Blueberry Wren ThoughtsThe bloggings of WrenZola2026-10-10T00:00:00+00:00https://blueberrywren.dev/atom.xmlA tale of four theorem provers, or: A (reasonably) opinionated comparison of Isabelle/HOL, Lean, HOL4, and Agda2026-10-10T00:00:00+00:002026-10-10T00:00:00+00:00
Blueberry Wren
https://blueberrywren.dev/blog/primes/<h1 id="the-above-wow-long-title">The above (wow, long title)</h1>
<p>In which I compare Lean, Isabelle/HOL, Agda, and HOL4 with only mild regard for "fairness".</p>
<h1 id="what-are-we-comparing-anyway">What are we comparing, anyway?</h1>
<p>All four of the above are theorem proving applications; that is, their purpose is to computer-formalize mathematics.
Broadly speaking, both Lean and Agda are dependent-types based systems, utilizing the Curry-Howard correspondence to prove theorems via a complex type system, whereas Isabelle/HOL and HOL4 are LCF-style systems, with a small "proof kernel" containing base rules (e.g. <code>forall x, x = x</code>) that all proofs must be constructed via.
Both foundations have advantages and disadvantages, and some will be discussed.</p>
<h1 id="and-on-what">And on what?</h1>
<p>I have formalized in all four a proof of the infinitude of primes; that is, the statement "For any number n, there is a prime larger than n". The exact proof formalized is the "usual" construction by Euclid, which you can find on Wikipedia if you want; <a href="https://en.wikipedia.org/wiki/Euclid%27s_theorem">see here</a>.</p>
<p>All of the proofs structurally look similar (mostly, we'll get to that), and hence it was the user experience that made the difference. For transparency, before this experiment, I was most familiar with Isabelle/HOL and Agda, and to some extent learnt HOL4 and Lean as part of this review.</p>
<h1 id="comparison-time">Comparison time!</h1>
<p>What follows is a bunch of opinions and somewhat arbitrary categories. Don't expect an unbiased review, please. If you only want proof comparisons, skip to Proof Comparisons, and if you only want more opinions, read the below and then skip to Arbitrary Rankings. The opinions go first.</p>
<p>I do not claim any of the following proofs are perfect! They're probably quite mediocre, really.</p>
<h2 id="overarching-similarities-differences">Overarching similarities/differences</h2>
<p>There are a few categories by which we can group these theorem provers. We have the above mentioned:</p>
<ul>
<li>LCF-style: Isabelle/HOL, HOL4</li>
<li>Dependent-style: Lean, Agda</li>
</ul>
<p>But there's also:</p>
<h3 id="interactivity">Interactivity</h3>
<ul>
<li>High-interactivity: Isabelle/HOL, Lean</li>
<li>Low-interactivity: HOL4, Agda</li>
</ul>
<p>Reasoning: Both Isabelle/HOL and Lean provide "live updates" as you type, and their structured proofs can be "down-arrow"'d through, to see intermediate steps. In contrast, both completed HOL4 and Agda proofs exist as fully-put-together terms that must be manually taken apart if you wish to inspect their internals. Both HOL4 and Agda can show you your current state and related information at any time, of course.</p>
<h3 id="automation">Automation</h3>
<ul>
<li>High-automation: Isabelle/HOL, HOL4</li>
<li>Medium-automation: Lean</li>
<li>Low-automation: Agda</li>
</ul>
<p>Isabelle/HOL has <code>sledgehammer</code>, which calls out to a number of external proof generation methods (SAT/SMT solvers, various FOL solvers, etc). For any goal that looks doable-but-annoying, there's a solid chance <code>sledgehammer</code> can solve it - this is nice because it saves you work, but the proofs it generates are also indecipherable, which is perhaps less than ideal. There also exists an equivalent for HOL4 called HolyHammer, but I didn't realize it existed until after I was writing this. Oh well. Isabelle/HOL and HOL4 both have very good support for many automated simplification and proof methods, which come in quite handy when trying to work with complex assumptions, for example. It may not be obvious how to proceed without simplification kicking in to chunk everything down.</p>
<p>Lean has decent automation, but not to the same level as Isabelle/HOL or HOL4. Its <code>simp</code> is not nearly as productive, and while <code>grind</code> is a very neat approach that can sometimes rival <code>sledgehammer</code>, a lot of the time it's quite useless for reasons beyond me. Both <code>sledgehammer</code> and <code>grind</code> are all-or-nothing; if they don't solve the goal, they make no progress. This is in contrast to <code>simp</code> (in all three), or more specialized tools like <code>auto</code> (Isabelle/HOL) or <code>gvs</code> (HOL4), which can make some progress and then leave the context in (ideally) a better place. The fact Lean doesn't have nearly as good partial-automation is a bit of a shame, because in my experience that's what actually matters more. Notably, both Lean and Isabelle/HOL have a <code>try</code> (In Isabelle/HOL, <code>try</code>/<code>try0</code> for with/without <code>sledgehammer</code>; in Lean, <code>try?</code>/<code>exact?</code>/<code>rw?</code>) that "have a go" at your goal with various automated methods and direct solve attempts. HOL4 doesn't have an equivalent, as far as I can tell, which is unfortunate, as it's quite handy.</p>
<p>Agda has essentially no automation. The only simplification you get is what can be computed based on inputs to functions. This, to be a bit frank, sort of sucks. It's quite hard to get things done because there's so much manual fiddling that must be taken into account. I am personally not a fan.</p>
<h3 id="foundations">Foundations</h3>
<p>Isabelle/HOL and HOL4 are both extremely classical in their foundations, which means that they accept the Law of Excluded Middle (∀ P. ¬P ∨ P), and both also axiomatize Hilbert's epsilon, which leads also to the Axiom of Choice. This seems to have a very positive effect on automated solvers, which quite often rely on laws such as double-negation elimination (¬¬P --> P), which is equivalent to the LEM. Lean is theoretically constructive (and hence does not have the LEM by default), but some of the "good" proof automation requires the LEM, and it seems the norm to use Lean classically, so that's what I did. <code>grind</code> for example just assumes you're using it. This does have the disadvantage that Lean isn't as good at dealing with e.g. existentials, for example.</p>
<p>Agda is constructive by default, and it seems the norm in the Agda world to keep your proofs that way, so I did. The big advantage of this is that after proving there are infinitely many primes, I can actually generate them! I can give my proof a number, and it'll spit out a prime bigger than that number. The disadvantage is that it is <em>horribly</em> slow to do so:</p>
<ul>
<li>0: 2 (instant)</li>
<li>1: 3 (instant)</li>
<li>2: 7 (instant)</li>
<li>3: 5 (instant)</li>
<li>4: 11 (quarter second)</li>
<li>5: 7 (quarter second)</li>
<li>6: 71 (3s)</li>
<li>7: 61 (10s)</li>
<li>8: 19 (40s)</li>
</ul>
<p>This may make sense if you looked at the proof structure above; we consider <code>(n + 1)! + 1</code>, so inside that proof, it's checking primality at numbers around ~360,000; that's going to be a bit slow. This construction, it should be noted, isn't meant to be fast, but it's also the most natural one. Is it worth giving up the LEM and good proof automation? You decide.</p>
<h3 id="dependent-types-as-a-foundation-vs-lcf">Dependent types as a foundation vs LCF</h3>
<p>I'm more a fan of LCF because it seems more amenable to automation, and I don't see the point of carrying around proof terms (classical logic is too useful!). If you vehemently disagree, email me at contact AT blueberrywren.dev, and if I like your argument enough I'll post it here.</p>
<h3 id="interaction-mode">Interaction mode</h3>
<p>Both Lean and Isabelle/HOL are interacted with interactively. Lean has modes for other editors, but high recommends the use of VSCode, and Isabelle/HOL has its own editor (jEdit) that it also practically forces the use of. This is <em>fine</em>; I understand why they do this, as interactive development is reasonably hard to make generic. Both of them make it work.</p>
<p>HOL4 is interacted with via either an Emacs mode or a Vim mode, and keybinds that allow one to copy text in/out of a running HOL4 REPL. This sounds weird because it is, but it works surprisingly well. I was already an Emacs user, so nothing really changed for me.</p>
<p>Agda is also interacted with via an Emacs mode, but everything happens in your file; you can use keybinds to refresh the state, add proof goals, etc. It also works fine.</p>
<p>As mentioned above, the advantage of the Lean/Isabelle/HOL approach is that one can see proofs in-progress, which you can't with Agda.</p>
<h3 id="documentation">Documentation</h3>
<p>Both Isabelle/HOL and HOL4 have extremely good mechanisms for searching for theorems; an editor panel + <code>find_theorems</code> for the former, and <code>DB.find</code>/<code>DB.match</code> for the latter. These allow for the searching of theorems by both name and by patterns, so I could for example search for lemmas of form <code>_ < SUC _</code>. This is <em>so</em> handy! Very often you know the <em>shape</em> of something you want, but maybe not the lemma itself.</p>
<p>Lean has leansearch and loogle, which are interesting, but they:</p>
<ol>
<li>Aren't built in.</li>
<li>Aren't as good.</li>
</ol>
<p>Which kind of sucks. <code>exact?</code> and <code>rw?</code> exist as "here's stuff you might be able to do", but they're nowhere near as flexible.</p>
<p>Agda, as expected perhaps, does not have an equivalent. One must become a master of <del>zen</del> looking through the right parts of the Agda standard library.</p>
<h1 id="proof-comparisons">Proof Comparisons</h1>
<p>Note: This isn't really meant to be a tutorial for any of these, though I will do a little explaining at the start. It's mostly for the reader to compare them, and see what ~equivalent statement proofs look like in different languages.</p>
<p>Let's get into the proofs! We'll go segment by segment, exploring sections of the proof and explaining as we go. Before that, some vaguely interesting stats:</p>
<ul>
<li>Isabelle/HOL: 117 LOC, with 19 proofs.</li>
<li>Lean: 155 LOC, with 12 proofs.</li>
<li>HOL4: 190 LOC, with 16 proofs.</li>
<li>Agda: 264 LOC, with 45 proofs (29, not counting <code>where</code> blocks)</li>
</ul>
<p>These are nowhere near apples-to-apples, but they're still fun.</p>
<p>We start with defining divisibility. In Agda we cheat and use the standard library version, so we can get proofs around computing divisors, which I didn't feel like redoing.</p>
<p>Isabelle/HOL:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>definition divides :: "nat ⇒ nat ⇒ bool" where</span></span>
<span class="giallo-l"><span> "divides n k = (∃j. j * n = k)"</span></span></code></pre>
<p>Lean:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>@[grind]</span></span>
<span class="giallo-l"><span>def divides (n k : Nat) : Prop :=</span></span>
<span class="giallo-l"><span> ∃q, k = n * q</span></span></code></pre>
<p>HOL4:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>Definition divides_def:</span></span>
<span class="giallo-l"><span> divides n k = ∃q. q * n = k</span></span>
<span class="giallo-l"><span>End</span></span></code></pre>
<p>Agda (looks like, in the standard library):</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>record _∣_ (m n : ℕ) : Set where</span></span>
<span class="giallo-l"><span> constructor divides</span></span>
<span class="giallo-l"><span> field quotient : ℕ</span></span>
<span class="giallo-l"><span> equality : n ≡ quotient * m</span></span></code></pre>
<p>So, basically the same. Then there's a few lemmas around divisibility proved (<code>divides k 0</code>, <code>divides k k</code>, etc). One we'll show off is <code>divides n k ==> divides n j ==> divides n (k - j)</code>, as it's mildly interesting in some of the theorem provers. In all of the following, the mult/sub lemma essentially states <code>a * (b - c) = a * b - a * c</code>.</p>
<p>Isabelle/HOL:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>lemma divides_diff: "divides x k ⟹ divides x n ⟹ divides x (k - n)"</span></span>
<span class="giallo-l"><span> using divides_def by (metis diff_mult_distrib)</span></span></code></pre>
<p>The proof search procedure <code>metis</code> does most of the work.</p>
<p>Lean:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>theorem divides_sub (n j k : Nat) (h1 : divides n k) (h2 : divides n j)</span></span>
<span class="giallo-l"><span> : divides n (k - j) := by</span></span>
<span class="giallo-l"><span> obtain ⟨q1, h1⟩ := h1</span></span>
<span class="giallo-l"><span> obtain ⟨q2, h2⟩ := h2</span></span>
<span class="giallo-l"><span> unfold divides</span></span>
<span class="giallo-l"><span> exists (q1 - q2)</span></span>
<span class="giallo-l"><span> grind [Nat.mul_sub]</span></span></code></pre>
<p>We do some unpacking, then identify <code>q1 - q2</code> as the other term (such that <code>n * (q1 - q2) = k - j</code>). Then grind with the appropriate lemma gets us there.</p>
<p>HOL4:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>Theorem divides_sub:</span></span>
<span class="giallo-l"><span> divides n k ⇒ divides n j ⇒ divides n (k - j)</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> rpt strip_tac</span></span>
<span class="giallo-l"><span> >> metis_tac[RIGHT_SUB_DISTRIB, divides_def]</span></span>
<span class="giallo-l"><span>QED</span></span></code></pre>
<p>Like Isabelle/HOL, when supplied with the appropriate lemmas, <code>metis_tac</code> takes it out.</p>
<p>Agda:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>divides-sub : ∀ {i j k} → i ∣ j → i ∣ k → i ∣ (j ∸ k)</span></span>
<span class="giallo-l"><span>divides-sub {i} (divides-refl q₁) (divides-refl q₂) = divides (q₁ ∸ q₂) (sym (*-distribʳ-∸ i q₁ q₂))</span></span></code></pre>
<p>Very similar. <code>divides-refl</code> is an abbreviation for <code>divides _ refl</code>, and like in Lean, we must manually point out <code>q₁ ∸ q₂</code>.</p>
<p>It was interesting to me that the Lean proof was, to some extent, such a pain. I had to put more effort into that one than any of the others, despite Lean having reasonably decent automation! Finding the appropriate lemmas was mildly more painful, and this was while I was still puzzling over syntax, to be fair.</p>
<p>We next need to define the product of a list of numbers, which looks like the following:</p>
<p>Isabelle/HOL:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>fun prod_list :: "nat list ⇒ nat" where</span></span>
<span class="giallo-l"><span>"prod_list [] = 1" | </span></span>
<span class="giallo-l"><span>"prod_list (x # xs) = x * prod_list xs"</span></span></code></pre>
<p>Lean:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>@[simp, grind]</span></span>
<span class="giallo-l"><span>def prod_list (xs : List Nat) : Nat :=</span></span>
<span class="giallo-l"><span> match xs with</span></span>
<span class="giallo-l"><span> | [] => 1</span></span>
<span class="giallo-l"><span> | x :: xs => x * prod_list xs</span></span></code></pre>
<p>The <code>simp</code> and <code>grind</code> markers were meant to help the automated proof methods out, and they did!</p>
<p>HOL4:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>Definition prod_list_def:</span></span>
<span class="giallo-l"><span> (prod_list [] = 1) ∧</span></span>
<span class="giallo-l"><span> (prod_list (x :: xs) = x * prod_list xs)</span></span>
<span class="giallo-l"><span>End</span></span></code></pre>
<p>Agda:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>prod-list : List Nat → Nat</span></span>
<span class="giallo-l"><span>prod-list [] = 1</span></span>
<span class="giallo-l"><span>prod-list (x ∷ xs) = x * prod-list xs</span></span></code></pre>
<p>Defining things in HOL4 is a little interesting, because you're just defining the body as a proof! That definition spits out a theorem <code>prod_list_def</code> that is literally</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>val it = ⊢ prod_list [] = 1 ∧ ∀x xs. prod_list (x::xs) = x * prod_list xs: thm</span></span></code></pre>
<p>!</p>
<p>Here in the Agda proof we also do a bunch of work to set up what will become a decision procedure for primality. This is because later we wish to ask "Is this prime?", and without the LEM to say "It must either be prime or not prime", we need to write an algorithm to decide this for us.</p>
<p>Back on track, we need to show a few lemmas around with prod list function. One of the interesting ones is as follows, where we prove that a number in said list will divide the product of the list.</p>
<p>Isabelle/HOL:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>lemma divides_prod_list: "x ∈ set xs ⟹ divides x (prod_list xs)"</span></span>
<span class="giallo-l"><span> apply (induct xs)</span></span>
<span class="giallo-l"><span> apply simp</span></span>
<span class="giallo-l"><span> apply auto</span></span>
<span class="giallo-l"><span> apply (case_tac xs; simp add: divides_def)</span></span>
<span class="giallo-l"><span> apply (case_tac xs; simp)</span></span>
<span class="giallo-l"><span> apply (rule mult_divide_l)</span></span>
<span class="giallo-l"><span> by assumption</span></span></code></pre>
<p>Very implicit; it's hard to tell what's going on, but the basic structure is there. Induct on the list, do some casing, apply a lemma about <code>divides _ (_ * _)</code>.</p>
<p>Lean:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>theorem divides_prod_list : ∀ xs x, x ∈ xs -> divides x (prod_list xs) := by</span></span>
<span class="giallo-l"><span> intros xs x mem</span></span>
<span class="giallo-l"><span> induction xs with</span></span>
<span class="giallo-l"><span> | nil => grind</span></span>
<span class="giallo-l"><span> | cons y ys ih =></span></span>
<span class="giallo-l"><span> by_cases h : (x = y)</span></span>
<span class="giallo-l"><span> · rw [h]</span></span>
<span class="giallo-l"><span> simp</span></span>
<span class="giallo-l"><span> exists (prod_list ys)</span></span>
<span class="giallo-l"><span> · cases mem with</span></span>
<span class="giallo-l"><span> | head => grind</span></span>
<span class="giallo-l"><span> | tail =></span></span>
<span class="giallo-l"><span> rename_i a</span></span>
<span class="giallo-l"><span> have ⟨h, hq⟩ := ih a</span></span>
<span class="giallo-l"><span> simp at *</span></span>
<span class="giallo-l"><span> rw [hq]</span></span>
<span class="giallo-l"><span> exists (y * h)</span></span>
<span class="giallo-l"><span> grind</span></span></code></pre>
<p>Reasonably large. We have to destructure the membership quite manually, which gets a little troublesome. It's a fairly straightforward proof, though.</p>
<p>HOL4:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>Theorem divides_prod_list:</span></span>
<span class="giallo-l"><span> x ∈ set xs ⇒ divides x (prod_list xs)</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> Induct_on ‘xs’</span></span>
<span class="giallo-l"><span> >- fs[]</span></span>
<span class="giallo-l"><span> >- (fs[]</span></span>
<span class="giallo-l"><span> >> rpt strip_tac</span></span>
<span class="giallo-l"><span> >- (fs[prod_list_def, divides_def]</span></span>
<span class="giallo-l"><span> >> qexists_tac ‘prod_list xs’</span></span>
<span class="giallo-l"><span> >> simp[])</span></span>
<span class="giallo-l"><span> >- (fs[divides_def, prod_list_def]</span></span>
<span class="giallo-l"><span> >> qexists_tac ‘h * q’</span></span>
<span class="giallo-l"><span> >> rev_drule EQ_SYM</span></span>
<span class="giallo-l"><span> >> strip_tac</span></span>
<span class="giallo-l"><span> >> fs[]))</span></span>
<span class="giallo-l"><span>QED</span></span></code></pre>
<p>Also not crazy, although it's hard to see the exact structure without comments (which I didn't write :P). This is a good time to point out HOL4 proofs are literally just SML terms! There's nothing more to it! The combinators <code>>></code> and <code>>-</code> (for apply latter to all subgoals of former, and to one subgoal of former resp.) are just infix functions composing other functions! It's all just SML! You interact with HOL4 through a REPL, so you construct stuff dynamically, but then you have to puzzle piece your function together afterwards. Once you know that, it's more obvious what's going on; we induct, handle the first case, then simplification on <code>MEM x (h ∷ xs)</code> give us two goals (<code>x = h</code> and <code>x ≠ h, MEM x xs</code> resp.)</p>
<p>Agda:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>prod-list-divides : ∀ xs x → x ∈ xs → x ∣ prod-list xs</span></span>
<span class="giallo-l"><span>prod-list-divides [] x ()</span></span>
<span class="giallo-l"><span>prod-list-divides (y ∷ xs) x (here refl) = divides (prod-list xs) (*-comm y (prod-list xs))</span></span>
<span class="giallo-l"><span>prod-list-divides (y ∷ xs) x (there p) with prod-list-divides xs x p</span></span>
<span class="giallo-l"><span>... | divides q eq rewrite eq = divides (y * q) (sym (*-assoc y q x))</span></span></code></pre>
<p>Very explicit, but also quite concise. Matching on the list membership is quite intuitive, because the Agda mode in Emacs includes a command <code>C-c C-c</code> to automatically case split on basically everything.</p>
<p>While it's much more implicit in Isabelle/HOL and HOL4 (a common theme), all four of these proofs take the form of asking whether the value we care about is at the head of the list, or somewhere later on, and that decides what we fill in divisibility with.</p>
<p>Then, Primality!</p>
<p>Isabelle/HOL:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>definition prime :: "nat ⇒ bool" where</span></span>
<span class="giallo-l"><span> "prime p = ((p > 1) ∧ (∀x. divides x p ⟶ x = p ∨ x = 1))"</span></span></code></pre>
<p>Lean:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>@[simp, grind]</span></span>
<span class="giallo-l"><span>def prime (n : Nat) : Prop :=</span></span>
<span class="giallo-l"><span> (n > 1) ∧ (∀k, divides k n -> k = 1 ∨ k = n)</span></span></code></pre>
<p>HOL4:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>Definition prime_def:</span></span>
<span class="giallo-l"><span> prime n = ((1 < n) ∧ (∀k. divides k n ⇒ k = 1 ∨ k = n))</span></span>
<span class="giallo-l"><span>End</span></span></code></pre>
<p>Agda:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>record Prime (n : Nat) : Set where</span></span>
<span class="giallo-l"><span> constructor isprime</span></span>
<span class="giallo-l"><span> field</span></span>
<span class="giallo-l"><span> gt1 : n > 1</span></span>
<span class="giallo-l"><span> div : ∀ k → k ∣ n → k ≡ 1 ⊎ k ≡ n</span></span></code></pre>
<p>In Agda we also define what it means to be composite as a "positive" definition, instead of just "not prime"; this makes working with it quite a bit easier.</p>
<p>The next "interesting" proof is proving that every not-prime number greater than one has a prime factor. In Agda this is part of the definition of being composite, so we don't bother including it. We're going to move slightly faster from now on, so I won't explain each snippet. Just compare yourselves.</p>
<p>Isabelle/HOL:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>lemma prime_factor: "¬(prime k) ⟹ k > 1 ⟹ ∃p. prime p ∧ divides p k"</span></span>
<span class="giallo-l"><span> apply (induct k rule: measure_induct[of "id"]; simp)</span></span>
<span class="giallo-l"><span> apply (rotate_tac 1)</span></span>
<span class="giallo-l"><span> apply (subst (asm) prime_def)</span></span>
<span class="giallo-l"><span> apply clarsimp</span></span>
<span class="giallo-l"><span> apply (case_tac "prime xa")</span></span>
<span class="giallo-l"><span> apply blast</span></span>
<span class="giallo-l"><span> apply (erule_tac x=xa in allE)</span></span>
<span class="giallo-l"><span> (* found with sledgehammer *)</span></span>
<span class="giallo-l"><span> by (metis divides_gt divides_trans less_Suc0 not_less_iff_gr_or_eq zero_not_divides)</span></span></code></pre>
<p>Lean:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>theorem prime_factor : ∀k, ¬(prime k) -> 1 < k -> ∃p, prime p ∧ divides p k := by</span></span>
<span class="giallo-l"><span> intros k nprime kgt1</span></span>
<span class="giallo-l"><span> induction k using Nat.strongRecOn with</span></span>
<span class="giallo-l"><span> | ind k' ih =></span></span>
<span class="giallo-l"><span> simp at nprime</span></span>
<span class="giallo-l"><span> obtain ⟨x,⟨xd,dvds⟩,xn1,xnk⟩ := nprime kgt1</span></span>
<span class="giallo-l"><span> clear nprime</span></span>
<span class="giallo-l"><span> by_cases h : prime x</span></span>
<span class="giallo-l"><span> · exists x</span></span>
<span class="giallo-l"><span> grind</span></span>
<span class="giallo-l"><span> · have lt : x < k' := by</span></span>
<span class="giallo-l"><span> apply Nat.lt_of_le_of_ne</span></span>
<span class="giallo-l"><span> · apply divides_less <;> grind</span></span>
<span class="giallo-l"><span> · assumption</span></span>
<span class="giallo-l"><span> have gt : 1 < x := by</span></span>
<span class="giallo-l"><span> cases x <;> grind</span></span>
<span class="giallo-l"><span> obtain ⟨p,⟨prm,dvds⟩⟩ := ih x lt h gt</span></span>
<span class="giallo-l"><span> exists p</span></span>
<span class="giallo-l"><span> refine ⟨prm, ?_⟩</span></span>
<span class="giallo-l"><span> apply divides_trans</span></span>
<span class="giallo-l"><span> · assumption</span></span>
<span class="giallo-l"><span> · grind</span></span></code></pre>
<p>HOL4:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>Theorem prime_factor:</span></span>
<span class="giallo-l"><span> ∀k. ¬(prime k) ⇒ 1 < k ⇒ ∃p. prime p ∧ divides p k</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> completeInduct_on ‘k’</span></span>
<span class="giallo-l"><span> >> rpt strip_tac</span></span>
<span class="giallo-l"><span> >> qpat_x_assum ‘¬_’</span></span>
<span class="giallo-l"><span> (fn h => assume_tac</span></span>
<span class="giallo-l"><span> (REWRITE_RULE [prime_def] h))</span></span>
<span class="giallo-l"><span> >> gvs[]</span></span>
<span class="giallo-l"><span> >> Cases_on ‘prime k'’</span></span>
<span class="giallo-l"><span> >- (qexists ‘k'’ >> simp[])</span></span>
<span class="giallo-l"><span> >- (first_x_assum $ qspecl_then [‘k'’] mp_tac</span></span>
<span class="giallo-l"><span> >> strip_tac</span></span>
<span class="giallo-l"><span> >> ‘0 < k'’ by metis_tac[divides_gt1_gt0]</span></span>
<span class="giallo-l"><span> >> ‘1 < k'’ by decide_tac</span></span>
<span class="giallo-l"><span> >> ‘k' <= k’ by gvs[divides_less]</span></span>
<span class="giallo-l"><span> >> ‘k' < k’ by decide_tac</span></span>
<span class="giallo-l"><span> >> first_x_assum drule</span></span>
<span class="giallo-l"><span> >> strip_tac</span></span>
<span class="giallo-l"><span> >> gvs[]</span></span>
<span class="giallo-l"><span> >> qexists ‘p’</span></span>
<span class="giallo-l"><span> >> metis_tac[divides_trans])</span></span>
<span class="giallo-l"><span>QED</span></span></code></pre>
<p>The steps of <code>0 < k'</code> ~> <code>1 < k'</code> and <code>k' <= k</code> ~> <code>k' < k</code> in the HOL4 one annoyed me a lot, but I couldn't figure out how to golf them down. Similarly, this line:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span> obtain ⟨x,⟨xd,dvds⟩,xn1,xnk⟩ := nprime kgt1</span></span></code></pre>
<p>of the Lean proof causes me pain.</p>
<p>We're almost there now! Two more steps to go: Prove there's always a prime outside a given set (list) of numbers, and use that to show the final statement. First, the former:</p>
<p>Isabelle/HOL:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>lemma another_prime: "(∀x∈set xs. x > 1) ⟹ ∃p. prime p ∧ p ∉ set xs"</span></span>
<span class="giallo-l"><span> apply (case_tac "prime (Suc (prod_list xs))")</span></span>
<span class="giallo-l"><span> using prod_list_lt apply fastforce</span></span>
<span class="giallo-l"><span> apply (frule prime_factor)</span></span>
<span class="giallo-l"><span> apply clarsimp</span></span>
<span class="giallo-l"><span> apply (case_tac "length xs = 0"; clarsimp)</span></span>
<span class="giallo-l"><span> apply (rule prod_list_gt_zero; clarsimp)</span></span>
<span class="giallo-l"><span> using prime_gt_one apply fastforce</span></span>
<span class="giallo-l"><span> using divides_prod_list divides_diff prime_gt_one one_divides</span></span>
<span class="giallo-l"><span> by (metis One_nat_def Suc_diff_Suc cancel_comm_monoid_add_class.diff_cancel lessI nat_less_le)</span></span></code></pre>
<p>Lean:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>theorem another_prime (xs : List Nat) (xsgt : ∀x, x ∈ xs -> 1 < x)</span></span>
<span class="giallo-l"><span> : ∃p, prime p ∧ p ∉ xs := by</span></span>
<span class="giallo-l"><span> by_cases h : prime (Nat.succ (prod_list xs))</span></span>
<span class="giallo-l"><span> · exists (Nat.succ (prod_list xs))</span></span>
<span class="giallo-l"><span> refine ⟨h, ?a⟩</span></span>
<span class="giallo-l"><span> by_contra</span></span>
<span class="giallo-l"><span> have lt : Nat.succ (prod_list xs) ≤ prod_list xs := by</span></span>
<span class="giallo-l"><span> apply prod_list_lt <;> grind</span></span>
<span class="giallo-l"><span> grind</span></span>
<span class="giallo-l"><span> · have ⟨pf, isprm, dvds⟩ : ∃p, prime p ∧ divides p (Nat.succ (prod_list xs)) := by</span></span>
<span class="giallo-l"><span> apply prime_factor</span></span>
<span class="giallo-l"><span> · exact h</span></span>
<span class="giallo-l"><span> · grind [prod_list_nz]</span></span>
<span class="giallo-l"><span> by_cases g : pf ∈ xs</span></span>
<span class="giallo-l"><span> · have pfdvds : divides pf (prod_list xs) := by</span></span>
<span class="giallo-l"><span> apply divides_prod_list <;> grind</span></span>
<span class="giallo-l"><span> have divone : divides pf ((Nat.succ (prod_list xs)) - prod_list xs) := by</span></span>
<span class="giallo-l"><span> apply divides_sub <;> grind</span></span>
<span class="giallo-l"><span> have also : divides pf 1 := by grind</span></span>
<span class="giallo-l"><span> grind [divides_not_one]</span></span>
<span class="giallo-l"><span> · grind</span></span></code></pre>
<p>HOL4:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>Theorem another_prime:</span></span>
<span class="giallo-l"><span> ∀(xs : num list). (∀x. x ∈ set xs ⇒ 1 < x)</span></span>
<span class="giallo-l"><span> ⇒ ∃p. prime p ∧ p ∉ set xs</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> rpt strip_tac</span></span>
<span class="giallo-l"><span> >> Cases_on ‘prime (SUC (prod_list xs))’</span></span>
<span class="giallo-l"><span> >- (qexists ‘SUC (prod_list xs)’</span></span>
<span class="giallo-l"><span> >> metis_tac[LESS_REFL, OR_LESS, prod_list_lt, gt1_gt0_weaken])</span></span>
<span class="giallo-l"><span> >- (drule prime_factor</span></span>
<span class="giallo-l"><span> >> impl_tac</span></span>
<span class="giallo-l"><span> >- metis_tac[ONE, LESS_MONO, prod_list_nz,gt1_gt0_weaken]</span></span>
<span class="giallo-l"><span> >- (strip_tac</span></span>
<span class="giallo-l"><span> >> Cases_on ‘MEM p xs’</span></span>
<span class="giallo-l"><span> >- (‘divides p (prod_list xs)’</span></span>
<span class="giallo-l"><span> by metis_tac[divides_prod_list]</span></span>
<span class="giallo-l"><span> >> ‘divides p ((SUC (prod_list xs)) - prod_list xs)’</span></span>
<span class="giallo-l"><span> by metis_tac [divides_sub]</span></span>
<span class="giallo-l"><span> >> gvs[]</span></span>
<span class="giallo-l"><span> >> metis_tac[prime_one, prime_zero, divides_not_one])</span></span>
<span class="giallo-l"><span> >- (qexists ‘p’ >> metis_tac[])))</span></span>
<span class="giallo-l"><span>QED</span></span></code></pre>
<p>Agda:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>prime-not-in : ∀ xs → (∀ x → x ∈ xs → x > 0) → Σ _ λ k → k ∉ xs × Prime k</span></span>
<span class="giallo-l"><span>prime-not-in xs gt with 2 ≤? prod-list xs</span></span>
<span class="giallo-l"><span>... | no ¬a = 2 , lemma , two-prime</span></span>
<span class="giallo-l"><span> where</span></span>
<span class="giallo-l"><span> lemma : 2 ∈ xs → ⊥</span></span>
<span class="giallo-l"><span> lemma pf with prod-list-lt xs gt 2 pf</span></span>
<span class="giallo-l"><span> ... | also = ¬a also</span></span>
<span class="giallo-l"><span>... | yes a with prime-or-composite (suc (prod-list xs)) (s≤s (≤-trans (s≤s z≤n) a))</span></span>
<span class="giallo-l"><span>... | inj₁ x = suc (prod-list xs) , lemma , x</span></span>
<span class="giallo-l"><span> where</span></span>
<span class="giallo-l"><span> lemma : (suc (prod-list xs)) ∈ xs → ⊥</span></span>
<span class="giallo-l"><span> lemma pf with prod-list-lt xs gt (suc (prod-list xs)) pf</span></span>
<span class="giallo-l"><span> ... | also = 1+n≰n also</span></span>
<span class="giallo-l"><span>... | inj₂ (composite p Pp p<n p∣) with p ∈? xs</span></span>
<span class="giallo-l"><span>... | no ¬b = p , ¬b , Pp</span></span>
<span class="giallo-l"><span>... | yes b with prod-list-divides xs p b</span></span>
<span class="giallo-l"><span>... | divs with divides-sub p∣ divs</span></span>
<span class="giallo-l"><span>... | sothen = ⊥-elim (lemma {p} {prod-list xs} sothen λ{ refl → one-prime Pp })</span></span>
<span class="giallo-l"><span> where</span></span>
<span class="giallo-l"><span> suc-sub : ∀ i → suc i ∸ i ≡ 1</span></span>
<span class="giallo-l"><span> suc-sub zero = refl</span></span>
<span class="giallo-l"><span> suc-sub (suc i) = suc-sub i</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> lemma : ∀ {i j} → i ∣ (suc j ∸ j) → i ≢ 1 → ⊥</span></span>
<span class="giallo-l"><span> lemma {_} {j} div neq rewrite suc-sub j = divides-not-one div neq</span></span></code></pre>
<p>The Agda proof differs slightly to accommodate the lack of ranges later.</p>
<p>The Isabelle/HOL proof clearly wins in terms of length here, but it's also really unclear what's going on. Everyone else gets progressively more verbose, and the HOL4 proof in particular here is a bit nastily nested. <code>metis_tac[]</code> (a first-order solver) does a lot of heavy lifting, as does <code>grind</code>. If you're wondering why both Isabelle/HOL and HOL4 have something named <code>metis</code>/<code>metis_tac</code>, it's because it was ported to Isabelle/HOL from HOL4.</p>
<p>We arrive at our final statement! Agda requires some more fiddling as it doesn't have ranges built in like the other two do, but we use our lemma above to construct the list <code>[2..n]</code>, and then show there's a prime outside that (and that it hence must be above <code>n</code>).</p>
<p>Isabelle/HOL:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>lemma infinite_primes: "∃p. prime p ∧ p > n"</span></span>
<span class="giallo-l"><span> apply (insert another_prime[where xs="[2 ..< Suc n]"])</span></span>
<span class="giallo-l"><span> apply (case_tac "n ≤ 1"; clarsimp)</span></span>
<span class="giallo-l"><span> apply (rule_tac x=2 in exI)</span></span>
<span class="giallo-l"><span> apply simp</span></span>
<span class="giallo-l"><span> apply (rule_tac x=p in exI)</span></span>
<span class="giallo-l"><span> apply simp</span></span>
<span class="giallo-l"><span> using prime_gt_one by force</span></span></code></pre>
<p>Lean:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>theorem infinite_primes : ∀ n, ∃p, prime p ∧ p > n := by</span></span>
<span class="giallo-l"><span> intros n</span></span>
<span class="giallo-l"><span> by_cases h : ¬(1 < n)</span></span>
<span class="giallo-l"><span> · exists 2</span></span>
<span class="giallo-l"><span> grind [prime_two]</span></span>
<span class="giallo-l"><span> · simp at h</span></span>
<span class="giallo-l"><span> obtain ⟨p, prm, notin⟩ := another_prime (List.range' 2 n) (by grind)</span></span>
<span class="giallo-l"><span> refine ⟨p, prm, ?notin⟩</span></span>
<span class="giallo-l"><span> grind</span></span></code></pre>
<p>HOL4:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>Theorem infinite_primes:</span></span>
<span class="giallo-l"><span> ∀n. ∃p. prime p ∧ p > n</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> strip_tac</span></span>
<span class="giallo-l"><span> >> Cases_on ‘n < 1’</span></span>
<span class="giallo-l"><span> >- (qexists ‘2’ >> simp[prime_two])</span></span>
<span class="giallo-l"><span> >- (qspec_then ‘listRangeINC 2 n’ assume_tac another_prime</span></span>
<span class="giallo-l"><span> >> ‘∀x. MEM x [2 .. n] ⇒ 1 < x’</span></span>
<span class="giallo-l"><span> by (rpt strip_tac >> gvs[MEM_listRangeINC])</span></span>
<span class="giallo-l"><span> >> first_x_assum rev_drule</span></span>
<span class="giallo-l"><span> >> rpt strip_tac</span></span>
<span class="giallo-l"><span> >> qexists ‘p’</span></span>
<span class="giallo-l"><span> >> gvs[MEM_listRangeINC, prime_gt_one]</span></span>
<span class="giallo-l"><span> >> ‘p ≠ 0’ by metis_tac[prime_zero]</span></span>
<span class="giallo-l"><span> >> ‘p ≠ 1’ by metis_tac[prime_one]</span></span>
<span class="giallo-l"><span> >> decide_tac)</span></span>
<span class="giallo-l"><span>QED</span></span></code></pre>
<p>It annoys me I couldn't get this smaller, but oh well.</p>
<p>Agda:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>infinite-primes : ∀ i → Σ _ λ p → p > i × Prime p</span></span>
<span class="giallo-l"><span>infinite-primes zero = 2 , s≤s z≤n , two-prime</span></span>
<span class="giallo-l"><span>infinite-primes (suc i) with prime-not-in (list-up-to (2+ i)) (list-up-to-nz (2+ i))</span></span>
<span class="giallo-l"><span>... | p , notin , Pp = p , DNE (2+ i ≤? p) lemma , Pp</span></span>
<span class="giallo-l"><span> where</span></span>
<span class="giallo-l"><span> notzero : p ≢ 0</span></span>
<span class="giallo-l"><span> notzero = prime-not-zero p Pp</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> implies : ∀ {a b} → (suc a ≤ b → ⊥) → (a ≡ b) ⊎ (a > b)</span></span>
<span class="giallo-l"><span> implies {a} {b} x with compare a b</span></span>
<span class="giallo-l"><span> ... | less .a k = ⊥-elim (x (s≤s (m≤m+n a k)))</span></span>
<span class="giallo-l"><span> ... | equal .a = inj₁ refl</span></span>
<span class="giallo-l"><span> ... | greater .b k = inj₂ (s≤s (m≤m+n b k))</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> lemma : ((2+ i ≤ p) → ⊥) → ⊥</span></span>
<span class="giallo-l"><span> lemma x with implies x</span></span>
<span class="giallo-l"><span> ... | inj₁ refl = notin (there (here refl))</span></span>
<span class="giallo-l"><span> ... | inj₂ (s≤s a) = notin (list-up-to-contains (2+ i) p (≤-trans a (≤-trans (n≤1+n i) (n≤1+n (suc i)))) (prime-not-zero p Pp))</span></span></code></pre>
<p>We've done it! Euclid would be proud. (probably)</p>
<p>It's now time for more opinions!</p>
<h1 id="arbitrary-rankings">Arbitrary Rankings</h1>
<p>I have five criteria I'll be ranking on:</p>
<ul>
<li>Ease of proof <em>discovery</em> (how easy is it to figure out what I want to do)</li>
<li>Ease of proof <em>manipulation</em> (how easy is it to do what I want)</li>
<li>Enjoyment (how much fun did I have)</li>
<li>Annoyance factor (how often was I going "ugh!")</li>
<li>Puzzled factor (how often did I go "why can't you solve this??")</li>
</ul>
<h2 id="ease-of-proof-discovery-higher-better">Ease of proof discovery (higher better)</h2>
<ol>
<li>Isabelle/HOL</li>
<li>HOL4</li>
<li>Lean</li>
<li>Agda</li>
</ol>
<p>Not much to comment on here, really. <code>sledgehammer</code> is a great boon, and both Isabelle/HOL and HOL4's theorem discovery tools are great. Lean was reasonably close behind, with <code>try?</code> often giving good related lemmas as a solve, and Agda was clearly last. Paging through <code>.agda</code> files online to find lemmas is annoying.</p>
<h2 id="ease-of-proof-manipulation-higher-better">Ease of proof manipulation (higher better)</h2>
<ol>
<li>Agda</li>
<li>Lean</li>
<li>HOL4</li>
<li>Isabelle/HOL</li>
</ol>
<p>Love it or hate it, Agda being entirely raw proof terms means things are essentially exactly what you tell them to be. There's never a moment where you're going "Damn, why won't the simplifier just expand this but not that!". Lean is pretty good here, as it's quite conservative around what it chooses to manipulate and everything is explicitly named. HOL4 has a pretty reasonable learning curve as one learns to use things like <code>qpat_assum</code> that can target based on patterns (e.g. <code>¬_</code>), but once you figure it out it's not bad. Isabelle/HOL really isn't stunning here; it's often hard to get it to do <em>exactly</em> what you want.</p>
<h2 id="enjoyment-higher-better">Enjoyment (higher better)</h2>
<ol>
<li>HOL4</li>
<li>Lean</li>
<li>Isabelle/HOL</li>
<li>Agda</li>
</ol>
<p>I had a great time learning both HOL4 and Lean, but HOL4 edges out because it's such a unique interaction mode and it's still very powerful. Lean was fun, although annoying at some times, and Isabelle/HOL wasn't particularly interesting, but some of that is because i'm familiar with it. Agda sort of sucked at times; writing a whole primality decision procedure and fiddling with type nonsense got quite annoying after a while.</p>
<h2 id="annoyance-factor-lower-better">Annoyance factor (lower better)</h2>
<ol>
<li>Agda</li>
<li>HOL4 / Lean (tied second)</li>
<li>Isabelle/HOL</li>
</ol>
<p>Agda "wins" for the same reasons as above. Having to do really manual proof search and fiddling constantly wasn't super pleasant. HOL4 and Lean both had their own annoyances and I think it's unfair to rank one over the other; the learning curve on assumption manipulation / sim was quite significant in HOL4 and Lean's automated tools were finicky enough it quite sucked at times. Isabelle/HOL i'm just used to, so there's some bias there.</p>
<h2 id="puzzled-factor-lower-better">Puzzled factor (lower better)</h2>
<ol>
<li>HOL4</li>
<li>Lean</li>
<li>Isabelle/HOL</li>
<li>Agda</li>
</ol>
<p>Same reasons as above; there were a lot of times where HOL4 just had me going "huh????" because some theorem-tactic wasn't doing what I expected it to, or was transforming the goal in an unpredictable way. Lean had similar, where it would just randomly decide "erm actually i'm not going to solve this really simple goal for you with <code>grind</code> do it yourself please" in ways that left me baffled. Seriously, sometimes <code>grind</code> is smarter than <code>sledgehammer</code> and sometimes it's stupider than <code>simp</code>. Weird. Isabelle/HOL had some of the same but was generally fine, and Agda was utterly predictable.</p>
<h1 id="overall-best-in-class">Overall best in class</h1>
<p>HOL4! I had a great time learning it, it's a seriously interesting system. I didn't <em>not</em> enjoy Lean, but there's enough odd stuff going on to make me slightly wary of it, I suppose. Isabelle/HOL remains the one I'm best at (I am somewhat paid to write it, so that helps), and Agda is Agda.</p>
<p>What should you try? Well, all of them, but I would at least try out something new. If you've only used dependent theorem provers before, try Isabelle/HOL or HOL4, and vice versa. If you've only used theorem provers that work fully interactively like Lean, try HOL4 or Agda! New experiences are the joys of life.</p>
<h1 id="all-the-code">All the code</h1>
<p>Enjoy.</p>
<details>
<summary>Unfold for everything.</summary>
<p>Isabelle/HOL:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>theory primes</span></span>
<span class="giallo-l"><span> imports Main</span></span>
<span class="giallo-l"><span>begin</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>definition divides :: "nat ⇒ nat ⇒ bool" where</span></span>
<span class="giallo-l"><span> "divides n k = (∃j. j * n = k)"</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma zero_not_divides: "k ≠ 0 ⟹ ¬(divides 0 k)"</span></span>
<span class="giallo-l"><span> by (simp add: divides_def)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma one_divides: "divides k 1 ⟹ k = 1"</span></span>
<span class="giallo-l"><span> by (simp add: divides_def)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma divide_mult_l: "divides x k ⟹ divides x (n * k)"</span></span>
<span class="giallo-l"><span> using divides_def by auto</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma divides_diff: "divides x k ⟹ divides x n ⟹ divides x (k - n)"</span></span>
<span class="giallo-l"><span> using divides_def by (metis diff_mult_distrib)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma divides_gt: "k ≠ 0 ⟹ n > k ⟹ ¬(divides n k)"</span></span>
<span class="giallo-l"><span> by (clarsimp simp add: divides_def)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma divides_less: "k ≠ 0 ⟹ divides n k ⟹ n ≤ k"</span></span>
<span class="giallo-l"><span> by (clarsimp simp add: divides_def)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma divides_trans: "divides n k ⟹ divides k j ⟹ divides n j"</span></span>
<span class="giallo-l"><span> using divides_def by force</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>fun prod_list :: "nat list ⇒ nat" where</span></span>
<span class="giallo-l"><span>"prod_list [] = 1" | </span></span>
<span class="giallo-l"><span>"prod_list (x # xs) = x * prod_list xs"</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma prod_list_gt_zero: "(∀x∈set xs. x ≠ 0) ⟹ length xs > 0 ⟹ prod_list xs > 0"</span></span>
<span class="giallo-l"><span> apply (induct xs)</span></span>
<span class="giallo-l"><span> apply simp</span></span>
<span class="giallo-l"><span> by (case_tac xs; clarsimp)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma prod_list_lt: "(∀x∈set xs. x > 0) ⟹ ∀x∈set xs. x ≤ prod_list xs"</span></span>
<span class="giallo-l"><span> apply (induct xs)</span></span>
<span class="giallo-l"><span> apply simp</span></span>
<span class="giallo-l"><span> apply auto</span></span>
<span class="giallo-l"><span> using prod_list_gt_zero apply fastforce</span></span>
<span class="giallo-l"><span> apply (erule_tac x=x in ballE)</span></span>
<span class="giallo-l"><span> using mult_eq_if apply auto[1]</span></span>
<span class="giallo-l"><span> by blast</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma divides_prod_list: "x ∈ set xs ⟹ divides x (prod_list xs)"</span></span>
<span class="giallo-l"><span> apply (induct xs)</span></span>
<span class="giallo-l"><span> apply simp</span></span>
<span class="giallo-l"><span> apply auto</span></span>
<span class="giallo-l"><span> apply (case_tac xs; simp add: divides_def)</span></span>
<span class="giallo-l"><span> apply (case_tac xs; simp)</span></span>
<span class="giallo-l"><span> apply (rule divide_mult_l)</span></span>
<span class="giallo-l"><span> by assumption</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>definition prime :: "nat ⇒ bool" where</span></span>
<span class="giallo-l"><span> "prime p = ((p > 1) ∧ (∀x. divides x p ⟶ x = p ∨ x = 1))"</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma prime_zero[simp]: "¬(prime 0)"</span></span>
<span class="giallo-l"><span> by (clarsimp simp add: prime_def)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma prime_one[simp]: "¬(prime 1)"</span></span>
<span class="giallo-l"><span> by (clarsimp simp add: prime_def)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma prime_two[simp]: "prime 2"</span></span>
<span class="giallo-l"><span> apply (clarsimp simp add: prime_def)</span></span>
<span class="giallo-l"><span> apply (case_tac x; clarsimp simp add: divides_def)</span></span>
<span class="giallo-l"><span> apply (case_tac nat; clarsimp simp add: divides_def)</span></span>
<span class="giallo-l"><span> by (case_tac j; simp)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma prime_gt_one: "prime p ⟹ p > 1"</span></span>
<span class="giallo-l"><span> using prime_def by simp</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma notprime_split: "¬(prime k) ⟹ k > 1 ⟹ ∃n j. n < k ∧ j < k ∧ k = n * j"</span></span>
<span class="giallo-l"><span> apply (clarsimp simp add: prime_def divides_def)</span></span>
<span class="giallo-l"><span> apply (rule_tac x=x in exI)</span></span>
<span class="giallo-l"><span> apply (rule conjI)</span></span>
<span class="giallo-l"><span> apply (metis less_Suc0 linorder_neqE_nat mult_is_0 n_less_m_mult_n)</span></span>
<span class="giallo-l"><span> apply (rule_tac x=j in exI)</span></span>
<span class="giallo-l"><span> apply auto</span></span>
<span class="giallo-l"><span> by (metis bot_nat_0.not_eq_extremum mult_zero_left not_less_zero)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma prime_not_divides_one: "prime p ⟹ ¬(divides p 1)"</span></span>
<span class="giallo-l"><span> by (clarsimp simp add: prime_def divides_def)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma prime_factor: "¬(prime k) ⟹ k > 1 ⟹ ∃p. prime p ∧ divides p k"</span></span>
<span class="giallo-l"><span> apply (induct k rule: measure_induct[of "id"]; simp)</span></span>
<span class="giallo-l"><span> apply (rotate_tac 1)</span></span>
<span class="giallo-l"><span> apply (subst (asm) prime_def)</span></span>
<span class="giallo-l"><span> apply clarsimp</span></span>
<span class="giallo-l"><span> apply (case_tac "prime xa")</span></span>
<span class="giallo-l"><span> apply blast</span></span>
<span class="giallo-l"><span> apply (erule_tac x=xa in allE)</span></span>
<span class="giallo-l"><span> by (metis divides_gt divides_trans less_Suc0 not_less_iff_gr_or_eq zero_not_divides)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma another_prime: "(∀x∈set xs. x > 1) ⟹ ∃p. prime p ∧ p ∉ set xs"</span></span>
<span class="giallo-l"><span> apply (case_tac "prime (Suc (prod_list xs))")</span></span>
<span class="giallo-l"><span> using prod_list_lt apply fastforce</span></span>
<span class="giallo-l"><span> apply (frule prime_factor)</span></span>
<span class="giallo-l"><span> apply clarsimp</span></span>
<span class="giallo-l"><span> apply (case_tac "length xs = 0"; clarsimp)</span></span>
<span class="giallo-l"><span> apply (rule prod_list_gt_zero; clarsimp)</span></span>
<span class="giallo-l"><span> using prime_gt_one apply fastforce</span></span>
<span class="giallo-l"><span> using divides_prod_list divides_diff prime_gt_one one_divides</span></span>
<span class="giallo-l"><span> by (metis One_nat_def Suc_diff_Suc cancel_comm_monoid_add_class.diff_cancel lessI nat_less_le)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma infinite_primes: "∃p. prime p ∧ p > n"</span></span>
<span class="giallo-l"><span> apply (insert another_prime[where xs="[2 ..< Suc n]"])</span></span>
<span class="giallo-l"><span> apply (case_tac "n ≤ 1"; clarsimp)</span></span>
<span class="giallo-l"><span> apply (rule_tac x=2 in exI)</span></span>
<span class="giallo-l"><span> apply simp</span></span>
<span class="giallo-l"><span> apply (rule_tac x=p in exI)</span></span>
<span class="giallo-l"><span> apply simp</span></span>
<span class="giallo-l"><span> using prime_gt_one by force</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>end</span></span></code></pre>
<p>Lean:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>import Primes.Basic</span></span>
<span class="giallo-l"><span>import Mathlib.Tactic.ByContra</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>set_option linter.style.setOption false</span></span>
<span class="giallo-l"><span>set_option linter.flexible false</span></span>
<span class="giallo-l"><span>set_option linter.style.whitespace false</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>@[grind]</span></span>
<span class="giallo-l"><span>def divides (n k : Nat) : Prop :=</span></span>
<span class="giallo-l"><span> ∃q, k = n * q</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>theorem divides_one (n : Nat) : divides n 1 -> n = 1 := by</span></span>
<span class="giallo-l"><span> intro ⟨q, hq⟩</span></span>
<span class="giallo-l"><span> cases n <;> cases q <;> grind</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>theorem divides_not_one (n : Nat) (d : divides n 1) (neq : n ≠ 1) : False := by</span></span>
<span class="giallo-l"><span> grind [divides_one]</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>theorem divides_sub (n j k : Nat) (h1 : divides n k) (h2 : divides n j)</span></span>
<span class="giallo-l"><span> : divides n (k - j) := by</span></span>
<span class="giallo-l"><span> obtain ⟨q1, h1⟩ := h1</span></span>
<span class="giallo-l"><span> obtain ⟨q2, h2⟩ := h2</span></span>
<span class="giallo-l"><span> unfold divides</span></span>
<span class="giallo-l"><span> exists (q1 - q2)</span></span>
<span class="giallo-l"><span> grind [Nat.mul_sub]</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>theorem divides_less (n k : Nat) : k ≠ 0 -> divides n k -> n ≤ k := by</span></span>
<span class="giallo-l"><span> intro knz div</span></span>
<span class="giallo-l"><span> simp at *</span></span>
<span class="giallo-l"><span> obtain ⟨q,hq⟩ := div</span></span>
<span class="giallo-l"><span> cases q <;> grind</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>theorem divides_trans (n k j) : divides n k -> divides k j -> divides n j := by</span></span>
<span class="giallo-l"><span> intro ⟨a,b⟩ ⟨c,d⟩</span></span>
<span class="giallo-l"><span> simp [divides] at *</span></span>
<span class="giallo-l"><span> exists (a * c)</span></span>
<span class="giallo-l"><span> grind</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>@[simp, grind]</span></span>
<span class="giallo-l"><span>def prod_list (xs : List Nat) : Nat :=</span></span>
<span class="giallo-l"><span> match xs with</span></span>
<span class="giallo-l"><span> | [] => 1</span></span>
<span class="giallo-l"><span> | x :: xs => x * prod_list xs</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>theorem divides_prod_list : ∀ xs x, x ∈ xs -> divides x (prod_list xs) := by</span></span>
<span class="giallo-l"><span> intros xs x mem</span></span>
<span class="giallo-l"><span> induction xs with</span></span>
<span class="giallo-l"><span> | nil => grind</span></span>
<span class="giallo-l"><span> | cons y ys ih =></span></span>
<span class="giallo-l"><span> by_cases h : (x = y)</span></span>
<span class="giallo-l"><span> · rw [h]</span></span>
<span class="giallo-l"><span> simp</span></span>
<span class="giallo-l"><span> exists (prod_list ys)</span></span>
<span class="giallo-l"><span> · cases mem with</span></span>
<span class="giallo-l"><span> | head => grind</span></span>
<span class="giallo-l"><span> | tail =></span></span>
<span class="giallo-l"><span> rename_i a</span></span>
<span class="giallo-l"><span> have ⟨h, hq⟩ := ih a</span></span>
<span class="giallo-l"><span> simp at *</span></span>
<span class="giallo-l"><span> rw [hq]</span></span>
<span class="giallo-l"><span> exists (y * h)</span></span>
<span class="giallo-l"><span> grind</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>theorem prod_list_nz : ∀ xs, (∀ x ∈ xs, x > 0) -> prod_list xs > 0 := by</span></span>
<span class="giallo-l"><span> intros xs f</span></span>
<span class="giallo-l"><span> induction xs with</span></span>
<span class="giallo-l"><span> | nil => grind</span></span>
<span class="giallo-l"><span> | cons x xs ih =></span></span>
<span class="giallo-l"><span> obtain b : prod_list xs > 0 := ih (by grind)</span></span>
<span class="giallo-l"><span> simp [*]</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>theorem prod_list_lt : ∀ xs, (∀ x ∈ xs, x > 0) -> ∀ y ∈ xs, y <= prod_list xs := by</span></span>
<span class="giallo-l"><span> intro xs f y yin</span></span>
<span class="giallo-l"><span> induction xs with</span></span>
<span class="giallo-l"><span> | nil => grind</span></span>
<span class="giallo-l"><span> | cons yp ys ih =></span></span>
<span class="giallo-l"><span> cases yin with</span></span>
<span class="giallo-l"><span> | head =></span></span>
<span class="giallo-l"><span> obtain a : prod_list ys > 0 := by grind [prod_list_nz]</span></span>
<span class="giallo-l"><span> exact Nat.le_mul_of_pos_right y a</span></span>
<span class="giallo-l"><span> | tail _ a =></span></span>
<span class="giallo-l"><span> obtain a : y <= prod_list ys := ih (by grind) a</span></span>
<span class="giallo-l"><span> obtain b : yp > 0 := f yp (by grind)</span></span>
<span class="giallo-l"><span> apply Nat.le_trans</span></span>
<span class="giallo-l"><span> · exact a</span></span>
<span class="giallo-l"><span> · exact Nat.le_mul_of_pos_left (prod_list ys) b</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>@[simp, grind]</span></span>
<span class="giallo-l"><span>def prime (n : Nat) : Prop :=</span></span>
<span class="giallo-l"><span> (n > 1) ∧ (∀k, divides k n -> k = 1 ∨ k = n)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>theorem prime_two : prime 2 := by</span></span>
<span class="giallo-l"><span> simp</span></span>
<span class="giallo-l"><span> intros k x</span></span>
<span class="giallo-l"><span> simp [divides] at x</span></span>
<span class="giallo-l"><span> have ⟨q,hq⟩ := x</span></span>
<span class="giallo-l"><span> (cases q <;> cases k <;> grind)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>theorem prime_factor : ∀k, ¬(prime k) -> 1 < k -> ∃p, prime p ∧ divides p k := by</span></span>
<span class="giallo-l"><span> intros k nprime kgt1</span></span>
<span class="giallo-l"><span> induction k using Nat.strongRecOn with</span></span>
<span class="giallo-l"><span> | ind k' ih =></span></span>
<span class="giallo-l"><span> simp at nprime</span></span>
<span class="giallo-l"><span> obtain ⟨x,⟨xd,dvds⟩,xn1,xnk⟩ := nprime kgt1</span></span>
<span class="giallo-l"><span> clear nprime</span></span>
<span class="giallo-l"><span> by_cases h : prime x</span></span>
<span class="giallo-l"><span> · exists x</span></span>
<span class="giallo-l"><span> grind</span></span>
<span class="giallo-l"><span> · have lt : x < k' := by</span></span>
<span class="giallo-l"><span> apply Nat.lt_of_le_of_ne</span></span>
<span class="giallo-l"><span> · apply divides_less <;> grind</span></span>
<span class="giallo-l"><span> · assumption</span></span>
<span class="giallo-l"><span> have gt : 1 < x := by</span></span>
<span class="giallo-l"><span> cases x <;> grind</span></span>
<span class="giallo-l"><span> obtain ⟨p,⟨prm,dvds⟩⟩ := ih x lt h gt</span></span>
<span class="giallo-l"><span> exists p</span></span>
<span class="giallo-l"><span> refine ⟨prm, ?_⟩</span></span>
<span class="giallo-l"><span> apply divides_trans</span></span>
<span class="giallo-l"><span> · assumption</span></span>
<span class="giallo-l"><span> · grind</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>theorem another_prime (xs : List Nat) (xsgt : ∀x, x ∈ xs -> 1 < x)</span></span>
<span class="giallo-l"><span> : ∃p, prime p ∧ p ∉ xs := by</span></span>
<span class="giallo-l"><span> by_cases h : prime (Nat.succ (prod_list xs))</span></span>
<span class="giallo-l"><span> · exists (Nat.succ (prod_list xs))</span></span>
<span class="giallo-l"><span> refine ⟨h, ?a⟩</span></span>
<span class="giallo-l"><span> by_contra</span></span>
<span class="giallo-l"><span> have lt : Nat.succ (prod_list xs) ≤ prod_list xs := by</span></span>
<span class="giallo-l"><span> apply prod_list_lt <;> grind</span></span>
<span class="giallo-l"><span> grind</span></span>
<span class="giallo-l"><span> · have ⟨pf, isprm, dvds⟩ : ∃p, prime p ∧ divides p (Nat.succ (prod_list xs)) := by</span></span>
<span class="giallo-l"><span> apply prime_factor</span></span>
<span class="giallo-l"><span> · exact h</span></span>
<span class="giallo-l"><span> · grind [prod_list_nz]</span></span>
<span class="giallo-l"><span> by_cases g : pf ∈ xs</span></span>
<span class="giallo-l"><span> · have pfdvds : divides pf (prod_list xs) := by</span></span>
<span class="giallo-l"><span> apply divides_prod_list <;> grind</span></span>
<span class="giallo-l"><span> have divone : divides pf ((Nat.succ (prod_list xs)) - prod_list xs) := by</span></span>
<span class="giallo-l"><span> apply divides_sub <;> grind</span></span>
<span class="giallo-l"><span> have also : divides pf 1 := by grind</span></span>
<span class="giallo-l"><span> grind [divides_not_one]</span></span>
<span class="giallo-l"><span> · grind</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>theorem infinite_primes : ∀ n, ∃p, prime p ∧ p > n := by</span></span>
<span class="giallo-l"><span> intros n</span></span>
<span class="giallo-l"><span> by_cases h : ¬(1 < n)</span></span>
<span class="giallo-l"><span> · exists 2</span></span>
<span class="giallo-l"><span> grind [prime_two]</span></span>
<span class="giallo-l"><span> · simp at h</span></span>
<span class="giallo-l"><span> obtain ⟨p, prm, notin⟩ := another_prime (List.range' 2 n) (by grind)</span></span>
<span class="giallo-l"><span> refine ⟨p, prm, ?notin⟩</span></span>
<span class="giallo-l"><span> grind</span></span></code></pre>
<p>HOL4:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>open arithmeticTheory listTheory prim_recTheory listRangeTheory;</span></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span>Definition divides_def:</span></span>
<span class="giallo-l"><span> divides n k = ∃q. q * n = k</span></span>
<span class="giallo-l"><span>End</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Theorem divides_not_one:</span></span>
<span class="giallo-l"><span> ∀n. divides n 1 ⇒ n ≠ 1 ⇒ F</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> simp[divides_def]</span></span>
<span class="giallo-l"><span>QED</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Theorem divides_less:</span></span>
<span class="giallo-l"><span> k ≠ 0 ⇒ divides n k ⇒ n ≤ k</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> rpt strip_tac</span></span>
<span class="giallo-l"><span> >> gvs[divides_def]</span></span>
<span class="giallo-l"><span>QED</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Theorem divides_trans:</span></span>
<span class="giallo-l"><span> divides a b ⇒ divides b c ⇒ divides a c</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> rpt strip_tac</span></span>
<span class="giallo-l"><span> >> gvs[divides_def]</span></span>
<span class="giallo-l"><span> >> qexists ‘q * q'’</span></span>
<span class="giallo-l"><span> >> gvs[MULT_ASSOC_COMM]</span></span>
<span class="giallo-l"><span>QED</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Theorem divides_sub:</span></span>
<span class="giallo-l"><span> divides n k ⇒ divides n j ⇒ divides n (k - j)</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> rpt strip_tac</span></span>
<span class="giallo-l"><span> >> metis_tac[RIGHT_SUB_DISTRIB, divides_def]</span></span>
<span class="giallo-l"><span>QED</span></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span>Definition prod_list_def:</span></span>
<span class="giallo-l"><span> (prod_list [] = 1) ∧</span></span>
<span class="giallo-l"><span> (prod_list (x :: xs) = x * prod_list xs)</span></span>
<span class="giallo-l"><span>End</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Theorem divides_prod_list:</span></span>
<span class="giallo-l"><span> x ∈ set xs ⇒ divides x (prod_list xs)</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> Induct_on ‘xs’</span></span>
<span class="giallo-l"><span> >- fs[]</span></span>
<span class="giallo-l"><span> >- (fs[]</span></span>
<span class="giallo-l"><span> >> rpt strip_tac</span></span>
<span class="giallo-l"><span> >- (fs[prod_list_def, divides_def]</span></span>
<span class="giallo-l"><span> >> qexists_tac ‘prod_list xs’</span></span>
<span class="giallo-l"><span> >> simp[])</span></span>
<span class="giallo-l"><span> >- (fs[divides_def, prod_list_def]</span></span>
<span class="giallo-l"><span> >> qexists_tac ‘h * q’</span></span>
<span class="giallo-l"><span> >> rev_drule EQ_SYM</span></span>
<span class="giallo-l"><span> >> strip_tac</span></span>
<span class="giallo-l"><span> >> fs[]))</span></span>
<span class="giallo-l"><span>QED </span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Theorem prod_list_nz:</span></span>
<span class="giallo-l"><span> ∀xs. (∀x. x ∈ set xs ⇒ 0 < x) ⇒ 0 < prod_list xs</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> rpt strip_tac</span></span>
<span class="giallo-l"><span> >> Induct_on ‘xs’</span></span>
<span class="giallo-l"><span> >> fs[prod_list_def]</span></span>
<span class="giallo-l"><span>QED</span></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span>Theorem prod_list_lt:</span></span>
<span class="giallo-l"><span> ∀xs. (∀x. x ∈ set xs ⇒ 0 < x) ⇒ ∀y. y ∈ set xs ⇒ y ≤ prod_list xs</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> rpt strip_tac</span></span>
<span class="giallo-l"><span> >> Induct_on ‘xs’</span></span>
<span class="giallo-l"><span> >> gvs[]</span></span>
<span class="giallo-l"><span> >> rpt strip_tac</span></span>
<span class="giallo-l"><span> >> gvs[prod_list_def]</span></span>
<span class="giallo-l"><span> >> metis_tac[prod_list_nz, LE_MULT_CANCEL_LBARE, LE_TRANS]</span></span>
<span class="giallo-l"><span>QED</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Definition prime_def:</span></span>
<span class="giallo-l"><span> prime n = ((1 < n) ∧ (∀k. divides k n ⇒ k = 1 ∨ k = n))</span></span>
<span class="giallo-l"><span>End</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Theorem prime_zero:</span></span>
<span class="giallo-l"><span> ¬(prime 0)</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> fs[prime_def]</span></span>
<span class="giallo-l"><span>QED </span></span>
<span class="giallo-l"></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Theorem prime_one:</span></span>
<span class="giallo-l"><span> ¬(prime 1)</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> fs[prime_def]</span></span>
<span class="giallo-l"><span>QED</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Theorem prime_gt_one[simp]:</span></span>
<span class="giallo-l"><span> prime n ⇒ 1 < n</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> fs[prime_def]</span></span>
<span class="giallo-l"><span>QED</span></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span>Theorem prime_two:</span></span>
<span class="giallo-l"><span> prime 2</span></span>
<span class="giallo-l"><span>Proof </span></span>
<span class="giallo-l"><span> fs[prime_def]</span></span>
<span class="giallo-l"><span> >> rpt strip_tac</span></span>
<span class="giallo-l"><span> >> fs[divides_def]</span></span>
<span class="giallo-l"><span> >> (Cases_on ‘k’ >> Cases_on ‘q’ >> fs[MULT_SUC])</span></span>
<span class="giallo-l"><span>QED</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Theorem divides_gt1_gt0:</span></span>
<span class="giallo-l"><span> ∀n k. divides n k ⇒ 1 < k ⇒ 0 < n</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> rpt strip_tac</span></span>
<span class="giallo-l"><span> >> gvs[divides_def]</span></span>
<span class="giallo-l"><span> >> (Cases_on ‘q’ >> gvs[MULT_SUC])</span></span>
<span class="giallo-l"><span> >> (Cases_on ‘n’ >> gvs[])</span></span>
<span class="giallo-l"><span>QED</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Theorem prime_factor:</span></span>
<span class="giallo-l"><span> ∀k. ¬(prime k) ⇒ 1 < k ⇒ ∃p. prime p ∧ divides p k</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> completeInduct_on ‘k’</span></span>
<span class="giallo-l"><span> >> rpt strip_tac</span></span>
<span class="giallo-l"><span> >> qpat_x_assum ‘¬_’</span></span>
<span class="giallo-l"><span> (fn h => assume_tac</span></span>
<span class="giallo-l"><span> (REWRITE_RULE [prime_def] h))</span></span>
<span class="giallo-l"><span> >> gvs[]</span></span>
<span class="giallo-l"><span> >> Cases_on ‘prime k'’</span></span>
<span class="giallo-l"><span> >- (qexists ‘k'’ >> simp[])</span></span>
<span class="giallo-l"><span> >- (first_x_assum $ qspecl_then [‘k'’] mp_tac</span></span>
<span class="giallo-l"><span> >> strip_tac</span></span>
<span class="giallo-l"><span> >> ‘0 < k'’ by metis_tac[divides_gt1_gt0]</span></span>
<span class="giallo-l"><span> >> ‘1 < k'’ by decide_tac</span></span>
<span class="giallo-l"><span> >> ‘k' <= k’ by gvs[divides_less]</span></span>
<span class="giallo-l"><span> >> ‘k' < k’ by decide_tac</span></span>
<span class="giallo-l"><span> >> first_x_assum drule</span></span>
<span class="giallo-l"><span> >> strip_tac</span></span>
<span class="giallo-l"><span> >> gvs[]</span></span>
<span class="giallo-l"><span> >> qexists ‘p’</span></span>
<span class="giallo-l"><span> >> metis_tac[divides_trans])</span></span>
<span class="giallo-l"><span>QED</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Theorem gt1_gt0_weaken:</span></span>
<span class="giallo-l"><span> ∀x. 1 < x ⇒ 0 < x</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> strip_tac >> decide_tac</span></span>
<span class="giallo-l"><span>QED</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Theorem another_prime:</span></span>
<span class="giallo-l"><span> ∀(xs : num list). (∀x. x ∈ set xs ⇒ 1 < x)</span></span>
<span class="giallo-l"><span> ⇒ ∃p. prime p ∧ p ∉ set xs</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> rpt strip_tac</span></span>
<span class="giallo-l"><span> >> Cases_on ‘prime (SUC (prod_list xs))’</span></span>
<span class="giallo-l"><span> >- (qexists ‘SUC (prod_list xs)’</span></span>
<span class="giallo-l"><span> >> metis_tac[LESS_REFL, OR_LESS,</span></span>
<span class="giallo-l"><span> prod_list_lt, gt1_gt0_weaken])</span></span>
<span class="giallo-l"><span> >- (drule prime_factor </span></span>
<span class="giallo-l"><span> >> impl_tac</span></span>
<span class="giallo-l"><span> >- metis_tac[ONE, LESS_MONO, prod_list_nz,gt1_gt0_weaken]</span></span>
<span class="giallo-l"><span> >- (strip_tac</span></span>
<span class="giallo-l"><span> >> Cases_on ‘MEM p xs’</span></span>
<span class="giallo-l"><span> >- (‘divides p (prod_list xs)’</span></span>
<span class="giallo-l"><span> by metis_tac[divides_prod_list]</span></span>
<span class="giallo-l"><span> >> ‘divides p ((SUC (prod_list xs)) - prod_list xs)’</span></span>
<span class="giallo-l"><span> by metis_tac [divides_sub]</span></span>
<span class="giallo-l"><span> >> gvs[]</span></span>
<span class="giallo-l"><span> >> metis_tac[prime_one, prime_zero, divides_not_one])</span></span>
<span class="giallo-l"><span> >- (qexists ‘p’ >> metis_tac[])))</span></span>
<span class="giallo-l"><span>QED</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span>Theorem infinite_primes:</span></span>
<span class="giallo-l"><span> ∀n. ∃p. prime p ∧ p > n</span></span>
<span class="giallo-l"><span>Proof</span></span>
<span class="giallo-l"><span> strip_tac</span></span>
<span class="giallo-l"><span> >> Cases_on ‘n < 1’</span></span>
<span class="giallo-l"><span> >- (qexists ‘2’ >> simp[prime_two])</span></span>
<span class="giallo-l"><span> >- (qspec_then ‘listRangeINC 2 n’ assume_tac another_prime</span></span>
<span class="giallo-l"><span> >> ‘∀x. MEM x [2 .. n] ⇒ 1 < x’</span></span>
<span class="giallo-l"><span> by (rpt strip_tac >> gvs[MEM_listRangeINC])</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> >> first_x_assum rev_drule</span></span>
<span class="giallo-l"><span> >> rpt strip_tac</span></span>
<span class="giallo-l"><span> >> qexists ‘p’</span></span>
<span class="giallo-l"><span> >> gvs[MEM_listRangeINC, prime_gt_one]</span></span>
<span class="giallo-l"><span> >> ‘p ≠ 0’ by metis_tac[prime_zero]</span></span>
<span class="giallo-l"><span> >> ‘p ≠ 1’ by metis_tac[prime_one]</span></span>
<span class="giallo-l"><span> >> decide_tac)</span></span>
<span class="giallo-l"><span>QED</span></span></code></pre>
<p>Agda:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>open import Data.Nat renaming (ℕ to Nat)</span></span>
<span class="giallo-l"><span>open import Data.Nat.Properties</span></span>
<span class="giallo-l"><span>open import Relation.Binary.PropositionalEquality</span></span>
<span class="giallo-l"><span>open import Data.Product</span></span>
<span class="giallo-l"><span>open import Data.Empty</span></span>
<span class="giallo-l"><span>open import Relation.Nullary.Negation</span></span>
<span class="giallo-l"><span>open import Data.List</span></span>
<span class="giallo-l"><span>open import Data.Sum</span></span>
<span class="giallo-l"><span>open import Relation.Nullary.Decidable</span></span>
<span class="giallo-l"><span>open import Relation.Binary</span></span>
<span class="giallo-l"><span>open import Relation.Nullary.Reflects</span></span>
<span class="giallo-l"><span>open import Data.Nat.Divisibility</span></span>
<span class="giallo-l"><span>open import Data.Bool using (Bool; true; false)</span></span>
<span class="giallo-l"><span>open import Data.Fin using (zero; suc; Fin; toℕ; fromℕ; fromℕ<)</span></span>
<span class="giallo-l"><span>open import Data.Fin.Properties using (toℕ-fromℕ; toℕ-fromℕ<)</span></span>
<span class="giallo-l"><span>open import Induction.WellFounded</span></span>
<span class="giallo-l"><span>open import Data.Nat.Induction using (<-wellFounded; <-rec)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>import Data.List.Membership.DecPropositional as DecPropMembership</span></span>
<span class="giallo-l"><span>open DecPropMembership Data.Nat._≟_</span></span>
<span class="giallo-l"><span>open import Data.List.Relation.Unary.Any using (here; there)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>-- The prime decision procedure was with assistance from https://gist.github.com/copumpkin/1286093</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>div-goes-into : ∀ i k → k ≢ 0 → i ∣ k → i ≤ k</span></span>
<span class="giallo-l"><span>div-goes-into i k neq (divides zero eq) = ⊥-elim (neq eq)</span></span>
<span class="giallo-l"><span>div-goes-into zero k neq (divides (suc q) eq) = z≤n</span></span>
<span class="giallo-l"><span>div-goes-into (suc i) k neq (divides-refl (suc q)) = s≤s (m≤m+n i (q * suc i))</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>divides-zero : ∀ i → 0 ∣ i → i ≡ 0</span></span>
<span class="giallo-l"><span>divides-zero zero (divides q eq) = refl</span></span>
<span class="giallo-l"><span>divides-zero (suc i) (divides q eq) rewrite *-comm q 0 = eq</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>divides-trans : ∀ {i j k} → i ∣ j → j ∣ k → i ∣ k</span></span>
<span class="giallo-l"><span>divides-trans {i} (divides-refl q₁) (divides q₂ eq₂) = divides (q₂ * q₁) (trans eq₂ (sym (*-assoc q₂ q₁ i)))</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>divides-sub : ∀ {i j k} → i ∣ j → i ∣ k → i ∣ (j ∸ k)</span></span>
<span class="giallo-l"><span>divides-sub {i} (divides-refl q₁) (divides-refl q₂) = divides (q₁ ∸ q₂) (sym (*-distribʳ-∸ i q₁ q₂))</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>divides-one : ∀ i → i ∣ 1 → i ≡ 1</span></span>
<span class="giallo-l"><span>divides-one zero (divides (suc q) eq) rewrite *-comm q 0 = ⊥-elim (1+n≢0 eq)</span></span>
<span class="giallo-l"><span>divides-one (suc zero) (divides (suc q) eq) = refl</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>divides-not-one : ∀ {i} → i ∣ 1 → i ≢ 1 → ⊥</span></span>
<span class="giallo-l"><span>divides-not-one {zero} (divides q eq) neq rewrite *-comm q 0 = 1+n≢0 eq</span></span>
<span class="giallo-l"><span>divides-not-one {suc zero} (divides q eq) neq = neq refl</span></span>
<span class="giallo-l"><span>divides-not-one {2+ i} (divides zero eq) neq = 1+n≢0 eq</span></span>
<span class="giallo-l"><span>divides-not-one {2+ i} (divides (suc q) eq) neq = 1+n≢0 (sym (suc-injective eq))</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lt-left-suc : ∀ i j → i ≤ j → i ≢ j → suc i ≤ j</span></span>
<span class="giallo-l"><span>lt-left-suc zero zero z≤n p = ⊥-elim (p refl)</span></span>
<span class="giallo-l"><span>lt-left-suc zero (suc j) z≤n p = s≤s z≤n</span></span>
<span class="giallo-l"><span>lt-left-suc (suc i) zero () p</span></span>
<span class="giallo-l"><span>lt-left-suc (suc i) (suc j) (s≤s x) p = s≤s (lt-left-suc i j x λ q → p (cong suc q))</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>not : {A : Set} → Dec A → Dec (¬ A)</span></span>
<span class="giallo-l"><span>not (yes p) = no (λ z → z p)</span></span>
<span class="giallo-l"><span>not (no ¬p) = yes ¬p</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>DNE : {A : Set} → Dec A → ¬ ¬ A → A</span></span>
<span class="giallo-l"><span>DNE (yes p) f = p</span></span>
<span class="giallo-l"><span>DNE (no ¬p) f = ⊥-elim (f ¬p)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>Decide : {A : Set} (P : A → Set) → Set</span></span>
<span class="giallo-l"><span>Decide P = ∀ i → Dec (P i)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lt-lower : ∀ {i j} → suc i ≤ suc j → i ≢ j → suc i ≤ j</span></span>
<span class="giallo-l"><span>lt-lower {zero} {zero} (s≤s p) q = ⊥-elim (q refl)</span></span>
<span class="giallo-l"><span>lt-lower {zero} {suc j} (s≤s p) q = s≤s z≤n</span></span>
<span class="giallo-l"><span>lt-lower {suc i} {suc j} (s≤s p) q = s≤s (lt-lower p λ x → q (cong suc x))</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lt-decide : ∀ i → (P : Nat → Set) (p? : ∀ n → n < i → Dec (P n)) → (∀ n → n < i → P n) ⊎ (Σ _ λ j → j < i × ¬ (P j))</span></span>
<span class="giallo-l"><span>lt-decide zero P p? = inj₁ λ _ ()</span></span>
<span class="giallo-l"><span>lt-decide (suc i) P p? with lt-decide i P h</span></span>
<span class="giallo-l"><span> where</span></span>
<span class="giallo-l"><span> h : (n : Nat) → n < i → Dec (P n)</span></span>
<span class="giallo-l"><span> h n lt = p? n (s≤s (<⇒≤ lt))</span></span>
<span class="giallo-l"><span>... | inj₂ (a , b , c) = inj₂ (a , s≤s (≤-trans (n≤1+n a) b) , c)</span></span>
<span class="giallo-l"><span>... | inj₁ x with p? i ≤-refl</span></span>
<span class="giallo-l"><span>... | no ¬a = inj₂ (i , ≤-refl , ¬a)</span></span>
<span class="giallo-l"><span>... | yes a = inj₁ h</span></span>
<span class="giallo-l"><span> where</span></span>
<span class="giallo-l"><span> h : (n : Nat) → suc n ≤ suc i → P n</span></span>
<span class="giallo-l"><span> h n lt with n ≟ i</span></span>
<span class="giallo-l"><span> ... | yes refl = a</span></span>
<span class="giallo-l"><span> ... | no ¬a = x n (lt-lower lt ¬a)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>¬lt-decide : ∀ i → (P : Nat → Set) (p? : ∀ n → n < i → Dec (P n)) → (∀ n → n < i → ¬ P n) ⊎ (Σ _ λ j → j < i × (P j))</span></span>
<span class="giallo-l"><span>¬lt-decide i P p? with lt-decide i (λ x → ¬ (P x)) (λ n x → not (p? n x))</span></span>
<span class="giallo-l"><span>... | inj₁ x = inj₁ x</span></span>
<span class="giallo-l"><span>... | inj₂ (a , b , c) = inj₂ (a , b , DNE (p? a b) c)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>record Prime (n : Nat) : Set where</span></span>
<span class="giallo-l"><span> constructor isprime</span></span>
<span class="giallo-l"><span> field</span></span>
<span class="giallo-l"><span> gt1 : n > 1</span></span>
<span class="giallo-l"><span> div : ∀ k → k ∣ n → k ≡ 1 ⊎ k ≡ n</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>open Prime</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>zero-prime : ¬ (Prime 0)</span></span>
<span class="giallo-l"><span>zero-prime ()</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>prime-not-zero : ∀ p → Prime p → p ≢ 0</span></span>
<span class="giallo-l"><span>prime-not-zero p x refl = zero-prime x</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>one-prime : ¬ (Prime 1)</span></span>
<span class="giallo-l"><span>one-prime (isprime (s≤s ()) div)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>two-prime : Prime 2</span></span>
<span class="giallo-l"><span>two-prime .gt1 = s≤s (s≤s z≤n)</span></span>
<span class="giallo-l"><span>two-prime .div zero (divides (suc q) eq) rewrite *-comm q 0 = ⊥-elim (1+n≢0 eq)</span></span>
<span class="giallo-l"><span>two-prime .div (suc zero) (divides (suc q) eq) = inj₁ refl</span></span>
<span class="giallo-l"><span>two-prime .div (2+ zero) (divides (suc q) eq) = inj₂ refl</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>record Composite (n : Nat) : Set where</span></span>
<span class="giallo-l"><span> constructor composite</span></span>
<span class="giallo-l"><span> field</span></span>
<span class="giallo-l"><span> p : Nat</span></span>
<span class="giallo-l"><span> Pp : Prime p</span></span>
<span class="giallo-l"><span> p<n : p < n</span></span>
<span class="giallo-l"><span> p∣ : p ∣ n</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>not-prime-and-composite : ∀ p → Prime p → Composite p → ⊥</span></span>
<span class="giallo-l"><span>not-prime-and-composite _ (isprime gt2 div₁) (composite p (isprime gt3 div₂) p<n p∣) with div₁ p p∣</span></span>
<span class="giallo-l"><span>... | inj₁ refl = one-prime (isprime gt3 div₂)</span></span>
<span class="giallo-l"><span>... | inj₂ refl = 1+n≰n p<n</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>prime-or-composite : ∀ p → p > 1 → Prime p ⊎ Composite p</span></span>
<span class="giallo-l"><span>prime-or-composite (suc zero) (s≤s ())</span></span>
<span class="giallo-l"><span>prime-or-composite (2+ p) lt = <-rec _ h p</span></span>
<span class="giallo-l"><span> where</span></span>
<span class="giallo-l"><span> h : (x : Nat) →</span></span>
<span class="giallo-l"><span> ({y : Nat} → suc y ≤ x → Prime (2+ y) ⊎ Composite (2+ y)) →</span></span>
<span class="giallo-l"><span> Prime (2+ x) ⊎ Composite (2+ x)</span></span>
<span class="giallo-l"><span> h x f with ¬lt-decide x (λ k → (2+ k) ∣ (2+ x)) (λ n nlt → 2+ n ∣? 2+ x)</span></span>
<span class="giallo-l"><span> ... | inj₂ (ev₁ , ev₂ , ev₃) with f ev₂</span></span>
<span class="giallo-l"><span> h x f | inj₂ (ev₁ , ev₂ , ev₃) | inj₁ prm = inj₂ (composite (2+ ev₁) prm (s≤s (s≤s ev₂)) ev₃)</span></span>
<span class="giallo-l"><span> h x f | inj₂ (ev₁ , ev₂ , ev₃) | inj₂ (composite p Pp (s≤s p<n) p∣) =</span></span>
<span class="giallo-l"><span> inj₂ (composite p Pp (s≤s (≤-trans p<n (≤-trans ev₂ (n≤1+n x)))) (divides-trans p∣ ev₃))</span></span>
<span class="giallo-l"><span> h x f | inj₁ eq = inj₁ (isprime (s≤s (s≤s z≤n)) lemma)</span></span>
<span class="giallo-l"><span> where</span></span>
<span class="giallo-l"><span> lemma : (k : Nat) → k ∣ 2+ x → k ≡ 1 ⊎ k ≡ 2+ x</span></span>
<span class="giallo-l"><span> lemma k dv with k ≟ 1 | k ≟ (2+ x)</span></span>
<span class="giallo-l"><span> ... | no ¬a | yes refl = inj₂ refl</span></span>
<span class="giallo-l"><span> ... | yes refl | no ¬b = inj₁ refl</span></span>
<span class="giallo-l"><span> ... | yes refl | yes ()</span></span>
<span class="giallo-l"><span> lemma zero dv | no ¬a | no ¬b rewrite divides-zero (2+ x) dv = inj₂ refl</span></span>
<span class="giallo-l"><span> lemma (suc zero) dv | no ¬a | no ¬b = inj₁ refl</span></span>
<span class="giallo-l"><span> lemma (2+ k) dv | no ¬a | no ¬b with suc k ≤? x</span></span>
<span class="giallo-l"><span> ... | yes k≤x = ⊥-elim (eq k k≤x dv)</span></span>
<span class="giallo-l"><span> ... | no ¬k≤x = ⊥-elim (¬k≤x sothen)</span></span>
<span class="giallo-l"><span> where</span></span>
<span class="giallo-l"><span> one : 2+ k ≤ 2+ x</span></span>
<span class="giallo-l"><span> one = div-goes-into (2+ k) (2+ x) 1+n≢0 dv</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> two : k ≤ x</span></span>
<span class="giallo-l"><span> two with one</span></span>
<span class="giallo-l"><span> ... | s≤s (s≤s a) = a</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> also : k ≢ x</span></span>
<span class="giallo-l"><span> also x = ¬b (cong suc (cong suc x))</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> sothen : suc k ≤ x</span></span>
<span class="giallo-l"><span> sothen = lt-left-suc k x two also</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>prod-list : List Nat → Nat</span></span>
<span class="giallo-l"><span>prod-list [] = 1</span></span>
<span class="giallo-l"><span>prod-list (x ∷ xs) = x * prod-list xs</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>prod-list-nz : ∀ xs → (∀ x → x ∈ xs → x > 0) → prod-list xs > 0</span></span>
<span class="giallo-l"><span>prod-list-nz [] f = s≤s z≤n</span></span>
<span class="giallo-l"><span>prod-list-nz (x ∷ []) f rewrite *-comm x 1 rewrite +-comm x 0 = f x (here refl)</span></span>
<span class="giallo-l"><span>prod-list-nz (x ∷ x₁ ∷ xs) f = h {x} (f x (here refl)) (prod-list-nz (x₁ ∷ xs) (λ x₂ z → f x₂ (there z)))</span></span>
<span class="giallo-l"><span> where</span></span>
<span class="giallo-l"><span> h : ∀ {i j} → 1 ≤ i → 1 ≤ j → 1 ≤ i * j</span></span>
<span class="giallo-l"><span> h {suc i} {suc j} (s≤s a) (s≤s b) = s≤s z≤n</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>prod-list-NZ : ∀ xs → (∀ x → x ∈ xs → x > 0) → NonZero (prod-list xs)</span></span>
<span class="giallo-l"><span>prod-list-NZ xs f = >-nonZero (prod-list-nz xs f)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>prod-list-lt : ∀ xs → (∀ x → x ∈ xs → x > 0) → ∀ y → y ∈ xs → y ≤ prod-list xs</span></span>
<span class="giallo-l"><span>prod-list-lt [] f y ()</span></span>
<span class="giallo-l"><span>prod-list-lt (x ∷ xs) f y (here refl) = m≤m*n x (prod-list xs) ⦃ prod-list-NZ xs λ x₂ z → f x₂ (there z) ⦄</span></span>
<span class="giallo-l"><span>prod-list-lt (x ∷ xs) f y (there py) = also (prod-list-lt xs (λ x₂ z → f x₂ (there z)) y py) (f x (here refl))</span></span>
<span class="giallo-l"><span> where</span></span>
<span class="giallo-l"><span> lt+ : ∀ {i j k} → i ≤ j → i ≤ j + k</span></span>
<span class="giallo-l"><span> lt+ z≤n = z≤n</span></span>
<span class="giallo-l"><span> lt+ (s≤s x) = s≤s (lt+ x)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> also : ∀ {i j k} → i ≤ k → 1 ≤ j → i ≤ j * k</span></span>
<span class="giallo-l"><span> also a (s≤s z≤n) = lt+ a</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>prod-list-divides : ∀ xs x → x ∈ xs → x ∣ prod-list xs</span></span>
<span class="giallo-l"><span>prod-list-divides [] x ()</span></span>
<span class="giallo-l"><span>prod-list-divides (y ∷ xs) x (here refl) = divides (prod-list xs) (*-comm y (prod-list xs))</span></span>
<span class="giallo-l"><span>prod-list-divides (y ∷ xs) x (there p) with prod-list-divides xs x p</span></span>
<span class="giallo-l"><span>... | divides q eq rewrite eq = divides (y * q) (sym (*-assoc y q x))</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>prime-not-in : ∀ xs → (∀ x → x ∈ xs → x > 0) → Σ _ λ k → k ∉ xs × Prime k</span></span>
<span class="giallo-l"><span>prime-not-in xs gt with 2 ≤? prod-list xs</span></span>
<span class="giallo-l"><span>... | no ¬a = 2 , lemma , two-prime</span></span>
<span class="giallo-l"><span> where</span></span>
<span class="giallo-l"><span> lemma : 2 ∈ xs → ⊥</span></span>
<span class="giallo-l"><span> lemma pf with prod-list-lt xs gt 2 pf</span></span>
<span class="giallo-l"><span> ... | also = ¬a also</span></span>
<span class="giallo-l"><span>... | yes a with prime-or-composite (suc (prod-list xs)) (s≤s (≤-trans (s≤s z≤n) a))</span></span>
<span class="giallo-l"><span>... | inj₁ x = suc (prod-list xs) , lemma , x</span></span>
<span class="giallo-l"><span> where</span></span>
<span class="giallo-l"><span> lemma : (suc (prod-list xs)) ∈ xs → ⊥</span></span>
<span class="giallo-l"><span> lemma pf with prod-list-lt xs gt (suc (prod-list xs)) pf</span></span>
<span class="giallo-l"><span> ... | also = 1+n≰n also</span></span>
<span class="giallo-l"><span>... | inj₂ (composite p Pp p<n p∣) with p ∈? xs</span></span>
<span class="giallo-l"><span>... | no ¬b = p , ¬b , Pp</span></span>
<span class="giallo-l"><span>... | yes b with prod-list-divides xs p b</span></span>
<span class="giallo-l"><span>... | divs with divides-sub p∣ divs</span></span>
<span class="giallo-l"><span>... | sothen = ⊥-elim (lemma {p} {prod-list xs} sothen λ{ refl → one-prime Pp })</span></span>
<span class="giallo-l"><span> where</span></span>
<span class="giallo-l"><span> suc-sub : ∀ i → suc i ∸ i ≡ 1</span></span>
<span class="giallo-l"><span> suc-sub zero = refl</span></span>
<span class="giallo-l"><span> suc-sub (suc i) = suc-sub i</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> lemma : ∀ {i j} → i ∣ (suc j ∸ j) → i ≢ 1 → ⊥</span></span>
<span class="giallo-l"><span> lemma {_} {j} div neq rewrite suc-sub j = divides-not-one div neq</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>list-up-to : Nat → List Nat</span></span>
<span class="giallo-l"><span>list-up-to 0 = 1 ∷ []</span></span>
<span class="giallo-l"><span>list-up-to (suc n) = suc n ∷ list-up-to n</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>list-up-to-nz : ∀ k x → x ∈ list-up-to k → x > 0</span></span>
<span class="giallo-l"><span>list-up-to-nz zero x (here refl) = s≤s z≤n</span></span>
<span class="giallo-l"><span>list-up-to-nz (suc k) x (here refl) = s≤s z≤n</span></span>
<span class="giallo-l"><span>list-up-to-nz (suc k) x (there p) = list-up-to-nz k x p</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>list-up-to-contains : ∀ i j → j ≤ i → j ≢ 0 → j ∈ list-up-to i</span></span>
<span class="giallo-l"><span>list-up-to-contains zero zero z≤n b = ⊥-elim (b refl)</span></span>
<span class="giallo-l"><span>list-up-to-contains zero (suc j) () b</span></span>
<span class="giallo-l"><span>list-up-to-contains (suc i) zero z≤n b = ⊥-elim (b refl)</span></span>
<span class="giallo-l"><span>list-up-to-contains (suc i) (suc j) (s≤s a) b with suc i ≟ suc j</span></span>
<span class="giallo-l"><span>... | no ¬c = there (list-up-to-contains i (suc j) (lt-left-suc j i a λ x → ¬c (cong suc (sym x))) b)</span></span>
<span class="giallo-l"><span>... | yes refl = here refl</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>infinite-primes : ∀ i → Σ _ λ p → p > i × Prime p</span></span>
<span class="giallo-l"><span>infinite-primes zero = 2 , s≤s z≤n , two-prime</span></span>
<span class="giallo-l"><span>infinite-primes (suc i) with prime-not-in (list-up-to (2+ i)) (list-up-to-nz (2+ i))</span></span>
<span class="giallo-l"><span>... | p , notin , Pp = p , DNE (2+ i ≤? p) lemma , Pp</span></span>
<span class="giallo-l"><span> where</span></span>
<span class="giallo-l"><span> notzero : p ≢ 0</span></span>
<span class="giallo-l"><span> notzero = prime-not-zero p Pp</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> implies : ∀ {a b} → (suc a ≤ b → ⊥) → (a ≡ b) ⊎ (a > b)</span></span>
<span class="giallo-l"><span> implies {a} {b} x with compare a b</span></span>
<span class="giallo-l"><span> ... | less .a k = ⊥-elim (x (s≤s (m≤m+n a k)))</span></span>
<span class="giallo-l"><span> ... | equal .a = inj₁ refl</span></span>
<span class="giallo-l"><span> ... | greater .b k = inj₂ (s≤s (m≤m+n b k))</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> lemma : ((2+ i ≤ p) → ⊥) → ⊥</span></span>
<span class="giallo-l"><span> lemma x with implies x</span></span>
<span class="giallo-l"><span> ... | inj₁ refl = notin (there (here refl))</span></span>
<span class="giallo-l"><span> ... | inj₂ (s≤s a) = notin (list-up-to-contains (2+ i) p (≤-trans a (≤-trans (n≤1+n i) (n≤1+n (suc i)))) (prime-not-zero p Pp))</span></span></code></pre></details>
Verifying (simple) C in Isabelle/HOL with AutoCorres2026-08-28T00:00:00+00:002026-08-28T00:00:00+00:00
Blueberry Wren
https://blueberrywren.dev/blog/isabelle-autocorres-tut/<h1 id="verifying-simple-c-in-isabelle-hol-with-autocorres">Verifying (simple) C in Isabelle/HOL with AutoCorres</h1>
<p>This post details the first steps of verifying a C function in Isabelle/HOL using AutoCorres. It'll go over the basic setup for Isabelle and AutoCorres, what AutoCorres gives you, and how we can verify some basic properties of a function (here, the sum of a list.) I use the latest versions of Isabelle and AutoCorres available at time of writing (24/08/26).</p>
<h1 id="caveats">Caveats</h1>
<p>This is <em>not</em> official documentation for AutoCorres, nor may it be 100% correct in all places. All the proofs go through, but I do not work on AutoCorres, nor have I used it professionally; most of my experience is hobby verification. However, I have found resources on it are woefully lacking, so I wished to introduce some more. Much of this information has been gleaned from the official documentation (which can be found <a href="https://trustworthy.systems/projects/OLD/autocorres/">here</a>,) and <a href="https://cgi.cse.unsw.edu.au/~cs4161/">this UNSW course</a>. When it runs, the slides/similar may be removed for some time - they exist on the internet archive also.</p>
<p>Any errors in the prose or code of the following are my own.</p>
<h1 id="assumed-knowledge">Assumed knowledge</h1>
<p>This article assumes a little either Isabelle/HOL or general verification knowledge, but I try to explain wherever feasible. A bit of C knowledge is required as well, and so is a little knowledge about program verification - a little Hoare logic, and the like. I'll try to explain as much as I can without being excessively verbose, and much of it is very searchable. Let's get into it!</p>
<h1 id="installing-isabelle">Installing Isabelle</h1>
<p>You can find Isabelle <a href="https://isabelle.in.tum.de/">here</a>. Install as is appropriate for your platform. You can decide whether to put <code>isabelle</code> in your path or not.</p>
<h1 id="installing-autocorres">Installing AutoCorres</h1>
<p>First, pick a directory for your project. It may be feasible to use AutoCorres globally, but I wouldn't recommend it for versioning reasons. Then, AutoCorres can be found by scrolling down <a href="https://trustworthy.systems/projects/OLD/autocorres/">here</a>. (It will probably take you <a href="https://github.com/seL4/l4v/releases">here</a>, whereupon you should scroll down to the latest AutoCorres release). You only need the AutoCorres download, as it bundles the C parser. Take that file, and extract it in your directory of choice.</p>
<p>Then we need to build AutoCorres. From the directory where you unpacked it, run</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #A6E22E;">$</span><span style="color: #E6DB74;"> L4V_ARCH=X64</span><span style="color: #F92672;"> <</span><span style="color: #E6DB74;">path-to-isabell</span><span>e</span><span style="color: #F92672;">></span><span style="color: #E6DB74;"> build</span><span style="color: #AE81FF;"> -v -b -o</span><span style="color: #E6DB74;"> document=</span><span style="color: #AE81FF;">false -d</span><span style="color: #E6DB74;"> autocorres-1.12 AutoCorres</span></span></code></pre>
<p>This'll take a second.</p>
<p>Replace paths as appropriate. Note that <code>L4V_ARCH</code> is <em>not</em> the architecture you are on - it determines how the tool translates various C sizes into Isabelle. This will need to be the same architecture you launch with later. There are some others, and on a related note:</p>
<h1 id="look-at-the-autocorres-readme">Look at the AutoCorres README!</h1>
<p>It may not all make sense yet, but it may answer some questions.</p>
<h1 id="launching-isabelle-with-autocorres">Launching Isabelle with AutoCorres</h1>
<p>I recommend making a little shell script for this step (<code>launch.sh</code> perhaps.) You'll need to invoke Isabelle in a manner similar to the following:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="shellscript"><span class="giallo-l"><span style="color: #88846F;">#!/bin/sh</span></span>
<span class="giallo-l"><span>L4V_ARCH</span><span style="color: #F92672;">=</span><span style="color: #E6DB74;">X64</span><span style="color: #A6E22E;"> /Applications/Isabelle2025.app/bin/isabelle</span><span style="color: #E6DB74;"> jedit</span><span style="color: #AE81FF;"> -d</span><span style="color: #E6DB74;"> autocorres-1.12</span><span style="color: #AE81FF;"> -l</span><span style="color: #E6DB74;"> AutoCorres my_theory.thy</span></span></code></pre>
<p>Remember that <code>L4V_ARCH</code> needs to be the same as earlier.</p>
<p>Now that we have Isabelle running, we can use AutoCorres to generate Isabelle versions of C files. The manner in which this is performed is long, complex, and interesting - I recommend a rabbit hole evening - but in short, the C parser first translates it to a deep embedding in a language called Simpl, and then AutoCorres takes this Simpl representation and turns it into a monadic shallow embedding best it can.</p>
<h1 id="some-c-to-verify">Some C to verify</h1>
<p>Here's what we'll be verifying today:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="c"><span class="giallo-l"><span style="color: #66D9EF;font-style: italic;">unsigned int</span><span style="color: #A6E22E;"> list_sum</span><span>(</span><span style="color: #66D9EF;font-style: italic;">unsigned int</span><span style="color: #F92672;"> *</span><span style="color: #FD971F;font-style: italic;">list</span><span>,</span><span style="color: #66D9EF;font-style: italic;"> unsigned int</span><span style="color: #FD971F;font-style: italic;"> length</span><span>) {</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> unsigned int</span><span> sum </span><span style="color: #F92672;">=</span><span style="color: #AE81FF;"> 0</span><span>;</span></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span style="color: #F92672;"> for</span><span> (</span><span style="color: #66D9EF;font-style: italic;">unsigned int</span><span> i </span><span style="color: #F92672;">=</span><span style="color: #AE81FF;"> 0</span><span>; i </span><span style="color: #F92672;"><</span><span> length; i</span><span style="color: #F92672;">++</span><span>) {</span></span>
<span class="giallo-l"><span> sum </span><span style="color: #F92672;">+=</span><span> list[i];</span></span>
<span class="giallo-l"><span> }</span></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span style="color: #F92672;"> return</span><span> sum;</span></span>
<span class="giallo-l"><span>}</span></span></code></pre>
<p>The following will be expanded on shortly:</p>
<ul>
<li>The use of unsigned</li>
<li>What it means to verify code</li>
</ul>
<p>We'll put it in a C file named <code>list_sum.c</code>.</p>
<h1 id="verifying-it">Verifying it</h1>
<p>At this point, your directory should look something like</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>autocorres-1.12</span></span>
<span class="giallo-l"><span>my_theory.thy</span></span>
<span class="giallo-l"><span>list_sum.c</span></span>
<span class="giallo-l"><span>launch.sh</span></span></code></pre>
<p>or similar.</p>
<p>Begin a regular Isabelle theory, importing AutoCorres (and whatever else you want):</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>theory my_theory</span></span>
<span class="giallo-l"><span> imports Main "AutoCorres.AutoCorres"</span></span>
<span class="giallo-l"><span>begin</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>end</span></span></code></pre>
<p>We then need to let AutoCorres perform its magic. First, we "install" the C file with the C parser:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>external_file "list_sum.c"</span></span>
<span class="giallo-l"><span>install_C_file "list_sum.c"</span></span></code></pre>
<p>You can use <code>print_theorems</code> to see what this defines. Of particular interest is <code>list_sum_body_def</code>. Then, AutoCorres:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>autocorres [skip_word_abs] "list_sum.c"</span></span></code></pre><h2 id="tangent-what-s-going-on">Tangent: What's going on?</h2>
<p>The idea the C parser and AutoCorres use for verifying C is that it is reasonable to do a very direct translation of C to Simpl, and then a <em>refinement</em> to the monadic representation. The C parser is correct through inspection, and extensive testing. However, the translation of Simpl to the monadic form is verified - there exist Isabelle-checkable proofs that show that the monadic representation, however different it may be, behaves identically to the Simpl equivalent. This makes the monadic form a refinement of Simpl, and is why the things we prove about the monadic forms translate back down to C.</p>
<h2 id="back-to-autocorres">Back to AutoCorres</h2>
<p>This might also take a second.</p>
<p>We choose to use <code>skip_word_abs</code>, skipping the "word abstraction" that can turn integers into Isabelle <code>nat</code>s. This makes unsigned integers perform modular arithmetic instead of using overflow checks; this has positives and negatives. Read the README for more, but perhaps you can guess why this is advantageous in our case? (Hint: is <code>sum</code> overflowing allowed?)</p>
<p>Again, you can use <code>print_theorems</code> to see what this gives you. Of particular interest is <code>list_sum'_def</code>. This is the monadic embedding of our function.</p>
<p>We then need to enter the locale (think of it as an environment) defined by the C parser and AutoCorres, so your file should look something like:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>theory my_theory</span></span>
<span class="giallo-l"><span> imports Main "AutoCorres.AutoCorres"</span></span>
<span class="giallo-l"><span>begin</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>external_file "list_sum.c"</span></span>
<span class="giallo-l"><span>install_C_file "list_sum.c"</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>autocorres [skip_word_abs] "list_sum.c"</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>context list_sum begin</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #88846F;">(* See below. *)</span></span>
<span class="giallo-l"><span>thm list_sum_body_def</span></span>
<span class="giallo-l"><span>thm list_sum'_def</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>term heap_w32</span></span>
<span class="giallo-l"><span>term heap_w32_update</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>end</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>end</span></span></code></pre>
<p>We do our work in this locale. If you haven't already, <code>term list_sum_body</code> and <code>term list_sum'</code>. The former is the deep embedding produced by the C parser, and the latter is the result of AutoCorres's shallow embedding. These can be unfolded with <code>list_sum_body_def</code> and <code>list_sum'_def</code> respectively. You can examine the types of things with ctrl-hover (cmd-hover on Macs.)</p>
<p>Also examine <code>term heap_w32</code>. The type for the monadic state used by AutoCorres is called <code>lifted_globals</code> (You may see it displayed as <code>'a lifted_globals_scheme</code> in some places.) It's a record containing fields for each type of pointer used; ours only uses <code>unsigned int *</code>, so it only contains information for 32 bit words. We can examine the extract and update functions used in <code>list_sum'_def</code> with <code>term heap_w32</code> and <code>term heap_w32_update</code>.</p>
<p>Which monad AutoCorres chooses to embed a function into depends on the function, and can also be configured. This function is simple enough that it can be encoded with purely <code>option</code>, but others include <code>pure</code>, <code>gets</code> (option with state,) and <code>nondet</code>.</p>
<h1 id="tangent-what-does-it-mean-to-verify-something">Tangent: What does it mean to verify something?</h1>
<p>Yes, this is a reasonable question to ask. What does it actually mean to verify this function? Generally, there are a few reasons to verify something:</p>
<ol>
<li>To prove it never "fails" (what failing means is another question)</li>
<li>To prove it produces some desired output</li>
<li>To prove it holds some desired property</li>
</ol>
<p>We'll look at all three.</p>
<h2 id="on-level-of-depth">On level-of-depth</h2>
<p>The not failing example will go into quite a lot of depth, whereas the correctness example will go into much less, only covering broad strokes. This is because the proofs are quite similar, and if you find the former excessively verbose, you might want to skip to the latter.</p>
<h1 id="not-failing-good">Not failing (good)</h1>
<p>Let's consider what we need for this function to not fail in C. The obvious constraint is that <code>list[i]</code> must be defined for all <code>0 <= i < length</code>. Using <code>term is_valid_w32 :: "lifted_globals ⇒ 32 word ptr ⇒ bool" </code>, we can state this as a definition:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>definition list_defined_to :: "lifted_globals ⇒ 32 word ptr ⇒ 32 word ⇒ bool" where</span></span>
<span class="giallo-l"><span> "list_defined_to s list len ≡ ∀i. 0 ≤ i ∧ i < len ⟶ is_valid_w32 s (list +⇩p uint i)"</span></span></code></pre>
<p>Notes:</p>
<ol>
<li><code>list</code> is a <code>32 word ptr</code>, as perhaps expected. <code>len</code> has been converted into a <code>32 word</code>.</li>
<li><code>s</code> is our state for the function, and carries information as mentioned about the heap.</li>
<li>We use the perhaps confusing <code>+⇩p</code> for pointer addition. You can write this in jedit with <code>+ \<^sub> <enter> p</code>. We also need an explicit type conversion <code>uint i</code>, as you can add negatives to a pointer, so the argument is an <code>uint</code> (this is <em>not</em> unsigned int; that's <code>unat</code>. <code>int</code> here corresponds to Isabelle <code>int</code>, which is signed.)</li>
</ol>
<p>Now we have our suitable precondition, let's set up our "doesn't fail" lemma. We expect that:</p>
<ul>
<li>If:
<ul>
<li>The list is defined properly</li>
<li>Some other property Q is true</li>
</ul>
</li>
<li>Then:
<ul>
<li>Our function does return successfully, and</li>
<li>Our function does not modify any state, so</li>
<li>That property is still true.</li>
</ul>
</li>
</ul>
<p>We can state this using the combinator <code>ovalidNF</code>. The NF stands for <code>no fail</code>, and it adds the additional condition that our program does not fail in some way during execution. Precisely what we want! It takes three arguments:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>term ovalidNF</span></span>
<span class="giallo-l"><span style="color: #88846F;">(*</span></span>
<span class="giallo-l"><span style="color: #88846F;">"ovalidNF"</span></span>
<span class="giallo-l"><span style="color: #88846F;"> :: "('a ⇒ bool) ⇒ ('a ⇒ 'b option) ⇒ ('b ⇒ 'a ⇒ bool) ⇒ bool"</span></span>
<span class="giallo-l"><span style="color: #88846F;">*)</span></span></code></pre>
<p>The arguments are:</p>
<ol>
<li>A precondition function.</li>
<li>A computation function.</li>
<li>A postcondition function.</li>
</ol>
<p>Note that use the <code>option</code> combinators as AutoCorres has translated our function into the <code>option</code> monad. Also note that our postcondition takes both the state <code>'a</code> and the return value <code>'b</code>. When we use <code>ovalidNF</code> with <code>list_sum'</code>, <code>'a</code> will be our state <code>lifted_globals</code>. So, our lemma then becomes:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>lemma list_sum_no_fail: "ovalidNF (λs. list_defined_to s list len ∧ Q s)</span></span>
<span class="giallo-l"><span> (list_sum' list len)</span></span>
<span class="giallo-l"><span> (λret s. Q s)"</span></span></code></pre>
<p>If we have our list defined properly and some property Q, and we run our program, then it does not fail and Q is still true (as our program did not modify any state).</p>
<h2 id="proof-time-detailed">Proof time! (detailed)</h2>
<p>If you're familiar with Hoare logic, you'll know we probably want to use some sort of weakest precondition reasoning. A weakest precondition is roughly "what is the smallest amount of information we need to know for this to be true", which allows us to simplify our proof obligations. Indeed, AutoCorres provides us with a family of tactics such as <code>wp</code> and <code>wpsimp</code>. However, I've found it useful to start these proofs by unfolding the function at hand, and applying <code>auto</code> or similar to get some simplification going. Then we can apply <code>wp</code> to apply relevant weakest precondition rules automatically.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> apply (unfold list_sum'_def)</span></span>
<span class="giallo-l"><span> apply auto</span></span>
<span class="giallo-l"><span> apply wp</span></span></code></pre>
<p>This should leave you with a state something like the following. We can see how our function has been simplified down to combinators like <code>owhile</code> and <code>oreturn</code>.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>proof (prove)</span></span>
<span class="giallo-l"><span>goal (1 subgoal):</span></span>
<span class="giallo-l"><span> 1. ovalidNF (λs. list_defined_to s list len ∧ Q s) (owhile (λ(i, sum) s. i < len) (λ(i, sum). do {</span></span>
<span class="giallo-l"><span> y ← oguard (λs. is_valid_w32 s (list +⇩p uint i));</span></span>
<span class="giallo-l"><span> sum ← ogets (λs. sum + heap_w32 s (list +⇩p uint i));</span></span>
<span class="giallo-l"><span> oreturn (i + 1, sum)</span></span>
<span class="giallo-l"><span> })</span></span>
<span class="giallo-l"><span> (0, 0))</span></span>
<span class="giallo-l"><span> (λr. case r of (x, y) ⇒ Q)</span></span></code></pre>
<p>If you're unfamiliar with Isabelle, this is our proof goal or obligation - it's what we're required to prove to finish the proof as a whole.</p>
<p>I <em>highly</em> recommend using the Query tab of jedit throughout (or equivalents like <code>find_theorems</code>.) <code>name: foo</code> will come in handy, and it's a nice fuzzy search. <code>find_theorems solves</code> will do what's on the tin, and <code>find_theorem intro</code> will find theorems that could apply.</p>
<p>As we have a while-loop, a reasonable step is to add an invariant. An invariant is something that is <em>invariant</em> over the loop - it is always true, at the top of every loop cycle, and right after the loop finishes. This is how we conclude things about what a loop does. Indeed, we can see a theorem of use:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>Reader_Option_VCG.owhile_add_inv: owhile ?C ?B ?x = owhile_inv ?C ?B ?x ?I ?M</span></span></code></pre>
<p>Most of the time, the prefixes can be omitted.</p>
<p>So first, we add an invariant, and then we can use <code>wp</code> to transform our <code>owhile_inv</code> into theorems we can work with.</p>
<p>The invariants we care about right now are:</p>
<ol>
<li><code> i ≤ len</code> (for termination)</li>
<li><code>list_defined_to s list len</code> (for no-failure)</li>
<li><code>Q s</code> (for simplified correctness)</li>
</ol>
<p>We also care that this loop terminates, so let's add a suitable measure.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> apply (subst owhile_add_inv[where I="λ(i, sum) s. i ≤ len ∧ list_defined_to s list len ∧ Q s"</span></span>
<span class="giallo-l"><span> and M="λ(i, sum) s. unat (len - i)"])</span></span></code></pre>
<p><code>I</code> is our invariant, and <code>M</code> is the termination measure for the loop. Note the type conversion in <code>M</code>. Then, <code>wp</code> for weakest precondition reasoning again:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> apply wp</span></span>
<span class="giallo-l"><span> apply auto</span></span></code></pre>
<p>(unconstrained <code>auto</code> here technically isn't the best practice, as it's affecting multiple goals, but in this instance it works alright.) This leaves me with the following three goals. Again if you're unfamiliar with Isabelle, the left-hand-side represents our "known facts", and the right-hand-side is our goal, like earlier.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>proof (prove)</span></span>
<span class="giallo-l"><span>goal (3 subgoals):</span></span>
<span class="giallo-l"><span> 1. ⋀a s. ⟦a < len; a ≤ len; list_defined_to s list len; Q s⟧ ⟹ is_valid_w32 s (list +⇩p uint a)</span></span>
<span class="giallo-l"><span> 2. ⋀a s. ⟦a < len; a ≤ len; list_defined_to s list len; Q s⟧ ⟹ a + 1 ≤ len</span></span>
<span class="giallo-l"><span> 3. ⋀a b m.</span></span>
<span class="giallo-l"><span> ⦉λs. a ≤ len ∧ list_defined_to s list len ∧ Q s ∧ a < len ∧ unat (len - a) = m⦊ do {</span></span>
<span class="giallo-l"><span> y ← oguard (λs. is_valid_w32 s (list +⇩p uint a));</span></span>
<span class="giallo-l"><span> sum ← λc. Some (b + heap_w32 c (list +⇩p uint a));</span></span>
<span class="giallo-l"><span> λb. Some (a + 1, sum)</span></span>
<span class="giallo-l"><span> } ⦉λr s. (case r of (i, sum) ⇒ λs. unat (len - i)) s < m⦊</span></span></code></pre>
<p>The first we talked about earlier - the access <code>list[i]</code> must be valid. We can solve this subgoal by unfolding <code>list_defined_to</code> via <code>list_defined_to_def</code>, and basic reasoning.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> apply (simp add: list_defined_to_def)</span></span></code></pre>
<p>For the second, it seems obvious - why hasn't <code>auto</code> solved it? (If it were on <code>nat</code>s, it certainly would have.) Alas, it's on <code>32 word</code>s, which as we have chosen to use modular arithmetic, are slightly less nice. I found it slightly hard to search for theorems involving <code>+</code> as it's so overloaded, but luckily here <code>find_theorems solves</code> finds <code>Word.inc_le: ?i < ?m ⟹ ?i + 1 ≤ ?m</code>.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> apply (simp add: inc_le)</span></span></code></pre>
<p>The final goal is more interesting. The initial intuition might be to use <code>wp</code> again, but this leaves us with nasty metavariables because of the chaining nature of the binds, and the fact that AutoCorres here is slightly too general. With a little searching we have the following, which it seems like <code>wp</code> is applying:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> Reader_Option_VCG.obind_wp: ⟦⋀r. ⦉?R r⦊ ?g r ⦉?Q⦊; ⦉?P⦊ ?f ⦉?R⦊⟧ ⟹ ⦉?P⦊ ?f >>= ?g ⦉?Q⦊</span></span></code></pre>
<p>But we only really need <code>?R</code> to be identical to <code>?P</code>. We could instantiate <code>?R</code> manually each time, or we can make a little helper lemma. Above this lemma, we add</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>lemma obind_wp_weak: " ⟦⋀r. ⦉P⦊ g r ⦉Q⦊; ⦉P⦊ f ⦉λs. P⦊⟧ ⟹ ⦉P⦊ obind f g ⦉Q⦊"</span></span>
<span class="giallo-l"><span> by (erule obind_wp, assumption)</span></span></code></pre>
<p>Then we can apply <code>obind_wp_weak</code> as many times as needed (There are two binds.)</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> apply (rule obind_wp_weak)+</span></span></code></pre>
<p>We hence have:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>proof (prove)</span></span>
<span class="giallo-l"><span>goal (3 subgoals):</span></span>
<span class="giallo-l"><span> 1. ⋀a b m r ra.</span></span>
<span class="giallo-l"><span> ⦉λs. a ≤ len ∧ list_defined_to s list len ∧ Q s ∧ a < len ∧ unat (len - a) = m⦊ </span></span>
<span class="giallo-l"><span> λb. Some (a + 1, ra) </span></span>
<span class="giallo-l"><span> ⦉λr s. (case r of (i, sum) ⇒ λs. unat (len - i)) s < m⦊</span></span>
<span class="giallo-l"><span> 2. ⋀a b m r.</span></span>
<span class="giallo-l"><span> ⦉λs. a ≤ len ∧ list_defined_to s list len ∧ Q s ∧ a < len ∧ unat (len - a) = m⦊ </span></span>
<span class="giallo-l"><span> λc. Some (b + heap_w32 c (list +⇩p uint a)) </span></span>
<span class="giallo-l"><span> ⦉λs sa. a ≤ len ∧ list_defined_to sa list len ∧ Q sa ∧ a < len ∧ unat (len - a) = m⦊</span></span>
<span class="giallo-l"><span> 3. ⋀a b m.</span></span>
<span class="giallo-l"><span> ⦉λs. a ≤ len ∧ list_defined_to s list len ∧ Q s ∧ a < len ∧ unat (len - a) = m⦊ </span></span>
<span class="giallo-l"><span> oguard (λs. is_valid_w32 s (list +⇩p uint a)) </span></span>
<span class="giallo-l"><span> ⦉λs sa. a ≤ len ∧ list_defined_to sa list len ∧ Q sa ∧ a < len ∧ unat (len - a) = m⦊</span></span></code></pre>
<p>It's finally time to start unfolding the definition of <code>ovalid</code> so we can crunch down these last few goals. If we hit the first goal with:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> apply (simp add: ovalid_def, clarsimp)</span></span></code></pre>
<p>we're left with</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> 1. ⋀a s. ⟦a ≤ len; list_defined_to s list len; Q s; a < len⟧</span></span>
<span class="giallo-l"><span> ⟹ unat (len - (a + 1)) < unat (len - a)</span></span></code></pre>
<p>This is part of the proof that our measure is correct and our loop terminates. <code>sledgehammer</code> takes it out nicely.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #88846F;"> (* Found with sledgehammer *)</span></span>
<span class="giallo-l"><span> apply (metis diff_diff_eq gt0_iff_gem1 less_diff_gt0 unat_mono)</span></span></code></pre>
<p>Tip: I fiddled with this for a bit manually, but if it looks fiddly and obvious, there's a good chance sledgehammer can do it.</p>
<p>Finally, the last two are easy:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> by (simp add: ovalid_def)+</span></span></code></pre>
<p>We have a proof of non-failure! This is very exciting.</p>
<p>The final proof is as follows:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>lemma obind_wp_weak: " ⟦⋀r. ⦉P⦊ g r ⦉Q⦊; ⦉P⦊ f ⦉λs. P⦊⟧ ⟹ ⦉P⦊ obind f g ⦉Q⦊"</span></span>
<span class="giallo-l"><span> by (erule obind_wp, assumption)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma list_sum_no_fail: "ovalidNF (λs. list_defined_to s list len ∧ Q s)</span></span>
<span class="giallo-l"><span> (list_sum' list len)</span></span>
<span class="giallo-l"><span> (λret s. Q s)"</span></span>
<span class="giallo-l"><span> apply (unfold list_sum'_def)</span></span>
<span class="giallo-l"><span> apply auto</span></span>
<span class="giallo-l"><span> apply wp</span></span>
<span class="giallo-l"><span> apply (subst owhile_add_inv[where I="λ(i, sum) s. i ≤ len ∧ list_defined_to s list len ∧ Q s"</span></span>
<span class="giallo-l"><span> and M="λ(i, sum) s. unat (len - i)"])</span></span>
<span class="giallo-l"><span> apply wp</span></span>
<span class="giallo-l"><span> apply auto</span></span>
<span class="giallo-l"><span> apply (simp add: list_defined_to_def)</span></span>
<span class="giallo-l"><span> apply (simp add: inc_le)</span></span>
<span class="giallo-l"><span> apply (rule obind_wp_weak)+</span></span>
<span class="giallo-l"><span> apply (simp add: ovalid_def, clarsimp)</span></span>
<span class="giallo-l"><span> apply (metis diff_diff_eq gt0_iff_gem1 less_diff_gt0 unat_mono)</span></span>
<span class="giallo-l"><span> by (simp add: ovalid_def)+</span></span></code></pre><h1 id="correctness-also-good">Correctness (also good)</h1>
<p>Then, what does it mean for our function to be correct? Well, a reasonable definition is that it produces the output we expect. We then need to figure out what "output we expect" means.</p>
<p>We could have also defined the sum of a list as similar to the following recursive function:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>function list_sum_spec :: "lifted_globals ⇒ 32 word ptr ⇒ 32 word ⇒ 32 word ⇒ 32 word" where</span></span>
<span class="giallo-l"><span>"list_sum_spec s list len i = (if i = 0 then 0</span></span>
<span class="giallo-l"><span> else heap_w32 s (list +⇩p uint (i - 1))</span></span>
<span class="giallo-l"><span> + list_sum_spec s list len (i - 1))"</span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* The pattern matching is trivially complete. *)</span></span>
<span class="giallo-l"><span> by pat_completeness auto</span></span></code></pre>
<p>Note that we explicitly check for 0 to ensure the recursion terminates (We can't pattern match on 0/Suc, as we're working with <code>32 word</code>s.). Unfortunately, this function's termination can't be proven automatically due to the use of a <code>32 word</code>, which Isabelle isn't as good with as its own <code>nat</code>s. This is why we use a <code>function</code> instead of <code>fun</code>, and we must do the termination proof ourselves:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>termination</span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* Note that the measure is just i, as it's decreasing. *)</span></span>
<span class="giallo-l"><span> apply (rule local.termination[where R="measure (λ(_,_,len,i). unat i)"])</span></span>
<span class="giallo-l"><span> apply blast</span></span>
<span class="giallo-l"><span> apply (unfold measure_def)</span></span>
<span class="giallo-l"><span> by (simp add: measure_unat)</span></span></code></pre>
<p>We also delete <code>list_sum_spec.simps</code> from the default simp set because it seems to cause some solvers to loop.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>declare list_sum_spec.simps [simp del]</span></span></code></pre>
<p>We can set up our lemma like before, but this time, we use the <code>ret</code> parameter:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>lemma list_sum_correct: "ovalid (λs. list_defined_to s list len)</span></span>
<span class="giallo-l"><span> (list_sum' list len)</span></span>
<span class="giallo-l"><span> (λret s. list_sum_spec s list len len = ret)"</span></span></code></pre>
<p>We want the result to be equivalent to summing the entire list with our recursive <code>spec</code> function. We also don't bother to prove that it doesn't fail here.</p>
<p>We can begin as before, omitting the <code>auto</code> step. We then need to annotate with a suitable invariant. A hint: We want the sum <em>at the end</em> to be correct, so a good invariant should capture correctness <em>at every step</em>, which gives us full correctness when the loop finishes.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> apply (subst owhile_add_inv[where I="λ(i, sum) s. i ≤ len ∧ list_defined_to s list len</span></span>
<span class="giallo-l"><span> ∧ list_sum_spec s list len i = sum"</span></span>
<span class="giallo-l"><span> and M="λ(i, sum) s. unat (len - i)"])</span></span></code></pre>
<p>We have to manually <code>subst list_sum_spec.simps</code> a few times as we deleted it from the simp set, but otherwise the proof is very straightforward. Mine came out to be:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>function list_sum_spec :: "lifted_globals ⇒ 32 word ptr ⇒ 32 word ⇒ 32 word ⇒ 32 word" where</span></span>
<span class="giallo-l"><span>"list_sum_spec s list len i = (if i = 0 then 0</span></span>
<span class="giallo-l"><span> else heap_w32 s (list +⇩p uint (i - 1))</span></span>
<span class="giallo-l"><span> + list_sum_spec s list len (i - 1))"</span></span>
<span class="giallo-l"><span> by pat_completeness auto</span></span>
<span class="giallo-l"><span>termination</span></span>
<span class="giallo-l"><span> apply (rule local.termination[where R="measure (λ(_,_,len,i). unat i)"])</span></span>
<span class="giallo-l"><span> apply blast</span></span>
<span class="giallo-l"><span> apply (unfold measure_def)</span></span>
<span class="giallo-l"><span> by (simp add: measure_unat)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>declare list_sum_spec.simps [simp del]</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma list_sum_correct: "ovalid (λs. list_defined_to s list len)</span></span>
<span class="giallo-l"><span> (list_sum' list len)</span></span>
<span class="giallo-l"><span> (λret s. list_sum_spec s list len len = ret)"</span></span>
<span class="giallo-l"><span> apply (unfold list_sum'_def)</span></span>
<span class="giallo-l"><span> apply wp</span></span>
<span class="giallo-l"><span> apply (subst owhile_add_inv[where I="λ(i, sum) s. i ≤ len ∧ list_defined_to s list len</span></span>
<span class="giallo-l"><span> ∧ list_sum_spec s list len i = sum"</span></span>
<span class="giallo-l"><span> and M="λ(i, sum) s. unat (len - i)"])</span></span>
<span class="giallo-l"><span> apply wp</span></span>
<span class="giallo-l"><span> apply auto</span></span>
<span class="giallo-l"><span> apply (simp add: inc_le)</span></span>
<span class="giallo-l"><span> apply (subst list_sum_spec.simps)</span></span>
<span class="giallo-l"><span> apply (simp add: less_is_non_zero_p1)</span></span>
<span class="giallo-l"><span> apply (subst list_sum_spec.simps)</span></span>
<span class="giallo-l"><span> by simp</span></span></code></pre>
<p>We could take this one step further if we wanted, and define a bijection between <code>32 word list</code> and <code>32 word ptr</code> assuming our precondition, and then also show that our own spec is equivalent to the sum of that list. That'd give us even more confidence our function is correct. I'm personally pretty convinced, but you're welcome to try this yourself!</p>
<h1 id="properties-also-good">Properties (also good!)</h1>
<p>We could then finally prove that if some property is true for the sum of a list, it's true for the result of our program. I won't detail this one; it should follow reasonably easily from the former two.</p>
<h1 id="conclusion">Conclusion</h1>
<p>So, what have we (hopefully) learnt?</p>
<ol>
<li>How to install and setup Isabelle and AutoCorres</li>
<li>What it means to prove things about programs</li>
<li>How to set up appropriate proofs</li>
<li>How to prove them</li>
<li>What tools we have available and how we can search for more</li>
</ol>
<p>I hope this has been informative!</p>
<h1 id="the-whole-file">The whole file</h1>
<p><code>list_sum.c</code>:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="c"><span class="giallo-l"><span style="color: #66D9EF;font-style: italic;">unsigned int</span><span style="color: #A6E22E;"> list_sum</span><span>(</span><span style="color: #66D9EF;font-style: italic;">unsigned int</span><span style="color: #F92672;"> *</span><span style="color: #FD971F;font-style: italic;">list</span><span>,</span><span style="color: #66D9EF;font-style: italic;"> unsigned int</span><span style="color: #FD971F;font-style: italic;"> length</span><span>) {</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> unsigned int</span><span> sum </span><span style="color: #F92672;">=</span><span style="color: #AE81FF;"> 0</span><span>;</span></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span style="color: #F92672;"> for</span><span> (</span><span style="color: #66D9EF;font-style: italic;">unsigned int</span><span> i </span><span style="color: #F92672;">=</span><span style="color: #AE81FF;"> 0</span><span>; i </span><span style="color: #F92672;"><</span><span> length; i</span><span style="color: #F92672;">++</span><span>) {</span></span>
<span class="giallo-l"><span> sum </span><span style="color: #F92672;">+=</span><span> list[i];</span></span>
<span class="giallo-l"><span> }</span></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span style="color: #F92672;"> return</span><span> sum;</span></span>
<span class="giallo-l"><span>}</span></span></code></pre>
<p><code>my_theory.thy</code> (With less fixing of indentation for the web, sorry):</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>theory my_theory</span></span>
<span class="giallo-l"><span> imports Main "AutoCorres.AutoCorres"</span></span>
<span class="giallo-l"><span>begin</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>external_file "list_sum.c"</span></span>
<span class="giallo-l"><span>install_C_file "list_sum.c"</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>autocorres [skip_word_abs] "list_sum.c"</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>context list_sum begin</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>definition list_defined_to :: "lifted_globals ⇒ 32 word ptr ⇒ 32 word ⇒ bool" where</span></span>
<span class="giallo-l"><span> "list_defined_to s list len ≡ ∀i. 0 ≤ i ∧ i < len ⟶ is_valid_w32 s (list +⇩p uint i)"</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma obind_wp_weak: " ⟦⋀r. ⦉P⦊ g r ⦉Q⦊; ⦉P⦊ f ⦉λs. P⦊⟧ ⟹ ⦉P⦊ obind f g ⦉Q⦊"</span></span>
<span class="giallo-l"><span> by (erule obind_wp, assumption)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma list_sum_no_fail: "ovalidNF (λs. list_defined_to s list len ∧ Q s) (list_sum' list len) (λret s. Q s)"</span></span>
<span class="giallo-l"><span> apply (unfold list_sum'_def)</span></span>
<span class="giallo-l"><span> apply auto</span></span>
<span class="giallo-l"><span> apply wp</span></span>
<span class="giallo-l"><span> apply (subst owhile_add_inv[where I="λ(i, sum) s. i ≤ len ∧ list_defined_to s list len ∧ Q s"</span></span>
<span class="giallo-l"><span> and M="λ(i, sum) s. unat (len - i)"])</span></span>
<span class="giallo-l"><span> apply wp</span></span>
<span class="giallo-l"><span> apply auto</span></span>
<span class="giallo-l"><span> apply (simp add: list_defined_to_def)</span></span>
<span class="giallo-l"><span> apply (simp add: inc_le)</span></span>
<span class="giallo-l"><span> apply (rule obind_wp_weak)+</span></span>
<span class="giallo-l"><span> apply (simp add: ovalid_def, clarsimp)</span></span>
<span class="giallo-l"><span> apply (metis diff_diff_eq gt0_iff_gem1 less_diff_gt0 unat_mono)</span></span>
<span class="giallo-l"><span> by (simp add: ovalid_def)+</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>function list_sum_spec :: "lifted_globals ⇒ 32 word ptr ⇒ 32 word ⇒ 32 word ⇒ 32 word" where</span></span>
<span class="giallo-l"><span>"list_sum_spec s list len i = (if i = 0 then 0 else heap_w32 s (list +⇩p uint (i - 1)) + list_sum_spec s list len (i - 1))"</span></span>
<span class="giallo-l"><span> by pat_completeness auto</span></span>
<span class="giallo-l"><span>termination</span></span>
<span class="giallo-l"><span> apply (rule local.termination[where R="measure (λ(_,_,len,i). unat i)"])</span></span>
<span class="giallo-l"><span> apply blast</span></span>
<span class="giallo-l"><span> apply (unfold measure_def)</span></span>
<span class="giallo-l"><span> by (simp add: measure_unat)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>declare list_sum_spec.simps [simp del]</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma list_sum_correct: "ovalid (λs. list_defined_to s list len) (list_sum' list len) (λret s. list_sum_spec s list len len = ret)"</span></span>
<span class="giallo-l"><span> apply (unfold list_sum'_def)</span></span>
<span class="giallo-l"><span> apply wp</span></span>
<span class="giallo-l"><span> apply (subst owhile_add_inv[where I="λ(i, sum) s. i ≤ len ∧ list_defined_to s list len ∧ list_sum_spec s list len i = sum"</span></span>
<span class="giallo-l"><span> and M="λ(i, sum) s. unat (len - i)"])</span></span>
<span class="giallo-l"><span> apply wp</span></span>
<span class="giallo-l"><span> apply auto</span></span>
<span class="giallo-l"><span> apply (simp add: inc_le)</span></span>
<span class="giallo-l"><span> apply (subst list_sum_spec.simps)</span></span>
<span class="giallo-l"><span> apply (simp add: less_is_non_zero_p1)</span></span>
<span class="giallo-l"><span> apply (subst list_sum_spec.simps)</span></span>
<span class="giallo-l"><span> by simp</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>end</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>end</span></span></code></pre>
<p>A bit underwhelming for how long it took to explain, perhaps!</p>
Flat/Non-higher-order construction of ANF via mutable holes2026-05-14T00:00:00+00:002026-05-14T00:00:00+00:00
Blueberry Wren
https://blueberrywren.dev/blog/anf-mutable/<h1 id="flat-non-higher-order-construction-of-anf-via-mutable-holes">Flat/Non-higher-order construction of ANF via mutable holes</h1>
<p>This post will describe an algorithm for constructing an ANF/similar IR from a functional-like base language with no closure usage,
and with no related excess space requirements. This algorithm is as far as I know not new, and has apparently been known in
imperative compilation for a while. However, I admittedly have no source for this, nor
have I seen it described for functional-like languages.</p>
<p>Thanks to Ryan Brewer and rpjohnst for their inspiration on this.</p>
<p>If you are only interested in code, please skip to Implementation.</p>
<h2 id="prerequisites">Prerequisites</h2>
<p>First, let us describe our input and output languages. Our input language will look like this:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> ml</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Let</span><span> of string</span><span style="color: #E6DB74;"> *</span><span> ml</span><span style="color: #E6DB74;"> *</span><span> ml</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Name</span><span> of string</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Int</span><span> of int</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Add</span><span> of ml</span><span style="color: #E6DB74;"> *</span><span> ml</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Print</span><span> of ml</span></span></code></pre>
<p>This is meant to echo some simple functional programming language, and contains all the elements needed to demonstrate the algorithm.</p>
<p>Our output language will look like a lexically-scoped flat ANF-style construction, with all lets at the toplevel.
The goal is to convert from our input <code>ml</code> to this language.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> base</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Name</span><span> of string</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Add</span><span> of string</span><span style="color: #E6DB74;"> *</span><span> string</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Int</span><span> of int</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Print</span><span> of string</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> anf</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Let</span><span> of string</span><span style="color: #E6DB74;"> *</span><span> base</span><span style="color: #E6DB74;"> *</span><span> anf</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Done</span><span> of string</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Hole</span><span> of anf</span><span style="color: #A6E22E;"> option</span><span> ref</span></span></code></pre>
<p>The notable addition is the <code>Hole</code> constructor in <code>anf</code>, the purpose of which will be described now.</p>
<h2 id="the-premise">The premise</h2>
<p>Imagine we are trying to convert the term</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> x</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span style="color: #A6E22E;"> y</span><span style="color: #66D9EF;font-style: italic;"> =</span><span style="color: #AE81FF;"> 2</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span> y</span><span style="color: #E6DB74;"> +</span><span style="color: #AE81FF;"> 1</span></span>
<span class="giallo-l"><span>in</span></span>
<span class="giallo-l"><span>x + 2</span></span></code></pre>
<p>When we arrive at the body of <code>x</code>, we have a conundrum. We need to put the conversion of <code>y</code> before <code>x</code>,
so that using <code>y</code> is well-scoped. Hence, we must convert <code>y</code> before we can continue. How do we use this conversion, though?
<code>x</code>'s content needs to be put in the <code>anf</code> field of <code>y</code>'s <code>Let</code>, so it's not clear how to both convert <code>y</code> before <code>x</code> and
to use <code>x</code>'s finished conversion in <code>y</code>.</p>
<p>One "traditional" method of solving this is via continuations, where <code>y</code> is passed a closure representing "what to do next", after it
converts its body. We can then put <code>x</code>'s content in that closure, which will be invoked later. This has two main flaws:</p>
<ul>
<li>It uses excess space. A conversion of a term will allocate ~2x the memory "needed"; it must allocate for the ANF construction itself, and for the closures needed during the construction.</li>
<li>It is slower, due to the aforementioned closure allocation and application.</li>
</ul>
<p>This method resolves these.</p>
<h2 id="the-algorithm">The algorithm</h2>
<p>Recall that we left a <code>Hole of anf option ref</code> field in our <code>anf</code> type. I will denote a hole like this: <code>[·]</code>.
The central idea is that our conversion of any given <code>ml</code> fragment will return:</p>
<ol>
<li>The fragment itself.</li>
<li>A name we can use to refer to what was bound in the fragment (In the conversion of addition/similar with nested content, names must be conjured.)</li>
<li>The reference created by the hole, so that it may be filled.</li>
</ol>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #66D9EF;font-style: italic;">val</span><span style="color: #A6E22E;"> convert</span><span style="color: #E6DB74;"> :</span><span> ml</span><span style="color: #E6DB74;"> -></span><span> (anf</span><span style="color: #E6DB74;"> *</span><span> string</span><span style="color: #E6DB74;"> *</span><span> anf</span><span style="color: #A6E22E;"> option</span><span> ref)</span></span></code></pre>
<p>Consider this simplified example:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> x</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span style="color: #A6E22E;"> y</span><span style="color: #66D9EF;font-style: italic;"> =</span><span style="color: #AE81FF;"> 2</span><span style="color: #66D9EF;font-style: italic;"> in</span><span> y</span><span style="color: #E6DB74;"> +</span><span style="color: #AE81FF;"> 2</span></span>
<span class="giallo-l"><span>in x</span></span></code></pre>
<p>When we convert <code>x</code>, this signals for the conversion of <code>y</code>. There are two steps to converting a <code>let</code> - we
must first convert the "head" (<code>2</code>), and then the "body" (<code>y</code>).</p>
<p>Converting the <code>head</code> will result in something of form</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> y</span><span style="color: #66D9EF;font-style: italic;"> =</span><span style="color: #AE81FF;"> 2</span><span> in </span></span>
<span class="giallo-l"><span>[·]</span></span></code></pre>
<p>Note that the hole is left to be filled later. This way, the conversion of <code>y</code>'s head need know nothing about its environment.
We represent this in code via the <code>Hole</code> constructor, which contains a reference to a fragment that either may be empty (<code>None</code>)
or filled (<code>Some ...</code>).
The conversion of the body can then proceed by first generating the expected addition, binding it to <code>nm</code> so it may be referenced later:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> nm</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> y</span><span style="color: #E6DB74;"> +</span><span style="color: #AE81FF;"> 2</span><span> in</span></span>
<span class="giallo-l"><span>[·]</span></span></code></pre>
<p>We now need to get this fragment into the proper lexical scope. We can do this by plugging it into the hole left by the conversion of the head:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> y</span><span style="color: #66D9EF;font-style: italic;"> =</span><span style="color: #AE81FF;"> 2</span><span> in</span></span>
<span class="giallo-l"><span>[</span></span>
<span class="giallo-l"><span style="color: #F92672;"> let</span><span style="color: #A6E22E;"> nm</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> y</span><span style="color: #E6DB74;"> +</span><span style="color: #AE81FF;"> 2</span><span> in</span></span>
<span class="giallo-l"><span> [·]</span></span>
<span class="giallo-l"><span>]</span></span></code></pre>
<p>Then, returning this fragment, the name bound (<code>y</code>), and the reference to the inner hole, we can continue converting <code>x</code>;
First, convert the head, using the name returned by the conversion of <code>y</code>:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> x</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> nm in</span></span>
<span class="giallo-l"><span>[·]</span></span></code></pre>
<p>Then, the body:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> nm2</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> x in</span></span>
<span class="giallo-l"><span>[·]</span></span></code></pre>
<p>Plug:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> x</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> nm in</span></span>
<span class="giallo-l"><span>[</span></span>
<span class="giallo-l"><span style="color: #F92672;"> let</span><span style="color: #A6E22E;"> nm2</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> x in</span></span>
<span class="giallo-l"><span> [·]</span></span>
<span class="giallo-l"><span>]</span></span></code></pre>
<p>And finally plug it into the hole returned by <code>y</code>.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> y</span><span style="color: #66D9EF;font-style: italic;"> =</span><span style="color: #AE81FF;"> 2</span><span> in</span></span>
<span class="giallo-l"><span>[</span></span>
<span class="giallo-l"><span style="color: #F92672;"> let</span><span style="color: #A6E22E;"> nm</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> y</span><span style="color: #E6DB74;"> +</span><span style="color: #AE81FF;"> 2</span><span> in</span></span>
<span class="giallo-l"><span> [</span></span>
<span class="giallo-l"><span style="color: #F92672;"> let</span><span style="color: #A6E22E;"> x</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> nm in</span></span>
<span class="giallo-l"><span> [</span></span>
<span class="giallo-l"><span style="color: #F92672;"> let</span><span style="color: #A6E22E;"> nm2</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> x in</span></span>
<span class="giallo-l"><span> [·]</span></span>
<span class="giallo-l"><span> ]</span></span>
<span class="giallo-l"><span> ]</span></span>
<span class="giallo-l"><span>]</span></span></code></pre>
<p>We are left with a final hole we can plug with <code>Done</code> to be explicit about the end of a control flow path.
One disadvantage of this strategy is that it does generate many unneeded names. Most of these can be avoided by carefully special
casing certain <code>lets</code>, and the rest can be eliminated via a simple folding pass.</p>
<h2 id="implementation">Implementation</h2>
<p>Below is a sample implementation of this algorithm, in OCaml.</p>
<details>
<summary>
The implementation can be unfolded here.
</summary>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> ml</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Let</span><span> of string</span><span style="color: #E6DB74;"> *</span><span> ml</span><span style="color: #E6DB74;"> *</span><span> ml</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Name</span><span> of string</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Int</span><span> of int</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Add</span><span> of ml</span><span style="color: #E6DB74;"> *</span><span> ml</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Print</span><span> of ml</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #88846F;">(* Suffix with ' to dodge OCaml annoyances. *)</span></span>
<span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> base</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Name</span><span>' of string</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Add</span><span>' of string</span><span style="color: #E6DB74;"> *</span><span> string</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Int</span><span>' of int</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Print</span><span>' of string</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> anf</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Let</span><span>' of string</span><span style="color: #E6DB74;"> *</span><span> base</span><span style="color: #E6DB74;"> *</span><span> anf</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Done</span><span>' of string</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Hole</span><span>' of anf</span><span style="color: #A6E22E;"> option</span><span> ref</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> fresh_name</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span style="color: #A6E22E;"> counter</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> ref</span><span style="color: #AE81FF;"> 0</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> fun</span><span style="color: #A6E22E;"> ()</span><span style="color: #66D9EF;font-style: italic;"> -></span></span>
<span class="giallo-l"><span> incr counter</span><span style="color: #E6DB74;">;</span></span>
<span class="giallo-l"><span style="color: #E6DB74;"> "nm" ^</span><span> string_of_int</span><span style="color: #E6DB74;"> !</span><span>counter</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #88846F;">(* A helper to make an anf fragment of form</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #88846F;"> let new_name = base in</span></span>
<span class="giallo-l"><span style="color: #88846F;"> [·]</span></span>
<span class="giallo-l"><span style="color: #88846F;"> *)</span></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> make_let_hole</span><span> (</span><span style="color: #FD971F;font-style: italic;">base</span><span style="color: #E6DB74;"> :</span><span> base)</span><span style="color: #E6DB74;"> :</span><span> (anf</span><span style="color: #E6DB74;"> *</span><span> string</span><span style="color: #E6DB74;"> *</span><span> anf</span><span style="color: #A6E22E;"> option</span><span> ref)</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span style="color: #A6E22E;"> name</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> fresh_name</span><span style="color: #A6E22E;"> ()</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span style="color: #A6E22E;"> r</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> ref</span><span style="color: #A6E22E;"> None</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span> (</span><span style="color: #A6E22E;">Let'</span><span> (name</span><span style="color: #E6DB74;">,</span><span> base</span><span style="color: #E6DB74;">,</span><span style="color: #A6E22E;"> Hole'</span><span> r)</span><span style="color: #E6DB74;">,</span><span> name</span><span style="color: #E6DB74;">,</span><span> r)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #E6DB74;"> rec</span><span style="color: #A6E22E;"> convert</span><span> (</span><span style="color: #FD971F;font-style: italic;">ml</span><span style="color: #E6DB74;"> :</span><span> ml)</span><span style="color: #E6DB74;"> :</span><span> (anf</span><span style="color: #E6DB74;"> *</span><span> string</span><span style="color: #E6DB74;"> *</span><span> anf</span><span style="color: #A6E22E;"> option</span><span> ref)</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #F92672;"> match</span><span> ml</span><span style="color: #F92672;"> with</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Name</span><span style="color: #FD971F;font-style: italic;"> nm</span><span style="color: #66D9EF;font-style: italic;"> -></span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* Bind to a new name, and return.</span></span>
<span class="giallo-l"><span style="color: #88846F;"> A case that can be eliminated in most cases.</span></span>
<span class="giallo-l"><span style="color: #88846F;"> *)</span></span>
<span class="giallo-l"><span> make_let_hole (</span><span style="color: #A6E22E;">Name'</span><span> nm)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Int</span><span style="color: #FD971F;font-style: italic;"> i</span><span style="color: #66D9EF;font-style: italic;"> -></span></span>
<span class="giallo-l"><span> make_let_hole (</span><span style="color: #A6E22E;">Int'</span><span> i)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Add</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> b</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* First, we convert `a` and `b` *)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span> (</span><span style="color: #FD971F;font-style: italic;">a_anf</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> a_name</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> a_hole</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> convert a</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span> (</span><span style="color: #FD971F;font-style: italic;">b_anf</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> b_name</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> b_hole</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> convert b</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* We chose a left-to-right evaluation order, so we</span></span>
<span class="giallo-l"><span style="color: #88846F;"> want to put `a` before `b`. Hence, plug `b`'s fragment</span></span>
<span class="giallo-l"><span style="color: #88846F;"> into the hole provided by `a`.</span></span>
<span class="giallo-l"><span style="color: #88846F;"> *)</span></span>
<span class="giallo-l"><span> a_hole</span><span style="color: #E6DB74;"> :=</span><span style="color: #A6E22E;"> Some</span><span> b_anf</span><span style="color: #E6DB74;">;</span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* Then, we need a fragment for the addition itself. *)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span> (</span><span style="color: #FD971F;font-style: italic;">add_anf</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> add_name</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> add_hole</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span> make_let_hole (</span><span style="color: #A6E22E;">Add'</span><span> (a_name</span><span style="color: #E6DB74;">,</span><span> b_name))</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* We put this in `b`'s hole. *)</span></span>
<span class="giallo-l"><span> b_hole</span><span style="color: #E6DB74;"> :=</span><span style="color: #A6E22E;"> Some</span><span> add_anf</span><span style="color: #E6DB74;">;</span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* Finally, we return the whole expression.</span></span>
<span class="giallo-l"><span style="color: #88846F;"> Everything is contained within `a_anf`.</span></span>
<span class="giallo-l"><span style="color: #88846F;"> If the user wishes to refer to the result of this conversion,</span></span>
<span class="giallo-l"><span style="color: #88846F;"> they should use add_name.</span></span>
<span class="giallo-l"><span style="color: #88846F;"> If they wish to plug something into it,</span></span>
<span class="giallo-l"><span style="color: #88846F;"> they should use add_hole.</span></span>
<span class="giallo-l"><span style="color: #88846F;"> *)</span></span>
<span class="giallo-l"><span> (a_anf</span><span style="color: #E6DB74;">,</span><span> add_name</span><span style="color: #E6DB74;">,</span><span> add_hole)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Print</span><span style="color: #FD971F;font-style: italic;"> body</span><span style="color: #66D9EF;font-style: italic;"> -></span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* Print is similar. *)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span> (</span><span style="color: #FD971F;font-style: italic;">body_anf</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> body_name</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> body_hole</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> convert body</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span> (</span><span style="color: #FD971F;font-style: italic;">print_anf</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> print_name</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> print_hole</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span> make_let_hole (</span><span style="color: #A6E22E;">Print'</span><span> body_name)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span> body_hole</span><span style="color: #E6DB74;"> :=</span><span style="color: #A6E22E;"> Some</span><span> print_anf</span><span style="color: #E6DB74;">;</span></span>
<span class="giallo-l"><span> (body_anf</span><span style="color: #E6DB74;">,</span><span> print_name</span><span style="color: #E6DB74;">,</span><span> print_hole)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Let</span><span> (</span><span style="color: #FD971F;font-style: italic;">name</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> head</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> body</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span> (</span><span style="color: #FD971F;font-style: italic;">head_anf</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> head_name</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> head_hole</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> convert head</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span> (</span><span style="color: #FD971F;font-style: italic;">body_anf</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> body_name</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> body_hole</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> convert body</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* We need to bind this let before body to ensure it is</span></span>
<span class="giallo-l"><span style="color: #88846F;"> properly lexically scoped.</span></span>
<span class="giallo-l"><span style="color: #88846F;"> *)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span style="color: #A6E22E;"> let_anf</span><span style="color: #66D9EF;font-style: italic;"> =</span><span style="color: #A6E22E;"> Let'</span><span> (name</span><span style="color: #E6DB74;">,</span><span style="color: #A6E22E;"> Name'</span><span> head_name</span><span style="color: #E6DB74;">,</span><span> body_anf)</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* Then fill it as expected. *)</span></span>
<span class="giallo-l"><span> head_hole</span><span style="color: #E6DB74;"> :=</span><span style="color: #A6E22E;"> Some</span><span style="color: #66D9EF;font-style: italic;"> let</span><span>_anf;</span></span>
<span class="giallo-l"><span> (head_anf, body_name, body_hole)</span></span></code></pre></details>
<p>I recommend toying with the conversion yourself, using <code>utop</code> or similar.
In the following, I will "clean up" the output slightly, as to not make it unreadable.</p>
<p>If we use our first example term:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>utop #</span><span style="color: #F92672;"> let</span><span style="color: #A6E22E;"> term</span><span style="color: #66D9EF;font-style: italic;"> =</span><span style="color: #A6E22E;"> Let</span><span>(</span><span style="color: #E6DB74;">"x",</span><span style="color: #A6E22E;"> Let</span><span>(</span><span style="color: #E6DB74;">"y",</span><span style="color: #A6E22E;"> Int</span><span style="color: #AE81FF;"> 2</span><span style="color: #E6DB74;">,</span><span style="color: #A6E22E;"> Add</span><span> (</span><span style="color: #A6E22E;">Name</span><span style="color: #E6DB74;"> "y",</span><span style="color: #A6E22E;"> Int</span><span style="color: #AE81FF;"> 1</span><span>))</span><span style="color: #E6DB74;">,</span><span style="color: #A6E22E;"> Add</span><span> (</span><span style="color: #A6E22E;">Name</span><span style="color: #E6DB74;"> "x",</span><span style="color: #A6E22E;"> Int</span><span style="color: #AE81FF;"> 3</span><span>));;</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;">val</span><span style="color: #A6E22E;"> term</span><span style="color: #E6DB74;"> :</span><span> ml</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #A6E22E;"> Let</span><span> (</span><span style="color: #E6DB74;">"x",</span><span style="color: #A6E22E;"> Let</span><span> (</span><span style="color: #E6DB74;">"y",</span><span style="color: #A6E22E;"> Int</span><span style="color: #AE81FF;"> 2</span><span style="color: #E6DB74;">,</span><span style="color: #A6E22E;"> Add</span><span> (</span><span style="color: #A6E22E;">Name</span><span style="color: #E6DB74;"> "y",</span><span style="color: #A6E22E;"> Int</span><span style="color: #AE81FF;"> 1</span><span>))</span><span style="color: #E6DB74;">,</span><span style="color: #A6E22E;"> Add</span><span> (</span><span style="color: #A6E22E;">Name</span><span style="color: #E6DB74;"> "x",</span><span style="color: #A6E22E;"> Int</span><span style="color: #AE81FF;"> 3</span><span>))</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>utop</span><span style="color: #F92672;"> #</span><span style="color: #A6E22E;"> convert</span><span> term;;</span></span>
<span class="giallo-l"><span style="color: #88846F;">(* Cleaned up: *)</span></span>
<span class="giallo-l"><span>(</span><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> nm1</span><span style="color: #66D9EF;font-style: italic;"> =</span><span style="color: #AE81FF;"> 2</span><span> in</span></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> y</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> nm1 in</span></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> nm2</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> y in</span></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> nm3</span><span style="color: #66D9EF;font-style: italic;"> =</span><span style="color: #AE81FF;"> 1</span><span> in</span></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> nm4</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> nm2</span><span style="color: #E6DB74;"> +</span><span> nm3 in</span></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> x</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> nm4 in</span></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> nm5</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> x in</span></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> nm6</span><span style="color: #66D9EF;font-style: italic;"> =</span><span style="color: #AE81FF;"> 3</span><span> in</span></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> nm7</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> nm5</span><span style="color: #E6DB74;"> +</span><span> nm6 in</span></span>
<span class="giallo-l"><span>Hole [·]</span></span>
<span class="giallo-l"><span>, "nm7"</span></span>
<span class="giallo-l"><span>, <empty reference></span></span>
<span class="giallo-l"><span>)</span></span></code></pre>
<p>We can then plug the returned hole, as described.
Via some inspection, we can verify this is indeed correct, and conforms to our ANF-like form, as expected.</p>
<p>As mentioned earlier, the large amount of duplicate names can be mitigated through strategies such as
special casing <code>let _ = <direct base></code> and folding passes.</p>
<h2 id="properties">Properties</h2>
<p>Clearly, the algorithm does not use closures, or any indirect jumps. It does not allocate any more than needed for the representation of
the output program; there is no excessive closure allocation. I do not currently have a good way to test performance on real-world large inputs,
but I have no reason to believe it would not perform better than an equivalent higher-order version.</p>
<h2 id="future-work">Future work</h2>
<p>I believe this method should be extendable to CPS as well, although I have not tried as of the moment. The "usual" higher-order CPS
conversion described in e.g. "Compiling with continuations, continued" looks quite similar to the higher-order presentation
of ANF conversion, so I would be interested in whether it can be similarly massaged into a mutable form.</p>
Type safe interpreters2026-01-17T00:00:00+00:002026-01-17T00:00:00+00:00
Blueberry Wren
https://blueberrywren.dev/blog/type-safe-interpreters/<p>It is well known that most software has bugs<sup><i>[Citation needed]</i></sup>.
It is also well known that interpreters are mostly software<sup class="footnote-reference" id="fr-1-1"><a href="#fn-1">1</a></sup>. One issue that one might
run into in an interpreter is <em>type safety</em>: It may very well be possible for your
typed language's interpreter to nevertheless end up in a state where it is asked
to evaluate <code>1 + "hi!"</code>. What can we do about that?</p>
<h2 id="gadts-generalized-adts">GADTs: Generalized ADTs<sup class="footnote-reference" id="fr-2-1"><a href="#fn-2">2</a></sup></h2>
<p>GADTs are a technique for increasing type safety in a program, by "indexing" a constructor by a type.
One of the canonical examples for this is an <code>Option</code>-like. Imagine we wanted a type-safe way to ensure
that in some cases, we could always extract the value inside. One way of doing this is to add an extra
type parameter, and use that to mark whether something is inside. We will use OCaml for this demonstration.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #88846F;">(* Dummy constructors; we are only using these for their types *)</span></span>
<span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> yes</span><span style="color: #66D9EF;font-style: italic;"> =</span><span style="color: #A6E22E;"> Yes</span></span>
<span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> no</span><span style="color: #66D9EF;font-style: italic;"> =</span><span style="color: #A6E22E;"> No</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">type</span><span> (</span><span style="color: #88846F;">_</span><span style="color: #E6DB74;">,</span><span style="color: #88846F;"> _</span><span>)</span><span style="color: #A6E22E;"> maybe</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #E6DB74;"> ^</span><span> regular "</span><span style="color: #A6E22E;">information</span><span> inside" </span><span style="color: #F92672;">type</span></span>
<span class="giallo-l"><span style="color: #E6DB74;"> ^</span><span style="color: #A6E22E;"> marker</span><span> of </span><span style="color: #A6E22E;">whether the information exists</span><span> </span></span>
<span class="giallo-l"><span style="color: #E6DB74;"> |</span><span> Nothing </span><span style="color: #E6DB74;">:</span><span> (no</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span>)</span><span style="color: #A6E22E;"> maybe</span></span>
<span class="giallo-l"><span style="color: #E6DB74;"> |</span><span> Just </span><span style="color: #E6DB74;">:</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span style="color: #E6DB74;"> -></span><span> (yes</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span>)</span><span style="color: #A6E22E;"> maybe</span></span></code></pre>
<p>Note that we have used a different syntax than usual. Normally, we put a type parameter in the constructor,
like <code>type 'a list</code>, and then use that throughout (<code>'a * 'a list</code>). However, as we are changing that type
in the "return" of the constructor, we need a syntax that allows us to change that. <code>_</code> marks a type parameter
we "don't need to name" (as we always specify it), and in this case, we always specify both. Then, we
add our elements before a <code>-></code>, mimicking a function. The general form of this in OCaml is <code>t1 * t2 * ... * tn -> t</code>.</p>
<p>Now, if we have something of type <code>(yes, 'a) maybe</code>, we know it contains a value! The only other way a <code>maybe</code> can be
formed is via <code>Nothing</code>, but that gives it type <code>(no, 'a) maybe</code>, so it'd be type-incorrect. This means we
can write a function like</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> get</span><span> (</span><span style="color: #FD971F;font-style: italic;">x</span><span style="color: #E6DB74;"> :</span><span> (yes</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span>)</span><span style="color: #A6E22E;"> maybe</span><span>)</span><span style="color: #E6DB74;"> -></span><span> 'a = </span></span>
<span class="giallo-l"><span> match x with</span></span>
<span class="giallo-l"><span> | Just a -> a</span></span></code></pre>
<p>and have it be total; there is no missing case, because the missing case is a type error. Note that when writing a
function like <code>or_else : (_, 'a) maybe -> 'a -> 'a</code>, we need to use this interesting piece of syntax:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> or_else</span><span style="color: #E6DB74;"> :</span><span style="color: #F92672;"> type</span><span style="color: #FD971F;font-style: italic;"> m</span><span style="color: #E6DB74;">.</span><span> (m</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span>)</span><span style="color: #A6E22E;"> maybe</span><span style="color: #E6DB74;"> -></span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span style="color: #E6DB74;"> -></span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span style="color: #66D9EF;font-style: italic;"> = fun</span><span style="color: #FD971F;font-style: italic;"> x def</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> </span></span>
<span class="giallo-l"><span style="color: #F92672;"> match</span><span> x</span><span style="color: #F92672;"> with</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Just</span><span style="color: #FD971F;font-style: italic;"> a</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> a</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Nothing</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> def</span></span></code></pre>
<p>This is as otherwise OCaml's normal type inference can get in our way and infer the wrong type, leading to a type error.<sup class="footnote-reference" id="fr-4-1"><a href="#fn-4">3</a></sup></p>
<h2 id="type-safe-interpreters">Type safe interpreters</h2>
<p>How does this allow us to get a more type-safe interpreter, though? Well, let's start by introducing our expression
type:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> _ expr</span><span style="color: #66D9EF;font-style: italic;"> =</span></span></code></pre>
<p>We've added space for a type parameter. What should integers and booleans look like? Maybe we should paramaterize our expressions
by the type they "evaluate to" - that way, when we have a <code>'a expr</code>, we know that it'll evaluate to something
of type <code>'a</code>. Hence:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> | Lit : int -> int expr</span></span>
<span class="giallo-l"><span> | Bool : bool -> bool expr</span></span></code></pre>
<p>Now, we want to add a case for <code>Add</code> and <code>Negate</code>. Naturally, we shouldn't be able to add two booleans, so let's restrict it
to only taking in <code>int expr</code>s, and similar for negate. We also know that these should return integers, too.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> | Add : int expr * int expr -> int expr</span></span>
<span class="giallo-l"><span> | Negate : int expr -> int expr</span></span></code></pre>
<p>We've already added type safety! It's impossible to write <code>Add (Bool true, Lit 5)</code>, because <code>Add</code> expects a <code>int expr</code>,
but <code>Bool true</code> is a <code>bool expr</code>. Let's keep going: <code><=</code> (or <code>Leq</code>) should take two integers and return a boolean,
and <code>If</code> should take a boolean as its first argument, but anything for its second and third.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> | Leq : int expr * int expr -> bool expr</span></span>
<span class="giallo-l"><span> | If : bool expr * 'a expr * 'a expr -> 'a expr</span></span></code></pre>
<p>Note that we can still use generic parameters, like <code>'a</code> here - we just need to think about when it makes sense to do so,
to get the type safety we want.</p>
<p>Now for functions. What should a function look like here? One way of implementing them is with a "Higher-order abstract syntax"(HOAS)<sup class="footnote-reference" id="fr-3-1"><a href="#fn-3">4</a></sup> approach,
where we use the functions of the host language to make functions in the interpreted language. In that case, we should
take a function as the argument to our constructor, but when what is our result type? That function type! We'll
need to know it later to safely write <code>Apply</code>, so we "store" it in the type now. We also want the function
to take and return an <code>_ expr</code>, so we can do constructions like <code>Lam (fun x -> Add(x,x))</code>.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> | Lam : ('a expr -> 'b expr) -> ('a expr -> 'b expr) expr</span></span></code></pre>
<p>Note that the function is not an <code>expr</code> at first, as otherwise we would have no way to construct it in the first
place. (Remember, this is how we make functions.)</p>
<p>Then <code>Apply</code>. It should take in a function, and a value, and then return the function applied to the value.
This hence translates as:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> | Apply : ('a expr -> 'b expr) expr * 'a expr-> 'b expr</span></span></code></pre>
<p>As a finale, we'll add pairs and projections. I won't elaborate on these, hoping that it's becoming obvious how
they work.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span> | Pair : 'a expr * 'b expr -> ('a * 'b) expr</span></span>
<span class="giallo-l"><span> | Fst : ('a * 'b) expr -> 'a expr</span></span>
<span class="giallo-l"><span> | Snd : ('a * 'b) expr -> 'b expr</span></span></code></pre><details><summary>All of the above in one code block</summary>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> _ expr</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Lit</span><span style="color: #E6DB74;"> :</span><span> int</span><span style="color: #E6DB74;"> -></span><span> int</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Bool</span><span style="color: #E6DB74;"> :</span><span> bool</span><span style="color: #E6DB74;"> -></span><span> bool</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Add</span><span style="color: #E6DB74;"> :</span><span> int</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> *</span><span> int</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span> int</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Negate</span><span style="color: #E6DB74;"> :</span><span> int</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span> int</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Leq</span><span style="color: #E6DB74;"> :</span><span> int</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> *</span><span> int</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span> bool</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> If</span><span style="color: #E6DB74;"> :</span><span> bool</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> *</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> *</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Lam</span><span style="color: #E6DB74;"> :</span><span> (</span><span style="color: #FD971F;font-style: italic;">'</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span style="color: #A6E22E;"> expr</span><span>)</span><span style="color: #E6DB74;"> -></span><span> (</span><span style="color: #FD971F;font-style: italic;">'</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span style="color: #A6E22E;"> expr</span><span>)</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Apply</span><span style="color: #E6DB74;"> :</span><span> (</span><span style="color: #FD971F;font-style: italic;">'</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span style="color: #A6E22E;"> expr</span><span>)</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> *</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Pair</span><span style="color: #E6DB74;"> :</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> *</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span> (</span><span style="color: #FD971F;font-style: italic;">'</span><span style="color: #F92672;">a</span><span style="color: #E6DB74;"> *</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span>)</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Fst</span><span style="color: #E6DB74;"> :</span><span> (</span><span style="color: #FD971F;font-style: italic;">'</span><span style="color: #F92672;">a</span><span style="color: #E6DB74;"> *</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span>)</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Snd</span><span style="color: #E6DB74;"> :</span><span> (</span><span style="color: #FD971F;font-style: italic;">'</span><span style="color: #F92672;">a</span><span style="color: #E6DB74;"> *</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span>)</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span style="color: #A6E22E;"> expr</span></span></code></pre></details>
<h2 id="examples">Examples</h2>
<p>Now let's look at some examples and their types.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>utop # Lit </span><span style="color: #AE81FF;">5</span><span>;;</span></span>
<span class="giallo-l"><span>- : int expr = Lit 5</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>utop # Bool true;;</span></span>
<span class="giallo-l"><span>- : bool expr = Bool true</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>utop # Add (Lit </span><span style="color: #AE81FF;">4</span><span>, Lit </span><span style="color: #AE81FF;">5</span><span>);;</span></span>
<span class="giallo-l"><span>- : int expr = Add (Lit 4, Lit 5)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>utop # Lam (fun f -> f);;</span></span>
<span class="giallo-l"><span>- : ('a expr -> 'a expr) expr = Lam <fun></span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>utop # Apply (Lam (fun x -> Add(x,x)), Lit 5);;</span></span>
<span class="giallo-l"><span>- : int expr = Apply (Lam <fun>, Lit 5)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>utop # Lam (fun b -> If (b, Lit </span><span style="color: #AE81FF;">5</span><span>, Lit </span><span style="color: #AE81FF;">6</span><span>));;</span></span>
<span class="giallo-l"><span>- : (bool expr -> int expr) expr = Lam <fun></span></span></code></pre>
<p>We have that a construction like <code>Lam (fun b -> If (b, b, Lit 6))</code> is not just an error, but a <em>type error</em>!
This means it's caught at compile time!</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>utop # Lam (fun b -> If (b, b, Lit </span><span style="color: #AE81FF;">6</span><span>));;</span></span>
<span class="giallo-l"><span> ^^^^^</span></span>
<span class="giallo-l"><span>Error: This constructor has </span><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> int expr</span></span>
<span class="giallo-l"><span style="color: #A6E22E;"> but an expression was expected</span><span> of </span><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> bool expr</span></span>
<span class="giallo-l"><span> Type </span><span style="color: #A6E22E;">int is not compatible</span><span> with </span><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> bool</span></span></code></pre><h2 id="the-actual-evaluator">The actual evaluator</h2>
<p>From here, the evaluator itself is very simple. We just write the interpretation of our language, as usual:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #E6DB74;"> rec</span><span style="color: #A6E22E;"> eval</span><span style="color: #E6DB74;"> :</span><span style="color: #F92672;"> type</span><span style="color: #FD971F;font-style: italic;"> t</span><span style="color: #E6DB74;">.</span><span> t</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span> t</span><span style="color: #66D9EF;font-style: italic;"> = fun</span><span style="color: #FD971F;font-style: italic;"> x</span><span style="color: #66D9EF;font-style: italic;"> -></span></span>
<span class="giallo-l"><span style="color: #F92672;"> match</span><span> x</span><span style="color: #F92672;"> with</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Lit</span><span style="color: #FD971F;font-style: italic;"> a</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> a</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Bool</span><span style="color: #FD971F;font-style: italic;"> b</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> b</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Add</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;">b</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> eval a</span><span style="color: #E6DB74;"> +</span><span> eval b</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Negate</span><span style="color: #FD971F;font-style: italic;"> a</span><span style="color: #66D9EF;font-style: italic;"> -></span><span style="color: #E6DB74;"> -</span><span> (eval a)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Leq</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;">b</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> (eval a)</span><span style="color: #E6DB74;"> <=</span><span> (eval b)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> If</span><span> (</span><span style="color: #FD971F;font-style: italic;">cond</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;">l</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;">r</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> (</span><span style="color: #F92672;">if</span><span> (eval cond)</span><span style="color: #F92672;"> then</span><span> (eval l)</span><span style="color: #F92672;"> else</span><span> (eval r))</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Lam</span><span style="color: #FD971F;font-style: italic;"> f</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> (</span><span style="color: #66D9EF;font-style: italic;">fun</span><span style="color: #FD971F;font-style: italic;"> x</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> f x)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Apply</span><span> (</span><span style="color: #FD971F;font-style: italic;">f</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;">x</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> eval ((eval f) x)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Pair</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;">b</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> (eval a</span><span style="color: #E6DB74;">,</span><span> eval b)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Fst</span><span style="color: #FD971F;font-style: italic;"> a</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> fst (eval a)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Snd</span><span style="color: #FD971F;font-style: italic;"> a</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> snd (eval a);;</span></span></code></pre>
<p>The <code>Lam</code> and <code>Apply</code> cases are interesting. In the former, we need to return a <em>function</em> of type <code>'a expr -> 'b expr</code>.
We can start by introducing a function <code>fun x -></code>, but we have <code>f : 'a expr -> 'b expr</code>, so we just apply it.
In the latter, we need to <code>eval f</code> to get a function <code>'a expr -> 'b expr</code> from <code>f</code>, which is of type
<code>('a expr -> 'b expr) expr</code>. We can then pass it <code>x</code>, which is of type <code>'a expr</code> to get a <code>'b expr</code>, which
we must then evaluate again to get a <code>'b</code>.</p>
<p>Now we can run the above examples.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>utop # eval (Lit </span><span style="color: #AE81FF;">5</span><span>);;</span></span>
<span class="giallo-l"><span>- : int = 5</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>utop # eval (Bool true);;</span></span>
<span class="giallo-l"><span>- : bool = true</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>utop # eval (Add (Lit </span><span style="color: #AE81FF;">4</span><span>, Lit </span><span style="color: #AE81FF;">5</span><span>));;</span></span>
<span class="giallo-l"><span>- : int = 9</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>utop # eval (Lam (fun f -> f));;</span></span>
<span class="giallo-l"><span>- : '_weak1 expr -> '_weak1 expr = <fun></span></span>
<span class="giallo-l"><span style="color: #88846F;">(* The `_weak1` is due to an internal OCaml limitation, called the "value restriction". *)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>utop # eval (Apply (Lam (fun x -> Add(x,x)), Lit 5));;</span></span>
<span class="giallo-l"><span>- : int = 10</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>utop # eval (Lam (fun b -> If (b, Lit </span><span style="color: #AE81FF;">5</span><span>, Lit </span><span style="color: #AE81FF;">6</span><span>)), Bool true);;</span></span>
<span class="giallo-l"><span>- : bool expr -> int expr = <fun></span></span>
<span class="giallo-l"><span style="color: #88846F;">(* Note that this gives us a function returning `int expr`. We'd need to either use `Apply`, like below,</span></span>
<span class="giallo-l"><span style="color: #88846F;"> or `eval` to get an `int` out of it.</span></span>
<span class="giallo-l"><span style="color: #88846F;">*)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>utop # eval (Apply (Lam (fun b -> If (b, Lit </span><span style="color: #AE81FF;">5</span><span>, Lit </span><span style="color: #AE81FF;">6</span><span>)), Bool true));;</span></span>
<span class="giallo-l"><span>- : int = 5</span></span></code></pre>
<p>Remember, all of the above is completely type safe! We have succesfully constructed an interpreter that can never
type error.</p>
<h2 id="how-do-you-apply-this">How do you apply this?</h2>
<p>In short, it can be hard. One way is to have a "base" language that's parsed, and then have your typechecker produce
a representation like the above that you then know is type correct. However, this does prevent typechecker bugs
from sneaking through, which was our entire goal!</p>
<p>To some extent, this is kicking the bucket down the road - you are now relying that your "host language"'s typechecker
is correct. However, this is a numbers game; if you're writing in OCaml or Haskell or similar, the chances of that
are very very high unless you're using extremely weird features.</p>
<h2 id="aside-denotional-semantics">Aside: Denotional semantics</h2>
<p>The astute may have noted that this is essentially a version of denotional semantics. We're interpreting into the
type-safe domain of the host language to ensure that the types always line up (as they must, for the interpretation
to succeed, and the typechecker of the host language ensures that).</p>
<h2 id="all-code">All code</h2>
<details><summary>All the code in one block, for pasting.</summary>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> _ expr</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Lit</span><span style="color: #E6DB74;"> :</span><span> int</span><span style="color: #E6DB74;"> -></span><span> int</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Bool</span><span style="color: #E6DB74;"> :</span><span> bool</span><span style="color: #E6DB74;"> -></span><span> bool</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Add</span><span style="color: #E6DB74;"> :</span><span> int</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> *</span><span> int</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span> int</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Negate</span><span style="color: #E6DB74;"> :</span><span> int</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span> int</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Leq</span><span style="color: #E6DB74;"> :</span><span> int</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> *</span><span> int</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span> bool</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> If</span><span style="color: #E6DB74;"> :</span><span> bool</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> *</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> *</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Lam</span><span style="color: #E6DB74;"> :</span><span> (</span><span style="color: #FD971F;font-style: italic;">'</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span style="color: #A6E22E;"> expr</span><span>)</span><span style="color: #E6DB74;"> -></span><span> (</span><span style="color: #FD971F;font-style: italic;">'</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span style="color: #A6E22E;"> expr</span><span>)</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Apply</span><span style="color: #E6DB74;"> :</span><span> (</span><span style="color: #FD971F;font-style: italic;">'</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span style="color: #A6E22E;"> expr</span><span>)</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> *</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Pair</span><span style="color: #E6DB74;"> :</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> *</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span> (</span><span style="color: #FD971F;font-style: italic;">'</span><span style="color: #F92672;">a</span><span style="color: #E6DB74;"> *</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span>)</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Fst</span><span style="color: #E6DB74;"> :</span><span> (</span><span style="color: #FD971F;font-style: italic;">'</span><span style="color: #F92672;">a</span><span style="color: #E6DB74;"> *</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span>)</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">a</span><span style="color: #A6E22E;"> expr</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Snd</span><span style="color: #E6DB74;"> :</span><span> (</span><span style="color: #FD971F;font-style: italic;">'</span><span style="color: #F92672;">a</span><span style="color: #E6DB74;"> *</span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span>)</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span style="color: #FD971F;font-style: italic;"> '</span><span style="color: #F92672;">b</span><span style="color: #A6E22E;"> expr</span><span>;;</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #E6DB74;"> rec</span><span style="color: #A6E22E;"> eval</span><span style="color: #E6DB74;"> :</span><span style="color: #F92672;"> type</span><span style="color: #FD971F;font-style: italic;"> t</span><span style="color: #E6DB74;">.</span><span> t</span><span style="color: #A6E22E;"> expr</span><span style="color: #E6DB74;"> -></span><span> t</span><span style="color: #66D9EF;font-style: italic;"> = fun</span><span style="color: #FD971F;font-style: italic;"> x</span><span style="color: #66D9EF;font-style: italic;"> -></span></span>
<span class="giallo-l"><span style="color: #F92672;"> match</span><span> x</span><span style="color: #F92672;"> with</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Lit</span><span style="color: #FD971F;font-style: italic;"> a</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> a</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Bool</span><span style="color: #FD971F;font-style: italic;"> b</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> b</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Add</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;">b</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> eval a</span><span style="color: #E6DB74;"> +</span><span> eval b</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Negate</span><span style="color: #FD971F;font-style: italic;"> a</span><span style="color: #66D9EF;font-style: italic;"> -></span><span style="color: #E6DB74;"> -</span><span> (eval a)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Leq</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;">b</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> (eval a)</span><span style="color: #E6DB74;"> <=</span><span> (eval b)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> If</span><span> (</span><span style="color: #FD971F;font-style: italic;">cond</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;">l</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;">r</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> (</span><span style="color: #F92672;">if</span><span> (eval cond)</span><span style="color: #F92672;"> then</span><span> (eval l)</span><span style="color: #F92672;"> else</span><span> (eval r))</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Lam</span><span style="color: #FD971F;font-style: italic;"> f</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> (</span><span style="color: #66D9EF;font-style: italic;">fun</span><span style="color: #FD971F;font-style: italic;"> x</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> f x)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Apply</span><span> (</span><span style="color: #FD971F;font-style: italic;">f</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;">x</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> eval ((eval f) x)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Pair</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;">b</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> (eval a</span><span style="color: #E6DB74;">,</span><span> eval b)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Fst</span><span style="color: #FD971F;font-style: italic;"> a</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> fst (eval a)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Snd</span><span style="color: #FD971F;font-style: italic;"> a</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> snd (eval a);;</span></span></code></pre></details>
<section class="footnotes">
<ol class="footnotes-list">
<li id="fn-1">
<p>No, I won't do the same joke twice. Most of the time. <a href="#fr-1-1">↩</a></p>
</li>
<li id="fn-2">
<p>I am not going into what "ADT" stands for, as it's a whole nother debate. <a href="#fr-2-1">↩</a></p>
</li>
<li id="fn-4">
<p>It may for example eagerly infer <code>(yes, 'a) maybe -> (yes, 'a) maybe</code>, which is a type error, as we also want to handle the <code>(no, 'a) maybe</code> <code>Nothing</code> case. <a href="#fr-4-1">↩</a></p>
</li>
<li id="fn-3">
<p>Higher-order abstract syntax. A bit too in-depth to explore in full right now, but worth exploring. <a href="#fr-3-1">↩</a></p>
</li>
</ol>
</section>
Axiom J in Homotopy Type Theory (HoTT)2026-01-01T00:00:00+00:002026-01-01T00:00:00+00:00
Blueberry Wren
https://blueberrywren.dev/blog/cubical-j/<h2 id="preface">Preface</h2>
<p>Happy new years!</p>
<h3 id="notation">Notation</h3>
<p><code>∀</code> may be used in place of a Pi-type in some cases. A nested <code>Π (a b : A). ...</code> (or sim. for <code>Σ</code>) represents <code>Π (a : A). Π (b : A). ...</code>.</p>
<h3 id="j">J</h3>
<p>Axiom J is the following:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>Given:</span></span>
<span class="giallo-l"><span>A : Type</span></span>
<span class="giallo-l"><span>x y : A</span></span>
<span class="giallo-l"><span>P : Π (a b : A). a = b -> Type</span></span>
<span class="giallo-l"><span>with</span></span>
<span class="giallo-l"><span>P x x refl</span></span>
<span class="giallo-l"><span>and</span></span>
<span class="giallo-l"><span>eq : x = y</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>we can conclude</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>P x y eq</span></span></code></pre>
<p>where <code>refl : ∀x. x = x</code>. In short, for any property <code>P</code>, if <code>P</code> is true for <code>x x refl</code>,
and we know that <code>eq : x = y</code>, then <code>P</code> is true for <code>x y eq</code>.</p>
<p>In a non-cubical context, this is obvious - the only proof of <code>x = y</code> for any <code>x</code> and <code>y</code> is <code>refl</code>, so it's close to a no-op. However, in HoTT, where there may
be many proofs of <code>x = y</code>, Axiom J is slightly less obvious. Why can we conclude that <code>P</code> is true for any path if we are only given that
it is true at <code>refl</code>?</p>
<h2 id="why">Why?</h2>
<p>First, let's curry <code>P</code>, turning the initial arguments from a Pi-type to a Sigma-type:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>P : Π (a b : A). a = b -> Type</span></span>
<span class="giallo-l"><span>==></span></span>
<span class="giallo-l"><span>P : (Σ(a : A). Σ(b : A). a = b) -> Type</span></span></code></pre>
<p>And rewrite the above accordingly.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>Given:</span></span>
<span class="giallo-l"><span>A : Type</span></span>
<span class="giallo-l"><span>x y : A</span></span>
<span class="giallo-l"><span>P : (Σ(a : A). Σ(b : A). a = b) -> Type</span></span>
<span class="giallo-l"><span>with</span></span>
<span class="giallo-l"><span>P (x, x, refl)</span></span>
<span class="giallo-l"><span>and</span></span>
<span class="giallo-l"><span>eq : x = y</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>we can conclude</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>P (x, y, eq)</span></span></code></pre>
<p>We will first apply the principle that if <code>a = b</code>, then <code>P a -> P b</code>, generally called something like <code>subst</code>itution. We can use <code>P (x, x, refl)</code> as our "<code>P a</code>". We then aim to show that:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>Given:</span></span>
<span class="giallo-l"><span>eq : x = y</span></span>
<span class="giallo-l"><span>then</span></span>
<span class="giallo-l"><span>(x, x, refl) = (x, y, eq)</span></span></code></pre>
<p>The first element is obvious - clearly <code>x = x</code>. Now we have to show that <code>(x, refl) = (y, eq)</code>.
This seems impossible! We do <em>not</em> have that <code>refl = eq</code>, due to the nature of HoTT.</p>
<p>Let's approach this by analysing the type of <code>(x, refl)</code> and <code>(y, eq)</code> (it's the same for both; otherwise the equality above wouldn't make sense).</p>
<p>Looking at the type of <code>P</code> above, we can conclude that</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>(x, refl) : Σ(b : A). x = b</span></span>
<span class="giallo-l"><span> ^ note the `x` here we got from </span></span>
<span class="giallo-l"><span> the first element of the tuple</span></span>
<span class="giallo-l"><span>and then necessarily</span></span>
<span class="giallo-l"><span>(y, eq) : Σ(b : A). x = b</span></span></code></pre>
<p>Now for the trick. While we do <em>not</em> have that <code>refl = eq</code>, we don't actually need it!
It turns out that we can prove that any element of <code>Σ(b : A). x = b</code> is equal to any other element of <code>Σ(b : A). x = b</code>, irregardless of
the proof of equality used - in other words, <code>Σ(b : A). x = b</code> only has one inhabitant. This property (only having one inhabitant) is called "contractibility".</p>
<p>A "proper" proof of this requires some careful thinking
(One can be found <a href="https://1lab.dev/1Lab.Path.html#34069">here as <code>Singleton-contract</code>, in Cubical Agda, courtesy of the 1lab</a>,
and it's Lemma 3.11.8 in the HoTT book, at time of writing.), but I'll give an informal one here.</p>
<p>Consider what <code>Σ(b : A). x = b</code> <em>means</em>. One way of interpreting it is like it's a subset - that
"<code>Σ(b : A). x = b</code> is the type of things that are elements of <code>A</code> equal to <code>x</code>".
However, there's only one of those! Namely, <code>x</code> itself. If we chose anything else, we wouldn't have <code>x = b</code> in the first place.
This means that our choice of equality doesn't matter at all - when we consider the tuple as a whole, there can only be one inhabitant.
Hence, as we already have that <code>x = y</code>, we have <code>(x, refl) = (x, eq) = (y, eq)</code>, completing our proof.</p>
<h2 id="tldr">TLDR</h2>
<ol>
<li></li>
</ol>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>J : Π (A : Type) </span></span>
<span class="giallo-l"><span> (x y : A)</span></span>
<span class="giallo-l"><span> (eq : x = y)</span></span>
<span class="giallo-l"><span> (P : Π(a b : A). x = y -> Type).</span></span>
<span class="giallo-l"><span> P x x refl </span></span>
<span class="giallo-l"><span> -> P x y eq</span></span>
<span class="giallo-l"><span>Goal : P x y eq</span></span></code></pre>
<ol start="2">
<li>Consider the equivalent "curried" version, so curry <code>P</code>:</li>
</ol>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>J : Π (A : Type) </span></span>
<span class="giallo-l"><span> (x y : A)</span></span>
<span class="giallo-l"><span> (eq : x = y)</span></span>
<span class="giallo-l"><span> (P : (Σ(a : A). Σ(b : A). a = b) -> Type).</span></span>
<span class="giallo-l"><span> P (x, x, refl)</span></span>
<span class="giallo-l"><span> -> P (x, y, eq)</span></span>
<span class="giallo-l"><span>Goal : P (x, y, eq)</span></span></code></pre>
<ol start="3">
<li>Use <code>subst : a = b -> P a -> P b</code>:</li>
</ol>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>Goal : (x, x, refl) = (x, y, eq)</span></span></code></pre>
<ol start="4">
<li>Use that <code>Π x a b. a = b -> (x, a) = (x, b)</code> (with <code>a = (x, refl)</code> and <code>b = (y, eq)</code>:</li>
</ol>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>Goal : (x, refl) = (y, eq)</span></span></code></pre>
<ol start="5">
<li>Use that <code>Σ(b : A). x = b</code> is contractible (<code>Π (one two : Σ(b : A). x = b)). one = two</code>):</li>
</ol>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>Done!</span></span></code></pre>
<p>A handwavy "proof term" may look like (ommitting some "obvious" arguments, as one may do with implicit arguments in Agda):</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>Given:</span></span>
<span class="giallo-l"><span>subst : Π P a b. a = b -> P a -> P b</span></span>
<span class="giallo-l"><span>subst-fst : Π x y p q. (x , p) = (x , q) -> x = y -> (x , p) = (y , q)</span></span>
<span class="giallo-l"><span>pair-snd-eq : Π x a b. a = b -> (x , a) = (x , b)</span></span>
<span class="giallo-l"><span>singleton-contractible : Π x (one two : Σ(b : A). x = b)). one = two</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>We have:</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>J : Π (A : Type) </span></span>
<span class="giallo-l"><span> (x y : A)</span></span>
<span class="giallo-l"><span> (eq : x = y)</span></span>
<span class="giallo-l"><span> (P : (Σ(a : A). Σ(b : A). a = b) -> Type).</span></span>
<span class="giallo-l"><span> P x x refl </span></span>
<span class="giallo-l"><span> -> P x y eq</span></span>
<span class="giallo-l"><span>J A x y eq P Pxxrefl = </span></span>
<span class="giallo-l"><span> subst (pair-snd-eq singleton-contractible) Pxxrefl</span></span></code></pre>Written in Pure Sea2025-12-19T00:00:00+00:002025-12-19T00:00:00+00:00
Blueberry Wren
https://blueberrywren.dev/blog/pure-sea/<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣴⣶⠾⠿⠿⠯⣷⣄⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀</span></span>
<span class="giallo-l"><span>⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣼⣾⠛⠁⠀⠀⠀⠀⠀⠀⠈⢻⣦⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀</span></span>
<span class="giallo-l"><span>⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣠⣾⠿⠁⠀⠀⠀⢀⣤⣾⣟⣛⣛⣶⣬⣿⣆⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀</span></span>
<span class="giallo-l"><span>⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⣾⠟⠃⠀⠀⠀⠀⠀⣾⣿⠟⠉⠉⠉⠉⠛⠿⠟⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀</span></span>
<span class="giallo-l"><span>⠀⠀⠀⠀⠀⠀⠀⠀⢀⣴⡟⠋⠀⠀⠀⠀⠀⠀⠀⣿⡏⣤⠀⠀__/\웃_⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀</span></span>
<span class="giallo-l"><span>⠀⠀⠀⠀⠀⠀⠀⣠⡿⠛⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⣷⡍⠀⠀\____/⠀⠀⠀⢀⣀⣀⣤⣤⣤⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀ </span></span>
<span class="giallo-l"><span>⠀⠀⠀⠀⠀⣠⣼⡏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠙⠷⣤⣤⣠⣤⣤⡤⡶⣶⢿⠟⠹⠿⠄⣿⣿⠏⠀⣀⣤⡦⠀⠀⠀⠀⣀⡄</span></span>
<span class="giallo-l"><span>⢀⣄⣠⣶⣿⠏⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠉⠓⠚⠋⠉⠀⠀⠀⠀⠀⠀⠈⠛⡛⡻⠿⠿⠙⠓⢒⣺⡿⠋⠁</span></span>
<span class="giallo-l"><span>⠉⠉⠉⠛⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠉⠉⠁⠀</span></span></code></pre>
<p>I don't have great C legs.</p>
Horrible answers to "What is a type?"2025-11-17T00:00:00+00:002025-11-17T00:00:00+00:00
Blueberry Wren
https://blueberrywren.dev/blog/horrible-types/<ul>
<li>A set.</li>
<li>Absolutely not a set.</li>
<li>An element of a category.</li>
<li>A proposition.</li>
<li>A chosen fixed point of a generating function.</li>
<li>The initial algebra/final coalgebra of a generating endofunctor over a reasonable base category (say, <code>Set</code>).</li>
<li>A metaphorical representation of bytes.</li>
<li>A membership function <code>UNIV → bool</code>.</li>
<li>That thing you put after the <code>:</code> to make the computer stop yelling at you :(</li>
<li><code>as any</code></li>
<li>Propaganda made up by Big Typechecker to make us complacent.</li>
<li>Nerd shit.</li>
<li>The archetype of person that you tend to feel attracted to romantically.</li>
<li>A metal plate with a glyph, used for printing ink onto paper.</li>
</ul>
Opinion piece: On Zig (and the design choices within)2025-10-14T00:00:00+00:002025-10-14T00:00:00+00:00
Blueberry Wren
https://blueberrywren.dev/blog/on-zig/<p>(From someone who has spent far too much time thinking about the designs of programming languages)</p>
<p>This post is split up into a few sections. I would also like to preface this post with:</p>
<ol>
<li>This is a little bit of a rant. I believe it presents some very reasonable points about Zig as a language, but it's not going to be
perfect or completely objective. It is an opinion piece, and you're free to ignore it if you want.</li>
<li>Existing memory safe languages are not perfect. Rust will be used as an example quite a bit, as from what is currently available, it embodies closer to what I think is reasonable in a programming language. However, there is still much room for improvement in this space.</li>
<li>All of the following is ultimately my opinion. If you disagree, you are welcome to find me somewhere on the internet and ask me more.</li>
<li>I bear no grudge or ill will against anyone who contributes to, works on, or is otherwise involved in the Zig community. The following are things I have noted about the language, not the people behind it. If you enjoy Zig, go and write it, and make cool stuff - I am not the programming language police.</li>
<li>Exception to the above: I have one gripe about the Zig community. This gripe "targets" no one person in particular; rather, larger trends.</li>
</ol>
<h2 id="ideological-differences">Ideological differences</h2>
<h3 id="memory">Memory</h3>
<p>First, and very much foremost, Zig is not memory safe. This is, in my opinion, the most
egregious thing in this post, by a very large margin. Moreso, Zig does not make any attempt to
be memory safe -
it can catch some things at runtime, with specific allocators, but so can C these days. Indeed, there
are some cases, like use-after-realloc, that <code>asan</code> can catch and Zig cannot.</p>
<p>A language in the modern day that does not make an attempt at memory safety is, in my opinion, not reasonable. It has been shown that in some areas, up to 70% of security bugs are due to memory safety issues (<a href="https://www.chromium.org/Home/chromium-security/memory-safety/">Source</a>).</p>
<p>I subscribe to the idea that the user must be constrained. It is perhaps harsh to say, but for large and complex programs, I believe that there are very few programmers who will write memory-correct code nine times out of ten. When writing code with others, that goes down. I personally do not believe I fit into that category.</p>
<p>The fact that Zig allows the user to write faulty software is supported by various somewhat informal, but still useful, statistics. Notably, the following statistic disregard duplicates, and unreported errors. However, general trends are still of note.</p>
<p>UPDATE: Someone has done a much more thorough analysis of crashes in JS runtimes! Thank you to the authors of the <a href="https://js-segfault-compare.sigmasd.workers.dev/">Javascript Runtime Segfault Tracker</a>, which demonstrates my point very effectively. To quote the person who sent me this: "it's a log scale. i'll let you guess which runtime is responsible for that."</p>
<p>For posterity, I leave my own analysis below:</p>
<details><summary>Here are some:</summary>
<ol>
<li>The Rust compiler has had a lifetime 59,780 issues reported. Of these, 4,158 contain one of "crash", "segmentation fault", or "segfault".</li>
<li>The Zig compiler has had a lifetime 13,269 issues reported. Of these, 2,260 contain one of "crash", "segmentation fault", or "segfault".</li>
</ol>
<p>This means that, roughly:</p>
<ol>
<li>7% of lifetime issues reported in the Rust compiler are crashes.</li>
<li>17% of lifetime issues reported in the Zig compiler are crashes.</li>
</ol>
<p>Not ideal.</p>
<ol>
<li>The Node/v8 JS runtime, written partially itself in JS and partially in C++, has had a lifetime 19,631 issues reported, 1,710 of which contain one of the above keywords.</li>
<li>The Deno JS runtime, written primarily in Rust, has had a lifetime 13,422 issues reported, 552 of which contain one of the above keywords.</li>
<li>The Bun JS runtime, written in Zig, has had a lifetime 13,828 issues reported, 3676 of which contain one of the above keywords.</li>
</ol>
<p>Again, this roughly means:</p>
<ol>
<li>8.7% of lifetime issues reported in Node are crashes.</li>
<li>4.1% of lifetime issues reported in Deno are crashes.</li>
<li>26.5% (!!!) of lifetime issues reported in Bun are crashes.</li>
</ol>
<p>Also not great. Again, these statistics are slightly off at best simply due to the nature of their collection, but the trends do not lie.</p>
</details>
<p>If you're not reading the above: It can be summarized as "Pretty bad."</p>
<h3 id="philosophy">Philosophy</h3>
<p>At one point, this part of the article contained a runthrough of the <code>zig zen</code>, and my opinions on each bullet point. I have decided that that is not a constructive discussion of Zig. It suffices for me to say that I do not believe Zig particularly embodies its own zen.</p>
<h2 id="practical">Practical</h2>
<h3 id="comptime">Comptime</h3>
<p>Zig does generics in an odd way. I believe this is the best way of putting it.
This post is not meant to be, nor will it contain, a proper explanation of Zig's <code>comptime</code>
capabilities, so I refer the reader to the wider internet there. However, doing generics
with "normal" code means that there are multiple ways to write the same generic function.
There is no standardization between different libraries, different styles of writing code, and
different users of Zig. Every person can do generics in their own special way.</p>
<p>This obviously has slightly dire effects on readability. In practice, most Zig users are reasonable enough
to stick to some "common patterns" of doing generics and similar, but it is widely known that if the user is giving the ability to do something, it will be done. I believe that generics are important enough they should be first class.</p>
<p>Arguments can be made that Zig's comptime is also useful for other things, not just generics. Some examples I have been given are conditional compilation, and variadic functions. Beyond these, I am yet to see a convincing motivating example that <em>requires</em> the machinery that Zig provides. Every such example can, in my experience, be solved with less powerful (and hence, for the most part, less confusing) machinery.</p>
<p>As a result, I am inclined to believe that Zig's comptime is a very large and all-encompassing feature that ultimately brings very little to the table that smaller features cannot.</p>
<p>I am personally a proponent of a good macro system, but I will readily admit people can also go overboard with one of those.</p>
<h3 id="casting">Casting</h3>
<p>Zig's casting is a bit cumbersome. To cast a float to a specific int width, for example, must be done with <code>@as(i32, @intFromFloat(flt))</code>. Bit of a mouthful. Inference can help here (For example if a variable is already known to be a <code>i32</code>, the outer cast is not needed), but I would think that with Zig's comptime abilities, this could be made a bit nicer. Luckily, it is common Zig practice to annotate everything if possible, so this does come up slightly less in practice. It is still a bit bulky however.</p>
<p>Float to int casting additionally can invoke undefined behavior if the float is outside the integer's range. I personally prefer truncating semantics, with perhaps a specialized method (<code>intFromFloatUnsafe</code>?) for UB semantics. That's more of a personal preference though.</p>
<h2 id="semantics">Semantics</h2>
<h3 id="result-location-semantics-rls">Result location semantics (RLS)</h3>
<p><a href="https://ziglang.org/documentation/0.15.1/#Result-Location-Semantics">See here</a>.</p>
<p>Result location semantics are in theory a quite nice idea. Knowing predictably where things are going to be placed in memory is, of course, good for any systems-adjacent language! In practice, there are several choices within RLS that I find counterintuitive. Take the following example, where we attempt to swap two struct members in place:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="rust"><span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">const</span><span> std</span><span style="color: #F92672;"> = @</span><span style="color: #A6E22E;">import</span><span>(</span><span style="color: #E6DB74;">"std"</span><span>);</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;">const</span><span style="color: #AE81FF;"> What</span><span style="color: #F92672;"> =</span><span style="color: #66D9EF;font-style: italic;"> struct</span><span> {</span></span>
<span class="giallo-l"><span> a</span><span style="color: #F92672;">:</span><span style="color: #000000;background-color: #FFFFFF;"> </span><span style="color: #A6E22E;text-decoration: underline;">i32</span><span>,</span></span>
<span class="giallo-l"><span> b</span><span style="color: #F92672;">:</span><span style="color: #000000;background-color: #FFFFFF;"> </span><span style="color: #A6E22E;text-decoration: underline;">i32</span><span>,</span></span>
<span class="giallo-l"><span>};</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">pub fn</span><span style="color: #A6E22E;"> main</span><span>() void {</span></span>
<span class="giallo-l"><span> var x</span><span style="color: #F92672;">:</span><span style="color: #000000;background-color: #FFFFFF;"> </span><span style="color: #A6E22E;text-decoration: underline;">What</span><span style="color: #F92672;"> = .</span><span>{</span><span style="color: #F92672;"> .</span><span>a </span><span style="color: #F92672;">=</span><span style="color: #AE81FF;"> 1</span><span>,</span><span style="color: #F92672;"> .</span><span>b </span><span style="color: #F92672;">=</span><span style="color: #AE81FF;"> 2</span><span> };</span></span>
<span class="giallo-l"><span> x</span><span style="color: #F92672;"> =</span><span style="color: #000000;background-color: #FFFFFF;"> </span><span style="color: #A6E22E;text-decoration: underline;">What</span><span> {</span><span style="color: #F92672;"> .</span><span>a </span><span style="color: #F92672;">=</span><span> x</span><span style="color: #F92672;">.</span><span>b,</span><span style="color: #F92672;"> .</span><span>b </span><span style="color: #F92672;">=</span><span> x</span><span style="color: #F92672;">.</span><span>a };</span></span>
<span class="giallo-l"><span> std</span><span style="color: #F92672;">.</span><span>log</span><span style="color: #F92672;">.</span><span style="color: #A6E22E;">info</span><span>(</span><span style="color: #E6DB74;">"x: {}"</span><span>,</span><span style="color: #F92672;"> .</span><span>{x});</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> var y</span><span style="color: #F92672;">:</span><span style="color: #000000;background-color: #FFFFFF;"> </span><span style="color: #A6E22E;text-decoration: underline;">What</span><span style="color: #F92672;"> = .</span><span>{</span><span style="color: #F92672;"> .</span><span>a </span><span style="color: #F92672;">=</span><span style="color: #AE81FF;"> 1</span><span>,</span><span style="color: #F92672;"> .</span><span>b </span><span style="color: #F92672;">=</span><span style="color: #AE81FF;"> 2</span><span> };</span></span>
<span class="giallo-l"><span> y</span><span style="color: #F92672;"> = .</span><span>{</span><span style="color: #F92672;"> .</span><span>a </span><span style="color: #F92672;">=</span><span> y</span><span style="color: #F92672;">.</span><span>b,</span><span style="color: #F92672;"> .</span><span>b </span><span style="color: #F92672;">=</span><span> y</span><span style="color: #F92672;">.</span><span>a };</span></span>
<span class="giallo-l"><span> std</span><span style="color: #F92672;">.</span><span>log</span><span style="color: #F92672;">.</span><span style="color: #A6E22E;">info</span><span>(</span><span style="color: #E6DB74;">"y: {}"</span><span>,</span><span style="color: #F92672;"> .</span><span>{y});</span></span>
<span class="giallo-l"><span>}</span></span></code></pre>
<p>This outputs the following:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="rust"><span class="giallo-l"><span>info</span><span style="color: #F92672;">:</span><span> x</span><span style="color: #F92672;">: .</span><span>{</span><span style="color: #F92672;"> .</span><span>a </span><span style="color: #F92672;">=</span><span style="color: #AE81FF;"> 2</span><span>,</span><span style="color: #F92672;"> .</span><span>b </span><span style="color: #F92672;">=</span><span style="color: #AE81FF;"> 1</span><span> }</span></span>
<span class="giallo-l"><span>info</span><span style="color: #F92672;">:</span><span> y</span><span style="color: #F92672;">: .</span><span>{</span><span style="color: #F92672;"> .</span><span>a </span><span style="color: #F92672;">=</span><span style="color: #AE81FF;"> 2</span><span>,</span><span style="color: #F92672;"> .</span><span>b </span><span style="color: #F92672;">=</span><span style="color: #AE81FF;"> 2</span><span> }</span></span></code></pre>
<p>I will note that the equivalent C can only be written in the former style, and it prints the former.</p>
<p>The only difference between the latter and the former is whether the type name is present. This is intended behavior! Indeed, this very example is given in the Zig reference, a fact that I find odd. Why give a warning against something when you could just fix it? Zig does not have move or copy constructors; I do not think there is very much reason for the latter to ever behave the way it does. One extra register is all you ever need, even for an arbitrary parallel move! (<a href="https://compiler.club/parallel-moves/">Source</a>.)</p>
<h3 id="pointer-reference-optimization">Pointer reference optimization</h3>
<p>In its previous form, PRO has been removed from Zig. There was a long period where this would print <code>5</code>:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="rust"><span class="giallo-l"><span style="color: #F92672;">const</span><span> std</span><span style="color: #F92672;"> = @</span><span style="color: #A6E22E;">import</span><span>(</span><span style="color: #E6DB74;">"std"</span><span>);</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;">const</span><span style="color: #AE81FF;"> AAAA</span><span style="color: #F92672;"> =</span><span style="color: #66D9EF;font-style: italic;"> struct</span><span> {</span></span>
<span class="giallo-l"><span> foo</span><span style="color: #F92672;">:</span><span> [</span><span style="color: #AE81FF;">100</span><span>]</span><span style="color: #A6E22E;text-decoration: underline;">u32</span><span>,</span></span>
<span class="giallo-l"><span>};</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">fn</span><span style="color: #A6E22E;"> kindabad</span><span>(a</span><span style="color: #F92672;">:</span><span style="color: #AE81FF;"> AAAA</span><span>, b</span><span style="color: #F92672;">: *</span><span style="color: #AE81FF;">AAAA</span><span>) void {</span></span>
<span class="giallo-l"><span> b</span><span style="color: #F92672;">.*.</span><span>foo[</span><span style="color: #AE81FF;">0</span><span>]</span><span style="color: #F92672;"> =</span><span style="color: #AE81FF;"> 5</span><span>;</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> std</span><span style="color: #F92672;">.</span><span>debug</span><span style="color: #F92672;">.</span><span style="color: #A6E22E;">print</span><span>(</span><span style="color: #E6DB74;">"unideal: {}"</span><span>,</span><span style="color: #F92672;"> .</span><span>{ a</span><span style="color: #F92672;">.</span><span>foo[</span><span style="color: #AE81FF;">0</span><span>] });</span></span>
<span class="giallo-l"><span>}</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">pub fn</span><span style="color: #A6E22E;"> main</span><span>()</span><span style="color: #F92672;"> !</span><span>void {</span></span>
<span class="giallo-l"><span> var f</span><span style="color: #F92672;">:</span><span style="color: #AE81FF;"> AAAA</span><span style="color: #F92672;"> =</span><span> undefined;</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> f</span><span style="color: #F92672;">.</span><span>foo[</span><span style="color: #AE81FF;">0</span><span>]</span><span style="color: #F92672;"> =</span><span style="color: #AE81FF;"> 0</span><span>;</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #A6E22E;"> kindabad</span><span>(f,</span><span style="color: #F92672;"> &</span><span>f);</span></span>
<span class="giallo-l"><span>}</span></span></code></pre>
<p>As Zig would correctly, per PRO at the time, but incorrectly per common sense, pass <code>a</code> as a reference.</p>
<p>This is actually mildly unfortunate. It's a very interesting optimization, and being able to guarantee behavior around optimization of parameter passing would also be quite beneficial. Unfortunately, Zig simply does not have the level of control needed to do it. Aliasing is freely allowed, and in order to make PRO work, it cannot be. Rust can, and in many cases does, do this! It's a shame Zig has to miss out.</p>
<p>There is current work to make PRO work in the case of pure functions (<a href="https://github.com/ziglang/zig/issues/5973#issuecomment-2380332493">Source</a>), so I remain hopeful that it will return in some form eventually.</p>
<h2 id="misc-improvable-things">Misc. Improvable things</h2>
<h3 id="speed">Speed</h3>
<p>The Zig compiler is not particularly fast. The LLVM backend even more so; compared to Clang, (which has the home field advantage, but can still be quite slow), and by my measurements, Clang is consistently between 3-10x faster. A new Zig backend has been written to help fix this; by similar measurements, it is consistently faster than Clang by 1.5-2x, and much faster than the Zig LLVM backend. While these numbers are nothing to scoff at, I believe there is more room for improvement, and I would like to see where it goes. Zig is a simpler language than C when comptime is not involved, and I would be excited to see that reflected in the benchmarks. It is also possible that Zig could use LLVM more efficiently, but I cannot comment on this without digging into the internals of the compiler.</p>
<p>Of course, all of this is quite reasonable. The Zig compiler has had far, far fewer man-hours put into it, and this of course reflects in aspects of the compiler that simply take a lot of time, such as these. I look forward to seeing what can be done in the future.</p>
<h3 id="tooling">Tooling</h3>
<h4 id="build-system">Build system</h4>
<p>The Zig build system is a little confusing. It is very neat to be able to write build system code in the language itself, and this is a feature I believe more languages should have. Unfortunately, it is as of current not well documented enough to justify its own complexity. This of course can be improved, and I hope it is.</p>
<h4 id="language-server">Language server</h4>
<p>Zig currently does not have a "first class" language server. The "Zig Language Server", or ZLS, is unofficial; It does not have real compiler integration, so it is unfortunately limited in some ways. The creator of Zig apparently does not use a language server while programming, so I do slightly understand why it is not a priority, but I personally believe tools like a good language server are quite essential to wider/popular usage. Here are some quotes I have heard from people who have used it far more than I:</p>
<ul>
<li>"Deeply horrid"</li>
<li>"It is one of the worst LSPs I have ever used"</li>
<li>"Don't get me started"</li>
</ul>
<p>Apparently it is very limited when <code>comptime</code> comes into play, and cannot handle compound types like 2D arrays.</p>
<p>I cannot offer much firsthand experience however.</p>
<h3 id="debug-mode">Debug mode</h3>
<p>There are always more errors to be caught. I particularly recently noticed that Zig cannot currently catch use-after-realloc errors, like the following:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="rust"><span class="giallo-l"><span style="color: #F92672;">const</span><span> std</span><span style="color: #F92672;"> = @</span><span style="color: #A6E22E;">import</span><span>(</span><span style="color: #E6DB74;">"std"</span><span>);</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">pub fn</span><span style="color: #A6E22E;"> main</span><span>()</span><span style="color: #F92672;"> !</span><span>void {</span></span>
<span class="giallo-l"><span style="color: #F92672;"> const</span><span> allocator</span><span style="color: #F92672;"> =</span><span> std</span><span style="color: #F92672;">.</span><span>heap</span><span style="color: #F92672;">.</span><span>page_allocator;</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> var buffer</span><span style="color: #F92672;"> = try</span><span> allocator</span><span style="color: #F92672;">.</span><span style="color: #A6E22E;">alloc</span><span>(</span><span style="color: #A6E22E;text-decoration: underline;">u8</span><span>,</span><span style="color: #AE81FF;"> 4</span><span>);</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> buffer[</span><span style="color: #AE81FF;">0</span><span>]</span><span style="color: #F92672;"> =</span><span style="color: #AE81FF;"> 1</span><span>;</span></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span style="color: #F92672;"> const</span><span> new_buffer</span><span style="color: #F92672;"> = try</span><span> allocator</span><span style="color: #F92672;">.</span><span style="color: #A6E22E;">realloc</span><span>(buffer,</span><span style="color: #AE81FF;"> 8</span><span>);</span></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span style="color: #88846F;"> // Should be caught!</span></span>
<span class="giallo-l"><span> buffer[</span><span style="color: #AE81FF;">0</span><span>]</span><span style="color: #F92672;"> =</span><span style="color: #AE81FF;"> 99</span><span>; </span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span> allocator</span><span style="color: #F92672;">.</span><span style="color: #A6E22E;">free</span><span>(new_buffer);</span></span>
<span class="giallo-l"><span>}</span></span></code></pre>
<p>Address sanitizer with Clang can catch this, so theoretically Zig should be able to catch it (perhaps with a similar system) too.</p>
<h2 id="misc-improvable-things-that-won-t-be-improved-for-reasons-beyond-me">Misc. Improvable things that won't be improved for reasons beyond me</h2>
<h3 id="behavior-around-undefined">Behavior around <code>undefined</code></h3>
<h4 id="debug-mode-1">Debug mode</h4>
<p>Apparently, it is desired that comparisons with <code>undefined</code> panic. This seems reasonable to me. However, the issue for this has been open <a href="https://github.com/ziglang/zig/issues/63">for almost ten years</a>, which makes me worry that it might be a while still until it is finished.</p>
<p>This panics in <code>Debug</code> and <code>ReleaseSafe</code> modes, however, so it does at least work in some cases.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="rust"><span class="giallo-l"><span style="color: #F92672;">pub fn</span><span style="color: #A6E22E;"> main</span><span>() void {</span></span>
<span class="giallo-l"><span style="color: #F92672;"> const</span><span> x</span><span style="color: #F92672;">:</span><span style="color: #000000;background-color: #FFFFFF;"> </span><span style="color: #A6E22E;text-decoration: underline;">u32</span><span style="color: #F92672;"> =</span><span> undefined;</span></span>
<span class="giallo-l"><span style="color: #F92672;"> if</span><span> (x</span><span style="color: #F92672;"> ==</span><span style="color: #AE81FF;"> 0</span><span>) {</span></span>
<span class="giallo-l"><span style="color: #F92672;"> return</span><span style="color: #AE81FF;"> 1</span><span>;</span></span>
<span class="giallo-l"><span> }</span><span style="color: #F92672;"> else</span><span> {</span></span>
<span class="giallo-l"><span style="color: #F92672;"> return</span><span style="color: #AE81FF;"> 0</span><span>;</span></span>
<span class="giallo-l"><span> }</span></span>
<span class="giallo-l"><span>}</span></span></code></pre><h4 id="safety">Safety</h4>
<p>According to <a href="https://github.com/ziglang/zig/issues/21915">this issue</a>, it is "not a goal of the Zig compiler" to catch issues like the following:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="rust"><span class="giallo-l"><span style="color: #F92672;">pub fn</span><span style="color: #A6E22E;"> main</span><span>() void {</span></span>
<span class="giallo-l"><span> var buf</span><span style="color: #F92672;">:</span><span> []</span><span style="color: #A6E22E;text-decoration: underline;">u8</span><span style="color: #F92672;"> =</span><span> undefined;</span></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span style="color: #88846F;"> // Very not allowed!</span></span>
<span class="giallo-l"><span> buf[</span><span style="color: #AE81FF;">0</span><span>]</span><span style="color: #F92672;"> =</span><span style="color: #AE81FF;"> 1</span><span>;</span></span>
<span class="giallo-l"><span>}</span></span></code></pre>
<p>This just seems silly to me. Catching something like this, in the simple case, should be just one pass over the AST; why not do it?</p>
<h3 id="tabs-and-syntax">Tabs and syntax</h3>
<p>Zig simply doesn't allow tabs in comments and strings? <a href="https://github.com/ziglang/zig-spec/issues/38">This issue</a> explains more, but the justification of "it (a tab) is ambiguous (in) how it should be rendered", I do not quite agree with.</p>
<p>Strings make some sense; you can still write <code>\t</code> for a tab, and they do indeed make output ambiguous. However, they're still allowed in indentation! This means that in commenting out code, you can take a program from valid to invalid. <code>zig fmt</code> does reify tabs into spaces, but if your editor is misconfigured and you're not running <code>zig fmt</code> constantly?</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>tabs.zig:5:36: error: comment contains invalid byte: '\t'</span></span>
<span class="giallo-l"><span>// const str: *const [1:0]u8 = "w";</span></span>
<span class="giallo-l"><span> ^~~~~~~~~~~</span></span></code></pre>
<p>Very odd.</p>
<p>Similarly, the following will not compile:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="c"><span class="giallo-l"><span style="color: #F92672;">if</span><span> (a </span><span style="color: #F92672;">>=</span><span>b) {</span></span>
<span class="giallo-l"><span> ...</span></span>
<span class="giallo-l"><span>}</span></span></code></pre>
<p>because the whitespace isn't correct. Zig doesn't have warnings, so this is always a compile error.</p>
<h3 id="iteration">Iteration</h3>
<p>Zig does not have a way to iterate through a slice or similar in any way except one-at-a-time forwards. Anything else? You're using a <code>while</code> loop, and you'll enjoy it. Zig blanket bans proposals to change the language, so despite issues like <a href="https://github.com/ziglang/zig/issues/21814">this one</a>, I doubt this will happen any time soon.</p>
<h3 id="warnings">Warnings</h3>
<p>Zig doesn't have 'em. Everything is an error. In practice, this mostly manifests through reasonably harmless things like "unused variable" notices becoming errors, which is reasonably annoying when just trying to spitball.</p>
<h2 id="my-only-note-on-the-community">My only note on the community</h2>
<p>For the most part, the community is about par for the course for programming language communities; that is to say, quite nice. However, I have had some reasonably negative interactions that I feel are somewhat of a general trend. They usually proceed like the following:</p>
<ol>
<li>I ask a question about solving something in Zig. Often, given my background, it is about adapting my more functional-esque thinking to Zig.</li>
<li>Someone chimes in with a half-solution that does not actually address my problem.</li>
<li>I attempt to communicate this to them, which often involves explaining the features I would use in <insert other language>.</li>
<li>They insist that these features are not needed, but do not elaborate on how one would solve the problem without them.</li>
</ol>
<p>This is unpleasant, and while it's not a particularly uncommon thing to see in programming language communities, Zig seems to have a bit of a bad case of it. I suspect it is due to Zig's fairly minimalistic nature; it lacks a lot of features that one would otherwise use to solve problems. Of course, this is the appeal for many, but still. It is made worse when said topic is something one is particularly knowledgeable about, and the people you are conversing with believe they can solve the issue without that knowledge.</p>
<p>I do not believe that a few bad apples necessarily spoil the whole barrel here, but they definitely sour it.</p>
<h2 id="summary">Summary</h2>
<p>I find Zig interesting, with an unfortunately negative connotation. I believe the goal of a C-like memory unsafe language "for the modern day", while interesting at first glance, ignores many of the issues that make C a problem in said modern day. Much of Zig seems to me like "wishful thinking"; if every programmer was 150% smarter and more capable, perhaps it would work. Alas, they are not; myself included.</p>
<p>I believe that modern concerns of memory safety and correctness require modern solutions; not performing patchwork fixes over the core issue.</p>
Isabelle/HOL: The various rule methods2025-09-19T00:00:00+00:002025-09-19T00:00:00+00:00
Blueberry Wren
https://blueberrywren.dev/blog/isabelle-rule-musings/<p>The following is adapted from the <a href="https://isabelle.in.tum.de/documentation.html">Isabelle/HOL 2025 tutorial</a>, particularly 5.2 and onwards. It will explain much more thoroughly than I can, so please use it as a source of truth.</p>
<p>I also make no promise that the following is entirely 100% correct. It is ultimately my understanding, but I have run it past several others, and to the best of our knowledge it is correct.</p>
<h1 id="notes">Notes</h1>
<p>These rule methods can be used in many different ways. While some general principles are mentioned below, if the prerequisits are met,
every rule can theoretically be used with every rule method. Many of these various combinations will not be beneficial to proving a given
goal, and hence it is useful to know how the rule methods interact with rules and proof states in order to select the correct pairing.</p>
<p>In that vein, the same rule will be interpreted differently by these different rule methods. Read more for how they work, and hence why.</p>
<h1 id="rule-erule-drule-and-frule-informally"><code>rule</code>, <code>erule</code>, <code>drule</code>, and <code>frule</code>, informally</h1>
<p>We use <code>P</code>, <code>Q</code>, and <code>R</code> as arbitrary assumptions and goals throughout.</p>
<h2 id="rule"><code>rule</code></h2>
<p>Consider the introduction rule <code>conjI</code>:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #AE81FF;">P Q</span></span>
<span class="giallo-l"><span style="color: #88846F;">----- conjI</span></span>
<span class="giallo-l"><span style="color: #AE81FF;">P</span><span style="color: #F92672;"> ∧</span><span style="color: #AE81FF;"> Q</span></span></code></pre>
<p>If we have a goal of form <code>R ==> P ∧ Q</code>, from <code>conjI</code> we can infer that it is sufficent to seperately prove <code>P</code> and <code>Q</code>. Indeed, performing <code>apply (rule conjI)</code> on a goal of this shape will result in two goals:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #AE81FF;">1</span><span style="color: #F92672;">.</span><span style="color: #AE81FF;"> R</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> P</span></span>
<span class="giallo-l"><span style="color: #AE81FF;">2</span><span style="color: #F92672;">.</span><span style="color: #AE81FF;"> R</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> Q</span></span></code></pre>
<p>which can be then proven seperately. <code>rule</code> is for backwards-reasoning; here we can see that as moving "backwards up" the introduction rule (Starting with the bottom, and ending with the top.) It is therefore useful for introduction rules, as demonstrated.</p>
<h2 id="erule"><code>erule</code></h2>
<p><code>erule</code> is designed to function with elimination rules. The <code>e</code> hence stands for <code>elimination</code>/<code>eliminator</code>. Take for example the elimination rule for disjunction:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #AE81FF;">P</span><span style="color: #F92672;"> ∨</span><span style="color: #AE81FF;"> Q</span><span> (</span><span style="color: #AE81FF;">P</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> R</span><span>) (</span><span style="color: #AE81FF;">Q</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> R</span><span>)</span></span>
<span class="giallo-l"><span style="color: #88846F;">-------------------------------- disjE</span></span>
<span class="giallo-l"><span style="color: #AE81FF;"> R</span></span></code></pre>
<p>(Informally, to prove something about a disjunction, we must handle both possible cases.)</p>
<p>If we have a goal of the form:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #AE81FF;">P</span><span style="color: #F92672;"> ∨</span><span style="color: #AE81FF;"> Q</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> R</span></span></code></pre>
<p>we can perform <code>apply (erule disjE)</code> to transform this into two goals:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #AE81FF;">1</span><span style="color: #F92672;">.</span><span style="color: #AE81FF;"> P</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> R</span></span>
<span class="giallo-l"><span style="color: #AE81FF;">2</span><span style="color: #F92672;">.</span><span style="color: #AE81FF;"> Q</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> R</span></span></code></pre>
<p>where we must handle each possible case of the disjunction. <code>erule</code> is a bit of both backwards and forwards reasoning. In the above elimination rule, we can see that we need three assumptions to prove <code>R</code> --- we already have <code>P ∨ Q</code>, so it is sufficient to then only additionally prove <code>P ==> R</code> and <code>Q ==> R</code>, which are exactly the goals <code>erule</code> gives us.</p>
<p>Notable: <code>erule</code> deletes the already-held assumption, as it is "rarely useful" (quoting the Isabelle/HOL tutorial). See below's note for more.</p>
<h2 id="note-on-rule-vs-erule">Note on <code>rule</code> vs <code>erule</code></h2>
<p>As mentioned, <code>erule</code> deliberately deletes the already-held assumptions when using an elimination rule. Above, we could see that <code>P ∨ Q</code> was not present in the generated goals, as it was already assumed. By instead using <code>rule</code>, we can keep the original goal in our assumptions as follows. If we apply the principles from the <code>rule</code> section to <code>disjE</code>, we would get:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #AE81FF;">P</span><span style="color: #F92672;"> ∨</span><span style="color: #AE81FF;"> Q</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> R</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>apply (rule disjE)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">⟦</span><span style="color: #AE81FF;"> P</span><span style="color: #F92672;"> ∨</span><span style="color: #AE81FF;"> Q</span><span style="color: #F92672;"> ⟧ ==></span><span style="color: #AE81FF;"> P</span><span style="color: #F92672;"> ∨</span><span style="color: #AE81FF;"> Q</span></span>
<span class="giallo-l"><span style="color: #F92672;">⟦</span><span style="color: #AE81FF;"> P</span><span style="color: #F92672;"> ∨</span><span style="color: #AE81FF;"> Q</span><span>; </span><span style="color: #AE81FF;">P</span><span style="color: #F92672;"> ⟧ ==></span><span style="color: #AE81FF;"> R</span></span>
<span class="giallo-l"><span style="color: #F92672;">⟦</span><span style="color: #AE81FF;"> P</span><span style="color: #F92672;"> ∨</span><span style="color: #AE81FF;"> Q</span><span>; </span><span style="color: #AE81FF;">Q</span><span style="color: #F92672;"> ⟧ ==></span><span style="color: #AE81FF;"> R</span></span></code></pre>
<p>i.e., <code>rule</code>, as expected, replaces the goal R with the goals sufficent to prove it. In this case, however, the first goal is trivial, and in the latter two, <code>P ∨ Q</code> holds little worth, as we know either <code>P</code> or <code>Q</code>. This is why <code>erule</code> automatically discharges the first goal and deletes the already-held assumption.</p>
<h2 id="drule"><code>drule</code></h2>
<p>For the sake of example, recall (one of) the conjunction elimination rules:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #AE81FF;">P</span><span style="color: #F92672;"> ∧</span><span style="color: #AE81FF;"> Q</span></span>
<span class="giallo-l"><span style="color: #88846F;">----- conjunct1</span></span>
<span class="giallo-l"><span style="color: #AE81FF;"> P</span></span></code></pre>
<p>This rule is more specifically called a "destruction" rule, as it takes apart (destroys) the original term (here the conjunction) and concludes with one of its subterms. The <code>d</code> in <code>drule</code> therefore stands for <code>destruction</code> or <code>destroy</code>. Destruction rules are used for forwards-reasoning, as you move "forwards down" the rule.</p>
<p><code>apply (drule conjunct1)</code> hence replaces an assumption of form <code>P ∧ Q</code> with one of <code>P</code>, deleting the original <code>P ∧ Q</code> assumption.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #AE81FF;">P</span><span style="color: #F92672;"> ∧</span><span style="color: #AE81FF;"> Q</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> R</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>apply (drule conjunct1)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #AE81FF;">P</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> R</span></span></code></pre><h2 id="frule"><code>frule</code></h2>
<p><code>frule</code> functions the same as <code>drule</code>, but does not delete the original premise. The <code>f</code> stands for <code>forwards</code>, as it is used for forwards-reasoning.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #AE81FF;">P</span><span style="color: #F92672;"> ∧</span><span style="color: #AE81FF;"> Q</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> R</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>apply (frule conjunct1)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">⟦</span><span style="color: #AE81FF;"> P</span><span style="color: #F92672;"> ∧</span><span style="color: #AE81FF;"> Q</span><span>; </span><span style="color: #AE81FF;">P</span><span style="color: #F92672;"> ⟧ ==></span><span style="color: #AE81FF;"> R</span></span></code></pre><h2 id="useful-related-tools">Useful related tools</h2>
<p>For all the above rule methods, <code>[of P₁ P₂ ... Pₙ]</code> can be used to explicitly instantiate them instead of using the <code>rule_tac</code> family (which is explained below). This instantiates left-to-right by occurence, so with</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span>thm conjI (</span><span style="color: #F92672;">* ⟦?</span><span style="color: #AE81FF;">P</span><span>; </span><span style="color: #F92672;">?</span><span style="color: #AE81FF;">Q</span><span style="color: #F92672;">⟧ ==> ?</span><span style="color: #AE81FF;">P</span><span style="color: #F92672;"> ∧ ?</span><span style="color: #AE81FF;">Q</span><span style="color: #F92672;"> *</span><span>)</span></span></code></pre>
<p><code>conjI [of A B]</code> will result in the instantiation <code>⟦A; B⟧ ==> A ∧ B</code>, from where the rule will proceed.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #AE81FF;">R</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> A</span><span style="color: #F92672;"> ∧</span><span style="color: #AE81FF;"> B</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #AE81FF;">Isabelle</span><span> can solve this on its own, but for the sake </span><span style="color: #F92672;">of</span><span> example</span><span style="color: #F92672;">.</span></span>
<span class="giallo-l"><span>apply (rule conjI [</span><span style="color: #F92672;">of</span><span style="color: #AE81FF;"> A B</span><span>])</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #AE81FF;">1</span><span style="color: #F92672;">.</span><span style="color: #AE81FF;"> R</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> A</span></span>
<span class="giallo-l"><span style="color: #AE81FF;">2</span><span style="color: #F92672;">.</span><span style="color: #AE81FF;"> R</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> B</span></span></code></pre>
<p>Notably, <code>[of ...]</code> does still work with the <code>_tac</code> family, but there is (as far as I know) no reason to use it over <code>_tac</code>'s explicit instantiation. Speaking of:</p>
<h2 id="the-tac-suffixes">The <code>_tac</code> suffixes</h2>
<p>For each of the above, there is a corresponding <code>_tac</code> (standing for tactic): <code>rule_tac</code>, <code>drule_tac</code>, etc. These <code>_tac</code>s are slightly more powerful than their <code>_tac</code>less equivalents. Firstly, each allows for the various premises to be explicitly instantiated by name. For example, with the <code>conjI</code> rule, one could explicitly write</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span>thm conjI (</span><span style="color: #F92672;">* ⟦?</span><span style="color: #AE81FF;">P</span><span>; </span><span style="color: #F92672;">?</span><span style="color: #AE81FF;">Q</span><span style="color: #F92672;">⟧ ==> ?</span><span style="color: #AE81FF;">P</span><span style="color: #F92672;"> ∧ ?</span><span style="color: #AE81FF;">Q</span><span style="color: #F92672;"> *</span><span>)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #AE81FF;">R</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> A</span><span style="color: #F92672;"> ⋀</span><span style="color: #AE81FF;"> B</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>apply (rule_tac </span><span style="color: #AE81FF;">P</span><span style="color: #F92672;">=</span><span style="color: #AE81FF;">A</span><span> and </span><span style="color: #AE81FF;">Q</span><span style="color: #F92672;">=</span><span style="color: #AE81FF;">B</span><span style="color: #F92672;"> in</span><span> conjI)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #AE81FF;">1</span><span style="color: #F92672;">.</span><span style="color: #AE81FF;"> R</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> A</span></span>
<span class="giallo-l"><span style="color: #AE81FF;">2</span><span style="color: #F92672;">.</span><span style="color: #AE81FF;"> R</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> B</span></span></code></pre>
<p>This allows the rule to refer to meta-forall-bound variables, which most commonly arise when performing induction or similar. For a goal of form:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #AE81FF;">P</span><span> n</span></span></code></pre>
<p>with some <code>n :: nat</code> mentioned in <code>P</code>, performing <code>apply (induction n)</code> will generate the goals</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #AE81FF;">P 0</span><span> </span></span>
<span class="giallo-l"><span style="color: #F92672;">⋀</span><span> nat</span><span style="color: #F92672;">.</span><span style="color: #AE81FF;"> P</span><span> nat </span><span style="color: #F92672;">==></span><span style="color: #AE81FF;"> P</span><span> (</span><span style="color: #AE81FF;">Suc</span><span> nat) (</span><span style="color: #F92672;">*</span><span style="color: #AE81FF;"> Variable</span><span> naming may differ</span><span style="color: #F92672;">. *</span><span>)</span></span></code></pre>
<p><code>nat</code> is a meta-forall bound variable. This functions as expected; during the induction step of an inductive proof, we must prove that for any <code>nat</code>, <code>P nat ==> P (Suc nat)</code>. Because it is meta-forall bound, <code>rule</code> and friends cannot refer to <code>nat</code> directly using <code>[of ...]</code> (Although, automatic unification can work). Instead, we must use <code>rule_tac</code> and friends to refer to it. I am not quite sure why this is, but I presume it is due to internal complexities around the meta-forall.</p>
<details><summary>A small artificial example of this difference, if the above is not clear.</summary>
<p>Recall that <code>[of ...]</code> can be used to explicitly instantiate:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span>lemma without_forall</span><span style="color: #F92672;">:</span><span style="color: #E6DB74;"> "A ∧ B ==> A"</span></span>
<span class="giallo-l"><span> apply (erule conjE [</span><span style="color: #F92672;">of</span><span style="color: #AE81FF;"> A</span><span>]) (</span><span style="color: #F92672;">*</span><span> succeeds </span><span style="color: #F92672;">*</span><span>)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>lemma with_forall</span><span style="color: #F92672;">:</span><span style="color: #E6DB74;"> "⋀ a b. a ∧ b ==> a"</span></span>
<span class="giallo-l"><span> apply (erule conjE [</span><span style="color: #F92672;">of</span><span> a]) (</span><span style="color: #F92672;">*</span><span> fails </span><span style="color: #F92672;">*</span><span>)</span></span>
<span class="giallo-l"><span> apply (erule_tac </span><span style="color: #AE81FF;">P</span><span style="color: #F92672;">=</span><span>a </span><span style="color: #F92672;">in</span><span> conjE) (</span><span style="color: #F92672;">*</span><span> succeeds </span><span style="color: #F92672;">*</span><span>)</span></span></code></pre>
<p>These lemmas are otherwise equivalent; only their presentation differs.</p>
</details>
<p>In general, these <code>_tac</code> methods have the form</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span>rule_tac v₁ </span><span style="color: #F92672;">=</span><span> t₁ and v₂ </span><span style="color: #F92672;">=</span><span> t₂ and </span><span style="color: #F92672;">...</span><span> and vₙ </span><span style="color: #F92672;">=</span><span> tₙ </span><span style="color: #F92672;">in</span><span style="color: #AE81FF;"> RULE</span></span></code></pre>
<p>where <code>vₙ</code> is a variable occuring in <code>RULE</code>, and <code>tₙ</code> is a locally bound variable or assumption. Any combination of zero or more of the variables occuring in <code>RULE</code> may be used, in any order.</p>
<p>The <code>_tac</code> methods have an additional advantage, which is that they can be told to refer to a specific goal. If we have goals of the form</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #AE81FF;">1</span><span style="color: #F92672;">.</span><span style="color: #AE81FF;"> A</span><span style="color: #F92672;"> ∧</span><span style="color: #AE81FF;"> B</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> R</span></span>
<span class="giallo-l"><span style="color: #AE81FF;">2</span><span style="color: #F92672;">.</span><span style="color: #AE81FF;"> P</span><span style="color: #F92672;"> ∧</span><span style="color: #AE81FF;"> Q</span><span style="color: #F92672;"> ==></span><span style="color: #AE81FF;"> R</span></span></code></pre>
<p><code>erule conjE</code> and friends will by default refer to the first goal. Using <code>erule_tac [i] conjE</code>, we can refer to the <code>ith</code> goal (1-indexed.) When combining this with specifying variables, the goal specifier comes first. (i.e., <code>apply (erule_tac [1] P=a in conjE)</code>.)</p>
<h1 id="rule-erule-drule-and-frule-more-formally"><code>rule</code>, <code>erule</code>, <code>drule</code>, and <code>frule</code>, (more) formally</h1>
<p>This section is almost entirely copied from the aformentioned Isabelle/HOL tutorial.</p>
<p>Given an arbitrary rule R of the form:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #AE81FF;">P</span><span>₁ </span><span style="color: #AE81FF;">P</span><span>₂ </span><span style="color: #F92672;">...</span><span> Pₙ</span></span>
<span class="giallo-l"><span style="color: #88846F;">------------ R</span></span>
<span class="giallo-l"><span style="color: #AE81FF;"> Q</span></span></code></pre>
<p>For elimination rules, <code>P₁</code> is referred to as the "Major premise". This will usually be the object being eliminated. In <code>disjE</code> for example, it is <code>P ∨ Q</code>.</p>
<ol>
<li>
<p>Method <code>rule</code> unifies <code>Q</code> with the current subgoal, and replaces it with the <code>n</code> subgoals <code>P₁ ... Pₙ</code>.</p>
</li>
<li>
<p>Method <code>erule</code> unifies <code>Q</code> with the current subgoal, and <code>P₁</code> with the first suitable assumption. The subgoal is then replaced with the <code>n - 1</code> subgoals <code>P₂ ... Pₙ</code>, and the assumption <code>P₁</code> is deleted.</p>
</li>
<li>
<p>Method <code>drule</code> unifies <code>P₁</code> with the first suitable assumption, which it then deletes. It then adds the <code>n - 1</code> subgoals <code>P₂ ... Pₙ</code>, and the original subgoal gains the assumption <code>Q</code>.</p>
</li>
<li>
<p>Method <code>frule</code> is like <code>drule</code>, but it does not delete <code>P₁</code>.</p>
</li>
</ol>
Crafting a dependent typechecker, part 12025-07-19T00:00:00+00:002025-07-19T00:00:00+00:00
Blueberry Wren
https://blueberrywren.dev/blog/dependent-p1/<p>This series is intended to give an interested layperson some idea of what goes on behind-the-scenes in a dependent typechecker, and how they might implement one of their own.</p>
<p>I personally hold the belief that dependent languages (or similar) will eventually be the future of programming, so knowing this information seems worthwhile to me. One may also simply be interested for the sake of it, or may be interested in implementing their own dependent language.</p>
<p>This series does assume a small base amount of knowledge around dependent programming languages. There are many tutorials out there far better than I could provide, so I will refer the reader to the wider internet if they are curious. (Return here afterwards, though!).</p>
<p>Additionally, the code snippets will be in OCaml, although a Haskell or Rust version may be made available at a later date.</p>
<p>The technique we will implement in this series can most succinctly be described as "Bidirectional typechecking, utilizing Normalization by Evaluation". I do not expect the reader to understand that sentence for at least a little while ;).</p>
<p>All code snippets will be collated at the end of each page, so scroll all the way down if you're only interested in that.</p>
<h2 id="resources">Resources</h2>
<p>The following are resources I highly recommend for exploring this topic on your own.</p>
<ul>
<li>András Kovacs' "Elaboration Zoo", <a href="https://github.com/AndrasKovacs/elaboration-zoo">found here</a>. It was a primary source of inspiration for this series.</li>
<li>"A tutorial implementation of a dependently typed lambda calculus", by Andres Löh, Conor McBride, and Wouter Swierstra; <a href="https://www.andres-loeh.de/LambdaPi/LambdaPi.pdf">found here</a>.</li>
<li>"Checking Dependent Types with Normalization by Evaluation: A Tutorial", by David Christiansen, <a href="https://davidchristiansen.dk/tutorials/nbe/">found here</a>, for the more lisp-minded.</li>
</ul>
<h2 id="the-fundamental-operation-of-typechecking">The fundamental operation of typechecking</h2>
<p>If you have implemented a typechecker before, you may have come to the realization that deciding when two things are the same is a very large component of typechecking. Whether it be simply checking that two arguments to <code>+</code> are both integers, or larger problems with polymorphism, the arguable core of typechecking is deciding equality.</p>
<p>In a dependent language, our types can (and often do) contain expressions that must be evaluated. Therefore, in order to explore how we check equality in the presence of evaluation, we will first start by considering how we do this for a very simple language - integer arithmetic. Take two expressions:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="javascript"><span class="giallo-l"><span style="color: #AE81FF;">1</span><span>: </span><span style="color: #AE81FF;">17</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 2</span><span style="color: #F92672;"> +</span><span style="color: #AE81FF;"> 4</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 2</span></span>
<span class="giallo-l"><span style="color: #AE81FF;">2</span><span>: </span><span style="color: #AE81FF;">7</span><span style="color: #F92672;">^</span><span style="color: #AE81FF;">2</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 4</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 4</span><span style="color: #F92672;"> +</span><span style="color: #AE81FF;"> 3</span></span></code></pre>
<p>How might we decide whether these are equal? The obvious solution is to evaluate them. Indeed, (sparing the reader the derivation), we can see they both evaluate to <code>36</code>, and so they are equal.</p>
<p>Let us now introduce a small extension: Variables with a known value, using "let". We will refer to the variables themselves as "bound variables", as they are bound by the "let". In this case, they are additionally bound to a value. Terms containing only bound variables are referred to "closed" terms - this alludes to, for example, closed and open systems in the real world. Getting back to evaluation, we could simply substitute the computed value:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="javascript"><span class="giallo-l"><span style="color: #66D9EF;font-style: italic;">let</span><span> x</span><span style="color: #F92672;"> =</span><span style="color: #AE81FF;"> 8</span><span style="color: #F92672;">^</span><span style="color: #AE81FF;">2</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 3</span><span>;</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #AE81FF;">1</span><span>: x</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 2</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 5</span></span>
<span class="giallo-l"><span style="color: #AE81FF;">2</span><span>: </span><span style="color: #AE81FF;">13</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 39</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>substitute</span><span style="color: #F92672;">...</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #AE81FF;">1</span><span>: (</span><span style="color: #AE81FF;">8</span><span style="color: #F92672;">^</span><span style="color: #AE81FF;">2</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 3</span><span>)</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 2</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 5</span></span>
<span class="giallo-l"><span style="color: #AE81FF;">2</span><span>: </span><span style="color: #AE81FF;">13</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 39</span></span></code></pre>
<p>And then evaluate. (In this case, our result is 117.) However, what if the variable occurs multiple times? The following is a little bad, but not awful:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="javascript"><span class="giallo-l"><span style="color: #66D9EF;font-style: italic;">let</span><span> x</span><span style="color: #F92672;"> =</span><span style="color: #AE81FF;"> 8</span><span style="color: #F92672;">^</span><span style="color: #AE81FF;">2</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 3</span><span>;</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #AE81FF;">1</span><span>: x</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 2</span><span style="color: #F92672;"> -</span><span> x</span><span style="color: #F92672;">^</span><span style="color: #AE81FF;">2</span><span style="color: #F92672;"> +</span><span style="color: #AE81FF;"> 5</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>substitute</span><span style="color: #F92672;">...</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #AE81FF;">1</span><span>: (</span><span style="color: #AE81FF;">8</span><span style="color: #F92672;">^</span><span style="color: #AE81FF;">2</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 3</span><span>)</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 2</span><span style="color: #F92672;"> -</span><span> (</span><span style="color: #AE81FF;">8</span><span style="color: #F92672;">^</span><span style="color: #AE81FF;">2</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 3</span><span>)</span><span style="color: #F92672;">^</span><span style="color: #AE81FF;">2</span><span style="color: #F92672;"> +</span><span style="color: #AE81FF;"> 5</span></span></code></pre>
<p>But what if <code>x</code> was the following?</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="javascript"><span class="giallo-l"><span style="color: #66D9EF;font-style: italic;">let</span><span> x</span><span style="color: #F92672;"> =</span><span style="color: #AE81FF;"> 8</span><span style="color: #F92672;"> ^</span><span style="color: #AE81FF;"> 2</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 3</span><span style="color: #F92672;"> +</span><span> (</span><span style="color: #AE81FF;">14</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 2</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 4</span><span>)</span><span style="color: #F92672;"> +</span><span style="color: #AE81FF;"> 8</span><span style="color: #F92672;"> -</span><span> (</span><span style="color: #AE81FF;">14</span><span style="color: #F92672;"> ^</span><span style="color: #AE81FF;"> 2</span><span>)</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 3</span><span style="color: #F92672;"> +</span><span style="color: #AE81FF;"> 5</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 5</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 18</span><span style="color: #F92672;"> ^</span><span style="color: #AE81FF;"> 3</span><span style="color: #F92672;"> +</span><span style="color: #AE81FF;"> 5</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 6</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 12</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 4</span><span style="color: #F92672;"> *</span><span> (</span><span style="color: #AE81FF;">6</span><span style="color: #F92672;"> ^</span><span style="color: #AE81FF;"> 2</span><span>)</span><span style="color: #F92672;"> +</span><span> (</span><span style="color: #AE81FF;">8</span><span style="color: #F92672;">^</span><span style="color: #AE81FF;">2</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 3</span><span>)</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 2</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 18</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 14</span><span style="color: #F92672;"> ^</span><span style="color: #AE81FF;"> 3</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 2</span><span style="color: #F92672;"> *</span><span> (</span><span style="color: #AE81FF;">4</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 3</span><span style="color: #F92672;"> ^</span><span style="color: #AE81FF;"> 2</span><span>)</span><span style="color: #F92672;"> +</span><span style="color: #AE81FF;"> 12</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 18</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 3</span><span style="color: #F92672;">^</span><span style="color: #AE81FF;">4</span><span style="color: #F92672;"> +</span><span style="color: #AE81FF;"> 1</span></span></code></pre>
<p>Duplicating that would clearly not be ideal!</p>
<p>Perhaps we could compute <code>x</code> in advance, and then substitute that result in. This is much better:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="javascript"><span class="giallo-l"><span style="color: #66D9EF;font-style: italic;">let</span><span> x</span><span style="color: #F92672;"> =</span><span style="color: #AE81FF;"> 8</span><span style="color: #F92672;">^</span><span style="color: #AE81FF;">2</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 3</span><span>;</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>evaluate and substitute</span><span style="color: #F92672;">...</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;">let</span><span> x</span><span style="color: #F92672;"> =</span><span style="color: #AE81FF;"> 61</span><span>;</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #AE81FF;">1</span><span>: </span><span style="color: #AE81FF;">61</span><span style="color: #F92672;"> *</span><span style="color: #AE81FF;"> 2</span><span style="color: #F92672;"> -</span><span style="color: #AE81FF;"> 61</span><span style="color: #F92672;">^</span><span style="color: #AE81FF;">2</span><span style="color: #F92672;"> +</span><span style="color: #AE81FF;"> 5</span></span></code></pre>
<p>(In fact, there is yet another optimization to do: What if we don't need to compute it at all, say because it's not used? We will explore this possibility later.)</p>
<p>A simple OCaml interpretation of the terms of this language may be the following.
(sidetrack: A "term" is some element of a language. Above, we have the language of (restricted) integer arithmetic, and our terms are expressions of said. Hence, we call our OCaml interpretation of this language <code>term</code>.)</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> variable</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> string</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> term</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Literal</span><span> of int </span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Name</span><span> of variable </span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Mul</span><span> of term</span><span style="color: #E6DB74;"> *</span><span> term </span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Exp</span><span> of term</span><span style="color: #E6DB74;"> *</span><span> term </span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Add</span><span> of term</span><span style="color: #E6DB74;"> *</span><span> term </span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Sub</span><span> of term</span><span style="color: #E6DB74;"> *</span><span> term </span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Let</span><span> of variable</span><span style="color: #E6DB74;"> *</span><span> term</span><span style="color: #E6DB74;"> *</span><span> term </span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* let x = ...; ... *)</span></span></code></pre>
<p>We then must make an environment that associates, or "binds", our names to terms. <code>Let</code> is often called a "binder" because it functions as the source of this binding. We will make our context a list of pairs <code>(variable name, term)</code>, and will reimpliement the lookup function for example's sake, although a suitable function is available as <code>List.assoc</code>.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> environment</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> (variable</span><span style="color: #E6DB74;"> *</span><span> term)</span><span style="color: #A6E22E;"> list</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #E6DB74;"> rec</span><span style="color: #A6E22E;"> lookup</span><span> (</span><span style="color: #FD971F;font-style: italic;">env</span><span style="color: #E6DB74;"> :</span><span> environment) (</span><span style="color: #FD971F;font-style: italic;">name</span><span style="color: #E6DB74;"> :</span><span> variable)</span><span style="color: #E6DB74;"> :</span><span> term</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #F92672;"> match</span><span> env</span><span style="color: #F92672;"> with</span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* See note below. *)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> []</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> failwith (</span><span style="color: #E6DB74;">"Variable " ^</span><span> name</span><span style="color: #E6DB74;"> ^ " not found."</span><span>)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span> (</span><span style="color: #FD971F;font-style: italic;">nm</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> value</span><span>)</span><span style="color: #E6DB74;"> ::</span><span style="color: #FD971F;font-style: italic;"> rest</span><span style="color: #66D9EF;font-style: italic;"> -></span></span>
<span class="giallo-l"><span style="color: #F92672;"> if</span><span> nm</span><span style="color: #E6DB74;"> =</span><span> name</span><span style="color: #F92672;"> then</span></span>
<span class="giallo-l"><span> value</span></span>
<span class="giallo-l"><span style="color: #F92672;"> else</span></span>
<span class="giallo-l"><span> lookup rest name</span></span></code></pre>
<p>Note: In this series, we will not be considering the possibility that a name is used without being previously defined in some way. This is an error, and can be handled via normal means, e.g. a suitable error message.</p>
<p>We now note something curious: Our lookup function need not return a fully computed value! It could return <code>7 + 2</code>, which we would have to further evaluate before we could do anything with. It would be possible of course to manually insert invariants ensuring that this is not the case, but we could still accidentally violate them.</p>
<p>Here we hit one of the most important distinctions in our exploration of dependent typechecking.</p>
<h2 id="terms-vs-values">Terms vs. Values</h2>
<p>A "term", as previously seen, is any element of a chosen language. Above, this was (some subset of) integer arithmetic. We could also consider the language of OCaml programs, of which the above examples would be terms. However, two terms are not always easy to compare. We may need to evaluate one, or both, and we don't know whether that will be needed until we start comparing them.</p>
<p>Instead, what if we defined another type that was guaranteed to be reduced to some suitable level? For this simple case, we could restrict this to contain only fully evaluated terms (i.e., integers). We'll call these "values".</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> value</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> VLiteral</span><span> of int</span></span></code></pre>
<p>We prefix these constructors with <code>V</code> to ensure they're distinct, and to remind us that they construct values. Then, we could modify our environment and lookup function to only deal with values:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span>- </span><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> environment</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> (variable</span><span style="color: #E6DB74;"> *</span><span> term)</span><span style="color: #A6E22E;"> list</span></span>
<span class="giallo-l"><span style="color: #E6DB74;">+</span><span style="color: #F92672;"> type</span><span style="color: #A6E22E;"> environment</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> (variable</span><span style="color: #E6DB74;"> *</span><span> value)</span><span style="color: #A6E22E;"> list</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #E6DB74;">-</span><span style="color: #F92672;"> let</span><span style="color: #E6DB74;"> rec</span><span style="color: #A6E22E;"> lookup</span><span> (</span><span style="color: #FD971F;font-style: italic;">env</span><span style="color: #E6DB74;"> :</span><span> environment) (</span><span style="color: #FD971F;font-style: italic;">name</span><span style="color: #E6DB74;"> :</span><span> variable)</span><span style="color: #E6DB74;"> :</span><span> term</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #E6DB74;">+</span><span style="color: #F92672;"> let</span><span style="color: #E6DB74;"> rec</span><span style="color: #A6E22E;"> lookup</span><span> (</span><span style="color: #FD971F;font-style: italic;">env</span><span style="color: #E6DB74;"> :</span><span> environment) (</span><span style="color: #FD971F;font-style: italic;">name</span><span style="color: #E6DB74;"> :</span><span> variable)</span><span style="color: #E6DB74;"> :</span><span> value</span><span style="color: #66D9EF;font-style: italic;"> =</span></span></code></pre>
<p>and now we know that <code>lookup</code> will always return something we can handle immediately, with no further processing.</p>
<p>In the general case, we call this "suitably-reduced" constraint a "normal form". We can say that <code>value</code> contains only elements of <code>term</code> in this chosen normal form.</p>
<p>Now we can finish our little evaluator. We do a slight hack to perform arithmetic inside values; if our value type contained more than just the constructor <code>VLiteral</code>, we would have to consider how to handle that case. This is something we will cover soon.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #88846F;">(* OCaml does not have integer exponentiation by default. Definition omitted. *)</span></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> pow</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;"> :</span><span> int) (</span><span style="color: #FD971F;font-style: italic;">b</span><span style="color: #E6DB74;"> :</span><span> int)</span><span style="color: #E6DB74;"> :</span><span> int</span><span style="color: #66D9EF;font-style: italic;"> =</span><span style="color: #E6DB74;"> ...</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #E6DB74;"> rec</span><span style="color: #A6E22E;"> do_op</span><span> (</span><span style="color: #FD971F;font-style: italic;">op</span><span style="color: #E6DB74;"> :</span><span> int</span><span style="color: #E6DB74;"> -></span><span> int</span><span style="color: #E6DB74;"> -></span><span> int) (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;"> :</span><span> value) (</span><span style="color: #FD971F;font-style: italic;">b</span><span style="color: #E6DB74;"> :</span><span> value)</span><span style="color: #E6DB74;"> :</span><span> value</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* Hack: This is only valid because we know our value type has one constructor, VLiteral. *)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span style="color: #A6E22E;"> VLiteral</span><span style="color: #FD971F;font-style: italic;"> va</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> a</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span style="color: #A6E22E;"> VLiteral</span><span style="color: #FD971F;font-style: italic;"> vb</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> b</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span style="color: #A6E22E;"> VLiteral</span><span> (op va vb)</span></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #E6DB74;"> rec</span><span style="color: #A6E22E;"> eval</span><span> (</span><span style="color: #FD971F;font-style: italic;">env</span><span style="color: #E6DB74;"> :</span><span> environment) (</span><span style="color: #FD971F;font-style: italic;">tm</span><span style="color: #E6DB74;"> :</span><span> term)</span><span style="color: #E6DB74;"> :</span><span> value</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #F92672;"> match</span><span> tm</span><span style="color: #F92672;"> with</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Literal</span><span style="color: #FD971F;font-style: italic;"> i</span><span style="color: #66D9EF;font-style: italic;"> -></span><span style="color: #A6E22E;"> VLiteral</span><span> i</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Name</span><span style="color: #FD971F;font-style: italic;"> nm</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> lookup env nm</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Mul</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> b</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> do_op (</span><span style="color: #E6DB74;"> *</span><span> ) (eval env a) (eval env b)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Exp</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> b</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> do_op pow (eval env a) (eval env b)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Add</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> b</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> do_op (</span><span style="color: #E6DB74;"> +</span><span> ) (eval env a) (eval env b)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Sub</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> b</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> do_op (</span><span style="color: #E6DB74;"> -</span><span> ) (eval env a) (eval env b)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Let</span><span> (</span><span style="color: #FD971F;font-style: italic;">nm</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> def</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> rest</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span style="color: #A6E22E;"> result</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> eval env def</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span style="color: #A6E22E;"> new_env</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> (nm</span><span style="color: #E6DB74;">,</span><span> result)</span><span style="color: #E6DB74;"> ::</span><span> env</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span> eval new_env rest</span></span></code></pre>
<p>In the <code>Let</code> case, we compute the definition first, then extend our environment with the new name and value before computing the rest of the expression.</p>
<p>We then, by returning a <code>value</code>, have a guarantee that whatever comes out of <code>eval</code> is as simple as we want it to be.</p>
<p>Comparing for equality is then very simple: We use <code>eval</code> to evaluate our terms into values, then because our values are in a nice normal form, we have the guarantee that we can compare them easily, with no further evaluation needed.</p>
<h2 id="wrap-up">Wrap up</h2>
<p>So far we have covered:</p>
<ol>
<li>Languages and terms.</li>
<li>Simple evaluation strategies for let bound variables & closed terms.</li>
<li>Values and normal forms.</li>
</ol>
<p>In the next part, we will explore how to take these concepts and apply them to something much closer to a "real" programming language, with <code>lambda</code> expressions and application, which will require the introduction of a "closure". From there, we can explore how to deal with open terms, containing free variables, and onwards to dependent types.</p>
<h2 id="code">Code</h2>
<details>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> variable</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> string</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> term</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Literal</span><span> of int </span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Name</span><span> of variable </span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Mul</span><span> of term</span><span style="color: #E6DB74;"> *</span><span> term </span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Exp</span><span> of term</span><span style="color: #E6DB74;"> *</span><span> term </span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Add</span><span> of term</span><span style="color: #E6DB74;"> *</span><span> term </span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Sub</span><span> of term</span><span style="color: #E6DB74;"> *</span><span> term </span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Let</span><span> of variable</span><span style="color: #E6DB74;"> *</span><span> term</span><span style="color: #E6DB74;"> *</span><span> term </span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* let x = ...; ...*)</span></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> value</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> VLiteral</span><span> of int</span></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span style="color: #F92672;">type</span><span style="color: #A6E22E;"> environment</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> (variable</span><span style="color: #E6DB74;"> *</span><span> value)</span><span style="color: #A6E22E;"> list</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #E6DB74;"> rec</span><span style="color: #A6E22E;"> lookup</span><span> (</span><span style="color: #FD971F;font-style: italic;">env</span><span style="color: #E6DB74;"> :</span><span> environment) (</span><span style="color: #FD971F;font-style: italic;">name</span><span style="color: #E6DB74;"> :</span><span> variable)</span><span style="color: #E6DB74;"> :</span><span> value</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #F92672;"> match</span><span> env</span><span style="color: #F92672;"> with</span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* See note below. *)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> []</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> failwith (</span><span style="color: #E6DB74;">"Variable " ^</span><span> name</span><span style="color: #E6DB74;"> ^ " not found."</span><span>)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span> (</span><span style="color: #FD971F;font-style: italic;">nm</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> value</span><span>)</span><span style="color: #E6DB74;"> ::</span><span style="color: #FD971F;font-style: italic;"> rest</span><span style="color: #66D9EF;font-style: italic;"> -></span></span>
<span class="giallo-l"><span style="color: #F92672;"> if</span><span> nm</span><span style="color: #E6DB74;"> =</span><span> name</span><span style="color: #F92672;"> then</span></span>
<span class="giallo-l"><span> value</span></span>
<span class="giallo-l"><span style="color: #F92672;"> else</span></span>
<span class="giallo-l"><span> lookup rest name</span></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span style="color: #88846F;">(* OCaml does not have integer exponentiation by default. Definition omitted. *)</span></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> pow</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;"> :</span><span> int) (</span><span style="color: #FD971F;font-style: italic;">b</span><span style="color: #E6DB74;"> :</span><span> int)</span><span style="color: #E6DB74;"> :</span><span> int</span><span style="color: #66D9EF;font-style: italic;"> =</span><span style="color: #E6DB74;"> ...</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #E6DB74;"> rec</span><span style="color: #A6E22E;"> do_op</span><span> (</span><span style="color: #FD971F;font-style: italic;">op</span><span style="color: #E6DB74;"> :</span><span> int</span><span style="color: #E6DB74;"> -></span><span> int</span><span style="color: #E6DB74;"> -></span><span> int) (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;"> :</span><span> value) (</span><span style="color: #FD971F;font-style: italic;">b</span><span style="color: #E6DB74;"> :</span><span> value)</span><span style="color: #E6DB74;"> :</span><span> value</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #88846F;"> (* Hack: This is only valid because we know our value type has one constructor, VLiteral. *)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span style="color: #A6E22E;"> VLiteral</span><span style="color: #FD971F;font-style: italic;"> va</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> a</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span style="color: #A6E22E;"> VLiteral</span><span style="color: #FD971F;font-style: italic;"> vb</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> b</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span style="color: #A6E22E;"> VLiteral</span><span> (op va vb)</span></span>
<span class="giallo-l"><span> </span></span>
<span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #E6DB74;"> rec</span><span style="color: #A6E22E;"> eval</span><span> (</span><span style="color: #FD971F;font-style: italic;">env</span><span style="color: #E6DB74;"> :</span><span> environment) (</span><span style="color: #FD971F;font-style: italic;">tm</span><span style="color: #E6DB74;"> :</span><span> term)</span><span style="color: #E6DB74;"> :</span><span> value</span><span style="color: #66D9EF;font-style: italic;"> =</span></span>
<span class="giallo-l"><span style="color: #F92672;"> match</span><span> tm</span><span style="color: #F92672;"> with</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Literal</span><span style="color: #FD971F;font-style: italic;"> i</span><span style="color: #66D9EF;font-style: italic;"> -></span><span style="color: #A6E22E;"> VLiteral</span><span> i</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Name</span><span style="color: #FD971F;font-style: italic;"> nm</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> lookup env nm</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Mul</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> b</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> do_op (</span><span style="color: #E6DB74;"> *</span><span> ) (eval env a) (eval env b)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Exp</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> b</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> do_op pow (eval env a) (eval env b)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Add</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> b</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> do_op (</span><span style="color: #E6DB74;"> +</span><span> ) (eval env a) (eval env b)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Sub</span><span> (</span><span style="color: #FD971F;font-style: italic;">a</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> b</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span><span> do_op (</span><span style="color: #E6DB74;"> -</span><span> ) (eval env a) (eval env b)</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> |</span><span style="color: #A6E22E;"> Let</span><span> (</span><span style="color: #FD971F;font-style: italic;">nm</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> def</span><span style="color: #E6DB74;">,</span><span style="color: #FD971F;font-style: italic;"> rest</span><span>)</span><span style="color: #66D9EF;font-style: italic;"> -></span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span style="color: #A6E22E;"> result</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> eval env def</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span style="color: #66D9EF;font-style: italic;"> let</span><span style="color: #A6E22E;"> new_env</span><span style="color: #66D9EF;font-style: italic;"> =</span><span> (nm</span><span style="color: #E6DB74;">,</span><span> result)</span><span style="color: #E6DB74;"> ::</span><span> env</span><span style="color: #66D9EF;font-style: italic;"> in</span></span>
<span class="giallo-l"><span> eval new_env rest</span></span></code></pre></details>
Debruijn indexes and levels, and why they're handy2025-05-26T00:00:00+00:002025-05-26T00:00:00+00:00
Blueberry Wren
https://blueberrywren.dev/blog/debruijn-explanation/<script>
function r(str) {
while (str.charAt(0) == ' ') {
str = str.slice(1);
}
return str;
}
function get_args(str) {
str = r(str);
if (str == "") {
return ["", []]
}
else if (str.charAt(0) == '.') {
return [str.slice(1), []];
}
let [rest, l] = get_args(str.slice(1));
return [rest, [str.charAt(0)].concat(l)];
}
function parse_app(str) {
str = r(str);
if (str == "") {
return ["", []];
}
else if (str.charAt(0) == '(') {
let [rest, l] = parse(str.slice(1));
let [rest1, k] = parse_app(rest);
return [rest1, [l].concat(k)];
}
else if (str.charAt(0) == ')') {
return [str.slice(1), []]
} else {
let c = str.charAt(0);
let [rest, l] = parse_app(str.slice(1));
return [rest, [c].concat(l)];
}
}
function parse(str) {
str = r(str);
if (str == "") {
return ["", {}]
}
else if (str.charAt(0) == '\\') {
let [rest, a] = get_args(str.slice(1));
let [rest1, bd] = parse_app(rest);
return [rest1, {args : a, bd}]
} else {
return parse_app(str);
}
}
function iso(x) {
return typeof x === 'object' && !Array.isArray(x) && x !== null;
}
function islist(x) {
return (x.constructor.name == "Array")
}
function helper(args, p) {
let r = [];
for (let l of p) {
if (iso(l)) {
r.push(debru_h(args, l));
} else if (islist(l)) {
r.push(helper(args, l));
}
else {
r.push(args.indexOf(l));
}
}
return r;
}
function debru_h(arg, p) {
let args = p.args.reverse().concat(arg);
return {l : p.args.length, bd : helper(args, p.bd)};
}
function debru(p) {
let [_, bd] = p;
return debru_h([], bd);
}
function printer(p) {
if (iso(p)) {
let rest = p.bd;
return "(" + "λ ".repeat(p.l) + printer(rest) + ")";
}
else if (islist(p)) {
k = "";
for (let e of p) {
k += " " + printer(e);
}
return "(" + k.slice(1) + ")";
}
else {
return p;
}
}
</script>
<h2 id="assumed-knowledge">Assumed knowledge</h2>
<p>At least a familiarity with the lambda calculus, including how it is evaluated. Some base knowledge of programming languages is also assumed.</p>
<h2 id="the-problem">The problem</h2>
<p>Let's look at a little imaginary term, in some lambda-calculus-like language. For future note, we call the lambda a "binder", as it binds a variable. There are other types of binders, e.g. <code>let</code>, but we will only consider lambdas for the moment.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span>λ f</span><span style="color: #F92672;">.</span><span> (λ y f</span><span style="color: #F92672;">.</span><span> (f y)) f</span></span></code></pre>
<p>We can perform what's called "beta reduction" on this term — essentially, function application, applying <code>f</code> to the lambda.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span>λ f</span><span style="color: #F92672;">.</span><span> (λ y f</span><span style="color: #F92672;">.</span><span> (f y)) (f)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>substitute [y </span><span style="color: #F92672;">:=</span><span> f]</span><span style="color: #F92672;"> in</span><span> λ y f</span><span style="color: #F92672;">.</span><span> (f y)</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>λ f</span><span style="color: #F92672;">.</span><span> (λ f</span><span style="color: #F92672;">.</span><span> f f)</span></span></code></pre>
<p>Uh oh. We've accidentally captured a variable! Instead of <code>f</code> referring to the outer <code>f</code>, now it refers to the inner <code>f</code>. This is "the capture problem", and it is quite annoying. Generally to avoid this, we need to rename <em>everything</em><sup class="footnote-reference" id="fr-1-1"><a href="#fn-1">1</a></sup> in our "substituted" term to names that are free (do not occur) in the "subsitutee" so nothing is accidentally captured. What if we could introduce a notation that avoids this?</p>
<h2 id="presenting-de-bruijn-indexes">Presenting: De Bruijn Indexes!</h2>
<p>De Bruijn indexes are a naming scheme where:</p>
<ul>
<li>We use natural numbers to refer to lambdas, and</li>
<li>Zero refers to the "most recent" lambda; one refers to the second most recent, etc.</li>
</ul>
<p>Let's rewrite that term above using this system:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span>λ (λ λ (</span><span style="color: #AE81FF;">0 1</span><span>))</span><span style="color: #AE81FF;"> 0</span></span></code></pre>
<p>Here's some ascii art showing what refers to what:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span> λ (λ λ (</span><span style="color: #AE81FF;">0 1</span><span>))</span><span style="color: #AE81FF;"> 0</span></span>
<span class="giallo-l"><span style="color: #F92672;"> | | \———/ | |</span></span>
<span class="giallo-l"><span style="color: #F92672;"> | | | |</span></span>
<span class="giallo-l"><span style="color: #F92672;"> | \————————————/ |</span></span>
<span class="giallo-l"><span style="color: #F92672;"> \———————————————————————/</span></span></code></pre>
<p>Now, how does this help us with our substitution problem? Surely if we naively subtitute we will still have binding issues - and indeed we do:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span>λ (λ λ (</span><span style="color: #AE81FF;">0 1</span><span>))</span><span style="color: #AE81FF;"> 0</span></span>
<span class="giallo-l"><span style="color: #F92672;">-></span></span>
<span class="giallo-l"><span>λ (λ (</span><span style="color: #AE81FF;">0 0</span><span>))</span></span></code></pre>
<p>No good!</p>
<p>What De Bruijn indexes allow us to do is simply avoid capturing. The rule is simple: Every time we go past a binder when substituting, we increment every free variable<sup class="footnote-reference" id="fr-2-1"><a href="#fn-2">2</a></sup> in our substituted term by one, to avoid the new binder. Just once, we decrement every free varible in the substitutee, to account for the removal of the binder:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span> λ (λ λ (</span><span style="color: #AE81FF;">1 2</span><span>))</span><span style="color: #AE81FF;"> 0</span></span>
<span class="giallo-l"><span style="color: #F92672;"> ^ ^ ^</span></span>
<span class="giallo-l"><span> a b c</span></span>
<span class="giallo-l"><span style="color: #F92672;"> -></span></span>
<span class="giallo-l"><span> λ (λ (</span><span style="color: #AE81FF;">1 1</span><span>))</span></span>
<span class="giallo-l"><span style="color: #F92672;"> ^ ^ ^ ^</span><span> </span></span>
<span class="giallo-l"><span> a b </span><span style="color: #F92672;">| \</span><span> decremented by one</span></span>
<span class="giallo-l"><span style="color: #F92672;"> |</span></span>
<span class="giallo-l"><span style="color: #F92672;"> \</span><span> incremented by one when we passed </span><span style="color: #E6DB74;">"through"</span><span> lambda c</span></span></code></pre>
<p>Now we're cool! Everything works as expected, and it takes much less work (and is much more predictable!).</p>
<p>At the bottom of this post there's a little widget that can convert terms to de Bruijn for you, if you want to play around!</p>
<h2 id="presenting-de-bruijn-levels">Presenting: De Bruijn levels!</h2>
<p>De Bruijn levels work similar to De Bruijn indexes, in that we use numbers to refer to binders. However, in De Bruijn levels, the lowest number refers to the <em>least</em> recently bound item.</p>
<p>Recall that:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #AE81FF;">Named</span><span style="color: #F92672;">:</span><span> λ f</span><span style="color: #F92672;">.</span><span> (λ y f</span><span style="color: #F92672;">.</span><span> (f y)) f</span></span>
<span class="giallo-l"><span style="color: #AE81FF;">Indexes</span><span style="color: #F92672;">:</span><span> λ (λ λ (</span><span style="color: #AE81FF;">0 1</span><span>))</span><span style="color: #AE81FF;"> 0</span></span></code></pre>
<p>Now, with levels:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #AE81FF;">Levels</span><span style="color: #F92672;">:</span><span> λ (λ λ (</span><span style="color: #AE81FF;">2 1</span><span>))</span><span style="color: #AE81FF;"> 0</span></span></code></pre>
<p>This has the same diagram of what refers to what:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span> λ (λ λ (</span><span style="color: #AE81FF;">2 1</span><span>))</span><span style="color: #AE81FF;"> 0</span></span>
<span class="giallo-l"><span style="color: #F92672;"> | | \———/ | |</span></span>
<span class="giallo-l"><span style="color: #F92672;"> | | | |</span></span>
<span class="giallo-l"><span style="color: #F92672;"> | \————————————/ |</span></span>
<span class="giallo-l"><span style="color: #F92672;"> \———————————————————————/</span></span></code></pre>
<p>(As it should! These two representations represent the same term.)</p>
<p>As you might expect, de Bruijn indexes and levels are each beneficial in their own situations.</p>
<p>Generally, De Bruijn indexes are "more useful" than De Bruijn levels, as they're "more local". In order to work with levels, you need to know "how deep" you are in a term at all times.</p>
<p>De Bruijn indexes give us the advantage that we can freely create new binders without the need for any information about where in a term we are, whereas de Bruijn levels give us the advantage when moving a term under a binder, free variables in said term do not need to be modified. Generally, one has many more free variables in a term than bound ones.</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span> λ (λ λ (</span><span style="color: #AE81FF;">2 1</span><span>))</span><span style="color: #AE81FF;"> 0</span></span>
<span class="giallo-l"><span style="color: #F92672;"> ^</span><span> this zero</span><span style="color: #F92672;">...</span></span>
<span class="giallo-l"><span style="color: #F92672;"> -></span></span>
<span class="giallo-l"><span> λ (λ (</span><span style="color: #AE81FF;">1 0</span><span>))</span></span>
<span class="giallo-l"><span style="color: #F92672;"> ^ ^</span><span> is still zero</span><span style="color: #F92672;">!</span></span>
<span class="giallo-l"><span style="color: #F92672;"> |</span></span>
<span class="giallo-l"><span style="color: #F92672;"> \</span><span> we had to modify this one though</span></span></code></pre><h2 id="other-advantages">Other advantages</h2>
<p>Something that can come up quite a lot in various contexts is comparing whether two terms are equal or not. There are many complicated ways to do so, but de Bruijn gives us an advantage in a critical one, called "alpha-equivalence". Consider the following two terms:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span>λf</span><span style="color: #F92672;">.</span><span> λx</span><span style="color: #F92672;">.</span><span> f x</span></span>
<span class="giallo-l"><span>λg</span><span style="color: #F92672;">.</span><span> λy</span><span style="color: #F92672;">.</span><span> g y</span></span></code></pre>
<p>These terms should clearly be equal, right? They do the exact same thing. In this case, we consider them "alpha-equivalent", meaning they are equal up to the names of variables. Alpha renaming is the process of renaming one term to match the names of another, so that they are "clearly" equal.</p>
<p>Let us consider the de Bruijn index representation of both of these terms:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span>λf</span><span style="color: #F92672;">.</span><span> λx</span><span style="color: #F92672;">.</span><span> f x </span><span style="color: #F92672;">=></span><span> λ λ </span><span style="color: #AE81FF;">1 0</span></span>
<span class="giallo-l"><span>λg</span><span style="color: #F92672;">.</span><span> λy</span><span style="color: #F92672;">.</span><span> g y </span><span style="color: #F92672;">=></span><span> λ λ </span><span style="color: #AE81FF;">1 0</span></span></code></pre>
<p>Isn't that nice? They've gone from being alpha-equivalent, but not quite equal, to being equal. de Bruijn gives us the ability to compare terms for equality without having to consider alpha-equivalence at all.</p>
<h2 id="wrapup">Wrapup</h2>
<p>De Bruijn indexes and levels can also be summed up via the following:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span>λa</span><span style="color: #F92672;">.</span><span> λb</span><span style="color: #F92672;">.</span><span> λc</span><span style="color: #F92672;">.</span><span> c</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>indexes</span><span style="color: #F92672;">:</span></span>
<span class="giallo-l"><span>λ λ λ </span><span style="color: #AE81FF;">0</span></span>
<span class="giallo-l"><span style="color: #F92672;">^ ^ ^</span></span>
<span class="giallo-l"><span style="color: #AE81FF;">2 1 0</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>levels</span><span style="color: #F92672;">:</span></span>
<span class="giallo-l"><span>λ λ λ </span><span style="color: #AE81FF;">2</span></span>
<span class="giallo-l"><span style="color: #F92672;">^ ^ ^</span></span>
<span class="giallo-l"><span style="color: #AE81FF;">0 1 2</span></span></code></pre>
<p>if you’re “here”</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span> v</span></span>
<span class="giallo-l"><span>λ λ λ</span></span></code></pre>
<ul>
<li>Using indexes, adding any binders further left doesn’t affect the current binder's variables, or any further right.</li>
<li>Using levels, adding any binders further right doesn’t affect the current binder's variables, or any further left.</li>
</ul>
<h2 id="de-bruijn-index-widget">De Bruijn index widget</h2>
<p>Try it out! Some example terms to try:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>\f x. f x</span></span>
<span class="giallo-l"><span>\x x. x</span></span>
<span class="giallo-l"><span>\x. (x (\y. y))</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>\x. \y. y x -- will not work</span></span>
<span class="giallo-l"><span>do \x. (\y. y x) or \x y. y x instead</span></span></code></pre>
<p>(sorry, it does over-parenthesize a bit :P)</p>
<input name="searchTxt" type="text" maxlength="512" id="searchTxt" class="searchField" placeholder="Type here!"/>
<pre data-lang="hs" style="background-color:#383838;color:#e6e1dc;" class="language-hs "><code class="language-hs" data-lang="hs" id="goober">
<p></code></pre></p>
<script>
document.getElementById('searchTxt').style.height="100px";
document.getElementById('searchTxt').style.fontSize="14pt";
//creates a listener for when you press a key
window.onkeyup = keyup;
var inputTextValue;
function keyup(e) {
//setting your input text to the global Javascript Variable for every key press
inputTextValue = document.getElementById('searchTxt').value;
//listens for you to press the ENTER key, at which point your web address will change to the one you have input in the search box
let p = parse("\\_. (" + inputTextValue + ")");
let k = debru(p);
let s = printer(k);
let sp = s.slice(5).slice(0,-3);
const thing = document.getElementById('goober');
thing.innerHTML = "<span>" + sp + "</span>"
}
</script>
<h2 id="alternatives">Alternatives</h2>
<p>It is worth noting that there are several other methods for gaining the same, or similar, advantages as de Bruijn gives. This post is not intended to explain them, but I will list several here so that the curious reader may read further (tip: when searching, append "lambda calculus" to find the right results quicker):</p>
<ul>
<li>HOAS, or "Higher Order Abstract Syntax"</li>
<li>PHOAS, or "Parametric HOAS"</li>
<li>Locally nameless</li>
<li>Nominal signatures</li>
<li>Well-scoped de Bruijn indices</li>
<li>Well-scoped names</li>
<li><a href="http://doi.acm.org/10.1145/2034773.2034817">“Nameless,
Painless”</a></li>
<li>Abstract scope graphs</li>
<li>Abstract Binding Trees</li>
<li>Co-de Bruijn indices</li>
</ul>
<p>As you can see, there are many approaches! Jesper Cockx has an excellent summary of almost all of these, which can be found <a href="https://jesper.sikanda.be/posts/1001-syntax-representations.html">here.</a> Notably, many are intended for formalization efforts rather than for computational usage.</p>
<h2 id="footnotes">Footnotes</h2>
<section class="footnotes">
<ol class="footnotes-list">
<li id="fn-1">
<p>Technically, this is not actually needed. It is sufficient to keep track of everything and rename only names that would overlap. See <a href="https://www.microsoft.com/en-us/research/wp-content/uploads/2002/07/inline.pdf">here</a> for more. <a href="#fr-1-1">↩</a></p>
</li>
<li id="fn-2">
<p>A free variable is one that is not bound by the expression we are currently considering. For example, in <code>λ x. f x</code>, <code>f</code> is free, but <code>x</code> is not. <a href="#fr-2-1">↩</a></p>
</li>
</ol>
</section>
Dependent types suck actually2025-04-01T00:00:00+00:002025-04-01T00:00:00+00:00
Blueberry Wren
https://blueberrywren.dev/blog/dependent-types-suck/<p>STOP DOING DEPENDENT TYPES</p>
<ul>
<li>Types were not supposed to be given computation!</li>
<li>YEARS of typechecking but NO real world use for going higher than GADTS</li>
<li>Wanted to go higher anyway for a laugh? We had a tool for that: It was called RUNTIME VERIFICATION</li>
<li>"Yes please give me <code>Id A x x</code> of something. Please give me <code>Vec (m + n) A</code> of it." -- Statements dreamed up by the UTTERLY INSANE</li>
</ul>
<p>Look at what computer scientists have been doing, with all the languages and typecheckers we built for them:
(This is REAL dependent types, done by REAL computer scientists)</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="plain"><span class="giallo-l"><span>sq2 : ◀.F-map-iso (◀.F-map-iso (ρ≅ Iso⁻¹)) ∙Iso α≅</span></span>
<span class="giallo-l"><span> ≡ (α≅ ∙Iso α≅) ∙Iso ▶.F-map-iso (λ≅ Iso⁻¹)</span></span>
<span class="giallo-l"><span>sq2 = ≅-path $</span></span>
<span class="giallo-l"><span> α→ _ _ _ ∘ ((ρ← ⊗₁ id) ⊗₁ id) ≡</span></span>
<span class="giallo-l"><span> (ρ← ⊗₁ ⌜ id ⊗₁ id ⌝) ∘ α→ _ _ _ ≡</span></span>
<span class="giallo-l"><span> (ρ← ⊗₁ id) ∘ α→ _ _ _ ≡˘</span></span>
<span class="giallo-l"><span> (id ⊗₁ λ←) ∘ α→ _ _ _ ∘ α→ _ _ _ ∎</span></span></code></pre><pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="lean"><span class="giallo-l"><span style="color: #F92672;">theorem</span><span style="color: #A6E22E;"> integral_re</span><span> {f : X → 𝕜} (hf : Integrable f μ) :</span></span>
<span class="giallo-l"><span> ∫ x, RCLike.re (f x) ∂μ = RCLike.re (∫ x, f x ∂μ) :=</span></span>
<span class="giallo-l"><span> (@RCLike.reCLM 𝕜 _).integral_comp_comm hf</span></span></code></pre><pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="coq"><span class="giallo-l"><span style="color: #F92672;">Lemma</span><span style="color: #A6E22E;"> next_spoke_ring</span><span> (y </span><span style="color: #F92672;">:</span><span> G) </span><span style="color: #F92672;">:</span><span> y \</span><span style="color: #F92672;">in</span><span> r </span><span style="color: #F92672;">-></span><span> next r y </span><span style="color: #F92672;">=</span><span> face (spoke y).</span></span>
<span class="giallo-l"><span style="color: #F92672;">Proof</span><span>.</span></span>
<span class="giallo-l"><span style="color: #F92672;">move=></span><span> ry; have [cycFp Up] </span><span style="color: #F92672;">:=</span><span> andP ucycFp.</span></span>
<span class="giallo-l"><span style="color: #66D9EF;">rewrite</span><span style="color: #F92672;"> -{</span><span style="color: #AE81FF;">1</span><span style="color: #F92672;">}</span><span>[y]nodeK (next_map inj_spoke) ?rev_uniq // (next_rev Up).</span></span>
<span class="giallo-l"><span style="color: #66D9EF;">rewrite</span><span style="color: #F92672;"> -</span><span>[prev p </span><span style="color: #AE81FF;">_</span><span>]faceK /spoke ee </span><span style="color: #F92672;">-</span><span>(canRL nodeK (nnn y)).</span></span>
<span class="giallo-l"><span style="color: #F92672;">by</span><span style="color: #66D9EF;"> rewrite</span><span> (eqP (prev_cycle cycFp </span><span style="color: #AE81FF;">_</span><span>)) // </span><span style="color: #F92672;">-</span><span>Ep </span><span style="color: #F92672;">-</span><span>Er.</span></span>
<span class="giallo-l"><span style="color: #F92672;">Qed</span><span>.</span></span></code></pre>
<p>"Hello I would like <code>(p : f ∘ g ≡ h ∘ k)</code> apples please"</p>
<p>they have played us for absolute fools
<br><br><br><br><br><br></p>
<details>
<summary>credits</summary>
<ul>
<li>
<p>Agda credit: <a href="https://1lab.dev/Cat.Monoidal.Base.html">1Lab</a></p>
</li>
<li>
<p>Lean credit: <a href="https://github.com/leanprover-community/mathlib4/blob/362bdac45f1c3e9307252e394f8ecfff137c4d85/Mathlib/MeasureTheory/Integral/SetIntegral.lean#L1183-L1185">Mathlib4</a></p>
</li>
<li>
<p>Rocq credit: <a href="https://github.com/rocq-community/fourcolor/blob/master/theories/proof/birkhoff.v">4 Color Theorem Proof</a></p>
</li>
</ul>
</details>
A short excerpt on pattern unification2025-03-30T00:00:00+00:002025-03-30T00:00:00+00:00
Blueberry Wren
https://blueberrywren.dev/blog/pattern-unification-short/<p>Preface: Low effort post.</p>
<p>The following is an excerpt from a discord conversation about dependent pattern unification. In short, pattern unification is one method for solving
unification goals such as the following:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span>id </span><span style="color: #F92672;">:</span><span> (</span><span style="color: #AE81FF;">A</span><span style="color: #F92672;"> :</span><span style="color: #AE81FF;"> Type</span><span>)</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> A</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> A</span></span>
<span class="giallo-l"><span>id </span><span style="color: #AE81FF;">A</span><span> x </span><span style="color: #F92672;">=</span><span> x</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>id2 </span><span style="color: #F92672;">:</span><span> (</span><span style="color: #AE81FF;">B</span><span style="color: #F92672;"> :</span><span style="color: #AE81FF;"> Type</span><span>)</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> B</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> B</span></span>
<span class="giallo-l"><span>id2 </span><span style="color: #AE81FF;">B</span><span> x </span><span style="color: #F92672;">=</span><span> id _ x</span></span></code></pre>
<p>Here, we have that our type argument to <code>id</code> is a hole, so we must solve it.</p>
<p>We are working with a de Brujin representation, so the above actually looks something like:</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #F92672;">let :</span><span> (</span><span style="color: #AE81FF;">A</span><span style="color: #F92672;"> :</span><span style="color: #AE81FF;"> Type</span><span>)</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> A</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> A</span><span style="color: #F92672;"> =</span><span> λ λ </span><span style="color: #AE81FF;">0</span><span>;</span></span>
<span class="giallo-l"><span style="color: #F92672;">let :</span><span> (</span><span style="color: #AE81FF;">B</span><span style="color: #F92672;"> :</span><span style="color: #AE81FF;"> Type</span><span>)</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> B</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> B</span><span style="color: #F92672;"> =</span><span> λ λ </span><span style="color: #AE81FF;">2</span><span> _ </span><span style="color: #AE81FF;">0</span></span></code></pre>
<p>Once we've gotten to the point of writing that hole, what was once <code>id</code> is now <code>2</code> (Two levels of lambda binders in the way.). As such, performing this
solving takes slightly more work, as we can't simply plug in the result of unification - the de Brujin wouldn't line up.</p>
<p>In this conversation, we were discussing relative to András Kovács' excellent "elab-zoo", <a href="https://github.com/AndrasKovacs/elaboration-zoo/">found here</a>.
We are discussing <a href="https://github.com/AndrasKovacs/elaboration-zoo/blob/master/03-holes/pattern-unification.txt"><code>03-holes/pattern-unification.txt</code></a> and <a href="https://github.com/AndrasKovacs/elaboration-zoo/blob/master/03-holes/Main.hs"><code>/03-holes/Main.hs</code></a> in particular, the former being a formal treatment of what happens <em>after</em> you find a solution, and the latter being an implementation of pattern unification (amongst other things).</p>
<h3 id="comments-before-the-fact">Comments before the fact</h3>
<p>I think this explanation is somewhat reasonable for what's actually happening. Nothing will replace the original document, of course! Go give that a read (preferably before you read this.)</p>
<h2 id="warning">Warning!</h2>
<p>This conversation is <em>only</em> going to make sense if you've had a look at at <em>least</em> the latter linked file above (<code>Main.hs</code>). I recommend also having a look at <code>pattern-unification.txt</code> if you really want to grasp it, though.</p>
<p>I also make no concrete warning that the below is 100% correct; while it is to the best of ability, i'm still learning this too!</p>
<h3 id="the-conversation-as-written-minorly-edited-to-exclude-comments-from-people-other-than-me">The conversation as written, minorly edited to exclude comments from people other than me</h3>
<p>(In reference to <code>pattern-unification.txt</code>)</p>
<blockquote>
<p>most of this is what you do <em>after</em> you've "found the solution"
finding the "solution" is vaguely your normal unification procedure
when you find a hole, you put a meta in it, when you unify something with that meta you "solve" it</p>
</blockquote>
<p>"Normal unification" here is your fairly traditional unification for typechecking; it is somewhat different in a dependent setting, but not
too different. (Look here later for a series on this!)</p>
<p>All of the following is then discussing <code>Main.hs</code> and the concrete implementation of solving a metavariable.
This maps somewhat closely from <code>pattern-unification.txt</code>, but can be understood standalone.</p>
<blockquote>
<p>Andras' puts it better than i could:</p>
</blockquote>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #88846F;">{-</span></span>
<span class="giallo-l"><span style="color: #88846F;">The actual unification algorithm is fairly simple, it works in a structural</span></span>
<span class="giallo-l"><span style="color: #88846F;">fashion, like conversion checking before. The main complication, as we've seen,</span></span>
<span class="giallo-l"><span style="color: #88846F;">is the pattern unification case.</span></span>
<span class="giallo-l"><span style="color: #88846F;">-}</span></span></code></pre>
<p><em>A small break while I write the following</em></p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span> (</span><span style="color: #AE81FF;">VFlex</span><span> m sp , t' )</span><span style="color: #F92672;"> -></span><span> solve l m sp t'</span></span>
<span class="giallo-l"><span> (t ,</span><span style="color: #AE81FF;"> VFlex</span><span> m' sp' )</span><span style="color: #F92672;"> -></span><span> solve l m' sp' t</span></span></code></pre>
<blockquote>
<p><code>VFlex</code> is what elab-zoo calls the thing holding an unsolved metavariable (here <code>m</code> or <code>m'</code>), and a "spine" <code>sp</code>, which is a list of everything bound in the context when <code>m</code> was created</p>
</blockquote>
<blockquote>
<p>you can then imagine the meta to be, essentially, a function, taking everything bound as arguments (which is what it actually is, in elab zoo)</p>
</blockquote>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span>id </span><span style="color: #F92672;">:</span><span> (</span><span style="color: #AE81FF;">A</span><span style="color: #F92672;"> :</span><span style="color: #AE81FF;"> U</span><span>)</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> A</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> A</span></span>
<span class="giallo-l"><span>id </span><span style="color: #AE81FF;">A</span><span> x </span><span style="color: #F92672;">=</span><span> x</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>id2 </span><span style="color: #F92672;">:</span><span> (</span><span style="color: #AE81FF;">B</span><span style="color: #F92672;"> :</span><span style="color: #AE81FF;"> U</span><span>)</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> B</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> B</span></span>
<span class="giallo-l"><span>id2 </span><span style="color: #AE81FF;">B</span><span> y </span><span style="color: #F92672;">=</span><span> id _ y</span></span>
<span class="giallo-l"><span style="color: #F92672;">=></span></span>
<span class="giallo-l"><span style="color: #F92672;">?</span><span>m </span><span style="color: #AE81FF;">B</span><span> y </span><span style="color: #F92672;">= ???</span></span>
<span class="giallo-l"><span>id2 </span><span style="color: #AE81FF;">B</span><span> y </span><span style="color: #F92672;">=</span><span> id (</span><span style="color: #F92672;">?</span><span>m </span><span style="color: #AE81FF;">B</span><span> y) y</span></span></code></pre>
<blockquote>
<p>here our normal typechecking would try to unify <code>?m</code>'s <code>???</code> with <code>B</code></p>
</blockquote>
<blockquote>
<p>the actual solving is then handled by <code>solve</code>:</p>
</blockquote>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span style="color: #88846F;">-- Γ ?α sp rhs</span></span>
<span class="giallo-l"><span style="color: #A6E22E;">solve</span><span style="color: #F92672;"> ::</span><span style="color: #66D9EF;font-style: italic;"> Lvl</span><span style="color: #F92672;"> -></span><span style="color: #66D9EF;font-style: italic;"> MetaVar</span><span style="color: #F92672;"> -></span><span style="color: #66D9EF;font-style: italic;"> Spine</span><span style="color: #F92672;"> -></span><span style="color: #66D9EF;font-style: italic;"> Val</span><span style="color: #F92672;"> -></span><span style="color: #66D9EF;font-style: italic;"> IO</span><span style="color: #66D9EF;"> ()</span></span>
<span class="giallo-l"><span>solve gamma m sp rhs </span><span style="color: #F92672;">= do</span></span>
<span class="giallo-l"><span> pren </span><span style="color: #F92672;"><-</span><span> invert gamma sp</span></span>
<span class="giallo-l"><span> rhs </span><span style="color: #F92672;"><-</span><span> rename m pren rhs</span></span>
<span class="giallo-l"><span style="color: #F92672;"> let</span><span> solution </span><span style="color: #F92672;">=</span><span> eval </span><span style="color: #AE81FF;">[]</span><span style="color: #F92672;"> $</span><span> lams (dom pren) rhs</span></span>
<span class="giallo-l"><span> modifyIORef' mcxt </span><span style="color: #F92672;">$</span><span style="color: #000000;background-color: #FFFFFF;"> </span><span style="color: #A6E22E;text-decoration: underline;">IM.</span><span>insert (unMetaVar m) (</span><span style="color: #AE81FF;">Solved</span><span> solution)</span></span></code></pre>
<blockquote>
<p><code>B</code> would be our <code>rhs</code> here</p>
</blockquote>
<blockquote>
<p>you need to remember we're working with debrujin, so the solution to our metavariable (which may reference things in the context of where the meta was created, of course) should exist in a different context (a "mostly" empty one, with only the arguments to our meta).</p>
</blockquote>
<blockquote>
<p><code>invert</code>, which is <code>^⁻¹</code> in the pattern unification text, creates a renaming from our original context (<code>sp</code>) to the desired new context, with only our meta arguments</p>
</blockquote>
<blockquote>
<p><code>rename</code> takes our <code>rhs</code> and uses the renaming to take it to the new context (it takes <code>m</code> as an argument because it does an occurs check at the same time, recursive solutions are no good)</p>
</blockquote>
<blockquote>
<p>finally we add the needed lambdas for our function meta (debrujin, remember), evaluate it in the empty context in order to take it into the value domain, and plug it in as the solution</p>
</blockquote>
<blockquote>
<p>so then our final solution is</p>
</blockquote>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span>id </span><span style="color: #F92672;">:</span><span> (</span><span style="color: #AE81FF;">A</span><span style="color: #F92672;"> :</span><span style="color: #AE81FF;"> U</span><span>)</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> A</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> A</span></span>
<span class="giallo-l"><span>id </span><span style="color: #AE81FF;">A</span><span> x </span><span style="color: #F92672;">=</span><span> x</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>id2 </span><span style="color: #F92672;">:</span><span> (</span><span style="color: #AE81FF;">B</span><span style="color: #F92672;"> :</span><span style="color: #AE81FF;"> U</span><span>)</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> B</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> B</span></span>
<span class="giallo-l"><span>id2 </span><span style="color: #AE81FF;">B</span><span> y </span><span style="color: #F92672;">=</span><span> id _ y</span></span>
<span class="giallo-l"><span style="color: #F92672;">=></span></span>
<span class="giallo-l"><span style="color: #F92672;">?</span><span>m </span><span style="color: #AE81FF;">B</span><span> y </span><span style="color: #F92672;">=</span><span style="color: #AE81FF;"> B</span></span>
<span class="giallo-l"><span>id2 </span><span style="color: #AE81FF;">B</span><span> y </span><span style="color: #F92672;">=</span><span> id (</span><span style="color: #F92672;">?</span><span>m </span><span style="color: #AE81FF;">B</span><span> y) y</span></span></code></pre>
<blockquote>
<p>?m is fully inline though, so</p>
</blockquote>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span>id </span><span style="color: #F92672;">:</span><span> (</span><span style="color: #AE81FF;">A</span><span style="color: #F92672;"> :</span><span style="color: #AE81FF;"> U</span><span>)</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> A</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> A</span></span>
<span class="giallo-l"><span>id </span><span style="color: #AE81FF;">A</span><span> x </span><span style="color: #F92672;">=</span><span> x</span></span>
<span class="giallo-l"></span>
<span class="giallo-l"><span>id2 </span><span style="color: #F92672;">:</span><span> (</span><span style="color: #AE81FF;">B</span><span style="color: #F92672;"> :</span><span style="color: #AE81FF;"> U</span><span>)</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> B</span><span style="color: #F92672;"> -></span><span style="color: #AE81FF;"> B</span></span>
<span class="giallo-l"><span>id2 </span><span style="color: #AE81FF;">B</span><span> y </span><span style="color: #F92672;">=</span><span> id ((λ </span><span style="color: #AE81FF;">B</span><span> y </span><span style="color: #F92672;">-></span><span style="color: #AE81FF;"> B</span><span>)</span><span style="color: #AE81FF;"> B</span><span> y) y</span></span></code></pre>
<blockquote>
<p>which is obviously equal to the "clear solution"</p>
</blockquote>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="haskell"><span class="giallo-l"><span>id2 </span><span style="color: #AE81FF;">B</span><span> y </span><span style="color: #F92672;">=</span><span> id </span><span style="color: #AE81FF;">B</span><span> y</span></span></code></pre>
<blockquote>
<p>and so clearly we've solved it!</p>
</blockquote>
<h3 id="comments-after-the-fact">Comments after the fact</h3>
<p>I don't really have any other comments. There will (hopefully shortly) start appearing a "tutorial" sort of series on writing a dependent language with holes, so some of this
will definitely come up in that, and I'll probably write some more comments here after i've gone and written that tutorial.</p>
<p>Hope this helps somebody!</p>
Welcome back.2025-03-27T00:00:00+00:002025-03-27T00:00:00+00:00
Blueberry Wren
https://blueberrywren.dev/blog/2025-03-27/<h1 id="hey-hey">hey hey</h1>
Hi, world.2023-06-17T00:00:00+00:002023-06-17T00:00:00+00:00
Blueberry Wren
https://blueberrywren.dev/blog/first/<p>This is just a little blog i'm doing for the sake of spreading stuff I learn about. Fun, right?</p>
<p>There will be mostly math and programming. \(a \to b\)</p>
<pre class="giallo" style="color: #F8F8F2; background-color: #272822;"><code data-lang="ocaml"><span class="giallo-l"><span style="color: #F92672;">let</span><span style="color: #A6E22E;"> fac</span><span style="color: #FD971F;font-style: italic;"> n</span><span style="color: #66D9EF;font-style: italic;"> =</span><span style="color: #F92672;"> if</span><span> n</span><span style="color: #E6DB74;"> <=</span><span style="color: #AE81FF;"> 1</span><span style="color: #F92672;"> then</span><span style="color: #AE81FF;"> 1</span><span style="color: #F92672;"> else</span><span> n</span><span style="color: #E6DB74;"> *</span><span> fac (n</span><span style="color: #E6DB74;"> -</span><span style="color: #AE81FF;"> 1</span><span>)</span></span></code></pre>
<p>$$\forall a. \forall b. (\forall c. c \to c) \to (a, b) \to (a, b)$$</p>