It is possible to provide a proof for a coinductive type using a corecursive function coupled with aguardedness condition. The guardedness condition, however, is quiterestrictive and many programs which are in fact productive and do not compromise soundness will be rejected. We present a system of cyclic proof for an extension of System F extended with sums, products and (co)inductive types. Using program transformation techniques we are able to take some programs whose productivity is suspected and transform them, using a suitable theory of equivalence, into programs for which guardedness is syntactically apparent. The equivalence of the proof prior and subsequent to transformation is given by a bisimulation relation. 

Gavin E. Mendel-gleason

Geoff Hamilton

CiteSeerX

Cyclic Proofs and Coinductive Principles
Gavin E. Mendel-Gleason
LERO http://lero.ie
ggleason@computing.dcu.ie
Dublin City University and Geoﬀ Hamilton
LERO http://lero.ie
hamilton@computing.dcu.ie
Dublin City University
Abstract
It is possible to provide a proof for a coinductive type using a corecursive function cou-
pled with a guardedness condition. The guardedness condition, however, is quite restrictive
and many programs which are in fact productive and do not compromise soundness will
be rejected. We present a system of cyclic proof for an extension of System F extended
with sums, products and (co)inductive types. Using program transformation techniques
we are able to take some programs whose productivity is suspected and transform them,
using a suitable theory of equivalence, into programs for which guardedness is syntactically
apparent. The equivalence of the proof prior and subsequent to transformation is given by
a bisimulation relation.
1 Introduction
In constructive type theories habitation of a type requires a demonstration of termination or co-
termination for inductive and co-inductive types respectively. A failure to do so allows unsound
propositions to be proved.
In the Coq theorem prover, the guardedness condition is the condition checked to ensure
admissibility of productive programs. The condition has the advantage of only requiring a
syntactic check on the form of the program and is a suﬃcient condition. However, this condition
suﬀers from being highly restrictive. It rejects many programs which are in fact productive.
The Curry-Howard correspondence takes as a starting point the principle that logic can be
viewed as a type system, and proofs of logical statements can be viewed as type-correct pro-
grams. This equivalence has lead to very fruitful developments in both logic and computation.
We use this well known correspondence to bring techniques from program transformation to
bear on the problem of inductive and co-inductive proofs. In order to do so however, we need
a theory of proof that is suﬃciently ﬂexible to allow program transformations which make use
of folding which is the creation of new (co)-inductive principles.
Cyclic proof is a method of describing inductive proofs without direct reference to an induc-
tion law [4]. Instead, it allows circularities in proofs, each cycle coupled with a side condition
from which soundness of the argument follows. Arguments therefore closely resemble the struc-
ture of type correctness proofs for functional programming languages [10] and hence is an
appealing way to deﬁne a type theory for a functional programming language. Inhabitation of
a type then follows after the side conditions can be shown to hold, otherwise the argument is
only partially correct.
We describe how program transformation of functional programs naturally situates in the
context of cyclic proof. Here, the Curry-Howard correspondence is explicit and program trans-
formation can be viewed as substitution of new proofs under an equivalence which preserves
behaviour, that is, all, even potentially inﬁnite, cut-free fragments of a proof.
This paper makes a number of novel contributions. We extend Brotherston’s concept of
cyclic proof to include coinductive proofs. We show a method by which we can perform trans-
formations directly on proof trees. We demonstrate a bisimulation principle for demonstrating
E. Komendantskaya, A. Bove, M. Niqui (eds.), PAR-10 (EPiC Series, vol. 5), pp. 107–113 107Cyclic Proofs and Coinductive Principles Mendel-Gleason and Hamilton
the equivalence of proofs. Finally, we show how these techniques can be used to transform some
proofs which do not meet the guardedness condition into proofs which do.
2 Language
The language we present is a functional programming language, which we will call ΛF with a
type system based on System F with recursive types. The use of System F typing allows us
to ensure that transitions can be found for any term. Our term language will follow closely on
the one used by Abel [2].
Var ∋ x,y Variables
TyVar ∋ X,Y Type Variables
Fun ∋ f,g Function Symbols
Ty ∋ A,B,C ::= 1 | X | A → B | ∀X.A | A + B | A × B Types
| νX.A | µX.A
Tr ∋ r,s,t ::= x | f | () | λx : A.t | ΛX.t | r s | r A Terms
| inl(t, )| inr(t, )| (t,s)
| foldν(t,A) | unfoldν(t,A)
| foldµ(t,A) | unfoldµ(t,A)
| case r of inl(x1) ⇒ s ; inr(x2) ⇒ t
| split r as x1,x2 in s
Ctx ∋ Γ ::= · | Γ,x : A | Γ,X Contexts
We will describe substitutions using the map σ which will represent assignment of variables
to terms and type variables to types. Extension of a substitution will be written as σ ∪ (x,t)
or σ ∪ (X,A). We will use a function FV (t) to obtain the free type and term variables from a
term. Substitutions of a single variable will be written [X := A] or [x := t] for type and term
variables respectively.
We will also ﬁnd the need to introduce recursive terms. Though it’s possible that these can
be suitably encoded in System F, it simpliﬁes the presentation to provide them explicitly.
Recursive terms will be represented using function constants. Function constants will be
drawn from a set F. We will couple our terms with a function ∆ which associates a function
constant f with a term e, ∆(f) = e, where e may itself contain any function constants in the
domain of ∆.
For a term t with type T in a context Γ we will write Γ ⊢ t : T. A type derivation must be
given using the rules given in Table 1.
Without further restrictions, this type system is unsound. First, the Delta rule for function
constants clearly allows non-termination given ∆(f) = f : T. We will deal with this potentiality
later when we describe cyclic proof.
In addition, the use of iso-recursive types introduces the possibility of non-termination if
the type is not given some additional restriction. We will restrict the form of types which can
be used with the Fold/Unfold rule to meet an additional positivity condition.
Strictly Positive A type variable X is strictly positive with respect to a type T iﬀ X does
not occur on the left side of an implication in T and T is built of strictly positive types. We
will then say that the type µX.T (or νX.T) is strictly positive.
108Cyclic Proofs and Coinductive Principles Mendel-Gleason and Hamilton
x : A ∈ Γ
Var
Γ ⊢ x : A
Γ,x : A ⊢ t : B
ImpIntro
Γ ⊢ (λx : A.t) : A → B
Γ ⊢ r : A → B Γ ⊢ s : A ImpElim
Γ ⊢ r s : B
Γ,X ⊢ t : A
AllIntro
Γ ⊢ ΛX.t : ∀X.A
Γ ⊢ t : ∀A.T
AllElim
Γ ⊢ t B : A[X := B]
Γ,f : A ⊢ ∆(f) : A
Delta
Γ ⊢ f : A
Unit
Γ ⊢ () : 1
Γ ⊢ r : A Γ ⊢ s : B
PairIntro
Γ ⊢ (r,s) : A × B
Γ ⊢ t : T
OrIntroL
Γ ⊢ inl(t,T + S) : (T + S)
Γ ⊢ t : S
OrIntroR
Γ ⊢ inr(t,T + S) : (T + S)
U = νX.T Γ ⊢ t : T α ∈ {µ,ν}
Unfold
Γ ⊢ unfoldα(t,U) : T[X := U]
U = νX.T Γ ⊢ t : T[X := U] α ∈ {µ,ν}
Fold
Γ ⊢ foldα(t,U) : U
Γ ⊢ e : T + S Γ,x : T ⊢ t : U Γ,y : S ⊢ s : U
OrElim
Γ ⊢ (case e of inl(x) ⇒ t ; inr(y) ⇒ s) : U
Γ ⊢ s : T × S Γ,x : T,y : S ⊢ t : U
PairElim
Γ ⊢ (split s as x1,x2 in t) : U
Table 1: System F Proof Rules
3 Cyclic Proof
In order to allow more ﬂuidity in the structure of our proof trees we introduce a notion of a
cyclic proof. A cyclic proof can be presented by making reference to a syntactically identical
prior node. Our presentation is much the same as the one given by Brotherston [4]. We will
however extend the deﬁnition to deal with coinductive types.
Rule Graph A rule graph is a connected graph G = (V,s,r,p) where V is a set of vertices,
r : V ⇀ Rules a map from vertices to some ﬁnite set of rules, s : V → Seqs a map from vertices
to a sequent and p : V → [V ] a map from vertices to lists of vertices.
For our purposes the sequents for a rule graph will be of the from Γ ⊢ t : A. The map p,
associates the antecedents of a vertex v which derive the consequent given by s.
Derivation Tree A derivation tree D is a rule graph G = (V,s,r,p) with the following con-
straints:
• There is a single privileged vertex v0 = root(V ) which is not the target of any arc called
the root of the derivation tree. More formally: ∀v ∈ V.v0  ∈ p(v)
• The number of antecedents |p(v)| of a vertex is consonant with the arity of the rule r(v).
109Cyclic Proofs and Coinductive Principles Mendel-Gleason and Hamilton
• The codomain of s is from the set Seq of well formed sequents.
• Ri is the ith rule in some list of rules Rules with antecedents
− →
D and consequent Seq
Structural Proof A structural proof is a ﬁnite derivation tree D of a consequent Γ ⊢ t : τ.
Bud / Companion Node Given a derivation D a bud is a vertex v ∈ V such that r(b) is
undeﬁned.
A companion node of a bud node is a vertex v′ such that s(v) = s(v′) for some vertex v and
s(v) = Γ ⊢ t : αX.T for α ∈ µ,ν.
Pre-Proof A pre-proof is a pair (D,R) such that for each bud node v the partial function
R ⇀ V associates a companion node.
Pre-Proof Graph Given a P = (D = (V,r,s,p),R) a pre-proof, we can associate a graph
GP = (V ′,r,s,p) by identifying buds with companions.
The pre-proof essentially mirrors the type checking algorithm familiar from functional pro-
gramming languages such as Haskell [7] [10] [9]. Intuitively, the method is to assume the type
of a recursive function, place it in the context and then unify with its subsequent occurrence.
The reason for the use of cycles rather than assumptions on the type of function constant is
that more comprehensive changes to the proof tree will be possible. This will be clariﬁed later
when we look at transforming the proof.
Once a cyclic pre-proof is presented, we still have additional proof obligations in order to
show that the type derivation is sound. While such a cyclic pre-proof proves safety [10] it can
not be used for a constructive type theory since it allows inhabitation of every type.
We will not prove general soundness conditions, but rely on prior work showing that struc-
tural induction and the guardedness are suﬃcient conditions. Once these conditions have been
satisﬁed, we can assume the correctness of the proof.
Path A path < v0,··· ,vn > is a sequence of vertices such that for each vi, vi+1 ∈ s(vi) where
i < n.
Sub-term A sub-term of a term t which has a derivation with root v0, is any term which has
a derivation starting from vi which is in a path from v0, and which contains only introductions
(ImpIntro, AllIntro, OrIntroL, OrIntroR, PairIntro, Fold).
Structural Recursion A pre-proof with cycles will meet the structural recursion condition,
if every bud associated with a µ type is a derivation of a sub-term of its companion.
Guardedness A pre-proof will meet the guardedness condition if every path from every com-
panion to a bud follows a right branch of a cut (ImpElim, AllElim, OrElim, PairElim, and
entirely excluding Unfold which has only one rule) and has a fold.
4 Evaluation And Equivalence
The utility which we will derive from the use of cyclic proof is in the ability to present the
same proof in new ways by way of transformation. In order to say what we mean by the same
however, we have to have a notion of equivalence. The typical evaluation relation for the lambda
type lambda calculus leads us to a notion of equivalence between terms of the following form:
110Cyclic Proofs and Coinductive Principles Mendel-Gleason and Hamilton
(λx : A.t)s = t[x := s] Provided that x is not free in s.
split (r,s) as x,y in t = t[x := r,y := s] Provided that x,y are not free in r,s.
case inl(r) of inl(x) ⇒ s ; inr(y) ⇒ t = s[x := r] Provided that x is not free in r.
case inr(r) of inl(x) ⇒ s ; inr(y) ⇒ t = t[y := r] Provided that y is not free in r.
unfoldµ(foldmuxT,T) = x
unfoldν(foldnuxT,T) = x
This equivalence can be lifted up to derivations. We show below the proof tree associated
with the ﬁrst equation, provided of course that we interpret replacement of the derivation to
mean that every leaf with Γ ⊢ x : A is replaced with Γ ⊢ r : A.
. . .
Γ ⊢ r : A
Γ
. . .x : A
. . .
Γ ⊢ t : A → B ImpElim
Γ ⊢ s : B
=
. . .
Γ ⊢ r : A
. . .
Γ ⊢ s : B
This is the typical β equivalence that we expect from the lambda calculus or it’s equivalent
of cut-elimination in proofs. We then extend this to deal with all of the previous equations.
From this equivalence of proofs we will then make a further equivalence over potentially
inﬁnite proofs, which can occur from the unfolding of function constants. This equivalence
relation will use a coinductive principle to establish a bisimilarity of proof objects.
Bisimulation A proof D will be considered a bisimulation of another proof D′, written as
D D′ if D = D′ or if a decomposition of the proof tree of D and D′ have R = R′ and Di D′
i
under the assumption D D′, where D and D′ are written as below.
D =
D0 ··· Dn R Γ ⊢ t : A
D′ =
D′
0 ··· D′
n R Γ ⊢ s : B
Intuitively, two proofs will be identical under this relation if they are equal (modulo our
equivalence relation corresponding to reduction), or if they have equal rules and bisimilar sub-
parts.
5 Example
We take an example using the co-natural numbers N∞ ≡ νX.1+X and potentially inﬁnite lists
[A] ≡ ΛA.νX.1 + (A × X). Here we take ∆ to be deﬁned as:
∆(zero) := fold(inl(),N∞)
∆(plus) := λ x y : N∞ .
case (unfold(x,N∞)) of
| inl(z) ⇒ ys
| inr(n) ⇒
fold(inr(plus n y),N∞)
∆(sumlen) := λ xs : [N∞] .
case (unfold(xs,[N∞])) of
| inl(nil) ⇒ zero
111Cyclic Proofs and Coinductive Principles Mendel-Gleason and Hamilton
| inr(p) ⇒
split p as (n,xs′)
in fold(inr(plus n (sumlen xs′)),N∞)
The program sumlen is meant to calculate the sum of elements in a potentially inﬁnite list,
plus the size of the list. It will not pass a test of the guardedness condition, despite being
productive, since it involves internal cuts with the plus function. However, by producing a
cyclic proof, unfolding and subsequently eliminating intermediate cuts we will be able to prove
productivity.
A perhaps more interesting example is the following ﬁlter function given by Komendantskaya
and Bertot in [3]. We start with the following program:
p Zero = Zero
p (Succ x’) = x’
le Zero = True
le Zero = False
le (Succ x’) (Succ y’) = le x’ y’
f (x:y:tl) = case (le x y) of
True -> x:(f (y:tl))
False -> f ((pred x):y:tl)
We can then create the transition system demonstrating type-correctness and reify to obtain
the following functions:
redz Zero xs = Zero:(f (Zero:xs))
redz (Succ x) xs = redz x xs
red x y tl = case le x y of
False -> case x of
Zero -> Zero:(f ((Succ y):tl))
Succ x’ -> red x’ y tl
True -> (Succ x):(f ((Succ y):tl))
le Zero = True
le Zero = False
le (Succ x’) (Succ y’) = le x’ y’
f (Zero:y:tl) = Zero:(f (y:tl))
f ((Succ x):Zero:tl) = redz x tl
f ((Succ x):(Succ y):tl) = red x y tl
As we can see here, the always, eventually notion of productivity that is given in [3] is recast
as a coinductive function meeting the guardedness condition, with auxiliary inductive functions
representing the eventually criterion.
6 Conclusion and Prior Work
We have given what is to our knowledge the ﬁrst account of cyclic proofs over mixed inductive
and coinductive types. We demonstrate the utility of such a presentation by showing how proofs
can more easily be transformed to equivalent proofs which meet syntactic restrictions ensuring
soundness.
112Cyclic Proofs and Coinductive Principles Mendel-Gleason and Hamilton
The correspondence between cyclic proof and functional programs has previously been de-
scribed by Robin Cockett [5]. His work also makes a distinction between inductive and coin-
ductive types.
Gordon developed the use of transition systems for the purpose of demonstrating bisimilarity
[7]. Gordon showed that bisimilarity was a contextual equivalence relation. In future work we
hope to show that the notion of equivalence given here is a contextual equivalence relation for
the variant of System F given.
Various methods of dealing with inductive and coinductive types in a constructive type
theory are demonstrated in [8] [6] [1]. The approach taken here diﬀers in that we use transition
systems rather than saturated sets to show consistency.
Using cyclic proofs with side conditions allows for more direct proofs of functional program
correctness than do methods such as syntactic restrictions [11] [8]. As such, this direct method
seems more suitable for use as an aid to proving correctness of real wold functional programs.
The authors care currently working on an implementation of a proof system using the ideas
presented in this paper.
Acknowledgments. This work is supported, in part, by Science Foundation Ireland grant
03/CE2/I303 1 to Lero, the Irish Software Engineering Research Centre (www.lero.ie).
References
[1] Andreas Abel. Mixed inductive/coinductive types and strong normalization. In APLAS, pages
286–301, 2007.
[2] Andreas Abel. Typed applicative structures and normalization by evaluation for system f
ω.
In Erich Gr¨ adel and Reinhard Kahle, editors, CSL, volume 5771 of Lecture Notes in Computer
Science, pages 40–54. Springer, 2009.
[3] Yves Bertot and Ekaterina Komendantskaya. Inductive and coinductive components of corecursive
functions in coq. Electron. Notes Theor. Comput. Sci., 203(5):25–47, 2008.
[4] James Brotherston. Cyclic proofs for ﬁrst-order logic with inductive deﬁnitions. In B. Beck-
ert, editor, Automated Reasoning with Analytic Tableaux and Related Methods: Proceedings of
TABLEAUX 2005, volume 3702 of LNAI, pages 78–92. Springer-Verlag, 2005.
[5] J. Robin B. Cockett. Deforestation, program transformation, and cut-elimination. Electr. Notes
Theor. Comput. Sci., 44(1), 2001.
[6] Eduardo Gim´ enez. Structural recursive deﬁnitions in type theory. In ICALP ’98: Proceedings
of the 25th International Colloquium on Automata, Languages and Programming, pages 397–408,
London, UK, 1998. Springer-Verlag.
[7] Andrew D. Gordon. Bisimilarity as a theory of functional programming. Theor. Comput. Sci.,
228(1-2):5–47, 1999.
[8] Christine Paulin-Mohring. Inductive deﬁnitions in the system coq - rules and properties. In TLCA
’93: Proceedings of the International Conference on Typed Lambda Calculi and Applications, pages
328–345, London, UK, 1993. Springer-Verlag.
[9] Simon L. Peyton Jones and David R. Lester. Implementing functional languages. Prentice-Hall,
Inc., Upper Saddle River, NJ, USA, 1992.
[10] Benjamin C. Pierce. Types and programming languages. MIT Press, Cambridge, MA, USA, 2002.
[11] D. A. Turner. Total functional programming. Journal of Universal Computer Science, 10(7):751–
768, 2004.
113

Cyclic Proofs and Coinductive Principles

http://www.chem.cmu.edu/groups/mccullough/publication/PDF%20files/2000-lz.pdf

Cyclic Proofs and Coinductive Principles

Abstract

Similar works

Full text

Available Versions

CiteSeerX