For loyal QA9 readers, advance announcement that our release of Cedille 1.0.0 (promised some time ago!) is going to be made Friday. You can get a sneak peak at the web site here. The links on that page to the github repo won’t work yet as the repo is private. But this will change Friday. We will have a Debian package for easy installation — and will be happy for pull requests for packaging for other systems!

## Category Archives: Uncategorized

I haven’t yet started repeating myself — though there’s every chance you’ll hear it here twice — but iteration is the sort of thing one can find just one use after another for. I mean, if you’ve seen it once, you’ve seen it a thousand times: iteration delivers repeatedly. How many times have you iterated to good effect? I say again: is iteration great or what?

Ok, got that out of my system. 🙂 I am working on lambda encodings right now, and with Church-encoded data, every piece of data is its own iterator. So the encoding tends to make one think of algorithms in terms of iteration. We have a function f, and a starting point a, and we wish to apply f to a in a nested fashion, n times: and . To multiply numbers N and M, for example, we can iterator the function “add M” on starting point 0, N times. And other natural algorithms have iterative formulations.

What about division? Usually in total type theories (where it is required that uniform termination of every function — that is, termination on all inputs — has to be confirmed statically by some termination-checking algorithm or technique), natural-number division is implemented using well-founded recursion. The idea is that to divide x by y, we basically want to see how many times we can subtract y from x until x becomes smaller than y (at which point it is the remainder of the division). So one wants to make a recursive call to division on x – y, and since that quantity is not the predecessor of x (or y), the usual structural decrease demanded by the termination checker is not satisfied. So the usual simple schemes for observing termination statically cannot confirm that division is terminating. And indeed, if y were 0, there would be no structural decrease. So it is not a completely trivial matter. The solution one finds in Coq (Arith/Euclid.v in the standard library for Coq version 8.4) and Agda (Data/Nat/DivMod.agda in the standard library version 0.8) is to use well-founded recursion. This is a somewhat advanced method that uses a generalized inductive type to encode, effectively, all the legal terminating call sequences one could make using a given well-founded ordering. Then we can do structural recursion on an extra argument of this generalized inductive type.

Well-founded recursion is really quite cool, and it’s amazing to see the power of the type theory in the fact that well-founded recursion is derivable, not primitive, to the language. Every student of type theory should try walking through the definitions needed for well-founded recursion over, say, that natural number ordering <. But as elegant and impressive as it is, it's a pretty heavy hammer to have to get out. For starters, if you want to reason later about the function you defined by well-founded recursion, you are most likely going to have to use well-founded induction in that reasoning. So you find yourself continually setting up these somewhat complicated inductions to prove simple lemmas. A second issue is that at least in Agda, because there is no term erasure explicit in the language, if you write a function by well-founded recursion, you are going to be manipulating these values of the generalized inductive datatype at runtime. I reported earlier on this blog that in my experience this led to a major, major slowdown for running code extracted from Agda. So if you are just doing some formal development to prove a theorem, then well-founded recursion won't cause you serious problems in Agda. But if you want to extract and run code that uses well-founded recursion, you likely will see major performance issues.

In my standard library for Agda, the version of natural-number division defined by well-founded recursion is in nat-division.agda:

{- a div-result for dividend x and divisor d consists of the quotient q, remainder r, and a proof that q * d + r = x -}

div-result : ℕ → ℕ → Set

div-result x d = Σ ℕ (λ q → Σ ℕ (λ r → q * d + r ≡ x))

```
```div-helper : ∀ (x : ℕ) → WfStructBool _<_ x → (y : ℕ) → y =ℕ 0 ≡ ff → div-result x y

div-helper x wfx 0 ()

div-helper x (WfStep fx) (suc y) _ with 𝔹-dec (x =ℕ 0)

... | inj₁ u = 0 , 0 , sym (=ℕ-to-≡ u)

... | inj₂ u with 𝔹-dec (x < (suc y))

... | inj₁ v = 0 , (x , refl)

... | inj₂ v with (div-helper (x ∸ (suc y)) (fx (∸< {x} u)) (suc y) refl)

... | q , r , p with <ff {x} v

... | p' with ∸eq-swap{x}{suc y}{q * (suc y) + r} p' p

... | p'' = (suc q) , (r , lem p'')

where lem : q * (suc y) + r + suc y ≡ x → suc (y + q * suc y + r) ≡ x

lem p''' rewrite

+suc (q * (suc y) + r) y

| +comm y (q * (suc y))

| +perm2 (q * (suc y)) r y = p'''

`_÷_!_ : (x : ℕ) → (y : ℕ) → y =ℕ 0 ≡ ff → div-result x y`

x ÷ y ! p = div-helper x (wf-< x) y p

This code returns a value of type div-result x y, which contains the quotient q, remainder r, and the proof that x equals y * q + r. It is not as simple as one would like, due to the use of well-founded recursion.

But we can avoid well-founded recursion for defining division, if we go back to our old friend iteration (“There he is again!” — sorry, I said I had that out of my system, but apparently not quite). Because we know that we will not possibly iterate subtraction of y from x more than x times, if y is not 0. So we can pass an extra argument in to division which is a counter, that we start out at x. Again we use the div-result type, but this time there is no need for well-founded recursion:

divh : (n : ℕ) → (x : ℕ) → (y : ℕ) → x ≤ n ≡ tt → y =ℕ 0 ≡ ff → div-result x y

divh 0 0 y p1 p2 = 0 , 0 , refl

divh 0 (suc x) y () p2

divh (suc n) x y p1 p2 with keep (x < y)

divh (suc n) x y p1 p2 | tt , pl = 0 , x , refl

divh (suc n) x y p1 p2 | ff , pl with divh n (x ∸ y) y (∸≤2 n x y p1 p2) p2

divh (suc n) x y p1 p2 | ff , pl | q , r , p = suc q , r , lem

where lem : y + q * y + r ≡ x

lem rewrite sym (+assoc y (q * y) r) | p | +comm y (x ∸ y) = ∸+2{x}{y} (<ff{x}{y} pl)

```
```

`_÷_!_ : (x : ℕ) → (y : ℕ) → y =ℕ 0 ≡ ff → div-result x y`

x ÷ y ! p = divh x x y (≤-refl x) p

You can find this in nat-division2.agda. The code is also a bit less cluttered with helper lemmas, although we still do need to require that x is less than or equal to n, in order to rule out the case that we run out of counter budget (n) before we are done dividing x.

This example shows that sometimes iteration is sufficient for defining functions like division whose natural definition is not structurally recursive. The moral of the story is that we should not forget about iteration. And that is a lesson worth repeating!

Well, I am embarrassed at how late I am in posting the solution to the puzzle I mentioned in my last post. It has been a busy summer with taking care of our sweet new baby at home, and running StarExec development at work. Anyhow, below is a graph with the minimum number of nodes which contains every legal possible combination of properties from termination (aka strong normalization), normalization (aka weak normalization), confluence (aka Church-Rosser), and local confluence (aka Weak Church-Rosser), and their negations. This graph was found by Hans Zantema, whom I asked about this puzzle by email (he agreed to let me share his solution here). Furthermore, he argues that 11 is the minimal number of nodes, as follows. Out of the 16 possible combinations of properties SN, WN, CR, and WCR and their negations, we exclude immediately the combinations with SN and ~WN (since SN implies WN) and CR and ~WCR (since CR implies WCR). So there are three legal possibilities for the values of CR and WCR, and three for the values of SN and WN. These are independent, so there are 9 legal combinations of properties. Now, Hans argues, since there is a node X which is SN and ~WCR, there must be two nodes which are SN and CR. For since X is SN but not WCR, it has two children (which are still SN) which cannot be joined. We may assume these children are themselves CR, otherwise we could repeat this observation and the graph would not be minimal. Similarly, since there is a node which is ~WN and ~WCR, there must be two nodes which are ~WN and CR. So there must be at least 11 nodes. And the graph below has 11 nodes. To test your knowledge, you can try to identify which combination of properties each node has! Fun!

Suppose we have a graph (A,->) consisting of a set of objects A and a binary relation -> on A. This is a simple case of an abstract reduction system, as defined in the Terese book (in the more general case, we have not just one relation ->, but an indexed set of relations). In the theory of abstract reduction systems, an element x is confluent iff whenever there is a path from x to y and a path from x to z, then there exists some element q which is reachable from both y and z. An element x is locally confluent iff whenever there is an edge (not an arbitrary path) from x to y and an edge from x to z, then there is some element q reachable from both y and z. So confluence implies local confluence, but (rather famously) the reverse implication holds only for terminating systems. An element is terminating iff there are no infinite paths from that element. An element is normalizing iff there exists a path from that element to a normal form, which is an element that has no outgoing edges. So terminating implies normalizing.

We have these four properties: confluence, local confluence, termination (sometimes also called strong normalization), and normalization (sometimes called weak normalization). What is the smallest graph that is property diverse, in the sense that for every consistent combination of properties, the graph contains an element with that combination of properties? (The consistency requirement for the set of properties for an element arises because confluence implies local confluence and termination implies normalization).

I will post the answer to this (with a nice picture) Monday…

Just a quick note: the PLPV 2012 PC chairs have posted a call for papers. The submission deadline is Oct. 11th. This is a great opportunity to give a talk to an audience likely to include many well-known researchers, since PLPV is affiliated with POPL and has had quite significant registration numbers (among the highest of all affiliated workshops) in the past couple years.