length index:




aC
a C

F
& J
X

X

b 
8.cd

aCeJ+fThis kind of computed type is good for data which are in some way measured by theindices—elements are finite, not because they contain only finitely many constructor
symbols per se, but because, as we decompose them, their indices recursively ‘godown’ some well-founded ordering. There is no place, in this setting, for inductive
families whose indices, like those of the stock exchange, can go down as well as up.
The practical limitations of this system require further exploration. Certainly, the removal of unification from the pattern matching process makes it considerably morestraightforward to implement attractively and to grasp. It has been even been implemented outside the protective environment of the interactive proof assistant—inLennart Augustsson’s dependently typed programming language, Cayenne [Aug98].
Cayenne allows general recursion, hence its typechecker requires a boredom thresholdto prevent embarrassing nontermination. Of course, the programs which make sense
do typecheck, and some interesting examples are beginning to appear [AC99].
On the other hand, two recent examples—both implementations of first-order unification, as it happens—cannot be expressed as they stand in this restricted system. Ana
12

Bove’s treatment [Bove99] shows that a standard Haskell implementation of the algorithm can be imported almost systematically into type theory. However the generalrecursion of the original is replaced by ‘petrol-powered recursion’4 over an inductively
defined accessibility predicate [Nor88] which can be expressed in ALF, but not its
successors.
My implementation, in chapter seven of this thesis, is dependently typed, and exploits
the power of ‘constraining constructors’ to represent substitutions as association lists ina way which captures the idea that each assignment gets rid of a variable. Variables arefrom finite sets indexed by size,  J , and terms are trees over a number of variables,
& J . Association lists, MghJ , represent substitutions from g variables to terms
over J :M   i;=M5>JjJ

Pk;=  &g  @A;=( g lm;=MB>gYJ
M  nPj@olm;=MBW&gYJ

Having said that, I am quite sure that ‘gravity-powered’ unification can be implemented
in Agda using the restricted type system. I only use association lists because my application of substitutions is delayed and incremental. If you are happy to apply substitutions straight away, a functional representation suffices. Nonetheless, the M type
stands as a useful data structure—a ‘context extension’—which one might reasonably
hope to represent as a datatype.
The C OQ system [Coq97] has inductive families of types with strictly positive
schemata [P-M92, P-M96]. However, they have moved away from the traditional‘one-step’ elimination operator, following a suggestion from Thierry Coquand: they
now divide elimination into a Case analysis operator and a constructor-guarded Fixpoint operator. Eduardo Giménez’s conservativity argument [Gim94] is bolstered by astrong normalisation proof for the case of lists [Gim96]—he has recently proved strong
normalisation for the general case [Gim98]. Bruno Barras has formalised much of themetathory for this system [Bar99], including the decidability of typechecking.
This Case-Fix separation is a sensible one, and it makes practical the technology
in this thesis—working in what is effectively Luo’s UTT [Luo94], I start from thetraditional ‘one-step’ rule, but I have mechanised the derivation of Case and Fix foreach datatype. Everything which then follows applies as much to C OQ as to L EGO.
There is, though, a noticeable gap between programming by Case with Fix in C OQ
and programming by pattern matching in ALF or Cayenne. This gap has been addressed by the work of Cristina Cornes [Cor97]. She identifies a decidable class of4

my phrase13second-order unification problems which captures many pattern matching programs
viewed as collections of functional equations. Solving these problems mechanically,
she has extended C OQ with substantial facilities for translating such programs in termsof Case and Fix.
This takes the form of a macro Cases which allows pattern matching style decompo 4J
sition of multiple terms from unconstrained inductive families (eg—vectors ofarbitrary length) and combines with Fix to yield recursive function definition in thestyle of ML. Although the full gamut of dependent families can be defined, she has
adopted an Agda-like solution to the problem of computing with them.
The task of implementing pattern matching for constrained instances of inductive famS 2(J —nonempty vectors) she leaves to the future. Where
ilies (or ‘subfamilies’, eg
she leaves is where I arrive. I have not attempted to duplicate her machinery for thetranslation of equational programs. Rather, I have concentrated on the problem of caseanalysis for subfamilies, the last gap between her work and dependent pattern matchingin ALF.
As I have already mentioned, we have known for some time that dependent patternmatching is not conservative—it implies the uniqueness of identity proofs, which does
not hold in Hofmann’s groupoid model of type theory [HoS94, Hof95]:

5p    /
5p  /

;rqs8t;vu[wyxTz(6{qs|5;a8}6~qs ;E|> !W|`6  !   |8| d$ |sfX d$ |sf

This points to a very real connection between pattern matching and the power of equality in type theory. Case analysis on inductive subfamilies (also known as ‘inversion’)
necessarily involves equational reasoning—for each constructor, we must check that its
return type unifies with the subfamily we are analysing. These unification problems resemble those which arise in unfold/fold program transformation [BD77, TS83, GS91].
They are treated at the meta-level in ALF [Coq92, Mag94].
Cristina Cornes made some progress in this area with her tactics for inverting inductively defined relations over simply typed data in C OQ[CT95]. My MSc project was toimport this technology for L EGO. I made explicit the separation between, on the one
hand, the splitting of the family into its constructors, with the subfamily constraints
becoming object-level equations, and on the other hand, the simplification of those
constraints. I implemented a complete first-order unification algorithm for object-level
equations over constructor forms in simple types [McB96].
The uniqueness of identity proofs contributes directly to the extension of this firstorder unification algorithm to dependent types, yielding explicit object-level solutions
14

to the same class of unification problems which ALF handles implicitly.5 The last gap
between programming with datatypes in L EGO or C OQ and pattern matching in ALF
has now been bridged.
Building that bridge has involved many engineering problems and the development ofsome, I feel, fascinating technology. In particular, the tactic which I built for deploying
the elimination rules of inductive datatypes has a potential far beyond that purpose. I
have begun to explore the use of rules in that style for specifying and proving propertiesof programs: this thesis contains several examples.

1.3 implementation
I have implemented a prototype version of the technology described in this thesis as anextension to L EGO. It contributed to, rather than benefiting from the full analysis set
out here. Nonetheless, let me emphasise at this stage that although the prototype could
work better, it does work.
Enough technology has been implemented to support all the example programs andproofs in this thesis. They have all been built with O LEG’s assistance and checkedwith L EGO—core O LEG is a subset of L EGO’s type theory for which Randy Pollack’s
typechecker runs unchanged. Sometimes I have had to hand-crank techniques I havesubsequently shown how to mechanise, but the developments described in the thesis
are an honest account of real machine proofs.

5

In fact, ALF rejects cyclic equations as unification problems which are ‘too hard’, while I disprovethem, so four years’ work has been good for something.

15

Chapter 2
O LEG, a type theory with holes
Although you have just started reading this chapter, I have nearly finished writing it.
When I started, a long time ago, I intended it to be an unremarkable summary of afamiliar type theory, present largely out of the need to present the notational conventions used in this thesis. However, despite my best intentions, this chapter does containoriginal work—it describes a type theory, O LEG, which gives an account of incomplete
constructions quite different from those in existing use.
Let me say from the outset that I did not set out to invent such a thing. For someyears I have been writing programs which construct L EGO proofs of standard datatypeequipment—constructor injectivity and so forth—together with tactics to deploy them.
I began, in my MSc work, with direct synthesis of proof terms in the abstract syntax—
this was, frankly, rather painful. However, as time went on, the tools I was building
myself looked more and more like a theorem-prover. Eventually, the penny dropped—
synthetic programming and proof is only for clever people with nothing better to do;busy people and stupid machines need an analytic framework with a sound treatmentof refinement. What had previously been ‘voodoo’, an ad hoc assortment of syntactic
trickery, became O LEG, a type theory for machines as well as people.
O LEG was thus manifest in code long before it was rationalised in this chapter. I
put it together with the help of many spare parts from Randy Pollack’s L EGO code.
L EGO’s treatment of ‘metavariables’ is remarkable in what it allows—too remarkable,
in fact. Scope is not quite managed properly, so that the reliability of L EGO still liesin the final typecheck of the completed term. I did not consider it my business torepair this problem—I was looking for a more convenient way to represent proofswith-holes for mechanical manipulation. I hit upon the idea of binding holes in thecontext because it required very little alteration of the term syntax, and because it madeoperations like refinement’s ‘turn the unknown premises into subgoals’ just a matter of16

turning q s into  s. This treatment of holes resonates strongly with Dale Miller’s explicit
binding of existential variables in the ‘mixed’ quantifier prefix of unification problems[Mil91, Mil92].
At the time, explicit substitution was not even an issue. If I had wanted to maintain the scope of holes via such technology (as is found in the ALF family [Mag94]
and Typelab [vHLS98]), I should have had to re-engineer the whole L EGO syntax, reduction mechanism and typechecker. As it turned out, my adaptations were minimal.
There is a profound reason for this—where explicit substitution relies on ingenuity,
O LEG relies on cowardice. Instead of repairing the troublesome interactions between
holes and computation by propagating bits of stack through the term structure, O LEG
simply forbids them.
However, let me keep you in suspense no longer. O LEG consists of a computational
core—Luo’s ECC [Luo94] with local definition [SP94] but without  -types—wrappedin a development calculus, in much the same way that Extended ML [KST94] wraps
core Standard ML [MTH90]. My reason for the separation is precisely the aforementioned cowardice with respect to holes and computation.
Extended ML’s treatment of holes profits from the fact that, in simple type systems, it
is always safe to replace a term (eg, the placeholder ‘?’) with another of the same type.
Although there is no way that core terms in a dependent type theory could ever hope tohave such a replacement property (for a counterexample see section 2.2), it does holdfor the terms (or ‘partial constructions’) of O LEG’s development layer. This single
metatheorem does most of the work in O LEG’s successful reconstruction of refinement
proof as we know it.

2.1 the O LEG core
D EFINITION: universes, identifiers, bindings, terms]

u[wyxTz
universes Y;E;X'ax
where  is a natural number

identifiers ;E;XP]+] 67676

Let us allow ourselves countably many identifiers.
I define families of bindings and terms indexed by the finite set of variables^  permitted to appear free in them. My motivation is to ensure that17

identifiers are only used where they are meaningful.1

 of variables, and any P not in  the sets   of bindings of 
extending and u  of terms over are defined inductively2 as follows:} u  u >  u 
 PX  ;   
qsP;   ">P;   ¢     @  u S£4¤¦¥[§¡ (  u     u¡  u u
¢ 6¨@  u 
For any set

Binding is the means of attaching to an identifier properties such as ‘type’, ‘value’ andany other behavioural attributes in which we may be interested. A structural linguist,
following Saussure [Sau16], might point out that identifiers, like words, have no intrinsic significance. Variables, on the other hand, are signs. Binding creates a sign, linking
signifier and signified.
Syntactically, a binding is a binding operator, followed by an identifier, followed bya sequence of properties each introduced by a special piece of punctuation, eg ‘:’ for‘type’ or ‘=’ for ‘value’. The binding operator determines the computational role ofthe variable. I would encourage you to think of bindings as important syntactic entities
in their own right, and the ‘.’ as a combinator which attaches a binding to its scope
which, by convention, extends rightwards as far as possible.
O LEG’s core binding operators comprise the usual q (often written © ) for universalquantification and " for functional abstraction, together with (pronounced ‘let’) representing local definition. I describe those bindings where the bound variable occurs
nowhere in its scope as fatuous.
As usual, application is indicated by juxtaposition and associates leftwards. I shall Z that variable P occurs free in term Z . When P« ª Z , I shall freely
denote by P

 Z

D¬ Z

abbreviate qsPG; 6 by
. Further, otherwise identical consecutive bindings of   Z
distinct variables may be abbreviated with commas, ">P­; 6W" ; 6 , for example,
  Z
becoming "=P  ; 6 .

® -convertible terms are identified, with ¯ representing the consequent notion of synn± Z
tactic identity. Let ° P`² denote the result of substituting for free occurrences of
P Z

in . Formally, we might prefer to live in a de Bruijn-indexed world [deB72]; informally, let us grant ourselves the luxury of names and the associated luxury of ignoring
the issue of variable capture.
1

My ulterior motive is to prepare the ground for the application of dependently typed functional
programming to syntax in chapter seven.
2
Natural deduction is the best style I have found for presenting indexed inductive families.

18

Having introduced all this syntax, let us abuse it wherever it suits us. We are notmachines, and we can suppress inferrable information which machines might demand.
To be sure, the machines are catching up, with work on implicit syntax from [Pol90]
and beyond. I do not propose to give any mechanistic account of the arguments I
shall omit, the parentheses I shall drop and the ad hoc notations I shall introduce—the
purpose is purely presentational.
D EFINITION: contexts and judgments
The set ³´¶µ2´ of contexts is defined inductively:¹  ³s´¶µ=´  u>º P» ª ¹¹ ¼ P;  ³s´¶µ=´·v¸ ³s´¶µ=´¹  ³´¶µ2´ =  u2º P» ª ¹¹A¼ PX  ; } ³´¶µ2´Note that we may treat a context ‘forgetfully’ as a set of variables, hence
u=º is the set of terms over ¹ .

¹ ¹³s´¦µ2´ , then ½ º is the set of -judgments. If ¾
Ifthat ¾ holds by writing ½ , we may assert
º

¹À¿ ¾

½ º contains context validity and typing judgments:@  Z Z   u>º@ ;½ºvalid ½ º
In many presentations, a context is an assignment of types to identifiers. Here, value
assignments are also permitted. Let us also indulge in a slight abuse of notation andwrite whole bindings in the context, effectively annotating entries with binding operators and perhaps additional properties.3 Seen as a data structure, for example in theimplementation of L EGO, a context is a stack of bindings. We can recover the ‘formal’contexts defined above simply by forgetting the extra annotations. We shall often needto check whether a given variable has a particular property, whether or not it may have
¹ ¼ Z ¼y¹SÁ for a context where P has the property that
others. Let us, for example, write PQ;
Z
its type is , regardless of other annotations.
As we explore a term, each variable we encounter is given its meaning by the stack ofbindings under which we have passed. A variable is not a name; it is a reference to a3

It is often useful to know what colour a variable is.

19binding. Names arise as a social phenomenon—just as in the story of Rumpelstiltskin,
naming things gives us power over them.
Let us now define computation with respect to a context. We should feel no apprehension at this. Quite the reverse, syntax only makes sense relative to the context which
explains its signs. Goguen’s typed operational semantics for type theory [Gog94] necessarily and naturally involves the context, significantly reducing the cost of metatheory. Although the contextual information he requires is active in typing and passive
in computation, this is more an accident of ECC than an inevitable restriction. Compagnoni and Goguen’s more recent typed operational semantics for higher-order subtyping [CG99] exploits the potential to the full.
M ANTRA:¹ is with me, wherever I go.
I, too, feel strongly provoked to exploit the potential he reveals by increasing the activity of the context in computation. Real programming language implementations keep
values in stacks.
We may still employ the usual technique of supplying a number of contraction
schemes which indicate the actual computation steps, together with a notion of compatible closure which allows computation to occur anywhere within a term.
D EFINITION: contraction schemes
O LEG’s contraction schemes are shown in table 2.1.

Subterms susceptible to the Â , Ã or contraction schemes are, respectively, Â -, Ã - and -redexes. Note that the property of being a Ã -redex is implicitly context-dependent. A
term is in normal form if it contains no redexes.
It is perhaps helpful to think of ÄÆÅ and ÄÈÇ as ‘work’, while ÄÊÉ is ‘waste disposal’.
As a fan of Fritz Lang’s 1926 classic silent film, ‘Metropolis’, I like to imagine what
computation sounds like: Â -reduction sounds like paper-shuffling; Ã -reduction soundslike filing cabinets and photocopiers; pops like sudden suction.
D EFINITION: compatible closure
If ÄÊË is a contraction scheme, its compatible closure, Ä20

Ë , is given by 2.2ÂÃ¹«¿ vd ">PÌ;  67@&f  ÄÆÅ  PLX  ;  6Í@¹ ¼ PLX  ;  ¼y¹SÁÎ¿ PÏÄÈÇ ¹À¿  PGX  ;  6¨@ÐÄÊÉ@ P. ª @Table 2.1: contraction schemes¹Ñ¿  ÄÊË  Á¹ ¿  Ä Á
Ñ
Ë ¹«¿
Á
¹Ñ¿  Ä  ÁÒ@Ä@¹À¿  @ÒÄ Ë  Á @¹À¿  @ÒÄ Ë  @ ÁË
¹À¿  Ä  Á¹À¿ Ë  Ä  Á¹Ñ¿ qsPÓ;  6 Z Ä Ë qsPÌ;  Á 6 Z¹«¿ "=PÌ;  6Ô@ÐÄ Ë ">PÌ;  Á 6Ô@¹À¿  Ä Ë  Á¹À¿  Ä  Ë Á¹À¿  PLX  ;  6¨@ÐÄ Ë  PGX  Á ;  6Í@¹À¿  PX  ;  6@ÒÄ Ë  PGX  ;  Á 6Í@ËË
¹ ¼y¢  ¿ @ÐÄ @ Áº¹«¿Õ¢  6@ÒÄ ¢ Ë  6¨@ ÁºË ºTable 2.2: compatible closure¹«¿ ×XÖ Z¹À¿ Ø Z¹À¿hÙ ØÏ ¹«¿ }Ø Z¹Ñ¿ÚÙ Ø Z
Ü¹À¿ 'ax Ø u[wyxTz ¹Ñ¿ u[wyÛxTYz¨ Ø u[wyxTz \¹À¿ ÝÖX  Á ¹ ¼ qsP;  Á ¿ Z Ø Z Á¹À¿ qsPÓ;  6 Z Ø qsPÌ;  Á 6 Z Á
Table 2.3: cumlativity

21

emptydeclaredefine

prop

type

var

imp

all

abs

app

let

cuml

·(¸ ¿

valid

¹Ñ¿  ;Ìu[wyxTz
 Þ q  "Sß¹ ¼y¢ PÌ;  ¿ valid ¢ .

¹À¿¹ ¼  PGX  ;   ;¿ valid¹À¿ valid¹À¿ ' axÈ;Ìu[wyxTzaà¹À¿¹À¿ u[wyxnz  valid;Qu[wyxnz Bá R¹ ¼  ¼y¹ Á ¿ valid¹ ¼ PQPQ; ;  ¼y¹SÁ¿ PÑ; ¹ ¼ qsP;  ¿Úâ ;Ì'ax¹Ñ¿ qsPÌ;  6 â ;Q'ax¹ ¿  ;u[wyxTz ¹ ¼ qsP;  ¿ Z ;Ìu[wyxTz¨À¹À¿ qsPÌ;  6 Z ;Qu[wyxTz
¹ ¼ ;  ¿ @}; Z¹Ñ¿ ="=" PPÓ;  6Ô@;qsPÓ;  6 Z¹À¿ ¡ ;ãqsPÌ;  6 Z ¹À¿  ; ¹À¿ ¡  ;  PX  ;  6 Z
Z¹ ¼   ¿¹À¿  PXPLX  ;  ; 6Í@;  PG@X ;  ;  6 Z¹À¿ @;  ¹À¿ Ø Z¹À¿ @; Z
Table 2.4: O LEG core inference rules22M ETATHEOREM: Church-Rosser¹À¿  ÖX @implies existence of a common reduct ä such that¹À¿ å ä¹À¿ @ å ä

M ETATHEOREM: strengthening¹ ¼   ¼¹ Á ¿ @; ZºP ª ¹ Á  @ Z

implies¹ ¼y¹SÁÎ¿ @; Z

M ETATHEOREM: subject reduction¹À¿  ; Z¹À¿ å @implies¹À¿ @; Z

M ETATHEOREM: strong normalisation¹À¿ @; Z
ensures that @ is strongly normalising.

M ETATHEOREM: cut¹ ¼  PGX  ;  ¼y¹SÁÎ¿ @; Z

implies¹ ¼ °  ± P`² ¹SÁÎ¿ °  ± WP ²@};K°  ± PW² Z
Table 2.5: metatheoretic properties

23

Henceforth, I shall elide the context in casual discussion. I write Ä for the union of thelabelled compatible closures, and å for its finite transitive closure. A term is strongly
normalising if admits only finite sequences of reductions. The smallest equivalenceÖ
relation closed under å is called conversion and denoted X .

Observe that -binding allows us to avoid meta-level substitution in describing computation. Explanations of identifiers are activated by putting them into the context, not by
propagating them through terms. The traditional Â -contraction

d("=PQ;  6Í@(f  Ä°  ± PW²I@

becomes a ‘noisier’ reduction sequenced("=PQ;  6Í@(f  Ä Å  PLX  ;  6Í@Ä ÇæÍæÍæ  PGX  ;  69°  ± PW²I@Ä É °  ± P ²@Following Luo, I combine the notions of conversion and universe inclusion in a type
Öcumulativity preorder with respect to X :D EFINITION: cumulativity
The cumulativity relation,

Ø , is defined inductively in table 2.3.

ØIn [Luo94], Luo shows that is antisymmetric and hence a partial order with respectZÖ
¹
to X . In fact, every well-typed term @ (under ) has a principal type in the sense that¹Ñ¿ @; Z Áçè¹À¿ Z Ø Z Á .

Consequently it will be my habit to omit the index in u[wyxTz where uncontroversial—
this phenomenon is known as typical ambiguity [HP91]. In practice, the cumulativity
constraints required to ensure consistency of any development can be stored as a finite
directed graph and checked for offending cycles.
The system of inference rules for the validity of contexts and typing judgments in the
O LEG core calculus is given in table 2.4. The formulation is slightly unusual in thatit involves no meta-level substitution in types—the same job is done by the computational behaviour of local definition, as performed by the cuml rule.
All the usual metatheoretic properties (see table 2.5) hold as we might expect them to.
They contribute no insight unavailable from the Luo’s treatment of ECC in [Luo94].
Severi and Poll have shown how to extend dependent type systems with local definitions [SP94]. The Church-Rosser property follows by the ‘parallel reduction’ argument of Tait and Martin-Löf, as modernised by Takahashi[Tak95]. Subject reduction,24

strengthening and cut follow by induction on typing derivations, differing only in minor details from the proofs for ECC. I have omitted weakening from the list because it
is a special case of the monotonicity property which I shall prove in section 2.2.2.
Strong normalisation for the O LEG core is a direct consequence of strong normalisation
for ECC. In the style of Severi and Poll, a type-preserving translation maps O LEG
terms to ECC terms adding apparently pointless Â -redexes4 , so that each step in an
O LEG reduction sequence can then be simulated by a step in an ECC reduction of its
translation. Consequently, an infinite reduction sequence for a well-typed O LEG term
becomes an infinite reduction sequence for a well-typed ECC term, and we know thatno such thing exists.
The interesting aspect of O LEG is its development superstructure. Let us now give ourattention to that.

2.2 the O LEG development calculus‘You can’t put a hole where a hole don’t belong.’(Bernard Cribbins)

Holes stand for the parts of constructions we have not yet invented. Every hole shouldtell us two things about the candidates which may fill it:
their type,Z¹

the context, , of variables they may employ
We may ascribe these properties to the hole itself, by way of convenient abbreviation.
¹ ¿ @h; Z .
The point is that it must be safe to fill such a hole with any @ such that
Solutions must be locally checkable if working with holes is to be practicable.
As I have already mentioned, the treatment of holes for simple type systems is greatly
helped by the fact that terms do not ‘leak’ into types. Consequently, any subterm
may safely be replaced by another of the same type, without affecting the type of thecontaining term—local checkability of hole solutions is just one special case. Holes
may safely be represented by unlabelled ? symbols, as typing places no dependency
between them.
4

It may help to think of the translation to ECC as tying old tin cans onto terms to make the ECC
reduction as noisy as the O LEG reduction.

25

However, the application of a dependently typed function smuggles the argument term
into the result type—this is why the replacement property fails. Consider the following
example, in a context defining an equality symbol for natural numbers:"!êé ;  ¬   ¬ 'ax"2ë7ì{íéÑ;rqsJÒ;  6 J !)é'J"WîðïWñ é ;rqsg Jj; 6Bgò!êé J ¬ J !)é)g
It may be reasonable to infer thatîðïWñ é Ód¦ë[ì~í5éNÔfó;Ô[!+é5
but we may not instantiate any of the ?s and retain this typing unless we instantiatethem all— îðïWñ é ’s first two arguments appear in the required type of d¦ë[ì~í5éÔf .

Somehow we must represent the information that the three ?s in îôïWñ é Ójd¦ë[ì~í5éÔf
signify the same, and what more natural way could we choose than to give them asingle sign?

Hence, let us invent a new binding operator ‘?’ (pronounced ‘hole’) to introduce variables standing for holes in a proof which must be instantiated by a common candidateof an appropriate type. We may now add to the context

BP; and inferîðïWñ é PQPGd¶ë7ì{íéÛPofó;APW!)é)P
When we think of a suitable candidate, we may ‘solve the hole’ by changing the  binding to, say, PGX^FÌ; , and the typing will stand.
However, the danger has not gone away. We could quite reasonably inferîðïWñ é d(BJÒ;  6BJêf dvJÒ;  6BJêf d¦ë[ì~í5éNBJj;  6BJ+fó;ÍJÐ;  6õJÛ!)éNBJÐ;  6BJ
BJG;  6~Jsince one binding
is syntactically identical to another, even if we regard thebound variables as distinct (indeed, not in the same scope). We are not free to solve
one without the others, so we must avoid this situation.
The point is that although there is nothing wrong with holes leaking into types, disaster strikes if we permit  -bindings to do so. The O LEG development calculus ensures26

that  -bindings are always in safe places—ie, that they may always be solved independently. Indeed, this arises as a corollary of a more general replacement property, justlike in the simply typed case.
By introducing an explicit binding operator for holes, O LEG follows Dale Miller’s lead
[Mil91, Mil92] in representing the state of the system as a judgment whose context or‘mixed prefix’ explains the variously quantified variables involved.
The O LEG development calculus represents the store of a theorem prover directly at
the judgment level. Theorem provers tend to contain four kinds of information:
assumptions
proved theorems
unproved claims
partial proofs of claims
These four components are each represented by a form of binding—respectively, thefour given in the definition below. A state is a context of such bindings. The terms ofthe development calculus are called partial constructions.
D EFINITION: states, components and partial constructions
states ö´U÷~´vz·&¸ ö´U÷r´Uz
 Sú components ³   for Pø« ö´v÷~´vz ù  ³  
ø ¼ ù  ö´v÷~´Uz  u

"=P; } ³   u BP; } ³  partial constructions  @  u @  =   u 
 PX  ;  ³  û    } u BPü û ;  ³  ù  ³   ý    S£4¤¦¥r§ùÎ6 ý  
27

Observe that partial proofs, or ‘guesses’ are attached to holes with a ‘ ü ’ symbol, indi
cating that they have not the computational force of -bound values attached with ‘=’.
ø
Indeed, we may view any state as a core context by forgetting all but the ‘:’ and ‘=’
properties of each variable. This, in particular, means that guesses are invisible to the
core.

ø

ø

Statesin the development calculus are equipped with -judgment forms þz&ÿ$½ þz&ÿ$½ , we may assert that ¾ holds bycorresponding to those of the core. If ¾
ø  ¾.
writingþz&ÿ$½ is given byý    Z  uý ;=uþ z(ÿ$½

valid þz(ÿ$½

Even the abstract form of the typing judgment contains an important piece of
information—the development calculus does not extend the type system, only the language of terms. Holes are never bound to the right of the ‘:’. This only serves toemphasise the analytic view that types come before terms—we do not explain termswith types, we search for terms inside types.

ø ¿Table 2.6 shows the new inference rules. Note that core judgments¾ only validate
ø viewed forgetfully as a core context—any guesses in ø will not be checked. Thisø  valid premises appearing in some rules.
accounts for the extra
The analogous metatheoretic properties from table 2.5 continue to hold for this extended system. The parallel reduction treatment for Church-Rosser and the derivationinductions for subject reduction, strengthening and cut can easily be adapted. Strong
normalisation for the development calculus reduces to strong normalisation for thecore by a translation argument which adds the assumption vgj| JWÐ;4qs8t;vu[wyxnz(68 at theroot of the context and turning  -bindings into -bindings: every hole without a guess,P;  , becomes PGü (gÐ| JW  ;  , then the translated guesses become  -bound values.
The core terms are embedded in the partial constructions. The forgetful interpretationof states as core contexts allows variables to appear in partial constructions via theterm rule. The effect of the core/development separation is thus to restrict where holes
may be bound. A partial construction containing no  -bindings is said to be pure, thatis, expressible as a core term. Pure terms may, of course, refer to variables  -bound intheir context.

In particular,  -bindings cannot occur inside applications or -bound values. This isenough to ensure that they have no interaction whatever with computation.  -bindings
28

state validity

·&¸ 

empty

ø


ø ¼ ùPQ;
valid

declare

ø



valid

ø ¿  ;u[wyxTz  definevalid 
ø ¼  PG
X ;

valid

 Þ "  2ßù ­ø ¿  ; 

valid

ø 

ø ¼ BPLü ý ; ý ; valid

constructtyping partial constructions
term

abs

let

hole

guess

cuml

ø ¿ @; Z@}; Z
ø ¼ "=Pk;   ý ; Z
ø  ">PÌ;  6 ý ;ãqsPÓ;  6 Z
Z
ø ¼   ø m PLPLX X  ;  ; 6 ý ;  Pý X ;  ;  6 Z
ø ¼ BPk;   ý ; Zø  PÌ;  6 ý ; Z P ª Z
ø ¼ PLü û ;   ý ; Zø  BPLü û ;  6 ý ; Z P. ª Zø ø  ýý ;; Z ø ¿ Ø Z
ø



valid
ø 

Table 2.6: development calculus inference rules

29are allowed to appear in ‘guesses’—partial constructions attached to holes as potential
solutions. However, unlike -bindings, guesses are merely typechecked annotations—they have no computational behaviour and hence no effect on subsequent typing.

In fact, the only contraction scheme at the partial construction level is -contraction
removing spent value bindings.

ª ýø t GP.
P X ; 6ý Ä É ý
All the other computations occur within embedded terms via the closure rules given
below. Of course Ã -reduction in terms can exploit -components in the context.

ø ¿ @ÒÄ @ Á@ÒÄ Ë Ë @ Á
ø ¿ 
Á
ø ¿ 
Á
ø  "=PQ;  6 ý Ä Ä Ë ">PÌ;  Á 6 ýø  BPÌ;  6 ý Ä Ä Ë BPÌ;  Á 6 ýø ¿  Ä ÁËø ¿  ÄË  Áø D PGX  ;  6 ý Ä Ë  PX  Á ;  6 ýø m PLX  ;  6 ý Ä Ë  PGX  ;  Á 6 ýø  û Ä Ëû Áø ¿  Ä Ë Áø  BPü û ;  6 ý Ä Ë BPü û Á ;  6 ýø  PLü û ;  6 ý Ä Ë BPü û ;  Á 6 ýËË
ø ¼ù  ý Ä ý Áø  ù   6 ý Ä ùË  6 ý ÁËø

A crucial role is played by the side-conditions in the hole and guess rules. These insist
that although the term under a  -binding may exploit the bound variable, its type may
not. Without them, we should have to allow  -bindings in types. Furthermore, theserestrictions simply reflect the natural ways in which holes arise—in a refinement style
proof, we only make claims motivated by the need to construct an inhabitant of a typewhich we already know.
The inability to leak into types is something partial constructions share with terms in
simply typed systems. We should expect the replacement property to follow easily,
and in exactly the same manner—replacing the typing subderivation for the replacedterm.

2.2.1 positions and replacement
The positions    are formed from the partial constructions   by deleting one subâ    ‘forgetfully’ induces a context extension
partial construction. A position30â  which collects the components under which the deletion point lies. If ý     ,ââthen ° ý ² denotes the partial construction obtained by inserting ý at ’s deletion point.
Positions are defined inductively as follows
D EFINITION: positions
For P

 Sú â  S _£2¤¦¥~§³  6 â    â     } u  û   S£4¤¦¥r§  S BPGü â ;  6 û    
ø ¼  X ø
 ° ý ²9X ý
ø¼ ³  6 â X ø ¼ ³  ¼ âdâ õ³   6 â fr° ý ²9Xh³  6 â â° ý ² d(BPGü ; 6 û fr° ý ²9XmBPü ° ý ²7; 6 û ø ¼ BPLü â ;  6 û X ø ¼ â
ø  â ° ý ²Ê; Z follows from a subderivation of some
Crucially, any derivation ofø ¼ â  ý ;  .
âÌ¼(â Á for the position obtained by replacing the We may compose positions, writingâ â Á
âQ¼(â Á fr° ý ²KX â ° â Á ° ý ²E² and âQ¼(â Á X âÌ ¼ â  Á .
in by . Clearly d
M ETATHEOREM: replacement
Iffollows from
and
then

â ° ý ²Û; ZøÙø ¼ â   ýý Á ; ; Ùø  â ° ý Á ²; Z
ø



¼ â

P ROOF
The proof is by induction over the derivation of
the position.

øâ ° ý ²G; Z , then case analysis onââ

In all cases where the position is  , ie ° ý ²ÛX ý , the typing derivations for ° ý ² and ýÁÙ Zmust be the same, yielding that is —the conclusion is exactly the typing of ý .
We only need the strength of the induction when the position is nontrivial.
term—  is the only positionabs
We haveso we must havefollowing from
Suppose
Inductively
Hence


 â
 Z
ø ¼ "=P">; PÌ ;  6 â ° ý ° ý ²²Û;; qsZ PÌ; 6
ø ¼ "=P;  ¼ â   ý ; Ù
ø ¼ "=P;  ¼ â   ý Á ; Ù
ø ¼ "=P;   â ° ý Á ²; Zø  ">PÌ;  6 â ° ý Á ²ò;ãqsP;  6 Zø

31

let, hole
We go under the component in the same way as for abs.
guess
If the position goes under the component, the above argument applies. If theposition goes into the guess:â ° ý ²7;  6 û ; Z
B

G
P
ü
ø  â ° ý ²; ø ¼ â  ý ; Ùø ¼ â  ý Á ; Ùø  â ° ý Á ²Û; ø  BPGü â ° ý Á ²[;  6 û ; Z
 Z are not affected by theNote that the typing of û and the side-condition P ª
We haveso we must havefollowing from
Suppose
Inductively
Hence

ø



change of guess.
To claim that the simplicity of this theorem belies its utility is to misunderstand thepragmatics of theory. There is no utility without simplicity.

2.2.2 the state information order
We shall need a little more metatheoretical apparatus before we are ready to reconstructtheorem proving in O LEG. In particular, we shall need a notion of ‘progress’ betweenø Á ‘improves’ ø if it contains at least as muchO LEG states. The idea is that a stateø Áøinformation— must simulate the behaviour of every variable in .
D EFINITION: state information order
For valid statesø and ø Á , we say øhø Á , if

Nø , if ø ¿ Õ
P ; Z then ø ÁÒ¿ PÕ; Z .
Nø , if ø ¿ Y
P ÄÈÇ  then ø Á¿ P ÖX  .
For each P
For each Pis clearly a preorder.

øNotice that inserting new components into moves it up the order. So does replacing atype-only binding or  -with-guess by a -binding of an appropriately typed value. Furthermore, guesses may be added to holes, removed or modified at will, so long as their32

intended type is respected—the replacement property helps us to check modifications.
On the other hand, once a variable has a computational behaviour, we may not take itaway.

ø  ø Áøhø ÁIfthen, viewed as variable sets
, so þz&ÿ$½þz&ÿ½  . As the ordering
preserves all the observable behaviour of a state, we should expect to find the following
holds
M ETATHEOREM: monotonicity
IføÏø Á , then for all ¾  þz&ÿ$½,ø ¾ implies ø Á  ¾

P ROOFWe must first generalise a little:
If
then
and
providedø R Ïø Áø Rø R ¾
ø R ¼y¹Ñ¿ ¾
ø Á captures no variables from ø or ¹
R

implies
impliesø Á  ø ! ¾
ø ÁR ¼¹«¿ ¾
RThis allows us an easy induction on derivations. From the definition of , we shallacquire exactly the components we need to replace those subderivations which lookøøø
up types from R , perform Ã -reductions from R or simply validate R . That is, theinteresting cases are
the var ruleø

If the variable being typed lies in R , the definition of tells us how to derive theø Ásame type from R . Otherwise, the result follows from the inductive hypothesis,
which replaces the prefix in the premise, and the var rule, which recovers thetype from the unchanged suffix.
the validity rulesø

If the context being validated is R , replace the entire derivation with that ofø Á ¿ valid. Otherwise, the context strictly contains ø R , so the premise contextRøcontains R , hence the inductive hypothesis applies.
the cuml rule
The inductive hypothesis supplies the modified premise. As for the computa
tional side condition, the definition of enables us to replace every Ã -reductionøø Á
for variables in R with an equivalent conversion valid in R .
33

2.3 life of a hole
I now present four basic replacement operations which act as a basis for working withholes.

Z ø ¿ øý ;  B PÓ;  6 ý ; Z ;Qu[wyxTzø  BPÌ;  6 ý ; Z ø  û ; ø  BPü û ;  6 ý ; Zø  BPü û ;  6 ý ; Zø  BPÓ;  6 ý ; Zø  BPü û ;  6 ý ; Zø m PLX û ;  6 ý ; Z û pure
ø

claim

(birth)try(marriage)

regret(divorce)

solve(death)

It is clear that each of these rules is admissible. We may read them as justifying the
replacement at any position of the construction in the premise by the construction in
the conclusion. Monotonicity justifies the corresponding steps which insert and modify
new  -components in the state.
Effectively, claim allows us to insert a new hole at any position. Holes are naturallyZborn this way—we claim that holds in order to develop our proof of . The sidecondition on the hole typing rule holds as a matter of course.
The try and regret steps allow us to attach and discard guesses repeatedly—hopefully
our judgment improves as we go round the cycle. Once the guess contains no  components, it has become a core term—death is not the end of the journey, but thetransition by which a hole is solved, becoming a local definition.
These four rules allow us to extend the notion of ‘information order’ to positions. This
gives us the means to relate operations which are focused at a particular position to theamount of information available at that position.
D EFINITION: position information orderøâ â Á  , the position information order
For valid states and â  â Á is given inductively by the following rules:
34

ø


ø

refl

ø

trans



â
ø



â


â

â Á ø  â Á  â ÁÁ â  â ÁÁ ¿ 
ø ¼ âø  âÓ¼vâ Á  âÌ;Ì¼ u[BwyPÌxT; z  6 â Á

claim

try

ø


ø ¼ â  û ; 
âÌ¼ BPÌ;  6 â Á  âQ¼ BPGü û ;  6 â Á

regretøâÌ¼ BPLü û ;  6 â Á  Qâ ¼  PÌ;  6 â Á

ø

solve

Á û pureâÌ¼ BPLü û ;  6 â Á  Ìâ ¼  LâûP X ; 6
The admissibility of the four basic replacement operations given above ensures that ifø  â  â Á , then
if
if

ø

ø ¼ â valid thenâ ° ý ²; Zthenø ¼â Á øvalid and

ø ¼ â  Ïø ¼ â  Áâ Á ° ý ²; ZWe may now reconstruct the familiar tools of refinement proof as operations which
manipulate O LEG states, preserving their validity. Moreover, we can make assurance
double sure at any stage by rederiving the state’s validity judgment. This direct correspondence between judgments of the type theory and states of the machine, and thus
between admissible rules and tactics, is quite a solid basis on which to build a proof
assistant.

2.4 displaying an O LEG state
The prototype implementation of O LEG was written for use by other programs, rather
than by people. However, this thesis is full of O LEG proofs, so we shall need some
way to see what we are doing. Let us think how we might display an O LEG state.
I propose to list the components of a state vertically, so that the more local bindings
are literally as well as metaphorically under the more global ones. For each binding,we should give the binding operator, the identifier, then a table showing the property
indicators (‘:’ or ‘=’) with the associated terms (types or values). It will serve the cause35

of brevity if we sometimes relax vertical alignment, combining bindings when morethan one identifier is being given the same treatment.
Now, any term can be viewed as a subterm under a context of binders—let us allow
ourselves to format these contexts in the same way as the ‘main’ state and write thesubterm directly underneath. For example, we might have the state shown on the right.

"
"`F
"`
"`

;ãu[ wyxTz;  ¬ ;;5&q %D;7u[wyxTzq ')({; % ¬&q&')*{;%
%
qsJÆ;
%
+"/'yüY "5/'-,ã;  ¬   ¬ "5/'$ #{Xm.
"  "/'  ; "; Ô/d " /'  f;0&q  '';  ¬ 
q ;
 ¬ 
  ¬ d  ¬  f0"/' , "/'1#;

The initial four assumptions introduce atypeof natural numbers, its two constructors and a primitive recursion operator. Following this, I have shown a partial development of the addition function.
Observe the completed successor case in
troduced by a binding, while the zerocase is still an unknown bound with a  .
The partial proof is bound with a  , indicating that it still contains  -bindings
which must not be duplicated. Note alsothat -binding enables us to inspect terms
such as "5/'$# which would otherwise bestuck beneath the application of .

In general, then, a state is displayed as a tree whose forking nodes are bindings. Fromeach binding, one edge points ‘underneath’ to its scope, and others point ‘sideways’
into the terms attached by the property indicators ‘ ; ’, ‘ X ’ and ‘ ü ’. The sequence ofcomponents which make up a state form a spine of the tree, vertically aligned at theleft hand side, starting at the root and following the ‘underneath’ edges until the lastcomponent is reached. In the above example, the spine consists of the bindings for, F , , 
and "/' . The subtrees reached by going ‘sideways’ from this spine(representing, for example, the type of , or the incomplete development of "/' )have terms or partial constructions at the leaves. As we have seen, wherever we find apartial construction, we may replace it by another of the same type.
It is unlikely that we should always want to see the whole tree of a large state fully
expanded as above. You can, perhaps, imagine using a mouse to draw clouds rounduninteresting parts of proofs, introducing a cloud symbol in the state display. Perhaps
we can double-click on the cloud to restore the expanded tree.

36

Let us expand in detail only where we are interested,
keeping connected subtrees of uninteresting proof obscured by clouds. For instance, if we are simply interested in unsolved goals, the above example can be
reduced to this picture.

+"/'{üY+"5/) , ;~q   ; I like this interface for obscuring irrelevant details because I can focus on a subtree
without displaying the full path back to the root. Further, if we allow subtrees containing clouds to be obscured by bigger clouds, we can structure our lack of interest—when
we expand the larger cloud to return to that part of the development, the bits marked as
dull remain hidden.
Now that we can visualise the state, let us visualise tactics as direct manipulations of thedisplayed image. Each symbol is given a tangible presence by its binding. Operations
which affect a symbol should be addressed, by mouse or whatever, to its binding. We
shall soon find ourselves dragging bindings about the place, and so forth. It is, perhaps,
an advantage of making  -bindings explicit that they afford such visual metaphors.

2.5 basic component manipulations
I shall present tactics as qualified state transitions. The validity of the final state must follow from that of the initial state,
given the side-conditions.

beforeè

afterside-conditions

Table 2.7 shows some basic tactics for manipulating components at the outer level of the O LEG state. These tactics are
justified by monotonicity, except for cut and abandon which
are standard metatheoretic properties.
We may also represent replacement as a tactic,
øø
instantiating it to acquire tactics which workøBPGÁ ü â ° ý ²7;  è øBPÁ ü â ° ý Á ²[; at any position in the development. Consequently, we may apply claim, abandon, try,ø ¼ â  ý ; Ùregret, solve and cut within guesses. Howø ¼ â  ý Á ; Ùever, we are not free to create and destroy " s,as these would not preserve the type of the partial construction.
Of course, we will want to operate with a little more sophistication than to edit partial
constructions directly with try and regret. What we have established is the machinery37

assumejustify

ø

ø

ø Á è

claim

ø

ø

"ø=PÁ ;  è"ø=PÁ ; øregretøøøBPLÁ ü ý ;  èøøøBPGÁ ü ý ;  èøBPÁ ; ý ;  PGX  ;  èø ÁøBPkÁ ; 

solve

ø

øBPLÁ ü ý ;  PLX ý ; ø Áý purecutøøø ¿  ;Ìu[wyxTztryøBPÁ ;  èø Á èøBPÁ ; ø ¿  ;Ìu[wyxTzøøøabandon°  ± PW² ø ÁøøBPÁ ;  èpostpone

ø

ø Á

ø

øBPÁ ;  è

P k
»
ª ø Á
Table 2.7: basic component manipulations38ø"ø=PkÁ ; intro-q

attackBP; èPnüYBP'; ; P  ü BP'; @; Z

BP';~q  Z ; èP"  ; Z
yPS;
P

raise-qretreatèP
 üt; @A; Z"  ; Z
BP ;
@



intro-

BP';   Z X  ; Praise-

èBP ;rq  Z ; "  ;  ±° P P²@ X  ; PL; ZPè X  ; BPG; Z@è

BPG;   Z X  ;  X  ; @

Table 2.8: moving holes through their types
for making holes appear and disappear in a given place. Just like the cinema, if wework this machinery fast enough, we create the illusion of movement.

2.6 moving holes
Traditionally, we may ‘introduce’ a term of functional type by filling a hole with a " binding whose body is a new hole—the context of the new hole contains the argumentof the function. We may ‘animate’ this manoeuvre by pretending that the  -binding
has moved under the argument and shortened its type.
Another familiar manoeuvre undoes the effect of introduction, generalising a hole functionally over the assumptions from which it was to be proven. The  -binding moves
outwards through the binding of the assumption, and its type gets longer. Miller calls
this ‘raising’ [Mil91]. We may also shuffle holes in and out through -bindings appearing in their types.
These moves are collected in table 2.8.



Notice that the two introduction tactics only replace constructions of the form BPÓ; 6&P .
If the body was some arbitrary @ , the introductions would affect the P ’s in @ , rather than
the whole expression. Fortunately, any hole not of this form can be made ready for39introduction by the attack tactic.
The raising tactics, however, have no such restriction. They allow us to move holes out
through assumptions and definitions, becoming more functional as they go, until they
are outermost in a guess. The retreat tactic may then be used to extract them from thedevelopment. A partial construction can always be made pure by raising and retreating
its remaining  -bindings.

2.7 refinement and unification
The intros-q tactic makes progress by filling a hole with a " -term. This section builds
tactics to fill holes with applications.
Let us begin with a very simple motivating example, say, developing the 5 /325 function for natural numbers in termsÍ5 /325 ;~qJA ; We may introduce the argument by attack, then intros- " .

[ /42 üY"=JA; 
6 5A;of "/' .

5

At this point, we might decide to solve for 7 by adding
two numbers together. We can do this, even if we have
not yet decided which two numbers, by inserting holes
for the numbers. That is, we first claim 67676

[5 /325 üY"=J   ; BP ; 6 5;67676 then solve 5 with "/'98ï and cut.
We have filled one old hole, 5 , with "5/' applied to two
new holes—that is, we have ‘refined 5 by "/' ’.

[ /425 ü ">J   ; P ; "5/'nP

To complete the development, refine each of P and
J.

40

 by

5

  /425 Xm";:ã; "/'9::The tactic naı̈ve-refine solves one hole by a given function applied to unknowns represented by new holes. It
is a combination of claim, try and solve.

naı̈ve-refine

 ;ZNote that I have not explained how the length of the argument sequence P < is to be chosen. We could leave itto the user. However, since convertability is decidable,
we can simply try the successively longer sequences af¡
forded by the q s in the type of until either one works
or we run out of arguments.

è= PG< ; <X ¡Z P<;¡ ;q>PÌ< ;  < 6 Z

Hence, in the above example, we effectively solved 5 by naı̈ve-refine with "/' , theneach of P and by naı̈ve-refine with J .

">J   ; ">J g;rqsP ; 
qsJWP';õJÛ!)éÛP
PÒ!)éÛJ">g;
">JW Bg ;Jò !+ég  ;gÐ ;gÆ!+é 

While naı̈ve-refine is good for simple types, as one might
expect, it is not sufficiently powerful to be of real use in
the dependently typed setting. Consider this (admittedly
somewhat artificial) problem.

We have to find a such that g !)é . Careful exami
nation shows that J will do, with a derivation via J  g .

However, we cannot simply do naı̈ve-refine on gj withJ   g , because J   g proves PÐ!)éÛJ , not gÈ!)é  .
We can, however, start by building an application of J a -binding.



g

in



If we could solve P and so that the types of P>J and gj
became convertible, we could complete the refinement. Thatis, we need to unify the two types. Note that it is unification we need, not just one-sided matching—we need to infer
values for holes in the goal, not just unknown arguments.

P ;  JWP×;êJò !ê éòP
P>JLXJ g PÌJWP ;êPÒ!)éJ 
gj ;êgÆ!+é

This thesis is not the place for a discussion of unification for proof search—there ismuch work on this in the literature [Pym90]. For my purposes, something similarin power to first-order unification on normalised terms will prove adequate. O LEG’s
explicit bindings of holes and assumptions, and its support for various operations which
permute them, suggest that Miller’s technology for unification ‘under a mixed prefix’[Mil92] could be imported very easily.
Let us therefore imagine ‘buying in’ a pre-existing unification tool and use it to drive
the tactic shown below.
41

unifyøAB
P Á X Z ; 
BPÊ;
ý

ø Á
 ü â ÁC  PTX ±  Á ; Z°P P ² ý?@  ü âèDø ø Áø Á  â  â Áø Á¼ â  Á ¿ }Ø Z
The idea is that unify solves holes until enough new Ã -reductions have been added to}Ø Z . At that point, the desired  , temporarily stored in a  -binding, can be filled
give
in as the value for P .
Note that there is nothing to stop unify creating new holes, although this is unusual forfirst-order algorithms. Nor do I require the unification process to terminate, although
this sometimes helps.
We may now build a two-phase tactic which incorporates unification in the refinement
process.
unify-refine

ø
1.

ø


 ü â

C BP';

ýZDè ü â

?E F
E

Ù

<
@ < Á ; ¡ F

P X Z
BPÊ;
ý

 B
< ;

AHG
G

¡ ;ãqF < ; Ù < 6 ÁâÌ¼ Ù
2. unify P and P (at position  F < ; < )¡As with naı̈ve-refine, it is not necessary to specify how many arguments should havein advance. Provided we are willing to wait for the unification attempts, we may simply
start with none and keep trying successively until either the unification succeeds or we42run out of q s. This is exactly the behaviour of L EGO’s notorious ‘Refine’ tactic.5
An alternative to this search behaviour is a more precise ‘drag-and-drop’ technique.
We can imagine a mouse action picking up a hypothesis by a suffix of the functionalpart of its type and dropping it on a hole. The arguments of the hypothesis before thepoint we selected would be the ones made holes by unify-refine.
Perhaps you are familiar with the children’s toy which consists of a postbox with various holes of different shapes in the top. The toy comes with a number of blocks, andthe object of the exercise is to post each block through the correct hole. In order to do
this, the child is given a refinement tactic which takes the form of a blue plastic hammer. There is an initial phase where the connection between the shape of the block andthe shape of the hole has not yet been made—a phase characterised by violent hammering and tantrums. Everyone who has ever learned L EGO has undergone a similar
experience.

2.8 discharge and other permutations
Let me complete this reconstruction of basic theorem-proving in O LEG with somemore technology for shuffling components around. It is fairly clear that we may permute components in the state in any way which preserves the dependencies between
them.
Where dependency does arise, we may still reorder the components, but we have toaccount for it by introducing appropriate functional behaviour. In particular, this allows
us to discharge an assumption by making everything which follows from it functional
over it. L EGO implements this transformation by its ‘Discharge’ tactic. We mayreconstruct it piecewise by the four manipulations given in table 2.9.
Although we may read each of the ‘four discharges’ as pulling the binding of P through
the binding of , this is just a cinematic illusion. They are, of course, proven by creatingan earlier binding for , then expressing the later one in terms of it. By monotonicity,
we may make the same permutations for  -components as we can for " -components.
We may also make permutations and deletions in the argument types of functionalholes, so long as we do not break any dependencies. See table 2.10. If we bracket suchmoves with raising and introduction, we can make similar permutations and deletions
in arguments which have already been introduced.
5

L EGO tries quite hard to keep going, applying weak head-normalisation at each step, in an attempt
to reveal a fresh I -binding.

43

" -through- " -through-"
ø

ø

 è
">P
;
"ø  Á ; Z"  ;4qs PÓ;  6 Z"= P; ±  ø Á° P ²

 -through-"ø PGX  ;  è Zø" Á ;øø  Xt">PÌ;  6Ô@;0qs PÌ;  6 Z"> PL; ±  ø Á° P ²"=  Pk;  Z èø Á X^@=;
 -through- ø"  ;  PL X   ;  6 Z
ø PÁ X ;ø

 PX  ;  èZø Á X^@=;

ø  X  PGX  ;  67@
 PGX  ;  6 Z;
  ø PTXÁ ;Table 2.9: the four discharges

swap-independent

KJE;~qLP' < ;  <q F N; M
q Z 6; O è

delete-unusedÁKJ ;0qPP'F < ;  <q  ;6O
q Z N; M J2Xm" P <    F 6=J Á P < F KJE;rqPP' < ;  <q Z N; MèÁQJ ;AqPP Z < ;  < J Xm"RP <   6QJ Á P <

  Z
ª

ª O

Table 2.10: permuting and deleting arguments44

2.9 systems with explicit substitution
Now seems a good time to compare O LEG’s treatment of holes with that of othersystems.
The key issue is how to cope with holes leaking out of the scope of their explanation.
L EGO ignores this issue and reaps the consequent frightful harvest—although instantiations are typechecked, they may involve out-of-scope values which are only detectedonce the completed ‘proof’ is being verified. O LEG deals with the problem by forbidding it—a hole may not escape its scope, but its scope may be widened by raising,keeping the dependency information explicit and intact.
The real comparison lies with systems which treat this problem via explicit substitution, such as TypeLab [vHLS98] and ALF [Mag94]. Holes appear in the calculi
underlying both systems without explicit binding. Instead, the context and type of ahole are recorded in an external ledger. By good design, this context coincides withthe collection of bound variables under which the hole makes its initial appearance, but
computation may destroy this coincidence, so explicit substitution is required to fix it
up.
[vHLS98] illustrates this with a simple example. Suppose  is defined to have type S¿ Ð;;S . Now consider the termin context k;;S . That is, its ledger entry is ;;Sd("`k;TSQ6ÔfU
We are told that the " -abstracted  is ‘the same object’ as the  in the ledger. On the
one hand, we may instantiate  with  and Â -reduce to get U . On the other, we mayÂ -reduce to get  which we can then instantiate with  . The two do not commute, as

they show in this diagram:d("`k;TSQ6ÔfUÞ Ð; XY ß
Vd("`k;TSQ6 TfU

ÂW


W(Â

Þ Ò;X^ V ß UThe trouble is that performing the Â -reduction first introduces a discrepancy—the term
no longer contains a binding occurrence of  corresponding to the  in the ledger,45

hence the subsequent instantiation is a touch anachronistic. In fact, the substitution implicit in the Â -reduction has passed through  without stopping to consider the fact thatsome  ’s might appear when it is instantiated, hence the solution is to delay explicitly
the application of the substitution to  . When  is instantiated, the substitution may
proceed. That is, we repair the leak in scope by attaching an explicit substitution to thehole:d("`k;TSQ6ÔfUÞ Ò;X^ ßd("`k;TSQ6 TfUVÂW
9° k;XXUô²W(ÂÞ Ò;X^ ß
VUThe extra ° Ý;XYUô² is really a kind of binding which maintains consistency with theledger, so that  remains a ‘function’ of  . That is, the problem remains ‘think of a
¬ S function’, and the value remains ‘whatever-it-is applied to U ’.
S
The O LEG approach to this problem is total cowardice—since such situations cause
trouble, they are forbidden. In particular, we may not bind holes inside an application,
so there is no relationship with Â -reduction to untangle.

Z

"o@+;
We can, of course, have the state shown on the right. However,KJaüY"=P ; ZZ
the guess for J has no computational force. We cannot reduce J@ ;unless we widen J ’s scope by raising and retreating, undoing the
introduction of the " and leaving us with an explicitly functional
JÔ@
hole.
Is this an unbearable restriction? I can assure you that it will give us no trouble in thecourse of this thesis. The point is that O LEG offers a genuine compromise between
the ingenuity of explicit substitution and the pain of representing holes as, say, skolem
functions over the entire context—holes need only be kept functional as far as they areused computationally.
2.10 sequences, telescopes, families, triangles
Finally, for this chapter, let me digress for a moment to introduce an important notational convenience which will serve both to abbreviate and clarify what follows. We
will frequently encounter sequences of terms, often as arguments to functions or in46

dices of type families. I wish to avoid the traditional @ðR_6[676@$V for a number of reasons:
it’s too wide
it introduces a subscript which is frequently irrelevant
our binding syntax involves significant dots—throwing more dots around (inthrees, no less) can only cause confusion
Forswear therefore the pointillist sequence in favour of de Bruijn’s telescope notation [deB91]. A sequence <@ , indicates a finite, perhaps empty sequence of terms, and,¼
following that primitive monoidal urge, we have composition operator and empty
sequence Z .
de Bruijn explains how to give such a sequence a ‘type’. In a simply typed setting, weZ
could just write < , but things are a little more complicated for us: in our dependently
typed world, the values of earlier terms in a sequence can affect the types of later terms.
We cannot afford to lose this dependency information, hence we must incorporate somekind of placeholder into the type sequence notation.
D EFINITION: telescope is a set of variables not containing PSRT67676UPWV , and Z&[  u S£4¤¦¥N\^]_]_] ¥1`Ha \ § forZZ¼
bcedfceg, then < is an h < -telescope (where P < abbreviates PSR 67676vPWV and <Z R ¼ 67676 Z V

If

abbreviates).

That is, we define a sequence of types relative to a sequence of identifiers
which become bound in turn and stand as placeholders for earlier values
in later types.
For example, the P < -telescopePjk+lR m j k+P l  m j P9k+l i mSu[wyxTz ¼ PSR ¬ 'ax ¼ q  ;EPSR~6õP  
represents a triple of, respectively, a type PSR , a predicate Pall elements of PSR satisfy P .

over PSR , and a proof P9i thatZ

We may now exploit telescopes in all sorts of circumstances. For example, if < is anZ
P < -telescope, the judgment ¹À¿ <@; < abbreviates the conjunction of the judgments47

¹Ñ¿ ð@ R; Z R¹ ¿ @  ;j° @ðR ± PSRô² Z Ñ..
.

¹Ñ¿ @UVh;K° @UVnWR ± PWVonWR&²>676767° @ôR ± P_Rð² Z V Z[gFurther, the binding " < ; < abbreviates the sequence of " -bindings giving the typeZ [3  < X <@4; Z <g Pwith ’s for the ’s, whileabbreviates the corresponding
similarly for the other binding operators.

-bindings, andWe may thus speak of a sequence of bound variables as having a telescope where
we would speak of a single bound variable as having a type. I shall glibly omit atelescope’s placeholding variables, unless they are necessary to avoid ambiguity. Whenessential for clarity, I shall attach the placeholder variables to the types in situ, rather
than naming them beforehand, making the above example

P_R;=u[wyxTz ¼ P  ;7PSR ¬ u[wyxTz ¼ P9iÌ;4q  ;aPSR~6BP  
The term ‘telescope’ comes from its notation-shrinking power, inspired by the kindof collapsible telescope that Horatio Nelson once famously put to his blind eye. It isa more appropriate metaphor for abbreviating a dependent type sequence than othercollapsible structures such as accordions or opera hats because each of the concentric
cylinders which makes up the telescope has a lip which constrains the next (and hence
all the following cylinders).
The optical behaviour of telescopes is helpful also. Broadly speaking, the longer an
optical telescope, the smaller the field of view and the greater the magnification. Similarly, as you extend a type telescope, each new type acts as a new constraint, so thecollection of inhabiting sequences ‘visible through the telescope’ becomes smaller but
more informative.6
There is another sense in which type telescopes are collapsible—if we instantiate thefirst placeholder, we acquire a more specific telescope shorter by one.
D EFINITION: telescope application

Z

If < is the P_R

Z< @is the P
6 ]_]_]]_]_]

V -telescope Z R ¼ Z  ¼ 6[676 Z V and @ ; Z R , then the application

V -telescopede Bruijn talks of sequences ‘fitting into’ telescopes, but I prefer to avoid the mixed metaphor.

48

° @ ± PSRô² Z  ¼ 67676Í° @ ± PSRô² Z V
Z<@ ; < @@ ¼ <@ ; Z <Observe that if

then

.

This notion of application for telescopes may be iterated over a term sequence in the same way as function application, shortening a telescope by
 ¼Z
instantiating any prefix. That is, if < is an P < -telescope and  < ; < then d < < f <± Z
is just °p < P`< ² < .
Note that the use semicolon for sequential composition leaves the comma free for its
usual role, indicating multiple inhabitation of the same type or telescope. That is, P <  < ;Z < means that each of P < and  < inhabits Z < , where P < ¼  < ; Z < means that the concatenationZof P < and < inhabits < .
Let us also introduce a notation for making multiple copies of a telescope.
D EFINITION: iterated sequence or telescope
If <@ is a sequence of terms or a telescope, then
q

<@sr

V

is the sequential composition ofg[copies of <@ .

dIf <@ is a sequence of terms or telescope containing a free subscript , thenq [ V<@ r [

is the sequential composition<@ðR¼ 67676 <@$V

The empty sequence or telescope is thus

Þ ßà.



Þ
ß ¬  and still intend the curried form ofHence we may say that "/' has typethe function.

Z

q [

V

Observe that if <@ðR  676[6 <@UVK; < then <@ r [Similarly

q ¡

;

q Z

< r

[ V
¡ ¼ ¡
<@ r [ abbreviates d <@ðRBf 67676Íd <@vV=f .

V.

Now that we have the telescope notation for expressing types of indices, we may define
the notion of an indexed family.
D EFINITION: indexed family49

If < is a telescope and Z< ; < 6 .
itant of q PÌ

Z is a type, then an t < -indexed u -family is an inhab-For example, if for all J»;
we define  J to be the finite datatype with J elements, we
may say that  is -indexed u[wyxnz -family. Or, perhaps perversely, we may describe theÞ  ß -indexed v v -family.
function which decides equality on the natural numbers as a
For any u[wyxTz -family (henceforth ‘type family’), we may define the following telescope:
D EFINITION: free telescope for a type familyZ

If < is an P < -telescope and 8
telescope for 8 , isZ

is a < -indexed type family then, 8 , the freeZ < ¼ d¦8wPT< f

For example, is just J.;

 ¼ Pk;4  J.

What is visible through this telescope? Every member of the family 8 , of course! That¼
is, if |;[8 <@ , then <@ |Û; 8 . Note also that 8 <@ is the same as one element telescope 8 <@ !
Finally, let us consider how to abstract over arbitrary telescopes. Simply taking

q Z < ;1x=u[wyxTzzy V 6 67676
Z 

does not capture the potential for type dependency within the telescope: may dependZ
Z  ; Z R ¬ u[wyxTz
on a value of type R and so on. We may represent this by taking. We
then have not a telescope of types, but a telescope of type families:

Z R;2u[wyxnz ¼
Z  ; Z R ¬ u[wyxTz ¼
Z
Z Z  ¬i; q_@ðRs; R~69d@:Rõf u[wyxTz ¼..
.
[ V nWR
q Z&[ ÞZ
V ;4q <@2;@  ß  r [ 6[u[wyxTz
Z

VThis is a very special < -telescope which I call { u[wyxTz , and any sequence which ing
habits it is a triangle of length . That is, a triangle is a sequence which represents atelescope.

Z

It is not hard to convert an P < -telescope < into a triangle: we simply turn the abstractions
implicit in the telescope notation into " -bindings which capture the earlier P ’s in later
Z ’s. The resulting triangle is
50

Z R¼

">PTR; Z R{6 Z  ¼">PTR; Z R{6 ">P  ; Z  6 Z i ¼..
.

"RPQ< ; Þ Z&[ ß [VonWR 6 Z VCorrespondingly, if < is a triangle, the P < -telescope it represents is
P_R;  R ¼
P  ; )  PSR ¼
P9iÌ;  iWPSRP  ¼..
.

P`V ;  V Þ P [ ß [VonWR
There is no ambiguity between triangles and the telescopes they represent. You caneasily spot which is which by which side of the colon they appear. I shall happily writeq Z < ;zZ { V u[wyxTzv6
q <@2; < 6Z<Z

here < is a triangleZhere < is the represented telescope

What could mean as a triangle in a type position? Its elements are type families and,apart from the first unindexed one, these type families are not types.

Z ¼

Z ¼Z

g}|eb

Z

Observe that if < is thelength triangle representing telescope < and @Q; ,ZZÞ  [ @ðß V[ . Telescope application is thus repre¼
then the triangle representing d < fê@ issented in the triangle coding by function applications.
These notational forms give us the syntactic power to manipulate dependent type families and their inhabitants cleanly and with hardly any more effort than for simple types.
Since dependent type families feature strongly in this thesis, we are sure to be glad of
the convenience.

51

Chapter 3
Elimination Rules for Refinement
Proof
Introduction rules tell us how to establish new information. Elimination rules tell us
how to exploit what we know. This chapter identifies a particularly useful class of
elimination rule and develops a tactic to deploy them in refinement proof.
My first encounter with things described as ‘elimination rules’ was when I was beingtaught natural deduction as an undergraduate mathematician. In particular, I learned
elimination rules for the propositional connectives ~ and  :



~
 




~



° ²

° Û²

%

%

..
.

 
%

..
.

I recall thinking the two ~ -elim rules uncontroversial, whilst being somewhat confusedby the convoluted behaviour of  -elim. It was only when I caught my supervisor building a proof from the bottom of the blackboard upwards that I began to see the point.
 -elim tells us how to exploit a disjunctive hypothesis to gain leverage on whatever% it is we are trying to prove. The ~ -elim rules seem somewhat undermotivated bycomparison—they project out one or other conjunct, so we have to arrange to want the
conjuncts.
We can reformulate the ~ -elim rules as a single rule in the style of  -elim:

52

° ²
° Û²


..
.

~

%
%

This rule (often called ‘uncurrying’) makes explicit the ‘see if you can prove it fromthe conjuncts’ technique which the original pair of rules tacitly require the reasoner toapply. And that is the key point. Elimination rules should supply a proof techniquewhich analyses the hypothesis in question to give leverage on whatever the objective
may be. The ‘projective’ rules only manage to be both applicable and motivated if weare lucky enough to be trying to prove one or other of the projections.
M ANTRA:The end motivates the means.
It is only because ~ is a pretty boring connective—there is no choice about how toprove ~ —that we can get away with projective elimination rules. A disjunctive
hypothesis yields no definite conclusion, so forward synthesis is blocked—we have towork analytically, reasoning by cases.
from } by splitting the task into two subtasks, decomposing the hypothesis. However, this is not the only way a well-designed elimination
rule can make analytical progress. We can also decompose the objective (or ‘goal’)
into more specific cases, our favourite example being the ‘principle of mathematicalinduction’: -elim helps us prove %°%J ²%NF..
.

 %vJ
qsJÒ; 6 %LJ

This rule explains how to prove an arbitrary goal % indexed by a natural number J : wemust show that proofs of % are made the same way that numbers are. The subgoals instantiate the index with more specific natural numbers. This instantiation may provide
us with the concrete data we need to perform some computation or simplification, andthis is, by and large, how inductive proofs work.
Henceforth, I shall intend by ‘elimination rule’ only this kind of rule whose conclusion is an arbitrary goal, possibly abstracted over indices. This characterisation is very53

broad, including rules where there is nothing being eliminated. This may seem odd,
but it is sometimes useful to characterise what progress we can make towards an arbitrary goal without exploiting any further information. Good examples to bear in mind
are the impredicative encodings of the true proposition and the absurd proposition, re¬ % and q&%.;'axn6T% . The former exploits no information inspectively q&%­;'axn6T%
the cause of proving its arbitrary % , and consequently exerts no leverage, leaving % asa subgoal. The latter is only derivable in the context of a contradiction, and it indicatesthat we already have all we need to establish whatever % we want.
In order to exploit elimination rules whose conclusion is abstracted over indices, weneed to make the corresponding abstractions from the goal we are trying to prove. Itis, of course, obvious how to do this when the goal already looks like qsJ; 6K%­J .
This chapter is largely devoted to explaining how to make the abstractions under lessobvious circumstances.

3.1 propositional equality (definition deferred)
One of the tools we shall shortly require is a propositional notion of equality. The
conventional formulations become awkward once type dependency enters the picture.
The trouble is that two instances of a type family with indices which are not convertible,
just propositionally equal, are not the same type. The familiar definitions permit only
equations within one type—they forbid us even from stating the equality of elements
drawn from the two instances of the family.
Huet and Saı̈bi encounter a similar problem in their formalisation of category theory[SH95]—they need to state the equality of arrows whose domains are not necesssarily
computationally equal. Their solution is to relax the formulation rule for equations onarrows whilst still supplying only the reflexive constructor. With care, this approach
may be extended to the commonplace propositional equality, and that is what I propose
to do.
Rather than presenting my definition at this stage, with slender motivation and lesscontext, I shall defer the treatment until we have more idea of what its properties shouldbe, and more language with which to describe them.
Since I do not use a familiar equality, I shall not presume to use the familiar ‘! ’ symbol.
Instead I shall write ‘ ’. Experienced readers who dislike suspense will find its definition in chapter 5. Otherwise, read on here—let us look out for the required behaviourof as we go.
54

3.2 anatomy of an elimination ruleLet us first establish notation for elimination rules and give names to their components. Presenting elimination rules as raw types, or even in the conventional natural
deduction style is relatively uninformative, as I have found in the past to my cost. In
this section, I shall motivate what I hope is a clearer presentation (arising from a blackboard conversation with Rod Burstall). It is important that we come to some systematic
understanding of these rules, for we shall need to teach machines to use them.
In order to make sense of any elimination rule, we need to knowwhat it eliminates—its target
what family of arbitrary goals it proves—its scheme
For example, mathematical induction (right) eliminates a natural number, J , and proves goals of the form %J , where % isa family of propositions (ie, a predicate) over.

  5/ &  %h; qsJÐ; 6r'ax%J
6[6[67676r6
%F
%k&J

q J»; 6 %J

I mark the target with a box. We can tell % is the scheme because it stands at the headof the rule’s return type.
If we want to apply this rule, the target marker tells us that we must select a natural
number to eliminate, which will stand in the place of J . Having done so, we will needto abstract it from the goal to make an appropriate scheme for % . It is important to typethe scheme prominently. The index types are not always so obvious as here. Further,
we may need to be precise about which type universe the goal must inhabit: the ‘'ax ’in the above rule makes it suitable only for propositional goals—this rule cannot be
used for programming.
Schemes always have types of form q9< S; 7< 6n . I call the < the rule’s indices, and theindexed telescope  < the rule’s aperture. Later we shall see elimination rules for thesame thing, but with different apertures. We shall also see how to change the apertureof a rule. In conventional proofs by mathematical induction, the scheme is often called
the ‘induction predicate’. However, we shall have need of schemes which are notpredicates and rules which are not inductive.
Wherever % is applied, its arguments are called patterns. The universally quantified
variables appearing in patterns are pattern variables. Target selection must instantiate
all the pattern variables in the conclusion of the goal—otherwise we will not know
55what to abstract to build the scheme. For mathematical induction, the only patternvariable involved is the target itself, so this requirement is clearly fulfilled.
Above the solid line are the rule’s cases, each of which proves % applied to some casepatterns (such as F and vJ above). Any subgoal-specific assumptions appear above a
dotted line, the horizontal cousin of natural deduction’s vertical ellipsis. Those which
do not involve % are case data. Those which do are described as inductive hypothesesor recursive calls.
The visual aspect of this presentation is intended to convey the idea that the cases of anelimination rule are the ghosts of the corresponding introduction rules. Prawitz’s ‘inversion principle’ captures this relationship between the introduction and elimination
rules of natural deduction [Pra65]—he attributes the idea to Gentzen who in [Gen35]
expresses the property as follows:In eliminating a symbol, we may use the formula with whose terminal
symbol we are dealing only ‘in the sense afforded it by the introduction ofthat symbol’.
In essence, elimination rules show us how to mimic the structure of the hypotheses onwhich they act. Mathematical induction shows us to how to make %J imitate J; . Iwill freely suppress implicit assumptions (such as the J.;
in the ‘successor’ subgoal
above) in order to strengthen this resemblance.
M ANTRA:
Decomposition is the exposition of construction.
Before I describe how to work with elimination rules in more detail, let me place thediscussion in context by exhibiting a number of variations on the theme.

563.3 examples of elimination rules
Parameterised data structures like lists have parameterised elimination rules.
In particular, we say that an elimination rule’s
parameters are those hypotheses on which thescheme’s and cases’ types depend. They may,where interesting, be listed at the top of the rule.

?

B  ,8 =; u[wyxTz ¬%Ï;nd$>8Ûf
u[wyxTz? ;78 %ó@676[6[676[676[6[67676[6[6 ?
%md ð8Lf%td   @(fq S;=>8 6 %!

Note that I supply the case datum ;28 explicitly, despite its appearance in thecase pattern, in order to emphasise the imitation of the constructor.

  

A class of elimination rule which we will construct and use over and over again in thisthesis is the case analysis or inversion principle. For any notion given by introduction
rules, the corresponding inversion principle asserts that those introduction rules are
exhaustive. There is one case for each introduction rule, and there are no inductive
hypotheses.1
Consider, by way of example,

c

for



, presented here in its

g

c

g

g cc Jg &J‘suffix’ variant.
The traditional ‘Clark completion’ [Cla78] presentation represents the choice of derivations as a disjunction of existentially quantified equations.

qsg  J56 g c J Á ¬Á ~kJêg Á

 g 6

g
ãg
Á Á
Á
Á Ác J Á g  J 6Bgãg ~òJ+&J ~ògThere is one disjunct for each introduction rule—the schematic variables become existentially quantified over equations demanding that the conclusion proves the inverted
hypothesis and that the premises hold. This construction is somewhat mechanical, inthat it explicitly constrains each argument of the hypothesis even if the constraint isÁÁ
redundant, like the  g 6[676vgLQg in each case.
In [McB96], I gave a standardised ‘elimination rule’ presentation of inversion, essenc
tially currying the Clark completion. For example, the generic class of hypothesis gJwould be inverted thus:
1

In fact, it is good to think of induction as inversion augmented with recursive information.

57

c

M *n %Ï;='axg g Á J+g ÁG
6[676[676[6[67676r6767676r676

g

%

g

g Qg Á Jê&J Á g Á c J ÁL
6r67676r6767676r67676[6[676[676[676[676[6[67676
c

J ¬

%
%

and J are parametric to the whole rule. Once they have been instantiated, the equations in the subgoals may be simplified automatically. This approach is somewhat
clumsy, but it is very easy to apply, as the scheme % may be any proposition—no abstraction is necessary. We shall shortly develop the abstraction technology required
to exploit a more streamlined version, with an indexed scheme removing the need forequational constraints on the parameters:
This inversion principle differs from the Clark rule
only in its aperture. They are, of course, interderivable, suggesting that there might be a systematic
way to change the aperture of an elimination rule.
In fact, that is the essence of the tactic this chapter
develops.

c%Ï;4qsg JÒ;  6r'ax

g c J
676[676[676[676%g g%GgÈ(Jcqsg JA6 g J ¬ %GgYJ

The process which simplifies the constraints arising from inversion makes critical useof the fact that constructors are injective and disjoint (the ‘no confusion’ property). For
natural numbers, we might plausibly choose to derive two of Peano’s postulates:qsg  Jj; 6[&gLÎ(J ¬ gLQJqsJÒ; 67Fª &J
The above formulation of injectivity is essentially projective after the fashion of the
awkward ~ -elim rules—directly useful only if it is gGJ we are trying to prove. For
non-unary constructors,   for example, the problem gets worse—we either haveseparate head and tail injectivity theorems, or a single result which yields a tuple ofequations which we then eliminate.

58 .a &  S

Consequently, I present injectivity as an inversion rule foran equation of successors. This is really just the ‘tuple’version in curried form—the ‘predecessor’ equations are
the hypotheses of the rule’s only case.
Turning to the ‘constructors disjoint’ result, if we think of‘not’ as ‘implies false’ and ‘false’ as the absurd proposition‘anything is true’, we discover that we had an elimination
rule all along, with a fortunate number of cases.
I shall show how to prove rules like these in chapter 5.

%h;2'ax

ñ f:
67676r67676%

&ñ^: ¬
  
F

%



%h;2'axFTÎ : ¬%We should not think of elimination rules as solely belonging to datatypes and relations.
They also provide neat tools for reasoning about functions. After all, what is the extension of a function, but a relation on which a total and deterministic computationalmode has been imposed.
An equational presentation of a function corresponds to a set of introduction rules,
with recursive calls becoming inductive premises. It makes sense to reason about the
behaviour of the function by the corresponding elimination rule.

  

Consider—the function which decides the equal  F F X &U/
ity of two natural numbers. Later, we shall see how  &Fg &F JGXX #a#aMM  
to define it by recursive pattern matching equations as&gÆ&JGX
gYg
shown.
The corresponding elimination rule allows us to do what John McCarthy calls recur sion induction [McC67], effectively packaging up the recursive structure of
as asingle induction principle.

  Q%Ï;4qsg JÐ;  6{q  ;v v'67'ax%NFÐFÒ&U/%NFÒ&JÛ#aM%&gÚFj#aMqsg  JA6%GgYJ   gYJ
59

%GgY
J 
676[6[67676r6767676%N(gÈ&J 

Many proofs about functions operate by choosing the right combination of inductions
and case analyses on the arguments to make the computation unfold. Recursion induction on functions does away with the apparent cunning of this choice by wrappingup ‘the right combination’ in a derived rule which targets applications of the function
directly. The proof of a recursion induction principle follows the construction of thefunction it describes, step by step.
In order to make proper use of such a recursion induction principle, or any other ruleeliminating a function application, we must choose a scheme % which abstracts that application from the goal. Each subgoal thus replaces the application by the appropriate
value.
Such abstractions are usually unnecessary when eliminating datatypes or relations.
However, exactly when and where this abstraction behaviour is required seems to varyfrom rule to rule, and even from problem to problem—I cannot see how to infer it
reliably from the structure of the rule or its target.
The user must be free to indicate which arguments are to be abstracted in any given
case—I put a box in the type of the scheme around any index for which abstraction Ó is to be attempted. When  is boxed in, it indicates that we would like tod  gYJ+f as  .
abstract occurrences ofFor many functions, typically of a ‘searching’ or ‘testing’ character, recursion induction is still too close to the implementation to be really useful. For example, regardless  returns &v/ for equal andof how the test works, we should like to know that
#EM5 for unequal arguments. We can represent these requirements as ‘extensional’
introduction rules, via the propositional equality:  PÓPKD&U/
These equations may not be computational, but we canstill use them for conditional rewriting, should we be lucky
P ª  
enough to encounter applications ofwhich look likeP D#aMthe left hand sides.
We are often less lucky. Imagine we are trying to prove a property of a programqsP   6 â d if   P then else Z f

The computation is blocked at the box, because the ‘if’ will only reduce given aboolean value, and inside the box because P and are not numerals. Neither rewriterule applies, because we do not know whether or not P and are equal. We can remove  call returns
the blockage if we split the problem into the two cases where the
&v/ and #EM5 respectively.
60  This is exactly the behaviour of the inversion
principle corresponding to the rewrite rules.

%Ï;4qsg 

call yields two cases: one
Inverting awhere the arguments are the same and the result is (v/ , the other where the arguments differ and #EM5 is returned.

 Jj;  6~q  ;v v'67'axg Jª
676r6767676r67676r67676[6%JÒJÛ&U/%GgYJ#EM5
qsg JA6%GgYJ   gYJ

 

Again, boxing  indicates that dg}J+f is to be abstracted from the scheme. Consequently, it is replaced in one subgoal by &U/ and in the other by #aM . In both cases,

the ‘if’ reduces—further, in the &U/case, P and are coalesced:

qsP'69° P ±  ²&d â  f
qsP   6BP»ª  ¬ â Z
Inversion requires much less effort than extracting the same information from ‘characterisation theorems’ like the following (from the L EGO library):qsg  Jj;  6BgGJ   g Jê&v/
To achieve the effect of the inversion, you need to combine this lemma with projection
from the ‘  ’, boolean case analysis and a rewriting mechanism.
M ANTRA:
Invert the blocking computation.
The point is simple. Introduction rules construct information. Elimination rules exploit information. It is a serious weakness to confuse these purposes. In my view, an
equational specification is the wrong tool to exploit the properties of one program in a
proof about another. By construction, elimination rules, especially those which invert
blocked computations, are much better tools for that purpose. Over the course of thisthesis, you will see this point reinforced in example after example.

3.4 legitimate targets
In order to refine a goal by an elimination rule, we must do two things:
61

select a target of the kind the rule eliminates
construct a suitable scheme from the goal
I shall discuss the latter in the next section, but the first issue requires comment now,
because it impacts on how we should present elimination rules in the first place.
The point is that, in order to be able to select a target, we must know what kind oftarget the rule eliminates. We must define what it means to be a ‘legitimate target’ ofa rule, so that when we tell the machine which rule we want to use, it can tell us what
we may use it on.
As we have just seen, there are many different kinds of elimination rule, eliminating
many different kinds of target. The elimination rule for a datatype eliminates an arbitrary element of that type, abstracted in the rule and appearing in the concluding
pattern:q J.;  6%GJ
cInverting an inductively defined relation like eliminates hypothetical inhabitants of
the relation, but the pattern ( %}gYJ ) only involves the relation’s indices (g and J ), notcthe target (the proof of g
J ) itself:

qsg  J56 g c J ¬%LgYJ

An elimination rule for a function specifically eliminates applications of that function,rather than arbitrary elements of the result type, so the target appears only in the patterns.

qsg  J56N%GgYJ   gYJ
More diverse variations include ‘double induction’, where we must provide two targets
for a nested analysis. There is no way we can expect a machine to cope with thisdiversity, looking only at a type and trying to second-guess the intention behind it.
Let us place the burden of specifying what an elimination rule targets where it
belongs—with the manufacturer of the rule. In the Northern Irish tradition, a legitimate target is whatever we say it is.
Consequently, the boxes around targets become more than a notational courtesy between you and me—they are annotations which the machine can also see. One way to62

represent such annotations is to store the boxed term and type in a fatuous -binding
with a special identifier, ‘  ’, below:

qsJÒ;  6  mXJj;  6%J
qsg  J56{q=Y;Eg c JA6   XY;Eg c JA6%LgYJ
qsg  J56  tX   gYJÒ;v v'6%LgYJd   g JêfGiven the ‘manufacturer’s instructions’, the machine can ask us for legitimate targets inthe order that the annotations appear in the type. When we indicate what to eliminate, aprocess known in the business as fingering, the machine can match it against the target
annotation, inferring the universally quantified variables therein.
This opens the interesting possibility that the type of an elimination rule might becomputed from its targets. After all, we cannot compute the elimination scheme until
we know what it is we intend to eliminate. We will see an example of this techniquelater—the ‘injectivity’ and ‘conflict’ rules for a given datatype will be combined into asingle rule which computes the inversion appropriate to the equation being eliminatedonce targetting has instantiated the two sides with constructor expressions. This is nota caprice on my part—it really is the easy way to prove the Peano-style properties ofdependent datatypes.

3.5 scheming with constraints‘You can have any color you like, as long as it’s black.’(Henry Ford)

Undergraduates should count themselves fortunate that the exercises in inductive proof
with which they are traditionally presented involve goals of form:‘For allg  , rhubarb rhubarb g .’The formulation of the ‘base’ and ‘step’ cases then involves mindless copying of theg‘rhubarb’ bit, with appropriate values substituted for the ‘ ’. Even if they cannot complete the question, they can still manufacture the proof template (once any tendency togg|bwrite ‘suppose XÈÜ , show XÈÜ’ has been beaten out of them, that is) and thus
collect some credit.2
2

For such purposes ‘rhubarb rhubarb’ makes as worthy a predicate as any.

63

c



When reasoning about even modestly complex notions, such as for , we are lesslikely to be favoured by goals bearing so close a resemblence to an elimination rulec conclusion, such as that of
:
c
c



 ;W67676ðqsg  JA6 g c J ¬%gYJ’s scheme abstracts over arbitrary pairs of natural numbers, but how are we todeal with less arbitrary pairs? How can we cope with particular restrictions of relac 
to a moretions, datatypes and so forth? How might we apply a generic rule likecrestricted instance of ? Consider the boxed hypothesis in[F |  @;4qsP'6 P c F ¬ PTF
We need to construct a scheme which is constrained according to the problem in hand,but still abstracted over the entire aperture of the rule. The constraint we need can be
expressed by means of propositional equality, taking%

X ">P  JA6J+F ¬ PTF

As it were, ‘you can have any J»; you like, as long as it’s F ’.
c s

Plugging in this scheme, the conclusion of

becomesqsg  J56 g c J ¬ J+F ¬ gF
Now, if we fill in the details of our selected target, P

FTF ¬ PTFc

F , this is further instantiated to

and we can surely prove FTÎF —let us presume there is some  ;4qs8m;Uu[wyxTz(6~qs|0;a86õ|sQ|

More generally, suppose we have an elimination rule prov
ing some scheme % for patterns ý < ° < ² , as shown to the right.

The notation ý < ° < ² represents the sequence of patterns with thepattern variables abstracted: more generally, ý < ° <@v² means ‘the
patterns with @ ’s substituted for the ’s’.

%^;4q < U6>

rule subgoalsq < 6% ý < ° < ²

We may apply this rule to a more specific goal—let us presume that targetting has produced a matching  giving the rule’s pattern variables in terms of the goal’s hypotheses.
That is, consider a goal which looks like64

q P'< 6 ° ý < °_  < ²a²
We may choose a scheme % with explicit equational constraints:" <$6~q P)< 6 <E ý < °_  < ² ¬ ò° ý < °_  < ²E²
What is < I ý < ° < ² ? It is a telescopic equation: in general, if  < and <@ are sequences ofglength , then the telescopic equation  < <@ abbreviates the telescope of equations:Þ   Ò@  ß V
Observe, though, that we must be able to express these constraints even in the presenceof type dependency. For example, if we were building constraints on an apertureSJ»; ¼  ;Jwe might need something likeJRõQJ  ¼ RB  Rã; S JR 

S  J 
. That is, we need a notion of equality whicheven thoughand ;scales to telescopes—exactly what

will provide.

Let us instantiate the rule’s conclusion, filling in the pattern variables according to 
and % with the scheme we have constructed:

q P'< 6 ý < °_  < ² ý < °_  < ² ¬° ý < °  < ²E²

If we can solve the equations, we will recover the target goal. Fortunately, they arereflexive.
The point is this: in much the same way that Henry Ford’s customers could ask forany colour of Model T, but would only receive satisfaction if they happened to choose
black, the above scheme is indeed abstracted over the entire aperture, but the patterns
to which it applies are subject to equational constraints which recover their specificity.



Notice that the formulation of this scheme requires no abstraction. The e°ý < °_P< ²a² re
mains untouched. It is targetting which identifies the ý < °P< ² —they need not even occur
in the goal, although the exercise is perhaps a little pointless if they do not.
65

We have established the basic technique for constructing schemes when our goal ismore specific than the conclusion of the elimination rule. It is broadly effective, but it
sometimes generates redundant information. For example, constraints are unnecessary
wherever the goal really is as general as the rule—there is no point in saying ‘you canhave any color you like, as long as it’s a color’. We should try to avoid equations whereabstraction will do.
The next three subsections describe techniques to make the basic scheme less clumsy,
in accordance with the following three observations:wherever a fresh variable is constrained to equal an index, we can coalesce thetwo and remove the constraint
we can avoid abstracting the scheme over redundant information
if an index is constrained to equal a complex pattern (for example, when weapply an elimination rule characterising a function) we may sometimes simplify
the scheme by replacing copies of the pattern with the index

3.5.1 simplification by coalescence
The simpler the example, the more unnecessary constraints there are likely to be: if wewanted to prove

qsJÒ;  6 rhubarb rhubarb J
the generic constrained scheme would be">gm;  6~qsJÐ;  6õgãJ ¬rhubarb rhubarb J

This is not the scheme which I want my students to write down, so it had better not
be the scheme which the machine computes. Wherever a scheme constrains a " -boundindex to a equal fresh q -bound variable of the same type, we may coalesce the two.
Our example becomes">JÒ;  6 rhubarb rhubarb J
as we might hope for.

66

When we coalesce two variables, we have a choice of which name to keep—it is polite
to preserve the name from the goal. Note that if the same q -bound variable is constrained to equal more than one index, that effectively forces those indices to be thesame—we may only make one coalescence, otherwise we lose this ‘diagonalisation’.

3.5.2 what to fix, what to abstract
Which of the goal’s premises do we really want the scheme to abstract? Which should
remain fixed over the whole scope of the elimination? Unfortunately, these can bequite subtle questions. Imagine, for example, that we are building the ,óM" function
for polymorphic lists:,M" ;ãq   Z ;Uu[wyxTz(6~q ¡ ; L¬ Z 6rqsPÌ;v  6[ Z
In order to do recursion on P we must certainly fix —the element type is parametricZ
to the elimination rule for  . We may fix and J or not as we please.
On the other hand, when we are constructing functions which require nested recursion,
we may not be so free to fix arguments. Consider, for example, Ackermann’s function:

M +* ;  ¬  ¬ 
M +* FÌJ«X&J
M +* vgÈF X M ê* gÈBF+*
ê*ê*M vgÈ&J«XM gÀdM &gYJ+fWhen we apply the outer recursion on the first argument, we must not fix the second
argument—as you can see, the recursive calls which decrease the former also vary thelatter.
Abstracting wherever we are not forced to fix sounds like a promising policy—it does
not hurt us to have too much flexibility, only too little.
However, sometimes abstraction is definitely redundant. Recall our earlier example, proving

qsP'6 P c F ¬ PTF
perhaps by

c



c



%Ï;4qsg JÒ;  6r'ax

g c J
676[676[676[676%g g%GgÈ(Jcqsg  JA6 g J ¬ %GgYJ(shown to the right).

67

As things stand, the basic scheme abstracts all the premises

X ">g  JA6~qsP'6P c F ¬ gãP ¬ JêF ¬ PTF%

Coalescence removes qsP (and renames g ):X ">P  JA6P c F ¬ JêF ¬ PnÎF%Plugging this into the conclusion of the rule, we find we have a proof thatqsP  JA6BP c J ¬ P c F ¬ J+F ¬ PTFc

The extra inequality, P F , is redundant. It is present because we have abstracted overwhat we were eliminating, but it is not in any way useful because the scheme is notindexed over the proof of the inequality.
Typically, once targetting has filled in what is being eliminated, the application of anelimination rule looks like

ä9 % '< P < ;%ý < °_P < ²


The premises occurring in the inferred arguments  < are the ones being eliminated.
However, some ’s may not appear in the patterns, so some eliminated premises may
not appear in the instantiated patterns ý < °_ < ² . The elimination thus tells us nothing about
them, so we may omit them from the scheme provided type dependency permits.
That is, we may omit a premise P on grounds of redundancy provided

P occurs in the arguments of the elimination rule inferred by targetting
P does not occur in the instantiated patterns ý < °_L < ²
the remainder of the goal does not depend on P
cInductive relations like are usually formulated in exactly this ‘proof irrelevant’ way.
c
In our example, the eliminated hypothesis P F satisfies the three conditions. We omit
it, leaving%

X ">P  JA6J+F ¬ PTF

This is the scheme we want.
683.5.3 abstracting patterns from the goal
Rules with indices marked for abstraction
oblige us to carry out further simplificationon the scheme, in order that they have the intended ‘rewriting’ effect.

 Ó 

Recallfrom section 3.3—we might 
use this rule to rewrite an application of
in a goal like the following:

qsP   6 ° if
Targetting infers ° P%Ï;4qsg Jj;  6~q  ;v v'67'axg Jª
676r6767676r67676r67676[6%JÒJÛ&U/%GgYJ#EM5
qsg JA6%GgYJ   gYJ

  P  then  else@U²
± gò²ô°  ± J ² . The coalesced scheme is thus

X ">P     6   P  ¬%  ° if   P  then  else @U²

The boxed  tells us that we should abstract away occurrences of dgoal. Once we have done this, we can throw the constraint away.
%  P  ffrom theX ">P    >6 ° if  then  else @U²

Abstracting arbitrary terms in dependent type theory is a sensitive business—we are
not always free to replace a given subterm by a variable of the same type, because thetyping of the whole term may depend on the particular intensional properties of thesubterm being replaced. However, it is worth a try—if unsuccessful, we may leave theconstraint as it is and continue.
This rewriting technique is very powerful. The trouble caused by the intensionalityof the type theory is a real pity. Perhaps a part of the problem could be avoided withappropriate facilities for reconstructing broken typings from propositional equalities,
as proposed by Hofmann [Hof95].

69

3.5.4 constraints in inductive proofs
Let us see how constrained schemes affect inductive
proofs. We will acquire constraints on the inductive
hypotheses, as well as those on the conclusions of
the subgoals.
Consider applying the weak induction principle3 forc(see right) in a proof of JÒ;  6r'ax%Ï;4qsg%gmJ
676[676[676[676%g g%GgÈ(Jcqsg JA6 g J ¬ %GgYJ

  @aä4@:;~qsP   6 &P c  ¬ 'P  ± ±
Targetting gives ÕX ° (P g²&° J)² , so we infer the scheme (coalescing and J ):%X ">g   6rqsP'6BgG(P ¬ P  

The corresponding subgoals are shown to the right.
The constraints which appear as hypotheses in thesubgoals, N¡ and  # , are ‘friendly’—they restrict the
g ’s and P ’s we have to deal with. The constraint
in the inductive hypothesis,  # , is ‘unfriendly’—itÁ
restricts our choice of P .
A closer examination of these constraints reveals amore subtle but crucial distinction.

N|  >;rqsg  P'; qsN ¡ ;BgG&P
P' g   @a ý ;rqs?g   JA; Á q ý ;rqsP ;qsN ¢>Á ;BgLÎ(P ÁP  J
qsP ;qs # ;gLÎ(PP'(JThe variables appearing in these constraints come from two sources:
the pattern variables for each case of the elimination rule, g and J above—these
become premises of the subgoals, and appear on the left-hand side of constraintsÁthe variables universally quantified in the scheme, P and P above—these become
premises of the subgoals and also parameters of the inductive hypothesis: they
appear on the right-hand side of constraints
The ‘friendly’ constraints tell us useful information about the variables which occur
as subgoal premises, whether they come from the scheme or the patterns. In chapter
An inductively defined relation like £ also has a strong induction principle—the distinction is explained in section 4.1.5.
370

5, we will see how to simplify them, solving for variables appearing on either side—‘friendly’ constraints constitute unification problems.
In our example, let us imagine we can perform thissimplification on +¡ and  # , instantiating the g ’s toleave the subgoals shown.

ÁN|   ;~qsP';  @¦ ý Á ;~qsPP'J0(;P q ?  ý ;~qsP Á ; 
qsN ¢>Á ;r&PnÎ(P ÁP AJP'(JThe ‘unfriendly’ constraints cannot tell us anything about the variables which occur as
subgoal premises—+¢ does not allow us to infer P . Rather, they narrow our choices forÁ
the copies of the scheme variables (like P ) which parameterise inductive hypotheses.
That is, ‘unfriendly’ constraints can only determine variables appearing on the righthand side—they are matching problems.
Look back before we simplified the ‘friendly’ constraints:Á
we cannot find an P to solve the matching problemgG(P Á . However, now that we have done the unification,
Áa solution has become available. Inferring P for P we canobtain the subgoals shown on the right.

ÁÁN|   ;rqsP';  @¦ ý ÁÁ ;rqsP'P JA(;P q ?  ý ;P  J
P'(J

Something interesting has happened, and we will see what it is if we present thesesubgoals in natural deduction style:|  ÁÁP'&P @¦ ý Á ÁP' JP'ã&J

This looks like a plausible recursive specification of  ! In fact, what we have done
is apply the standard unfold/fold technique for logic programs [TS83, GS91] to transc
form our goal, viewed as a specification of  in terms of , into subgoals which give recursively. The unification problems in the conclusions are those which arise in
unfolding; the matching problems in the inductive hypotheses are those involved infolding.

3.6 an elimination tactic
In this section, I shall present a tactic, eliminate, which refines a given goal by a given
elimination rule—the user is required to finger the targets, then the tactic constructs anappropriate scheme and solves the goal, generating a subgoal for each case.
eliminate operates in five stages:
71

preparing a proforma application of the elimination rule to arguments initiallyunknown
fingering the targets and inferring the pattern variables
constructing a constrained scheme
proving the goaltidying up
I have implemented a prototype of this tactic with much of the functionality describedhere as a key component in my extension of L EGO. Of course, if I had known thenwhat I know now, it would have all the functionality. This section is the blueprint for
the revised version.
c

I shall present each stage as a little tactic. The
induction we have just seen in the previous section makes a useful running example. The tactic
should reproduce exactly the effect we manufactured by hand.
The rule we shall use and the goal we shallprove are shown in O LEG notation on the right.
The boxed premise in the rule is the inequality
it eliminates: the boxed inequality in the goal is
the one we shall target.

" c  ,Y;rq&%;rqsg  JA; 'ax q&')¤;rqsgk;%g g q&')*;rqsg  JA;
q ')¤¦¥ N; %GgYJ&
 %gÆ(Jqsg JA; cq § ;kg J%LgYJ

N ¨>©7|ª{;rqsP   ;  c 
q   ;.&PP

3.6.1 preparing the application
The preparation step could be carried out for any goal to be solved by any lemma. It
is just an administrative manoeuvre, getting everything in the right place for the real
work which follows.
TACTIC: eliminate-prepare72è« g;~q¦ < ;  < 6 Ù °p < ²« g«;5q¦ < ;  < 6 Ù °p < ²

6¬©7|ªõ;~qPP'< ; ­ <M° P`< ²

6¬©7|ª&üY"P < ; ­  < < | ý>ý XN; <  gw <; Ù p°  < ²
6 1©79J Î;®M° PW< ²
1©79
JThe goal’s hypotheses are introduced; thelemma’s hypotheses are inserted as unknowns.
A ‘proforma’ application of the lemma is then
manufactured and stored as a -binding. Ultimately, this application will be used to solves©[J9 . We must first fill in some of the < .
The prepared application for our example isshown on the right.

N N¨P©7|¬IüY"=P   ;  c "  ; &P
% ;m676[6')¤ ;m676[6 ')*;m676[6Bg  J;  c  § ;«c g  J| ý>ý X
,Y%6[676§; %GgY J6 1©79J Î;+P
1©79
J

3.6.2 fingering targets
Having installed an application of the rule in the proof of the goal, the next step isto infer some of its arguments by targetting. We may presume that the rule has asequence of targets marked by its manufacturer. The user must now finger a sequenceof matching expressions to be eliminated.
We may make use of the unify tactic to do our matching, although this may be a slightoverkill. Something like the following happens:­6¬©7|ªIü "RP < ¼  ;  ¼ .
  < R < ; < R <  ¼  o| ý>ý XÙ« gw¼ <  R  <; p° < R < ²
6 s©[9J f; MÓ° PW< ²s©[9J@B°p <  ²'; Z ° <  ² targets° P`< ²'ª; ¯0° PW< ² to be eliminated<è6¬©7|ªIüY"RP < ; ­  < < R  <  X°; ä>< < °RPW< ²
 | ý>ý XN g  < R ¼ ä>< °PW< ²; Ù p°  < R ¼ ä9< ° PW< ²a²
6 1©79J Î;MÌ° PW< ²1©79JZ °pä9< °PW< ²a² Ö ¯0°PW< ²XÖ
@y° ä9< ° PW< ²E² X >° PW< ²73

That is, targetting tries to match terms and types. If successful, some of the rule’sarguments  < will be inferred as ä9< ° PW< ² . Others,  < R , will not be inferred. The two kinds do
not have to be bound in separate clumps—it is just easier to write down that way.
If a rule has more than one target, we will have to repeat
this step for each.

gIn our example, we successfully match 
the types also infers g and J .

 | ý>ý X±
X c  ,Y %67676
; %(Pfto § . MatchingJ§X &P
X

Now, if an elimination rule is particularly complicated, its later structure may be computed from earlier arguments inferred by targetting. The instantiated type of | ý>ý may
reduce, revealing more premises to be inferred. The tactic should create holes for theseand add them to the application. Computation may also reveal more targets. Incorporating this possibility, the real behaviour of the targetting step is as follows
TACTIC: eliminate-target6¬©7|ªIüY"RP < ; ­  <   < R ; < R6¬©7|ªIü " P < ¼  ; ­  < ¼ .
<X ä>< ° PW< ²o  < R  < ; < R <  ¼  < i ;  < i
 | ý>ý Á XN g  < R ¼ ä>< °PW< ² ¼  < i| ý>ý XÙ« gw¼ <  R  <Ù Á ° P < ¼  < R ¼  < iB²; °p< R < ²è;6s©[J9 ;fMÓ° PW< ²6 1©79J Î;MÌ° PW< ²
s©[J9
1©79
J
Z


Z < < Ö <@B° < ²'; ° < ² target° ä9° PW²a² Ö X ¯0° PW²
s° P`< ²';ª¯0° PW< ² to be eliminatedÙ @yp° ä9< °  < ° PW<R ²E¼ ² äs< ° P`X < ²E² >å ° PW< q²  < in;  < iÍ6 Ù Á ° P < ¼  < R ¼  < iB²
Observe that not only have the  < been inferred and turned into -bindings, but some

 < i have appeared as a result of computation. The proforma application is extended
accordingly.

74

3.6.3 constructing the scheme
If the targetting phase has left the state as shown,
the tactic may proceed to construct the elimination
scheme. The scheme variable, % , has been uncovered
and the patterns, ý < ° PW< ² , have been inferred. The task is
now to compute % . We must put the analysis of section
3.5 into practice.

6¬©7|¬üY"¦| <
" P<
%

Recall that the basic scheme is manufactured by abstracting all the premises and constraining the indicesto equal the instantiated patterns.
Correspondingly, the tactic begins by building a basic
scheme, copying the non-parametric premises P < from thegoal and constraining all the indices. A premise | is considered parametric exactly when it occurs in the type of % .
The tactic may fail at this point if the goal being addressedis too ‘big’ for the universe over which the rule eliminates.

; 8­ <; <;09q <v; Í< °²|2< ²

 | ý>ý XN g ä <; %°ý < ° PW< ²6s©[9J Î;MÌ° PW< ²s©[9J%QüY" <j;Á Í­< ° |2< ²
q P< ; <PÁq G4< 1; < 9Á ³<ý °P < ²MÓ° P < ²

The remainder of this phase prunes the basic scheme down to something less clumsy,
wherever this is possible. Of course, in a real implementation, we would try to savework by approaching the desired scheme more directly, but I suspect that ‘pruning thebasic scheme’ gives a clearer exposition. There are two passes:Á

For decreasing4  , remove qsP  from the scheme if it is redundant, ieP   ä <(P  has been targetted 67676 )P ª ý < ° PW< ²( 67676 but is not being ‘inspected’ in the patterns 676[6 )P  ª ­ <  MÌ°PW< ² ( 67676 or depended on by the rest of the goal)\ \ ý \ °PW< ²
For increasing5 Ü , try to simplify constraint qs ;ª
if
and
and

There are two simplifications to check for: in order,– coalescenceÁ
\
if ý \ is some P  (index constrained to equal fresh variable 676[6 )Ö ­ and  X
Á \ ( 676[6 of sameÁ type)then replace P  by  , remove qsP  from scheme\ÁStrictly, we should then rename  to P  , keeping the name from the goal,
but that would make this presentation more complex than it already is.
45

Later redundant premises must not be used as excuses to retain earlier redundant premises.
Simplifying earlier constraints may unify the types of later constraints.

75

– abstraction for rewriting\\

When  is marked for abstraction with q  in the type of % , try replacing\\
all occurrences of ý in the scheme by  . If the result is well-typed, discard

 \ , otherwise leave the scheme alone.

Once simplification is complete, the pruned scheme is made accessible by changing
the % to % . The type of | ý>ý can then reduce.
In our example, the basic scheme is more complex thanit needs to be. Reflecting the ‘proof irrelevant’ nature ofÁ
inductive relations, the  is redundant. Furthermore, we
may remove 7V by coalescence.

%Ìüm">g Á    JKÁ ; 
qsP Á ; Á c  Áq  ;[(P=qs ´ ;Bg t vÁ P Á
qs7V Á  ;BJG
P  ÁThe pruned scheme is exactly the one we came up withwhen we did this example by hand. The type of | ý>ý
reduces accordingly.

 % Xm"=g   Á ; qP Á ;q ´ Á  ;Bg Á tvP ÁP  | ý>ý X c  ,µ%N67676
;0qsP Á ; Áqs+ ´Á ;[vPe
t
(
P

P 

I summarise the behaviour of this phase as a tactic step:
TACTIC: eliminate-schemeè%;Aq9<v; Í< °²|>< ²

 | ý>ý XN g 67676;% ý < ° PW< ²

 % Xm"=<»; Í< °²|>< ²
Á Áq P< ¶ ; ­ < ¶Áýq  < ¶ Á 1; < ¼ ¶ ³<
4
¶ °P < ¶ ²
Á
M ° < P< ¶ ²

 | ý>ý XN g 676[6Á Á;APq P < ¶ ; ­ < ¶Á
q  < ¶ Á =; ý < ¶ °P < ¼ ¶ ²sÁ ³<ý ¶ °P < ¶ ²¦
M ° ý < ° PW< ² P < ¶ ²ÁÁ
The P < ¶ are what remain of the P < after pruning—P < ¶ is the corresponding76

selection from P < .
The  < ¶ are what remain of the  < after pruning, equating a pruned sequenceÁ
of indices < ¶ to a pruned sequence of patterns ý < ¶ ° P < ¶ ² .
Recall that the conclusion we are trying to prove is M° PW< ² : by construction,MÁý ¼ ¶°< °PW< ² P < ²K¯ ÌM °PW< ²

3.6.4 proving the goal
TACTIC: eliminate-goal | ý>ý X« g ä <Á Á;0>q P < ¶ ; ­ < ¶Á
q  < ¶ Á K; ý < ¶ °P < ¼ ¶ ²sÁ ³<ý ¶ °P < ¶ ²&
M ° ý < ° PW< ² P < ¶ ²
61©79J Î;MÌ° PW< ²è 1©7J92X| ý>ý P < ¶ d$  ý < ¶ °P < ¶ ²f; MÌ°PW< ²This phase proves 1©7J9 from | ý>ý by instantiating thepremises abstracted in the scheme with their ‘originals’,
making the constraints reflexive and the return type thedesired MÓ° PW< ² .
The effect on our example is shown on the right.

3.6.5 tidying up
TACTIC: eliminate-tidy6¬©7|ªIü "R P < ; ­ <%XÏ67676 9< ;  <  < X äs< ° PW< ²
 | ý>ý XN  g %  9<  äs< ° PW< ² s©[J9=XN| ý>ý P < ¶ d  ý < ¶ °P < ¶ ²fè s©[9JÁ   9<  ;0q>P)< ¸n­ ; ­ < ¸Í6  <¬©7ª| IXm" P'< ; < Á  gÆ676[6Íd 9<  P)< ¸~f_676[677 | ý>ý X c  ,Y%67676
; qP Á ; q· ´Á ;r&Pe &P Á
 1©79J 2XN| ý>P ý PLd$  (Pnf;)PÛ 

Each  9[Áproves [ generalised over the P)< ¸ it depends on.
Firstly this phase cuts the -bindings for inferred arguments  < , and also % , | ý>ý ands©[J9 .
The task is then to shuffle the subgoals—the rule arguments not inferred by targetting—outside the proof of ¬©7|ª . This is done by discharging the " s through them, so that they
are generalised over only what their types depend on (as opposed to raising the  s,which would generalise over everything regardless). Typically, this will re-abstract the
fixed parameters.
Once the  s are outside the " s, the retreat tactic moves them outside the binding of¬©7|ª . At this point, smart implementations try to ¹ -reduce the proof of ¬©[|ª . Finally,¬©7|ª is solved, becoming a -binding.
In our example, the subgoals do not depend on any of the premises, so no generalisationis necessary. The final subgoals and proof term are as follows:  92R ;Aqg  P Á ; q Á ;Bg &P Á 9  ;AqPg  JA; g 
q ?  ý ;~qP Á ; qLÁ ;Bg &P Á
P J

Á
qP ;
q Á ;Bg t(P Á   ¨>©7ª| EXm"=PP   ­; v J"  c  ;7vP c    Á Á; ,d( "=g  6~qs P 6BgG(P Á ¬ P Á   Á f
92R 9 (PP  G d  (PTf;AqP ; c q  ;r &PKPò
3.7 an example— 

We have built our hammer—let us bang in a few nails. I propose to synthesise thefunction described earlier in the chapter, and to prove some useful theorems about it.
We will make use of the eliminate tactic for both programming and proof.
78 

is a recursive function on , so the starting point for  ,the development will be ’s elimination rule,, whichdoubles as the traditional induction principle and its primitive
recursion operator.

  ,%h; qsJÐ; 6ru[wyxTz%J
6[6[67676r6
%F
%k&J

q J»; 6 %J

The sequence of work is then as follows:Use  ,  F FYX&v/
  &gFYX#EM5  FÊvJX#EM5  &gÈvJX   gYg

to build an implementation of 
corresponding to the obvious functional
program.

  , again to prove   ’s recursion induction principle:  Q

Use%Ï;4qsg JÐ;  6{q  ;v v'67'ax%NFÐFÒ&U/%NFÒ&JÛ#aM%&gÚFj#aMqsg  JA6%GgYJ   gYJ

 5 Q

Use
to prove a more con  —venient elimination rule forthe inversion principle suggested
earlier in the chapter.

  

%GgY
J 
676[6[67676r6767676%N(gÈ&J 

   %^;4qsg JÒ;  6~q  ;v v+6r'axg Jª
6767676r67676[6[676[676[6%GJÐJ(v/%Gg JÛ#aM
qsg JA6%LgYJ   gYJ

Use
to show thatsatisfies its equational specification, given here as ‘introduction
rules’.

79  PÌPet(v/  PP  ª t#aM3.7.1 constructing
Let us implement 

by a nested recursion, on the first argument and then the second.

P ROGRAM: º ºL»K¼  Q½ Xm"=g  JÒ;  6v v
   ;0qsg  JÐ;  6  Q½ g J
satisfying

  F F X&U/  &gF X#EM5  F &JGX#EM5  
&gÚ&JGX
g g

D EVELOPMENTThe above goal is shown with a box around our first target. Note the -binding which 
with a more informative alias.
replaces the return type of 

See how the return type oflooks a bit like the left-hand side of a pattern matching  , !
definition? We can find our target g there. eliminate it with
We now have a base case and a step case.
Note the way the return types have pickedup the patterns corresponding to the caseanalysis.
In the base case, we are ready to eliminate the second argument, J , again with  ,.
We can now ‘fill in the right-hand sides’ by introducing the premises, then refining by &U/  àôà and  à # .
for#EM5 for

The step case is kept neat by introducing gand its associated recursive call before elim  ,inating J with
. Note that the typeof the recursive call tells us which argument
patterns it is good for.
80

   à ;0qsJA ; K ½
  # ;0qsg ;  F J
qsä:- 9;rqsJA ; Q ½
gYJ
qsJ  K ; ½
   X   , d(&"=gYgkJ 6~qsJ06  K½ gYJ+f
  à   #   àôà ;  K½  FjF
à #ã;AqsJ ;  K½

qsä: - s;K ½
FJ
Ð
F
(

J
   à X   ,d("=JA6  Q½ FÌJ+f  àôà   à #   # üY"=g; "=ä:- ;{qsJ5 ; Q ½
  # ;{qsJ5;  gYJ
 Q½ &g J  #  

# à with #aM . For# # , we
We solve
introduce the premises and refine by the recursive call ä:-)J .

   # à ;  Q½ &gÈF# # ; qJ;  Q½
Áqä: Ó- Q ½ ;(gYJ   # X   ,d(("=gÈJA(6 J  Q½ vgYJ+f
  à  ###
We have built our first function with eliminate!

3.7.2 proving
There is a standard technique for proving the recursion induction principle for a function. We fix an arbitrary scheme % indexed by the function’s arguments and result type.
We also assume that % is preserved by each ‘introduction rule’, ie recursive equation.
We then prove that % holds for any arguments and the corresponding result—this proof
has exactly the same recursive structure as the function itself. Discharging the fixedassumptions will give us the general rule.
T HEOREM: º ºL»K¼P¾¿RÀÁ;~qsg  JÐ; 6~q+;v v'67u[wyxTz")'3ÂzÂ
;%FÒ FÒ&v/")'3Â^Ã;~qsJÐ;  6 %NFÐ&Jò#aM")'¦ÃÄÂ
;~qsgY ; 6 %&gÕFÒ#aM")'¦ÃÅÃ
;~qsg JA;q ?   +; v v
q ý ;%gYJJ    ;~qsg % (JAgÆ;  &}  g J+f%gYJkd")%81

P ROOF 

For ourexample, we fix % and assume
it is preserved by each of the four equations.

 

We are left proving %­g J dgÊJêf forany g and J , where before we computed Q½ gÏJ  ,. We eliminate within exactly the same places.

I will show one base case and the step case.
Once elimination has instantiated the arguments 
ofappropriately, it reduces in each subgoal, making them vulnerable to the assumptions constructed with exactly that purpose. Thebase cases follow directly.
Similarly, the conclusion of the step
case reduces to the conclusion of therelevant assumption, '¦ÃÃ , with  suitably instantiated.

äõ-J

computed the recursive callin the construction of the function.
Here, ä:- J fills in the premise of '¦ÃÅÃto complete the proof.

;rqsg  JÐ;  6~q';v v)6[u[wyxTz"'3ÂzÂ
;%kFÐ FÐ&U/"'3Â^Ã;rqsJÒ;  6 %kFjvJÛ#aM"'¦ÃÄÂ
;rqsgm ; 6 %k&gÕFÐ#aM"'¦ÃÅÃ
;rqsg JA;q ?   ; v v
q ý ;%LgYJJ  5 Q ;rqsg %k &JAgÈ;  (  g J+f%LgYJd"%   Q àôà ;%FÒå FLd   FÒFTf
%FÒFÐ(v/"=äõ;~qsJ0;   gYJ+f
   # #{;~qsJ %Gg ; J d 
qsä:- Á ; %N(gY Jkd 
vgYJ+f%N(gÈ&Jkd
&J+f
 gY
å %k&gÈ(JNd  vgÈJ+fDischarging the subgoals proves the general rule we want.

Let us mark Ó  as targetting d   gYJ+f , and by default abstracting it.

This proof method gives a recursion induction principle for many of the functions wecan build in O LEG—it mimics exactly their construction. In effect, it packages up thesequence of eliminations which made the function, so that they can be used at one
stroke in proofs of its properties.

82

3.7.3 proving    

The proof ofbyis a good example of deriving an inversion principle from a recursion induction principle. It illustrates a technique which I shall use
relentlessly in similar circumstances for the rest of this thesis.
The proof of recursion induction principles is relatively simple. They directly describe
the computational behaviour of the function in question, so we should not be surprised
to find that the computational mechanism of the underlying calculus does all the hard
work. Recall that in each subgoal of the inductive proof, the conclusion reduces toexactly what is proven by the corresponding premise.
Contrarily, inversion principles often cut against the computational grain, characterising the extensional properties of functions, rather than the mechanism by which they
operate. The key to proving them is not to fix their schemes as " -bindings outside theinduction, but rather to let them vary inside the induction. This means that the inductive
hypotheses are themselves inversion principles—we use inversion, not computation, tosimplify the inductive steps.
T HEOREM: º ºL»K¼ÆÁÇÈ    ;rq&% ~; qsg  JÐ ;  6~q+;v v'6[u[wyxTz
q&'&É ~; qsgY ; 6 %g gÈ(v/
q&'=Ê ~; qsg JGû ;q 2JW ;Bg Jª %gmJÛ#aM
qsg J0;  
gYJ
%Gg J

P ROOF 5 Q , abstracting d   gmJf .
The scheme generated by eliminate is abstracted"2g  JA; "  +; v v  
9over the scheme of the rule we are trying to prove.
q % ;~qsg JÐ ; 6rq ); v v+6ru[wyxTz&
  gÝJ+f
Observe that the original din the conq '&É ;~qsgY ; 6  %GgYgÆ(v/&
q '=Ê ;~qg JGû ;&clusion has been replaced by  .
q 2JW ;g ãJª&%GgYJò#aM
%GgY
J 
We fix nothing in the context and eliminate by

The recursion induction gives us directly the three base cases and the step case. Again,
one base case is sufficently representative.

83

In this off-diagonal case, the recursion
induction has already filled in the answer #EM5 . Hence, introducing thepremises and refining by 'KÊ , we are left
proving FYÎª (J . This is not difficult, as
we shall see in chapter five.

   s à #r;~qsJÊ;   
q %Ï;~qsg JÐ ; 6rq);v v+6ru[wyxTz&
q '&É~;~qsgY ; 6 %GgYgÆ(v/&
q '=Ê=;~qg JGû ;&q&2JW ;g ãJª%GgYJ#EM5%NFÐ(J#aMThe step case is more entertaining. We do not know whether to use '¦É or 'KÊ , because
we do not yet know what  is. However, the inductive hypothesis is an elimination ruletelling us about g , J and  . I have called the scheme  to reduce confusion.

    ## ü "=g  J" ? 
)
" ý

;

;v v
;r&q «;~q g   J ;  6~q  ;v v)6[u[wyxTzq ËÌs;~qsgY ; 6 gYgÈ&U/0
q0ËÎÍ>;~qsg JGû ;q 2JW ;Bg Jª
gYJ#EM5
gY
J 
"%
;rqsg  JÒ ; 6{q  ;v v'67u[wyxTz"'¦É;rqsgY ; 6  %LgYgÈ&U/"'KÊ;rqsg JGû ;q 2JW ;õg Jª
g J#EM5  ## ;%N%&gÈ  
v}
J  ##?Introducing everything, we may now eliminate the conclusion with ý , abstracting
all the indices. No targetting is necessary as the patterns are fully instantiated. The
generated scheme abstracts g , J and  :X ">g  J  >6%k&gÆ&JWe are left with two subgoals, each with the equality decided:

 ## ;~qsgY;  6%(gÆ&gÈ&U/  
Ì





 
## Í ;~qg JG;q 2JW û ;Bg ãJª&%k&gÆ&J#EM5
84

These follow respectively from '¦É and '=Ê without much difficulty, completing the
proof.

As withit.

  Q , mark    as targetting d   g J+f and by default abstracting

3.7.4 proving the ‘introduction rules’
T HEOREM: º ºL»K¼PÏ/Ð^Ñ¦¿   (v/ ~; qg ;  
gYg
P ROOF
Eliminating with&v/

  s introduces a constraint because the target is diagonalised:

X ">g  JÒ;  6Ô")';v v)6BgãJ ¬% &v/

Both subgoals are easy.

   (v/ 9Ì ;rqsg; qs;gGg
&U/ t &v/
 
(v/ Í=;rqsg  Jû ;q 2JW ;Bg ãJªqs ;BgLQJ#aM D&U/

T HEOREM: º ºL»K¼PÒÔÓLÕ×Ö¿   #aM ;~qsg  JLû ; q 2 JW  ;Bg QJª
gmJ t#aM
P ROOF
Eliminating with  s, both subgoals are even easier.
85   #aM Ì9;~qsg û ; q2JW ;Bg gª  #aM Í=;~qsg &U/  J D#
; aM
q 2JW ûû Á ;g ãJªq2JW ;g ãJª#EM5 t#EM5


86

Chapter 4
Inductive Datatypes
This chapter gives a formal definition of the class of inductive datatypes and families
with which we shall work in O LEG. I shall broadly follow Luo’s choice of which definitions to admit, and show how their elimination and computation rules are generated[Luo94]. Goguen has checked that the usual metatheoretic properties such as strong
normalisation continue to hold for ECC extended with this notion of datatype [Gog94].
Basically, we shall have the datatypes and families arising from strictly positive
schemata, as proposed by Coquand, Paulin-Mohring and Dybjer [CPM90, Dyb91].
These are the datatypes of C OQ, L EGO and ALF. Induction and recursion over themwill be provided by means of the traditional elimination rules, which do exactly one
step of case analysis, attaching an inductive hypothesis to each recursive subterm so exposed. Each type is equipped with an ‘elimination constant’ whose type codes up theelimination rule—computation is then added by associating the appropriate contraction schemes (or Ø -reductions) with these constants. Elimination rules for inductively
defined relations were first formulated by Martin-Löf in [M-L71b].
This is the exactly the presentation described in Luo’s book [Luo94] and implemented
in L EGO[Pol94] by Claire Jones. C OQ has basically the same datatypes, but separates
the ‘inversion’ and ‘recursion’ aspects of elimination by providing a Case construct
for the former and a Fix construct for the latter. Fix is carefully checked to ensurethat recursive calls are made only on terms which are guarded by constructors andhence strictly smaller than the term being decomposed.
The Case/Fix presentation is much the neater one, for two reasons:Even if there is a particular argument on which I wish my function to do recursion, that is no reason to suppose it is the first argument on which it should docase analysis. Sometimes I want to look at another argument first, and then, per87

haps in not all of the cases arising, to decompose the recursive argument. The
conventional eliminator ties the two notions together inappropriately.
The conventional eliminator only facilitates recursion after exactly one constructor has been stripped away. The Fix operator allows recursion on any subterm
exposed by Case. This serves a more useful purpose than merely to admit inefficient definitions of the Fibonacci function. Working interactively, we do notneed to predict so precisely in advance the inductive structure you require.
Eduardo Giménez showed the conservativity and confluence of Case and Fix in[Gim94]. He showed strong normalisation for the Calculus of Constructions extended
with lists in this style [Gim96], and there seems no reason to suppose this does notextend to other types. Intuitively, Ø -reductions make a sound like the clanking of agiant metal cog in a ratchet. However deeply under skyscraping storeys of Â - andÃ -‘administration’ the real work may be buried, we can still hear the great machines
going clank—we know that the hands of the clock will go forward and that the bell
will ring for midnight.
This is a rather prosaic chapter in which I show how to mechanise Giménez’s argument
in O LEG. The summary, for those who would rather skip the detail, is that I equip eachdatatype with two alternative elimination rules, in the sense of the previous chapter. It
is, of course, the eliminate tactic which provides the means of their construction.
At this point, I should remark that I have omitted some classes of datatype found in
L EGO and C OQ. Both these systems permit mutually defined types: for example,
even and odd numbers given by a ‘zero’ constructor (which makes an ‘even’) and two‘successor’ constructors (taking ‘even’ to ‘odd’ and ‘odd’ to ‘even’). I omit them,
not because they are awkward in principle, but because discussing them in generalterms is a notational nightmare: I have no examples in this thesis which require them.
However, all of the technology developed here for solitary inductive definitions extends
to the mutual case without any difficulty—indeed the implemented system does handle
mutual definitions. In any case, a mutual definition can always be represented as asingle inductive family of datatypes indexed by a finite type whose elements label the¬ u[wyxnz with ÙTM5v&OÐ&U/ containing
branches—we might define a family ÙnMU&O;v v
the even numbers and ÙnMU&O#aM the odd numbers.
C OQ also allows embedded datatypes, where an existing datatype is used as an auxilliary to a new datatype—for example, defining the finitely branching trees by a single‘node’ constructor which takes a list of subtrees. This facility is both neat and laboursaving, but it adds no extra power. As Paulin-Mohring observes in [P-M96], embedded
88datatypes can be turned into mutual dataypes with extra branches duplicating the behaviour of the auxiliary types—we may define ‘finitely-branching-tree’ mutually with‘list-of-finitely-branching-trees’.

4.1 construction of inductive datatypes
Rather than plunging at the deep end and drowning in subscripts, let us establish a
simply-typed theme, then examine variations: parameterised (or, when the parameters
are themselves types, polymorphic) types, types with higher-order constructors anddependent inductive families, then degenerate types like relations and records.
The components of any inductive datatype definition are as follows
The type former is the new constant which names the type or type family, eg
S ,  .

,The constructors (or ‘introduction rules’) are the means of forming the canoni
cal elements of the datatype, eg F and  for .
The elimination rule (or ‘induction principle’) provides the mechanism for decomposing elements of the datatype in the cause of constructing something else,
be it a proof ‘by induction’ or some recursively computed value. This rule must
be marked with a target so that eliminate can use it.
The Ø -reductions animate this mechanism, defining the computational behaviourof the elimination rule for each canonical element.

4.1.1 simple inductive datatypes like
Componentwise
The type former is a constant which inhabits some universe
Ú×Û4Ü

;=u[wyxTz

 is an example of such an Ú×Û4Ü .
The constructors are function symbolsb67676ßÞ

89  R67676   3Ý , where for each  in   ;4q |0< ; 8 <  6rq PÌ< ; Þ Ú×Û4Ü ßNàáÔ6 Ú×Û4Ü

The 8 <  are called the non-recursive arguments because they may not refer to
Ú×Û4Ü
ÚpÛ4Ü
. Neither may they involve any universe as large as that which
inhabits,in order to avoid the paradoxical embedding of a larger universe inside a smaller
one—we may usually rely on Harper and Pollack’s universal policeman [HP91]
and use the unlabelled u[wyxTz regardless.



Ú×Û4Ü

We say that   has â  recursive arguments. Think of elements ofastree structures made from nodes of different kinds given by the constructors, a   node having â  out-edges and a label of telescope 8 <  . Actually, there
is no need for the recursive arguments to come after the non-recursive ones,
but it makes the presentation simpler if we pretend they always do—since nonÚpÛ4Ü
recursive arguments cannot have types involving, they may certainly always
be permuted to the front.


We may also think of constructors as introduction rules for|< ; 8 < Ú×Û4ÜPS R; 6767Ú×Û46 Ü P àÅá ;< ; | < P

Ú×Û4Ü

:

Ú×Û4Ü

The derivation trees composed from such rules correspond exactly to the tree
notion of inductive data structures mentioned above.



has two constructors:

Fk; J ; 
»
&J»;

Ú×Û4Ü

Observe also that, if
is to be inhabited, it will need at least one constructor
with no recursive arguments.
ÚpÛ4Ü®ãQä_å_æ

Let us examine, the constant whose type gives the elimination rule
Ú×Û4Ü
for
, in accordance with the general analysis of elimination rules presented
earlier.
Ú×Û4Ü®ãKä_å_æ

Ú×Û4Ü®ãKä_å_æThe pattern which
eliminates is the freeÚpÛ4Ü
pattern on, which matches any element of
ÚpÛ4Ü
Ú×Û4Ü
ÚpÛ4Ü®ãQä_å_æ
%^;4qsPÌ;6[u[wyxTz. Hencehas a scheme indexed by
Ú×Û4Ü
Ú×Û4Ü
, ie %Ï; qsP;6u[wyxTz and a rule goal targetting

ÚpÛ3Ü
Ú×Û4Ü
the element to be eliminated. q P;6%GP . The
q P;
6%P
outline of the rule is as shown.
In order to build a proof of %P for an arbitrary P , we need a method for eachconstructor, showing how % for its conclusion follows from % for its recursive90



arguments—more succinctly, that each   preserves % . We may think of %Ú×Û4Ü
as a property which must hold wherever its argument is an, hence it mustÚ×Û4Ü®ãKä_å_æ
have ‘introduction rules’—the rule subgoals of—analogous to those ofÚ×Û4Ü
Ú×Û4Ü®ãKä_å_æ. Thus we manufacture the rule subgoals of
from the introduction
Ú×Û4Ü
ÚpÛ4Ü
rules ofby writing % ý in the former wherever the latter has ý ;:| < ; 8 <  %PSR 676[6 %LP àÅá676[6[676[676[676[676[6[67676r6767676r67676r6767676r6
 | < PT< f
%Dd   Þ ÚpÛ4Ü< ;Note that the recursive arguments Pßàá have not disappeared entirely. The
types of the recursion hypotheses depend on them, hence we may infer that they
are themselves present as case hypotheses, and suppress them from the written rule accordingly. Functional programmers may be more familiar with ‘fold
operators’—the cut down version, where % is a constant and the recursive arguments are supplanted by the recursion hypotheses.

We now have all the pieces we need to complete the%Ï;4qsPÓ;Ú×Û4Ü

ÚpÛ4Ü®ãQä_å_æ

rule:

6ru[wyxTz| < ; 8 < R %PSR 67676 %GP à \|Û< ; 8 < Ý %LPSR 6[676 %GP àç6767676r67676r67676[6[67676[6[676[676[676[676[6[67676
676[6[67676[6[676[676[6[67676[6[67676r67676r6767676r6
 < <3Ý < <

67676
%td  R | PTf
%Dd 
| Pnf
Ú×Û4Ü
q P;
6%P
Or, more inscrutably,Ú×Û4ÜãQä_å_æ

4; q&%; Ú×Û4Ü ¬ u[wyxTz(6 \Ú×Û4Ü[ [\ ¬ÞÞ¬<dq |0< ; 8òR{6rq PÌ< ;ßNà 6 %LP ßNà%Dd  R | < PT< fõf
..
.

\
\
dq|0< ; 8 < Ý 6~q>PÌ< ; Þ Ú×Û4Ü ß à 6 Þ %GP [ ß [à ¬ %td   3Ý | < PT< fBf ¬q P; Ú×Û4Ü 6 %P  ,For the natural numbers, then, we get

 



, ; q&%G;$qsJÐ; 67u[wyxnzv6¬
d %FTf
dIqsJj;  69d %GJ+f ¬ %(J+f ¬q J.;  6 %GJ
91%Ï;4qsJj;

 6[u[wyxTz%J
67676r67676
%NF
%vJ

q J.; 6 %GJ

Those of us given to a skeptical disposition would be unlikely to accept the vaÚpÛ4Ü®ãQä_å_æ
lidity of
if we did not see how to plug the proofs of its rule subgoals
together to build an inhabitant of % for any particular P which we might make
Ú×Û4Ü
from
’s constructors. This process is represented in our type theory by the
Ú×Û4ÜÚ×Û4Ü®ãKä_å_æØ -reductions associated with
. By this means we imbue
with a comÚ×Û4Ü
putational meaning, allowing us to evaluate recursive functions over.
We add an Ø -reduction for the effect ofÚ×Û4ÜãQä_å_æ

< d
% '



Ú×Û4Ü®ãKä_å_æ   | < PT< f Ä³è0'ªé | < P <on each constructor:

q ÚpÛ3ÜãQä_å_æ

< P
% 'Ò

[

r àÅ[ áFor the natural numbers, we get two such rules:  ,µ%!'0ê>'&ÃF Ä³èë'ê  µ, %!'0ê>'&Ãn(JÏ³Ä èë'&Ã9Jd   ,µ%ì'ê>'¦Ã9Jêf

Given the type former and constructors for a simple inductive datatype, the elimination
rule and Ø -reductions can be computed in a straightforward way.

4.1.2 parameterised datatypes like
It is not hard to represent datatypes such as lists of natural numbers via the above
mechanism: 0;=u[wyxTz

  ;   J»;   oJG@@ ; ;   

However, it seems much preferable to define lists once, polymorphically and instantiatethat definition for each type of element we encounter than to define a new list typefor every element type. That is, we should be able to define lists in a way which isparameterised by the choice of element type, allowing us to write the functions which
operate on arbitrarily-typed lists once and for all. For each 8 ;nu[wyxnz , 8 should be
the simple inductive datatype of lists of 8 elements. Such entities are sometimes called‘families of inductive datatypes’, because each element of the family is an inductive
datatype.
This kind of parameterisation is very simple—once the parameters have been instantiated, they are fixed for the entire inductive definition—constructors, elimination rule,â
the lot. For a given parameter telescope ý < ; < , then, we need merely bind it parametrically to each of the defined constants and rewrite rules, correspondingly replacing eachííby ý < wherever they are applied.
Hence
92

type former
Ú×Û4Ü

4; q ý < ; â < 6[u[wyxTz

constructors   ;4qPý < ; â < 6rq|A< ; 8 <  6{qPPÓ< ; Þ Ú×Û4Ü ý < ß àá 6 Ú×Û4Ü ý <(or as an introduction rule)|< ; 8 < PSR ; Ú×Û4 Ü ý < 67Ú×Û4676 Ü P àá ; ÚpÛ3Ü ý <ý<< ;  | < P

elimination rule%Ï;nd

ý < f ¬ u[wyxTz|< ; 8 < R %PSR 67676 %GP à \|Û< ; 8 < Ý %LPSR 6[676 %GP à ç6767676r67676r67676[6[67676[6[676[676[676[676[6[67676
676[6[67676[6[676[676[6[67676[6[67676r67676r6767676r6
3Ý ý < |< PT< f


67676
%td  LR ý< 
| < PT< f%Dd q P; Ú×Û4Ü ý < 6%PÚ×Û4Ü

(or as a type)Ú×Û4ÜãQä_å_æ

4; qPý < ; â < 6~q&%G;yd ÚpÛ4Ü ý < f ¬ \ u[wyxTzU6 \
Ú×Û4Ü
[

dq|0< ; 8ò< R{6rq>PÌ< ; Þ ý < ß à 6 Þ %LP ßN[à ¬ %td   RLý < |< PT< fõf ¬..
.

dq|0< ; 8 < Ý 6~q>PÌ< ; Þ Ú×Û4Ü ý < ß àç 6 Þ %P [ ß [à ç ¬ %td   Ý ý < |< PT< fõf ¬q P; Ú×Û4Ü ý < 6N%PØ -reductions
Ú×Û4ÜãQä_å_æ < PT< f_Ä³è&'ªé| < P <ý < % 'k< d    ý < |q ÚpÛ4Ü®ãQä_å_æ

The family of datatypes,  , is thus given by>8;2u[wyxnz

 õ8<;298? ;78 @ ;298   ? @A;=B>893

ý < % 'Î< P [ r àÅ[ á  ,%Ï;nd$>8Ûf¬ u[wyxnz? ;78 %ó@676[676[6[67676r6767676r6
 ?
%td ð8Gf%md   @(fq S;=>8 6 %ì  ,Õ8 %!'¦î'4ï d  :? 8ÛfÎÄ³èð'¦î ?
 ,Õ8 %!'¦î'4ïd   @(fÎ³Ä èð'4ï @)d$B  ,Õ8³%ì'&î'&î@(f ?
Note that I suppress the parameter 8 when writing   @ , because it can be inferred?
from the type of , conversely leaving it visible in 98 and ð8 . In general, I shall
avoid mentioning parameters wherever convenient.

4.1.3 datatypes with higher-order recursive arguments, like
So far, each of the datatype constructors we have seen has a fixed number of recursivearguments—in the tree metaphor, a fixed number of out-edges to smaller subtrees.
One might choose to see these as a family of out-edges indexed by a finite set, andproceed to wonder whether any other types might be acceptable for indexing recursivearguments. And yes, any small enough type (telescope) can be used to index a recursiveargument, as long as it does not involve the type being defined1 , giving us the increased
power of higher-order recursive arguments addressing infinite families of subterms.
Higher-order recursive arguments are thus functions returning elements of the inductive datatype. The elimination thus rule has higher-order recursion hypotheses—
functions returning proofs of % .
For example, we may construct a type of ordinal numbers which supplements the‘zero’ and ‘successor’ constructors with the ‘supremum’ of a possibly infinite familyof smaller ordinals:
ñE ;2 IP;= / Pk;= ¡ ;  ¬  
/4" ¡ ;= The /4" constructor takes a family of ordinals indexed by , admitting a notionallytransfinite structure.2 The corresponding subgoal in the elimination rule gives access
1
2

a restriction known as strict positivity
Of course, ò }ó ôQõHö has only countably many inhabitants.

94

to a family of recursion hypotheses:   ,%Ï;4qsPÓ;U 6[u[wyxnz

sq JÒ;  6%Dd ¡ J+f
67676r6767676r67676[6 6[67676r6767676r67676r67676%td/PTf%td4/ " ¡fq Pk;= I 6%GP
%P

ñ
%

E

How can we compute over such a type? The /4" branch expects a family of proofs
of % for the image of its functional argument—we may manufacture such a family by" -abstracting over the recursive call:   ,÷%}'ê)'¦Ã='&ÃÅø ùAd$/4" ¡ fSÄ³è0'¦Ãø ù ¡ d("=JÒ;  6ô   ,ú%}'0ê)'&Ã='&ÃÅø ùAd ¡ J+fBf
In the same way, we can allow constructors of an arbitrary inductive datatype to havefamilies of recursive arguments, with the elimination rule acquiring families of recursion hypotheses:
type former
Ú×Û4Ü

;=u[wyxTz

constructors  ;4q |0< ; 8 <  6rq ¡ < ; q q ? < [ ;  < [ 6 ÚpÛ3Ü àÅ[ á 6 Ú×Û4Ür(or as an introduction rule)
ÚpÛ4Ü
ÚpÛ4Ü
| < ; 8 <  ¡ R ; q ? < R; < R{6
67676 ¡ ;4q ? < àá ;  < àá 6àá   | < ¡ < ; Ú×Û4Ü

elimination rule
%Ï;

676[6

¬ [u wyxnz|< ; 8 <  q ? < R; < R~6%Dd ¡ R ? < R:f 67676 q ? < àá ;  < àá 6%md ¡ ? < àá f
6[6[67676r67676r6767676r67676[6[676[676[676[676[6[67676r6767676r67676r6767676r67676[6[676[676[67àá6[676[6[676 ¡
%td   | < < fq P; Ú×Û4Ü 6 %GPÚ×Û4Ü(or as a type)
95

67676

Ú×Û4ÜãQä_å_æ

\4; q&%; Ú×Û4Ü ¬ q u[wyxTz(6[[ ÚpÛ3Ü à¡?
dq |0< ; 8ò< R{6rq < ; q < ;  < 6 \ r [ 6
q ? [
[
[

q < ;  < 6 %td ¡ [ ? < f r à[ ¬ %td   R | < ¡ < fBf ¬

..
.

q ? [
¡
<
<
dq|0< ; 8òR{6rq ; q < ;  < [ 6 ÚpÛ3Ü r [à ç 6
q ? [q < ;  < [ 6%td ¡ [ ? < [ fNr à[ ç ¬ %md q P; Ú×Û4Ü 6
% P
Ø -reductions
Ú×Û4ÜãQä_å_æ

< d
% '



 3Ý | < ¡ < fBf ¬  | < ¡ < f_Ä³è'=éL| < ¡ < q " ? < [ ;  < [ 6 ÚpÛ3ÜãQä_å_æ

4.1.4 dependent inductive families like the

% k
'< d

¡ [ ? < [ f r [àásLet us now extend the notion of inductive datatypes to include inductively definedindexed families of types as in [Dyb91].
g

For example, consider the finite sets. For any , it is not hard to define a simple typeg
with elements. Types such as F , b and v v are commonplace. However, our choicegof is at the meta-level, and we must define each type separately. How much more  ¬ u[wyxTz
useful if we could define  ;, enabling us to reason at the object level about F
arbitary finite sets. Of course,
had better be empty, and we can make  vJ byinventing a ‘new’ element, then embedding all the ‘old’ elements of  J . That is, 
is a mutually defined family of datatypes with constructors:# ñ J»;=  (JP ;=  J#$oPk;2 (JBy convention, I choose to think of these sets growing in a ‘push-down’ fashion. Theñ
new element introduced by # is ‘zero’, while the old elements are embedded by a‘successor’ function. By a deBruijn influenced predisposition, I see the newest as theclosest and lowest in number. Note that we may leave J as an implicit argument to #U .



has a family of elimination rules with a family of schemes%^; qsJÐ; 6sd  J+f ¬ u[wyxTz
We form the rule subgoals by demanding that %J holds wherever  J is inhabited—that is, we select the scheme corresponding to the relevant branch of the mutual defini'tion. Hence, 
,
96

 ' ,%Ï;4qsJÐ; 6sd$  J+f ¬ u[wyxnz%JÒP
6r6767676r67676r67676
ñ%N(Jd$# J+f%N&JNd$#$oPnf
qsJj; 6~q P;=  J 6 %JÐPwith computational behaviour '' ,û%!'KÊÔê>'KÊÅÃo&Jkd$# ñ J+fÒÄ³èð'KÊÔênJ ' û, %!'KÊÔê>'KÊÅÃo&J d$#$oPnfÒ³Ä èð'KÊÅÃ9PGd ,û%ì'KÊÔêÎ'KÊÅÃ9JjPTf  is thus an inductively defined family of types—the instances of the family are notinductive datatypes taken in isolation; only collectively do they form a mutual inductive
definition. Contrast this with a family of inductive datatypes such as B , where eachmember, eg 
is an inductive datatype in its own right.
In the light of this example, let us generalise to dependent inductive families,üý®æ

;4q <[; [< 67u[wyxTz

The constructors now take recursive arguments from and return values in any instanceüý®æ<@ for terms <@ó;  < . Thus, in theof the type family being defined, that is any‘introduction rule’ style, we get|ò< ; 8 <PSR ; üý® æ <@ðR üý®67æ 676 ÝÄþ P à ; üý®æ <@ à<@ V< ; | < PThe scheme ofthat isüýæÿãKä_å_æ%^; q.< 7; 7< 69d

üý®æ

< f

must be indexed over the entirety of the types being defined,¬ u[wyxTz

Recall that the ‘free telescope’ notation abbreviates this to %Ï;

üý®æ

üý®æ

¬ u[wyxnz .

< is inhabited; more
The rule subgoals demand that for all < , % < holds whereverüýæüý®æìãQä_å_æ
succinctly that % holds whereveris inhabited. Hence we get
:

97

%Ï;

¬ u[wyxTz

üýæ

6[676

| < ; 8 < % <@:R ¼ PSR 6[676 % <@ à ¼ P à
6[6[67676[6[676[676[6[67676[6[67676r67676r6767676r67676[6[676Ýþ ¼ % <@ V d | < Pn< füý®æ
¼¼
q< P ;.
N6 % < P

67676

Observe that there is still only one targetter: unifying term and type gives enoughüýæ
information to infer an inhabitant of.
The reduction rule for each constructor is thus:üý®æÿãKä_å_æ%' < <@Ýþ

¼V d    | < PT< fÄ³èë'4ï  î | < P < q üý®æìãQä_å_æ

4.1.5 inductively defined relations like% ' < <@ 

¼P  r àInductively defined relations bear a strong resemblance to dependent inductive familiesof datatypes. However, their presentation is differently motivated: inductive relations
are families of propositions and their role is in reasoning rather than computation—
they sit outside the domain of programs and data characterising aspects of it.
Propositions are types, and the terms which inhabit them constitute proofs. An inductive relation’s inhabitants are built by constructor functions, just like a datatype—we
may think of these constructors as inference rules—but their elimination rules do notinspect proofs explicitly in terms of their constructors.
Technically, the difference between inductive relations and datatypes is manifested in
two ways:
the type formers of an inductive relation range over the impredicative universe
'ax , and correspondingly, the schemes of their elimination rules are also families of propositions
inductive relations are proof irrelevant—the apertures of their elimination rules
abstract the indices of the relation, but not the proofs themselves, hence the rulecases never identify the constructors to which they correspond
We shall need at least one relation which can interfere with computation, and that is. We use to represent constraints in the elimination process for datatypes as well98

as relations, and hence we must allow it to eliminate over u[wyxTz as well as  ax . Indeed,this is not the only way in which does not fit the presentation of inductive relations
given here. It is treated specially, and gets the next chapter to itself. For the moment,
let us consider inductive relations for reasoning.
Many dependent datatypes have relational analogues. For example, the 
responds to the ‘less than’ relation:

family cor-Ú;4qsg  JÒ;  6['ax
There are two introduction rules for  : '

ã 

Jk­vJ

gÕ}JgÑ­(JThe names of the rules are really the constructor symbols, but taking them to the sideemphasises the proof irrelevant nature of relations. This leaves us free to write propositions with no prefixed proofs in the introduction rules.



'

Compare gÑ}J with  J . gÑ.F is clearly empty. For each (J , 
proves that J
is the ‘new’ thing only just smaller, whilst   lifts the proofs for those g ’s alreadyñsmaller than J : exactly as # creates the ‘new’ element of each finite set and #$ embeds
the ‘old’ ones.
The elimination rule O LEG provides for  is sometimes known as its strong induction
principle,  , :  ,%Ï;4qsg JÐ;  6r'axgÑJ %GgYJ
676r6767676r67676[6[676[676[676%Jò&J%GgÈ(Jqsg JÒ; 6~q  ;7gkJ 6 %Gg J
Note that the scheme is indexed only over the two numbers, not the proof that thefirst is less than the second. Correspondingly, the targetted  does not occur in the' and   appear in the subgoals.
goal patterns, nor do the constructor symbols Consequently, the step case hypothesis g«J is no longer implicitly given by the inductive hypothesis, so we must write it explicitly if we mean it to be there. As a matter99

of fact, we can choose to omit it from the rule, obtaining the weak induction principle. The two are equivalent given an appropriate notion of conjunction, but the strong
version is more useful in practice: it is generally preferable to discard unnecessary
hypotheses than to reconstruct necessary ones.
It is not clear to me why inductively defined relations should be equipped with computational behaviour: computation belongs within the realm of datatypes, and any ofthese inductive relations over which computation is desired can easily be redefined as adependent family. On the other hand, in the sense that computation explains induction,
it should be possible to equip relations with reduction rules which are meaningful, if
not desirable. For  , we get  ,û%ÿ'&î'  J &Jkd: ' J+fÎÄ³èë'¦î QJ  û, %ÿ'&î'  gÈ& J dðã  GfÎÄ³èë'  «d: ,µ%!'¦î '  gYJ Gf
With  to guide us, here is the general treatment:
proposition former

>ä

;4q.<r; 7< 6r'ax

inference rules (constructors)

PSR;4ä >ä <@ôR 67>67ä 6 P à ; >ä <@ à<@ 
| < P< ;à|< ; 8 <elimination rule (strong induction principle)%Ï;4q < [; 7< 6['ax

6[676| < ; 8 < >ä <@ðR 676[6 >ä <@ à % <@ðR 67676 % <@ à
6r67676[6[67676[6[676[676[6[67676[6[67676r6767676r67676r67676[6[67676[6[676[676[6[67676[6[67676% <@ àq < ¼  ; >ä 6 %<9Ø -reductions

>ä_ãQä_å_æ

% ' < <@à d 4ä | < PT< fÎÄ³èð'/ø  | < P <100q >ä_ãKä_å_æ% '< ý<[P [ r à[67676

4.1.6 record types
We can represent (dependent) record types as a degenerate case of inductive datatypes.


A simple datatypewith one constructor which has no recursive arguments isjust a tupling wrapper for the non-recursive arguments, or fields, as we might like tocall them.
The typical type former and constructor are as follows:
type former;4u[wyxTz

constructor (singular) >< ä_Ü <  >
 < ä_Ü ; 8 

; >ä_ÜThe ‘official’ field names < are significant in that they allow us to adopt a moreè­conventional named-tuple notation as syntactic sugar—I writeX
M to indicate­that is a sugared notation for M :  >ä_Ü<èX <@  X



 <

@
 >ä_Ü

This presumes that the sequence of names < determines which of the defined record
types is intended. Underneath the layer of sugar, the names of fields are irrelevant.
Having established this syntax, the elimination and computation rules become
elimination rule%Ï; ¬

ÎãKä_å_æu[wyxTz<@ ; 8 <676[676[ 6[67676r6767676r67676
 >< ä_Ü%
X <@ 
q Pk;  N6 %GPØ -reductionÎãKä_å_æ%!'  >ä_Ü<

X <@  Ä³è&' <@101These record types do not come ready-equipped with projections. Instead, their elimination rules require a function of the fields: introducing the arguments effectivelyÎãKä_å_æ
extends the local context with " -bindings for the fields. That is,has a similar behaviour to pattern-matching for named tuples, SML’s ‘open’ for structures orPascal’s ‘with 6[676 do’ construct. Underneath the " s, you are entitled to place any welltyped expression you choose, involving as many or as few fields as you like.

RãQä_å_æ

is preferable to projection
In an interactive, analytical setting, eliminating bybecause it is more focused on the goal. Also, a single elimination exposes all of the
fields together, where projection gives you but one at a time. To me it seems a rather
more honest account, especially when there may be type dependency between fields.
Understanding records by atomising them into fields in spite of the structure which
weaves them together is a bit like understanding London in terms of discrete hinterlands for each tube station. Plenty of people (including me) navigate London on thatbasis, but they are not the Londoners.

 >ä_Ü>[Let us nonetheless define the projections with the conventional notation d f~6. Typeæ
dependency requires us to do so in order—earlier projections appear in the types oflater ones.
Presuming we have defined d f{6æ >ä_Ü

RT676767d æ f~6 >ä_Ü V , d æ f~6 >ä_Ü V á R isd æ f~6 >ä_Ü V á RX RãQÙ ä_å_æ  Þ Ù  >ä_ÜP[ ±  >ä_ÜÎ[ V[
dv" ;
6 ° 6
²vß 8ÒV á Rõf
dv4" |A< ;  8Û< 6õÞ |=V Ù á Rõ f >ä_Ü>[ ±  >ä_Ü>[ V[
Ù
;rq ;
6 ° 6
²vß 8ÒV á R

I refer to this use of ‘.’ as ‘spot’ because I think of it as an ugly thing which I wish to
distance from the ‘dot’ used for binding. ‘dot’ marks a scope which may contain any
well-typed expression whose identifiers have been explained. ‘spot’ only allows theÙ  , we may
name of a field. Let us apply generous makeup to hide our acne. If ;write

Ù °PW< ²v6@ÛX è  PG< X Ù 6  >< ä_Ü ; 8< 6Ô@This syntactic sugar abbreviates a bunch of -bindings which open the record with ourchosen local names. The dot introduces the scope of the bindings—we may naturally
have anything we like under it. Let us abbreviate further, in the case where the chosennames are the ‘offical’ ones:Ù 6@ÛX è Ù °  >< ä_Ü ²(6¨@102If @ happens to be a field name, we recover the effect of projection. However, if
·3
¸
3(' '
X"! ¼ OLX$# ¼ ñ X&% , then Ù 6 O ñ X b*) # .

Ù X

There is a superficial resemblance between this ‘opening’ notation and the ‘explicit
environments’ of Sato, Sakurai and Burstall [SSB99]. However, their treatment propagates environments through the term structure in the manner of explicit substitutions,rather than giving them the ‘action at a distance’ effect of -binding. I have implemented these ‘first class local definition’ records as an experimental extension to LISP[McB92].

4.2 a compendium of inductive datatypes
This section defines formally a number of familiar datatypes as used in this thesis andin everyday functional programming. Its purpose is partly to consolidate the materialof the previous section, but mostly to confine to one contiguous portion of this thesis a
lot of boring definitions.
Some finite types, see table 4.1, are standard equipment: F (‘empty’), b (‘unit’) and v v(‘bool’). The constructor + is pronounced ‘void’.



Let us also have disjoint sums, , , and, specifically, ,óM5OQ2: table 4.2.

A dependent family, often to be found in the examples of this thesis are the vectors,
 : table 4.3. Note the suppression of inferrable arguments.

4.3 abolishing - -types and reinventing themLuo supplies dependent pairs, or  -types, as basic features of ECC, equipped with firstand second projections. However, with our facility for datatypes, it seems preferable
to present pairing as a parameterised record type. Also, pairs might as well acquire theapparatus we shall shortly build for other datatypes.
record former.

;78 . ¬ [u wyxTz
 ;=u[wyxTz

fields

b ;78
ò
.
v; b
103

F k;=u[wyxTzb Û;2u[wyxTz

v vk;=u[wyxTz+ ;Wb

&U/ ;; v v#EM5 ;; v v

Table 4.1: standard finite types/ 10/ 0 =; u[wyxTz, 2; u[wyxTz/

S; 43 S; / , 0;=u[wyxTz,M5OQ2 2;2u[wyxTz
2

 ' äÒäÒ; ; 0 / , 0Pk;
O oP;=,ó2M5OQ2
2

Table 4.2: , and ,MOK2

H  ;=u[wyxTz J.; ECKJ»;=u[wyxTz)

 C;



aCGF

S
?
) ;[H  ? @ ; S E CeJ
  @ ;E CGvJ

Table 4.3: vectors

104 m;=,MOK2
2

intro- 

BP';Ô  Z ; Praise- è  ; Z
P'·  ; ¼ ¸P  ; Z
P ;


è

BP';Ô  Z ; 
P'6I°ab ±  ²&° v ± PW²Å

Table 4.4: tactics for  -types in goals
The only penalty we risk paying is slightly clumsy syntax, but it is in our power tosugar this problem away. Let us have lots.

è 6Z f+PkZ ;  6 èZ X m
(
d
=
"
Ì
P
;
 Z
·  c ¼ ¸ X è · ;  6 ¼¸@ X
b X vX^@Kà è Þ ß ¼ Z X è b
5 Þ < à76 X è +PSR;  R{6A67676yêPWVe;  V6 Z·  < ¼ ß ¸ X è ·  + ¼ · ·  ¼ ¸ ¸¸@ XR 67676 V @ 676[6 is a fake binding operator
the usual special caseunlabelled pairs
empty telescope gives unit type
nonempty telescope gives  -type
empty sequence gives void
nonempty sequence gives pair

There is no conflict between using  both for binding and as an operator which turns
telescopes into the types of tuples, represented as pairs nested to the right. Also, westill have the dot-notation from record types as sugar for  , . Our cunning choiceof field names gives us the familiar d f{6Ib and d f~6v projections as a special case.

ææWe should equip O LEG with the tactics for dragging  -bindings through our fake  bindings. See table 4.4. Both are replacements. Applied recursively, intro-q and intro turn a goal full of q s and  s into a partial proof full of " s and  s. Correspondingly,
raise-  combines with raise-q to allow multiple subgoals to retreat from a partial
contruction as a single outstanding proof obligation.

4.3.1 the blunderbuss tactic
intro-  caters for  -types in goals, allowing us to solve them piecewise. What about -types in hypotheses? Although we usually try to curry them away wherever possible,
we do still find  -types in inductive hypotheses, for example, when the original goal
was to compute a pair.
105

It is awkward to exploit such hypotheses with tactics such as L EGO’s Refine which
are specifically geared to use functional information. I therefore propose the following‘blunderbuss’ tactic,3 which will search inside  as well as under q : . .
TACTIC: blunderbuss
This tactic tries to use some  to solve a ¬©7|ª by a depth äß©©>@rX  ; first search strategy. The nodes of the search tree are6¬©7|ªo;¨
given by -bindings of proofs to try. Initially, the root
node is set to  .
At each J9©5>X  ; , starting with ä ©©9@ , blunderbuss behaves as follows:
try to unify J9©5> with ¬©7|ª —if successful, stop, otherwise 6[676
reduce to weak head-normal form

generate subnodes by the type-directed methods given in table 4.5

and try blunderbuss with each in turn—blunder-subnodes aretried before blunder-q subnodes
We recover exactly L EGO’s Refine tactic if we only have blunder-q . However, now
we can just as well blunder under a  .

I have taken this opportunity to sneak in blunder- . Recall that when eliminate
generates a constrained scheme, the equations generated appear as a matching problem
 is intended to make it easierin any inductive hypotheses which may arise. blunder-to exploit such hypotheses whenever the matching problem has an obvious solution.
Hence, whenever an equational premise is required, blunderbuss tries to unify the two proof. If this fails, then blunder-q introduces the premisesides in order to supply a 
as normal. It would be very unusual if making a possible unification turned out to be
an unfortunate choice.
The construction of the ‘guarded fixpoint’ operator in the next section uses a style ofhypothesis for whose exploitation blunderbuss is exactly the right tactic.
3

A blunderbuss is an old-fashioned kind of gun with a barrel which opens out like a horn. It fires
almost anything at almost everyone in a wide spread. The phrase ‘blunderbuss tactics’ is used to describe
the technique of throwing everything you have got at a problem in the hope that something will work.

106



blunder-

ø

?E 

E 9
E J ©+5> X
E ü â

EE
E@


A; qP'. ;Í@o @ Á

AG

..
.

B

è

ø Á

?E  

G
E

G

E

Á E
 ü â @G
GG

-¬©[|ªK;f¨ý@ø and @ Áø unify,ieÁø Á  â  â Áø Á¼ â  Á ¿ @ Ö @ Á
Xblunder-q
ø
?E 

E 9
E J ©+5> X
E;AqP'. ;B8EE  ü â E@..
.
- ¬©[ª| Kf; ¨
ý

è

AHG

ø

E P
E 

G
G
G

 ü â
G
G

E
E
E
E
@

 d$  @ôf;Î°   @ ± P² .

..
.

6¬©7|ªo;¨
ý

?E

G

B

9ÓX

E
G

9X

;+8
;

AHG
G
G

. P
G
B

G

..
.

G
G

-¬©[|ªn;f¨ýblunder- 

ø

?E 

E 9
E J ©+5> X



 ü â
@

E

E

E

E


; êP'. ;B8

AG

..
.

B

è

-¬©[|ªK;f¨ýø?E  
EE   9= RBX
E 9 X
E

G
G
G
G
G

G



 ü â
@

E

E

 6Eb;78 6 v;Î°  9=R ± PW² .

..
.

-¬©[|ª;¨ýTable 4.5: blunderbuss search methods
107

AG
G
G
G
B

G
G

G

AG
G

B

G
G

G

4.4 constructing Case and Fix
This section shows how to derive two alternative eliminators for each datatype, corresponding to the Case and Fix operators in C OQ.

4.4.1 case analysis for datatypes and relations
From the elimination rule given for a datatype or relation,
we may construct a ‘sawn-off’ version which embodies thenotion that we may reason about an arbitrary inhabitant of
the type by considering each of the possibilities for its outermost ‘head’ constructor, but without any recursive information. For 8 , we get 8 :9<;4=?> .

8 (9@;A=B>
C"DFEHGID

8 KJMLMNPORQG DU8J7JVJ7J7JMJ
CTS
C G
=
E GUD
CWG
8 J

This construction builds theorem and proof together by a technique which I call hubris:
we proudly attempt to prove a blatantly false claim and fail, turning the remaining
subgoals into premises, just like a lecturer leaving the bits he has forgotten how to do
as exercises for the students. The trick is to postpone the remaining X -bindings at theoutside level, turning them into Y -bindings, and then to discharge them.
C ONSTRUCTION: case analysis
Suppose we have a inductive family

ZF[A\ D]E_^ `7D a ^^ ` Jcb4d
where
are the indices (as in dependent datatypes or relations)
bed is the universe the family of types inhabits
We need only consider indices, fixing the parameters of families like fg=?hand ij>klh for the whole construction.
This family will have an elimination rule

CrDsEtu ^ZF[A\nmpoq\

JcbAv

E wy^ x wsubgoals
D Z][4\ C z ^
J
Z][4\
^
where u inhabits a prefix ofz ^ is the corresponding prefix of wy^ x1w
b4v is the universe over which the family of types eliminates
108For our inductive definitions, the subgoalsCapplications of .
Let us boldly fix a
prove

C

and attempt toThis is patently untrue, but neverZF[A\nmpoq\mind, eliminate using
.

|

{^

C
D}E ^
Y ZF[A\([4? D}E u J~b4v D ZF[A\wy^ x w
X
C z^

{^
D
C
J7^ J7J~
J7J7J
D
X ^
 Z][4\([ABeZF[A\moq\ C
DeE wy^ x w D ZF[A\ J7J7J
C z^

Note that the holes may not appear so
neatly ordered, but no matter.

X{^

The subgoals
correspond to theconstructors of the datatype.

{jFor each , we divide its hypotheses into^^case data  and inductive hypotheses  B] .

|For our inductive definitions,nothing is permitted to dependon the inductive hypotheses.
Hence we may remove them withdelete-unused.
Having modified the subgoals inthis way, let us postpone them.
The state is now as shown.

have conclusions which are

X{ D}E  ^ D  ^E ?^s D
C j^  F^  J7J7Jc

C:D}Et^Y { ^ u JcbAv
D}E ^ C ^ ^Y ^  J  F
^ D
Y  ZF[A\moq\ C
J7J7J
DeEjC
D}E u ^
JbAv
E {^D}E  ^ C ^  F^ 
J
E ^
D ^
Ewy^ x w D ZF[4\Cz ^It is not hard to see that the following reductions hold

ZF[A\[4? C { ^ ^ ` *x 
H{ ¡  ^^9  RK
@

109

J7J7J

C
DeEtu ^
Y ^J~b4v{
DeEy ^ C^  *^ 
Y
J
D ^
Y ^
 ZF[4\([A?ZF[A\moq\ C
DeE wy^ x w D ZF[A\ J7J7J
C z^
 ZF[A\([4?

Finally, we may discharge theassumptions, recovering the caseanalysis principle as we might expect it.

C4.4.2 the guarded fixpoint principle
Before giving the construction of the elimination rule which performs the job of C OQ’s
Fix construct, let us look at an example which motivates both the need for it and themanner in which it is done.

¢£
¢ £
¢ £

It is that famous old troublemaker: the Fibonacci function, which is used for counting rabbits, drawing attractive rectangles and making Euclid’s algorithm goas slowly as possible:

Let us see what goes wrong if we just blunder in with 8 :§pfg¨ ,trying to mimic this definition. Here is the initial state, with

the return type decorated by -binding, so we can see what ishappening.

G

Let us eliminate .

Again, the -binding tracks the arguments. We can certainly¢£A®
fill in. Now watch what happens when we eliminate
again to split the successor case:© £S

The g = case is fine, but for double-successor,© £ G
disaster has struck! We have our g = safely© £ Genough, but what has happened with g? It hasappeared, all right, but in the wrong place—we haveno hope of accessing it.



S

=G

S



S



=S
=

=?=
¤ f¥¦=  ¢£ G  ¢£ = G © £ D
g D Y 8 ªJM8¢¬£ D­EH8 $G4«
D LMNPORQX© £8 Gg¢£A® D © £ S
X ¢£°¯ D}EgG D
X
EF±e²M³D 8© £ G© £ Ggg =¢£A¯® DVE*±­² ® D © £ S© £ Sg¢£A¯1¯ DVEHG g = DX
EH´Rµ·¶¸DVE*8 ±e²7³D © £ G© £ G gE*±­² ¯ ³ D © £ g G =© £ Gg =g =?=XOf course, the classic definition of the Fibonacci function is famous for its abominablerun-time.4 The traditional remedy is to write a linear recursion computing a pair of
successive values. In [BD77], Burstall and Darlington transform the above definition
into the following more efficient form:

¢¬£
¬¢ £
¬¢ £

¢£
¢£ =?=
=?=
4


S

=G

S

=S


==S
G
=

S




= ¢¬£ GV ¹ºx1»y J ¤ f¥y= ¹¼»½ S·¾=?= S·¿= = ¢¬£ =?= G V ¹ºx1»y J ½ » ¾ ¤ f¥y= ¹À» ¿Exercise: compute this.

110

¢£

By design, the auxiliary function=?= computes exactly the information required tocomplete the double-successor case, and it does so by a one-step recursion. The mainfunction is thus reduced to a case analysis.
In [Gim94], Giménez effectively generalises this technique to an encoding of recursion
on guarded arguments, and it this technique which I present below.
D EFINITION: guarded^ÁÁ

if 9@ is a datatype constructor with non-recursive arguments Â and^^ ^recursive arguments  , then each  d is guarded5 (by 9< ) in 9@ Â 
if  is guarded in  and  is guarded in Ã , then  is guarded in Ã

The idea is to introduce an intermediate data structure which
stores for each input the recursive values we need to computethe output. We may code this up as an elimination rule:GCÄDsEHGÅD

8 ªJMLMNPOQÆ Ç_È C GI
J7J7JVJ7J7J7JVJ7J
CWG
E GÅD
CWG
8 J

Once we have applied this rule, case analysis on allows us to split the subgoal intoC
cases for the separate patterns we wish to treat: for each pattern z , we must prove z
ÆIÇ_È C z
using the information supplied in.
Of course, to prove this rule, we shall have to be able to show

EHGÉD

8 ªJ

ÆIÇ·È C GGThis proof will go by recursion on : we must generate the auxiliary information forGG= from the corresponding information for . Just as in the Fibonacci function, we may
carry over any information we need to keep, together with computing the new value inexactly the same way as the ‘main’ function does.

ÆIÇ_È

C be? Different depths of recursion necessitate different amounts ofWhat should
auxiliary information. For Fibonacci, we may choose
Ê



Ï

S

Ê ¥yËsÌ_dÎÍ SÊ ¥yËsÌ_dÎÍU= G¥yËsÌ_dÎÍ·=B=Ï © g £ G ]Ð( © g £ = G 

Õ4Ö ×ÙÔ Ø , then it is Ñ ÒÚÕ Ô which ismore carefully, if Ñ Ò is a higher-order recursive argument of type Ó·ÔÕ
guarded, for any Ô
5111

Stylish users may choose to develop their auxiliary data structure as they develop theirfunction, for each follows the case analysis of the other.
More generally, we may give a single auxiliary structure suitable for all occasions.
C
Giménez defines it inductively for a parametric :

8

Ê

CÜG
S

¥yËsÛ(;Ah; C

Ê
C G
8
y
¥
¬
Ë
(
Û
4
;

h
;
Ê
G
8 ¥¦ËsÛ(;Ah1; C =For each datatype, the auxiliary mimics the constructors and recursion pattern. EachC
recursive argument is decorated with a proof, so that for each element of the originalCtype, the auxiliary stores

EHGÉD

for all its proper subterms. Proofs ofÊG
8 ªJ  8 ¥yË¬Û(;4h; C =  CWGÊ¥yË¬Û:;Ah; , at the same time splitting the 8 -patterns andthen go by case analysis on 8
surfacing the recursions for the exposed subterms.
My treatment differs only pragmatically, in that I compute the auxiliary structure rather
than defining it inductively.

ÊC S
8 Ê ¥yË C G
8 ¥yË =Ï CÜG ]Ð( 8 Ê ¥yË CÜG Ê

As case analysis feeds 8¥yË constructor expressions, it unfolds like one of those walC
lets for people with too many credit cards, revealing the proofs of for the exposed
subterms. The blunderbuss tactic can be used to extract the required hypothesis, provided it can be identified from its type.
Let us try to prove

EHGÉD

8 ªJ78

Ê

¥¦Ë

CÜG

G

by induction on . The base case is trivial. The step case is

EHGÉD

Ê
Ê
CÝG 
C G
8 ªJ  8 ¥yË«8 ¥yË =which reduces to

EHGÉD

Ê
CÝG 
8 ªJ  8 ¥yË CÝG sÐÞ 8 Ê ¥¦Ë CWG 112

We can clearly establish the second component of the pair. This leaves the requirement

EHGÉD

Ê
CÝG 
8 ªJ  8 ¥yËCÜGAgain using the ‘hubris’ technique, we may postpone and discharge this subgoal, we have the auxiliary generation lemmaÊ
8 ¥yË¬ßà> :

EHGÉD

©

8 KJ7LMNPORQ

Ê
CWG
8 ¥yË
J7JMJ7JMJ7JMJMJ7J7JVJ
CÝG
E GID
CÜG
8 J

Ê
CÝG 
CÜG
8 ªEHGÅ
J  D 8 ¥yË Ê
CW G
8 ªJM8 ¥yË

and hence the elimination rule 8©
8 gËCÄDsEHGÉDgË .

I shall give the general construction for simple types, then discuss extensions.
C ONSTRUCTION: guarded fixpoint
Consider an inductive family of datatypes
with á constructors as shown right.

^^

The Â are non-recursive and the  are â?
moq\recursive arguments. Let ãåäyæ
be itsstandard elimination rule.
Let us fix the components to besupplied by the user and makeholes for the components to besupplied by machine.
A Æ¼îHï
binding ãåäyæ
helps us trackÆIÇ_È
the development of ãåäyæ
.

We may immediately prove ãä¦æãåäyæZ¬q È<Z¬q È

DeE  Dãä¦æºJMLMNPORQ D ãåäyæÙJVLMNPORQY
DeE  Dãä¦Æ¼æ îHïDeE  ãåäyæ D
E Â~ó¬ D ãä¦æ ÆKÇ_È C  ãä¦æÆIÇ·È_ôõ DeE  DX]ãäyæ
äãä¦ÆKæ Ç_ÈZ¬q ÈD ãåäyæ
X]ãäyæE  DC  ãä¦æ

Y

C

Dãåäyæ LMNPORQÂ ^ D ç ^   ^ D_è ãäyæêé*ëíì^ ^ D
9@ Â  ãåäyæ

Æ¼îHïãäyæ ÆIÇ·ÈX]ãäyæ
µYcð¦ñpò

withÆKÇ_È_ôõ DµY  åã äyæêJ?ð¦ñ_ò Ý ãä¦æä

Now let us eliminate the  in both the auxiliary and its generator, aquiringa subgoal for each constructor. One is enough to illustrate the point, andreduces the subscript terror.
113XFãåäyæ
ãåäyæ

DeE Â ^ D ç ^E  ^ D¬èãåäyæêÆ¼
é*ë îHï
E ù ^ D¬è dé ëdãåäyîHæ ï
Æ¼
 9@ Â ^ R^ 
å
ã
y
ä
æ

mpoq\Æ¼îHï
ÆKÇ_È~öø÷ ³
ãåäyæ
ãåäyæ
ãåäyæ
J7J7J

ÆIÇ_Èöø÷ ³

ÆIÇ_È

ÆIÇ_È·ôà øö ÷ ³ DeE Â ^ D ç ^äE  ^ D¬èé ë Ç_È
E ^ D¬è ãä¦æêÆKÃ ÆKãä¦Ç_æ ÈHö ÷ ³ ^  ^ dé ^ ëdÂ  ãåäyæ mpoq\
ÆKÇ_È ÃÆKÇ_È_ôõ öø÷ ³ ÆIÇ_È·ôà
ãåäyæ
ä
ãåäyæ
ãåäyæ
ãä¦æ
ä J7J7J
ÆKÇ_ÈHö ÷ ³
To build ãåäyæ
, we introduce the arguments and return the iterated úùCof pair-types collecting, for each recursive argument  d , both  d and d ,ÆIÇ_È which the lovely let-binding reminds us is really ãåäyæ
d.
³
ÆIÇ_È·ôà öø÷
ä , we introduce the arguments and return the correFor ãåäyæ
sponding iterated tuple of pairs, passing on the accumulated proof Ãød andµadding the next layer, computed by ð¦ñ_ò .
XFãåäyæ

ãåäyæÆIÇ_Èöø÷ ³^ D ç^Y Â ^ D¬èY  ù ^ ãäyæêÆ¼
é ë îHïD¬èY è Cãäyæù d1é ëd


s

Ð
ú
d
dé ëdÆIÇ_È·ôà øö ÷ ³  Â ^ D ç ^äY ^ DsèY  ^ Dsè ãåäyæêÆIé ë Ç_È dé ëdY Ã û èü ãåäyæ µ x
mð¦oq\ñpò dÆIÃ d Ç_È Ã døýé7ëdMþ ÆKÇ_È·ôà öø÷ ³ ÆIÇ_È·ôà
ãåäyæ
ä
ãåäyæ
ãåäyæ
ãåäyæ
ä
J7J7J
Æ¼îHï
Cutting ãåäyæ
and the proofs of the subgoals, then discharging the fixed


ãåäyæ

hypotheses, we are left with

114



ãåäyæ

ÆIÇ_È



D­EJ7C:JMJ D}E  Dãä¦æêJ7LMNPORQ
E  D
ãä¦æ
 ÆIÇ_È·ôà  LMNPORQãåäyæä D­EJ7C JMJ DVE
D
Eµ­DVE  ãåäyæ D JMLMNPORQð¦ñ_ò Eãä¦æÂ~ó¬ D ãä¦æ ÆKÇ_È 
C 
E 
D
ÆKÇ_ãåÈ äy ^æãåäyæ Zsq Èãåäyæ
DeEjJMC J7J D}E  D
EµeD}E  ãåäyD æÙJMLMNPOQð¦ñpò EãåäyæÂ~ó¬ D ãåäyæ ÆIÇ_È 
C 
E  D
ãäyæ
C 

CÄDsE  Dãä¦æêJ7LMNPORQ

ÆIÇ_È C åã äyæJMJ7JMJ7JMJMJ7J7JVJ7J7J7J
C 
CWG
E  D
ãåäyæ J

The following conversions hold:ÆKÇ_È C 
ÆIÇ_È C  
è C
^ ^ 
ãåäyæ
9@ Â Rõÿ ú   d ]Ð: ãåäyæd é ëdÆKÇ_È·ôà C 
^ R^  ÿ
Â
ãåäyæ
ä
9@
üèü Zsq È C  x ÆKÇ_È·ôà C ãåäyæd ãåäyæ
ädøý}é*ëd ýZ¬q È C  ÿ  ÆKÇ_È_ôõ C R
ãåäyæ
ãä¦æ
ä
ZF[4\

For dependent families, we have exactly the same construction, replacing ãäyæ by
Z][4\ZF[4\ ^`or someas appropriate:115

DE­ ^ D Z][4\  ^ D ZF[4\ JMLMNPORQ Y Â ^ D ç ^ JMLMNPORQ Z][4\àÆIÇ_Èpöø÷ ³
Y ^ D¬è ZF[A\ ^Y  ù ^ ZF[A\WÆ¼ dîHé ï ëdD¬è ^ d x1 dé ëd
Y è C ^  x1 d ]Ð ù d1é ëdZ ][4\àÆIÇ_ÈZ][4ú \moq\ d ZF[A\WÆ¼îHï ZF[A\WÆKÇ_Èpöø÷ ³
J7J7Jµ
DEe ^ D ZF[A\Y¬ð¦ñ_òE Âcó¬ D ZF[A\àÆIÇ_È  ^C ^³ Z][4\àÆIÇ_È·ôà öø÷  Â ^ D ç ^äY ^ D¬è ZF[4\ ^Y  ^ D¬è ZF[4\àÆI d1Ç·é È ëd ^
 d x1 dé ëY Ã û èü ð¦ñpò µ  ^ d x dÃ d x Ã d d ý}é ë
Z][4\moq\ ZF[A\WÆKÇ_ÈÉZF[A\Wd þ ÆKÇ_È_ôõ öø÷ ³
 Z][4\àÆIÇ_È·ôà
ä
ä
JMJ7J
  ^ D ZF[4\ Z][4\Zsq Èµ Ý^  ZF[4\àÆIÇ·È_ôõ R^ YJBð¦ñ_òäCY  Z][4\àÆ¼îHï

If we have higher-order recursive arguments, we must abstract the pairs over them:ÆIÇ·È÷J7JMJ  ^ ^DVE D Y
J*ãåäyæJ7JMJ  ^ ^Æ¼îHï    ^ ù DVE D 
Y
*
J
å
ã
y
ä
æ
E  ^ D  ^  C    ^ B]Ð: ù  ^ 
ú
M
J
7
J
J
J
 ÆIÇ·È_ôõ }÷?
ãäyæä
J7JMJ  ^ ^DVE D YJFãåäyæJ7JMJ  ^ ^ÆIÇ_È    ^ 
DVE D 
YÚÃ 
F
J
å
ã
y
ä
æ
 ^ D  ^ J   ð¦ñ_ò µ Î  ^  Ã  ^ BxF Ã  ^  
J7J7JYãäyæ

Now that we have built these useful elimination rules, let us move on to consider thetechnology we need to solve the constraints which arise when we use them for dependent subfamilies.

116

Chapter 5
Equality and Object-Level Unification
This chapter examines different notions of propositional equality in Type Theory, together with the forms of equational reasoning they support.
In particular, I shall give a formal treatment of the predicate which I have been exploiting glibly until now: it is merely a convenient packaging of Martin-Löf’s identity
type together with the ‘uniqueness of identity proofs’ axiom proposed by Altenkirch
and Streicher [Str93]. The reason for reformulating equality in this way is to improve
the treatment of equality for sequences of terms in the presence of type dependency.
Once we have a definition of equality we can work with, the task is then to builda tactic, simplify, which solves first-order constructor form equations appearing as
premises to goals. To achieve this, we will need to construct still more machinery foreach inductive datatype:Á

a proof that constructors are injective and disjointÁa disproof of cyclic equations like

G

¸=

G

117

5.1 two nearly inductive definitions of equality
5.1.1 Martin-Löf’s identity type

² Dç
Â É
I
²
Â D
O

Dç >Â Â D Â·Âç Â C {! Âª {&gA§fg¨> ÂH#"%$gA§pfg¨

gA§fg¨CÄDsE²yD ç²
J ÎÂ   LMNPORQC ÂK >' Â~E²¦D ç E  D Â ² C ² JJis known in the business as ‘J’, for historical reasons.

We may easily prove that this equality is
substitutive in the usual sense.

C

The proof fixes

and the proof of thesingle case, then applies eliminate withg A§pfg¨ . The generated scheme makes no£use of the equation’s proof—g c¥ =Bh is‘proof irrelevant’.



)(

£
g*(c¥ ?= hCrD ç«LMNPOQ
C Â
E²yD ç E  D Â ² Cn²JJ)(c¥ £ =?h :It will prove convenient to have some sugar for applications of gÁ

substitutionÁ ~  C  ,+

coercion ~   ,+g*(c¥£=?h D Â ²  DHC Â H  C  DHC ²

ç Â C  ²  D ~. -0/213457689/  ~  D ù)(c¥ £ =Bh follows from that of gA§fg¨ :The computational behaviour of g

  >' Â  C Ã
Ã

118

ù



 D

5.1.2 uniqueness of identity proofs
Altenkirch and Streicher suggest thatshould be equippedwith the additional elimination rule shown, together with its
computational behaviour.

ç C {&  {&g):yg;A¥y> Â>< ÂH="%$g*:yg;A¥y>
CrD  Â·Â~ LMNPORQC > < ÂC E  D Â 
·Â J 

This rule is sometimes known in the business as ‘K’, largely because it comes after
‘J’.1

ç



For a given element type, , the aperture of g A§fg¨ , ie the space of equations overç Ð çwhich its scheme must range is two dimensional:. However, g yg A¥y> ’s
scheme ranges only over the diagonal. Of course, it is only the diagonal which isinhabited.

*: ;*: ; ?>Hofmann and Streicher have shown that g yg A¥y> is not derivable from g 4§£fg¨ [HoS94]. On the other hand, Streicher adds that g 4§pfg¨ is unnecessary if g c¥ =?h£²
and g yg A¥y> are taken as axiomatic: we may first use g c¥ =?h to replace by Â , say,ÂH . Effectively,
then g yg A¥y> to reduce the remaining arbitrary proof of Â ÚÂ to  >£we divide the g A§fg¨ process into two phases: the proof irrelevant phase (g c¥ =?h )reduces the family to its inhabited subfamily of reflexive equations, so the proof
relevant phase (g yg A¥y> ) need only be concerned with that restricted case.

*: ;): ;





*(



 *()(): ;5.1.3@ , or ‘John Major’ equality

It is now time to reveal the definition of , the ‘John Major’ equality relation.2 John
Major’s ‘classless society’ widened people’s aspirations to equality, but also the gap
between rich and poor. After all, aspiring to be equal to others than oneself is thepolitics of envy. In much the same way, forms equations between members of any
type, but they cannot be treated as equals (ie substituted) unless they are of the same
type. Just as before, each thing is only equal to itself.
1

Aficionados of the trombone might fondly imagine that the two rules are named after legendary jazz
duo J.J. Johnson and Kai Winding. I do not propose to pour cold water on this explanation.
2
John Major was the last ever leader of the Conservative Party to be Prime Minister (1990 to 1997)of the United Kingdom, in case he has slipped your mind.

119²ÅDA
Â Dç
Â ²ÅD O>;A§fg¨CÄDsE ÂC D ç

Dç > Â Â D Â Âç Â C {,B! ÂI  ÂH#"%$ {&>;A§fg¨>;Observe that > A§fg¨
inductively defined.

J  Â ÂC  «LMNPORQC ÂK  ÂH>E Â C D ç E DjD Â ÂEC C Â C D
JJ

is not the elimination rule which one would expect if>;GF A§fg¨
CrDsHE AÉD
E²¦DIA  Â
LMNPORQ1JJThe ‘usual’ rule eliminates over all theformable equations, and it is quite useless: it cannot be used to substitutetwo values of the same type because thescheme must be abstracted over an arbitrary type.

²

was

 LMNPORQC ç Âª  Â
>
EHA¸D
E²¦D2A E  D Â ² CJAÀ² 
LMNPORQJJJ;

By contrast, > A§pfg¨ eliminates only over the subfamily where the two types are thesame, the ‘type diagonal’: of course, all the inhabitants lie in this subfamily.

5.1.4 equality for sequences
The reason for adopting rather than when working with dependent types can beseen clearly when we attempt to extend the notion of equality to cover not just two^ ^ D ù^terms in a type but two sequences of terms in a telescope. Suppose we have  
for
ù^
^
^
^



some -telescope . We may not, in general, state the equality of sequences and asLK7·EKPx1<MNÚM*x J7J7J(Ð )<M D ù M* EK  while <M D ù M] EK , and these may be different.

since There is, of course, nothing to stop us writingLK EKx1M <MMx J7J7J
which will henceforth be abbreviated as the telescopic equation ^ ^.

We may correspondingly abbreviate the sequence of reflexivity proofs  > LK }xF  > <Mx J7J7J
120   ^ .

by >Let us not stop at that: in fact, we may prove substitutivity and uniqueness for telescopic equations.
C ONSTRUCTION: telescopic substitutionO

For each natural number , we may derivea substitution principle for telescopic equations of length .

O>;)(c¥CÄD ù ^The reduction behaviour will be as follows:>;)(c¥£=?h³ ù ^  ^ C {,B! :^ {,&^> ]K

£

=Bh

³

 LMNPORQC ^^E ^ D ù E ^ D ^ ^ C ^
J
J

O

;

The construction is by recursion on , effectively iterating > 4§pfg¨ .
The zero case is proved by the polymorphic identity function. Clearly the reduction behaviour is correct.

Now, assuming we have al£ ³
ready constructed > c¥ =Bh ,£ ³
let us construct > c¥ =?h
.

;*(

ù ù^

^ C

;)( <P

K

Fixing x , cx  , and the proof of
have the goal shown.

£ ³P>;*(c¥ =?h K
CrD ù x ù ^ LMNPOQ£ ®
>;)(c¥ =?hCÄD
LMNPOQ
CC

C cx  ^^E cx  ^ D ù x ù E x  ^ D cx  ^ cx  ^ C cx  ^JJC x  ^DVE ^ D ù ù ^XRQ·ñ?S'T E cx  ^ D x ^ x  x  x  ^C ¬x  ^ùNow,  is a proof that   , where both have type , hence we may elimi^^
nate  by >;A§fg¨ . The generated scheme includes all the  and  :DùDE ^ D ù^ E ^ D ^ ^ C ^Y  JFY   J  J    J cx Note that, as nothing depends on  , the proof relevance of >;A§fg¨ is not£necessary for this construction, just as in the construction of g *(c¥ =?h fromg A§fg¨ .
121

, we

The elimination leaves with the subgoal
shown.

VU ù ^ù ù^<X W ¹ ð Q·ñXS'T DVEEj ^  ^ DD  ù ^ x ù ^ ^ C x  ^Note that  x  is just   }p , which is^exactly the telescope of  .
^^Now that  and  have the same telescope, we may eliminate the remaining ^ by > c¥ £ =Bh ³ : the scheme is just C  . This leaves us with the subgoal
C x  ^, a proof of which we fixed in the context.

;)(

Y

;

From the -reduction associated with > 4§pfg¨pothesis, we may deduce thatand then the inductive hy-

Observe that the same proof structure also
yields substitutivity in the other direction.

>;)(c¥CÄD ù ^

£ ³ P ù ù ^ ^ C {  cx :^   *}xF  F^ >;)(c¥ =?h K x cx 
>
>
£ ³
ù : 



:


>;A§fg¨
J7JMJ ^ >;*(c¥ =?h J7J7J> ] JMJ7J£ ³ ù ù{, ^^ C^>;)(c¥ =?h   x ] : ] :  > FR
{ 

^

^

Although the roles of  and  are reversed,^
we may still fix the  and abstract over

=Bh[Z]\³

 LMNPORQC ^^E ^ D ù E ^ D ^ ^ C ^JJ^the  (the right hand sides) as required by> A§fg¨ .

;£C ONSTRUCTION: telescopic uniquenessO

For each natural number , we may derive asubstitution principle for telescopic equations oflength .

O

The reduction behaviour will be as follows:>;):yg;4¥¦>³ ù ^  ^ C {,& :^ {&^> Fª³>;):yg;A¥y>CÄD ^ ^
2Ã Ã¦ LMNPORQ

C  ^
>  Ã
E ^ D ^ ^ C ^IÃ Ã JOThis construction also proceeds by recursion on , again with polymorphic
identity as the base case. The step case is slightly more subtle than for£> c¥ =Bh .

;)(;*:yg;A¥y> ³ : let us constructSuppose we have already constructed >³.
> yg A¥y>;): ; <P K

122

This time we fix everything except the proofsof the equations.

X<Q·ñXS'TD}E  x  ^ D x ^ x ^C cx  ^ Ã ÃIÅÃ Ã;We have little choice but to eliminate  with > 4§pfg¨ . Perforce, this introduces equational constraints in the scheme:

 D C ]   C x  ^Neither of these constraints is disposable, since  definitely occurs in theYDD E ^D ^ ^JFY C ÃI  J cx  Ã x Ã2ÉÃ x Ã J Î ÅÃ  Dùgoal, and, in general, we may expect Ã to occur (implicitly) in the types of^the  .
Consequently, the subgoal we get is asshown.

^C

We may discard  , then eliminate£> c¥ =Bh .

;)(

K

Now

we

_ with 

are ready to appealC, with scheme  > ºÃ  .

to<X W ¹ ð Q·ñXS'T DVEE  Cx  ^ DD Ã x ^ÃI¸Ã x ^Ã
ÃIÉÃ
E D
> Ù2Ã 
C _ x  ^ 

DVE  ^ D ^ ^C   ÃI Ã }x  ^
>ºÃ
^
C 
 ^
This turns the remaining  into  > Ã  , so that the fixed proof of  > ÙÃ >;):yg;A¥y>³

RX W ¹ ð Q·ñXS'T

completes our obligations.
As far as the reduction behaviour is concerned, forgive me if I omit the detail. The construction successively applies elimination rules for equations
which reduce to their single subgoals when those equations are instantiated³with reflexivity. Consequently, each > yg A¥y> inherits this behaviour.

;): ;It is not impossible to build a notion of telescopic equality with substitution using , but
it is considerably more cumbersome. The method forces each equation to typecheck,by explicit appeal to the substitution operator for the prefixed equations. That is, weneed the first operators in order to formulate a telescopic equation of length, let alone establish its own substitutivity. Furthermore, in order to make the stepin the construction, it is not sufficient simply to substitute for the first equation with£g c¥ =?h , but rather we must eliminate it with g A§pfg¨ , not only substituting the terms,
but also instantiating the proof with reflexivity, allowing the substitutions repairing theremainder of the equations to reduce. By adopting , we achieve at least this telescopic
extension without acquiring proof relevant dirt under our fingernails.

b

O

Oa`

)(



123

5.1.5 the relationship between@

andHaving argued for the practicality of using instead of when working with dependent types, I nonetheless feel obliged to point out that the two are equivalent—provided
we mean equipped with g yg A¥y> . Let me now give the mutual construction. First,
the easy direction:

*: ;C ONSTRUCTION:

c fromb

This is so easy that I will just tell you the answers—by construction,
just telescopic equation for telescopes of length .





Y

ç

D

LMNPORQÂY ð D ç
Â ²
DeE ç DE XÂ D ç LMNPORQð  O
 

><
>ç  D
DeE E Â D ç LMNPOQEÂ Â ££
g)(c¥ =?h DeE> ç ;*(c¥ D =?h K
E Â D ç LMNPORQ
EjC D çE { DFC Â  LMNPORQ
E² D çE  D Â ²
C ²g):yg;A¥y> DeE> ç ;*:yD g ;A¥y> K
E Â D ç LMNPORQ
EjC D Â Â
E { DFC   «LMÂHNP ORQ> <E  D Â ·Â C )(c¥ £ =Bh and g):yg;A¥y> is ex-

Furthermore, the reduction behaviour for g£
actly that for > c¥ =?h and > yg A¥y> .

K

;)(

;): ; K

The other direction is the interesting one.
C ONSTRUCTION:

from

is

c with dfehgjid!kmln

Let us assume we haveand construct:
124D}E ç D
E Â D ç LMNPORQ
pE oàD LMNPORQ
E D]oð 
X > D}E ç D O LMNPORQ
E Â Dç
Â ÂD}E ç D
XM>;A§fg¨ E
LMNPOQÂ Dç
EjC D}E ÂEC D ç Â ÂC
E { DFC ÂK  J ÂH «LMNPORQ>E ÂC DçE  D Â ÂC
C ÂCD
XR

Let us first make a little abbreviation:kl>ff

,+

ú

ç D

LMNPORQJçkl>ff packages up a typed term. The idea is that  ç DY D ç LMNPORQY ÂoàDY DNo LMNPORQYð ü çx1Â ü o x ð¦ý  ç D ý
>  Y Â D çLMNPORQ
Y >< ü ç x1Â ý

is justfor k>ff s:

This makes the elimination rule

XM>;A§fg¨

D}E ç
E Â
EjC

D

D ç LMNPOQ
D}E²cD ç
E  DHü ç xÂüç x ²
ý
ý
M
L
P
N

O
Q
E { DFC ÂK 
> ' ü ç x1Â ý E² D çE  Drü ç x1Â
üç x ²
ý
ý
Cn² 

²

If we could only deduce Âfrom  , we would be most of the way there.
For that, we need a proof that equal cells have equal second projections.

125): ;The equivalence of g yg 4¥¦> and equality of second projections fromdependent pairs is folklore knowledge, but I shall do the work nonetheless.
It is even difficult to state the equality of the second projections, because
they are not of convertible types—we must use the substitutivity of equality to make a type coercion.

¶q VD E ç Â Ay²cD
Lñ r E  D çkl>Â ff Ay²
ç Â ç Â
Ay²  A ² E 
Dç A  ~ ÂH7 ²

X<W

The lemma we need is as shown. Let us
claim it globally and work on the main
goal.



Observe thatW ¶q ñVr  DsE  D ç ç J   ~  Â7 ²

so thatW ¶q ñLr :  >' ç  D Â ²
Let us exploit this discovery. Introducing
all the hypotheses, this is the goal we now
must solve.

²

As the type of  contains , it is wise toreabstract it:
We may now eliminateg)(c¥

£

=Bh .

C

SMð

by

Now  is a reflexive equation!

):yg;4¥¦> .

We may eliminate it by g

The subgoal we acquire follows{
from .
All that remains is to prove£the cells,  with g c¥ =?h .

)(



SMð

X<Q·ñXS'T

WD Â¶q ² ñLr :  > ç 
DºCn²WÂE¶q ² ñLr (  >< ç 
DeE D~ü çüç x ²
XRQ·ñ?S'T C  C C ² x1Â ýýCD·Q ñ?S'T ·Q ñ?S'T C Â ²<X W ¹ ð Q·ñXS'T

D}E C D~ü ç x1Â
C Â4 C ýü ç x1Â

DFC ÂK ü ç xÂ ý

XNsutvtxw¬òXs7S'yNw>v9zýW ¶q ñLr . Firstly, we eliminate the equation on

126

Although the two pairs unpacked by the binding sugar are the same, we have two names foreach projection. We can clear this up by elimiçnating Â , reducing the projections and cuttingthe sugared -bindings.

*:yg;A¥y> to remove the reflex-

Now we may use give  .

 ' !

The remaining subgoal has exactly the type of >DE ç D
X<WS't{w ç ç Â kl>ff
ÂR Â¬ç ÂR A ² E  Dç A  ~ Â7 ²



X*ñ

¶

[w | D}EE çÂ DD çLMNPORQ

E  Dç ç  ~  ÂH7·Â

q DVE ç D
X w} E ç D LMNPORQÂÂ ÚÂAs far as reduction behaviour is concerned, first observe thatW ¶q ñLr   >' ü ç xÂ ý   > ç  ÿ   >< Â¶qThis is because W ñLr eliminates in succession the first equation, the cell,then the second equation, and all three are in constructor form. Conse; §pfg¨ is applied to   > ÂH , the computed equality proof
quently, when >A
MS ð turns out to be  > Â . Since both these equations are reflexive, both£
the g)c( ¥ =?h and g)
: yg4; ¥¦> steps reduce as required.
5.2 first-order unification for constructor forms
A typical application of an elimination rule with scheme variableengender a schemeC ^ ` E­^ ^ ` ^ ^Y J  J Ã  · ~

Correspondingly, cases of formw^ D ^JMJ7JMJ7JMJMJ
C ~^  w·127

C DRE ^`D a ^JsLMNPORQ will

yield subgoals in the proof of formE w ^ E  ^ H^  w· ^  ·^ 
J J
Ã 

~

The equational constraints constitute a unification problem: if there is no solution,then the goal follows vacuously; if there is a most general unifier, we may use it to^^
instantiate the w and  .

D}EHGeD
Xi¦h;4gf E D 8» i>klh (= G )Gi>khSuppose, for example, we wish to write the ‘vector tail’
function, whose type prevents application to a null vector:
Note that I have fixed the element type

çto avoid clutter.

Eliminating » with i>kh9@;A=?> creates a constrained schemeDDEHGÅD EpÙDGGY 8 ªJ]Y  ij>klh,øJ
8 ªJ
ij>klh  =  J<.=  i>klhG

XBi¦h;4gf   D}EG D
E  D i8 >klh  = G 
E V K DMS G
The i¦h1;Agf    subgoal features the impossible
E ' M D  ¸=
premise that zero equals a successor, whilst inG
the i¦h1;Agf  '[ case the equations conveniently conD}Eij >D klh
XBi¦h;4gf  '[ E  D ç 8strain the type of the tail to be the return type of the
E D
function.
ÃEG D i>klh
E D 8 G 
E VK D i >klh G =E ' M D  = ¸=Gij>klh
DVEHG­D
Xi¦h;Agf  '' E  D ç 8
If we could solve these unification problems, we would
be left with this goal.
E DG
Ã i>klG hi>klh
The corresponding subgoals are as shown.

We would then introduce the arguments and return the tail.
The task does seem to hinge on solving the unification problems generated in the courseof elimination. In [McB96], I presented a tactic (‘Qnify’) for solving such problems,
provided the terms comprised constructor forms in simple datatypes. I shall largely
follow that treatment, extending the same procedure to dependent datatypes.
1285.2.1 transition rules for first-order unification
The ‘Qnify’ tactic operates by successively eliminating from the goal hypotheticalequations between constructor forms:E­ ^ J ¸Ã¦C

D EFINITION: constructor form

Ã is a constructor form over variable set  if eitherÁ ÃÁ Ã %ä ^Ã
where each Ã d is a constructor form over 
In the above goal, suppose  and Ã have the same type and are constructor forms over^the  . We may distinguish six possibilities by the following decision table:3




Ã
w

  [Ao ? ^   ^  ?^  ^Ã
if   Ã then cycle

identity
coalescence else substitution
apply
conflict
symmetry
injectivity

For each of these six kinds of constructor equation, there is an elimination rule. They
are shown in table 5.1
These six rules, once we have proven them, will constitute the transition rules of a
unification algorithm which is complete for the following class of problem:
D EFINITION: constructor form unification problem
A constructor form unification problem is a goal of form:E  ^ ^ ^
J Ã¦

^

C  ·^ ^

where the  and Ã are sequences of constructor forms over ùinhabiting some telescope3

L  and LXV] are constructors as different as chalk and cheese.
129

^

CrD

LMNPORQ

identity





CrD ù
coalescence

CrD

C


 LMNPORQC 
E w Dù w 
J


C w

LMNPORQ

cycle

CrD ù

 j B ^Ã   ^ÃC

 LMNPORQ B ^jÃ? ^E  Dù 
J Ã Csubstitution

CrD
conflict

CrD
injectivityCC x ^ÃLMNPORQ  [Ao  ^ ¡ ? ^Ã 
C

LMNPORQ ^ ^Ã¦  ?  ^ ¡C? ^Ã CTable 5.1: elimination rules for constructor form equations

130

LK[ K D ù K

Since  Ã
, the leading equation has both sides the same type, so that exactly oneof the above rules must apply (using symmetry if necessary). We must also check thateach of these rules preserves this structure.
L EMMA: transition rules preserve problem structure
Given a constructor form unification problem

E  ^ E cx  ^ D cx  ^ x ^ C  ·^ JÉÃ Ã Jeliminating  by the appropriate transition rule either solves the goal or
leaves a subgoal which is also a constructor form unification problem.
P ROOFLet us check, rule by rule:Á

identity
Before, we have²
D}E ^ D ¥ ^X 9¢¤£7 E  D  E  ^ D  ^ d¦ ^ dÃC^^ D ù^

where  d x  1 d x ÃD}E^ D ¥ ^X Â§¢ Ã ? E  ^ D ^ ^  ÃC. Afterwards, we have^ ^Ã D ù ^  d . Since the variable set is unchanged,  ^ and ^Ã are still constructorÁwhere forms.

coalescence and substitution
Up to a permutation of the goal (performed by the elimination tactic) we startwith²
D}E ^ D ¥ ^X 9¢¤£7 E  D ù KE  D
ÅÃEw ^ D  ^  ·E ^ D]H^  · ^  ·C  · Ã131¨ Ã and yx ^ Ã x ^Ã D ù ^ After elimination, we haveD}E ^ D ¥ ^X Â§¢ Ã ?   ^E w^ D  Ãwhere E ^ D]H^   ^  C  Ã Ã ÃÃAlthough,  has vanished from the variable set, it has been replaced by construc^ ^ D ù^
tor form Ã which does not contain  . As for the remaining problem, H Ã  Ã  Ã 
Ã.

9

Á

cycle and conflict
There are no subgoals.

Áinjectivity
Before:²D}E^ D ¥ ^X 9¢¤£7 ? ^ C
E  D ?  ^ C






Ã
E ^ D ^ ^ÃC  ?  ^ C x ^ F  ? ^Ã C x ^Ã D ù ^ . Now, the type of constructor  ?

where must beE­w ^ D  ^ ù  w·^ J^ C ^ C D ^with  Ã. After elimination:D}E^ D ¥ ^X §Â ¢ Ã ? E ^ C D] ^ C ^ C
E ^ D ^ ^ ÃÃC^

Certainly, the problem still consists of constructor forms over the  . Furthermore,^ ^^ ^^ D ^ }x* ù ^  ? wR^ Bboth  x  and Ã x Ã inhabit the telescope  w
.

C

C





©

Now we have checked that each transition rule preserves the structure of constructor
form unification problems, the next step is to put them together to make a unification
algorithm.

132

5.2.2 an algorithm for constructor form unification problems
The algorithm is very straightforward: it consists of repeatedly applying the transition
rule appropriate to the leading equation until either the goal is proved outright or noequations remain.
From the above lemma, it is clear that if one step leaves a subgoal, the next step canbe made. However, we must still show that unification terminates and computes mostgeneral unifiers:
D EFINITION: unifier, most general unifier^ ^^Ã is a constructor form unification problem over  and ª is a substitu^
^
^C
^ ^
^
tion from the  to terms over some  , then ª is unifer of  Ã if ª  «ª Ã .
^ ^In addition, ª is a most general unifier or mgu of  Ã if any unifier of ^ ^Ã can be factorised ¬­<ª , where ¬ is a substitution on the  ^ C .
If 

L EMMA: unification terminates
For all constructor form unification problems, the sequence of transition
rule applications determined at each stage by the leading equation is finite.
P ROOFI shall use the traditional proof: we may establish a well-founded ordering on unification problems, being the lexicographical ordering on the following three quantities:^Áthe number of variables Áthe number of constructor symbols appearing in the problem

Áthe number of equations in the problem

We may then check case by case that each transition rule either terminates directly or
reduces this measure.
cycle and conflict terminate directlyÁ

coalescence and substitution decrement the number of variablesÁÁinjectivity preserves the number of variables but reduces the number of constructor symbols
133Á

identity preserves the number of variables and the number of constructor symbols, but reduces the number of equations©
L EMMA: unification correct
For any initial goal which is constructor form unification problem

E  ^ ^ ^C  ·^ J Ã¦^^either  and Ã have no unifier, in which case the algorithm proves the goal,^ Ch®  ^^or there is a subset 
and a substitution ª from the  to constructor^^C^
forms over the  such that ª is a mgu of  with Ã and the algorithm yields
subgoalE­ ^ C C  ·^ 
J ª

P ROOF
It is enough to check that at each step of the problem, eitherÁ

the goal has been proven and there is no unifier, orÁ

the goal is of formE­ ^ C  ^ C ^ C
J Ã 

ª

C  ·^ such that a most general unifier^ ^unifierof  Ã

¬¡­<ª¬ of remainder  ^ C ^Ã C induces a most generalªThis invariant holds initially, with accumulator the identity substitution. If it holds
finally with no goal, there was no unifier. Otherwise it holds finally with the empty
remainder whose mgu is the identity substitution, so the accumulator is the mgu of ^ ^Ã .
Case by case, then:ÁÁcycle and conflict prove the goal in cases where there is no unifer
identity and injectivity change neither the accumulator nor the unifiers of theremainder134

Á

coalescence and substitution
remainder
accumulator
^ x^
y

x

ÉÃ Ã
before^  }· ^

}
_



 Ã }·
after ÃÃ ÃCCU C U CU ª ­<ª¬¬¯­ U¬¡­ U ­<ª^C ^C
Clearly ¬­  Ã U}· unifies jx  ÉÃ x Ã .

^C ^C
Now suppose ° also unifies yx  ¸Ã x Ã . Then °°=­  Ã U}· , because_° Ã °  by hypothesis– °=­  Ã }U _ w° when wx – °=­  Ã }U _w
^ C  }U _ ^ C
Ã UHence ° unifies  Ã }U · Ã Ã and can thus be factorised ±²­L¬ . But °³°­
_  ±´­<¬¡­  Ã }U · . Thus ¬­  Ã U _ is most general as required.
©

Suppose is a mgu of the remainder after the transition. It is enough to show Ã }· is a mgu of the remainder beforehand, with the invariant forcingthat Ã · to be a mgu of  ^ ^Ã .

I feel I should make some comment on these proofs, not that there is anything unusual
about them, quite the reverse. I have deliberately given a conventional ‘measure’ proofof termination, by way of comparison with the structurally recursive algorithm I shallexhibit later as an example of programming with dependent datatypes.
Now that we have an algorithm which exploits the transition rules, it remains only toconstruct proofs of them. identity is trivial. coalescence and substitution are just£applications of > c¥ =Bh . conflict, injectivity and cycle all require some work.

;)(

K

Before I give the constructions, I want to draw attention to the computational aspectof the proofs built by the unification algorithm: we shall need this technology to build
programs as well as proofs. If the algorithm generates

q DeE­^ C ^ C ^ C C  ª ·^ (
X< WVñLµ q S   J  Ã 
W7yNS y DeE­J7 ^ J7J  ^ ^ C  ·^ 
J Ã¦

^C

we shall need the computational behaviour (for arbitrary  )7W yNS q yª Ý^   >¶ª ]^  ÿ WVñVµ S q  ^ C   >  ^ C 
135

 

Recall that the elimination tactic supplies > proofs for the constraints. When an
elimination rule with associated reductions is applied to a constructor-headed target,
it reduces to one of the subgoal proofs, like, and the > s are passed for thesubgoal’s constraint arguments—this must allow the subgoal proof to reduce to its
simplified version Vñ, and ultimately to the value the user has supplied for thatcase.

W Lµ S q¤W y]S q y 

Once again, we may check this property stepwise. identity is implemented by a Y abstraction with the appropriate -behaviour, while coalescence and substitution ex£
ploit the established reduction of > c¥ =?h . For conflict and cycle there is nothing toprove, but we must pay attention in the case of injectivity.

·

K

;)(

5.2.3 conflict and injectivity
Consider an inductive family of datatypes

ZF[A\ DsE·^`MD a ^with

J7LMNPORQ

O constructors
DsEt^ D ¸ ^ ZF[A\ ^  uc^ 
9@¦d u dJÃdWe have already seen how to compute the case analysis principle

CrD Z][4\JMJ7J

Let us now use
datatype.

ZF[A\([A?

:«LMNPORQu^ D ¸ ^ d
J7J7JVJ7J7J7JVJ7J7JVJ7J7JMJ
C u·^ xF^
9@yd uH
E ^ D ZF[A\ C ^ÃJ Ã
ZF[A\([A?

J7JMJ

to prove conflict and injectivity theorems for this class of

The conventional way to prove injectivity for the constructors of simple datatypes isto define a suite of predecessor functions for each argument of each constructor anduse the fact that equality respects function application. This is the presentation used in[CT95, McB96]. We cannot do this in general for dependent types, as it is not always
136possible to supply dummy values for predecessor functions applied to constructors
for which they were not originally intended. It is my contention, in any case, that
predecessor functions are immoral: the whole idea of pattern matching is to expose
the ‘predecessors’ locally to each constructor case—we should never apply techniques
appropriate for one constructor only to arbitrary elements of a type.

OM

Fortunately, the computational power of dependent type theory comes to our rescue.
Instead of proving Peano-style conflict or injectivity theorems, we may manufacturea single ‘Peano concerto’ which eliminates any constructor-headed equation, computing the appropriate rule by case analysis.
C ONSTRUCTION: Peano concerto
We begin by establishing the structure of the development: we wish tocompute the Peano theorem appropriate to a given pair of elements, thenprove it for an equal pair of elements:

ZF[A\¨¹m]Æ#º#» DVE  ^ D ZF[A\E­w ^ D ZF[A\LMNPORQZF[A\¨¹[
DVE ^ ` D a ^Xä  E  D ZF[4\ ^`E w D ZF[4\ ^ `E  D  w
ZF[A¼
\ ¹jm]#
Æ º½» ^` 1x  ^ ` x1w
X

Note that it is perfectly reasonable to prove the theorem only for  and w in
ZF[A\ ^ `, because this is exactly the situation
the same instance of the family
in which the theorem will be used: eliminating the leading equation in a
unification problem, where both terms have the same type.

µ S'tv¾¿ÀÁ´Â , we may eliminate

M
ZF[A\([A?
^^each of  and w by
, giving O subgoals, of two varieties.
Looking first to the ‘statement’ problem,

In the first ‘off-diagonal’ kind, we are asked to compute the conflict theorems for unlike constructors 9@yd and 9@R

X

ZF[A\¨¹m]Æ#º#»dD}E  ^ D ¸ ^dE­w ^ D ¸ ^
LMNPORQ

We simply introduce all the premises and supply the rather useful elimination rule
137

CrD

LMNPORQC

After all, an equation with unlike constructors at the head is very unlikely
to be true.
More interestingly, on the diagonal, we must compute the injectivity theorems for like constructors

ZF[A\¨¹m]Æ#º#»X

dd

DE­ ^ D ¸ ^dE w^ D ¸ ^d
LMNPORQ

Fortunately, the case analysis has exposed the predecessors we need, so all^^
we do is pair them off. Introducing the  and w , we supply the rule

CrD

LMNPORQ^ w^ C

C

Crucially, the reduction behaviour of

ZF[A\¼¹jm]Æ#º½» y^ xF

Z][4\([AB

really means that^ ^^  Z][4\¨¹jmFÆ#º#»  ^ C w ^ C
9@yd  C  wxF 9<R w C  ÿd

Now let us show that the rule we have assigned to each kind of constructorheaded equation really holds if the equation does. Recall the goal

ZF[A\¨¹[XD}E_^ ` D a ^ä E D Z][4\ ^`E w D Z][4\ ^`E  D  w
ZF[A\¼¹jm]Æ½º#» ^` 1x  ^ ` x1w

K

We have quite a choice of things to eliminate here, but by far the most£useful is the equation  . Applying > c¥ =Bh , we are left with

X

;)(

ZF[A\¨¹[D}EÚ^`_D a ^äÃ d&Ä?v E D ZF[A\ ^ `ZF[A¨\ ¹m]Æ#º#» ^` 1x  ^ ` x
138

By eliminating the equation, we have restricted our attention exclusively
to the diagonal, sparing ourselves the trouble of considering the untrue
equations, let alone deducing their untrue consequences.
Now we may eliminate  with

ZF[A\¨¹[
X

äd

Z][4\([AB, yielding

O subgoals

DE u ^ D ¸ ^ZF[4\¨d ¹jmFÆ#º#» ^  uc^ 1xF
^ ^ ^
^
Ãød
9@d u~ Ã d  ucxF 9@d uHµ S'tv¾¿ÀÁ´ÂReducing, now that its case analyses have been fed constructor symbols, we obtain

ZF[A\¨¹[X

DEl^ D ¸ ^äd Eyu C D d
E  wcz D}ELMNP ^ ORD uQ ^ u ^CCFrom here, we simply introduce all the hypotheses and prove wczÝ  > u^  .

C

with

Checking the reduction behaviour, we find

ZF[A\¼¹R[
^`
^ ^`
^
^ 
ä  xF 9@ R xF 9@ R  >  9@ RB ÿ
ZF[A¼\ ¹R[^`^ ä Ã d&Ä?v xF 9<R R ÿ
ZF[A¼\ ¹R[^ ä   ÿ
 D^ ^ C J  wcz¼  > R^ 
CWD
Y LMNPORQJFY wcz     proofs as required

This ensures that the identity transition decomposes >for its use in programs.

Note the critical use of targetting in making this rule applicable. It is not obvious that

E·^`MD a ^ E 1w D ZF[4\ ^ ` 
J
J

w 

ZF[A\¼¹jm]Æ½º#» ^ ` x  ^ ` x1w

is an elimination rule, but that does not stop us unifying the targetter with a candidate
equation. If the equated terms have constructor heads, then the instantiated rule will
reduce, revealing the scheme variable and subgoals we would normally expect.
Although the unification algorithm only requires us to prove the Peano theorems for
ZF[A\ ^ `two elements of a particular instance, and that is the construction I have given
139

above, it is nonetheless possible to prove the stronger theorem which operates on any
ZF[A\two sequences in:

ZF[A\¨ÅÆÇäÈ ¹[ ä DsE ^ w ^ D ZF[A\ J  ^ w ^  ZF[A\¼¹jm]Æ#º½»  ^ w ^If we eliminate all but the last equation, we have reduced the problem to

ZF[A\¼¹R[ä  !

It is possible to use this theorem to eliminate a constructor-headed equation from anywhere in a telescopic problem, not just at the front. This can improve the efficiency of
unification: if we can see a conflict later in the telescopic equation, we can solve thegoal without first hacking through the earlier stages of the problem. Such measures are
not necessary when everything is in constructor form, but increase our efficacy for thewider class of problems polluted by non-constructor terms. It is much more difficult
to work with inductive families involving indices which are not in constructor form.
Such problems are beyond the technology developed in this thesis—I shall discussthem briefly in section 5.2.5.

5.2.4 cycle
Showing that cycles do not occur in our inductive datatypes is quite a subtle business.
Even proving

G É £

X

Ã

G4DEHG4D
G 8 G
(= 

Ê
G

requires quite a lot of technology. Let us do it. Eliminating ,É
DMS SXNË G É £ Ã Ë · GAD}EHG (= D  Ê£ Ã E  D G8 GX
wcz
E  D G ¸= G = =B=
ÊÊ

Applying unification (without cycle elimination) to both subgoals, we can at least simplify the two constructor-headed equations via the 8 >;Ay theorem. This eliminatesS
the case by conflict, while injectivity leaves us with an immediate step:GÌ

DEpG DX ?Â7?w E  DBG 8 G
wcz
E  DBG = G 
=

Ê

Ê
140

In fact, we can follow the same structure for any number of = ’s, but this is only because
the natural numbers are deceptively symmetrical. Watch what happens if we throw ina spare successor constructor, h , (making type 8 ) and try to prove

C

G É £
X

ù GeD}EHGeD C
G 8 G(=?h GS

ÃInduction on

G É £
X

and h cases which perish by conflict. The = case is as follows:

yieldsÃÊù GeDVEHG D C
E  wcz D?G 8GE  D G =Bh G = =?h1=ÊÊInjectivity yields

D}EHG D*X Ã   ÍMw E  DBG 8 C G
cw z
E  DBG (=?h G 
(h=

Ê

Ê

Oh dear! We have the wrong inductive hypothesis! The extra = appeared at the very
inside, rotating the cycle: it is only because one successor usually looks much like
another that these theorems are so easy for 8 .
In order to prove the result in this style, we must first strengthen it:G £  wc D  ù D}EHGeD C
8 G (=?h G XÊ sÐ: G ¸h= G  Ê 

By including not just the =Bh cycle, but also all its rotations, we will have more to do:there will be work in both successor cases, although one is enough to show what happens:XG £  wc D  ù ¯ DEHG D C
E  wcz D 8  GGsÐ: G h1= G  Ê 
=
B
h

Ê
 = G =Bh= G  Ê s Ð: = G (h=?= G  Ê 
141The right conjunct follows by conflict. The left reduces by injectivity:

D}EHG DX  ?zcÂ  ]Î E  D 8 G C G
wcz  ¸= h GG(h=  ÊÊ ]Ð( G (h= G  Ê 

The rotated conclusion follows by projecting the appropriately rotated conjunct of theinductive hypothesis.
This technique can be generalised to arbitrary cycles in arbitrary datatypes. The drawback is that (up to rotation), we need a new theorem for every cycle pattern. This leaves
us little choice but to generate them on the fly.
A slightly more cunning technique, arising from a conversation with Andrew Adams,
is mentioned in [McB96]. It constructs for a given cycle pattern  zt _ 4 in some typeÇDãåäyæ a quotient functionãäyæ  8

Ï  ÆÐÇ ÆÐ=S  Ï  RÏ ÇÇ  ÆÆ ÐÐ zy · Ï Ç ÆÐ
Applying Ï 
to both sides of the cycle, we get Ï Ç  Æ Ð  =  Ï Ç  Æ Ð R
We have already seen a disproof of that!

While the guarded recursion principles we have constructed for each datatype makethese functions relatively easy to manufacture—indeed I have implemented thistechnique—we have still not escaped from the burden substantial on-the-fly construction work, cycle by cycle.
Remember, though, that in cycle  zt p , zt · is a constructor form, and hence we cancompute by structural recursion on it: perhaps there is a way to compute the proof wewant. Unfortunately, though, there is no way to test whether we have decomposed as
far as a non-canonical symbol like  : our programs have no access to the decidable
conversion relation of the type theory which describes them.
Nonetheless, we can adopt blunderbuss tactics: for any element  of a datatype, we
can construct the property of ‘not being a proper subterm of  ’ in such a way that when has a constructor head, the property reduces to a product explicitly enforcing ‘not4

Without loss of generality, assumeÑÒ Ó^Ô has fresh variables in argument positions off the ‘cycle-path’.
142being any of the exposed subterms’. The idea works in the same as the auxiliary data
structure with which we earlier constructed guarded recursion. In fact, the predicate
we need is just an instance of that structure.
We may define this property for 8 , together with its non-strict counterpart as follows:D
8 G:y>;4¥¦;4f Y  1w 8
 w
£   D  Ê
8 (8:Ih Ì,(c¥
Y Ê8


£  8 1w D y¥ Ë 8 Õ:¦>;4¥y;Af
8 (8:Ih (c¥Y8 8 G:y>;A¥y;Af ºwRsÐ: 8 (8(hIÌH(c¥ £ ÙwR


with conversion behaviour£ S  Ï8 (8(hIÌ,(c¥ £  G ÿ£ G
8 (8(Ih Ì,(c¥  = ÿ 8 (8:hI(c¥  G
ÿ  8 G:y>;A¥y;Af  sÐ( 8 (8(hIÌ,(c¥ £  G £
8 :8(hIÌ,(c¥ w is thus inhabited exactly when  is not a proper subterm of w , whilst£
8 :8(Ih (c¥ ¸w adds the requirement % w to indicate that  is not any subterm of w .
£8 :8(Ih Ì,(c¥ Éw unfolds computationally to reveal a proof that  is not equal to any
guarded subterm of w . Observe, for example,
8 (8(hIÌ,(c¥£ ?= =  ÿ  8 G:y>;A¥y;4f  = R]Ð
 8 G:y>;A¥y;4f ÙRsÐÞ 8 (8:hIÌ,(c¥ £ ÙR

Suppose we can prove£
E  D 
Ã 8 KJ ÉÃ¦ 8 (8(hIÌ,(c¥  ÃIÌ,(c¥ £ ªzt · ,Then for any hypothetical proof of  zy · , we have a proof of 8 :8(hwhich will expand to a product containing

8 G:y>;A¥y;Af Ùfrom which contradiction the goal should surely follow.
The first step in the proof is to eliminate the equation, leaving the highly plausible

D D}E  D 8X }wc 

8 (8(h2Ì,(c¥

£ Ù
143

Ê

You could be forgiven for hoping that we might get a cheap proof by the 8¥¦Ësßõ>
Ê C
C
theorem we have already built, but sadly, that only proves 8¥yË when is a constantand all we have to do at each stage is pass on the accumulated information, adding justthe new layer. Here, the scheme varies over the recursion, so we must be more cunning.
Our next move is unsurprising: induction on  .

£ SÉS
D D
X }wc D  ®¯ DVE8 (8:D hIÌ,(c¥X }wc  E   D 8
 8 :8(hIÌ,(c¥ £ Ù£
8 (8:Ih Ì,(c¥ =  = ÏThe base case is trivial as its type reduces to . Unfortunately, the step is genuinely dif£ficult: 8 (8:h c¥fixes its first argument, so there is no way, as things stand, that we
can reduce the conclusion to the inductive hypothesis. Some intelligent strengthening
will be necessary. First reduce the conclusion to its non-strict expansion:IÌ,(D D}E DX }wc  ¯ E   D 8
 8 (8(h2Ì,(c¥ £ Þ£
8 (8(Ih (c¥ = ÞWe must prove that if  is not a proper subterm of itself, =  is certainly not a subterm.
We can see that if =  were a subterm,  would be a proper subterm, nomatter what
is on the right hand side. Let us make the corresponding generalisation. That is, we
introduce the hypotheses, create a hole for the more general version of the goal, thenuse it to solve the original:DDX }wc  ¯§Ö Y   D 8£
Y  G­D}E8 (8(hIÌHD (c¥ Þ
NX ×  E w ÉØ w D 8£
8 (£8:hIÌ,(c¥ ÙwÞwG Ù 8 ( 8(Ih (c¥ =×Why is this a good move? Well, we have fixed the first argument of the predicates, andwe are now free to let the second vary in an induction on w which corresponds to the£computational behaviour of 8 (8(h c¥ .

IÌ,(

144

NX ×  G ® D}E  ÉØ Ë D 8 :£8( hIÌ,S (c¥ £  S
G ¯ D}E w 8 (8(hI(cD ¥ =

XN×
£
E w
DVE8  ÉØ w D
8 (£8:hIÌ,(c¥ Ùwºw
E  ÉØ ?w D 8 (8(Ih (c¥ £ = w
8 (£ 8(Ih Ì,(c¥=w
8 (8(Ih (c¥ = =Applying a little computation, the base case becomes

NX ×  G ® D}E   ÉØ Ë D Ï  S ]Ð Ï
8 G:y>;4¥¦;4f=
GÌ>;Ay .

This is easily proven, with a little help from 8
Reducing the step case, we get

NX ×  G ¯ DVEE ww D£
}D E8  É¡Ø w D
8 (£ 8(hIÌ,(c¥ ÞwÙw£E  ÉØ ?w D  8 (8:hI(c¥ = ÙwRsÐÞ
8 G:y> ;A¥y;Af
8 (8(£ hIÌH(c¥ ÞwR
 8 G:y> ;A¥y;Af=  = wR]Ð( 8 :8(Ih (c¥ = ÙwRThe implication between the two right conjuncts is exactly given by the inductive hypothesis. As for the left conjuncts, expanding the conclusion’s 8 ¦> 4¥y;Af gives us aproof of =  = w from which we must prove . 8 >;Ay exposes a proof of  w , forwhich we have a disproof at the ready.

Ê GÌ

Õ: ;

Having established this property for the natural numbers, there is always the nagging
suspicion that we have exploited in some hidden way the symmetry of that datatype,just as we would be wary of generalising to all triangles a property which held in theequilateral case. When there is only one step constructor, with only one recursiveargument, the issue of whether phenomena behave conjuctively or disjunctively can
become blurred. However, in this case, everything fits together perfectly.
C ONSTRUCTION: cycle
Consider type former
145ãåäyæD

LMNPORQ

and á constructorsÂ ^ D ç ^  ^ D_è ãåäyæ°é ë^ ^ D
9@¦d Â  ãåäyæ

Note that I really should write âMd , as the number of recursive arguments
may vary from constructor to constructor. However, the proof will be evenless readable if I start subscripting superscripts.
We may define the inequality propertyãåäyæî  Çy[Ao° 1w Dä ÏYãä¦æêJ w Ê

We can then add the proper subterm relationãåäyæº  ÆB¹,ÅcÇÙ  Y  D ãäyæÙJFãä¦æ ÆKÇ_È  ãåäyæ î ä  Ï Çy[Ao Rº  ÆBÅcÇÙ  Y 1w D ãåäyæêJ ãäyæ î ä  Ï Çy[Ao ÙwRsÐÞ ãä¦æ º  ÆB¹,ÅcÇÙ ÙwRand the non-strict subterm relation

ãåäyæ

The computational behaviour of these definitions is as one would hope:ãåäyæº  ÆB¹,ÅcÇÙ Ý 9@R Â ^ w^  ÿ úÚHãä¦æ º  ÆBÅcÇÙ Ùw ÄpÛ ëÄ

We may now prove the cycle theorem:XFãåäyæGÜ o DVE  D
 E  Ã D ãä¦ æº ÉÃÆB¹,ÅcÇÙ  Ããåäyæ First, we eliminate the equation, leavingXFãåäyæGÜ o C D}E  D



ãä¦æ

ãäyº æNext, we eliminate the  .

 ÆB¹,ÅcÇÙ ÙDVE ^ D ç ^X<ÝSWw]d E Â ^ Dsè d ãåäyæêé*ëº ÆB¹,ÅcÇÙ  Ä  ÄFé*ëÄE  ^ Dsèãåº äyæ ÆB¹H ÅcÇ Ù 9@d Â ^ R^  9@¦d Â ^ R^ ãäyæ 146

The conclusion expands, yielding a product

DVE ^ D ç ^X<ÝSWw]d EÂ ^ Dsè d ãåäyæêé ëº ÆB¹,ÅcÇÙ  
E  ^ Dsè
è ãåäyæ º  ÆBÅcÇÙ  Ä ÄFÂ é^ ëÄ R^ ú ãäyæ 
9@¦dÄ]é ëÄ
Now we come to the strengthening step. The conclusion we are trying toshow is â -fold now. The trick is to prove each separately, abstracting away
the right hand  in â separate lemmas:

Ä^
X<ÝSWw]d Ö Y Â ^
Y ^

Y

D ç^
D¬è d
ãä¦æ°ºé*ë ÆB¹HÅcÇ ÙD¬è Ä  Ä]é ëÄÞß ãä¦æ âãßßä ë^ D à E w
Dß
X T7w[t ßß E É¡Ø D ãåäyæ º ÆB¹,ÅcÇÙá  w ãåäyæ  Ä w ßº  ÆÅcÇ Ù  9@yd Â ^ R^ w å Ä

ã
y
ä
æ
üè
T7w[t¨Ä  Ä  sÄ é*ëÄ ýßßThe proof of each lemma is again inductive. We apply ãåäyæ
each of the â , lemmas, we acquire á constructor cases:

DVEt^
XNT7wtT E Â ^ C
w

D ç^
D¬è 
Þà ãåäyæ°é ëE ^
D á E  É¡Ø w DÃ ÆBãåÅcäyÇæ Ù º   Æ¹,ÅcÇÙÂ ^ R^ Ä w w Ãºãä¦æ 9@¦d ^ Ã
º
B
Æ
,
¹
cÇ Ù  ÅE  ÉØ  D²¸wR^ 
å
ã
y
ä
æ

Ä
@
9





º ÆÅcÇ Ù  9@yd Â ^ R^  9@ ²¸^ wR^ ãåäyæ moq\, Thus for

âä ë

åÃ

Now, a little computation is in order:

DRE Â ^ C
XNT7wtT ­
E w^

D ç^
D¬è 
Þà ãåäyæ°é ë
âä ë
E ^
D á E  É¡Ø w D
Ãº ÆBãåÅcäyÇæ Ù º   Æ¹,ÅcÇÙÂ ^ R^ Ä w w Ã å
o  yw d ]Ð: Ã º Ã ÆB¹,ÅcÇÙ  w  ë
E  ÉØ  D  ãä¦æ î   Ç¦[49<ú Ú ãåäyæ ä ÏÄ Â ^ Ã R^  ãåäyæ  ²^ wR^  Ä Ã Û Ãî  Çy[Ao Dúãåº äyæ ÆBÅcä Ç Ù Ï
9@^ ^ yd
9@

Â
R



w
ú Ú ãåäyæ 
9@ydÃ¤Û ëÃ
147

Firstly, eachº  ÆBÅcÇÙ  9@yd Â ^ R^ w Ãfollows by Ã applied to the proof ofº ÆB¹,cÅ ÇÙ  Ä w Ããåäyæ ÉØ  .
projected from ãåäyæSecondly, we must establishãåäyæî  Çy[Ao 
²^ ^
^ ^
ä Ï
9@yd Â R 9@ w

That is, we must prove²^ ^ 9@yd Â ^ R^   @9 R wR  Ê¹[ ä  . If the constructors are different (æ èç ), the goal
so we apply ãä¦æé çis proved at once, otherwiseæand we must showÂ ^ ²^   ^ w ^  ÊØÉ  contains proofs for each ê of
But look! ãåäyæî  Çy[Ao  wä ÏÄ Ã

We may select the proof of 
proof of<Ä w Ä from the injected equations, and theî  Çy[Ao  wä ÏÄ ÄØÉ  establishing a contradiction and completing the construction.
from 
ãåäyæLet me remark only briefly on the extension to dependent families. For

ZF[A\ DsE·^`MD a ^J7LMNPORQ

the appropriate notion of inequality is

ZF[A\î  Ç¦[4o° ^ w ^ D ZF[A\   ^ Rw ^ 
ä Ï
Y
J


 Æ¹,ÅcÇÙ and ZF[4\¨º  ÆBÅcÇÙ as before:
ZF[A\¨º ÆB¹,ÅcÇÙ   ^ D ZF[A\ Z][4\àÆIÇ_È  ZF[A\î  Çy[Ao R^ 

Y
J
ä Ï
ZF[A\¨º ÆBÅcÇÙ  ^ w ^ D ZF[A\  ZF[4\î  Çy[Ao  ^ wR^ ]Ð( ZF[4\¨º ÆB¹HÅcÇ Ù  ^ w^ 

Y
J
ä Ï


We can then constructZ][4\¨ºÊ148

ZF[A\

Since all three of these take two sequences in, rather than two elements in someZ][4\ ^`, no problem arises in the strengthening step: we are free to abstract away thewhole right hand sequence, ensuring the induction is on the entire family.
As for the equational reasoning, suppose we are trying to prove some inequality
ZF[A\wj^ x1w 
where both sequences inhabit, with both  and w constructor^^
headed. Rather than trying to unify the  and w , we may apply the ‘strong’ version of
the Peano theorem directly to the telescopic equation, solving the goal in the case ofdifferent constructors, and exposing the equations of the predecessors if the constructors are the same.

Êy^ x1

In effect, then, the construction scales up without any difficulty from elements of simZ][4\ple types to sequences in some.
This construction also generalises easily to datatypes which use higher-order constructors to represent infinitely-branching structures. When the higher-order arguments appear as hypotheses they may simply be fixed, so that they may be used as the appropriate witnesses for higher-order arguments in goal positions. However, it is not easy
to exploit this proof automatically, as it is undecidable whether an infinitely-branching
structure contains a cycle. Suppose we have a hypothetical ordinal  , together with aDwhich yields  for input . If we have a hypothesis
function 8 $ ¢ ¸=B¥ ¤ ¢ëì Ç º  ÆB¹,ÅcÇÙ¤ ¢T =B¥ V , which expands to uncover a proof ofwe acquire a proof of æ
EHG¼D 8 KJ
but the machine has no reliable way of guessing thatis the rightnumber to expose the contradiction. Of course, if we know which branches a cycleo
takes, we can still apply æby hand.

¢

Ê

ëì

 Ç íÜ 

5.2.5 a brief look beyond constructor form problems
There is nothing which restricts our use of dependent families to indices in constructor
form. More complex indices lead to more complex unification problems, and the general case is inevitably undecidable. There are two ways in which such problems canarise, and they are not mutually exclusive:Á

Non-constructor-form indices may appear in the type of a constructor. For exD
ample, we might define sized binary trees, =?h >> 8 $ LMNPORQ as follows:>¨ ¤ hIîD?= h  >>S¥ D =?h  >>   D =Bh  >> w¥  D =Bh  >>W=  ¤ f¥¦= ÙwRyA>
149

Á

Non-constructor-form indices may appear in the type of an argument over whichcase analysis is to be performed. For example, we might wish to write¢ D]E ç DEp I
G D EpÙDG  Jij>klhBï i ¤ > Ë
LMNPOQJ
8 ªJ
ij>klhBï  ¤ f ¥y=

The tractability of such problems, even by hand, depends on the types of the nonconstructor-form expressions:Á

Many problems involving the comparison of types or functions are simply beyond us. On the one hand, we do not have theorems such as conflict at the levelof types—we cannot disprove 8. On the other hand, the intensionality of
prevents us from solving even such simple higher-order problems as

ñð ð

E¢ D

E D
8 & 8 KJ   8 ªJ ¢= R JMJ7J¢

Even though the extensional behaviour of is completely determined, there aremany intensionally distinct terms which exhibit that behaviour.

Á¤Equations within datatypes involving defined functions like f¥y= are less troublesome, especially if we have equipped those functions with derived elimination
rules which do constructor-based analysis of the return values.



¤  ¢

> Ë . Induction on will leave subgoals containing
Let us examine the example of i
unsolved equational problems, such as the i¦¦gf case:¢ ³ DsE ç D
Ep GÉD EpÞDG  JXi ¤  > Ë
ML NPORQ1J
8 ªJ
ij>klhBï  ¤ f¥y=S ¤
G   i¦ygfò   i>khBï 
f¥y=



Case analysis on will get us out of this predica¤
ment, but only because we know how f¥y= works.
A more cunning approach is to address the trou¤¤ > ¢ Ë withblesome f¥y= directly, constructing i¤ f¥y= ’s recursion induction principle, shown on the¤right. Note that the f¥y= symbol is completely absent from the cases.

Targetting the ¤ f¥¦=N\>k¶F

CrDsE 1w u D

C ÙwÞuJMJ7J7JVJ7J7J7JVJ7J
C S wÞw
C Ùw u= =E w D C Ùw ¤8 ªJf¥y= Ùw¤ f¥y= G  in goal i ¤  > ¢ Ë yields subgoals:

150

8 ªJMLMNPOQ¢ DsE ç
Xi ¤  > ËVó¢ ¯°DsE ç
Xi ¤  > Ë

EHGID EpÙDGS
ML NPORQJ
8 ªJ
ij>klhBï Jij>klh.ï
DEp G 1u D
LMNPORQ1J
8 KJ
 pE  C D i>klhï u Ji>khBï   EpÙDi>kBh ï@= u J ij>klBh ï@=D

The remaining indices are in constructor form!
I draw two conclusions from this discussion. Firstly, dependently typed programming with non-constructor-form indices is difficult—a principled machine treatment
is a long way off. Secondly, for hand treatments of such problems, derived elimination
rules describing the behaviour of non-constructor functions are of considerable benefit.

151

Chapter 6
Pattern Matching for Dependent Types
We are now in a position to build tools for programming with dependent datatypes.
In this chapter, I shall first discuss the interactive development of programs. However, I believe it also important to consider the translation of functional programs fromthe conventional equational style into real O LEG terms based on the elimination rules
primitive for each datatype.
Why should we be interested in these programs? Some people like to write programs,1and raw type theory is hard to write, especially as it must record explicitly the unfication attendant to the elimination of dependent datatypes. That is why we get machines
to do it.
I am an enthusiastic advocate of the analytic style of programming afforded by proof
editors. For me, the key point is that the search for programs is carried out in a structured space of partial objects constrained to make sense: the machine performs mostof the bookkeeping and checks for type errors locally and incrementally.
Synthesising programs in the conventional way involves unconstrained search amongst
arbitrary sequences of potential gibberish for completed objects which a compiler either accepts or rejects. The incremental programming afforded by interactive declarebefore-use environments common in the ML community is almost entirely uselessbecause it is incremental from the bottom up: it requires the details to be presented
before the outline and thus supports only the kind of lonely obsessiveness that gives
programming a bad name. The module system offers some compensation, at a coarse
granularity.
The trouble with raw type theory is not that it is hard to write, but that it is hard to
read. Even if a program is generated with machine help, it is still a good thing if
1

Others are merely paid to do it.

152we can represent it in a way which is comprehensible to humans. Sequences of tactic
applications are not especially informative and, in any case, run counter to the demandsof a good user interface.
I hope, therefore, you will agree that it is good to have a high-level representation
for synthesised proofs and programs which nonetheless exposes the analysis both bywhich it operates and by which it can be constructed. Pattern matching notation has
been with us for three decades in theory and in practice [Bur69, McB70]. Perhaps itis because I have been brought up in these old ways that I am so slow to change, but
I still prefer equational presentations of programs to this newfangled ‘pointer dereferencing’ or whatever it is the young people do these days. One side effect of a concise
and readable notation is that we can still write programs on the backs of quite smallenvelopes.
What do these programs look like? Let us simplify matters for the time being, andconsider only solitary functions:

D E ^ D ^V ^ K J
..
.

^

..
.³

ù

ÃK


Ã

..
.³

^ D ^^

Each  d will contain some ‘free’ variables w
d which are really universally quantified.
^^
may not appear in any of the d . Both and the w may appear in Ã d . It is, of course,^^^
impossible to guess the d for arbitrary and  d , although it is not hard to imagine
classes of problem for which it is routine. Let us assume they are also supplied by the
programmer, but nonetheless omit them informally when unremarkable.

What do we mean by such a program? I suggest that we mean to determine the type
and the intensional behaviour of the defined symbol . It is not enough that the program^ D ^should determine for each closed input a unique output Ã : that is merely to describe
the extension of a function—to give equations which must cover all the cases andbe true. The programs must also reflect a deterministic and terminating computation
mechanism, even on open terms, and taking canonical inputs to canonical outputs. Thatis, the equations must have computational, not just propositional force. The programsmust decode internally into combinations of abstractions, applications, case analysis
and terminating recursion. This requirement is reflected to a considerable extent in
the task of translating such programs in terms of the effective computational behaviour
primitive to O LEG datatypes.
153

A common notion of pattern matching from functional programming with simple types^
requires the patterns (the  d above) to be in constructor form, nonlinear, exhaustive anddisjoint. This is not sufficient to guarantee the intensional behaviour required here.
The classic counterexample (due, as far as I know, to Berry) is the three juror ¨ ;  ghfunction:ô  Iî¨ ; ô   ghIî¨ ; ô   ghIî¨ ; ô   gIh î¨ ; ô   gIh î¨ ; ô   gIh î¨ ; ô   gIh îi>  4gklhl
gy¦k>¦hõe¥ygfIh îgy¦k>¦hõe¥ygfIh îDi>  4gklhg¦ykl>yhg¦ykl>yhw
õe¥¦gf2h îõe¥¦gf2h îi>  4gklh­gyykl>yhu
õ4¥ygfIh îgyykl>yhõ4¥ygfIh î ij> Agkh u gyykl>yh
 w
 

õe¥ygfIh î

Now, imagine you are in a low-budget remake of the Henry Fonda film, ‘Twelve Angry
Men’, entitled ‘Three Mildly Peeved Men’, and your task is to find out what the majority verdict is. The three jurors do not each know what the others think, so the only
way you can gain any information is to ask them individually for their verdicts: you
cannot ask ‘should you have the casting vote’. Represent what you know by a pattern:
initially, you know nothing, so the pattern isÞwºuWhen you ask a question, of the first juror, say, your state of knowledge divides in two
possibilitiesgy¦k>¦h wÙuõ4¥ygfIh î wÞu
Based on this choice, you can adopt different strategies of questioning, ultimately giving you a set of possibilities from each of which you draw a conclusion. Does Berry’s
collection of patterns represent a set of such possibilities, arising from a conditionalquestioning strategy? No: each juror appears undeclared in at least one pattern, and at
least two jurors must declare in order to determine the answer.
The following shorter and intensionally realisable function has the same extensional
behaviour:2¨ ; ô   ghIî¨ ; ô   ghIî¨ ; ô   gIh î¨ ; ô   gIh î¨ ; ô   gIh î

2Di>  4gklhl
gy¦k>¦hgy¦k>¦hõe¥ygfIh îõe¥ygfIh îi>  4gklhg¦ykl>yhõe¥¦gf2h îg¦ykl>yhõe¥¦gf2h îi>  4gklh­
u
u
u
u


 ij> Agkh u gyykl>yh uõe¥ygfIh î

It also has an advantage in some cases if you are the third juror and prone to moments of angst.

154

Extensional presentations of functions are not useless: they are merely noncomputational. It is highly desirable, at times, to give such extensional properties in
specifications of functions. The question is then whether they can be transformed into
intensional programs, preserving the extensional requirements.
The fact that intensionally realisable patterns arise from such questioning strategies
militates strongly in favour of the analytic view of programming: generating patterns by case splitting not only guarantees their computational meaningfulness, butalso gives some guidance to the way we think about problems in the first place.3
Generating coverings of patterns by splitting is central to Thierry Coquand’s characterisation of pattern matching for dependent types [Coq92], as implemented in ALF[Mag94]. It is worth taking the time to review this now, not only to place the work ofthis chapter in its wider context, but also because it is in his meta-level footsteps that I
have followed with my object-level treatment.

6.1 pattern matching in ALF
Coquand proposes to admit functions defined in pattern matching style directly to thetype theory as constants with reduction rules given by the equations provided they satisfy certain safety conditions, more stringent than necessary, but nonetheless allowing
considerable freedom of expression. For

E w^ D ^ K
E w^ D ^ ³

J

D E­ ^ D ^E ^ K J

J

..
.

^

ù

ÃK

..
.³



Ã

..
.³

he demands
no nesting : for each ^ in any Ãød , does not occur in any  çæguarded recursion : for some and every , every recursive

 d

 ^ in Ãød has   guarded in^^covering : the  d form a covering of , in the sense to be defined below
3ö÷

When teaching students ML, I have so frequently found myself asking ‘What do you do with theempty list? What do you do with cons ?’ that it has become something of a mantra, for me, if not for
them.

155

The definition of covering captures the notion of successive case-splitting. We shallfirst need a definition of such a split or elementary covering—this we iterate to yieldcovering.
D EFINITION: elementary coveringç^The  d form an elementary covering ofsuch that ^ if there is an argument positionÁ  d  is constructor-headed for each æÁ for any argument sequence  ^ with   constructor-headed, there is ex^ D ^^  ^actly one æ and instantiation of the wd which makes  d ÿ çNote that, in particular, sequences with different constructors heading the th argument must be covered by different patterns, and that all possible constructors must becovered: we have just asked the th argument to reveal which constructor is at its head.

ç

D EFINITION: covering
the free pattern4 w

Á^^ D ^^ D ^is a covering of^^^^ D ¸^

if  d (over wd ) is an^ elementary covering of and  d  (over u ^ d  )^ ^ ^are coverings of the d , then the   d  w·  d also form a covering of

Á



U

Which coverings we can build interactively depends on which elementary coverings
we can recognise as such—this is where unification comes in. Let us suppose that we
ZF[A\have a family of types, and that we wish to form an elementary covering of sometelescopew ^ D  ^ x1w D ZF[A\ c^ x w ^ C D  ^ C

by case-splitting on w .

ZF[4\has constructors

^ D ¥ ^ d^ D ZF[A\ ^9@¦d Ãd^^so the possible cases are those where the  unify with the Ãød , the flexible variables being^ D ^ d x w^ D ^ .

¥We apply an appropriate unification algorithm, such as the constructor unification fromlast chapter, getting one of three responses
4

my term

156

ª

Á

a most general unifier _d from variables Áindication that there is no unifierÁ

failure due to ambiguity or getting stuck^ D ¥ ^ x w^ D ^
^ D ¸^
to terms over some udIf the unification is conclusive for each constructor case, then our elementary covering
has one pattern for each mgu _d , given by^^ ^C_ª d wyxF 9@¦dª_d }x wª(over u^ D ¸ ^ x w^ C D

^ C_ª d )

We can now build coverings by starting with the free pattern and repeatedly applying
case-splitting, as allowed by the unification. Note that unification is a meta-level notion
here: it must be sound with respect to the computational equality. Apart from that, we
can make it as clever or as stupid as we like. Constructor unification is already quite
generous—this is essentially what the implementation of ALF provides.
Programming then proceeds in a type-directed way, building a covering for the argument telescope of a function, then filling in the right-hand sides by refinement, allowing
recursive calls, provided the appropriate termination check is satisfied.5

Y

It is not hard to see that all the -reductions so far presented in this thesis fall into thisclass of definable function (provided we make the appropriate straightforward extension for mutually defined functions on mutually defined datatypes): the elimination
rules for datatypes have been constructed to yield elementary coverings of them, with
one-step guarded recursion. In fact, we do not even need the unification algorithm tohandle conflict, injectivity or cycles: coalescence and substitution are enough for thedatatype -reductions, and we must add identity if we wish to support > 4§pfg¨ .

Y;What about the other way around? If we fix on constructor form unification as thatwhich informs the case-splitting process, then we may follow this treatment at theobject-level.

6.2 interactive pattern matching in O LEG
This section contains the main metatheoretic result of this thesis: it proves that functions which can be manufactured interactively in ALF can be manufactured interactively in O LEG. Furthermore, the simulation is at an intensional level—the functions
5

In the original ALF implementation, this was left as a moral obligation, but Coquand’s criterion
above is not hard to enforce.

157

we manufacture from O LEG elimination rules have the same computational behaviouras those defined directly in ALF.
Before we can progress to the theorem, we must examine computation with elimination
rules in more detail.

6.2.1 computational aspects of elimination
Suppose a function can be given in terms of another



Y

^ D¥^

JRÈ 

È as follows:^ÈWhat can we infer about the computational behaviour of from that of ?

ÈThis is a very common situation. If is an elimination rule and we construct byeliminating some of its arguments with , this is exactly the structure which will take.
If has a reduction behaviour given by -reductions or a pattern matching function in
the Coquand style, we may be able to infer the corresponding behaviour for . For
example, we have already seen how to construct 8 (9@;A=?> from 8 (§fg¨ in this way:
how does 8 (9@;4=?> reduce when it is fed constructor-headed numbers? It is not hard tocheck that it inherits the appropriate behaviour from 8 :§pfg¨ :

È

È

Y

C {ø4{ù S ÿ {ø
8 (9@;A=?>C { ø4{ù G ÿ {ù G
8 (9@;A=?>=¤

Similarly, if we want to implement the pattern matching version of f¥y= by means of
8 :§pfg¨ , we need to be sure that the defining equations are intensionally recoverable.
In particular, we need to show that any recursive calls to 8 :§pfg¨ in the implementation¤
can be replaced by recursive calls to f¥y= convertible to them. We can achieve thisby a process of unfold/fold transformation on functional programs which respects thecomputational equality of O LEG.
Let us consider unfolding first.
SupposeÈ is given by a pattern matching programÈ ^ DsE­w ^ D ^ J ù
È d

Ãd

(over pattern variables w^ D ^

158d)

From the definition of , we can infer the lengthened equation ^ ÿÈ ^(any 

^ D ¥^)^For each  d , there are two possibilitiesÁ  ^ is at least as long as  ^ dÁ  ^ is shorter than  ^ d

^

^ ^C

^ ^ D ^In the former case, we may split  as x  , so that   d. If
y^ x w ^ to terms over u ^ D ^ which unifies  ^ d and  ^ , then we have¸

ª is a substitution fromª  ^ ÿ Èúª  c^ x  ^ C   Èúª  ^ d x ª  ^ C ÿ  ªÃ d  ª  ^ C (over u ^ D ¸ ^ )
^
û^
^
^ ^C
^ ^ D û^, where is a prefix of .
In the latter case, it is  d which we split as x  so that  
If ª is a unifying substitution, then we haveª  ^ ÿ Èúª  ^  Èúª  ^and thereforeª y^ x ª  ^ C ÿ Èúª  c^ x  ^ C   Èvª  ^ d ÿ ªjÃ dNote that we may not, in general, pad out the application of before the unification,^^
because  may not have functional type until the  have been instantiated.
Folding is more straightforward. If we know that ^ ÿ  where  ^ is the free pattern, and]^ ÿ  7
^ D ^(over w)Ã ªthen

 ^ ÿ Ã  ª p^ (over w

^ D ^)ª

I have not explained where these substitutions come from,6 but I do not have to:unfolding and folding are a pair of techniques by which we can derive new intensional
equations from old ones. I do not propose to use them to construct pattern matching¤
programs, but rather to confirm their intensional status. For example, the program f¥y=
may be written in pattern matching notation
6

Perhaps you can guess.

159¤ f¥y=¤ f¥y=



S
w

w

=


w

=  ¤ f¥y= ÙwRThis quite clearly falls within Coquand’s class of definable functions. We have already¤seen f¥¦= defined somewhat less perspicuously in O LEG:¤ f¥y= Y  D 8 ªJM8 &«8 
 Y w D 8 ªJ wR Y  D 8 ªJFY ¤ f¥y= ³ D 8 &«8 ªJ*Y w D 8 ªJV=  ¤ f¥¦= ³ wRB

8 (§fg¨

We can check that the pattern matching equations hold intensionally for the O LEG
definition. First unfolding with respect to each -reduction of 8 (§pfg¨ :Y¤ f¥y=¤ f¥y=SD
Y w D 8 ªJ w
Y w 8 ªJM=  8 (§pfg¨ J7JMJ ÙwR=

Folding with respect to the O LEG definition:¤ f¥y=¤ f¥y=SD
Y w D 8 ªJ w ¤Y w 8 ªJM=  f¥y= ÙwR=

Lengthening:¤ f¥y=¤ f¥y=

S

=

w
w




w

=  ¤ f¥y= ÙwRWe have checked our implementation of the pattern matching program!
In fact, we can use lengthening, unfolding and folding to check all the dervived computation laws in this thesis, and we shall use them in particular to ensure the intensional
validity of the pattern matching programs we shall shortly construct.
Of particular interest is the computational effect of case analysis followed by unification.
Suppose we face the goal

X
where

íDE  ^ D ^ ùJd is some

ZF[A\ z ^ZF[A\^, with the z in constructor form. Let
160

have constructors

u^ D ¸ ^ ^ D ZF[4\ z ^9@ u
Eliminating  d by

C 

..
.

X 

..
.

 



ZF[A\[4?

yields, in general:^ D ZF[A\Yw ^E­ ^ DE ^ Dw ^ zj^ x1
dù
DeE u ^ D ¸ ^E­ ^ D ^Ey ^ DHz ^ xF
u~^ 
@
9






ù
^D ^
Y  Z][4\([AB C

yz ^ x1 d^^
J7JMJ tJ7JMJ zyx1 d   > zRxF  >  d 

Now let us apply the unification algorithm to  . Either there is no unifier, in whichcase we have no need of a computational explanation, or there is a most general unifier~ . In this case, the new subgoal looks like

ª

X C

DVEw ^ D  ^
ù 
ª~

ª

Furthermore, having found ~ , we may also unfold the definition of with respect toZ][4\([AB^, discovering that for all w

^ 
^ ^
^
~ª   ÿ jC ª~^  u·x ª~ yxF  >üª~  zyx d Bÿ w
The latter conversion holds by the computational properties of the proof term generated
by the unification algorithm established in the previous chapter.
This shows us that case analysis with constructor form unification really does correspond intensionally to Coquand’s case-splitting step. We are now in a position to provea crucial metatheorem.

161

6.2.2 conservativity of pattern-matching over O LEG
T HEOREM: conservativity of pattern-matching over O LEG
SupposeEw ^ D  ^ K

D E ^ D ^J
E^ KE­w ^ D  ^ ³

J

..
.

J

^

..
.³

ù

ÃK


Ã

..
.³

is an admissible program according to the characterisation of the previous
section, with^ D ^^ÁÁ^

the  d (over wd ) a covering of built interactively by case-splittingwith constructor form unification
recursive calls structurally smaller on the â th argument

Then there is an O LEG term ^ d ÿÚD]E  ^ D ^ ù^ D ^J satisfying for each æ , for any wd,ÃødP ROOFLet us present the main problem as one of theorem proving. We must prove goalíDE­ ^ D ^ ùJXHowever, we must check that however we implement , it satisfies the computationallaws intended by the pattern matching equations.
One of the key aspects of this construction is justifying the recursive calls. We can help
ourselves in this regard if we give them highly distinctive types. As they stand, they
just have whatever type it is the function returns for the given arguments, which might
be something dull. We can introduce a much more informative type as follows

ô
D E ^ D ^X A[ oo DE­ ^ D ^ JMLM ôNPORQR^ ù
XRÇ ýJ^ Æ ÇÇ DE  ^ D ù
ô ^
X
ä
Jô 
^
DE  ^ D
^
XR È
J
^
 ^ DY<J  [Aoo  È R^ 
162

È

What has happened? I have defined in terms of , a function which returns elements^ôô
of an as yet unknown -indexed LMNPORQ -family, . Of course, is going to turn out to^ D ^ ùbe Y 
J , in the style of the decorative -bindings from previous chapters, but forô ^ùnow, it remains obscure: we transfer values between and  by means of a pair of
[4oo
 Ç
ä , both of which will turn out to be the identity function. As
unknowns
andthings stand, though, the type of a call to identifies precisely its arguments—when
we wish to make a recursive call, we, and also the blunderbuss tactic, shall be able tofind the hypothesis we need just by looking at its type!

Ç ýÆ ÇÈÈThe next step is to eliminate the â th argument of with the appropriate guarded recurZF[A\ z ^ZF[A\sion principle. Suppose is, whereis a dependent family of datatypes.7
ë
ZF[A\nZ¬q È. Eliminating, we obtain the
The guarded recursion principle we need is thus
schemeC Yu^ D Z][4\E ^ D^ ^ ^J  J u zy1x  ë ô ^

In fact, this scheme will have had its constraints optimised in the usual way—there will
ZF[A\be none at all if
is a simple type. Let us nonetheless consider the general case.
The immediate subgoal is

DVE ^ D ZF[A\XRÈþ7ÿ  v  E u D ZF[A\WÆKÇ_È C ^ B}uë^E ^ DE  ^ D u ^ zy^ x1ô ^ëIntensionally speaking, unfolding the definition ofthatÈ with respect to ZF[A\Zsq È tells usÈ  ^ ÿÿ ZF[A\nZ¬q È zyC ^ x1È þ7ÿ Z]ë [4 v \à zyÆI^ x1Ç_ È·ë ôàÝ^   > C zj^ x1 ë  zy^ x1  Ý^   zy^ x1 È þ7ÿ ë  v  ëä È þ7ÿ  v 
>
ë
ë
ë
^

È

The subgoal constraints require exactly that the  are well typed arguments of , sothey reduce by unification to

DVE ^ D ^XRÈ vv E  D Z][4\àÆIÇ_È C ^?
zyx1
ë
ô ^
ë
7

We may consider any parameters fixed.

163

That is, we have the same goal as before, but with the addition of the auxiliary premise
which is ready to unfold revealing the available recursive calls as we split  intoë
cases—it may not be the last argument, as shown here, but its position is immaterial.
Note also that the computational behaviour of terms generated by unification givesÈ  ^ ÿ È ë vv ¼^  ZF[A\WÆKÇ_È·ôà ä C Èmþ7ÿ ë  v  zy^ x1 ë ^

Now we replay the interactive case-splitting process which justified the covering  d .
Splitting an argument means eliminating it by the case analysis rule for its datatype,then applying the unification tactic to the subgoals. Because the unification tactic implements the same unification algorithm as that which justifies the elementary covering
induced by the split, we know we will achieve exactly the same effect.
We are left with subgoals corresponding to the coveringD}E­^ D  ^XRÈ d E w D ZF[Ad \àÆIÇ_È C ^ B}
z x1 dd ëô ^dWhat is more, we know that case analysis with unification has the right intensional
effect, so thatÈ  ^ d ÿ È d wÜ^  ZF[A\àÆIÇ_È·ôà ä C Èþ7ÿ ë  v  z ^ d x1 d ë Ç ýÆ ÇIt is time to fill in the right-hand side. Let us introduce the premises and refine by Çä :^ D ^
XRÈ d Ö Y w D ZF[4d \àÆIÇ·È C ^z x dY ? D ^ ^ ùd ëX Ç ýd Æ Ç Ç   d U ^ _ä dd^Ã d is the expression we want to supply for  d , but it may contain some recursive u  , so[Aoo
we cannot just refine by it. We must replace those applications by s to fresh holesô u^of type first. Since there is no nesting, we may write them in any order, although
if nesting was permitted, we would still be able to choose an order. I shall only write
one of them in.
164^ D ^XRÈ d Ö Y w D ZF[4d \àÆIÇ·È C ^z x dY ? D ô ^d ëuVX ÈÇ ý d  Æ Ç Ç  ^   [Aooä dHÃ d J7JM[J È d  J7JMJ ô ^Where are we to find these elements of u  ? From ? , of course! Since u  is, by
ZF[A\ z ^ ëassumption, structurally smaller than  d , and must have some typed  , the typeëZ][4\àÆIÇ_È C z ^ x1
C z ^ x1u
d expands to a product containing d   , ieëëE  ^ D ^ z ^ x1u
J d  ëyz ^ x1

ë 

ô ^

È ^

Let us project this out and call it  . Because u  is well typed, we can find a matching
substitution which solves the constraints. Hence we may form

 u ^    > z ^ 1x u   D ô u ^ d ëand thus instantiateÈ d .

ÈIn point of fact, blunderbuss with ? is enough to solve d , because it solves reô ^flexive equations and searches through ú -types. Since u  is uniquely the type of therecursive call on those arguments, there is no way the search can come back with thewrong value.
Let us check that this type-directed folding really finds the recursive call. The point isthat

ZF[A\àÆIÇ_È·ôà Cz ^ x1 ÿ7þ  v  d dÿäÈ  ZF[4\Z¬q È C ë   z ^ x1u ë x  
J7J7JÈþ7ÿ ë v d   ë J7J7J J7J7J
Projecting this out and applying it as shown above givesÈþ7ÿ ë  v  z ^ d  x1u  ë u ^    > z ^ d  xu  ë Compare this with the definition of È above: it folds (by the matching substitution) toÈ u^ 
ZF[A\Zsq È C

Hence we know that for all w^
165È  ^ d ÿ Ç ýÆ ÇÇ äªÃd  J7J7J] [Aoo  È u ^   J7JMJ ô[4ooÇ ýÆ Ç Ç ä as suggested earlier. We find
All that remains is to solve and cut , 
and
[4oo
Ç ýÆ ÇÇ ä s^^that  is exactly È  . Hence (trivially unfolding and folding), the s and^ D ^
disappear and the È ’s turn into ’s. As required, for each æ and all wd ^ d ÿ øÃ d  J7J7J u ^ tJMJ7J ©

6.2.3 constructing programs
A man bought a full size replica of Michelangelo’s ‘David’. He put it inhis back garden and invited his friends round to see.
‘It’s just a big block of white marble.’ said they.
His reply: ‘I haven’t unwrapped it yet.’
The above theorem makes use of the guarded recursion, case analysis and unification
technology from the previous two chapters to ‘replay’ the justification of a patternmatching function known to lie within Coquand’s class of admissible definitions. We
had the advantage of knowing the equations in advance, and indeed the derivation of
the covering—we merely had to check that we could build a term with the right typeand computational behaviour. As we shall shortly see, this is only a slight advantage—
we can use essentially the same technique and construct the pattern equations as wego.
I propose to supply a collection of tactics for programming. As well as performing
theorem-proving actions on the O LEG state, these tactics will create and manipulate
associated pattern-matching programs in such a way that they are always justifiable by
Coquand’s criteria and, once the holes are filled, intensionally correct.
By way of a running example, I propose to construct i¦f;A=?h , the function which extractsç
the last element of a nonempty vector. Let us fix and suppress the element type .

i¦f;A=?h

DsEHGÉD

E DG ç
8 ªJ  i >klhÚ= J

I shall not tell you what the pattern matching program is, for the point is to unwrap it.
We begin with a goal166

NX × £7ÂDDEHGID 8 KJ E  D i>khR= G J ç

Here is a tactic which indicates that a given goal should be regarded as a programming
problem.
TACTIC: program

NX × £7Â

D D}E ,K D K..
.

E  D ZF[A\ z ^ë...
E  ³ D ³
ù  ·^ +Z
DeE  ^ D ^X A[ oo DeE ^ D ^ JVLM ZNPORR^ Q ù  ·^ 
XVÇ ýJ Æ Ç Ç DeE ^ D ^ ù  ·^  Z  ^XCä  ^ D ZF[AJ \ 
YuE ^ D ^E  ^ D u ^ zy^ x1
Z ^
ë
^
®
DeE  ^ DX
E ? D Z][4\àÆIÇ_È C zy^ x1
Z ^ë^  ^ D ZF[4\Z¬q È èC ® Ý^   z^ x1 
Y
J
>
^
[Aoo  ^R £MÂ D   ^ D
ë
×
Y
RJ 
 ^ D ^  ®  ^  X

P ROOF
The tactic
program

×£ D

O ë
O

turns MÂ , which must have at least premises, into a programming problem.
solved by appeal to a function of arity , recursive on its â th argument.

OZÇ ýÆ Ç× £7Â D is

 [AooAs before, the more informative type family is introduced, together withand Ç
ä , then  ë is eliminated with the relevant guarded recursion theorem. This leaves®
®
us filling in the body of the function . Associated with is a pattern matching equa®
tion labelled   , with its pattern variables listed in parentheses, which describes the®
^
aspects of ’s behaviour for which accounts. The left-hand side of this equation is  ,®
indicating that describes the effect of for any arguments matching the free pattern ^ —that is, any arguments at all. The right-hand side is a placeholder X , indicating that^
we have not yet decided what returns for arguments matching  .
167

®

As we split the goal to yield subgoals for specific constructor cases, so we shall®
split the equation   into the corresponding equations with more instantiated patterns.
These equations constitute the pattern matching program we are building, and weshall maintain the invariant that their patterns constitute a covering in accordance with®
Coquand’s definition. This is trivially the case for   .

©

By the way, if the program is not recursive, let us allow the omission of the  from theëtactic call. Correspondingly, we do not need to apply the guarded recursion theorem.
®
The type of is then the same as that of . The rest of the techique is unaffected.
Now, i¦f;4=?h is structurally recursive on either of its arguments, so it is immaterial which
we choose. I shall pick the vector. Let us see the effect of the tactic:

DEHGID E DGXÉ[Af;Aoo=?h DEHGID 8 ªJ E  D i>kh= G JMLMNPORQ


R ç
XRÇ ý Æ Ç Ç DEHGID 8 ªJ E  D i>kh= G J ç Éf;4=?h   XCä   D 8 ªJi>kh= J  Éf;A=?h 
Y D8w
EHY G D i>klh
E  D8G
E L K ]D i >klhÚG =E  M D w =®
DEÉG f;4=?D h XE  D8
G

i

>
l
k
Ú
h
=
Ê
E  ? DCÜG i>klh ¥yË É© C ® G Ý GÅfD ;A=?h   DGG=>ê=   > R i¦£7f;AÂ D=?h  Y GÅD 8 ªJ*Y  D ij>klhÚ= G Jij>[4kloo h  gË×®
Y 8 ªJ*Y ij>klhÚ= JRi¦f;A=?h    i¦f;A=Bh    X  GUD 8 x1 D i>kh= G 
Now that we know how to start the process, we must figure out how to build coverings.
TACTIC: split

168

DVE ^ D  ^X d E w D ZF[4d \àÆIÇ·È C ^?
z x1 dd ëZ ^d d  s^ d  X w^ D ^ d 

Ä D ZF[A\ ¥ C ^DEl^ D ¸ ^X  E u D Z][4 \àÆIÇ_È C
?
ª~  z ^ d x d ë 
Z ^
ª~ d

+

..
.

   ª~  ^ d  X..
.

 u^ D ¸ ^  where w
D]E  ^ D ^ ZF[A\ ^JÃand 9@R^ ^^^and ~ is a most general unifier (from wyx  to terms over u ) of cxw
^ xF
ZF[4\
^
Ã 9@ R , both in

ª

C

C

Ä and

P ROOF
The tactic
split wÄÄ

performs a case split on w in subgoal d , yielding a bunch of subgoals  . The equation
for d is split correspondingly into equations for the  .

Z][4\

Ä

C

As above, we eliminate w in subgoal d via the case analysis principle forandthen apply unification. The tactic succeeds provided unification in each case eithershows that there is no unifier or finds a mgu ~ . The resulting collection of mgus^
justifies the new covering, and it also justifies the unfoldings which show that d  d^reduces in each case to  ~  d .

ª

ª

©

The invariant that the patterns of the equations associated with the subgoals form acovering is maintained.
In our example, we shall certainly need to split on the vector  . There is no way tomake a nonempty vector with i¦ygf , so only the i¦kly= case survives:169ö DEHG D
E  D ç8EDG
ÃEiD >klö h DVEpTD ? úêÃ v
8ë E  D ij>klh= 
E E K DBG=E < M DÃ  h G
Ê Éf;A=?CW
G i> klh ¥yË   ÃÉf;A=?hi¦kly= Ãö   GD  D ç x Ã D ij>klh G i¦f;A=?h   i¦kly= Ã  X  8 x
XNote that the wallet of recursions has unfolded by one step, showing us the recursive
call we could make for Ã , but for the fact that it is not known to be nonempty. The effectöof our informative retyping has been to make the conclusion of tell us the patterns in
the corresponding equation.



We must make one more split before we can finish the job. If this were simply typed
programming, we would split Ã to see whether is the last element or not. However,G
we do not need to destructure Ã —splitting will tell us all we need.

ö DE  D ç
ó E D SE Ã ? D i>klö h D}ETDúºÃ ë v E D 8
 ij>klhÚ= 
E L K DMSE  M D =ÃÉf;A=?hÊC S
S ij> klh ¥yË   ÃÉf;4=?hi¦kly= Ãö ¯ DEpG DXE  D ç8EDG
ÃEiD >klö hÚD}= ETD
? úºÃ v
ë E  D ij8 >klhÚ= 
E L K D G==E  M DÃ Ê Éf;A=?C h G
ijG >klh ¥yË  = Ã i¦kly= Ã Éf;4=?h·= ö ó  i¦f;A=?h   i¦k¦=  Ã   X   D ç x Ã D i>klh S  ö ¯  i¦f;4=?¦h   i¦kly=  Ã   X  GUD 8 x  D ç x Ã D i>klh= G X170

Observe that in the former case, there is no way the matching problem can ever besolved to allow access to a recursive call, whilst in the latter, the way is clear.
Having split as far as is necessary, we should like to fill in the right-hand sides.
TACTIC: return

DVE ^ D  ^X d E w D ZF[4d \àÆIÇ·È C^?
z x1 dd ëZ ^d d  ^ d  X w^ D ^ d   w^ D ^d YdY B} D ZF[A\WÆKÇ_È Cz ^ x1 dd ëÇ ýÆ ÇÇ äªÃ Cd
 d   ^ d  Ç ýÆ ÇÇ ä<Ã Cd  w ^ D  ^ d 

C

^

+

P ROOF
Given
return Ãød [4oowe may, as before, form Ã d by replacing the recursive calls u bys to holes of type
Z u^
. If these calls are structurally smaller at argument â , we will once again be able tosolve these holes by appeal to appropriate projections from  ? .

©

The structural condition ensures that the new equation is acceptable, and the same
argument as that in the above theorem shows that it holds intensionally.
example has two cases. For the singleton, the value should just be the head. return
Ourgives
us

 öó



Dç
D
S
YÃ D ij>klö h DVEpTD
Y ? ú°Ã ë v E D 8
 ij>klhR= 
E E K DMS=
E < M DÃ  Ê Éf;A=?C h SÇ ý Æ Ç Ç ä ij >klh ¥yË Ã ö ó  i¦f;A=?h   i¦k¦=  Ã   Ç ýÆ Ç Ç ä Y  D ç x Ã D i>klh S 

In the case with the nonempty tail, we make the recursive call171

return i¦f;4=?h ­ÃThis becomesXö¯D G D
Y  D ç8YDG
Y·Ã D i>klö hÚD}= EpTD
Y  B} ú°Ã v E D 8ë ij>klhÚ= 
E E K D GE < M D =  =ÃÊ Éf;A=BC h G
 D i>klh ¥yË = ÃX Ç ýÆ ÇÇ Éf;A=?h [AooÃ ä 

A quick search reveals the appropriate recursion

   ? Ï G  GJ Ã >ê=   >ÙÃ 
justifying the equation ö ¯  i¦f;4=?h¦  i¦kly=  Ã   Ç ýÆ ÇÇ ä   [Aoo  i¦f;A=Bh ­Ã B GD 8 x  D ç x Ã D ij>klhÚ= G 
We can tell when a program is finished—once all the placeholding X s have gone. We
Z [Aoo Ç
andmay now solve ,ä as in the previous case. This leaves us with a realterm whose intensional behaviour corresponds to the associated equational program,which satisfies Coquand’s conditions by construction.

Ç ýÆ ÇOur example becomes  i¦f;A=?h  i¦kly= Ã   ¦i f;4=?h lÃi¦f;A=?uh   i¦k¦= Ã This is a rather subtle way to write i¦f;A=?h which makes crucial use of the extra indexing
information. Naı̈vely erasing the indices in the hope of recovering a function overordinary fg=?h s yields
172  
f;A=?h  kly= Ã   f ;A=?hÃf;A=?h  kly= Ã (Ð )This is clearly not the right function, or indeed a function at all.
Of course, we could have split Ã and built the usual i¦f;A=?h   i¦kly= i¦ygf   i¦f;A=?h   i¦kly=  C Ã i¦f;A=?uh   i¦k¦=  i¦kly= C Ã  

I do not wish to embark on a discussion of the relative merits of these two programs—I
will merely point out that computation on the indices of a type behaves differently fromcomputation on the type directly, and sometimes interestingly so.
The combined effect of these tactics is to allow a similar style of interactive program
development to that available in ALF—not only can we build the same programs, but
we can do so in the same way.
However, this is not enough. Having built these programs, how do we store them?
For O LEG, the representation of the program is still a ghastly term involving guarded
recursion, case analysis and unification, all painstakingly recorded. Why can’t wejust write the pattern matching equations down? The construction of programs in thissection has relied on knowing more than just the equations—we have also exploited thejustification that the equations satisfy Coquand’s conditions, and we have recovered aprocess for building those justifications interactively.
In the next section, I consider how much we can do with just the equations.

6.3 recognising programs
The question asked in this section is ‘for which pattern matching programs can werecover the justification?’. Sadly, as we shall see, the answer is not ‘all of them’.
Nonetheless, it is worth analysing at what point the problem becomes undecidable,with a view to building a system where we can store enough information to allow
the recovery. The aim is to describe a class of recognisable programs. I have madesome progress in this direction, although there is work still to be done. I feel somediscussion of the problem is worthwhile, not least because the techniques describedhere are sufficient to recognise all the examples in this thesis, which will save me thetrouble of describing the construction.
173

Our existing tactical presentation of program construction will be of assistance to us.
We have built ourselves a structural editor for acceptable programs. Let us now imagine
this editor being used not by humans but by a mechanical recogniser whose task is totake a set of pattern matching equations and build the program. This echoes the view
I have taken of the constructions with which we may equip our datatypes—they makeuse of the tools we have developed for theorem-proving, ie the structural editing ofO LEG terms. I know relatively little about writing compilers, but it seems to me that a
promising first move is to build a structural editor for the target language.
The three tactics from the previous section divide recognition into three phases:Á

identify an argument position on which the recursion in the program is guarded(and apply program)Áshow that the patterns form a covering (by applying split)Áfill in the right-hand sides (with return)The first and third of these are easy. We may simply check each argument positionin turn for one which satisfies the guardedness condition before applying program.
Meanwhile, return codes up exactly the operation we need. It is the second phase,checking the covering, where undecidability creeps in.

6.3.1 recursion spotting
Given a goal

NX × £7Â

DDE  ^ D ^ J ù

and a pattern matching program of arity

^ 
dd
Ãd

 w^ D ^ d O

It is easy to check for recursive calls to in the Ã d . It is also easy to find for each equation
the set d of argument positions which satisfy the guardedness condition. We may saythat non-recursive equations are guarded in all their argument positions. Coquand’s
criterion requires that the intersection of the d be nonempty. If so, we may apply the
program tactic for any of the indicated positions.

û

û

174

It is possible that this procedure will yield a choice of positions. While any of them will
do, we may still have a preference. For example, structurally recursive programs over¢i>klh s or  s are necessarily also guarded on their natural number indices. It does notreally matter which we choose, but I would prefer the recursion to be on the datatypes
themselves, rather than the indices, as this produces a justification which seems to me
more intuitive.
Now we have found â , we may apply
programO ëThis leaves us with subgoal ®  p^  X®

and its associated equation ^ D ^ Now, let us relate the program equations we are trying to construct with the associated equations in the current state of the construction. I call the latter the covering equations because their patterns are guaranteed to form a covering. In particular,
we are certain that each program equation is covered by exactly one of the covering
equations—only one of the covering patterns may be instantiated to give each program
pattern.
For each covering equation, we may collect the program equations it covers—this isjust a first-order matching problem. There are three possibilities:ÁÁ

there is one equation, and it is covered exactly, meaning that the covered equation also covers its coverer—the patterns are the same, up to renaming of variables and return is now applicableÁthere is at least one covered equation, but none covered exactly, so splitting will
be necessary
there are no equations covered—this means either that the program is incomplete, or that there is nothing to cover—an undecidable type inhabitation problem

Let us look at each case in turn.

6.3.2 exact problems
If we have reached the stage where a covering equation175 d  s^ d  X w^ D ^ d exactly covers a program equation ^ d  Ãd w^ D ^ d then we may apply tactic
return Ãød
We know that the guarded recursive calls will be available to us, so we complete thisbranch of the justification.

6.3.3 splitting problems
We have a covering equation   ¬^   X

 w^ D ^ 

which covers several program equations^ ^ D ^_ª d  Ãd w d dwhere _
ª d is a (matching) substitution from the w ^ to terms over the w ^ d .

Each time we split a covering equation, we introduce at least one more constructor
symbol into its patterns (since patterns may be nonlinear, replacing a pattern variable
by a constructor form may add more than one constructor symbol to the pattern). We
may exploit this property to measure how far away the program equations are from being covered exactly. In order for a matching to exist, a program equation must containat least as many constructor symbols as the covering equation, so we may simply countthe excess.

æÄSuppose  covers equation and is then split into several cases, one of which, say,covers also. We know the constructor excess of equation over is strictly less thanthat over  , because the patterns contain more constructor symbols. Hence, we may
keep splitting problems until they become exact or empty and be sure that the process
will terminate.

æ

æ

Ä

Ä

Which split should we make? In order to see this, we must expand each of the program
equations in terms of  . We know
176

^ 
^ ü
_ª d   ÿ jª_d w J7J7J?ý
where the tuple is just the collection of accessible recursive call values

Ä

ª Ä

Ä

If there is a w such that each _d w is constructor-headed, then w is a candidate forsplitting. If that split is successful, constructor symbols will appear at w , yielding
simpler subproblems.

Ä

Ideally, everything will be in constructor form, splits will always yield solvable unification problems, so we may split any of the candidates and carry on. Which candidate
should we choose? I would suggest we prefer candidates higher up the type dependency hierarchy, as these may induce splits in other arguments by unification. For
example, if we are building a covering of the i>kh s, splitting a vector will automatiS
cally split its length into and = cases, while merely splitting the length will leave us
with work still to do on the vector.
Even if there are awkward non-constructor expressions involved, there will only bea finite number of candidates at any stage, so we may keep trying to split until one
works. It is conceivable that, in an impure world, splitting something too early may
yield unsolvable unfication problems later. For the sake of argument, we may consider the recogniser to be nondeterministic—any justification will do. This is far fromsatisfactory, but it is safe.

6.3.4 empty problems
We have a subgoal

X d

Z ^
D}E­w ^ D  ^ E ? DdJ
JMJ7JMJ  dbut no program equations to give us a clue what should go on the right-hand side,or how to do any further case splitting. This either means that the programmer has
forgotten a case, or else one of the d is empty, and there is morally no need to explain
what should happen, as the case cannot arise.

Types can be empty for arbitrarily subtle reasons—the type inhabitation problem isundecidable. Even if we restrict everything in sight to constructor forms, we will still
be able to code up the halting problem as a datatype inhabitation question (see table
6.1). Some empty types, such as the simple type with one step constructor and nobase constructors, require an inductive argument to prove them empty. Others may
177eventually disappear after enough case splitting, but there is no way of telling how
much is required.
If we cannot be totally clever, can we be totally stupid? That is, can we reject theseS
problems out of hand? Unfortunately not. The elimination rule for the type has no-reductions and thus corresponds to an empty program—if we are to recognise therecursion operators provided for datatypes as bona fide programs, we shall have to beable to solve some empty problems.

Y

Having rejected trying zero and infinity steps of case splitting, the only other intuitively
plausible option is one. Let us try one case split on each argument in turn, and if any
proves the goal, we have success. Otherwise, the problem is too hard and we fail torecognise the program. This is enough to allow us to ignore cases with arguments in
S ¢ S
types like , and so on. The idea is that a type is obviously empty if there is noconstructor-headed expression which inhabits it.
Effectively, the programmer must deal with non-obviously empty types explicitly, by
calling subprograms which eliminate them. If we construct a program interactively
which takes several steps of splitting to dispose of a type, we may represent the last
step by an obviously empty subprogram which gets called from the last case wherea pattern existed. This effectively records the splitting process used to dismiss thetype. If we find ourselves repeating ourselves, perhaps we should be able to registercommonly used emptiness proofs in such a way that they are tried along with splitting
whenever an empty problem is encountered.
It is conceivable that one search path through checking a covering may lead to only
obvious empty problems, while another may lead to a non-obvious empty problem.
Once again, we may save ourselves by crude nondeterminism. Whether we can dobetter remains to be seen.

6.4 extensions
I feel I should make brief mention of a number of obvious extensions to the class ofprograms we should be willing to consider, none of which is particularly controversial.

6.4.1 functions with varying arity
In simply typed languages, we are not used to seeing functions with varying arity.
Certainly, the use of curried functions is commonplace, but there is nothing serious
178Á

basic datatypes

Á

describing the machineÁ

halting problem (¦;4fh=DD­<­<­ other =?h1;Ah> s=?h;  h ?= h1;Ah>y;4fh =Bh;Ah>£££Dother =]îp¨
<
­
<
­
­
 fs

f;4  ]= î¨ fD gõyh D ¨·i>f> øh ¨nÚij>££h  ;Ay=?ghg  =Bh;Ah> Ð =]î¨ f Ð =?h;4h> Ð =]îp¨ f Ð ¨nÚij>h  ;Ay=?ghgy=  fg=Bhh  ;Ay=?£ gh1g¤ > h=?gf=]î¨ f ]Ð =]î¨ £ f Ð: fg=?h·=Nîp¨ £ f 

h
;
¢

kl õe¥  ;Ahg =Bh;Ah> Ð h; ¤ >(h=Bgf is the type of lists built by adding elements at the right-hand end with theconstructor =?yk . I overload ¦gf .)Á list membership (for any element type ç ) D ç £ Ã D fg=?h ç D ç ù D ¨£ >¨ £ >   Ã¢ ù D ¨n>¨ >  Ý kly=  Ã D  Ã ¨n>¨ > kly= Ã
=B>
> 
Á updating the tape (¥ ¤ 4;Ah> D h; ¤ >U ¨·i> «h; ¤ >U LMNPORQ ) D N= îp¨ £ f  D fg=Bh·]= îp¨ £ f
£
D
ü
ü £
f f;4  y ¥ ¤ A;4h> ¦gf xx1 ý(f> øh ¦gf x f;A  x kly= y ýDD h=?gf}=]îp¨ £ f Ã  D =Nîp¨ £ f  D fg=?hÚ=]îp¨ £ f
D D
ü
D
2ü D
f¨·i> Ã y ¥ ¤ 4;Ah> =?yk Ã x1¬x1 ý(f> øh x Ã x kly= y ý
£
£
DjD
D
 £ f;4  D  D ¥ ¤ 4;Ah1h=?> gf=]îp2ü D ¨ x1¬x ygff ý  g õ¦=]h îpü ¨ =?yk f D cx £ f;A  x ygfý
DjD h=?gf=]î¨ £ f  Ã D =]îp¨ £ f  D fg=?h·=]î¨ £ f ¨nÚij> D  Ã  D ¥ ¤ A;4h> 9ü D x1¬x kly=tÃ  ý  g õyh ü =?yk D cx Ã x1 ýÁ one step (=Bh> ¤ D h  ;Ay=?ghgy=A«k ¢ õ4¥  ;4hg  kl ¢ õe¥  ;Ah1g  LMNPOQ )
£
D
ü
D
ü2D
Ã  ¨>¨ >  Rxx1D  C x C ¤ x2Î ý¸Ã Bü  ü D ó ¥ ¤ 4ü ;Ah> x1 C x ý Î Ã ÂMzcA Ã 4ó =?h> Ã B x x1¬x1 ý?ý  C x Ã Â7zc ý¢D h ;4y=?ghgy=4«k õ4¥  ;4hg  h; ¤ >U LMNPORQ )? D h  ;Ay=?ghgy= Ã Â7zc D h; ¤ >ÃDü=?h ¤ Ã ? Ã Â7zc y;Afh=¦Ã ? y;Afh x Ã Â7zc ýÉÃ Â7zc Ã Bz D =Bh> ¤ Ã ? ¥   Â D Ã  D y;Afh=¦Ã ?  Ã ÂMzcõ4  Ã ?z  Â D Ã  D y;Afh1=Ã ? ¥ Ã Â7zc
Table 6.1: coding the halting problem
179·

happening that  -equivalence cannot explain. There seems to be little motivation forallowing functions to be defined with arity varying between pattern equations.
By contrast, there are some dependently typed functions for which such a relaxation in
the syntax would be of genuine benefit. These tend to arise when we write one function
to compute types involved in another. For example(c¥y¨ S D 8 $  LMNPORQ
(c¥y¨
(c¥y¨
=?¥y¨
=?¥y¨
=?¥y¨
=?¥y¨

8
G 
G
=
8 & (c¥y¨
DsEHGÉDG
8 @J'(c¥y¨
S  S
S  
= 

G
G
=?= Ùw=?¥y¨ =  ¤ f¥y= ÞwÚ

The first argument of =?¥y¨ is the number of subsequent arguments, and the function
computes their sum. You might well point out that I could make the arities uniformby Y -abstraction, but that is because I am not doing any pattern matching on the newly
exposed arguments. Of course, in any case I can always introduce subprograms, but
why should I have to?
You might also suspect that such functions are uncommon in practice, and thus not
worth the trouble. There are three things to say to that:ÁÁ

Dependently typed programming is still in its infancy—we do not know which
techniques will turn out to be common in practice.

ÁThis is the kind of technique which is used somewhat less frivolously in strong
normalisation proofs—we compute a meta-level function type from an objectlevel function type, then we compute the appropriate metal-level function to inhabit it.
This sort of behaviour is already supported in as industrial a programming language as C. The remarkably common printf command takes a formatting
string, followed by arguments appropriate to the fields to be printed—you hope.
Of course, there is no check to see that it makes sense. C compilers do not blink
twice atprintf(‘‘%s%s%s’’);180

but the effect is seldom benign. Dependent types sanitise these rather frightening
functions.
We may accommodate this behaviour by adjusting the definition of covering to allow
lengthening of pattern sequences by fresh pattern variables, provided the result type
beforehand is functional. These extended patterns may then be split as before. Eachlengthening can, of course, be replaced by a call to a subprogram in order to recover
the uniform arity of the original. The treatment of recursion is as before. Recursive
calls can be recognised provided they have at least the arity of the pattern to which theguarded recursion principle was applied. Longer sequences of arguments can be cut in[Aootwo, leaving a recursiveof the right length which is then applied further.



6.4.2 more exotic recursion
While it is sufficient to facilitate functions which are only recursive on one argument
position, it is nonetheless convenient to allow more complex structures to be built intoa single function, rather than forcing the programmer to break them up. The traditional
example is Ackermann’s function:

D;Ak 8 &«8 $ 8SÙG  G;Ak =S 
 S;Ak Þ=;4k =
 G  ;Ak    ;AkÙ= G ;Ak Þ= =The recursion in this function is lexicographic in the sense that either the first argument
decreases structurally, or else it stays the same, but the second argument decreases. It
can be split into a pair of Coquand-accepted primitive recursive functionals as follows:¯  D ;Ak
8  8  «8 $ 8
¯ ÂMÍ  S  Â7[Í  S;Ak =¯  ÂM Í  G  Â7[Í  
¯
 G 
;Ak 
=;Ak ÂMÍ
D;Ak  8 &«8 $ 8
S ;Ak =¯ ;Ak Þ=;Ak   ;Ak What has happened here? For a start, the main ;Ak function has been  ’d into a¯functional. This enables the = case to be delegated to the auxiliary function ;Ak .



181



This receives as an argument the function ;Ak , available by structural recursion—itis thus free to apply this function, as well as making its own guarded calls.8
Would not all but the most die-hard of origami programmers9 prefer to write the lexicographic version? In fact, we already have the tools to construct it interactively—
suppose we have reached the following stage:

Ê
DEp GÉD
X [Ak o o DEp GÉD 8 KJMLMÊ NPORQ G  8
XRÇ ý Æ Ç Ç DEp GÉD 8 KJ k Ê
G
X
k
® ä  ? D Ï 8 KJM8 ;Ak 
YG D
Y G 8¯ DE  = D
XM;Ak E  ? D 8  EHGÅD ÊG sÐÞ 8 Ê ¥¦Ë J7JMJ  
8 ªJ 
k 
EG D
8 G
Ê
 © k º=;Ak 
8 gËºJ7JMJThe  B} argument gives us access to guarded recursion on the first argument. We may
now add guarded recursion on the second (for the same first argument) by eliminating©
Gwith 8 gË , fixing and ? :

XM;Ak¯ DVEp D
E ? D 8  EHGÉD ÊG sÐ( 8 Ê ¥yË J7J7J  
8
ª
J

k
EHG D
Ê
E ? C D 8 Ê G
8 G ¥yË  kº= 
Ê
k Þ=


Case splitting onG

now gives us

We would not need to pass !" #%$ explicitly through the recursion if we could define &(')+*$ locallyto the successor case of &,'-) .
9
An origami programmer only uses pattern matching to define fold operators.
8182¯ ® D}Ep D
E ? D 8  EHGÅD Ê G ]Ð: 8 Ê ¥yË J7J7J  
8
ª
J

k
E ?'C D ÏÊ&S¯¯ D}Ep k ÞD =XM;Ak E
8
? D  EHGÅD 8 ªJ Ê k   G ]Ð: 8 Ê ¥yË J7J7J  
EHG DE ?' C D 8  ÊG sÐ( 8 Ê ¥yË  Ê kÙ=   G 
k

Þ=
Ê
 G
k Þ= =¯®
For the ;4k  case, we may project the appropriate component of  B} . Looking at
¯¯
[Aoo
Ç ýÆ Ç Ç ä toand;Ak  in more detail, the nested right-hand side translates by 
XM;Ak

¯¯ D



D

8
Y ? D  EHGÅD 8 ªJ Ê k G sÐÞ 8 Ê ¥¦Ë J7JMJ  
G DY8Y ? C D  Ê k Þ= G sÐ: 8 Ê ¥¦Ë  Ê kÙ=   G DÊGX ?K D Ê k Ù =[Aoo
X Ç ?ýR Æ M Ç Ç k  [4oo    ? Kä   ?V M ?K is solved from  B} C and ?R M is solved from  ? . The definition is complete.
XM;AkY

We can build quite complex structures with multiple eliminations by guarded
recursion—more even than lexicographic recursion on a number of argument positions. For example, we may define a function on lists of trees which at each recursion
replaces the head tree by its subtrees—some steps may make the list longer, but thedecomposition of the head tree guarantees termination.
The question of how to extend the class of recognisable pattern matching programs
into this more exotic territory is an important and interesting one. Much attention has
already been paid to the simply typed case, for example, in Manoury and Simonot’s‘ProPre’ [MS94] system. Further, Cristina Cornes has equipped C OQ with a substantial
package translating equational programs with relatively interesting recursive structure
into constructor guarded fixpoint expressions [Cor97].
Further investigation is beyond the scope of this thesis. However, I shall nonethelesswrite such equational programs in the following chapter, since they are shorter andclearer than their expanded versions where each recursion has its own subfunction.
When I do so, I shall always be careful to point out the justification, imagining that weare deriving the function interactively.
183

Chapter 7
Some Programs and Proofs
We have now developed substantial technology for constructing dependently typed
functional programs, and also for reasoning about them. Let us now put that technology
to work.
In the course of this chapter, I offer some examples which I believe illustrate the advantages afforded by working with more informative types. We shall see new versionsof old programs which are tidier and easier to prove correct. We shall see applicationsof our elimination rule technology which aid program discovery as well as verification.
Hopefully, we shall see sense.
Later, I shall focus on the manipulation of syntax as a programming domain whichshows off to great effect the expressive power of dependent pattern matching. In particular, I shall construct and prove correct a first-order unification algorithm which has
the novel merit of being structurally recursive.

7.1 concrete categories, functors and monads
In the examples which follow, we shall examine methods of working with syntax via
dependently typed functional programming. The behaviour of the functions we shalldevelop fits neatly into a categorical treatment, so it is worthwhile building some tools
for packaging these functions and their properties categorically.
We shall not need any particularly heavy category theory, which is just as well, as far
as I am concerned. For a substantial formalisation of category theory, see [SH95]. In
fact, we may restrict our attention to concrete categories—those whose objects canbe interpreted as a family of types and whose arrows can be interpreted as functions
between types in the family.
184

7.1.1 records for categories
So, what shall we say is a category?
The idea is not that objects are types and arrows functions, but that both are data which
can be interpreted as such. Imagine we are modelling a programming language categorically: we might have O LEG datatypes representing the types and functions of that
language, together with translations which model those types and functions as O LEG
types and functions. Those datatypes give us the objects and arrows of a concrete
category, and the translations their interpretations.
Let us fix the types of objects and arrows.

D.
/

LMNPORQD.
.

 LMNPORQ

Now, let us define a record type 9@¦khave a meaningful category:

 >h> to contain the things we must supply to

Y0 DD EE û D . J ù D /.  / ù û   û / ù 
J
  /
.
D
 ­
 LMNPORQ ­ DE ù D . J  / ù       ù \>¤ = ¤ F DD EE û D . J ù E D . D  E  ¢ J D  Y1 /  ¦ ù E  D û / E  D  û   ¢ 0  y
\>= 9
J
J ×
J
J
×
­

 ¢P :  ×  yFI think it is safe to overload   . Confusion between the interpretations of objects andarrows will not arise in these examples.
Saunders MacLane [Mac71] defines a concrete category to be a category equippedwith a faithful functor into Set. That is, the interpretations must not only preserve
identity and composition, but must also embed the objects and arrows in Set. I havegiven no such condition. It begs the question ‘what is the appropriate equality on
objects and arrows?’.
In type theory, as in marriage, fidelity comes down to the way you see things. O LEG’s
intensional equality is too discriminating to be useful here. I propose to consider two
arrows the same if their interpretations are extensionally equal: interpretations are thus
trivially faithful. Consequently, it makes little sense to consider the category separately from the functor which interprets it—the functor properties are how we know
the category has the traditional absorption and associativity laws with respect to thisextensional notion of equality.
185

¢R × D / ù , let us make the abbreviation¢ Ö × ,+ E  D   J  ?¢    ×  ¦Correspondingly, if

The usual absorption and associtivity properties¢0YÖ ¢
Ö ×0
Y×¢ 0 ×  0 Ö ¢ 0  × 0  

all follow by reflexivity.
Discharging the parameters, we have our notion of category. I shall typically write

9@¦k  >h>/

to mean a category for a given notion of arrow, leaving the object type implicit.
For any type family 2 Â
/
2

Â


Y

ù D.

 D . «LMNPOQ , we may define
J32 Â




2

Â ù
D

.



.

 LMNPOQ­

We may easily define an operation   on such families such that/D 2 Â  9@yk >h> 2 Â with objects interpreted via 2 Â
and arrows, identity and composition as themselves.
This is the usual notion of functions between types in a family, represented within our
defined class of category.
In particular, if we let 4
of O LEG types.

µ·¶w be the identity function on LMNPOQ , then  4 µ·¶ w  is the categoryÏù

As a special case, we may pretend any type is a -indexed type family and manufacù
ture the one-object category   of its endofunctions.
We will encounter categories whose arrows are not represented directly as O LEG func-

tions. A rather glib example is the 9@yk >h> 8 whose arrows live in 8 (actually,
/

Ï

Ï

G
G
S
8 , but never mind), with interpreted as ¤ f¥y= . The identity is , the¤composition is f¥y= , and hence the property that interpretation respects composition isjust associativity.
186

7.1.2 records for functors
A functor takes objects and arrows from one category to objects and arrows of another,preserving identity and composition. We can certainly write these requirements down
as a parameterised record.
Let us fix source and target categories, then open them:

¯
.
/

D
¯ D LM. NPOR¯ Q.

¯

 LMNP¯ ORQ/ 9@¦k >h>.
D LMNPORQ
.
D .
/

 LMNPOR Q  D9@yk >h> /
 ¯ D

¯
¯
 ¯  ¯ x 0 ¯ xF  xF  x

Y

­

­

¯
¯      x 0 xF  xF   x
¤
¤
¤
¤
x

x
\>= F \>= 9 Y ­ ­ \>= F \>= 9 

Relative to these, let us define a record type©

¥y¦kh  with fields

© D. ¯.
©  D  / ¯ ù ©   / ©  ù ; D J7J7J Ö©
Ì  >=? §; D J7J7J ¢ © × ¯ Ö 576; ¢ Ö © ;²×Ì ><= F D J7J7J © {; Y ¢ 1 0 ¯  Y Ö8139  © ¢} 0   © Ì >=?9 J7J7J ; ×;; ×

Note that I have left out some human-inferrable universal quantifiers for the sake ofreadability.
The extra condition—preservation of extensional equality of arrows—is necessary. It is
possible for two extensionally equal source arrows to be distinguished computationally,and hence mapped to different arrows in the target category, unless we expressly forbidit.
Of course, ¯ whenwriting functor types, I shall suppress all the details and just leave©
  ¥yyklh.



By way of example, every polymorphic1 type family has an associated functor. It
would be nice if these were manufactured automatically. I shall outline the functor for£¨ ; > .

*î1in the ML sense187£ © D©
µ·¶µ·¶¨ ;)î >¥yyklh   4 w R 4 w £ ©  ü
£
©
¨ )
; î >
© = ¨ ;)ùî D >D; =Y
LMNPORQJ*Y ¢ î~>=  î~>= ù  ¢FÌ >=?§ ; = J7yJ7J yÌ  >R= F = J7J7J
Ì >=?9 = J7J7J
ù£D
J*Y  ¨ ;*î >JýThis functor just lifts functions to their exception-propagating images. I use a ‘table’
notation for case expressions: the column heading  indicates what is being analysed,
underneath it are the patterns, and to the right are the corresponding return values—
this notation is easily interpreted by pattern matching. The three remaining fields may£©
easily be proven by inverting ; , ie case analysis on the ¨ ;> -typed argument
implicit in the extensional equations.

*î

Finally, one irritating aspect of intensional type theory is that we may have to workwith several implementations of, extensionally speaking, the same function. Suppose©
©
we have another candidate ; for the arrow part ; of a given functor, with the same
type and extensional behaviour. It would be really annoying if we had to redo the©
©
proofs of the properties for the functor with ; replaced by ; , but fortunately, we
may make this argument once and for all.

C

C

©

The point is that the functor properties concern only the extensional behaviour of ; ,©
©
so we may construct a function =B;A¨> ¥y¦kh which takes our source functor, ;©
©
©
and a proof that ; and ; have the same extension, returning the functor with ; onarrows and all the same properties. I shall not give the details here—they amount only
to unremarkable rewriting.



C

C

C

7.1.3 records for ‘concrete’ monads
The formalisation of monads I shall give is a ‘concrete’ version of the Kleisli triple
presentation due to Manes [Man76], which he showed equivalent to the convention
definition [Mac71] by an endofunctor : with natural transformations  and ; .
D EFINITION: Kleisli triple
A Kleisli triple  :
2 ?A@



ü=<  2

on a category > is given byis pronounced ‘bind’.

188

Á

a function : from > -objects to > -objects

a : C  , interpretingan object-indexed family of morphisms  B>  C
the elements of C in its : -image

Á

a

ü=<
a family of functions , indexed by a pair of objects C ED , from C : DI to >  : C : DK
>

Á

a

a

satisfying the equations

Á

Î

üF< 



Á ò¢ üF<  0   ¢Á  ò ¢ 7ü <  0 ×  üF< ò ¢ üF<  0  × ü=< aThe Kleisli category arising from such a structure has the same objects
as > , and C to D arrows given by the >  C : DI .  gives each object its
identity, and the composition G is

¢ Gh×  ¢ üF< 0 ×
­

­ üH<

Consequently,  0 gives a functor from > to the Kleisli category, and gives a functorfrom the Kleisli category to the image of > under : . The composition of the two isthus a functor which does : to objects.
The presentation of monads given below is based on the idea of a functor which is split<üF<into  0 (below ý ) and .

­

^­

­

Given two concrete categories and a functor, we may describe what it means to be aconcrete monad which splits that functor. Let us keep the same target and source
categories opened as above and fix further

Z D©

 ¯  ¥yyklhZ

Let us open with the names given by the fields.

Z

JI

ù

ù D . ¯A concrete monad splitting ¯ captures a classof ‘diagonal arrows’,(),© ù 
which are interpreted in. These will be the arrows of the Kleisli
category, and they must be equipped with a notion of composition G which behaves
under interpretation like the composition in the Kleisli category.

)î £ ©

î> functor, viewing ~>= as packaging data and y as representing
Think of the ¨ ;an error condition. Arrows in the source category are ‘reliable’ functions acting on
189actual data; arrows in the target category are ‘error-aware’ functions—they may handle errors or create them. The functor takes reliable functions to ‘error-propagating’
functions—they will give actual output for actual input and transmit error conditions.
A ‘diagonal arrow’ is an unreliable function—it accepts actual data, but may result in£ ©
> characterises a class of these unreliable functions
an error. A monad splitting ¨ ;such that

*î

Á

¢

¢

every reliable function has an unreliable image (which just packages the output<
with ~>= ) given by ýî

¢ D  ù then <ý ¢ D  ¨ ;*î £ > ùÁ every unreliable function × in the class has an error-aware image (which propaü=<gates input errors, but may make new output errors) given by ×
£ ù
£
£ ù
D
ü=<HD
«¨ ;)î > then × ¨ ;)î >  ¨ ;*î >if ×
Á the combination <ý ¢ üF< does the same thing to source arrows as ¨ ;)î £ > ©
£
£ ù
ù
D
< ü=<~D¨ ;)î >  ¨ ;*î >if ¢then ý ¢ifMore formally, let us fix the carrier type for diagonal arrows
I

D.

¯



.

¯

«LMNPOQ* with fields

and collect the relevant details in a record type KWy;

¯ ù
JI
ù
D
ýü=­ <D JMJ7J  LI/ ù   ©





/
­ D JMJ7J  LI ù    û  I   ©   û ù I  ù ¯
G JMJ7J  ­  D JMJ7J  LI  ù  ¯      ù D  ¢ =ü <    <  y*   ¢P yKÜy;)íF JMJ7J
D  ¢  y ý0Y 1  ¢ üF<  B  ]KWy*; A¤ 9 D JMJ7J < =üG*< × Ö ©
×
¢
¢
; <
©  ( fgh D JMJ7J ¢ ý Ö<© yh§ ; D JMJ7J < × ¯  Ö ý ¢ Ö < ý × < yh9 JMJ7J ý  ¢ 0 ×   ý ¢* G  ¦ý × 
M
D
Fü <
Fü <
;M 4k c§ ; D JMJ7J ¢ Ö × =ü  < Ö ¢ Ö Fü < ×  Fü <ò ¢  0  × ;4k c9 JMJ7J  ¢ Gh× <

This may look like a lot of stuff, but remember that the diagonal arrows might not
be represented functionally—they might be something really concrete like association<üF<lists. The operations ý , and G should be viewed as syntactic. We have to ensure thatthey have the right semantics. Of course, if they are just functions and their interpretation is application, then this is very easy to do.

^­ ­

190

)î £ ©

The ¨ ;> functor has trivial functional representations of arrows source and target.
££ ©
D
For the corresponding ¨ ;>NKKÜy;¨ ; > , we take the diagonal arrow£ ù<
type to be  ¨ ;> and the interpretation as application. ý just composes H>=ü=<on the back of its argument whilst is defined by case analysis:

*î

)î

) *î

­

¢ ü=<  î~>= ]  ¢¢ ü=<  y­î  y ùComposition is defined in accordance with the requirement on its interpretation: ¢ Gh×  ¢ ü7<  × ]

As for the propertiesÁ KWy;*íF , KWy;)49 and ©  yh9 hold by reflexivity.
Á ( ¤ fgh and M ;Akc9 hold by case analysis then reflexivity.
Á ©  ¦h1§?;Áholds, rewriting by the premise.

;4kc§;Mholds by case analysis, then reflexivity in the ¦ case and rewriting by
the premise in the H>= case.

î

There is a function which constructs the (concrete) Kleisli category for a given concretemonad.
OD
f>g=?fg KÜ¦;*

The 9<ykI

9@yk  >h>I >h1> so constructed has operations:ÄY 1  <ý[Y 1¯
0 Ä 
G

 Ä  ©   ?¢  Ä   ¢ üF< 
Observe191

PHP

Y 1Ä Q=Q Ä ¯ <ý[Y 1¯  Ä  
 <[ý Y 1 üF< ¯  © {; Y1  

¢ Ä × Q=Q Ä 

P=P 0

Y 

RR 75 6 1E9SSYÄ Ä­(definition of )(definition of   )¤( fgh )(Ì  >=R¤ F ) (\>= F )( ¢ Gh×  Ä    ¢ Gh×   üF<    ò ¢ Fü <  0  × ü=<    ¢ Fü <  B × Fü <  ]
 ¢? Ä B ×  Ä ]

Ä(definition of 0 )(definition of   )M( ;4kc9  )¤(>= 9 )(definition of   )

\

­Ä
­Ä

7.2 substitution for the untyped T -calculus
In this section, I shall develop the technology to give a monadic [Man76, Mog91] presentation of substitution for terms with binding—in particular, the untyped Y -calculus
with de Bruijn indices [deB72]. Bellegarde and Hook [BH94] suggest the following
datatype, which Altenkirch and Reus [AR99] describe as ‘heterogeneous’, and Bird
and Paterson [BP99] describe as ‘nested’.

¥ D LMNPORQ
Z?;A¨ ¥ D LMNPORQ
 D¥
¥
D


ij;
?Z ;A¨¤A ¤ Ã D ZP;4D ¨ ¥ Ã Z?;A¨
;
¥

£ ¥
D
Ã ZP;4¨  ¨ D ;)î >¥ f;A¨ Ã Z?;A¨This datatype relativises terms to an arbitrary type of variables.3 It can be defined in
SML, but recursion over it is necessarily polymorphic and hence unavailable. However,Haskell now allows functions over such datatypes, so long as their types are supplied
explicitly.
In such languages, terms may not appear in types—this apartheid policy is advisable
because the terms often engage in such criminal activities as nontermination. Hence, if
we want to make some kind of indexed family, the indices must themselves be types.
£> as a kind of type-level = , corresponding
This presentation works by using ¨ ;to the idea that there is some number of variables and that abstraction introduces one
S
more. Also, ?;A¨
is a type of closed terms. However, this hacked-up type-level

)î

Z

3
In fact, our scheme of definitions restricts the variable type to inhabit a smaller universe than theterms over it.

192

8

has only introduction rules: no computation on indices is available. Fortunately,
substitution is structural on terms.
We need no such Group Areas Act. In our system, terms are as trustworthy as types.
¢
We can use the 8 God invented, and then  to make sets of variables.

Z?;A¨

GUD
GU8 D

LMNPOQ D¢ GDGij;  Z?;A¨¤A ¤ Ã D Z?;AD ¨ G G
 Ã Z?;A¨;DGÃ ZP;4D ¨ = G
f;4¨ Ã Z?;4¨

ZP;4¨ G is the type of Y -terms with G free variables. Later, we shall see operations on
syntax which are made structural by the availability of recursion on this index.
Placing these types in our categorical setting, we have¢¢   D @9 ¦k  >h> / Z?;4¨  D 9@yk  >h> Z?;A¨/¢ZThe objects in these categories are elements of 8 , interpreted via  and ?;4¨ respectively. The arrows are function spaces interpreted by application. Hence we effectively
abbreviate: /  G ,+ ¢    ¢  G
 /VU G ,+ ?Z ;A¨   ZP;4¨ G
In this section, we shall be looking to build a functor\>y;A¨> D © ¥yyklh   ¢   Z?;4¨ ¢which, for every arrow on a variable space in    , gives us the operation on terms from
 ?;A¨  over those variables renaming them as indicated. The object part of the functor
is just the identity on 8 . We may then view functions in the typeZ

 I G H+¢

  Z?;A¨ G

as simultaneous substitutions frommonadic implementation

 variables to terms over G variables and seek a
193

£
I
D
c( ¥ =?h+K KÜ¦;* \>y;A¨>
Note that \ >y;A¨n> is not an endofunctor, as in the conventinal notion of monad, but
we can still think of splitting it in a monadic way. The consequent Kleisli category willthus interpret substitutions as functions from terms over one set of variables to terms
over another.
Before we can work with terms, we need some basic tools for working with variablesin the de Bruijn style.

7.2.1

,

and

de Bruijn’s insight was to see a variable not just as an indentifier, but as a reference to abinding. Variable indices count outwards through the W -bindings, 0 for the most local,
1 for the next and so on. For example,
W8XZY[W]\Y-X3\

becomes W,W_^a`

Every time we go under a binder, the new variable is 0 and the old ones get incremented. We may represent this distinction by the constructors of the b]c family.
Now, suppose we have a renaming—an arrow X8dfehgjilk . In order to apply such arenaming across a term, we must explain what to do with the expanded variable space
under a mAnpo —it must affect only the free variables embedded by q r , leaving the newly
bound qFs variable alone.
Xut,d]r evgjiNr k
Xwt
wX t

x qFsaezyx q r|\,y

{
{

q=sk
qrpxEXE\,yThis is a recognisable program.
Discharging over arbitrary k , e

and X , we obtain the functional mA}Aq ~ which takes any
such X to the appropriate Xut . I suppress the boring arguments when I apply it.
mA}Aq ~de kd YaXEd b]cemA}Aq ~aXmA}Aq ~aXxq=seyxqr|\,y{{b]ckaYbcJr e

qFskq rxEXE\,ymA}Aq~ gives us the arrow part of the functor194b]cr k}Aq~d]c8~ _ b]c( b]c_}Aq~z{ = r n = mA}Aq~rE = YYYr[ = YYYrE = YYY

There is a recursion induction principle for mA}Aq~ which we may regard as generated
automatically from its equational definition. mA}Aq ~ is not a recursive function, so it isperhaps more informative to call it an inversion principle mA}Aq ~+ c-¡ :e¢ k£d]X|de g i k¤d]b]cr e¥¦b]cr k§¤x qFsaezyx qFsky\­db]cJr eY¨©%ª,«¤¤\

x q r|\,yx q rpx%XE\,y¬ymA}Aq ~aXE\

The three functor properties left elliptic above follow easily by inversion. I shall showrE and leave the other two to your imagination.

® rEd¯° ±]%²daX
dE±gji­²´³
dE¯gjia± \db]cr ¯mA}Aq ~x%XµN³y-\¶·mA}Aq ~X mA}Aq~¸³z\Inverting the boxed mA}Aq ~ application, we acquire two subgoals® rEº¹d¯° ±]%²daX
d3±gjiN²´³
d3¯gji±\db]cJr ¯mA}Aq ~x%X[µ­³yx qFs¯y_¶»mA}Aq ~Xxq=s±[y® rE¦d¯° ±]%²daX
d3±gjiN²´³
d3¯g i ±\db]c¯mA}Aq ~x%X[µ­³yx q r|\,y_¶»mA}Aq ~aXfx q rpx ³\(y¬y195The two conclusions then reduce respectively to
qFs­²(¶·qFsl²
q rxEXx ³¼\,y3y_¶»q rpx%Xfx ³¼\,y¬yAs you can see, these are both reflexive.
We can use mA}Aq ~ to define an important class of renamings—the thinnings. These add
a new variable to the set, but not necessarily at the top.4 If there are k old variables,
there are r k choices for the new variable \ . ~ ½}Ac\ is the renaming which shuffles theold variables in around the new one, without changing their order.
The idea is, morally:~ ½}Ac\N¾¿{¾ , if ¾ÁÀÂ\¾ÄÃB^ , if ¾Å£\

Æ{ \ .
In particular, ~ ½}Ac\N¾vÇ

Now, if the new variable is qFsk , then thinning is just the q r embedding. Otherwise, it isa mA}Aq ~ ed thinning!
~ ½}AcÈdkd Yb]cJr kÉ

x7k£gjiÊr kyie~ ½}AcÈdkd Yb]cJr kÉ
b]ckË~ ½}Acx qFsky{q rEÌ~ ½}Acx q r|\,y{mA}Aq ~8x~ ½}Ac\,ybcJr kThinning provides us with an alternative view of bcpr k . Every variable is either the newone, \ , or an embedded old one, ~ ½}Ac\­¾ for some ¾§d°b]ck . We may imagine a partial
inverse to ~ ½}Ac which makes the distinction, with the following extensional behaviour:~ ½}AÍdkd Yb]c¼r k¥~ ½}AÍ~ ½}AÍ\\

x ~ ½}Ac\­¾,y\¶¶b]cr kËoÎnpÏ-ÐpÑx b]ckyÏfr|¾c£x b]cky~ ½}AÍ

is a refinement of the decidable equality for the finite sets—it not only tells us
whether two elements differ, but also in what way.
We can get some help writing ~ ½}AÍ if we try to prove the above pair of equational laws(for a common abstracted \ ) by recursion induction on ~ ½}Ac , as defined in the obvious
way. We thus seek:
4‘Thinning’ is a liquid metaphor.

196

®

~ ½}AÍd-k
d-\ ¾_db]cr koÂnÏÐÒx bcky®
~ ½}AÍ]Ó d, kd \db]c¼r kÔ~ ½}AÍ]Õd¾db]ck~ ½}AÍ\Lx ~ ½}Ac\~ ½}AÍ\N\Ä¶»cÑxb]cky¾(y¶·Ïfr|¾

The abstraction of \ outside both equations allows them to be transformed simultaneously. The induction yields subgoals:®

~ ½}AÍÖd+kd\ ¾db]c¼r koÂnÏÐÒx bcky®
~ ½}AÍ]Ó=¹×d|kdÔ~ ½}AÍ]Õd¾db]ck~ ½}AÍÄx qFsakyx q r|¾,y_¶·Ïfr|¾~ ½}AÍx qFskyx qFsky_¶»cÑxb]cky®
~ ½}AÍ]Ó7Ød|kd\db]c¼r k
Xdb]ck¥b]cr kÔÙ°¾°Úd ~ ½}AÍ°Õd-¾_db]ck~ ½}AÍa\Lx%X3¾,y_¶»Ïr|¾~ ½}AÍ\­\Ä¶·c£x b]ckyÔ~ ½}AÍ]Õd ¾ db]cr k~ ½}AÍÄx q r|\(ymA}Aq ~X¾¶»Ïfr|¾~ ½}AÍx q r|\,yx q r|\,y_¶»c£x bcr ky

We now know how to ~ ½}AÍ at qFsk . We can gain further information about the q r caseÔby inverting the mA}Aq~ . Allowing that we can do this inside the -binding by appropriate
algebraic manipulation, we obtain

197

®

~ ½}AÍ]Ó7Ø+d(-k-\X-Ù°¾°Údd bcr kdbck¥b]c¼r kÔd ~ ½}AÍ°Õd-¾_db]ck~ ½}AÍa\zxEXE¾,y_¶»Ïfr|¾~ ½}AÍ\N\Ä¶·cÑxb]ckyÔÔ~ ½}AÍÕd ~ ½}AÍØ ¹d~ ½}AÍÄx q r|\,yx qFsÊr ky¶·Ïfrpx qFsky¾db]ck~ ½}AÍxq r(\,yxq rxEXE¾,y¬y_¶·Ïfrxq r(¾,y~ ½}AÍxqr|\,yxqr|\,y_¶»c£x b]c¼r kyStripping away the excess notation, we have certainly found the base cases to ourfunction:~ ½}AÍ~ ½}AÍ~ ½}AÍYYYxqFsakyxqFsakyx q r|\,yxq=sk8yxq r(¾,yxq=sNr kyc£x b]ckyÏfr|¾
Ïfrpx qFsky{{{

We have also found out some useful information about the step case. It must satisfy:ÛÛ¾­db]ckaY~ ½}AÍa\zxEXE¾,y_¶»Ïfr|¾~ ½}AÍ\­\Ä¶·cÑxb]cky¾Nd b]ckaY~ ½}AÍx q r|\,yx q rpx%X3¾,y3y_¶»Ïfrpx q r|¾,y~ ½}AÍÄx q r|\,yx q r|\(y¶·c£x b]cr kyEffectively, each branch of the conclusion propagates the result of the corresponding
recursive call: Ïr stays Ïfr and c stays c 5 . That is, the recursive value is passed
on by the appropriate monadic lifting Ü Ýqr3Ì]FÜ . Hence the whole program is~ ½}AÍ~ ½}AÍ~ ½}AÍ~ ½}AÍxqFsakyxqFsakyx q r|\,yx q r|\,yxq=sk8yxq r(¾,yxq=sNr kyxq r(¾,y
{

{

{

{

c£x b]ckyÏfr|¾
Ïfrpx qFskyÜ q rEÌFÜx~ ½}AÍa\N¾,yBy construction, this satisfies the three base case equations and reduces the step case
to
Û
Û

5

¾Nd b]ckaY~ ½}AÍa\Lx%XE¾,y_¶»Ïfr|¾~ ½}AÍ\N\¶·c£x b]cky¾Nd b]ckaYÞÜ ßqr3Ì]FÜ8x ~ ½}AÍa\Lx%X3¾,y3y_¶»Ïfrpx q r|¾,yÜ q rEÌ=Ü8x ~ ½}AÍa\­\,y_¶»c£x b]c¼r kyMatthew 5:37

198

This holds by rewriting the conclusions with the hypotheses. The desired extensional
introduction rules have thus been satisfied. The corresponding non-computational inversion rule, ~ ½}AÍ( c-¡ , is the real prize:kÈd]\¢d]b]c¼r k¤d]b]cr k¥¤oÎnpÏÐÒxb]cky¢\zxcÑxb]cky¬y¾­d b]c¼r kaY¤¤¨©%ª,«

x ~ ½}Ac\­¾,yxÏr|¾,y¾~ ½}AÍ\­¾~ ½}AÍ( c¡

tells us that there are two possible outcomes from ~ ½}AÍ and under whatcircumstances they arise. Fixing ‘new variable’ \ , then any ¾ is either \ (in which case~ ½}AÍ returns c ) or an ‘old variable’ thinned (in which case ~ ½}AÍ identifies it). It isa very useful rule, because it effectively performs a constructor case analysis on the
output of the function. We will see just why this is so helpful later on.
Can you guess how we prove this rule? That’s right: by ~ ½}AÍ ’s recursion induction¤

principle, making sure to keep in the scheme, so that any inductive hypotheses arethemselves elimination rules. We start with®

~ ½}AÍ( c¡d k d
 \ db]cJr k¤db]cJr kËoÎnpÏÐÒxb]cky¢¤´à|á´d\Lx c£x b]cky3y´àâ_d-¾_db]ck¤x~ ½}Ac\N¾,yx Ïfr|¾,y¾ãdb]cJr k¤¾ ~ ½}AÍ\Ê¾¨©%ª,«

I have indicated by boxing how the recursion induction scheme is abstracted. We
acquire three base subgoals, corresponding to the base cases of the function, and theirconclusions all follow directly from àâ (off the diagonal) or àá (for \Î{ä¾å{vxq=sky ).
It is on the step subgoal where you should concentrate any remaining interest you canmuster.

199

®

~ ½}AÍ( c¡Ø Ø%d-kd-\_ ¾dbcJr k
-¾ t doÎnÏÐpÑx b]cky¤-Ù°¾°Ú_ddb]c¼r k¥oÎnpÏ-Ðp£x b]cky¨©%ª(«¤
_àá]d\LxcÒx bcky¬y_àæâ°d¾dbcJr k¤
x ~ ½}Ac\­¾,yxÏr|¾,y
¤
¾­¾ t
¤

dbcJr3r k¥oÂnÏÐÑxb]cJr k8y¢¨©%ª,«¤
_à|á·dx q r|\,yx c£x b]c¼r ky3y_àâ»d-¾_dbcr k¤
x ~ ½}AcÁx q r(\(y-¾,yx Ïfr|¾,y-¾dbcJr k¤x q r ¾ yx+Ü ßq rEÌ]=Ü ¾ t y

We are not yet in a position to use either à|á or àâ , because we do not yet know whichapplies. In the conclusion, the computation is blocked at the point where Ü q rEÌ=Ü isapplied to ¾ t , the result of the recursive call, not yet in constructor form. However,case analysis on the result of the recursive call is exactly the effect of the inductive
hypothesis. Eliminating with the indicated scheme, we obtain:®

~ ½}AÍ( c¡Ø Ø ç-d´à|á]d¤®

¤x q r|\,yx c£x b]cr ky3yx q r|\,yx+Ü q rEÌFÜx cÑxb]cky¬y3y~ ½}AÍ( c¡Ø Ø Õ-d´àâd¾db]cJr k¤
x ~ ½}AcÁx q r|\,y-¾,yx Ïfr|¾(yèédb]ck¤x q rpx ~ ½}Ac\Nèy3yx%Ü ßqr3Ì]FÜ8x Ïfr|èy3y

The lifted q r now reduces, propagating the two cases correctly. Both conclusions now
follow from the indicated hypotheses. The elimination rule holds.
In fact, the way the inductive step was proven shows us how this rule is useful in thewider setting. Applying this rule unblocks computations which are waiting to do caseanalysis on the result of a call to ~ ½}AÍ , and these are very common. For example, we
may define the following function:200

7ê8ë7êë

êwdkd ÄY\­db]c¼r kaY¸²d n oìkYfxr k§íîky \Lë

² w¾~ ½}AÍ\N¾c£x b]ckyÏfr|¾ t{²¡ np¾ t¸êu (pronounced ‘knockout’) generates a substitution (function from variables toterms) which removes \ , replacing it by a term ² over the ‘remaining variables’. A
source variable ¾ other than \ , ie a x ~ ½}AcÄ\­¾ t y , is mapped to the ¾ t given by removing\ from the variable set without reordering the others.
When proving properties of =êë êu , we will see it reduce to the case analysis on ~ ½}AÍ .
At this point, elimination by ~ ½}AÍ( c¡ has exactly the effect required to unblock thecomputation. We are interested in what comes out of ~ ½}AÍ , so the more conventionalelimination of what goes in is a clumsy way to proceed.
Now that we have the tools to work with variables, let us turn our attention to terms.

7.2.2 the substitution monad splits the renaming functor
We have already decided that the object part of the functor ï_cnoÈ is just the identity
on . It is also fairly clear that a renaming becomes a substitution just by composing¡´n on the back, ieÜ ×X_\j{ð¡¸np´x%X%\,yHence ¡´n is the identity for substitution.
The remaining programming consists of the arrow part of ï_cnoÈ and the êFÜ operation of ñ°ÐprE~%ò —the effect on terms.
It is fairly clear that we shall haveXFÜxH¡´n\,y¢{X%\(a monad law)XFÜxnÞópóz±² y¢{ãnÞópó»xX FÜf±yxX FÜ,² y..
.

It is not so clear how to push X under a binder. We need something like..
.
XFÜxmAnpoð² y¢{ômAnpoãxX tõßö ² yö

201

where X t is the lifting of X which takes the source bound variable to (a reference to) thetarget bound variable, and whose behaviour on the free variables respects that of X .
Now, we have already defined mA}Aq ~ to lift renamings. How do we lift substitutions? The
bound/free case analysis on the source variable is easy enough. We know what to dowith the bound variable, otherwise the case analysis also tells us which ‘old’ variable
X should be applied to. The latter yields a term over the old variables, which mustthen be renamed to the free variables in the target set. Now, we know that the variable
renaming is just q rEÌ , but we need this lifted to terms. That is, we need something likerEmA}Aq ~8X-x qFsaezy{v¡¸np_x qFsakyrEmA}Aq ~8X-x q r|\,y÷{Ü q rEÌFÜx%X%\(yHowever, it is êFÜ which we are trying to define, and applying it recursively to the resultof X is not structural.
One solution is to define the renaming [n operation in advance—we already know how
to lift renamings:
[nøXxF¡¸np\,y¢{ð¡¸np´x%X%\,y[nøXx nÞóóz±²Ýy¢{ônÞóó»x [nùXE±yxnøX[² y[nøXx mAno² y{ômAnoãx [núx mA}Aq ~X=y´² yOnce we have this, we can define rEmA}Aq ~ with [nzq rEÌ for Ü ßq rEÌFÜ , leaving us free to define êFÜin terms of it.
As Altenkirch and Reus point out, this involves writing two very similar functions
over terms, where one nonstructural function would do. Of course, the nonstructuralfunction saves three lines of code at the expense of a well-founded induction on anordering which they must exhibit and prove satisfactory. They suggest that, turning ablind eye to the proof obligations, the nonstructural function is preferable, expressing
the vague hope that the carpet under which they are sweeping the actual work will one
day become magic.
As it happens, no carpets are necessary, magic or otherwise. ê=Ü and [n can be implemented with a single structurally recursive function, provided it is made sufficiently
parametric. Suppose that for some type family û we have a function
X|db]ceûk

We can map this function across terms, provided we know
202



ü
ü

how to convert X output from ûýk to terms npoékü

how to represent variables in ûkhow to lift functions between b]c sets and û sets

We already know how to do these things when û is b]c , so we have renaming—we canthen build the three operations for use when û is W : . .
In fact, we will have an easier time proving the monadic behaviour of substitution if wetake this opportunity to generalise lifting from inserting new variables at q=s to insertingthem anywhere—~ ½}AÍ and ~ ½}Ac make this just as easy to implement. We only everuse ~ ½}AÍ on variables, so the ‘how to lift’ requirement becomes ‘how to thin’.
The goal is

Wû
d þ
¨©%ª,«Wÿ(ûdkd Yb]ck¥
ûk

W
û eÁdkd Y×ûýk¥
npoék
W² 
Ù ukûýdkd Y\Nd bcJr kY×ûýk¥®
oÂnÞódeÁ kadaXdb]ceûýk¸²d npoée

npoék

û¼r k

Subject to these parameters, we may first build lifting for û from the thinning parameter:mA}Aq ~deÁ kd Y\Nd b]c¼r eÁY+\ t d b]cr kaYaXEd b]ce\mA}Aq ~a\N\ t ¾V{~ ½}AÍ\N¾c£x b]ceyÏfr|¾ tûýkYb]c¼r e



ûºr k

ÿ(û\ t²Ù  kû\ t x%X3¾ t yis the ‘new’ source variable and \ t is the corresponding target variable. The liftedfunction uses ~ ½}AÍ to distinguish new from old, and either embeds \ t via ÿ(² or thins
the result of X with ² Ù kû .
The oÂnÞó function may now be writtenoÎnÞóøX-xF¡¸np\,y¢{¦û e¥xEX%\(yoÎnÞóøX-x nÞóóz±²Ýy¢{ônÞóó»x oÎnÞóùXE±yxoÂnÞóøX[² yoÎnÞóøX-x mAnoð² y{ômAnoãx oÎnÞóúx mA}Aq ~xq=seLyx qFskyXFy´² y203

Once the parameters are discharged, we may take:[nî{ãoÎnÞóÎb]c i ¡¸np~ ½}Ac
~ ½}Ac Ì¸\¿{ã[núx ~ ½}Ac\,yê=Ü{ôoÂnÞóno ¡¸np  ~ ½}AcNote that the notion of lifting used in renamingmA}Aq ~Êb]ci_¡¸np-~ ½}Ac§xqFsezyax qFsakyis extensionally the same as the mA}Aq~ function we defined earlier. This follows easily byinverting the ~ ½}AÍ contained in mA}Aq ~ . It therefore inherits all the same functor properties
via r3npoÈc~  .
Our task is now to plug these into the relevant functor and monad. I am afraid to saythat a little forward planning at this point will pay dividends later. I will motivate it
as best I can. Both c8~  and òzcn require the extensional equality of arrows
to be respected: conditions which will apply to both [n and ê=Ü . Since these are both
implemented by oÎnÞó , it is worth proving this property for oÎnÞó while the parameters
are still abstracted. The goal is®

oÂnÞóldeÁ kad
aX %³VdbceûkÙ°¾°Úd\db]ce
XE\¶ø³º\d no e \oÂnÞóùX3\¶oÂnÞóå³z\

You will, I hope, be unsurprised to learn that the technique I recommend is recursion
induction on oÂnÞó . Either oÎnÞó will do—I have chosen the second. Three subgoals,
one at a time:®

oÂnÞóde¢ kad
aXZ+³ädb]ceûkÙ°¾°Ú÷d\dbceX%\¶ù³¼\\db]ceû e¥xEXE\,y_¶øû e¥x ³¼\,y204

Rewrite by Ù°¾°Ú . Next YYY®

oÂnÞód-e¢ kdXZ+³vdb]ceûýk-Ù°¾°Úúd\db]ceX%\Ä¶ø³\
-±%² d npoée-± t %² t d npoék
-±EÙ°¾°Ú´daX
db]ceûýkÙ°¾°Úd\db]ceX%\Ä¶ø³\oÎnÞó X3±p¶å± t´²7Ù°¾°Úad
nÞóó»x oÎnÞóøX%±[yxoÎnÞó

X×²Ýy_¶·nÞóóz± t ² t

If we plug Ù°¾°Ú into ±EÙ°¾°Ú , we can turn x oÎnÞóùXE±[y into ± t . The same thing happens with

we shall encounterx oÎnÞó X-² y . In fact, all the inductive proofs (implicitly) on noin this thesis have an nÞópó case whose proof is ‘rewrite by the inductive hypotheses’.
From now on, I shall omit them.
Of course, the real interest is in the mAnpo

®

case:

oÂnÞóde kNdaXZ+³édb]ceûýkÙ°¾°ÚÈd\db]ceX%\Ä¶ø³¼\
¸²
d npovr e¸² t
d npovr k¸²7Ù°¾°ÚdaX
db]c¼r eû¼r kÙ°¾°Úd\dbcJr e
X%\Ä¶·mA}Aq ~Äxq=seyx qFsky_³¼\
oÎnÞóùX[²(¶ú² t
mAnoôx oÎnÞó»x mA}Aq ~ xqFseyx qFsakyXFy´² y¶·mAno²t

Now, equation respects function application, so we may strip off those W s. The conclusion is nowoÎnÞó»x mA}Aq ~Äx qFsakyxq=seyXFy´²(¶ú² t

and this is ripe for the inductive hypothesis, leaving us with205®

Ù°¾°Ú t d\dbcr emA}Aq ~ xqFseyx qFsakyX3\¶»mA}Aq ~xqFseyx qFsaky_³¼\

Expanding mA}Aq ~ , we find this is really®

Ù°¾°Ú t d\dbcr e~ ½}AÍÄxqFsey-\c£x b]ceyÏfr(¾ÿ(ûx qFsky²7Ù ukûÁxqFskyx%X%¾(y{~ ½}AÍx qFseLy-\cÒxb]ceLyÏfr¾

ÿ(ûÁx qFsaky²Ù ukûx qFskyx ³º¾,yThe computation is blocked by the two ~ ½}AÍ applications, but we know how to invert
them. Indeed, since they have the same arguments, we may invert them simultaneously.
Of course, in this instance, a case analysis on \ would have the same effect, but that is
only because we are thickening at x qFs|ky , and we know how ~ ½}AÍ is implemented—wewant the effect of inversion, so we do inversion. We are left with two cases:®®±ç-d3ÿ(û (qFsk ) ¶åÿ(û (qFsk )± Õ-d¾db]ck² Ù kû§x qFsakyxEXE¾,y_¶ø² Ù kûÁxq=sk8yx ³¼¾,y

The first is reflexive; the second becomes so after rewriting with Ù°¾°Ú . We have provenoÂnÞó and may now discharge the parameters.
Let us prove that renaming is functorial—we have already supplied  and [n . Itremains to prove the properties. r3 is just a special case of oÂnÞó .
The r[ property gives us the goal

® r[Ad-ed´²¼d noée[n i ²|¶ø²Here, at last, my devotion to recursion induction comes unstuck. The trouble istwofold:ü

The scheme for oÎnÞó recursion induction is abstracted over different source andtarget objects and here they are unified. The elimination tactic will supply aconstraint to resolve this, but it is a little clumsy.
206üThe scheme is abstracted over an arbitrary renaming, but we are concerned witha very particular one. Again the tactic will give us a constraint—that the function
is intensionally equal to i . We will only have extensional equality, so the proof
will not go through.

There is still much work to do to come to an understanding of the correct manipulationof constraints for this kind of inductive proof. In the meantime, let us do structural
induction on ² ! The ¡¸np and nÞóó cases are easy.6 Here is mAnpo :® r[  d-e
´²

d
d



npo

´² Ù°¾°Ú_d[n  i 

r e
²(¶ú²

mAnpoãx [núx mA}Aq ~ÊYYY×xqFsaeyxq=seLy i y´² y_¶»mAnoð²

We may introduce the hypotheses and strip off the mAno s. This leaves us with YYYE¶B² .
The inductive hypothesis looks a bit like that, so let us try transitivity (or rewriting
backwards).
® r[ t d[nøxmA}Aq ~NYYYx qFseLyx qFsezy i y´²|¶»[n  i  ²

Now we get a bonus for proving oÎnÞó in advance. The goal asks us to show that
two renamings do the same thing to a term ² . If we apply oÎnÞóp- , it is enough to showthat they agree at every variable:®

±ed\db]c¼r emA}Aq ~NYYY[x qFsaezyx qFsaey i \¶  i  \But mA}Aq ~NYYY×x qFseLyx qFsaezy has the same functor properties as mA}Aq ~ , including preservationof identity—exactly the goal here.
Next, r3 :® rEd¸² ¯° ±daX
dE±gji­²´³
dE¯g i ± \d no ¯[núx%X[µ i ³y\Ä¶»[nùX [n£³L\6

Trust me, I’m doing the proof as I write this.

207

Recursion induction is once more our friend. Eliminating the boxed application, we
again find easy ¡¸np and nÞópó cases. The mAnpo case is very similar to that in the previous
proof:® rE d¸²¬ ¯° ±]d
aX
´³
\
\ t
Ù°¾°ÚdE±gjil²dE¯gji±d no r ¯d no r ±d¸²daXdr ±g i ²
[n»xEXµ]ilxmA}Aq ~NYYYE³y¬y-\¶»[nøX%\ t
mAnpoôxn»xmA}Aq ~ NYYYx%Xµ]i³y3y-\,y_¶·mAnohx[n»x mA}Aq ~NYYYX=y-\ t yOnce again, strip the mAnpo s, apply transitivity with the inductive hypothesis on the right,
and then oÂnÞó , leaving:® rE d\db]cr ¯mA}Aq ~N
 YYY×x%Xµ i ³y-\¶»mA}Aq ~ÊYYYXfx mA}Aq ~NYYY%³¼\,yQuelle surprise! The property that the lifting functor preserves composition! Renaming
is a functor!
Now let us turn to showing that substitution is monadic. We have already supplied Ü ê(composition with ¡´n ) and ê=Ü . Since the representation of í is functional, we interpret these arrows by application. We may also supply directly the Kleisli demandedby òcnp :X! ³¼\¿{

XFÜx ³#"%$,yòcn  reduces to reflexivity and òzcnp

is true by construction. Zc~  follows because ¡´n respects equality whilst &(npÍ°- is an instance of oÎnÞóp- . Zc~ is reflexive. Only ñ°ópmA}A~ and &,nÍ° require any real work.
ñ°ópmA}A~ says®

ñ°ópmA}A~Ed+eÁ kad
aX
d3evgjiak ²d noìe
Ü ×X=Ü,²|¶[nùX_²

208

We can prove this with exactly the same plan as before. Recursion induction leaves
easy ¡¸np and nÞóó cases. The mAno case reduces by the same strategy as before to®

ñ°ópmA}A~' d\db]cJr emA}Aq ~ ÊYYY¬~ ½}Acx qFsezyxqFskyx+Ü [X y-\Ä¶§¡´nxmA}Aq~(NYYY~ ½}Ac§xq=seLyx qFskyX%\,yThat is, composing ¡¸np and lifting must commute. Both mA}Aq~( s, on expansion, areblocked at x~ ½}AÍx qFsezy-\(y . Inverting ~ ½}AÍ leaves two trivial subgoals.

&,nÍ° starts the same way:®

&,nÍ°÷d¯° ±]%²¬d
aX
´³

d3±lí
²
d3¯líÖ±d no ¯

 \xEX! ³y=Ü\¶¦X=Ü

But after the usual story, the mAno®

³­=Üf\case is reduced to&,nÍ°  d\db]cr ¯mA}Aq ~N
 YYYx%X) ³y-\¶·mA}Aq ~ÊYYYXfx mA}Aq ~NYYY%³¼\,yThis says that lifting for substitutions must respect composition—we only know thisresult for renamings. We can boil the goal down a little further by expanding the outermA}Aq~( s and inverting their blocked ~ ½}AÍ s. This give us two cases: one for the newly
bound variable, just a reflexive equation, indicating that it is correctly propagated bylifting; the other, for the free variables, is still awkward.

®

&,nÍ°  d\db]c ¯~ ½}Acx qFsl² yxX=Ü8x ³¼\,y¬y_¶hx mA}Aq ~ÊYYYpX=yFÜ8x~ ½}Acxq=s±[yx ³¼\,y¬yThis is a special case of the last lemma we need to prove—a crucial fact about therelationship between thinning and substitution:

209

®

~ ½}Acñ°ÐrE~deÁ kad\dbcr e\ tdbcr k
aX
d3e¥íÖk
d noìe
 ²
~ ½}Ac \ t X=Ü,²¶hx mA}Aq ~ÊYYYæ\N\ t X7y=Üx ~ ½}Ac



\Ä² y

That is, substituting then thinning has the same effect as thining first, then applying thelifted substitution.
There is no point inventing a new proof plan when an old one will do. ¡¸np and nÞópó
are easy as before. Modulo the need to switch between a mA}Aq ~ ed ~ ½}Ac and a mA}Aq ~ ed ~ ½}Ac(ie another ~ ½}Ac ), we can again reduce the mAnpo case to an equation involving blockedmA}Aq~( s which we simplify by inversion, leaving us with the free variable case:®

~ ½}Acñ°ÐrE~  d¾db]ce~ ½}Acx q r|\ t yx ~ ½}Acx qFskyx%X3¾,y3y_¶»~ ½}Acx qFsNr kyx ~ ½}Ac \ t x%XE¾,y¬yNow ~ ½}Ac®

is just renaming via ~ ½}Ac , so what we really have is~ ½}Acñ°ÐrE~  d¾db]ce
[núx mA}Aq ~x ~ ½}Ac\ t y¬yx [n»x q rEÌyxEX%¾,y3y_¶·[núx q r  Ìyax [n»x~ ½}Ac\ t yx%X%¾,y¬y

We may rewrite both sides by the property that renaming preserves composition (backwards):®

~ ½}Acñ°ÐrE~  d¾db]ce
[núx3xmA}Aq ~x ~ ½}Ac\ t y3y_µ]iq rEÌyx%X%¾(y¶·[núx q r  Ìaµ]ilx~ ½}Ac\ t y3yx%XE¾(yBut all the mA}Aq ~ does is shuffle qr through x~ ½}Ac\ t y . The two sides of the equation areintensionally the same. We have proven that substitution is monadic.

7.3 a correct first-order unification algorithm
This is the main example of dependently typed functional programming in this thesis.
210

I propose to study unification for ‘trees with holes’. The algorithm is a variation on thetheme which goes back to Alan Robinson [Rob65]. It is the program implementing thealgorithm which is new, and which benefits from the dependent type system in a way
which is just not available in the simply typed world, even with the remarkable higherorder polymorphic extensions which are becoming available in the more upmarket sorts
of programming language. Here we shall make critical use of the fact that our types
depend on data—real data with elimination as well as introduction rules.


Just as with npo , let us represent variables via b]c , but since trees have no binding, we
may fix the number of variables as a parameter of the type.
ü

formation rulekÈd]~ ºk£d¨©%ª(«ü

constructors\ d]b]ck¢¡´n\¢d]~ ºkümAnpq Ì d~ ºk± %²8d]~ ¼k°
qZÍp±²d~ ºkelimination rulekÈd]¤d]~ ºk¥¨©%ª,«¤¤¤xF¡¸np\,ymAnpq Ì²d]~ ºk

Y

¤

¤
±
²
YYYYYYYYYYYY¤
xqZÍp±² y²

We may construct the renaming functor and substitution monad for ~  followingmuch the same path as for no , but without the work required to cope with binding.
For this section, let us have
evg+*-k¥{-,
e¥í

k¥{.,

~ ¼e
b]ce





~ ºk~ ºk

ï_cnpoÈ»d]c8~ _Abc_(A~ 8
ñ°ÐprE~+òvd|òzcn§ï_cnpoÈ
ñ°ÐprE~0/{í

/-mA}ArEmA}+ñ°ÐprE~%ò

Within this framework, we may equip substitutions with the preorder induced by priorcomposition:211

X! ³21ô³

The task of unifying some ±°%²pd~ ethat
XFÜ-±Ñ{is to find (an k and) an arrow X_deðíôk suchX FÜ,²

if any exists, and in particular, to find one which is maximal with respect to the above
ordering.
Unification is thus an optimisation problem, and it is worth spending a little time thinking about such problems in general, before proceeding with this particular example.

7.3.1 optimistic optimisation
Unification is just one example of a problem involving optimisation with respect to a
conjunction of constraints. I should like to draw your attention to a particular class ofconstraint which makes such problems vulnerable to a reassuringly naı̈ve technique—optimism.
That is, we begin by guessing that the optimum is the best thing we can think of. Then,as we encounter each constraint in turn, we continue to think the best that it allows,
reducing our current guess by only so much as is necessary. Once we have worked ourway through all the constraints, it is to be hoped that our final guess, however batteredby bitter experience, is genuinely optimal.
This hope holds true if each constraint has the property that once a solution has beenfound, anything smaller remains a solution. Let us call such constraints downwardclosed, or closed for short. This property of constraints gives the underlying rationale
to the transformation of recursive optimisation algorithms which relativises them toan accumulating solution—a technique which has already found its way into the automated synthesis of (parts of) a unification algorithm in [ASG99].
We can give a record type characterising such properties for arrows ordered by composition. Fixing a category and a source object 3 , we may represent a closed constraint
on 3 out-arrows as inhabitants of the record type ºmArE453 with fields:

6½,Ï´d ¸ûaY°x73¢gûy÷¨©%ª,«
ºmArE4p- d ¸ûaY+aX+³ºd'3÷gûY-X98V³v
6
ºmArEÞd ¸ûaY+´³d'3÷gûY½¸Ï³ð

212

6½ ÏLX ¸
.:YaXEd ûÂg

6

½ Ï³
¸
6
:¼Y ½,ÏLXµN³

Note the extra condition that the constraint must not distinguish extensionally equal
arrows. This is the price of allowing functional representations of arrows in intensional
type theory.
We may further define what it means to be maximal with respect to such a constraint.
Fixing and opening a ºmArE4;3 record, and also fixing a target û and an arrow X|d<3¢gû , we may collect the relevant conditions in a record òzn=}AoÂnmX with fields:>6

 m?pr×d ½¸ÏLX[np8~ r×d .:Y´³¼d'3¢g

:Y

6

½,Ï³



ÔA@

dfûÈg

:ºY³8@µX

That is, X must be a solution, and every other solution ³ must be smaller than X , with a@@µ(X . We may easily prove that maximality respects extensional
witness such that ³B8
equality of arrows.
Next, let us define an operator which conjoins closed constraints.

C

EDjd.3´YGFNIHådºmArE453_YºmArE453
6
ED  6 ½,ÏL{BFKJ3ºmArE4p-»{LFMNJ3ºmArEÈ{LFOQP »{SHTM N 3J ºmArE£{UHOQP
6 ½,ÏL{HR3J ºmArE4{þ½,ÏL{ W(ûY[WXZYfxV·F X7yXl
W xY¿
H XFyZJ YYY%C

The proofs of the properties are unremarkable.
The optimistic strategy at each constraint F extends an accumulated guess ³ by enough6of an X that FNY ½,ÏåXæµ³ holds. We may regard this as effectively constraining thewitnesses X to the existence of solutions to F bounded by ³ . The constraint on X is
closed provided F is. Let us therefore construct an operator&,c[ d.3_%û8Y´³¼d\3¢g ûYºmArE453V ¼mAr34Âû
6&,c[å³£ 6 ½,Ï{LFKJ3ºmArE4p-»{LFMNJ3ºmArEÈ{]FOQP{þ½,Ï{äWº: Y[WX%d ûåg º: Y»F Xµ­³^J YYYE
Again, the properties are easily proven.
We are now ready to prove the optimist’s lemma:®`_ó~ }AoÈ}ArE~3dGaI3´%ûËd)b
 PcFÊ PH¼dºmArE4da´³
d aäg 3
G e<f\ d°òzn =}AoÎnpmgFÎ³aX)d 3÷g û) hifj\ d°òzn =}AoÎnpm]x &(c[å³;FpyXCòzn =}AoÎnm°x EDkFlHyx%XµN³y213

This is the key step in the correctness proof for the optimistic strategy. It tells us that aCconjunction x EDmFRHÄy may be optimised by extending the optimum ³ for F with justenough X to satisfy H . The proof is not very difficult, which is one of the reasons why
I like it.
First, let us unpack the definitions by the elimination rules for the argument records
and introduce the hypotheses:

WnaI3´Eû
WnF

WnFM N

WnFOQP
WH

WHM NWHOQP
W|³d)bd YYY]d]YYYd]YYYd]YYYd]YYYd]YYYdag

3

Wne<opqPsr°±dF§³
Wne<t (² p¯E±d(-: d)b
 u da gv
9F[wdFluÔ @A)d 3÷g

ux8

@

:
:
µÊ³

)d 3÷g û
WZhie<op<Pcr°±Vd)H¿X[µ­³WZhie<t (² p¯E±°d( :
dyb
 u
v
yd 3¢g : HKw`e_y
d HzuNµ­³
Ô @
A
d[ûåg
:
@
x
u
8
µX
C
®
e \

d°òz
n =}AoÂnm°x EDkFlHyx%Xµ­³yWX

We may also attack the goal with the introduction rules for records and implications:®

Fh'edF»XµN³
H4hi´
e dyj
H XµN³
W:
dyb
W u
da g
:
WnFä
w dFkuWHK¢
w dyHzu
® @
d[ûåg
®
@:
wqM 
N dXuT8µxEXµ­³y®

214Now, HéXµý³ is already known to hold, and F Xµý³ follows by FOQP from e<oTpqPcr°± , so
we have certainly found a solution to the composite problem. It remains to show the
optimality by expressing the hypothetical solution u as some ÙÄµXµN³ .
The proof successively exploits the optimality of the solution to each subproblem.
@Firstly, we use e<t ²Vp¯E± to acquire for some t(dq3¢g :u{8îÙ t µN³


By HTM N , we now know that HÈÙ t µN³ , hence hie<t ²Vp¯E± gives us an ÙÁdfûåg

@t8: withÙµX

We supply this@as the witness, for we haveu{8îÙ t µN³|8

x=ÙµXFy_µ­³|8ÙÄµx%XµN³y

as required.
Note that the proof does not make use of HOQP . In effect, we can optimise with respect
to a collection of constraints all but one of which are downward-closed, as long as we
address the non-closed constraint last—it is not a freedom we shall need.

_The óp~ }Aoå}ArE~ lemma allows us to solve a complex closed constraint by recursively
decomposing it into an equivalent conjuction of simpler closed constraints, each ofwhich we address in turn, accumulating the solution. Accordingly, we shall need abook equivalence on closed constraints} ¡£d.3_YºmArE453V

6

6

ºmArE453V¨©%ª,«

} ¡Î½,ÏL{]FAJYYYEJ
½ ÏL{HRJYYY%,{£¸ûYaX%d\3¢gûaYx}F»X 
H¿XFyW­x7H¿X 

F·X=ytogether with a proof } ¡pòn= that for equivalent constraints an arrow maximising
one also maximises the other—this is easy.
Lots of algorithms follow the optimistic strategy, from finding the largest element of anonempty list of numbers to principal type inference for ML. Let us see how it works
for unification.

215

7.3.2 optimistic unification
A unifier for ±°%²8d]~ ae

is a substitution X|de¥íÖk subject to the constraint X7Ü ±-¶éX FÜß² .
We may thus consider the computation of most general unifiers to be an optimisation
problem over the Kleisli category ñ°ÐprE~I/ induced by the substitution monad. Fortunately for us, the constraint is downward-closed. We may construct~~c}Ab]r±²d]¼mAr34zec}Ab]r±²L{

6XFÜ²JYYY%½¸Ï{þW°kaY[WX Y­X=Ü±¶

The two properties are easily proven. Extensional equality of arrows in ñ°Ðpr3~0/ means
exactly that they have the same effect on terms. Downwards closure follows from thefact that the interpretation of arrows in the Kleisli category—substitution—respects
composition.
It is easy to provide the justification for the structural decomposition of rigid-rigid
problems:~

C c}Ab]r~ x q Íp±n¸²3yxqZ~ Í±)²Y+y3yx EDþx c}Abr±n ±)+ yx c}Ab]r²´
 ²Yy3y} ¡x

We may represent out-arrows from eq  oée{.,Ôk£d] Y3e¥íby a dependent pairk

We might well guess that the type of the unification algorithm should beoj£deY±°%²d~ ºeÁYoÎnÏÐpÑx q  oéeLy

The adoption of the optimist strategy means defining oj in terms of a subfunctionÐpoj computing unifiers which are most general relative to an accumulated bound.
ÐpoÈdeÁY±°E²d ~ ºeYq  oéeoÎnÏÐpÑx q  oéeLy

The identity substitution is the biggest substitution in the composition ordering, so we
take
oj

 ±²L{ôÐoj±²7e J216

Note that for any given ± and ² this function is an arrow in the Kleisli category of
the oÎnpÏÐ monad—we already know how to propagate unification failures correctly.
This suggests a functional definition of Ðoj , with the rigid-rigid cases given by:Ðpo
Ðp
o 
Ðp
o 
Ðp
o 

..
.

mAnpq mAnpq xqZÍ±p²
xqZÍpn± ¸i² 3yAm npq xqZÍ±² ymAnpq xqZÍp)± Y² y{WXZYÏfrÞXWXZYcÒxqZoéezy
WXZYcÒxqZoéezyxÐpo L² ´7² +.
y x ÐojÄ±-±)+y{{{

So far, this is structural on terms. The trouble comes once we encounter a variable.
How do we unify a variable with a tree, relative to a nontrivial bounding guess ³ ?
The traditional approach is to unload the accumulator ³ , and we may easily prove the~lemma cmAn} ¡x&,c[å³£x~c}Abr±p² y3yx~c}Ab]r³N=Ü±³N=ÜÝ²Ýy

Unfortunately, applying the substitution blows up the terms, so the corresponding recursive program is not structural. This is where you might think we need to impose
an external termination ordering or accessibility argument which exploits the fact that,
although the substitutions blow up the terms, they do get rid of variables. In fact, thisis not the case.

7.3.3 dependent types to the rescue
Incidentally, I have just noticed that Augustsson and Carlsson’s paper [AC99] also
contains a section with this title—I expect it to become traditional.
Now, we certainly need to exploit the property that the accumulated substitution gets
rid of variables as it blows up terms. Every development of unification in the literature7
does this externally to the program, by means of a more or less ad hoc termination
ordering. This invariably requires an auxiliary function to count the distinct variables
in a term and an auxiliary lemma which relates the value of this function before andafter a substitution subject to the occur check.
That is to say, a vital component of the sense made by the unification algorithm has
been absent from every one of its implementations until now—understandably, because
the data structures which manifest that sense have not been available until now. The
7

or at least those which care about termination

217

point is that by explaining terms as built over a finite context of variables, we haveequipped them with exactly the natural recursive behaviour which we need. To countthe number of variables in a term is to make a posterior phenomenon of what is, atleast to structural linguists [Sau16], a prior requirement for the terms to be consideredmeaningful. The number of variables has finally arrived where it belongs—in the typeof terms.
Look again at the type of Ðpo :ÐpoÈdeÁY±°E²d ~ ºeYq  oéeoÎnÏÐpÑx q  oéeLy

This entitles us to proceed not only by structural recursion on trees, but also by structural recursion on e . I cannot stress too strongly that it is the indexing of types withterms which allows this. Parametric polymorphism is not enough, because we cannot
compute on types. There are structural forms of computation available in our dependently typed setting which just cannot be found in simply typed languages.
The recursive structure I therefore suggest is lexicographic, first on e and then on ± . If
we are unifying trees over r e variables, we are entitled to make recursive calls for any
trees over e variables, however large.
Of course, the number of variables must not merely be decreasing—it must do soin a structural way, one at a time if we are to avoid further appeals to well-foundedrecursion. We have already seen how to define a substitution which gets rid of a single
variable via the =ê-ë êu function. Here it is again:7êë
 \Lë

7êë

êwdkd ÄY\­db]c¼r kaY¸²d ~ ¼kYfxr kÎíÖky
² w¾

{

~ ½}AÍ\N¾c£x b]ckyÏfr|¾ t²¡ np¾ t¸

êw can easily be shown to have extensional behaviour (or, thinking relationally,

introduction rules): \Lë

² w\Ä¶ú²

 \Lë

² Ýx~ ½}Ac\N¾,y_¶Î¡´n¾

These follow directly from the established extensional behaviour of ~ ½}AÍ . The corresponding inversion rule, Í°cÍ°~+ c-¡ , follows from ~ ½}AÍ( c¡ :218

Í°cÍ°~+ c-¡
evd]\¢d]b]c¼r e²d~ ºe¤d]b]cr e
¤

\Ä²



~ ¼e¤¤¨©%ª,«

x ~ ½}Ac\N¾,yxF¡¸np¾,y¾L \zë² w¾

If our accumulator is a composition of 7êë êw s, we may apply it one step at a time
whenever we reach a variable. In fact, this is not merely a structural way to do unification, but also quite an efficient one. Of course, we must constrain the accumulator totake this form, and the easiest way to do this means abandoning our functional representation of substitution in favour of a more concrete ‘association list’ treatment.
Let us then define the following datatypeü

formation ruleü

constructorse k£dnmA}ArE~°eùk£d]¨©%ª(«\¢d]b]cJr e²d~ ºe³údnpmA}ArE~feøknpcr(\²|³údnpmA}ArE~|r eùknpc}AmAÌ d]nmA}ArE~fkkThis datatype is a combination of a conventional association list and the Å relation.
It is definable in ALF, C OQ and O LEG, but not in Agda or Cayenne because of its
nonlinear base constructor type.
We may equip it with
üa composition which behaves like append for association lists and transitivity forÅXXnpc}AmXXÊx n8cr,\²|³y
ü

{
{

X
n8cr|\Ä²x%X³yan interpretation via =êëêu into ñ°ÐrE~0/n c}Am9px n8cr(\²XFyxEX ly \ë
{

{

²

Correspondingly, we may manufacture a concrete category
with
219

C

}Ar3~Jd8ºc8~ ånpmA}ArE~

= nc}Amµ =  e  = ~ ºe w³8  = ³ÄFÜCº

There is trivially a functor from }ArE~ to ñ°ÐrE~0/ which does  to arrows, because theinterpretations of arrows in source and target are the same.

Cº}ArE~ that I propose we search for unifiers, although we
It is amongst the arrows ofshould still show that any most general X computed yields a most general X  in ñ°ÐrE~0/ .
Correspondingly, let us takeq  oée{.,Ôk£d] YnmA}ArE~feøk

and defineÐpoÈdeÁY±°E²d ~ ºeYq  oéeoÎnÏÐpÑx q  oéeLyoj£deY±°%²d~ ºeÁYoÎnÏÐpÑx q  oéeLyoj±²L{ãÐoj±²ænpc}AmWe now have all we need to outline a structurally recursive defininition of Ðoj ,deferring the treatment of the base cases:220Ðpo 
mAnq 
mAnq Xh{Ðpo  mAnq 
x q Íp±² y
Xh{


Ðp
o 
x q Íp±² ymAnqXh{Ðpo  x q  Í±n´²¬yx q  Í±!²7+yXh{
x W8XZYÐoj  ²´²7ÞXFyFÜ8xÐpo  ±±`ÊXFyÐpo  xF¡¸np\,yXn c}Amnpcr(èa¯p³

Ðpo  xF¡¸np\,yXn c}Amnpcr(èa¯p³

xF¡¸np¾,yÏfrÞX
cÒxqZoéezycÒxqZoéezyXh{Ïfrpx mA4=mA4=\­¾,yÜ x
 =~ [c zè¯[yFÜxÐpo    èÄëî¯ 7Ü+xF¡¸np\,yz èÄëmAnpq  ¯ÝFÜxF¡¸np¾,y_³yXh{mA4=ï_}?}?\mAnq  Ü x
 =~ [c zè¯[yFÜxÐpo    èÄëî¯ 7Ü+xF¡¸np\,yz èÄë¯ÝFÜÝmAnpq   ³yÐpo  xF¡¸np\,yx q Íp±² yXh{Xnc}AmmA4=ï_}?}?\zxqZÍp±²Ýy
npcr(èa¯p³
Ü x=~ c[zè¯[yFÜxÐpo    èÄëî¯ 7Ü+xF¡¸np\,yz èÄë..
.

¯ÝFÜx q  Í±² y_³yand the symmetric cases YYY

where
=~ c[Lè¯Á kQJ+³Á{ kJ3n8cr|è¯p³

and Ü 9=~ c[zèa¯FÜ is its failure-propagating image.

7.3.4 correctness ofIn the spirit of refinement, let us now reduce correctness of the unification algorithm tocorrectness of mA4=mA4= and mA4=ï_}?}? . We have not yet defined the latter, but we canmotivate the definition by seeing where we get stuck.
Here is the specification of oj in the form of an inversion principle o c¡ :221o c¡
evd]±%²d]~ ºe¤d]oÂnÏÐÒx q ZoìeLy~c}Ab][±²YYYYYYYYYYYYYYYYYY¤
x c£x q  oéeLy3y¤¨©%ª(«

X d]npmA}ArE~°eùk~òzn=}AoÎnpm]x c}Ab]r±² yxEX  yYYYYYYYYYYYYYYYYYYYYYYYYYYYY¤xÏfrz Q
k JX=3yx o±² y

where


~

c}Ab][±²L{-,

kYaXEdZeËíÖkaY­X FÜ±V¶ Æ

X7Üß²

We can prove o c¡ from an inversion principle Ðoj c-¡ for Ðpo :Ðojp c-¡evd]±%²d]~ ºe¤d]qZoéeoÎnÏÐpÑx q  oéezy¨©%ª,«

X|dnmA}ArE~feøk³»d]nmA}ArE~fkk t~òzn =}AoÎnm°x&,c[»x%X  yax c}Ab]r±² y3yx ³ly
YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY¤
7k JXFxÏfr k t J+³ °X7¬y¤aXEd q  oéeÁY
X-xÐpo ±p²XFy³ d]nmA}ArE~°eùkú~lc}Ab ³7Ü ±Á³FÜß²
YYYYYYYYYYYYYYYYYYYYYYYYYY¤k JXFxcÑxqZoéey3y

The proof simply expands oj in terms of a call to Ðoj which is then inverted.
This leaves Ðojp c-¡ subgoals with ³ instantiated to nc}Am . Recall that nc}Am is justCº
. The properties of }ArE~ and ñ°ÐrE~0/ then reduce these subgoals to those of oj c-¡ .
The interesting work is proving Ðpo c-¡ . Of course, like all our other proofs of
non-computational rules by recursion induction, the proof is by recursion induction on¤Ðpoj keeping
universally quantified. In the subgoals involving variables, let us
also follow the program and do case analysis on the accumulated substitution. We mayclassify the subgoals as follows
ürigid-rigid off-diagonal (also known as ‘conflict’)222

Here we are trying to unify mAnpq with qZÍÊ±Ê² . Ðoj returns c , so we must
apply the c case. This leaves us proving®

Pcghitp¯wæd-kdd npmA}ArE~feøk-I`rd°³ 7Ü mAnq|¶
_³³=Ü+x q  Í±p² yFortunately, reducing êFÜ pushes the substitution under the constructors, leaving
us with a hypothesis

!rÁd]mAnq|¶»q  Í£³7Ü±³7Üß²

ü

The goal can thus be proven by the unification tactic from chapter 5.
rigid-rigid on-diagonal (also known as ‘injectivity’)
Correctness for mAnpq with mAnq is very easy.
As for xqZÍ±n_²i¬y and x q  Í±)²\+y , the computation reduces the goal conclusion
to¤

Xfx+x WXYÐoj ² ´²7X=yFÜx Ðpo  ±n±)ÊXFy¬y

If my propaganda has worked, you should now expect me to use the inductive
hypotheses to invert the recursive calls. I shall not disappoint you. This leaves
us with four subgoals.
In three of them, the unification has failed somewhere and the ultimate value is~c —the inversion will give us a proof of c}Ab]f±Ó(²Ó for some  . We may
use this to show that the original q Í s have no unifier.
Otherwise, we have substitutions@

and ³ , together with proofs of~We<f\d°òzn=}AoÂnm°x&,c[»x%X yax c}Ab]r±X±!+y3yx ³ y~@W]<Ù f\d°òzn =}AoÂnm°x &,[c »x3x ³ °X7ylyax c}Ab]r²´²7%y3yx@

 yUnification has returned x ×³yfX and applying the Ïfr case leaves us trying toprove.

~@
e<p!qPd°òn=}AoÎnpm]x&(c[»x%X lyax c}Ab]rx q Í±n´²yxqZÍ±)²\+y3y¬yx3x ³yly~
By -p} ¡pòzn= with cmAn , followed by structural decomposition andCº®

}ArE~EY ï_rEó

this becomes

223

C
~
e<p!qPd°òn=}AoÎnpm]x ~ EDþx c}Ab]rÁX =Ü±÷XÄ=Ü±n@ ¬yx c}Ab]rÁX  7ÜÝ²÷ X Ä
 FÜ²7% y3yx3x lyx ³ y¬y_®

ó~ }AoÈ}ArE~ , we acquire two subgoals

Applying~
e<p!qPVfd°òn=}AoÎnpm]x c}Ab]rÁXÄ=Ü±nX 7Ü±nyx ³ly~®
@e<p!qP(° d°òn= }AoÎnpm]x&(c[»x ³lyx c}Ab]rX 7Üß²i¢XÄ=Üß²7+y¬yx ly~
In the former, cmAn backwards lets us move X out as a bound, giving us a goal
which follows immediately from e<f \ . In the latter, we may shuffle the bound®

inside, then apply composition laws to get®

e<p!qP  d°òn=}AoÎnpm]x~c}Ab]r¢x ³°X7y7Üß²ix ³°X=y7Üß²Y+y3yx

@

ly

ü

Now, pulling out the composition as a bound, we reduce the goal to Ù<f\ .
flexible cases with npcr|è¯p³
All of these work the same way. We have someÐpo±² kQJ¬np8cr|è¯p³

where either ± or ² is a variable. This reduces toÜ =~ c[zèa¯=Ü8x ÐojÎ èëÖ¯u±l èÄë¯²|³yInverting the recursive call with the inductive hypothesis, we find one of twothings–~c}Ab]l³7Üx+ èë¯ 7Ü±y³LÄ=Üx+ èë¯ FÜß² yand we must provel~c}AbÄxnp8cr|èa¯p³y7Ü±Èx n8cr|è¯p³yÄ=Üß²

But x npcrèN¯ ³ym is just x ³ y èÈë
pushing ê=Ü through the composition.
–@~¯ , so it is just a question ofsuch that òzn=}AoÎnpm]x&(c[»x ³ yax c}Abr èÄëand we must proveòzn=}AoÎnpm]x&(c[»x¬x npcr|èa¯p³ylyx~¯w±l èëÖ¯ ² y3yxc}Ab]r±² y¬yx@

The proof is easy bound shuffling and composition hacking.

224

ly

@

ly

ü

flex-flex base case
The computation ofÐpo§xF¡¸np\(yaxF¡¸np¾,y,npc}Am

has reduced toÏfrpx mA4=mA4=\N¾,yWe may safely presume a Ïr answer, because we are in either the ‘identity’or the ‘coalescence’ situation, according as \ equals ¾ or not. Hence, we mustchoose the Ïfr case in the proof, leaving us with the obligation®

e<p!qPd°òn=}AoÎnpm]x&(c[x~c}AbrxF¡¸np\,yxF¡¸np¾|y3y3yx¬x mA4=mA4=\N¾,yly

We may easily remove the trivial bound, yielding®

e<p!qPd°òn=}AoÎnpm]x~c}Ab]rxH¡´n\(yaxH¡´n¾,y¬yx3x mA4=mA4=8\­¾,ylyüSince we have not yet implemented mA4=mA4= , we can go no further with theproof. Let us export this goal as the specification of mA4=mA4= .
flex-rigid base cases
For these five subgoals, we are trying to unify ¡´n]\ with some ² which is not avariable. We may collect them all together in the following rule, expressing thelatter as a side condition:
evd]\d]b]c¼r e²d]~ r ekp°\² .¯d¾Nd b]cr eY²È¶ÎÆ ¡¸np¾¤d]q  ovr eoÂnÏÐÑxqZor ey÷¨©%ª,«

X dnpmA}Ar3~eúk|³»d]npmA}ArE~fkk tòn =}AoÎnpm
~x &([c »xEX  yx c}Ab]rxF¡¸np\,y´² y¬y
x 
³ ly
YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY¤Qk JX=¼x Ïfrz k t J+
³ fX=3y³·d]npmA}ArE~feøk~lc}Abæ³£\ø³=Üß²
YYYYYYYYYYYYYYYYYYYYYYYYY¤Q
k J%³x cÑxq  oéezy¬y¤nc}Am]xmA4=ï_}?}?\² y225

We could regard this as an inversion rule specification for mA4=ï_}?}? , but it is stilla little too general. For example, the hypotheses of the rule each have arbitrary
accumulators, but we know the accumulator is npc}Am . Once we have made theaccumulator npc}Am everywhere, we no longer need to let it vary in the scheme. Let
us tidy up a little.
evd]\d]b]c¼r e²d]~ r ekp°\² .¯d¾Nd b]cr eY²È¶ÎÆ ¡¸np¾¤d]oÎnpÏÐÒxqZovr ezy¢¨©%ª,«~lc}Ab´xH¡´n\,y´²
YYYYYYYYYYYYYYYYYYYY¤
x cÑxq  oéey¬y¤³úd]npmA}ArE~°kk~òn =}AoÎnpm]x c}Ab]rxH¡´n\(y´² yx ³ly
YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY¤
x Ïfrz Q
k J+³3yx mA4=ï_}?}?\Ä² yThe tidy version proves the untidy version because the tidy hypotheses are special cases of the untidy ones, modulo some equational reasoning. Let us take thisas the specification of mA4=ï_}?}? .
We have proven correctness of unification, contingent on correct implementation ofmA4=mA4= and mA4=ï_}?}? . You may have noticed that we did not have to unwrap any ofthe òzn=}AoÂnm s in the above proof—we merely showed that the most general unifiers
computed in the base cases were correctly propagated. It is in mA4=mA4= and mA4=ï_}?}?
that we create the substitutions and where we shall have to do real work proving maximality. In order to achieve this, we must come to an understanding of variable occurrence.
But even now, we have seen enough to know that our unification algorithm is terminating of its own accord.

7.3.5 what substitution tells us about the occurs check
In conventional presentations of unification, the occurs check is a boolean decision,and its role in ensuring termination is external to the program. For us, though, thesituation is somewhat different—what is to happen if there is no occurrence of xF¡¸np\,yin some rigid ² with which it is to be unified? We do not just substitute ² itself for \ .
226

We must make manifest in the program the elimination of \ by computing the imageof ² in the syntax with one fewer variable—² t such thatÜ ß~ ½}Ac\FÜ,² t ¶ú²

If we can find such a ² t , then \Lë

² t

is a most general unifier for xF¡¸np×\,y and ² . Let us prove this lemma, as we shall need it
several times.

®

/-cÍ°~Ed-e¢d-\¢db]cr e´² t d~ ºe~òzn =}AoÂnm°x c}Ab]rxF¡¸np\,yx+Ü ~ ½}Ac\=ÜÝ² t y¬y \Lë

² t

Now, at last, we must do some real work. Introducing the òn=}AoÎnpm record:®

Ù<pqPcr°±Vdæ \Lë
² t  =ÜxH¡´n\,y_¶B \zë
² t  7Üx%Ü ~ ½}Ac\FÜß² t yhi (² p¯E±]d(-k dXdr e¥íîk-Ù°¾°Ú_d|X=ÜxH¡´n\,y_¶X=Üx+Ü ~ ½}Ac\=ÜÝ² t y
Ô
³
d¬e g
k
9X 8 
³  \ë² t®

Taking Ù<pqPcr°± first, notice that the left-hand side is just  \ë ² t w\ , which we can rewriteby the ‘introduction rules’ to ² t . Observe that the right-hand side is a composition ofsubstitutions. After a little monadic tinkering, we obtain®

Ù<pqPcr°± t dÜ I¬=Üß² t ¶Bx3 \ë

² t <Ü ß~ ½}Ac\y=Üß² t

This says that two substitutions have the same behaviour at an arbitrary tree ² t . By&,nÍ° , it is enough to prove that they behave the same at variables.
®

Ù<pqPcr°± t d-¾db]ceÜ 0×¾Ä¶x¬ \zë

² t ¼Ü ~ ½}Ac\_y-¾

227

Reducing, we obtain®

Ù<pqPcr°± t d-¾db]ce¡¸np¾¶ \Lë

² t (x~ ½}Ac\Ê¾,yAgain, this follows by the established extensional behaviour of =êëêw .

We have found a unifier—let us now show that any other unifier factors through it.
Introducing the assumptions and the pair:

Wk
d
W X

dr e¥íÖkWÙ°¾°Úd|X=Ü+xF¡¸np\,y_¶®
³d3e¥íîk® hi d-9X 8 ³ Ä \zëXFÜx+Ü Ý~ ½}Ac\FÜß² t y²t

Let us try to prove h' first, hoping to shed some light on ³ . This goal also comes down
to checking that the two substitutions agree at all variables:

®

hi



t d ¾db]cJr e

XE¾Ä¶³­FÜ  \zë

² t ¾

Predictably, the next step is to invert the blocked computation with Í°cÍ°~% c-¡ :)
h® i  dX%\¶·³N=Üß² thi Õ d+¾´db]ce®

Xfx ~ ½}Ac\­¾,y_¶ù³º¾

The latter subgoal gives us a big clue. We can prove it by taking³v{W]¾Nd b]ceÁYX-x ~ ½}Ac\­¾,yWe must now prove hi
as the composition)

. A little monadic massage shows ³ is extensionally the sameX!¼Ü ~ ½}Ac\

228

Making the replacement,
®

hi

 

t dX%\¶Bx%X`Ü ~ ½}Ac\y=Üß² t

Unwinding the composition reduces this goal to Ù°¾°Ú .
This is progress indeed, for all the nontrivial substitutions generated by mA4=mA4= ormA4=ï_}?}? will be most general unifiers by this lemma. Indeed, we are now in a position to write mA4=mA4= :mA4=mA4=ºdeÁY+\ ¾Êd b]cr e¢Yq  oðr e

mA4=mA4=8\N¾¿{~ ½}AÍ\­¾cÒx bceLyÏfr|¾ t

r eJ3nc}Amue J3n8cr(\LxF¡¸np¾ t y,nc}Am

Recall that to establish correctness, we must prove®

mA4=mA4=





d-e
d
-\_ ¾db]cr e~òn =}AoÎnpm]x c}Ab]rxH¡´n\,yxH¡´n¾,y¬yx3x mA4=mA4=8\­¾,yly

Since mA4=mA4= is defined with ~ ½}AÍ , it is verified by ~ ½}AÍ( c¡ , leaving two cases®

mA4=mA4=



d-ed-\dbcJr e~òn =}AoÎnpm]x c }Ab]rxH¡´n\,yxH¡´n\,y¬yx npc}Am9 y®
mA4=mA4=Õ]d-ed
-\dbcJr e-¾dbce~òn =}AoÎnpm]x c }Ab]rxH¡´n\,yxH¡´n_x~ ½}Ac\N¾,y3y¬yx3x n8cr|\zxH¡´n¾(y,nc}Amwyly

For the former, recall that npc}Amv is the identity substitution—this clearly unifies two
equal variables, and equally clearly, every other unifier factors through it. For the latter,interpreting the association list and tidying, we get®

mA4=mA4=Õt ded\db]c¼r e
¾db]ce~òzn =}AoÂnm°x c}Ab]rxF¡¸np\,yx+Ü ~ ½}Ac\=Ü8xF¡¸np¾,y3y¬y \LëÖ¡¸np¾

229

This follows from /-cÍ°~ .
The role ~ ½}AÍ plays in mA4=mA4= is to attempt to compute the image of ¾ in the variable
set with \ removed. If this succeeds, we manufacture the corresponding knockout. If
it fails, that is because ¾ is \ and the identity substitution will do.
The analogous role in mA4=ï_}?}? is played by the occurs check, seen as an attempt tocompute the appropriate ‘thickened’ tree for use in a knockout—this will fail exactly
in the case of an offending occurrence. Correspondingly, the occurs check is no longera boolean decision—it provides us with the witness which explains why it is safe to
substitute. More sense has appeared in the program! The type of the occur check is8½ÍdeÁY\Ndb]cJr e¢Y¸²]d~ r eYoÂnÏÐÒx ~ ¼ezy

Its inversion rule should be something like:evd]\¢d]b]c¼r e¤d]~ r eoÂnÏÐÒx ~ ¼eLy¨©%ª,«_¤x+Ü ~ ½}Ac\=ÜÝ² yx Ïfr² y¸²d~ ÷r eÁY

where

_

88 r¤

88 r\²
YYYYYYYYYYYYYYYYYY¤²xc£x ~ ¼ezy3y²x ½Í\² yis some useful means of characterising when \ occurs in ² .

In other words, 8½Í\ is the partial inverse of Ü ~ ½}Ac\FÜ . Hence we will implement8½ÍN\ by pushing ~ ½}AÍ­\ through trees, with any c at a variable causing a coverall. However, before we can really work with the occurs check, we must formalise
the notion of occurrence.

7.3.6 positions
The idea of pattern matching is to explain decomposition by inverting construction,and I was exposed to it at such an early age that it simply refuses to wear off. We
have already seen  in terms of duplication and ~ ½}AÍ in terms of ~ ½}Ac . Since
searching for an occurrence is a kind of decomposition, I cannot help asking what thecorresponding construction might be.

230

Let us therefore identify the operation which makes an occurrence—the operation
which puts something at a given position. In order to do this, we shall need to represent positions within a tree.
Every datatype û has an allied datatype of positions or ‘one-hole contexts’ within elements of û , together with an operation which puts a û in the hole. Huet gives abeautiful construction of ‘zipper’ types which code up one-hole contexts as paths fromthe hole back to the root of the term, recording the contents of other side-branches on
the way. We may equivalently, and slightly more conveniently for our purposes, reverse the direction and code up paths from the root to the hole. Let us therefore define
the parameterised datatype ór(k of positions within k :üformation ruleü

constructorsk£d]ór|k£d]½8Ì d]ópr|k² Ù<E¯gd]ópr|k²d]~ ºkmAq ~¸²7<
Ù Eg¯ p²dór|k±d]~ ºk² Ù<E¯gd]ópr|k?} ½~f±² Ù<3¯dór(kThe constructors may be interpreted as directions for finding the position from the root,
respectively ‘stop ½ ’, ‘go mAq ~ ’ and ‘go }?½~ ’. Consequently, the function whichputs a term at a position isê]ê!rldkY¸²7Ù<E¯gd ópr|kY.Z²d ~ ºkY~ ºk

Allow me to break with convention and write r postfix—its definition is:½
x mAq ~,² Ù<3¯² yx }?½~°±² <Ù 3¯ ×y

²
²
²

r{rr{{²qZÍºx² Ù<E¯g ²r+y´²
qZÍp±lx ²7<
Ù Eg¯ Z
² r%y

In particular, we may now describe a term containing ¡¸np\ as Ù<3¯­xH¡´n\,yr
In order to reason about positions, it will be useful to have some other apparatus.
Indeed, we may consider r to interpret óprk as the arrows of a category with
one object interpreted as ~ §k . ½ is the identity. Let us therefore define thecomposition, which, in the spirit of the piece, I shall write as an infix operator called~ ½c :231

 Ù<E¯´d ópr|kaYór(k Ù<E¯ { Ù<E¯g~ ½c Ù<E¯ { Ù<3¯×y´²~ ½cmAq ~x ²7Ù<E¯a~ ½c Ù<E¯[y~ ½cÙ<E¯
{}?½~f±lx ²7Ù<E¯~ ½c~ ½cÈdkY¸²7Ù<E¯g°½
x mAq ~,² Ù<3¯ ² yx }?½~°±² <Ù 3¯ ×yThe definition of r ensures the correct interpretation of ½ . An easy recursion
induction proves the correct interpretation of ~ ½c :x Ù<E¯g~ ½cL²7Ù<E¯[y- ²r¶  <Ù E¯g­x ²7Ù<E¯gZ²r+yr

By the way, datatypes (eg mA}ArE~ , ) with a single and constant base constructor (eg c}Am ,) and linear step constructors (eg 8cr , r ) are isomorphic to their own position types.
The r and ~ ½c operations are the same (eg nÞópóc , ómAr ). This may accountfor their peculiarly regular behaviour.
Returning to our ~  syntax, we shall also need to push substitutions through positions. Overloading slightly:ê=Üfde kaYaX%d e¥íkYór|eór(kXFÜÝ½ XFÜx mAq ~(² Ù<E¯g² yXFÜx ?} ½~°±² <Ù Eg¯ y{½ÌmAq ~8xX7ÜÝ² Ù<E¯g[yxX=Üß² y ?} ½~xXFÜ±[yxX=Üß²7<
Ù Eg¯ yRecursion induction on this operation gives us a proof of º½c8 :XFÜx ² Ù<3¯Z²ry_¶xXFÜ² Ù<E¯g[yxX=ÜZ² yr

Now, in order to prove that occurs check failure causes unification failure, we shallneed to show that the only position at which we may find a term inside itself is ½ :®

ºÏ8mAÊd-kd-Z²d~ ºk´²7Ù<E¯dópr|k-Ù°¾°Ú¿)d  ²|¶ø²7Ù<E¯gZ²r²7<
Ù E¯ ¶»½

We have seen a similar theorem before. The proof goes by induction on Z² , then caseanalysis on ² Ù<E¯g . A lot of impossible cases are removed by unification—there are
obviously no mAq~ or }?½~ positions within ¡¸np\ or mAnq . The only real work to bedone is when ² Ù<E¯g is not ½ and  ² is a qZÍ . There are two such cases, one much
like the other, so I shall just give the proof for qZÍ and mAq ~ :232®

ºÏ8mA
i

 dkd
±°%² ¯d~ ºk
± o¾°Ú´d¸² <Ù Eg¯ °dór|kÙ°¾°Ú d3±p¶ø²7Ù<E¯_±Qr²<
Ù Eg¯ p¶»½¸²(o¾°Úad¸² <Ù Eg¯ dópr|kÙ°¾°ÚdqZÍp±²|¶²<
Ù Eg¯ p¶·½

xmAq~(²7Ù<E¯g¯[yx q  Í±²Ýyr

The trick is to rotate the cycle. Reducing r , Ù°¾°Ú becomesqZÍ±p²|¶»q Íºx ²7Ù<E¯g­x q  Í±p² yr+y-¯

Unification identifies ² and ¯ and tells us that±¶ø² Ù<E¯glx q  Í±² yr

Now, if we are careful, we can turn this into a cycle in ± and apply the relevant inductive
hypothesis. Our categorical tools allow us to rewrite the above equation to±¶

x ²7Ù<E¯a~ ½cÁx mAq ~|½² y3y-±Qr

The inductive hypothesis ±o¾°Ú now tells us thatx ²7Ù<E¯~ ½cÁx mAq ~|½¢² y3y_¶»½

This is manifest nonsense, but we need to make a constructor appear at the head on
the left-hand side to reveal the conflict. That is to say, a further case analysis on ² Ù<3¯ ,accompanied by the unification tactic, completes the proof.
We are now in a position to fill in the last component of the unification algorithm.

7.3.7

and

As suggested earlier, the 8½Í function pushes ~ ½}AÍ through a ~  .
8½Í
8½Í\xF¡¸np¾,ymAnpq  Ì{\8½Í\x q  Í±p² y{{Ü ¡´nÌ]FÜx ~ ½}AÍa\­¾,ymAnpq Ì8½Í\N±8½Í\²Ïr|± tÏfr² tÏr|± tc£x ~ ºkyc£x ~ ºky²t233

ÏrpxqZÍp± t ² t ycÑx ~ ºkycÑx ~ ºkyNow that we know how to talk about positions, we can give this function a better
inversion principle, 8½Í( c-¡ :8½Í( c-¡
evd]\¢d]b]c¼r e¤d]~ r e¤oÂnÏÐÒx ~ ¼eLy¨©%ª,«¤ x+Ü ~ ½}Ac\=ÜÝ² yx Ïfr² yx Ù<E¯g­xF¡¸np\(yryx c£x ~ ºey¬y¤¸²]d ~ r e¢Y²x8½Í\Ä² y

The proof, which I omit, is by recursion induction and inversion of the blocked computations.
Now let us define mA4=ï_}?}? :mA4=ï_}?}?z\²L{½Í\²Ïfr² tcÑx~ ºezyÏfrz e J3npcr|\² t nc}AmwcÑxqZovr ezy

We must show that this function satisfies its specification:®

mA4=ï_}?}? Ø ded\db]c¼r e¸²d~ r e
kpf²7.¯fd¾dbcJr e²å¶ÎÆ ¡´n¾¤doÎnpÏ-ÐpÑx q  ovr ezy¨©%ª(«
~
0
´àá
dG
 p
d 
c}Ab]¸xH¡´n\(y´²¤x cÑxq  ovr eLy3y
´àæâ
dk
d
aX
dnmA}ArE~feøk~) h'¤ f\d°òzn =}AoÂnm°x c}Ab]rxF¡¸np\(y´²Ýyx%X yÏrz7
k JXF¤x mA4
 =ï_?} ?} \²ÝyThis we prove by expanding mA4=ï_}?}? and inverting 8½ÍN\L² , leaving two cases.
The first is

234

®

mA4=ï_}?}? Õ d¸²äd~ ¼e¤doÎnÏÐpÑx q  ovr eLy¨©%ª(«´àæâ]d-kdXdnmA}ArE~°eùk~y h'¤ f\d°òzn =}AoÂnm°x c}Ab]rxF¡¸np\,yJÜ Ý~ ½}Ac\=Üß² yxEX  yÏfr Q
k JXF¤

J3n8cr|\Ä²ænpc}Amux Ïfrz7e

Introducing the hypotheses, refining by àâ and unpacking the association list, we areleft proving®

mA4=ï_}?}?ptÕ dfòzn=}AoÂnm°x~c}Ab]rxF¡¸np\,yJÜ ß~ ½}Ac\=Üß² y \ë

²This follows by the /-cÍ°~ lemma.
Meanwhile, the other case of the inversion is®

mA4=ï_}?}? ç d Ù<E¯ådórr e

-kpf²7.¯°d-¾_db]c¼r e
 <Ù E¯ ­xH¡´n\,yr ¶ÁÆ ¡´n¾¤doÎnpÏ-ÐpÑx q  ovr eLy¨©%ª(«
~
0

_à|á
d9
 p
d 
c}Ab]¸xH¡´n\,yx Ù<E¯g­xF¡¸np\,yr+y¤x cÑxq  ovr eLy3y¤x cÑxq  ovr ey¬yThis time, introducing the hypotheses, refining by à|á and expanding ®

mA4=ï_}?}?ptç d-kdXdr e¥íÖk-!rdX FÜxF¡¸np\,y_¶X=Üx Ù<3¯­xH¡´n\,yry

By º½c8 , we may push X through r , telling us235~c}Ab] leaves

XE\Ä¶
ºÏ8mA

xXFÜ Ù<E¯×yx%X3\,yr

now tells us that Ù<3¯¶»½
reducing kpf²7.¯ to¾Y¡¸np\ð¶ÎÆ ¡´n¾

from which we may easily prove the goal.

7.3.8 comment
This verification of a unification is another in a long line of such developments. From
Zohar Manna and Richard Waldinger’s pioneering hand-synthesis [MW81], throughLawrence Paulson’s machine verification in LCF [Pau85] to the more recent work indiverse proof systems [Coen92, Rou92, Jau97, Bove99], all have faced the same inherent problem of explaining a program which simply does not make the sense its makerintended.
Critical to the correctness of the unification algorithm is the relativisation of terms totheir context of variables. Such relativised data structures occur naturally in dependent
type systems. Unification has always been structurally recursive—it is just that thestructure could not be made data until the right types came along. Now they have, andthat is something to be pleased about, and to be vocal about.
There are three delicate aspects of unification which must be handled somehow inevery treatment, and they are not entirely independent:üü

the termination of the algorithmüthe propagation of a unifier computed for one part of a problem through the restof the problem
the failure of unification due to failure of the occur check

The termination issue has, over the years, been separated from partial correctness withincreasing panache and aplomb, but the technique standard in the literature is wellfounded recursion over an ad hoc ordering. Manna and Waldinger [MW81] are sensible
236

enough to leave the choice of this ordering until they have extracted the conditions it
must satisfy:‘We have deferred the choice of an ordering K¡+ç to satisfy the ordering
conditions we have accumulated during the proof. The choice of this ordering is not so well-motivated formally as the other steps of this derivation.’
The necessary ordering combines lexicographically the size of the variable set and thestructure of the problem—the different treatments manifest this in slightly different
ways. Paulson [Pau85] points out that he works rather harder than he would like to,motivating the desire for ‘an LCF package for well-founded induction’ in order toemulate Manna and Waldinger’s paper development more closely.
Implementations of what would otherwise be generally recursive programs in typetheory necessarily involve computation over the proof of termination. Different strategies exist to minimise the impact of this unwelcome intrusion of proof into program.
Joseph Rouyer [Rou92] manages to confine the logical component to the outermost
well-founded recursion on the number of variables, the inner recursion on terms being
purely structural.
Ana Bove moves the goalposts in a pleasingly systematic way [Bove99]. Her ALF
program does its recursion over the proof of an accessibility relation constructed almost
directly from the Haskell program she wishes to import—the arguments to the program
become the indices of the relation. A single induction over this relation thus splits into
cases corresponding to the left-hand sides of the original program, while the exposed
sub-proofs give exactly the recursive calls. Of course, she still has to prove that all theelements are accessible by well-founded lexicographic induction, but by packaging thiscomplicated induction into a single relation, she has not only supported the program
but also effectively acquired ipso facto its recursion induction principle—useful for
proving its properties.
Of course, my program does a similar lexicographic recursion, but it is internalised in
the data structures. I avoid an appeal to well-founded recursion on 1 for the numberof variables by unloading the accumulated substitutions incrementally, which is notunreasonable as they are built incrementally, and which incidentally enables me todelay them until they become critical.
It might perhaps be interesting to consider how much more trouble it would be to use
a normalised representation of substitution, applied all at once. However, normalising237

substitutions is, in any case, computationally quite expensive.
Manna and Waldinger work rather hard to synthesise the accumulation of a unifier
across a list of subproblems. The idempotence of the unifier plays a pivotal role. Paulson’s proof is apparently simpler, but he is unforthcoming about the ‘occasional ugly
steps’. Coen [Coen92] describes this problem as the only awkward aspect of partial
correctness.
The ‘optimistic’ treatment of accumulators makes this problem rather easier to deal
with—introducing the accumulator as an extra parameter effectively strengthens theinductive hypotheses for the subproblems in exactly the necessary manner. Armando,
Smaill and Green’s automated synthesis manages to profit from this without excessive
prompting [ASG99]. Bove also exploits an accumulating parameter with the same
benefit. As I have shown, it is a natural technique to employ when the order withrespect to which we seek an optimum is induced by some notion of composition.
As for showing there is no unifier when the occur check fails, my treatment is morally
the same as Manna and Waldinger’s, packaged slightly more categorically. It is alsoslightly more concrete. The use of the datatype of positions and its attendant operations, together with ~ ½}Ac , means that the inversion of the occur check instantiates theinvestigated term with patterns capturing the relevant information, rather than presenting it propositionally. However, the position datatype comes into play only in the proof,
not in the program, so in this case, there is not much to choose between the two.
Nonetheless, we may one day want a unification algorithm which augments the failure
response with diagnostic information, so that a PhD student desperate for cash can havean easier time finding the type errors in an undergraduate’s ML program. At this point,a concrete representation of positions becomes a must. The type of 8½Í could justas easily have been
8½ÍdkYb]cr kË~ r k¥~ ¼kR¢órr k

returning a witness in the case of failure. A treatment of positions is hardly wasted.
Furthermore, as Huet points out [Hue97], there is no reason why the construction of
position apparatus should not be automated for arbitrary datatypes.
Finally, I would like to comment on two ‘packaging’ aspects of the development of
unification in this thesis. Firstly, the monadic treatment both of failure-propagationand of substitution itself seems to present the necessary equipment in a useful andorderly way.
Secondly, the use of inversion and recursion induction principles to capture the be238

haviour of components lent such a regularity and tangibility to the components of thecorrectness proof that I believe I have given substantial credence to the methodology
of capturing ‘leverage’ in this way. Recall, for example, how the inversion of the occur
check not only exposed the information pertinent to the two possibilities but performed
the consequent rewriting, allowing still further progress by computation. Further, thewhole effect was triggered by asking a single high-level question about a program
component‘what can have happened in that occur check?’rather than a low-level question about data
‘what values can that oÂnÏÐÒx ~ ¼ky have?’
We have been able to stare at unification without going blind.

239

Chapter 8
Conclusion
What are the contributions of this thesis?
Firstly, and somewhat tangentially, it introduced O LEG, a type theory with holes which
has two advantages:
üü

separation of partial constructions from the core computational terms in such a
way that the partial constructions—where the holes live—behave well enough tohave the replacement property
internalisation of the account of the holes within the judgments of the theory,
allowing the state of a theorem prover to be represented exactly by a valid context

Of course, relative to systems which explain holes with the aid of explicit substitution,it has the disadvantage of forbidding certain interactions between holes and computation. For the work presented here, this has not troubled us at all. Admittedly, this has
not involved the kind of higher-order problem for which the banned interactions mighthelp.
On the other hand, the resemblance to Miller’s ‘mixed prefix’ [Mil92] treatment isstrong enough to suggest that his brand of higher-order unification might be feasible.
He too handles the interaction between holes and computation by ‘raising’ the holes tothe functionality required to ensure that the computation happens entirely within theirscope. Nonetheless, deeper exploration is needed before we can say that O LEG is asuitable basis for sophisticated theorem proving. It is, however, an effective basis forthe tactics and mechanised constructions on which the main work of the thesis depends.
That work was to build object-level support for pattern matching on dependent
types in a conventional type theory extended with uniqueness of identity proofs. It
240

closes the problem opened by Thierry Coquand as to the status of pattern matching[Coq92, CS93] as implemented in ALF [Mag94]: it demonstrates that uniqueness ofidentity proofs is sufficient to support pattern matching where the unification underpinning case analysis is for first-order constructor forms—this is the unification suggested
by Coquand and implemented in ALF. The necessity was shown by Hofmann and Streicher [HoS94, Hof95].
In the course of that demonstration, I used a new ‘John Major’ formulation of propositional equality. This allows elements of different types to aspire to equality, but ensuresthat they are only treated equally if they come from the same type. John Major equality is equivalent to Martin-Löf equality, but considerably more convenient in practice.
It facilitates the expression of unification problems over sequences of terms involving
type dependency, without requiring any dependency in the equations.
Consequently, I was able to extend the object-level first-order unification algorithm
presented for simply typed constructor forms in my MSc work [McB96] to the dependently typed case. The necessary ‘no confusion’ and ‘no cycle’ theorems for eachfamily of types can be constructed automatically in a uniform way. This is the objectlevel unification required to support pattern matching, and it shows that the need for
uniqueness of identity proofs is no idle coincidence.
However, following the famous dictum of Marx and Engels, it is not enough merely
to show that dependently typed pattern matching can be given meaning in an almost
conventional type theory—the point is to show that it is good for something. I hope I
have successively argued for the principle of representing relativised data in relativised
types. I believe the developments of substitution and unification in chapter seven lendtangible credence to this argument. The unification example, in particular, demonstrates the importance of allowing datatypes to depend on terms.
The latter may require general recursion to be abandoned for the sake of typechecking,1
but it makes more programs structurally recursive because it gives us more structures—types indexed by terms allow computation on the indices; types indexed by types donot.
M ANTRA:If my recursion is not structural, I am using the wrong structure.
Dependent types make sense where general recursion is made sense of, if we are lucky.
1

Lennart Augustsson disagrees, as do a number of others. In my opinion they are trying to have theircake and eat it, but they are nonetheless convinced of the advantages of cake.

241

There are many examples where the ‘right structure’ is hard to represent internally tothe program, and where an external termination argument seems the prudent course,
but the expressiveness of a dependent type system nonetheless offers the improved
prospect of principled structural alternatives. The functional programming community
ignores dependent types at its peril.
Turning from programs to their proofs, I suspect the idea of using elimination rules
to capture the behaviour of program components abstractly from their implementations to be an important one. Specifications should not only tell us what programs towrite—they should tell us what we need to know about the function when it is used.
The latter behaviour is clearly like elimination in character. The kind of second-orderrule supported by O LEG’s eliminate tactic exploits such information in a compact andpowerful way, relativised to the goal which motivates its use.
We are quite happy to specify and write programs (derived introduction rules) in an
abstract and modular fashion—we should derive the corresponding elimination rules
so that we can reason about programs in an abstract and modular fashion. We havebeen trying far too long to prove properties of programs by fiddling about with theprimitive rules for data—we would never dream of writing programs that way. Henrik
Persson has also identified this style of reasoning as of considerable assistance in his
formalisation of the polynomial ring [Per99]. First-order equational specifications only
do half the job—they are inappropriate for reasoning about the usage of programs.
That is, they are good for characterising introduction behaviour, but they need to becomplemented by a more effective treatment of elimination.
I believe the technology and methodology developed in this thesis contributes not only
to the writing of programs which make sense, but to the effective exploitation of thatsense in reasoning about them.

8.1 further work
‘The world will be far better when we turn things upside down.’(J. Bruce Glasier)There is a great deal to be done.
Firstly, as far as the technology supporting dependently typed programming is concerned, it is an important task to identify a recognisable dependently typed programming language. As things stand, the equational programs we might like to write corre242

spond only to the deducible computational behaviour of complex proof terms—if wewant to be able to check a reloaded program, we need to reload its justification.
As I pointed out in chapter six, the problem lies in ensuring that stored programs givea satisfactory account of their empty cases. I believe that a reasonable way to go about
this is to make the machine capable of detecting those argument types which can beshown to be empty by one step of case analysis. If more than one step is required,
then the empty type can nonetheless be split into nontrivial constructor cases, and thisis something the program can and should record. In effect, the program must containenough hints to allow the reconstruction of the emptiness proof.
We might consider insisting that types be ‘filled up’ with markers indicating ‘badness’
in regions which would otherwise be empty. What implications for the expressivenessof the type system the enforcement of this discipline would entail, it is too early to say.
However, the propagation of ‘badness’ surely involves the same work as the propagation of emptiness. It is a question of which gives the clearest treatment, and a more
explicit approach is certainly worthy of attention.
With the development of improved technology for programming with dependent types,
there is an imperative to write programs. Despite the clear argument from principlethat more precise data structures lead to tighter programs—otherwise, why have types
at all?—it is not rhetoric which changes practice but competition.
One example, close to home, which springs to mind is the development of a polymorphically typed strongly terminating functional programming language: parser, type
inference algorithm, interpreter. Delphine Terrasse has encoded Natural Semantics in
Coq [Ter95a, Ter95b] using a simply typed presentation of terms and types, with inductively defined relations describing valid formation and typing. It seems reasonable
to hope that these latter properties can be built directly into data structures via dependent types. The work of Altenkirch and Reus [AR99] and of Augustsson and Carlsson[AC99] is already moving positively in this direction. Further, having developed firstorder unification, an ML-style type inference algorithm [DM82] seems an obvious next
step, especially as finding principal types is another optimisation problem addressableby the optimistic strategy. Also, there are existing developments in simple types available for comparison [NN96, DM99].
However, in tandem with the continuing development of programming technology, thedevelopment of a strong specification methodology which includes elimination as wellas introduction rules seems a task of genuine importance. The focus of that development should be on program derivation at least as much as verification. Even at the243early stage reached in this thesis, we have seen a small example of elimination rules
used to transform a specification towards a program—the development of ~ ½}AÍ from~ ½}Ac .
More than this, an area of interest not touched on in this thesis, but prominent in mythinking is the use of derived elimination rules for programming itself. As a starting
point, it seems very likely that Phil Wadler’s suggestion to equip datatypes with different ‘views’ [Wad87] supporting different notions of pattern matching for the sameunderlying type can be put on a sound footing.
The motivation for such a development is very straightforward. As a matter of course,
we write ‘derived constructors’—functions which build elements of datatypes in more
abstract patterns, reflecting the macroscopic structure of the problem at hand. We writeópmAr to add numbers together, r3c to add an element to the end of a list, and so forth.
It would surely be helpful to equip programmers with the means to analyse data at thesame macroscopic level.
Although a great deal of attention has been paid to developing what goes on the righthand side of pattern equations in a principled way, the left-hand side has long been
neglected. It is time the left came into its own. We have nothing to lose but our chains.
We have a world to gain.

244

Appendix A
Implementation
A few points about the prototype implementation:ü

O LEG was implemented primarily as technology for the machine construction of
the standard theorems with which I equip datatypes, and to support the writingof tactics at a relatively high level. The separation of partial constructions fromterms is not rigidly enforced. Further, as it uses L EGO’s unification algorithm,
the scoping conditions for solving holes are not enforced either. However, thecomplete terms generated are independently checked by L EGO’s reliable typechecker before they are trusted.

üThe restrictions on the positioning and behaviour of holes were not rationalised
until after the implementation was complete. Nonetheless, in all the developments I implemented, I found that I obeyed them. This gives at least anecdotal
support to the suggestion that they are, in some way, natural restrictions to make.
The implementation of the eliminate tactic does not have the abstraction facility
described in chapter three. This still makes it entirely adequate for all the programming in this thesis, as such abstractions are not necessary when working
with datatype elimination rules.

ü

The tactic does not, however, support derived elimination rules for functions in
the way that it should. Although the examples using such rules have all been
implemented and machine checked, the elimination rules for functions were applied by hand.
The invention of ‘John Major’ equality came some time after I stopped workon the prototype. Consequently, the traditional equality (plus uniqueness) isused. Telescopic equations are thus represented in a somewhat awkward way,245

with each equation in the telescope coercing by all the previous ones in order
to be well typed. This significantly complicated the elimination tactic and theunification technology, but nonetheless they work.

246

Bibliography[AR99]

Thorsten Altenkirch, Bernhard Reus. Monadic presentations of lambdaterms using generalized inductive types. In Computer Science Logic,
1999.

[ASG99]

Alessandro Armando, Alan Smaill, Ian Green. Automatic Synthesis of
Recursive Programs: The Proof-Planning Paradigm. Automated Software Engineering, 6(4):329–356. October 1999.

[Aug85]

Lennart Augustsson. Compiling Pattern Matching. In Conference Funcitonal Programming and Computer Architecture, 1985.

[Aug98]

Lennart Augustsson. Cayenne—a language with dependent types. In
Proceedings of the International Conference on Functional Programming(ICFP’98). ACM Press, September 1998.

[AC99]

Lennart Augustsson, Magnus Carlsson. An exercise in dependent types:
A well-typed interpreter. 1999.

[Bar92]

Henk Barendregt. Lambda calculi with types. In D.M. Gabbay, S.
Abramsky and T.S.E. Maibaum, editors, Handbook of Logic in computer
Science, volume 1. OUP. 1992.

[Bar99]Bruno Barras. Auto validation d’un système de preuves avec familles
inductives. PhD Thesis, Université Paris VII. November 1999.

[BH94]

Françoise Bellegarde, James Hook. Substitution: A formal methods casestudy using monads and transformations. Science of Computer Programming, 23(2-3). 1994.

[BP99]

Richard Bird, Ross Paterson. de Bruijn notation as a nested datatype.
Journal of Functional Programming. Vol. 9, No. 1, pp77–92. 1999.

[Bove99]

Ana Bove. Programming in Martin-Löf Type Theory. Unification: A
non-trivial Example. Licentiate Thesis. Chalmers University of Technology, Göteborg. In preparation.

[Bro96]

Jason Brown. Presentations of Unification in a Logical Framework.
1996. D. Phil Thesis. Keble College, Oxford.

247

[BD77]

Rod Burstall, John Darlington. A Transformation System for Developing
Recursive Programs. JACM, Vol. 24, No. 1, January 1997, pp44–67.

[Bur69]Rod Burstall. Proving Properties of Programs by Structural Induction.
Computer Journal, 12(1). pp41–48. 1969.

[BMS80]Rod Burstall, Dave MacQueen, Don Sannella. Hope: An Experimental Applicative Language. In Proceedings of the 1980 LISP Conference.
Stanford, California.

[Bur87]

Rod Burstall. Inductively Defined Functions in Functional Programming
Languages. Journal of Computer and System Sciences. Vol. 34, Nos. 2/3,
April/June 1987, pp409–421.

[Cla78]

K. Clark. Negation as Failure. Logic and Databases, editors H. Gallaire,
J. Minker, pp293–322. Plenum Press. 1978.

[Coen92]

Martin Coen. Interactive Program Derivation. PhD Thesis. University ofCambridge. 1992.

[CG99]

Adriana Compagnoni, Healfdene Goguen. Typed Operational Semantics
for Higher Order Subtyping. To appear in Information and Computation.

[Coq97]

Projet Coq. The Coq Proof Assistant Reference Manual, Version 6.1.
Rapport de recherche 203, INRIA. 1997.

[CPM90]Thierry Coquand, Christine Paulin-Mohring. Inductively Defined Types.
In P. Martin-Löf and G. Mints editors, Proceedings of Colog ’88.
Springer-Verlag LNCS 417. 1990.

[Coq92]Thierry Coquand. Pattern Matching with Dependent Types. In Proceedings Types for Proofs and Programs, June 1992.

[CS93]

Thierry Coquand, Jan Smith. What is the status of pattern matching intype theory? In El Wintermte, pp112–114. June 1993.

[CT95]

Cristina Cornes, Delphine Terrasse. Inverting Inductive Predicates in
Coq. In Types for Proofs and Programs: International Workshop TYPES’95. Springer-Verlag LNCS 1158. June 1995.

[Cor97]

Cristina Cornes. Conception d’un langage de haut niveau dereprésentation de preuves. Doctoral Thesis, Université Paris VII. 1997.

[CF58]

H.B. Curry, R. Feys. Combinatory Logic. Amsterdam: North Holland.
1958.

[DM82]

Luis Damas, Robin Milner. Principal type schemes for functional programs. In Proceedings, 9th ACM Symposium, Principles of Programming Languages, pp207–212. 1982.

[deB72]

N.G. de Bruijn Lambda calculus notation with nameless dummies. Indagationes mathematicae 34, pp381–392.
248

[deB91]

N.G. de Bruijn. Telescopic Mappings in Typed Lambda-Calculus. Information and Computation 91, pp189–204. 1991.

[DM99]

C. Dubois, V. Menissier-Morain. Certification of a type inference tool for
ML: Damas-Milner within Coq. Journal of Automated Reasoning, Vol.
23, No. 3, pp319–346. November, 1999.

[Dyb91]

Peter Dybjer. Inductive Sets and Families in Martin-Löf’s Type Theory.
Logical Frameworks, edited by G. Huet and G. Plotkin. CUP 1991.

[Gen35]Gerhard Dentzen. Untersuchungen über das logische Schliessen. Mathematische Zeitschrift 39, pp176–210, 405–431. 1935. (In translation,
pp68–131 of The Collected Papers of Gerhard Gentzen, edited by M.E.
Szabo, North-Holland, 1969.)[Gim94]

E. Giménez. Codifying guarded definitions with recursive schemes. Proceedings of Types 94, pp39—59.

[Gim96]

E. Giménez. Un Calcul de Constructions Infinies et son Application à laVérification de Systèmes Communicants. Doctoral Thesis. ENS Lyon.
1996.

[Gim98]E. Giménez. Structural Recursive Definitions in Type Theory. In Proceedings of ICALP ’98. Springer-Verlag LNCS 1443. July 1998.

[Gog94]

H. Goguen. A Typed Operational semantics for Type Theory. PhD Thesis. University of Edinburgh. CST-110-94.

[GS91]

P.A. Gardner, J.C. Shepherdson. Unfold/Fold Transformations of Logic
Programs. pp565—582 of Computational Logic: Essays in Honor of
Alan Robinson, edited by Jean-Louis Lassez and Gordon Plotkin, MIT
Press, 1991.

[Hal99]Thomas Hallgren. Alfa User’s Guide.
http://www.cs.chalmers.se/˜hallgren/Alfa[HP91]

Robert Harper, Robert Pollack. Type checking, universe polymorphism
and typical ambiguity in the calculus of constructions. Theoretical Computer Science, 89(1). 1991.

[vHLS98]

F. von Henke, M. Luther, M. Strecker. Interactive and automated proof
construction in type theory. In Bibel and Schmitt (1998), chapter 3: Interactive Theorem Proving.

[HoS94]

Martin Hofmann, Thomas Streicher. The groupoid model refutes uniqueness of identity proofs. Proceedings, Ninth Annual IEEE Symposium on
Logic in Computer Science. pp208–212. Paris, France. July 1994. IEEE
Computer Society Press.

[Hof95]

Martin Hofmann. Extensional concepts in intensional type theory. PhD
Thesis. University of Edinburgh. CST-117-95.
249

[Hue75]

Gérard Huet. A Unification Algorithm for Typed W -Calculus. TheoreticalComputer Science 1, pp27—57. 1975.

[Hue97]Gérard Huet. The Zipper. Journal of Functional Programming Vol. 7, No.
5, pp549–554. 1997

[Jau97]

M. Jaume. Unification : a Case Study in Transposition of Formal Properties. In Supplementary Proceedings of the 10th International Conference on Theorem Proving in Higher Order Logics: Poster session
TPHOLs’97. E.L. Gunter and A. Felty, editors. pp79–93. 1997.

[KST94]

Stefan Kahrs, Donald Sannella, Andrzej Tarlecki. The Definition of Extended ML. LFCS Technical Report 94-300, University of Edinburgh.
1994.

[LP92]

Zhaohui Luo, Robert Pollack. The L EGO proof development system: auser’s manual. LFCS Technical Report 92-211, University of Edinburgh.
1992.

[Luo94]Zhaohui Luo. Computation and Reasoning: A Type Theory for Computer Science. 1994. Oxford University Press.

[Mac71]

Saunders MacLane. Categories for the Working Mathematician.
Springer Verlag GTM 5. 1971.

[Mag94]

Lena Magnusson. The implementation of ALF—A Proof Editor basedon Martin-Löf’s Monomorphic Type Theory with Explicit Substitutiton.
PhD thesis, Chalmers University of Technology, Göteborg. 1994.

[Man76]

E. Manes. Algebraic Theories. Springer-Verlag GTM 26. 1976.

[MW81]

Zohar Manna, Richard Waldinger. Deductive Synthesis of the Unification Algorithm. Science of Computer Programming, 1:5–48. NorthHolland. 1981.

[MS94]

P. Manoury, M. Simonot. Automatizing Termination Proofs of Recursively Defined Functions. Theoretical Computer Science, 135, pp319–
343. 1994.

[M-L71a]

Per Martin-Löf. An Intuitionistic Theory Of Types. Manuscript, 1971.

[M-L71b]

Per Martin-Löf. Hauptsatz for the Intuitionistic Theory of Iterated Inductive Definitions. Proceedings of the Second Scandinavian Logic Symposium. North Holland. 1971.

[M-L75]Per Martin-Löf. An Intutionistic Theory Of Types: Predicative Part. In
H. Rose and J.C. Shepherdson, editors, Logic Colloquium ’74. NorthHolland. 1975.

[M-L84]

Per Martin-Löf. Intuitionistic Type Theory. Bibliopolis, 1984.
250

[McB70]

Fred McBride. Computer Aided Manipulation of Symbols. PhD thesis,the Queen’s University of Belfast, 1970.

[McB92]

Conor McBride, Chris McBride. POLYSEMY: LISP with ambigous pattern matching and first class local definitions. Experimental implementation. 1992.

[McB96]

Conor McBride. Inverting Inductively Defined Relations in LEGO.
Types for Proofs and Programs, International Worskshop TYPES ’96.
Springer-Verlag LNCS 1512. pp236–253.

[MP67]

J. McCarthy, J.A. Painter. Correctness of a compiler for arithmetic expressions. Mathematical Aspects of Computer Science, pp33–41. AMS,
1967.

[McC67]

John McCarthy. A Basis for a Mathematical Theory of Computation. Computer Programming anf Formal Systems, P. Braffort and D.
Hirschberg editors. North Holland Publishing Company. 1967.

[Mil91]

Dale Miller. A Logic Programming Language with Lambda-Abstraction,
Function Variables and Simple Unification. Journal of Logic and Computation 2/4, pp497–536. 1991.

[Mil92]

Dale Miller. Unification Under a Mixed Prefix. Journal of Symbolic
Computation 14, pp321–358. 1992.

[MTH90]Robin Milner, Mads Tofte, Robert Harper. The Definition of Standard
ML. The MIT Press, 1990.

[Mog91]

E. Moggi. Notions of computation and monads. Information and Computation, 93(1). 1991.

[Muñ96]César Muñoz. Dependent Types with Explicit Substitutions: A Metatheoretical development. Types for Proofs and Programs, International
Worskshop TYPES ’96. Springer-Verlag LNCS 1512. pp294–316.

[NN96]

Wolfgang Naraschewski, Tobias Nipkow. Type Inference Verified: Algorithm W in Isabelle/HOL. Types for Proofs and Programs, International
Worskshop TYPES ’96. Springer-Verlag LNCS 1512. pp317–332.

[Nor88]Bengt Nordstrom. Terminating General Recursion. BIT, Vol. 28, pp605–
619. 1988.

[P-M92]Christine Paulin-Mohring. Inductive Definitions in the System Coq:
Rules and Properties. In Proceedings TLCA, 1992.

[P-M96]

Christine Paulin-Mohring. Définitions Inductives tn Théorie des Typesd’Ordre Supérieur. Habilitation Thesis. Université Claude Bernard (Lyon
I). 1996.

[Pau85]

Verifying the Unification Algorithm in LCF. Science of Computer Programming, 5:143–169. North-Holland. 1985.
251

[Pau86]

Lawrence Paulson. Constructing recursion operators in intutionistic typetheory. Journal of Symbolic Computation (2), pp325–355. 1986.

[Pau87]

Lawrence Paulson. Logic and computation: interactive proof with Cambridge LCF. Cambridge Tracts in Theoretical Computer Science, Vol. 2.
CUP. 1987.

[Per99]Henrik Persson. An Abstract Development of the Polynomial Ring in
Agda. In Type Theory and the Integrated Logic of Programs, Doctoral
Thesis. Chalmers University of Technology, Göteborg. 1999.

[Poll94]

Erik Poll. A Programming Logic Based on Type Theory. Doctoral Thesis. Technische Universiteit Eindhoven, 1994.

[Pol90]Robert Pollack. Implicit Syntax. In preliminary Proceedings, 1st workshop on Logical Frameworks, 1990.

[Pol94]Robert Pollack. Incremental Changes in LEGO: 1994. LFCS Report.
University of Edinburgh.

[Pra65]

Dag Prawitz. Natural Deduction—A proof theoretical study. Almquist
and Wiksell, Stockholm. 1965.

[Pym90]David Pym. Proofs, Search and Computation in General Logic. PhD
Thesis. University of Edinburgh. 1990.

[Pym92]David Pym. A Unification Algorithm for the W£ -Calculus. International
Journal of Foundations of Computer Science Vol. 3 No. 3, pp333–378.
1992.

[Rob65]

Alan Robinson. A Machine-oriented Logic Based on the Resolution
Principle. ACM, 12:23–41. 1965.

[Rou92]

Joseph Rouyer. Développement de’algorithme d’unification dans le Calcul des Constructions avecs types inductifs. Technical Report 1795,
INRIA-Lorraine. November 1992.

[SH95]

Amokrane Saı̈bi and Gérard Huet. Constructive Category Theory. In Proceedings of the joint CLICS-TYPES Workshop on Categories and Type
Theory, Göteborg, Sweden. 1995.

[SSB99]Masahiko Sato, Takafumi Sakurai, and Rod Burstall. Explicit Environments (Extended abstract). 1999.

[Sau16]

Ferdinand de Saussure. Cours de Linguistique Générale. 1916.

[SP94]

Paula Severi, Erik Poll. Pure Type Systems with Definitions. In LFCS
’94. Springer-Verlag LNCS 813, pp316–328. 1994.

[Sli97]

Konrad Slind. Function Definition in Higher-Order Logic. In Theorem
Proving in Higher-Order Logics. 9th International Conference, TPHOLs’96. Springer-Verlag LNCS 1125. August 1996.
252

[Str93]

Thomas Streicher. Investigations into intensional type theory. Habilitiation Thesis, Ludwig Maximilian Universität. 1993.

[Tak95]

M. Takahashi. Parallel reductions in W -calculus (Revised version). Information and Computation. 118(1), pp120–127. 1995.

[TS83]

Hisao Tamaki, Taisuke Sato. A transformation system for logic programs
which preserves equivalence. ICOT TR-018. 1983.

[Ter95a]D. Terrasse. Encoding Natural Semantics in Coq. Fourth International Conference on Algebraic Methodology and Software Technology,(AMAST ’95). Springer-Verlag LNCS. July 1995

[Ter95b]

D. Terrasse. Vers un environnement de developpement de preuves en Semantique Naturelle. PhD thesis, École Nationale des Ponts et Chaussées(ENPC). October 1995.

[Tur95]David Turner. Elementary strong functional programming. Proceedingsof the first international symposium on Functional Programming Languages in Education. Springer-Verlag LNCS 1022. 1995.

[Wad87]

Philip Wadler. Views: A way for pattern matching to cohabit with data
abstraction. 14th ACM Symposium on Principles of Programming Languages, Munich, January 1987.

253

Indexºç¨©%ª,« ‘triangle telescope’, 50‘is sugar for’, 101
datatypes» ‘empty type’, 104¼ ‘unit type’, 104‘boolean type’, 104¢ ‘sum type’, 104½ ¾¿4µ À?Á
recordsµ{ ²Â ‘record as tuple’, 101Ã ¾¿4À?ÁYÓ ‘projection’, 102
aYw² µ ‘open with official names’, 102
aÄ \ Yw² ‘open with local names’, 102
sigma types
ÔÔ\¢dq3 ‘fake -binding’, 105
W ‘non-dependent product’, 105
7±<µJ%² ‘pair’, 105Ôµ 3 ‘tuple type’, 105
 ± ‘tuple’, 105
equalities¶ , see equality
Ä , see equality
concrete categories‘categorical arrow’, 185gµ ‘arrow composition’, 185
8 ‘arrow equality’, 185‘identity arrow’, 185
 =êw  ‘object/arrow interpretation’,185
concrete monadsí ‘monad arrow’, 190
=Ü ‘monad bind’, 188‘monad composition’, 190Ü ‘monad embed’, 190
 =êw  ‘arrow interpretation’, 190
7ê-ëêw ‘knockout’, 200, 218npmA}ArE~ operations
 ‘npmA}Ar3~ composition’, 219
 ‘nmA}ArE~ interpretation’, 219

property indicatorsd ‘type’, 18{ ‘value’, 18
8 ‘guess’, 28binding operators\d<3 ‘universal quantification’, 18
W]\Òd3 ‘functional abstraction’, 18,¤ 27\L{·±d'3 ‘local definition’, 18, 27®
\¢dq3 ‘hole component’, 27®
\%8»ÚNd'3 ‘hole with guess’, 27
contexts¥  ‘empty context’, 19, 28
JI¦ ‘context extension’, 19, 28§‘information order’, 32
judgments¥ ¨5©
judgment’, 19ª « ‘core©
‘development judgment’,28¬
computation‘syntactic identity’, 18­¯® ‘contraction’, 21, 30­ ® ‘one-step reduction’, 21, 30° ‘many-step reduction’, 20±{ ‘conversion’, 20²‘cumulativity’, 21, 24
positionsµ ‘trivial position’, 31FK³ J\F t ‘position composition’, 31F ‘context from position’, 31Fl Ú ‘put at position’, 31§‘information order’, 34u²\´\ ‘substitution’, 18
telescopesµ² µ ‘sequence’, 47û ‘telescope’, 47y¸ ¶· ç ‘free telescope’, 50µ ê(¹ Ó ‘iteration’, 49û² ‘application’, 48

{-,

254

abandon, 38
abstraction for rewriting, 60, 76
Ackermann’s function, 67, 181npmA}ArE~ , 219
C
}Ar3~ category, 219
C
ED , 213
aperture, 55
assume, 38
attack, 39

constructor form, 129
unification problem, 129
constructors, 89
contexts, 19
contraction schemescore, 20, 21
development, 30
conversion, 24
covering, 155, 156
elementary, 156
empty, 177
equations, 175
exact, 175
cumulativity, 21, 24
cut, 38
cut property, 23
cycle, 129, 130, 145Å-reduction, 20
bindings, 17
fatuous, 18
blue plastic hammer, 43
blunderbuss, 106, 142, 165Ðpoj , 217, 220Ðoj c-¡ , 222¼boolean type, see&,c[ , 213ÆÇ-reduction, 20
discharge, 43, 44
downward-closed constraint, 212

À?À
¶ , 163

case analysis, 57, 108
category, see concrete category
8mAm , 1258½Í , 230, 233½Í( c-¡ , 234
Church-Rosser, 23
claim, 34, 38
Clark completion, 57
¼mAr34 , 212
closed constraint, 212

eliminate, 71–78
elimination rule, 53
aperture, 55
case data, 56
case patterns, 56
cases, 56
datatype, 89
indices, 55
inductive hypotheses, 56
patterns, 55
recursive calls, 56
scheme, 55, 63–71, 75
target, 55, 61–63,73
empty type, seeequality
John Major, 119
Martin-Löf, 118
propositional, 54¶ , 54, 119construction from Ä , 124mA}Ao , 119  c[p-mA}Ao , 120
ñ°ÐprE~ ç , 121~c}Ap ç , 122
Ä , 118, 36
coalescence, 75
coalescence, 129, 130, 136
compatible closure
core, 20, 21
development, 30
components, 27¼c8~  , 185
concrete category, 184, 185from a family, 186of types, 186
concrete monad, 189
conflict, 129, 130, 136constraints, 65
friendly, 70
unfriendly, 70
255construction from ¶ , 124}?mA}Ao , 118}?ñ°ÐprE~ , 118~}?c}Ap , 119p} ¡ , 215

strong, 99
weak, 70, 100
inductive datatypes, 87
dependent families, 96
parameterised, 92
records, 101
simple, 89
with higher-order constructors, 94
inductively defined relations, 98
injectivity, 129, 130, 136
intro- ¤ , 39
intro- , 39
inversion, 57-reductions, 89
iterated sequence, 49
iterated telescope, 49

faithful functor, 185
X¶· , 97, 163
y¶· ÈÉÊ , 115,
¿4Ì 163, 115, 163
y¶· ÈÉÊ Ë ¿y¶·zÍEÀ?Ð ¶Î , 108y¶·jÏ Ð · , 97y¶·j Ê , 115, 163
familyindexed, 50
type, 50
Fibonacci function, 110
fields, 101b]c , 96bc-mA}Ao , 96
fixpoint, guarded, 110, 113
folding, 71, 159
Ford, Henry, 63
free pattern, 156qZo , 216, 220c8~  , 187
functor, 187

J rule, 118
judgments
core, 19development, 28
justify, 38
K rule, 119
Kleisli
category, 189
triple, 188/-mA}ArEmA} , 191
knockout, 200, 218
Í°cÍ°~% c-¡ , 218r , 231
guarded, 111
guarded fixpoint, 110, 113
guess, 28no , 193
lengthening, 159, 181
À , 71, 99
ÀÞ-mA}Ao , 99
1 , 57
Clark completion, 57
Clark-style inversion, 57
1 c-¡ , 58, 64
weak
induction principle, 70¤-reduction, 20
lexicographic
recursion, 181
}Aq ~ , 194
mA}Aq~ , 194
mA}Aq ~+ c-¡ , 195
mA}ArE~ , 93
mA}Ar3~ mA}Ao , 57, 93

halting problem, 177, 179
hole,® 25-binding, 28
life of, 34
hubris, 108, 113
identity,
129, 130, 136
Ñ Ì[Á
,Ñ Ì[
89Á
¿4Ì
Ñ Ì[Á ÈÉÊ , 113, 113
Ñ Ì[Á ÈÀ?ÉÐ Ê ËÑ Ì[Á Ï Ð · , 91
 Ê , 113
indentifiers, 17
indexed family, 50
induction principle
256

Major, John, 119oÂn[Ò  }A~ Ï , 154
mantraabout blocking computations, 61
about contexts, 20
about decomposition, 56
about recursion, 241
about the means, 53òn=}AoÎnpm , 213oÂnÏÐ , 104oÂnÏÐ , 187oÂnÏÐNò , 191
mgu, 133oj , 216, 220o c-¡ , 221òcn , 190
monad, 188
most general unifier, 133

postpone, 38
program, 167
property, 18
propositional equality, 54
pure, 28
raise- ¤ , 39
raise- , 39
records, 101
opening, 102
projection, 102regret, 34, 38
ï_cnoÈ , 193, 201–210
renaming, 194
replacement
fails in general, 25
for partial constructions, 31
retreat,39
Ö ¿K× Ö Ì
É , 163
return, 171
rhubarb, 63, 66

naı̈ve-refine, 40, 90 CC [= , 112[=nÓ÷c , 113ºnrE , 108
-mA}Ao , 91
}?= , 113l , 59, 78–86
introduction rules, 85
-  c-¡ , 60, 83
-pï_Ê , 59, 81ºÏ8mA , 232~
c}Ab] , 222

rEnpoåc8~  , 188

scheme, 55, 63–71, 75
sequence, 47
iterated, 49
Ô-types, 103
solve, 34, 38
split, 168
spot, 102
state information order, 32
states, 27
strengthening, 23
strong induction principle, 99
strong normalisation, 23
strongly normalising, 24
subject reduction, 23
ñ°ÐrE~+ò , 201–210
substitution, 129, 130, 136
ñ°ÐrE~+ò , 193
sum type, see ¢syntactic identity, 18
syntaxcore, 18
development, 27

obviously empty, 178
optimism, 212_
ó~ }AoÈ}ArE~ , 213Ô , 94ÕpmA}Ao , 95partial constructions, 27
patterns, 55
Peanoconcerto, 137
postulates, 58ópmAr , 159
ópr , 231
position information order, 34
positions, 30, 31

tacticabandon, 38257

development, 29

assume, 38
attack, 39
blunderbuss, 106
claim, 38cut, 38
deletion, 44
discharges, 44
eliminate, 71–78
intro- ¤ , 39
intro- , 39
justify, 38naı̈ve-refine, 40
permutation, 44
postpone, 38
program, 167
raise- ¤ , 39
raise- , 39regret, 38
retreat, 39
return, 171
solve, 38
split, 168try, 38
unify, 41
unify-refine, 42
target, 55, 61–63, 73
telescope, 47
application, 48
free, 50
iterated, 49
telescopic
equation, 65
substitution, 121
uniqueness, 122
terms, 17~ ½c , 231~ ½}AÍ , 196–199~ ½}AÍ( c-¡ , 199~ ½}Ac , 196~  , 211
triangle, 50
try, 34, 38
type family, 50
type former, 89
type inference rules
core, 22, 24

unfolding, 71, 159
unification problem, 129
unifier,133~c}Abr , 216
unify, 41
unify-refine, 42»unit type, seeuniverses,
17~cmAn , 217¡_8~ , 104vlast¡mAnrE~ , 172¡~ np}Am , 128

weak induction principle, 70, 100

258