(*<*)

theory Paper

imports "../Nominal/Nominal2" 

        "~~/src/HOL/Library/LaTeXsugar"

begin

consts

  fv :: "'a \<Rightarrow> 'b"

  abs_set :: "'a \<Rightarrow> 'b \<Rightarrow> 'c"

  alpha_bn :: "'a \<Rightarrow> 'a \<Rightarrow> bool"

  abs_set2 :: "'a \<Rightarrow> perm \<Rightarrow> 'b \<Rightarrow> 'c"

  equ2 :: "'a \<Rightarrow> 'a \<Rightarrow> bool"

  Abs_dist :: "'a \<Rightarrow> 'b \<Rightarrow> 'c" 

  Abs_print :: "'a \<Rightarrow> 'b \<Rightarrow> 'c" 

definition

 "equal \<equiv> (op =)" 

fun alpha_set_ex where

  "alpha_set_ex (bs, x) R f (cs, y) = (\<exists>pi. alpha_set (bs, x) R f pi (cs, y))"

fun alpha_res_ex where

  "alpha_res_ex (bs, x) R f pi (cs, y) = (\<exists>pi. alpha_res (bs, x) R f pi (cs, y))"

fun alpha_lst_ex where

  "alpha_lst_ex (bs, x) R f pi (cs, y) = (\<exists>pi. alpha_lst (bs, x) R f pi (cs, y))"

notation (latex output)

  swap ("'(_ _')" [1000, 1000] 1000) and

  fresh ("_ # _" [51, 51] 50) and

  fresh_star ("_ #\<^sup>* _" [51, 51] 50) and

  supp ("supp _" [78] 73) and

  uminus ("-_" [78] 73) and

  If  ("if _ then _ else _" 10) and

  alpha_set_ex ("_ \<approx>\<^raw:\,\raisebox{-1pt}{\makebox[0mm][l]{$_{\textit{set}}$}}>\<^bsup>_, _\<^esup> _") and

  alpha_lst_ex ("_ \<approx>\<^raw:\,\raisebox{-1pt}{\makebox[0mm][l]{$_{\textit{list}}$}}>\<^bsup>_, _\<^esup> _") and

  alpha_res_ex ("_ \<approx>\<^raw:\,\raisebox{-1pt}{\makebox[0mm][l]{$_{\textit{set+}}$}}>\<^bsup>_, _\<^esup> _") and

  abs_set ("_ \<approx>\<^raw:{$\,_{\textit{abs\_set}}$}> _") and

  abs_set2 ("_ \<approx>\<^raw:\raisebox{-1pt}{\makebox[0mm][l]{$\,_{\textit{list}}$}}>\<^bsup>_\<^esup>  _") and

  fv ("fa'(_')" [100] 100) and

  equal ("=") and

  alpha_abs_set ("_ \<approx>\<^raw:{$\,_{\textit{abs\_set}}$}> _") and 

  alpha_abs_lst ("_ \<approx>\<^raw:{$\,_{\textit{abs\_list}}$}> _") and 

  alpha_abs_res ("_ \<approx>\<^raw:{$\,_{\textit{abs\_set+}}$}> _") and 

  Abs_set ("[_]\<^bsub>set\<^esub>._" [20, 101] 999) and

  Abs_lst ("[_]\<^bsub>list\<^esub>._" [20, 101] 999) and

  Abs_dist ("[_]\<^bsub>#list\<^esub>._" [20, 101] 999) and

  Abs_res ("[_]\<^bsub>set+\<^esub>._") and

  Abs_print ("_\<^bsub>set\<^esub>._") and

  Cons ("_::_" [78,77] 73) and

  supp_set ("aux _" [1000] 10) and

  alpha_bn ("_ \<approx>bn _")

consts alpha_trm ::'a

consts fa_trm :: 'a

consts fa_trm_al :: 'a

consts alpha_trm2 ::'a

consts fa_trm2 :: 'a

consts fa_trm2_al :: 'a

consts supp2 :: 'a

consts ast :: 'a

consts ast' :: 'a

consts bn_al :: "'b \<Rightarrow> 'a"

notation (latex output) 

  alpha_trm ("\<approx>\<^bsub>trm\<^esub>") and

  fa_trm ("fa\<^bsub>trm\<^esub>") and

  fa_trm_al ("fa\<AL>\<^bsub>trm\<^esub>") and

  alpha_trm2 ("'(\<approx>\<^bsub>assn\<^esub>, \<approx>\<^bsub>trm\<^esub>')") and

  fa_trm2 ("'(fa\<^bsub>assn\<^esub>, fa\<^bsub>trm\<^esub>')") and

  fa_trm2_al ("'(fa\<AL>\<^bsub>assn\<^esub>, fa\<AL>\<^bsub>trm\<^esub>')") and

  ast ("'(as, t')") and

  ast' ("'(as', t\<PRIME> ')") and

  equ2 ("'(=, =')") and

  supp2 ("'(supp, supp')") and

  bn_al ("bn\<^sup>\<alpha> _" [100] 100)

(*>*)

section {* Introduction *}

text {*

  So far, Nominal Isabelle provided a mechanism for constructing alpha-equated

  terms, for example lambda-terms

  \[

  @{text "t ::= x | t t | \<lambda>x. t"}

  \]\smallskip

  \noindent

  where free and bound variables have names.  For such alpha-equated terms,

  Nominal Isabelle derives automatically a reasoning infrastructure that has

  been used successfully in formalisations of an equivalence checking

  algorithm for LF \cite{UrbanCheneyBerghofer08}, Typed

  Scheme~\cite{TobinHochstadtFelleisen08}, several calculi for concurrency

  \cite{BengtsonParow09} and a strong normalisation result for cut-elimination

  in classical logic \cite{UrbanZhu08}. It has also been used by Pollack for

  formalisations in the locally-nameless approach to binding

  \cite{SatoPollack10}.

  However, Nominal Isabelle has fared less well in a formalisation of the

  algorithm W \cite{UrbanNipkow09}, where types and type-schemes are,

  respectively, of the form

  \begin{equation}\label{tysch}

  \begin{array}{l}

  @{text "T ::= x | T \<rightarrow> T"}\hspace{15mm}

  @{text "S ::= \<forall>{x\<^isub>1,\<dots>, x\<^isub>n}. T"}

  \end{array}

  \end{equation}\smallskip

  \noindent

  and the @{text "\<forall>"}-quantification binds a finite (possibly empty) set of

  type-variables.  While it is possible to implement this kind of more general

  binders by iterating single binders, like @{text "\<forall>x\<^isub>1.\<forall>x\<^isub>2...\<forall>x\<^isub>n.T"}, this leads to a rather clumsy

  formalisation of W. For example, the usual definition for a

  type being an instance of a type-scheme requires in the iterated version 

  the following auxiliary \emph{unbinding relation}:

  \[

  \infer{@{text T} \hookrightarrow ([], @{text T})}{}\qquad

  \infer{\forall @{text x.S} \hookrightarrow (@{text x}\!::\!@{text xs}, @{text T})}

   {@{text S} \hookrightarrow (@{text xs}, @{text T})}

  \]\smallskip

  \noindent

  Its purpose is to relate a type-scheme with a list of type-variables and a type. It is used to

  address the following problem:

  Given a type-scheme, say @{text S}, how does one get access to the bound type-variables 

  and the type-part of @{text S}? The unbinding relation gives an answer to this problem, though 

  in general it will only provide \emph{a} list of type-variables together with \emph{a} type that are  

  ``alpha-equivalent'' to @{text S}. This is because unbinding is a relation; it cannot be a function

  for alpha-equated type-schemes. With the unbinding relation  

  in place, we can define when a type @{text T} is an instance of a type-scheme @{text S} as follows:

  \[

  @{text "T \<prec> S \<equiv> \<exists>xs T' \<sigma>. S \<hookrightarrow> (xs, T') \<and> dom \<sigma> = set xs \<and> \<sigma>(T') = T"}

  \]\smallskip

  \noindent

  This means there exists a list of type-variables @{text xs} and a type @{text T'} to which

  the type-scheme @{text S} unbinds, and there exists a substitution @{text "\<sigma>"} whose domain is

  @{text xs} (seen as set) such that @{text "\<sigma>(T') = T"}.

  The problem with this definition is that we cannot follow the usual proofs 

  that are by induction on the type-part of the type-scheme (since it is under

  an existential quantifier and only an alpha-variant). The implementation of 

  type-schemes using iterations of single binders 

  prevents us from directly ``unbinding'' the bound type-variables and the type-part. 

  Clearly, a more dignified approach for formalising algorithm W is desirable. 

  The purpose of this paper is to introduce general binders, which 

  allow us to represent type-schemes so that they can bind multiple variables at once

  and as a result solve this problem more straightforwardly.

  The need of iterating single binders is also one reason

  why the existing Nominal Isabelle and similar theorem provers that only provide

  mechanisms for binding single variables have so far not fared very well with

  the more advanced tasks in the POPLmark challenge \cite{challenge05},

  because also there one would like to bind multiple variables at once.

  Binding multiple variables has interesting properties that cannot be captured

  easily by iterating single binders. For example in the case of type-schemes we do not

  want to make a distinction about the order of the bound variables. Therefore

  we would like to regard in \eqref{ex1} below  the first pair of type-schemes as alpha-equivalent,

  but assuming that @{text x}, @{text y} and @{text z} are distinct variables,

  the second pair should \emph{not} be alpha-equivalent:

  \begin{equation}\label{ex1}

  @{text "\<forall>{x, y}. x \<rightarrow> y  \<approx>\<^isub>\<alpha>  \<forall>{x, y}. y \<rightarrow> x"}\hspace{10mm}

  @{text "\<forall>{x, y}. x \<rightarrow> y  \<notapprox>\<^isub>\<alpha>  \<forall>{z}. z \<rightarrow> z"}

  \end{equation}\smallskip

  \noindent

  Moreover, we like to regard type-schemes as alpha-equivalent, if they differ

  only on \emph{vacuous} binders, such as

  \begin{equation}\label{ex3}

  @{text "\<forall>{x}. x \<rightarrow> y  \<approx>\<^isub>\<alpha>  \<forall>{x, z}. x \<rightarrow> y"}

  \end{equation}\smallskip

  \noindent

  where @{text z} does not occur freely in the type.  In this paper we will

  give a general binding mechanism and associated notion of alpha-equivalence

  that can be used to faithfully represent this kind of binding in Nominal

  Isabelle.  The difficulty of finding the right notion for alpha-equivalence

  can be appreciated in this case by considering that the definition given for

  type-schemes by Leroy in \cite[Page 18--19]{Leroy92} is incorrect (it omits a side-condition).

  However, the notion of alpha-equivalence that is preserved by vacuous

  binders is not always wanted. For example in terms like

  \begin{equation}\label{one}

  @{text "\<LET> x = 3 \<AND> y = 2 \<IN> x - y \<END>"}

  \end{equation}\smallskip

  \noindent

  we might not care in which order the assignments @{text "x = 3"} and

  \mbox{@{text "y = 2"}} are given, but it would be often unusual (particularly

  in strict languages) to regard \eqref{one} as alpha-equivalent with

  \[

  @{text "\<LET> x = 3 \<AND> y = 2 \<AND> z = foo \<IN> x - y \<END>"}

  \]\smallskip

  \noindent

  Therefore we will also provide a separate binding mechanism for cases in

  which the order of binders does not matter, but the `cardinality' of the

  binders has to agree.

  However, we found that this is still not sufficient for dealing with

  language constructs frequently occurring in programming language

  research. For example in @{text "\<LET>"}s containing patterns like

  \begin{equation}\label{two}

  @{text "\<LET> (x, y) = (3, 2) \<IN> x - y \<END>"}

  \end{equation}\smallskip

  \noindent

  we want to bind all variables from the pattern inside the body of the

  $\mathtt{let}$, but we also care about the order of these variables, since

  we do not want to regard \eqref{two} as alpha-equivalent with

  \[

  @{text "\<LET> (y, x) = (3, 2) \<IN> x - y \<END>"}

  \]\smallskip

  \noindent

  As a result, we provide three general binding mechanisms each of which binds

  multiple variables at once, and let the user choose which one is intended

  when formalising a term-calculus.

  By providing these general binding mechanisms, however, we have to work

  around a problem that has been pointed out by Pottier \cite{Pottier06} and

  Cheney \cite{Cheney05}: in @{text "\<LET>"}-constructs of the form

  \[

  @{text "\<LET> x\<^isub>1 = t\<^isub>1 \<AND> \<dots> \<AND> x\<^isub>n = t\<^isub>n \<IN> s \<END>"}

  \]\smallskip

  \noindent

  we care about the information that there are as many bound variables @{text

  "x\<^isub>i"} as there are @{text "t\<^isub>i"}. We lose this information if

  we represent the @{text "\<LET>"}-constructor by something like

  \[

  @{text "\<LET> (\<lambda>x\<^isub>1\<dots>x\<^isub>n . s)  [t\<^isub>1,\<dots>,t\<^isub>n]"}

  \]\smallskip

  \noindent

  where the notation @{text "\<lambda>_ . _"} indicates that the list of @{text

  "x\<^isub>i"} becomes bound in @{text s}. In this representation the term

  \mbox{@{text "\<LET> (\<lambda>x . s) [t\<^isub>1, t\<^isub>2]"}} is a perfectly

  legal instance, but the lengths of the two lists do not agree. To exclude

  such terms, additional predicates about well-formed terms are needed in

  order to ensure that the two lists are of equal length. This can result in

  very messy reasoning (see for example~\cite{BengtsonParow09}). To avoid

  this, we will allow type specifications for @{text "\<LET>"}s as follows

  \[

  \mbox{\begin{tabular}{r@ {\hspace{2mm}}r@ {\hspace{2mm}}ll}

  @{text trm} & @{text "::="}  & @{text "\<dots>"} \\

              & @{text "|"}    & @{text "\<LET>  as::assn  s::trm"}\hspace{2mm} 

                                 \isacommand{binds} @{text "bn(as)"} \isacommand{in} @{text "s"}\\[1mm]

  @{text assn} & @{text "::="} & @{text "\<ANIL>"}\\

               &  @{text "|"}  & @{text "\<ACONS>  name  trm  assn"}

  \end{tabular}}

  \]\smallskip

  \noindent

  where @{text assn} is an auxiliary type representing a list of assignments

  and @{text bn} an auxiliary function identifying the variables to be bound

  by the @{text "\<LET>"}. This function can be defined by recursion over @{text

  assn} as follows

  \[

  @{text "bn(\<ANIL>) ="}~@{term "{}"} \hspace{10mm} 

  @{text "bn(\<ACONS> x t as) = {x} \<union> bn(as)"} 

  \]\smallskip

  \noindent

  The scope of the binding is indicated by labels given to the types, for

  example @{text "s::trm"}, and a binding clause, in this case

  \isacommand{binds} @{text "bn(as)"} \isacommand{in} @{text "s"}. This binding

  clause states that all the names the function @{text "bn(as)"} returns

  should be bound in @{text s}.  This style of specifying terms and bindings

  is heavily inspired by the syntax of the Ott-tool \cite{ott-jfp}. Our work

  extends Ott in several aspects: one is that we support three binding

  modes---Ott has only one, namely the one where the order of binders matters.

  Another is that our reasoning infrastructure, like strong induction principles

  and the notion of free variables, is derived from first principles within 

  the Isabelle/HOL theorem prover.

  However, we will not be able to cope with all specifications that are

  allowed by Ott. One reason is that Ott lets the user specify `empty' types

  like \mbox{@{text "t ::= t t | \<lambda>x. t"}} where no clause for variables is

  given. Arguably, such specifications make some sense in the context of Coq's

  type theory (which Ott supports), but not at all in a HOL-based environment

  where every datatype must have a non-empty set-theoretic model

  \cite{Berghofer99}.  Another reason is that we establish the reasoning

  infrastructure for alpha-\emph{equated} terms. In contrast, Ott produces a

  reasoning infrastructure in Isabelle/HOL for \emph{non}-alpha-equated, or

  `raw', terms. While our alpha-equated terms and the `raw' terms produced by

  Ott use names for bound variables, there is a key difference: working with

  alpha-equated terms means, for example, that the two type-schemes

  \[

  @{text "\<forall>{x}. x \<rightarrow> y  = \<forall>{x, z}. x \<rightarrow> y"} 

  \]\smallskip

  \noindent

  are not just alpha-equal, but actually \emph{equal}! As a result, we can

  only support specifications that make sense on the level of alpha-equated

  terms (offending specifications, which for example bind a variable according

  to a variable bound somewhere else, are not excluded by Ott, but we have

  to).  

  Our insistence on reasoning with alpha-equated terms comes from the

  wealth of experience we gained with the older version of Nominal Isabelle:

  for non-trivial properties, reasoning with alpha-equated terms is much

  easier than reasoning with `raw' terms. The fundamental reason for this is

  that the HOL-logic underlying Nominal Isabelle allows us to replace

  `equals-by-equals'. In contrast, replacing

  `alpha-equals-by-alpha-equals' in a representation based on `raw' terms

  requires a lot of extra reasoning work.

  Although in informal settings a reasoning infrastructure for alpha-equated

  terms is nearly always taken for granted, establishing it automatically in

  Isabelle/HOL is a rather non-trivial task. For every

  specification we will need to construct type(s) containing as elements the

  alpha-equated terms. To do so, we use the standard HOL-technique of defining

  a new type by identifying a non-empty subset of an existing type.  The

  construction we perform in Isabelle/HOL can be illustrated by the following picture:

  \begin{equation}\label{picture}

  \mbox{\begin{tikzpicture}[scale=1.1]

  %\draw[step=2mm] (-4,-1) grid (4,1);

  \draw[very thick] (0.7,0.4) circle (4.25mm);

  \draw[rounded corners=1mm, very thick] ( 0.0,-0.8) rectangle ( 1.8, 0.9);

  \draw[rounded corners=1mm, very thick] (-1.95,0.85) rectangle (-2.85,-0.05);

  \draw (-2.0, 0.845) --  (0.7,0.845);

  \draw (-2.0,-0.045)  -- (0.7,-0.045);

  \draw ( 0.7, 0.5) node {\footnotesize\begin{tabular}{@ {}c@ {}}$\alpha$-\\[-1mm]classes\end{tabular}};

  \draw (-2.4, 0.5) node {\footnotesize\begin{tabular}{@ {}c@ {}}$\alpha$-eq.\\[-1mm]terms\end{tabular}};

  \draw (1.8, 0.48) node[right=-0.1mm]

    {\small\begin{tabular}{@ {}l@ {}}existing\\[-1mm] type\\ (sets of raw terms)\end{tabular}};

  \draw (0.9, -0.35) node {\footnotesize\begin{tabular}{@ {}l@ {}}non-empty\\[-1mm]subset\end{tabular}};

  \draw (-3.25, 0.55) node {\small\begin{tabular}{@ {}l@ {}}new\\[-1mm]type\end{tabular}};

  \draw[<->, very thick] (-1.8, 0.3) -- (-0.1,0.3);

  \draw (-0.95, 0.3) node[above=0mm] {\footnotesize{}isomorphism};

  \end{tikzpicture}}

  \end{equation}\smallskip

  \noindent

  We take as the starting point a definition of raw terms (defined as a

  datatype in Isabelle/HOL); then identify the alpha-equivalence classes in

  the type of sets of raw terms according to our alpha-equivalence relation,

  and finally define the new type as these alpha-equivalence classes (the

  non-emptiness requirement is always satisfied whenever the raw terms are

  definable as datatype in Isabelle/HOL and our relation for alpha-equivalence

  is an equivalence relation).

  The fact that we obtain an isomorphism between the new type and the

  non-empty subset shows that the new type is a faithful representation of

  alpha-equated terms. That is not the case for example for terms using the

  locally nameless representation of binders \cite{McKinnaPollack99}: in this

  representation there are `junk' terms that need to be excluded by

  reasoning about a well-formedness predicate.

  The problem with introducing a new type in Isabelle/HOL is that in order to

  be useful, a reasoning infrastructure needs to be `lifted' from the

  underlying subset to the new type. This is usually a tricky and arduous

  task. To ease it, we re-implemented in Isabelle/HOL \cite{KaliszykUrban11}

  the quotient package described by Homeier \cite{Homeier05} for the HOL4

  system. This package allows us to lift definitions and theorems involving

  raw terms to definitions and theorems involving alpha-equated terms. For

  example if we define the free-variable function over raw lambda-terms

  as follows

  \[

  \mbox{\begin{tabular}{l@ {\hspace{1mm}}r@ {\hspace{1mm}}l}

  @{text "fv(x)"}     & @{text "\<equiv>"} & @{text "{x}"}\\

  @{text "fv(t\<^isub>1 t\<^isub>2)"} & @{text "\<equiv>"} & @{text "fv(t\<^isub>1) \<union> fv(t\<^isub>2)"}\\

  @{text "fv(\<lambda>x.t)"}  & @{text "\<equiv>"} & @{text "fv(t) - {x}"}

  \end{tabular}}

  \]\smallskip

  \noindent

  then with the help of the quotient package we can obtain a function @{text "fv\<^sup>\<alpha>"}

  operating on quotients, that is alpha-equivalence classes of lambda-terms. This

  lifted function is characterised by the equations

  \[