Hormonas de crecimientos

Before giving the construction of the elimination rule which performs the job of COQ’s

Fix construct, let us look at an example which motivates both the need for it and the manner in which it is done.

It is that famous old troublemaker: the Fibonacci func- tion, which is used for counting rabbits, drawing at- tractive rectangles and making Euclid’s algorithm go as slowly as possible: ¢–£ S ‡ = S ¢–£ = S ‡ = S ¢–£ =?= G ‡ ¤ f¥¦= ™ ¢–£ G Ÿ™ ¢–£ = G Ÿ

Let us see what goes wrong if we just blunder in with88:§pfg¨ ,

trying to mimic this definition. Here is the initial state, with the return type decorated by †

-binding, so we can see what is happening. †© g £ ‡ Y D 88ªJM88 D 88$ƒ«LMNPORQ X ¢¬£ D­EHG4D 88 © g £ G Let us eliminateG . Again, the †

-binding tracks the arguments. We can certainly fill in

¢–£A®

. Now watch what happens when we eliminate again to split the successor case:

X ¢–£A® D © g £ S X ¢–£°¯ D}EŠG D 88 EF±e²M³ŠD © g £ G © g £ = G The © g £ = S

case is fine, but for double-successor, disaster has struck! We have our

© g £ = G safely enough, but what has happened with ©

g

£

G

? It has appeared, all right, but in the wrong place—we have no hope of accessing it.

X ¢–£A¯® DVE*±­² ® D © g £ S © g £ = S X ¢–£A¯1¯ DVEHG D 88 EH´Rµ·¶¸DVE*±e²7³ŠD © g £ G © g £ = G E*±­² ¯ ³ D © g £ = G © g £ =?= G

Of course, the classic definition of the Fibonacci function is famous for its abominable run-time.4 _{The traditional remedy is to write a linear recursion computing a pair of}

successive values. In [BD77], Burstall and Darlington transform the above definition into the following more efficient form:

¢¬£ S ‡ = S ¢¬£ = S ‡ = S ¢¬£ = = G ‡ ™ ¢¬£ =?= G ŸV“¹ºx1»y” J ¤ f¥y= ¹¼» ¢–£ =?= S ‡ ½ = S·¾ = S·¿ ¢–£ =?= = G ‡ ™ ¢¬£ =?= G ŸV“¹ºx1»y” J ½ » ¾ ¤ f¥y= ¹À» ¿

By design, the auxiliary function =?= computes exactly the information required to

complete the double-successor case, and it does so by a one-step recursion. The main function is thus reduced to a case analysis.

In [Gim94], Gim´enez effectively generalises this technique to an encoding of recursion on guarded arguments, and it this technique which I present below.

DEFINITION: guarded

Á

if9@š› is a datatype constructor with non-recursive arguments

^  and recursive arguments ^  , then each d is guarded 5_(by 9<š› ) in9@š› ^  ^  Á if is guarded in„ and„ is guarded inÃ, then  is guarded inÃ

The idea is to introduce an intermediate data structure which stores for each input the recursive values we need to compute the output. We may code this up as an elimination rule:

CÄDsEHGÅD 88ªJMLMNPOQ ÆIÇ_È C G J7J7JVJ7J7J7JVJ7J CWG E GÅD 88 J CWG

Once we have applied this rule, case analysis onG

allows us to split the subgoal into cases for the separate patterns we wish to treat: for each patternz

, we must prove C

z

using the information supplied in

ÆIÇ_È

C

z

.

Of course, to prove this rule, we shall have to be able to show

EHGÉD 88ªJ

ÆIÇ·È

C

G

This proof will go by recursion onG

: we must generate the auxiliary information for

=

G

from the corresponding information for

G

. Just as in the Fibonacci function, we may carry over any information we need to keep, together with computing the new value in exactly the same way as the ‘main’ function does.

What should

ÆIÇ_È

C

be? Different depths of recursion necessitate different amounts of auxiliary information. For Fibonacci, we may choose

Ê ¥yËsÌ_dÎÍ S ‡ ÏÏ Ê ¥yËsÌ_dÎÍU= S ‡ ÏÏ Ê ¥yËsÌ_dÎÍ·=B= G ‡ ™ © g £ G Ÿ]Ð(™ © g £ = G Ÿ 5_{more carefully, if}

ÑÒ is a higher-order recursive argument of typeÓ·Ô Õ4Ö Ô ×ÙØ , then it isÑÒÚÔ Õ which is guarded, for anyÔ

Stylish users may choose to develop their auxiliary data structure as they develop their function, for each follows the case analysis of the other.

More generally, we may give a single auxiliary structure suitable for all occasions. Gim´enez defines it inductively for a parametricC

: 88 Ê ¥yËsÛ(;Ah; C S CÜG 88 Ê ¥yˬÛ(;4h; C G 88 Ê ¥¦ËsÛ(;Ah1; C = G

For each datatype, the auxiliary mimics the constructors and recursion pattern. Each recursive argument is decorated with a

C

proof, so that for each element of the original type, the auxiliary stores

C

for all its proper subterms. Proofs of

EHGÉD 88ªJ ™ 88 Ê ¥yˬÛ(;4h; C = G Ÿ ƒ CWG

then go by case analysis on88

Ê

¥yˬÛ:;Ah; , at the same time splitting the88 -patterns and

surfacing the recursions for the exposed subterms.

My treatment differs only pragmatically, in that I compute the auxiliary structure rather than defining it inductively.

88 Ê ¥yË C S ‡ ÏÏ 88 Ê ¥yË C = G ‡ ™ CÜG Ÿ]Ð(™ 88 Ê ¥yË CÜG Ÿ

As case analysis feeds88

Ê

¥yË constructor expressions, it unfolds like one of those wal-

lets for people with too many credit cards, revealing the proofs of C

for the exposed subterms. The blunderbuss tactic can be used to extract the required hypothesis, pro- vided it can be identified from its type.

Let us try to prove

EHGÉD 88ªJ788 Ê ¥¦Ë CÜG by induction onG

. The base case is trivial. The step case is

EHGÉD 88ªJ ™ 88 Ê ¥yË CÝG Ÿ ƒ«88 Ê ¥yË C = G which reduces to EHGÉD 88ªJ ™ 88 Ê ¥yË CÝG Ÿ ƒ ™ CÝG ŸsÐޙ 88 Ê ¥¦Ë CWG Ÿ

We can clearly establish the second component of the pair. This leaves the requirement EHGÉD 88ªJ ™ 88 Ê ¥yË CÝG Ÿ ƒ CÜG

Again using the ‘hubris’ technique, we may postpone and dis- charge this subgoal, we have the auxiliary generation lemma

88 Ê ¥yˬßà>› : EHGÉD 88ªJ ™ 88 Ê ¥yË CÝG Ÿ ƒ CÜG EHGÅD 88ªJM88 Ê ¥yË CWG

and hence the elimination rule88

© gË . 88 © gË CÄDsEHGÉD 88KJ7LMNPORQ 88 Ê ¥yË CWG J7JMJ7JMJ7JMJMJ7J7JVJ CÝG E GID 88 J CÜG

I shall give the general construction for simple types, then discuss extensions.

CONSTRUCTION: guarded fixpoint

Consider an inductive family of datatypes withá constructors as shown right.

The ^

Â

are non-recursive and the ^

ž

are �

recursive arguments. Let ãåäyæ mŠoq\

be its standard elimination rule.

ãåäyæ D LMNPORQ ^  D ^ ç œ ^ ž D_è ãäyæêé*ëíì 9@š›•œ ^  ^ ž D ãåäyæ

Let us fix the components to be supplied by the user and make holes for the components to be supplied by machine. A † - binding ãåäyæ ƼîHï helps us track the development ofãåäyæ

ÆIÇ_È . Y C DeE ž D ãä¦æºJMLMNPORQ † ãäyæ ƼîHï ‡ Y ž D ãåäyæÙJVLMNPORQ X]ãäyæ ÆIÇ·È DeE ž D ãä¦æ ãåäyæ ƼîHï ž Ycð¦ñpò µ DeE ž D ãä¦æ E Â~ó¬ž D ãä¦æ ÆKÇ_È ž C ž X]ãäyæ ÆIÇ·È_ôõ‚ ä DeE ž D ãä¦æ ãåäyæ ÆKÇ_È ž X]ãäyæ Z¬qÈ D E ž D ãä¦æ C ž

We may immediately proveãä¦æ Z¬qÈ with ãåäyæ Z¬qÈ<‡ Y ž D ãåäyæêJ?ð¦ñ_ò µ žÝ™ ãä¦æ ÆKÇ_È_ôõ‚ ä žŸ

Now let us eliminate thež

in both the auxiliary and its generator, aquiring a subgoal for each constructor. One is enough to illustrate the point, and reduces the subscript terror.

XFãåäyæ ÆIÇ_Ȋöø÷ DeE ^  D ç E ^ ž D¬è ãåäyæêé*ë E ^ ù D¬è ãåäyæ ƼîHï ž dé ë d ãåäyæ ƼîHï ™ 9@š› ^  ^ žRŸ † ãåäyæ ÆIÇ_È ‡ ãåäyæ mpoq\ ãåäyæ ƼîHï ãåäyæ ÆKÇ_È~öø÷ ³ J7J7J XFãåäyæ ÆIÇ_È·ôà‚ ä öø÷ ³ DeE ^  D ^ ç E ^ ž D¬è ãä¦æêé ë E ^ à D¬è ãä¦æ ÆKÇ_È ž dé ë d ãåäyæ ÆKÇ_ÈHö÷ ³ ^  ^ ž ^ à † ãåäyæ ÆIÇ_È·ôà‚ ä ‡ ãåäyæ mpoq\ ãåäyæ ÆKÇ_È ãä¦æ ÆKÇ_È_ôõ‚ ä öø÷ ³ J7J7J To buildãåäyæ ÆKÇ_ÈHö÷ ³

, we introduce the arguments and return the iteratedú

of pair-types collecting, for each recursive argumentž

d, both C ž d and ù d,

which the lovely let-binding reminds us is reallyãåäyæ ÆIÇ_È ž d. For ãåäyæ ÆIÇ_È·ôà‚ ä öø÷ ³

, we introduce the arguments and return the corre- sponding iterated tuple of pairs, passing on the accumulated proof Ãød and

adding the next layer, computed byð¦ñ_ò

µ . † ãåäyæ ÆIÇ_Ȋöø÷ ³ ‡ Y ^  D ^ ç Y ^ ž D¬è ãäyæêé ë Y ^ ù D¬è ãäyæ ƼîHï ž d1é ë d ú è ™ C ž d ŸsÐ ù dé ë d † ãåäyæ ÆIÇ_È·ôà‚ ä öø÷ ³ ‡ Y ^  D ^ ç Y ^ ž Dsè ãåäyæêé ë Y ^ à Dsè ãåäyæ ÆIÇ_È ž dé ë d û èŠü ð¦ñpò µ ž dŠÃd x Ãdøýé7ë dMþ † ãåäyæ ÆIÇ_È·ôà‚ ä ‡ ãåäyæ mŠoq\ ãåäyæ ÆIÇ_È ãåäyæ ÆKÇ_È·ôà‚ ä öø÷ ³ J7J7J Cuttingãåäyæ ƼîHï

and the proofs of the subgoals, then discharging the fixed hypotheses, we are left with

ãåäyæ J7JMJ D­EC:D}E ž D ãä¦æêJ7LMNPORQ E ž D ãä¦æ LMNPORQ † ãåäyæ ÆIÇ_È·ôà‚ ä ‡ J7JMJ D­EC DVE ãåäyæ D ž JMLMNPORQ E ð¦ñ_ò µ­DVE ž D ãä¦æ E Â~ó¬ž D ãä¦æ ÆKÇ_È ž C ž E ž D ãåäyæ ãåäyæ ÆKÇ_È ^ ž † ãåäyæ ZsqÈ ‡ JMJ7J DeEjC D}E ž D ãåäyæÙJMLMNPOQ E ð¦ñpò µeD}E ž D ãåäyæ E Â~ó¬ž D ãåäyæ ÆIÇ_È ž C ž E ž D ãäyæ C ž CÄDsE ž D ãä¦æêJ7LMNPORQ ãåäyæ ÆIÇ_È C ž JMJ7JMJ7JMJMJ7J7JVJ7J7J7J C ž E ž D ãåäyæ J CWG

The following conversions hold:

ãåäyæ ÆKÇ_È C ™ 9@š› ^  ^ žRŸõÿ ‡ ú è ™ C ž d Ÿ]Ð:™ ãåäyæ ÆIÇ_È C ž d Ÿ é ë d ãåäyæ ÆKÇ_È·ôà‚ ä C ™ 9@š› ^  ^ žRŸ ÿ ‡ ü‘èŠü ãåäyæ ZsqÈ C ž d x ãåäyæ ÆKÇ_È·ôà‚ ä C ž døý}é*ë d ý ãåäyæ Z¬qÈ C ž ÿ ‡ ™ ãä¦æ ÆKÇ_È_ôõ‚ ä C žRŸŠž

For dependent families

ZF[4\

, we have exactly the same construction, replacingãäyæ by Z][4\

or some

ZF[4\ ^`

Y C DE­^ ž D JMLMNPORQ † Z][4\àƼîHï ‡ Y ^ ž D ZF[4\ JMLMNPORQ † Z][4\àÆIÇ_Èpöø÷ ³ ‡ Y ^  D ^ ç Y ^ ž D¬è ZF[A\ ^ „ dé ë d Y ^ ù D¬è ZF[A\WƼîHï ^ „ d x1ž dé ë d ú è ™ C ^ „ d x1ž d Ÿ]Ð ù d1é ë d †

Z][4\àÆIÇ_È ‡ˆZ][4\‰mŠoq\ ZF[A\WƼîHï ZF[A\WÆKÇ_Èpöø÷

³ J7J7J Y¬ð¦ñ_ò µ DEe^ ž D ZF[A\ E Âcó¬ž D ZF[A\àÆIÇ_È ^ ž C ^ ž †Z][4\àÆIÇ_È·ôà‚ ä öø÷ ³ ‡ Y ^  D ^ ç Y ^ ž D¬è ZF[4\ ^ „ d1é ë d Y ^ à D¬è ZF[4\àÆIÇ·È ^ „ d x1ž dé ë d û èŠü ™ ð¦ñpò µ ^ „ d xž dŠÃd Ÿx Ãdý}é ë d þ † Z][4\àÆIÇ_È·ôà‚ ä ‡ˆZ][4\‰mŠoq\ ZF[A\WÆKÇ_ÈÉZF[A\WÆKÇ_È_ôõ‚ ä öø÷ ³ JMJ7J †Z][4\‰ZsqÈ ‡ Y ^ ž D ZF[4\ JBð¦ñ_ò µ ^ žÝ™ ZF[4\àÆIÇ·È_ôõ‚ ä ^ žRŸ

If we have higher-order recursive arguments, we must abstract the pairs over them:

† ãäyæ ÆIÇ·È÷ ‡ J7JMJ Y ž DVE ^ D ^ J*ãåäyæ J7JMJ Y ù DVE ^ D ^ J*ãåäyæ ƼîHï ™ž ^ Ÿ ú JMJ7J E ^ D ^ J ™ C ™ž ^ ŸBŸ]Ð:™ ù ^ Ÿ † ãäyæ ÆIÇ·È_ôõ‚ ä }÷?‡ J7JMJ Y ž DVE ^ D ^ JFãåäyæ J7JMJ YÚà DVE ^ D ^ JFãåäyæ ÆIÇ_È ™ž ^ Ÿ J7J7JY ^ D ^ J ™ ð¦ñ_ò µ ™Îž ^ Ÿ™ à ^ ŸBŸxF™ à ^ Ÿ

Now that we have built these useful elimination rules, let us move on to consider the technology we need to solve the constraints which arise when we use them for depen- dent subfamilies.