Documente Academic
Documente Profesional
Documente Cultură
ROBERT CARTWRIGHT
Computer Science Department, Rice University, Houston, TX 77005-1892
JIM DONAHUE
Xerox Palo Alto Research Center, Palo Alto, CA 94304
Abstract. Lazy evaluation has gained widespread acceptance among
the advocates of functional programming. The implementation of lazy
evaluation is easy to describe but its semantic consequences are deceptively complex. This paper develops a comprehensive semantic theory of
lazy data domains and explores several approaches to formalizing that
theory within a programming logic. In the process, the paper presents
four interesting results.
First, there are several semantically distinct definitions of lazy evaluation that plausibly capture the intuitive notion. The differences
among the various definitions are significant; simple programs produce different results under the different definitions.
Second, non-trivial lazy domains are similar in structure (under
the approximation ordering) to universal domains such as the P
and T [Plot78] models of the untyped lambda calculus. In fact,
both P and T are isomorphic is simple lazy data domains.
Third, we prove that equational specifications do not have the
power to define lazy domains. This result establishes a fundamental limitation on the power of equational theories as data type
specifications.
Fourth, although lazy domains have the same higher-order structure as universal domains such as P , they nevertheless have an
elegant, natural characterization within first order logic. In this
paper, we develop a simple, yet comprehensive first order theory
of lazy domains which subsumes LCF.
A forerunner of this paper appeared in the Proceedings of the 1982 ACM Conference on
LISP and Functional Programming under the title The Semantics of Lazy Evaluation.
This research was partially supported by NSF grants MCS-8104209, MCS-8403530 and
by Xerox Corporation.
1
1. Introduction
Since the publication of two influential papers on lazy evaluation in 1976
[Hend76, Frie76], the idea has gained widespread acceptance among the
advocates of functional programming [Hend80, Back78]. There are two basic
reasons for the popularity of lazy evaluation. First, by making some of the
data constructors in a functional language non-strict, it supports programs
that manipulate infinite objects such as recursively enumerable sequences,
making some applications easier to program. Second, by delaying evaluation
of arguments until they are actually needed, it may speed up computations
involving ordinary finite objects.
Despite the popularity of lazy evaluation, its semantics are deceptively
complex. Although the implementation of lazy evaluation is easy to describe, its semantic consequences are not. In lazy domains, the existence
of infinite objects nullifies the usual principle of structural induction for
program data. Replacing conventional data constructors by their lazy counterparts radically alters the topological structure of the data domain. As
a result, reasoning about programs defined over lazy domains is a subtle,
often counterintuitive endeavor. Many simple theorems about ordinary data
objects do not hold in the context of lazy evaluation. For example, although
the function reverse reverse is the identity function on ordinary linear lists,
it does not equal the identity function in the context of lazy evaluation;
applying reverse to an infinite list yields the undefined object . In response to these issues, this paper develops a comprehensive semantic theory
of lazy data domains and explores several approaches to formalizing that
theory within a programming logic. In the process, the paper presents four
interesting new results.
First, there are several semantically distinct definitions of lazy evaluation
that plausibly capture the intuitive notion. In contrast to the implementationoriented approaches in the literature, we define lazy evaluation as a change
in the value space over which computation is performed. We use a small collection of constructors from denotational semantics [Scot76, Scot81, Scot83]
to build abstract value spaces that correspond to the meanings of computations using various lazy constructors. Our abstract approach to defining
lazy domains accommodates several different interpretations of the informal
concept of lazy lists developed in the literature [Frie76, Hend76]. The differences among the various interpretations are significant; simple programs
produce different results under the different interpretations.
Second, non-trivial lazy domains are similar in structure (under the approximation ordering) to universal domains (as defined by Scott [Scot76])
such as the P and T [Plot78] models of the untyped lambda calculus.
Specifically, we show that P is isomorphic to the simple lazy domain
where Triv is the trivial data domain consisting of two objects {, T} and
denotes the Cartesian product of two sets. Moreover, the primitive
operations on TrivSeq corresonding to the the primtive operations of P
({0, suc, pred, ifthenelse, K, S, apply}) are definable by first order recursion
equations using only the constants T and , the constructor and selector
functions for TrivSeq, and the logical operations and por (parallel or) on
Triv. An analogous relationship exists between T (including an appropriate
set of primitive operations) and the corresponding lazy domain
B = B B
where B is the Boolean data domain consisting of three objects {, T, F}.
Hence, lazy sequences provide an elegant model of the untyped lambda
calculus that is intuitively familiar to most computer scientists.
Third, we prove that equational specifications [ADJ76,77] [Gutt78] do not
have the power to define lazy domains. This result establishes a fundamental
limitation on the power of equational theories as data type specifications.
Fourth, although lazy domains have the same higher-order structure as
universal domains such as P , they nevertheless have an elegant, natural
characterization within first order logic. In this paper, we develop a simple,
yet comprehensive first order theory of lazy domains relying on three axiom
schemes asserting
(1) the principle of structural induction for finite objects;
(2) the existence of least upper bounds for directed sets; and
(3) the continuity of functions.
To demonstrate the deductive power of the system, we show that there is a
simple, natural translation of the higher-order logic LCF [Gord77] into our
first order system. In addition, we derive a generalized induction rule (analogous to fixed point induction in LCF) for admissible predicates called lazy
induction which extends conventional structural induction to lazy domains,
simplifying the proof of many theorems. An instance of this generalized rule
reduces to ordinary fixed point induction.
The remainder of the paper is divided into six sections. Section 2 provides
a brief overview of Scotts theory of data domains [Scot76,Scot81,Scot83].
Section 3 develops the specific machinery required to define the abstract
semantics of lazy data domains. Using this machinery, Section 4 presents
a taxonomy of lazy lists, demonstrating that there are many semantically
distinct data domains that capture the intuitive notion of lazy evaluation.
Section 5 explores various approaches to formalizing our semantic definition
of lazy domains within a logical theory. In the process, we prove that algebraic specification is too weak to accomplish the task and that lazy domains
have the same rich higher-order structure as P . Finally, in Section 6, we
present a simple first order theory for lazy data domains and demonstrate
that it is as least as powerful as the corresponding theory formulated in the
higher-order logic LCF. Section 7 assesses the intuitive significance of our
results and speculates about promising directions for future research.
2. Background
2.1. Mathematical Preliminaries. The following group of definitions rigorously describes our concept of data domain, which is an adaptation and
distillation of several different expositions by Scott [Scot 76,81,83].
Definition 2.1. A partial order is a pair hS, vi consisting of a set S of
objects, called the universe of S, and a binary relation v over S such that
(1) v is reflexive: x S x v x.
(2) v is antisymmetric: x, y S [x v y y v x x = y].
(3) v is transitive: x, y, z S [x v y y v z x v z] .
A subset R S is consistent (in S) iff u S such that r R (r v u);
u is called an upper bound of R. A subset R S is directed iff every finite
subset E R has an upper bound in R. The restriction of the relation v
to the set R is denoted vR .
Notation It is customary to abuse notation and denote a partially ordered
set hS, vi by the symbol S for the universe. In this case, the partial ordering
relation corresponding to S is denoted vS . We will follow this practice
except when more precise notation is necessary for the sake of clarity.
Definition 2.2. A partial order S is complete iff every directed subset R S
(including the empty set) has a least upper bound (denoted tR) in S. The
least upper bound in S of the empty set is denoted . The phrase complete
partial order is frequently abbreviated cpo.
Definition 2.3. Two partial orders A and B are isomorphic (written A v
B) iff there exists a bijective (one-to-one and onto) function h : A B that
preserves the partial ordering on A:
x, y A [x vA y h(x) vB h(y)] .
Definition 2.4. A partial order B is a finitary basis iff
(1) B is countable, and
(2) every finite consistent subset of B (including the empty set ) has a
least upper bound in B.
Definition 2.5. Let S be a partial order. A non-empty subset R S is an
ideal over S iff
(1) R is directed, and
(2) R is downward closed: r R s S s v r s R.
The set of ideals over S is denoted dSe. For every r S, the set r
{s S | s v r} is an ideal in dSe; it is called the principal ideal determined
by r.
Lemma 2.1. The set of ideals over a partial order S forms a cpo hdSe, i
under the subset ordering .
Definition 2.6. Let B be a finitary basis. The domain determined by B is
the cpo hdBe, i.
topological sense). We will use two such domains For example, the domain
of Boolean truth values, consisting of the set
{, T, F}
under the partial ordering vB defined by
x vB y x = y x = .
is a degenerate domain.
An example of a more interesting domain is P , the power set of the
natural numbers under the partial ordering v determined by set inclusion.
The finite elements of P are precisely the finite sets of natural numbers.
2.2. Domain Constructions. In specifying domains, it is often convenient
to construct composite domains from simpler ones. There are two fundamental mechanisms for constructing composite domains: the Cartesian product
construction and the continuous function construction. We will discuss several other constructions later in the paper, but they are all based on these
two mechanisms.
We will define the two constructions without proving that the constructed
domains are well-formed. The interested reader is encouraged to verify that
they are.
Definition 2.11. Given domains A and B with presentations and , the
Cartesian product domain, denoted [AB], is the domain h[A B], v[AB] i
with presentation where A B is the set of pairs
{hx, yi | x A, y B},
v[AB] is the relation defined by
(x1 , y1 ) v[AB] (x2 , y2 ) x1 vA x2 y1 vB y2
and is the enumeration hi | i Ni consisting of all pairs haj , bk i sorted
by rank
(j + k) (j + k + 1)
+ m.
r(j, k) =
2
The bottom element of A B is hA , B i where A and B denote the
least elements of A and B.
Lemma 2.3. [A B]0 v A0 B 0 .
Notation The square brackets appearing in the expression [A B] are
significant because they distinguish the Cartesian product construction on
domains A and B from the standard set-theoretic Cartesian product construction on the universes of these domains. The latter is commonly used to
specify the domains of multi-ary functions. The distinction is important in
domain theory: f : [A B] C is a unary function that maps arguments
from the set [A B] into C while g : A B C is a binary function that
takes two arguments x A and y B and produces a result in C.
The second fundamental domain construction is the formation of the domain of approximable maps from one domain into another. An approximable
map is a data object that denotes a function.
Definition 2.12. Assume that we are given data domains A and B. A
partial map from A into B is a binary relation R A0 B 0 such that R is
consistent: a A0 , the set
{b B 0 | x A0 [x v a xRb]}
is consistent. An approximable map from A into B is a partial map R from
A into B that satisfies the following two closure properties:
(1) R is downward-closed: ha, bi A0 B 0 (hx, yi R [x v a b v
y] xRy) .
(2) f is directed-closed: a A0 b1 , b2 B 0 (aRb1 aRb2 aR(b1 t
b2 )) .
Definition 2.13. Given a partial map R from A into B, the function determined by R is the function f : A B defined by
G
f (a) = {b B 0 | x A0 [x v a xRb]}.
Lemma 2.4. If R is a partial map from A into B, then the function f :
A B determined by R is continuous.
Definition 2.14. Given the domains A and B with presentations hai | i
Ni and hbi | i Ni, the domain of approximable maps A , B is is the
domain hC, vC i with presentation where C is the set of approximable
maps from A into B, vC is the relation defined by
R1 vC R2 R1 R2
and is the enumeration consisting of the set
{R | finite R0 [A0 B 0 ] such that R is the downward, directed closure of R0 }
sorted by rank
X
2r(i,j) .
hai ,bj if
partial recursive function f R such that for all x1 , . . . , x#f A, the function
R
R
k.(f R (xR
1 , . . . , x#f ), k )) has range index(f (x1 , . . . , x#f )) .
Given the preceding motivation, we formalize the notions of computable
function and computable map as follows.
Definition 2.18. An element a of a domain A is accessible iff the index set
of the ideal corresponding to a is recursively enumerable.
Definition 2.19 (Computable). Given the domains A and B with effective
presentations and , an approximable map f [A , B] is computable iff
the index set {hi, ji | hi , j i f } for f is recursively enumerable. The function f determined by an approximable map f from A into B is computable
iff f is computable.
A computable function f : A B is computable in the sense that
given any accessible element x A (represented by the code xR ), we can
enumerate the set of basis elements that approximate f (x) B.
Definition 2.20 (Effectively isomorphic). Let A and B be domains with
effective presentations and . A and B are are effectively isomorphic iff
there exists a computable function h : A B that establishes an isomorphism between A and B.
Definition 2.21 (Signature). A signature is a pair hO , # i consisting
of a finite set of function symbols O distinct from V ar and a function #
mapping O into the natural numbers N specifying the arity # f for each
symbol f in O . If # f is 0, f is called a constant.
Notation For the sake of notational simplicity, we will frequently write
instead of O . For example, f means f O . Similarly, we will write
#f instead of # f in contexts where there is no ambiguity.
Definition 2.22 (Domain Algebra). A domain algebra D with signature
is a pair hD, D i consisting of a domain D and an interpretation function D
mapping each symbol o into an continuous #o-ary function oD (called
an operation) over D.
Definition 2.23 (Isomorphic algebras). Two algebras D1 and D2 with signature are isomorphic iff there exists a bijective (one-to-one and onto)
function : D1 D2 such that
the domains D1 and D2 are isomorphic under , and
for each operation symbol f ,
x1 , . . . , x#f D1 (f D1 (x1 , . . . , x#f )) = f D2 ((x1 ), . . . , (x#f )) .
The obvious difference between a domain and a domain algebra is that
a domain algebra identifies a collection of primitive operationsin addition to a universe of valuesthat form a set of building blocks for defining
new functions over the universe. In contrast, a domain leaves the primitive
operations on data unspecified.
10
11
Corollary The domain algebra consisting of D augmented by least fixedpoint interpretation for the function symbols f1 , . . . , fn satisfies the recursive
program P .
Definition 2.27 (Recursively Definable). A function f : Dn D (where
n 0)1 is recursively definable in D iff there exists a recursive program P
such that f is one of functions in the least fixed-point hf1 , . . . , fn i of the
functional corresponding to P .
Definition 2.28 (Expressive, Reflectively Complete). A domain algebra
D = hD, D i with effective presentation is expressive iff every accessible
element of D is recursively definable in D. D is computationally complete iff
every computable function f : Dn D (n 0) is recursively definable in
D. D is reflexively complete iff the following three properties hold:
(1) D is expressive.
(2) There exists an effective subspace D, of D that is effectively isomorphic to the domain D , D under the function h : [D , D] D, .
(3) The function apply : D, D D defined by
f [D , D] x D apply(h(f ), x) = applyD (f, x)
is recursively definable in D.
Remark We will call elements of the subspace D, internal maps to distinguish them from the elements of the domain D , D.
Lemma 2.7. If an algebra D is reflexively complete, then it is computationally complete.
Proof Let f be an arbitrary computable n-ary function over D. Since D is
expressive and D , D is effectively isomorphic to D, , there is a recursive
program
f=M
that defines the curried internal map f corresponding to f . The recursive
program for f is the equation
f = M
f (x1 , . . . , xn ) = apply(. . . (apply(apply(f, x1 ), x2 ) . . . , xn ).
2.4. Projections on the Universal Domain. An interesting collection
of domains can be constructed from a collection of primitive domains (such
as Nat and Bool) by composing the Cartesian product and approximable
map constructions. However, there are many important domains such as
infinite cartesian products of primitive domains that are beyond the scope of
this simple scheme. Dana Scott has developed a much more comprehensive
approach to the problem of constructing domains based on the concept of a
universal domain.
1In the special case n = 0, we define D 0 as the empty universe containing the single
element . Hence, each element d D is identified with the continuous function mapping
tod.
12
Definition 2.29 (Universal Domain). A domain U with effective presentation is universal iff the following two properties hold:
(1) Every domain D is isomorphic to a subspace UD of U .
(2) Given an effective presentation for a domain D, there is an effective
subspace of U that is effectively isomorphic to D.
Since every domain D has an isomorphic image UD within a universal
domain U , the problem of defining an arbitrary domain can be reduced to
defining an arbitrary subspace of U . A simple, elegant way to identify an
arbitrary subspace UD of U is to define a map, called a projective map,
in U , U that uniquely characterizes the subspace UD . Moreover, since
U, is an effective subspace of U , there is an internal map Map D U,
corresponding to D.
2.4.1. Projections.
Definition 2.30 (Projective map). A projective map on a domain D is an
approximable map : D , D with the property that there exists a subset
P D0 satisfying the constraint
= {hx, yi | p P p v x y v p}.
In other words, is the downward, directed-closure of the set {hp, pi | p P }.
Definition 2.31 (Projective map domain). Given the domain D with presentation , the domain D of projective maps over D is the domain hE, vE i
with presentation where E is the set of projective maps of D, vE is the
subset ordering, and is the enumeration function for the set of all finite
maps D sorted by rank
X
2i
{i | hbi ,bi ij<ibj 6=bi }
13
T, F
ifthenelse
or
not
left
S
:
:
:
:
:
:
B
B (U (U U ))
B (B B)
BB
U U
U, ((U U U U ))
and
por
pair
right
K
:
:
:
:
:
:
U B
B (B B)
B (B B)
U (U U )
U U
U (U U )
14
x 6= (x) = T
ifthenelse F x y = y
and x y = ifthenelse x y F
x 6= T y 6= T (por x y) = (or x y)
not x = ifthenelse x F T
right (pair x y) = y
Kxy = x .
15
ifthenelse x y z
or x y
and x y
por x y .
=
=
=
=
pair
z . left z
z . right z
x . Pair (1 1st x) (2 2nd x)
=
=
=
=
16
=
=
=
=
x . y . pair T (pair x y)
z . left right z
z . right right z
x . Pair (1 1st x) (2 2nd x)
=
=
=
=
=
=
=
=
=
=
=
=
=
=
x . pair T x
y . pair F y
z . right z
z . right z
z . left z
z . not left z
x . if L? x then inL+ 1 outL+ x
else inR+ 2 outR+ x
(6) Lifted domain. D = {hT, xi | x D} {}. Let D be the projection map corresponding to D. The basic maps corresponding to D
are:
delay : D D = x . pairT x
force : D D = z . right z
: U D = x . delay D force x
In constructing products and unions, there are three plausible symmetric
ways to handle composite objects containing an undefined component:
(1) A composite object (e.g. an ordered pair) containing an undefined
component is identified with the undefined object in the constructed
domain. Coalesced products () and sums () obey this convention.
17
18
4. A Taxonomy of Lists
The variety of mechanisms available for constructing lazy domains suggests that there may be several different lazy domains that correspond to
an ordinary (industrious) recursive data domain (such as lists)each with
subtly different properties. In fact, the number of semantically distinct possibilities is surprisingly large. We will illustrate this phenomenon by studying list domains in detail. In particular, we are interested in determining
and classifying the possible lazy variations on the domain algebra consisting
of the subspace L
(0)
L = A (L L) ,
:
Pair :
cons :
cdr :
A? :
L
L
L2 L
LL
LL
A
true, false, a1 , a2 , . . .
car
if-then-else
Pair ?
:
:
:
:
:
L
L
LL
L3 L
LL
where true, false, a1 , a2 , . . . are constants denoting lists that are atoms. We
presume that A is an unspecified flat, expressive subdomain of U including
the elements true and false and a set of object isomorphic to the natural
numbers N.
The domain List defined in equation (0) is the project characterized by
the projection map
List = u .
if L? u then inL A outL u
l
else inR (L 1st outR u) (L 2nd outR u))
19
L
L
L
L
L
=
=
=
=
=
A + (L L)
A + (L L)
A (L L)
A (L L)
A + (L L)
20
(0) does not, but all of the lazy variants (1)-(5) do. For example, the list
zeros defined by the equation
zeros = cons 0 zeros
denotes the undefined element of the industrious domain (0) while it
denotes a linear list of 0s in each of the other domains (1)-(5).
Within the class of domains that support infinite objects, there are significant differences in the kinds of infinite and undefined objects that can
appear within infinite and partial objects. By applying this form of analysis,
we can demonstrate that the first four domains (1)-(4) have fundamentally
different internal structure. We can also show that domain (5) is distinct
from the other domains, but the difference between it and domain (1) is
not significant because the two domains (and corresponding algebras) are
isomorphic.
In domain (1), lists can contain undefined atoms (the element hT, i,
undefined pairs (the element hF, i, and undefined lists (). In domain (2),
lists can contain undefined atoms and the undefined pair but not undefined
lists. In domain (3), lists can contain undefined lists but not undefined
atoms and undefined pairs. In domain (4), lists can contain undefined lists
and undefined pairs, but not undefined atoms. In domain (5), as in domain
(1), lists can contain undefined atoms, undefined pairs, and undefined lists.
However, domain (5) contains a different form of undefined pair (hT, hT, ii)
than domains (1), (2), and (4).
By inspecting a few simple examples, we can easily prove that the first
four lazy domains are distinct (non-isomorphic); corresponding computations yield different answers. In domain (1), we can define
(1) the infinite list containing no atoms;
(2) the infinite sequence containing undefined lists () alternating with
zeros; and
(3) the list consisting of undefined atoms
by the expressions
(1) BigTree = cons BigTree BigTree
(2) AltSeq = cons (cons 0 AltSeq), and
(3) A .
However, in the other three domains (2)-(4), at least one of the corresponding lists does not exist. In domain (2), AltSeq denotes the undefined
pair Pair ; lists may not contain undefined lists. In domain (3), both
BigTree and A denote the undefined list ; every defined list must contain a defined atom. In domain (4), Atom denotes the undefined list ;
lists cannot contain undefined atoms. Hence, domains (1), (2), (3), and
(4) are structurally distinct (nonisomorphic); the set of finite elements is
fundamentally different in each case.
Although each pair (created by a cons operation) in domain (5) contains
a redundant level of lifting, domain (5) is isomorphic to domain (1) under
21
L
L
L
L
L
=
=
=
=
=
A (L L)
A (L L)
A (L L)
A (L L)
A [(L L) ] .
In this standardized form, the close relationship between domain (5) and
domain (1) is evident.
The remaining interesting variations on lazy lists are:
(6)
(7)
(8)
(9)
(10)
(11)
(12)
L
L
L
L
L
L
L
.
=
=
=
=
=
=
=
A (L L)
A (L L)
A (L L)
A (L L)
A (L L )
A (L L)
A (L L )
Variation (6) accommodates undefined atoms and undefined lists, but not
undefined pairs. Variation (7) does exactly the opposite; it accommodates
undefined pairs, but not undefined atoms or lists. Variation (8) is only
marginally lazy: within lists it accommodates undefined atoms, but not
undefined lists or undefined pairs. Variations (9), (10), (11), (12) all delay
22
the evaluation of only one argument of a paired list. As a result, domains (9)
and (11) allow infinitely deep lists but not infinitely long ones while domains
(10) and (12) do the opposite. Spaces (9) and (10) prohibit undefined atoms
while domains (11) and (12) accommodate them.
At this point, the question arises: which denotational definition of lazy
lists corresponds to the standard implementation-oriented definition given
in the literature [Frie76]? The answer is (4), because their domain accommodates undefined lists and undefined pairs but not undefined atoms.
The situation is somewhat more complicated in the case of the semantics
presented in [Hend76]. Their semantic definition describes a domain isomorphic to (1), but the definable data points are contained within a subdomain
isomorphic to (4), because the operations in their domain cannot generate
undefined atoms.
5. Axiomatizing Lazy Domains
Since there are significant differences between various formulations of lazy
data domains, it is important to develop clear, comprehensive axiomatic
definitions for the alternatives. Naively, we might attempt to specify a lazy
domain like
(1)
L=A+LL
23
:
:
:
:
:
P
P
P
P
P
P
P
(P (P P ))
(P P )
(P (P P ))
24
defined by
suc x
pred x
ifthenelse x y z
K
S
=
=
=
=
=
{e + 1 | e x}
{e | e + 1 x}
{e | e y 0 x} {e | e z 1 y}
x . y . x)
Map(x . y . z . apply(apply(x, z), apply(y, z))) .
where Map : (P , P ) P , is the function mapping continuous functions on P to their images in P . Surprisingly, all of these operations are
recursively definable in the a domain containing the lazy subspaces TrivSeq
and Triv together with the obvious structural operations
T,
por , and
cons
hd
tl
:
:
:
:
:
Triv
Triv2 Triv
Triv TrivSeq TrivSeq
TrivSeq TrivSeq
TrivSeq TrivSeq.
Note that the Cartesian product symbol in the definition above indicates that cons is a binary functionnot a unary function on pairs. The
recursive programs defining the primitive operations OP over appear in the
Appendix.
P together with the binary operation apply : P 2 P and maps S and
K, forms a model for the untyped lambda calculus (excluding -reduction).
Consequently, the lazy space TrivSeq together with the corresponding operations also constitutes a model for the untyped lambda calculus. TrivSeq is
a particularly attractive model for computer scientists, because it is based
on widely understood concepts from applicative programming. Lazy domains are the natural higher order generalization of familiar recursive
data structures.
The most widely publicized method for specifying data domains in the
literature is equational specification (frequently called algebraic specification). We formally define the method as follows.
Definition 5.1 (Quotient Algebra). Let be an algebra and let be an
equivalence relation on the universe D. is compatible with iff every
operation f in is well-defined with respect to . If is compatible with
the quotient algebra / corresponding to is the pair hD/, OD/ i.
is called the parent algebra corresponding to /.
Definition 5.2. The free term algebra with signature is the algebra
with universe T and interpretation function O defined by
O (f ) = f
where
f (x1 , . . . , x#f ) = f (x1 , . . . , x#f )
A term algebra is a quotient algebra corresponding to a free term algebra.
25
necessary.
26
domain to include all of the limit points of directed sets of basis elements.
But this requirement is too stringent. The only elements of a lazy domain
that are accessible in a program are the ones with approximating sets (of
basis elements) that are recursively enumerable. Since there only countably
many recursively enumerable subsets of the basis set, the computationally
significant portion of a lazy domain is countable.
Without performing a deeper analysis than cardinality arguments, we
cannot rule out the possibility that equational specification can define a
domain that contains an isomorphic image of all of the accessible elements
of a non-trivial lazy domain. In fact, a machine implementation of a lazy
domain obviously includes only countably many elements; yet, it suffices
as a crude (non-extensional) formal characterization of the lazy domain.
Similarly, given any logical theory for a non-trivial lazy domain (including
all of the limit points), we can construct a countable non-standard model.3
Consequently, it is meaningful to ask whether equational specification can
define domains containing an isomorphic image of the accessible elements
of a non-trivial lazy domain. We will use computability arguments to show
that the answer to this question is no. In fact, we will prove a much stronger
result, namely that equational specification is too restrictive to define any
non-trivial computationally expressive domainlazy or industrious! The
crux of the problem is that the equality relation in an initial specification is
recursively enumerable and the inequality relation in a final specification is
recursively enumerable, yet neither the equality relation nor the inequality
relation in a non-trivial, computationally expressive domain is recursively
enumerable.
Definition 5.10 (Non-trivial domain). A domain D is non-trivial iff it contains a recursively enumerable, infinite set E = {e0 , e1 , . . . , ei , . . .} of mutually incomparable (under the approximation ordering vD ) basis elements.4
Theorem 5.1. Neither the initial interpretation nor the final interpretation of an equational specification can define a non-trivial, computationally
expressive algebra.
Proof. Let be a non-trivial, computationally expressive algebra with the
recursively enumerable set E = {e0 , e1 , . . . , ei , . . .} of incomparable basis
elements. We can encode the set of natural numbers N within by using
each basis element ei in E to represent the corresponding natural number
i. The effective subdomain E + = E is clearly isomorphic to the flat
domain N consisting of N augmented the undefined element . Since
is computationally expressive and E + is an effective subdomain of ,
has the following two properties. First, for each basis element ei , there is a
variable-free term Mi over denoting ei . Similarly, there is a variable-free
3This result is the immediate consequence of the Lowenheim-Skolem theorem; see En-
27
otherwise .
Let be the set of variable-free terms of form (M ) where M is an arbitrary term over . is clearly recursively enumerable. Hence, the subset
0 of terms inequivalent to M0 must be recursively enumerable. Similarly, the set of terms {M | (M ) 0 } is recursively enumerable. But this
set is simply , the set of divergent computations over E + which is not
recursively enumerable. Hence, we have a contradiction.
Since lazy domains have essentially the same structure as P , an obvious
approach to formulating a logic for lazy domains is to use a higher order logic
based on the lambda calculus (similar to Edinburgh LCF) that conveniently
expresses the properties of P .5 However, we would prefer not to abandon
first-order logic for two reasons. First, first-order theories (such as firstorder Peano arithmetic) based on structural induction provide a simple,
elegant characterization of ordinary data domains. In this context, recursive
programs can be formalized as definitions extending the theory. The highly
successful Boyer-Moore LISP Verifier [Boyer75,79] is based on such a firstorder system.6 We would like to extend this approach to handle lazy lists
as well. Second, the completeness theorem for first order logic provides a
invaluable tool for analyzing the deductive power of any theory. If a first
order theory is too weak to establish a particular theorem, there must be a
non-standard model in which that theorem is false. In higher order logics, on
the other hand, a theory may be too weak to prove an important theorem,
yet there may be no model that refutes it.
5See [Giles78] for an LCF axiomatization of lazy lists.
6A rigorous explication of this approach to program semantics appears in [Cart84].
28
if x =
T if x 6= c(s1 (x), . . . , s#c (x)) = x
c?(x) =
F otherwise .
[
cC
(e) The basis D0 of D forms a well-founded set under the substructure ordering which is the transitive closure of the binary
relation
[
{hxj , c(x1 , . . . , x#c )i | x1 , . . . , x#c D0 c(x1 , . . . , x#c ) 6= } .
j=1,...,#c
29
i=1,...,#c
or, equivalently,
x [x0 (x0 x (x0 )) (x)] z (z).
A detailed account of this process appears in [Cart80].
The corresponding problem for lazy domains D is more subtle. If we
construct the axiomatization described above for a lazy domain D, then
the specified domain contains only the finite objects (basis elements) of
the lazy domain.7 The structural induction scheme (4) has the effect of
banning infinite objects (limit points) from the domain. In fact, if we extend
the axiomatized algebra to include the characteristic predicate Finite? for
finite objects and augment the axiomatization by a sentence asserting that
constructors map finite objects to finite objects, then we can prove
x Finite?(x) = T
by structural induction.
As a result, recursive definitions over the domain may not have least fixed
points because directed sets do not necessarily have least upper bounds. For
example, if we consider a domain consisting the finite objects in TrivSeq, the
function definition
f (x) = cons(true, f (x))
is contradictory, because we can prove by structural induction that
x, y [x 6= cons(y, x)] .
If we replace induction scheme (4) by an induction axiom scheme restricted to finite objects:
(40 )
then the lazy domain is a model for our axiomatization, but so is the subspace containing only finite objects. In such a theory, we could not prove
any interesting statements about infinite objects.
7Non-standard models may contain infinite objects, but their behavior does not
resemble that of lazy data objects. For a detailed discussion of this issue, see [Cart84].
30
7. A Satisfactory Axiomatization
The solution to the problem is to augment the axiomatization consisting
of (1), (2), (3), and (4) above by two additional schemes asserting that:
: (5) Every definable directed set has a least upper bound.
: (6) Every term t(x) over the domain operations G is continuous in
the variable x.
and by an extra axiom asserting that:
: (7) Every element is the least upper bound of the set of finite elements
that approximate it.
They are formalized as follows. Let (u) and t(u) be an arbitrary formula
and term respectively in the language of the data domain and and let x, y, z
be variables not free in either (u) or t(u). Let Diru {t(u) | (u)} abbreviate
the formula
x, y [(x) (y) z((z) x v t(z) y v t(z))]
F
which asserts that {t(u) | u(u)} is a directed set. Let u {t(u) | (u)} = v
abbreviate the formula
x ([(x) t(x) v v] z [x (x) t(x) v z] t(x) v v)
which asserts that v is the least upper bound of the set {t(u) | (u)}.8 Then
the additional axiom schemes and axiom are:
: (5) (the existence of least upper bounds)
G
Diru {t(u) | (u)} v[ {t(u) | (u)} = v]
u
31
that the system is strong enough to prove all of the important properties
of particular lazy domains. For this reason, it is interesting to compare the
power of our first-order system with the corresponding theory in LCF, a
logic specifically designed to accommodate higher order domains like P .
The LCF theory looks similar except:
(1) It includes the typed lambda calculus in the term syntax for the
logic.
(2) The induction axiom scheme is fixed point induction on recursively
defined functions. This scheme has the form
(() f [(f ) (Mf )]) (Y (f . Mf ))
where (f ) is a formula that admits induction on f . Fixed-point induction is applicable only to admissible formulas, where admissibility
is a complex syntactic test (described in [Gord77]) that analyzes the
types of terms within the formula.
The closest analog of structural induction in LCF is fixed point induction on a projection characterizing the domain of interest. The fixed point
induction scheme has the form:
(8)
f [(f ) (Mf )] (Y (f . Mf ))
32
structure of formulas that is beyond the scope of this paper, but the basic
idea underlying the proof is instructive.
The admissibility test in LCF ensures that passing to the limit of a directed set (of lazy data objects) does not change the meanings of subformulas that determine the truth of the entire formula. The idea behind the
derivation is that the metamathematical justification for fixpoint induction
on a function within a particular admissible formula can be translated into a
proof in our first order system consisting of two parts. The first part utilizes
conventional structural induction to establish that the formula holds for all
finite approximations to the function. The second part extends the result to
the entire function (an infinite lazy object) by appealing to the definition of
admissibility and the fact that all functions in the domain are continuous.
Although the admissibility test required for lazy induction is awkward, the
rule can be a useful shortcut in certain situations. A particular important
example is lazy induction on the projection D characterizing the recursive
data type D defined by the domain equation
D = Dn1 + . . . + Dnk
where n1 , . . . , nk are positive integers. For each component Dni of D, let
ci ?, ci , and si,j , j = 1, . . . , ni denote the recognizer, constructor, and selector
functions, respectively, used to identify, build, and tear apart objects of form
Dni within D. Then D n is defined by the equation:
D = x . if c1 ? x then c1 (D s1,1 x) . . . (D s1,n1 x)
else if . . .
else if ck ? x then ck (D sk,1 x) . . . (D sk,nk x)
else.
When we apply lazy induction to this projection, the premises of the rule
reduce to the premises of conventional structural induction for the finite
objects of the domain. Similarly, the conclusion of the rule reduces to an
assertion that the hypothesis holds for all objects in D. Hence, if a formula is
admissible, conventional structural induction establishes the formula holds
for all objects in D, not just finite ones!
7.1. Sample Program Proofs. Consider the recursive definition
append (x, y) = if Atom? x then y
else cons(car (x), append (cdr (x), y))
over the data domain L(1) . The following formula
x, y, z append (x, append (y, z)) = append (append (x, y), z)
is obviously true on the domain of finite objects (including ). The proof
is a trivial induction on the structure of x. Does the same theorem hold
for all lazy lists? The answer must be yes, because the formula stating the
33
x L(zap(x) < x)
where the function zap and the relation v are defined by the formulas
zap(x)
x<y
if Atom? x then
elsecons(car (x), zap(cdr (x)))
(x 6= y) (x v y).
34
35
(i + j) (i + j + 1)
+ i.
2
9.1. Auxiliary Operations. The following collection of auxiliary operations OAux are used in the definition of the primitive operations OP of
P .
36
def X
=
Plus(I, J)
=
Times(I, J)
=
Pair (I, J)
=
1st X
=
1st 1 (k, X)
=
any2nd (i, k, X)
=
2nd X
=
2nd 1 (k, X)
=
any1st(k, j, X)
=
Overlap(I, J)
=
Top
=
odd X
=
Halve X
=
approx (i, X)
=
i X
(hd x) por (def S X)
{i + j | i I j J}
Cons([hd I] and [hd J],
Cons([(hd Tl I) and (hd J)] por [(hd I) and (hd Tl J)],
Plus(Tl I, Tl J)))
{i j | i I j J}
Cons([(def I and (hd J)] por [(hd I) and (def J)],
Plus(Tl I, Times(I, Tl J)))
{hi, ji | i I j J}
Plus(Halve Times(Plus(I, J), Plus(Plus(I, J), Suc 0))), I)
{i | j hi, ji X}
1st 1 (0, X)
{i k | j hi, ji X}
Cons(any2nd (k, 0, X), 1st 1 (Suc k, X))
j k [hi, ji X]
Overlap(Pair (i, k), X) por any2nd (i, Suc k, X)
{j | i[hi, ji X]}
2nd 1 (0, X)
{j k | i [hi, ji X]}
Cons(any1st(0, k, X), 2nd 1 (Suc k, X))
i k [hi, ji X]
Overlap(Pair (k, j), X) por any1st(Suc k, j, X)
i[i I i J]
[hd I and hd J] por Overlap(Tl I, Tl J)
{i}
Cons(T, Top)
i [2i + 1 X]
(hd Tl X) por (odd Tl Tl X)
{i | 2i X} {j | 2j + 1 X}
Cons([hd X] por [hd Tl X], HalveTl Tl X)
i X
[hd i] por [([(odd i) and (hd X)] por [odd Tl i]) and
approx (Halve i, Tl X)]
37
{0}
Cons(T, )
Sucgraph 0
{hi, ji k | hi, ji k j [ Suc i ]}
Cons(approx (2nd k, Suc 1st k), Sucgraph Suc k)
{i + 1 | i I}
Cons(, I)
Predgraph 0
{hi, ji k | hi, ji k j [ Pred i ]}
Cons(approx (2nd k, Pred 1st k), Predgraph Suc k)
{i | i + 1 I}
Tl I
Condgraph 0
{hi, ji k | hi, ji k j [ Cond1 i ]}
Cons(approx (2nd k, Cond1 1st k), Condgraph Suc k)
Condgraph1 (X, 0)
{hi, ji k | hi, ji k j Cond2 (X, i )}
Cons(approx (2nd k, Cond2 (X, 1st k)), Condgraph1 (X, Suc k))
Z . Cond(X, Y, Z)
Condgraph2 (X, Y, 0)
{hi, ji k | hi, ji k j Cond3 (X, Y, i )}
Cons(approx (2nd k, Cond3 (X, Y, 1st k)), Condgraph2 (X, Y, Suc k))
{i Y | 0 I} {j Y | w [w + 1 I]}
Cons([(hd I) and (hd Y )] por [(def Tl I and (hd Z)],
Cond3 (I, Tl Y, Tl Z))
Kgraph 0
{hi, ji k | hi, ji k j [ K1 i ]}
Cons(approx (2nd k, K1 1st k), Kgraph Suc k)
{hi, ji | j X}
Pair (Top, Filter X)
{i | i I}
Filter1 (I, 0)
{i k | i k i X}
Cons(approx (k, I), Filter1 (I, Suc k))
38
S = Sgraph 0
Sgraph k {hi, ji k | hi, ji k j [ S1 i ]}
= Cons(approx (2nd k, S1 1st k), Sgraph Suc k)
S1 X Y . S2 (X, Y )
= Sgraph1 (X, 0)
Sgraph1 (X, k) {hi, ji k | hi, ji k j S2 (X, i )}
= Cons(approx (2nd k, S2 (X, 1st k)), Sgraph1 (X, Suc k))
S2 (X, Y ) Z . S3 (X, Y, Z)
= Sgraph2 (X, Y, 0)
Sgraph2 (X, Y, k) {hi, ji k | hi, ji k j S3 (X, Y, i )}
= Cons(approx (2nd k, S3 (X, Y, 1st k)), Sgraph2 (X, Y, Suc k))
S3 (X, Y, Z) = apply(apply(X, Z), apply(Y, Z))
apply(F, X) {j | i hi, ji F i X}
= 2nd apply1 (0, F, X)
apply1 (F, X, k) {p k | p k p F 1st p X}
= Cons(test(k, X, F ), apply1 (F, X, Suc k))
test(p, X, F ) p F 1st p X
= Overlap(p, F ) and approx (1st p, X)
References
[ADJ76]
Goguen, J., J. Thatcher and E. Wagner. An Initial Algebra Approach to the Specification, Correctness and Implementation of Abstract Data Types. IBM Research Report RC-6478,
Yorktown Heights, 1976.
[ADJ77]
[Back78]
Backus, J. Can Programming be Liberated from the vonNeumann Style? A Functional Style and its Algebra of Programs.
CACM 21, 1978, 613-641.
[Bare77]
[Boye75]
[Boye79]
Boyer, R.S., and Moore, J S. A Computational Logic, Academic Press, New York, 1979.
39
[Cart76]
Cartwright, R. User-Defined Data Types as an Aid to Verifying LISP Programs. Automata, Languages and Programming,
Edinburgh Press, 1976.
[Cart80]
[Cart83]
[Cart84]
Ende72]
[Frie76]
[Gile78]
[Gord77]
[Gutt78]
[Hend80]
[Hend76]
[Kami80]
[Plot78]
[Scot76]
[Scot81]
Scott, D. S. Lectures on a Mathematical Theory of Computation. Technical Monograph PRG-19. Oxford University
Computing Laboratory, Oxford.
40
[Scot83]
[Stoy77]
[Tars55]