Fall Lecture 3 September 4. Stephen Brookes

Transcription

1 Fall 2018 Lecture 3 September 4 Stephen Brookes

2 Today A brief remark about equality types Using patterns Specifying what a function does

3 equality in ML e1 = e2 Only for expressions whose type is an equality type Equality types include all types built from e.g. int, bool, *, -list int list int * bool (int * bool) list but NOT real or -> = 2; val it = true : bool - [1,1] = (0+1)::[2-1]; val it = true : bool - (fn x => x+x) = (fn y => 2*y); Error: operator and operand don't agree [equality type required]

4 patterns We introduced patterns, to be used for matching with values Matching p to value v either fails, or succeeds and binds names to values p ::= _ x n true false (p1,, pn) p1::p2 [p1,, pn] Can attach types if desired

5 Using patterns Recall divmod : int * int -> int * int fun check (x:int, y:int):bool = let val (q, r) = divmod (x, y) in (x = q*y + r) end Introduces check : int * int -> bool Binds check to a function value What does this function do?

6 eval : int list -> int fun eval ([ ]) = 0 eval (d::l) = d + 10 * (eval L) This definition uses list patterns [ ] matches (only) the empty list d::l matches a non-empty list, binds d to head of the list, L to its tail eval [2,4] =>* 42 What does this function do?

7 decimal : int -> int list fun decimal n = if n < 10 then [n] else (n mod 10) :: decimal (n div 10) Why didn t I define this function using integer patterns? decimal 42 = [2,4] decimal 0 = [0] What does this function do?

8 log : int -> int fun log x = if x = 1 then 0 else 1 + log (x div 2) log 3 =??? Q: How can we describe this function? A: Specify its applicative behavior - For what argument values does it terminate? - How does the output relate to the input?

9 Specifications For each function definition we specify: Type (of the function s argument and result) Assumption (about argument value) Guarantee (about result value, when assumption holds)

10 Format fun log (x:int) : int = if x=1 then 0 else 1 + log (x div 2) definition (* TYPE log : int -> int *) (* REQUIRES x *) (* ENSURES log x. *) type assumption guarantee For all values x : int satisfying the assumption, log x : int and its value satisfies the guarantee Any ideas?

11 log spec fun log (x:int) : int = if x=1 then 0 else 1 + log (x div 2) (* TYPE log : int -> int *) (* REQUIRES x > 0 *) (* ENSURES log x = the integer k 0 *) (* such that 2 k x < 2 k+1 *) For all integers x>0, log x evaluates to an integer k such that 2 k x < 2 k+1 relevant math facts?

12 notes Can use =>* or = in specs Use math notation and math facts, accurately! A function can have several specs different assumptions may lead to different guarantee

13 another log spec fun log (x:int) : int = if x=1 then 0 else 1 + log (x div 2) (* log : int -> int *) (* REQUIRES x = a power of 2 *) (* ENSURES log x = the integer k *) (* such that 2 k = x *) (a weaker spec why?) (actually implied by original spec)

14 eval spec fun eval ([ ] : int list) : int = 0 eval (d::l) = d + 10 * (eval L) TYPE eval : int list -> int REQUIRES R = a list of decimal digits ENSURES eval R = a non-negative integer (not the best spec for eval why not?) (doesn t say which non-negative integer!)

15 decimal spec fun decimal (n:int) : int list = if n<10 then [n] else (n mod 10) :: decimal (n div 10) TYPE decimal : int -> int list REQUIRES n 0 ENSURES decimal n = a list of decimal digits (again, not the best spec )

16 connection eval and decimal are designed to fit together They satisfy a connection spec TYPE decimal : int -> int list REQUIRES n 0 eval : int list -> int ENSURES eval(decimal n) = n (says which list and which integer )

17 Evaluation Expression evaluation produces a value if it terminates e => k e e => * v e evaluates to e in k steps e evaluates to v in finitely many steps Declarations produce value bindings d => * [ x1:v1,..., xk:vk ] Matching a pattern to a value either succeeds with bindings, or fails TYPE SAFETY

18 Basic properties e => * e if and only if k 0. e => k e e => 0 e If e1 => m e2 and e2 => n e3 then e1 => m+n e3

19 Substitution For bindings [ x1:v1,..., xk:vk ] and expression e we write [ x1:v1,..., xk:vk ] e for the expression obtained by substituting v1 for x1,..., vk for xk in e (for free occurrences, only) [ x:2 ] (x + x) is [ x:2 ] (fn y => x + y) is fn y => 2 + y [ x:2 ] (fn x => x + x) is fn x => x + x

20 Explaining evaluation For each syntactic construct we give evaluation rules for => showing order-of-evaluation We derive evaluation laws for => * how expressions evaluate what is the value, if it terminates We can also count number of steps => (n)

21 Addition rules e1 => e1 e1 + e2 => e1 + e2 e2 => e2 v1 + e2 => v1 + e2 ei, vi : int v1 + v2 => v where v = v1 + v2 + evaluates from left-to-right

22 Addition law If e1 => * v1 and e2 => * v2 and v = v1 + v2 then e1 + e2 => * v (2+2) + (3+3) => 4 + (3+3) => => 10 (2+2) + (3+3) => * 10 (2+2) + (3+3) => (3) 10

23 Application rules e1 => e1 e1 e2 => e1 e2 e2 => e2 (fn x => e) e2 => (fn x => e) e2 (fn x => e) v => [ x:v ] e a function call evaluates its argument

24 Application law If e1 => * (fn x => e) and e2 => * v then e1 e2 => * [x:v]e

25 Other rules div and mod evaluate from left to right Tuples evaluate from left to right Lists evaluate from left to right

26 Declaration rule In the scope of fun f(x) = e, f => (fn x => e) fun divmod(x, y) = (x div y, x mod y) divmod (3,2) => (fn(x, y) => (x div y, x mod y)) (3,2) => (3 div 2, 3 mod 2) => (1, 3 mod 2) => (1, 1)

27 Example fun f(x) = if x=0 then 1 else f(x-1) (* f : int -> int *) (* REQUIRES x >= 0 *) (* ENSURES f x = 1 *)

28 In the scope of Example fun f(x) = if x=0 then 1 else f(x-1) f(1-1) => (fn x => if x=0 then 1 else f(x-1)) (1-1) => (fn x => if x=0 then 1 else f(x-1)) 0 => if 0=0 then 1 else f(0-1) => if true then 1 else f(0-1) => 1 (justified by the rules given earlier!)

29 Patterns If matching p1 to v succeeds with [ B ], (fn p1 => e1 p2 => e2) v => * [ B ] e1 If matching p1 to v fails, and matching p2 to v succeeds with [ B ], (fn p1 => e1 p2 => e2) v => * [ B ] e2 If matching p1 to v fails, and matching p2 to v fails, (fn p1 => e1 p2 => e2) v fails uncaught exception Match [nonexhaustive match failure]

30 So far Using => and =>* we can talk precisely about program behavior But we may want to ignore evaluation order... For all expressions e1, e2 : int and all values v:int, if e1 + e2 => * v then e2 + e1 => * v In such cases, equational specs may be better For all expressions e1, e2 : int, e1 + e2 = e2 + e1 the same, more succinctly

31 Example fun add1(x, y) = x + y fun addr(x, y) = y + x addl and addr are indistinguishable Let E be a well-typed expression of type int Let E be obtained from E by replacing a call to addl with a call to addr E also has type int E and E have equal values Not easy to prove directly using =>*

32 Equivalence For each type t there is a mathematical notion of equivalence (or equality) =t for values of type t Expressions of type t are equivalent iff they evaluate to equivalent values, or both diverge v1 =int v2 v1 = v2 (equal integers) f1 =int->int f2 v1,v2:int. (v1 =int v2 implies f1 v1 =int f2 v2)

33 Extensionality When e 1 and e2 are values of type t -> t e1 = e2 if and only if for all values v1, v2 of type t v1 = v2 implies e1 v1 = e2 v2

34 Equations (when well-typed) Arithmetic e + 0 = e e1 + e2 = e2 + e1 e1 + (e2 + e3) = (e1 + e2) + e = 42 Boolean if true then e1 else e2 = e1 if false then e1 else e2 = e2 (0 < 1) = true

35 Equations (when well-typed) Applications only when the argument is a value (fn x => e) v = [x:v]e Declarations In the scope of fun f(x) = e the equation f = (fn x => e) holds

36 Compositionality (when well-typed) Substitution of equals If e 1 = e2 and e1 = e2 then (e1 e1 ) = (e2 e2 ) If e1 = e2 and e1 = e2 then (e1 + e1 ) = (e2 + e2 ) and so on

37 Equivalence fun add1(x, y) = x + y fun addr(x, y) = y + x Let E be a well-typed expression of type int containing a call to addl Let E be obtained by changing to addr Easy to show that addl =int * int -> int addr By compositionality, E = int E Hence, if E =>* 42 then also E =>* 42 Easy to prove using =

38 Equations (when well-typed) Applications (fn p1 => e1 p2 => e2) v = [B1]e if matching p1 to v succeeds with bindings [B1] (fn p1 => e1 p2 => e2) v = [B2]e if matching p1 to v fails & matching p2 to v succeeds with bindings [B2]

39 Equations Declarations In the scope of fun f(p1) = e1 f(p2) = e2 the equation f = (fn p1 => e1 p2 => e2 ) holds

40 Useful facts e => * v implies e = v e =>* v implies (fn x => E) e = [x:v] E evaluation is consistent with equivalence

41 So far Can use equivalence or = to specify the applicative behavior of functional programs Equality is compositional Equality is defined in terms of evaluation => * is consistent with = and ML evaluation

42 Guidelines Be clear and precise Use bound variable names consistently Use => * (evaluation) and = (equality) accurately Don t leave assumptions hidden