Page 1
Theoretical Computer Science 379 (2007) 120–141
www.elsevier.com/locate/tcs
Semantics of a sequential language for exact real-number
computation
J. Raymundo Marcial-Romero∗, Mart´ ın H. Escard´ o
University of Birmingham, Birmingham B15 2TT, England, United Kingdom
Received 30 May 2005; received in revised form 7 November 2006; accepted 24 January 2007
Communicated by G.D. Plotkin
Abstract
We study a programming language with a built-in ground type for real numbers. In order for the language to be sufficiently
expressive but still sequential, we consider a construction proposed by Boehm and Cartwright. The non-deterministic nature
of the construction suggests the use of powerdomains in order to obtain a denotational semantics for the language. We show
that the construction cannot be modelled by the Plotkin or Smyth powerdomains, but that the Hoare powerdomain gives a
computationally adequate semantics. As is well known, Hoare semantics can be used in order to establish partial correctness only.
Since computations on the reals are infinite, one cannot decompose total correctness into the conjunction of partial correctness
and termination as is traditionally done. We instead introduce a suitable operational notion of strong convergence and show that
total correctness can be proved by establishing partial correctness (using denotational methods) and strong convergence (using
operational methods). We illustrate the technique with a representative example.
c ? 2007 Elsevier B.V. All rights reserved.
Keywords: Exact real-number computation; Sequential computation; Semantics; Non-determinism; PCF
1. Introduction
This is a contribution to the problem of sequential computation with real numbers, where real numbers are taken
in the sense of constructive mathematics [2]. It is fair to say that the computability issues are well understood [34].
Here we focus on the issue of designing programming languages with a built-in, abstract data type of real numbers.
Recent research, discussed below, has shown that it is notoriously difficult to obtain sufficiently expressive languages
with sequential operational semantics and corresponding denotational semantics which articulate the data-abstraction
requirement. Based on ideas arising from constructive mathematics, Boehm and Cartwright [3], however, proposed
a compelling operational solution to the problem. Yet, their proposal falls short of providing a full solution to the
data abstraction problem, as it is not immediately clear what the corresponding denotational interpretation would
be. A partially successful attempt at solving this problem has been developed by Potts [28] and Edalat, Potts and
S¨ underhauf [6], as discussed below.
∗Corresponding address: Facultad de Ingenier´ ıa, Divisi´ on de Computaci´ on, Cerro de Coatepec s/n, Ciudad Universitaria, C.P. 50100, Toluca,
Edo. de M´ exico, M´ exico. Tel.: +52 722 2 140855x202.
E-mail addresses: jrm@cs.bham.ac.uk (J.R. Marcial-Romero), mhe@cs.bham.ac.uk (M.H. Escard´ o).
0304-3975/$ - see front matter c ? 2007 Elsevier B.V. All rights reserved.
doi:10.1016/j.tcs.2007.01.021
Page 2
J.R. Marcial-Romero, M.H. Escard´ o / Theoretical Computer Science 379 (2007) 120–141121
In light of the above, the purpose of this paper is twofold: (1) to establish the intrinsic difficulties of providing a
denotational model of Boehm and Cartwright’s operational approach, and (2) to show how it is possible to cope with
the difficulties. Before elaborating on this research programme, we pause to discuss previous work.
Di Gianantonio [14], Escard´ o [11], and Potts et al. [27] have introduced various extensions of the programming
languagePCFwithagroundtypeforrealnumbers.Eachoftheseauthorsinterpretstherealnumberstypeasavariation
of the interval domain introduced by Scott [29]. In the presence of a certain parallel conditional [25], all computable
first-order functions on the reals are definable in the languages [14,8]. By further adding Plotkin’s parallel existential
quantifier [25], all computable functions of all orders become definable in the languages [14,7,10]. In the absence of
the parallel existential quantifier, the expressivity of the languages at second-order types and beyond is not known.
Partial results in this direction are developed by Normann [23].
It is natural to ask whether the presence of such parallel constructs is an artifact of the languages or whether they
are needed for intrinsic reasons. Escard´ o, Hofmann and Streicher [9] have shown that, in the interval domain models,
the parallelism is in fact unavoidable: weak parallel-or is definable from addition and other manifestly sequential
unary functions, which indicates that addition, in these models, is an intrinsically parallel operation. Moreover,
Farjudian [12] has shown that if the parallel conditional is removed from the language, only piecewise affine functions
on the reals are definable.
Essentially, the problem is as follows. Because computable functions on the reals are continuous (see e.g. [34]), and
because the real line is a connected space, any computable boolean-valued function on the reals is constantly true or
constantly false unless it diverges for some inputs. Hence, definitions using the sequential conditional produce either
constant total functions or partial functions. If one allows the boolean-valued functions to diverge at some inputs, then
non-trivial predicates are obtained, and this, together with the parallel conditional, allows us to define the non-trivial
total functions [11].
This phenomenon had been anticipated by Boehm and Cartwright [3], who also proposed a solution to the problem.
In this paper we develop the proposed solution and study its operational and denotational semantics. The idea is based
on the following observations. In classical mathematics, the trichotomy law “x < y, x = y or x > y” holds for any
pair of real numbers x and y, but, as is well known, it fails in constructive (and in classical recursive) mathematics.
However, the following alternative cotransitivity law holds in constructive settings: for any two numbers a < b and
any number x, at least one of the relations a < x or x < b holds. Equivalently, one has that (−∞,b) ∪ (a,∞) = R.
Boehm and Cartwright’s idea is to consider a language construct rtesta,b, for a < b rational, such that:
(1) rtesta,b(x) evaluates to true or to false for every real number x,
(2) rtesta,b(x) may evaluate to true iff x < b, and
(3) rtesta,b(x) may evaluate to false iff a < x.
It is important here that evaluation never diverges for a convergent input. If the real number x happens to be in the
interval (a,b), then the specification of rtesta,b(x) allows it to evaluate to true or alternatively to false. The particular
choice will depend on the particular implementation of the real number x and of the construct rtesta,b(cf. [20]), and
is thus determined by the operational semantics.
Asapplicationoftheconstruction,wegiveanexampleofarecursivedefinitionofasequentialprogramforaddition,
which is single valued at total inputs, as required, but multi-valued at partial inputs. Thus, by allowing the output to
be multi-valued at partial inputs, we are able to overcome the negative results of Escard´ o, Hofmann and Streicher
mentioned above.
We take the view that the denotational value of rtesta,b(x) lives in a suitable powerdomain of the booleans. Thus
(1) if a < x < b then the denotational value would be the set {true,false}, (2) if a ?< x and x < b then it would be
the set {true}, and (3) if a < x and x ?< b then it would be the set {false}. Technically, one has to be careful regarding
which subsets of the powerset are allowed, but this is tackled later in the body of the paper. One of our main results is
that the Hoare powerdomain gives a computationally adequate denotational semantics. We also show that the Plotkin
and Smyth powerdomains do not render the rtest construction continuous and hence cannot be used as models. These
and other examples of powerdomains are discussed in the body of the paper.
As is well known, Hoare semantics can be used in order to establish partial correctness only. Because computations
on the reals are infinite, one cannot decompose total correctness into the conjunction of partial correctness and
termination, as is usually done for discrete data types. Instead, we introduce a suitable operational notion of strong
convergence and show that total correctness can be proved by establishing partial correctness (using denotational
Page 3
122 J.R. Marcial-Romero, M.H. Escard´ o / Theoretical Computer Science 379 (2007) 120–141
methods) and strong convergence (using operational methods). The technique is illustrated by a proof of total
correctness of our sequential program for addition. Further applications are discussed in the concluding section.
1.1. Related work
Potts [28] considers a redundant if operator (rif) for his programming language LAR (an extension of PCF with
linear fractional transformations), defined as
rif : ICK × ICF2× (ICK → t)2→ t
rif x < (I, J);
g(x),
if J ? x.
where K ∈ ICR∞and F is a dense subset of K. He uses the Hoare powerdomain to develop a denotational semantics
for his language and prove computational adequacy. Our work justifies this choice. Potts considers a deterministic one-
step reduction relation, while we consider a non-deterministic relation so as to have as precise a match as possible
with the denotational semantics in the case of multi-valued terms.
Edalat,PottsandS¨ underhauf[6]hadpreviouslyconsideredthedenotationalcounterpartofBoehmandCartwright’s
operational solution. However, they restrict attention to what can be referred to as single-valued, total computations.
In particular, their computational adequacy result for their denotational semantics is restricted to this special case.
Although it is indeed natural to regard this case as the relevant one, we have already met compelling examples, such
as the fundamental operation of addition, in which sequentiality cannot be achieved unless one allows, for example,
multi-valued outputs at partial inputs.
For their denotational semantics, they consider the Smyth powerdomain of a topological space of real numbers
(which they refer to as the upper powerspace). Thus, they consider possibly non-deterministic computations of
total real numbers, restricting their attention to those which happen to be deterministic. In the work reported
here, we instead consider non-deterministic computations of total and partial real numbers. In other words, instead
of considering a powerdomain of a space of real numbers, we consider a powerdomain of a domain of partial
real numbers. Our computational adequacy result holds for general computations, total or partial, and whether
deterministic or not. For our domain of partial real numbers, we consider the interval domain proposed by Scott [29],
but the present findings are expected to apply to many possible notions of domain of partial real numbers.
Farjudian [13] has developed a programming language, which he called SHRAD, which satisfies the three
requirements mentioned at the beginning of the paper: sequentiality, data abstraction and expressivity. In his work,
he defines a sequential language in which all computable first order functions are definable. However extensionality
is traded off for sequentiality, in the sense that all computable first order functions are extensional over total real
numbers but not over partial real numbers. Hence functions such as the rounding functions, which are frequently used
in practice, cannot be defined in SHRAD.
Di Gianantonio [15] also discusses the problem of sequential real-number computation in the presence of data
abstraction, with some interesting negative results and translations of parallel languages into sequential ones.
In order to characterize computable functions on the real numbers, Brattka [4] introduces a class of relations that
includes a construction which is essentially the same as Boehm and Cartwright’s multi-valued test discussed above.
The main difference is that we articulate relations as functions with values on a powerdomain. With this, we are able
to capture higher-type computation. Moreover, as discussed above, we take a powerdomain of the interval domain,
not of the real line, and hence we are able to distinguish partiality from multi-valuedness: an interval gives a partially
specified real number, and a set of intervals collects the possible (total or partial) outputs of a non-deterministic
computation.
then f else g =
?
f (x),
if I ? x;
1.2. Organization
Section 2 presents a running example that motivates the technical development that follows. Section 3 introduces
some background. Section 4 studies the rtest construction from the point of view of powerdomains. Section 5 develops
a programming language with the rtest construction and establishes computational adequacy for the denotational
semantics developed in Section 4. Section 6 applies this to develop techniques for correctness proofs and gives sample
applications. Section 7 summarizes the main results and discusses open problems and further work.
Page 4
J.R. Marcial-Romero, M.H. Escard´ o / Theoretical Computer Science 379 (2007) 120–141123
2. Running example
In order to motivate the use of the multi-valued construction discussed in the introduction, we give an example
showing how it can be used to avoid the parallel constructions used in previous works on real-number computation.
We take the opportunity to introduce some basic concepts and constructions studied in the technical development that
follows.
In the programming language considered in [11], the average operation
(− ⊕ −): [0,1] × [0,1] → [0,1]
defined by
x ⊕ y = (x + y)/2
can be implemented as follows:
x ⊕ y = pif x < c
then pif y < c
then consL(tailL(x) ⊕ tailL(y))
else consC(tailL(x) ⊕ tailR(y))
else pif y < c
then consC(tailR(x) ⊕ tailL(y))
else consR(tailR(x) ⊕ tailR(y)).
Here
c = 1/2,
L = [0,c],
C = [1/4,3/4],
R = [c,1],
the function consa: [0,1] → [0,1] is the unique increasing affine map with image the interval a, i.e.,
consL(x) = x/2,
consR(x) = x/2 + 1/2,
and the function taila: [0,1] → [0,1] is a left inverse, i.e.
taila(consa(x)) = x.
More precisely, the following left inverse is taken, where κais the length of a and µais the left end-point of a:
consC(x) = x/2 + 1/4,
taila(x) = max(0,min(κax + µa,1)).
Because equality on real numbers is undecidable, the relation x < c is undefined (or diverges, or denotes ⊥) if x = c.
In order to compensate for this, one uses a parallel conditional such that
pif ⊥ then z else z = z.
The intuition behind the above program is the following. If both x and y are in the interval L, then we know that
x ⊕ y is in the interval L, if both x and y are in the interval R, then we know that x ⊕ y is in the interval R, and
so on. The boundary cases are taken care of by the parallel conditional. For example, 1/2 is both in L and R, and an
unfolding of the program for x = y = 1/2 gives
1/2 ⊕ 1/2 = pif ⊥
then pif ⊥
then consL(1 ⊕ 1)
else consC(1 ⊕ 0)
else pif ⊥
then consC(0 ⊕ 1)
else consR(0 ⊕ 0).
Page 5
124 J.R. Marcial-Romero, M.H. Escard´ o / Theoretical Computer Science 379 (2007) 120–141
All branches of the conditionals evaluate to 1/2, but in an infinite number of steps. This can be seen as follows.
A repeated unfolding of 1 ⊕ 1 gives the infinite expression consR(consR(consR(...))). Denotationally speaking,
the program computes the unique fixed point of consR, which is 1. Operationally speaking, the first unfolding says
that the result of the computation, whatever it is, lives in the interval R, because, by definition, the image of consR
is R; the second unfolding says that the result is in the right half of the interval R, i.e. in the interval [3/4,1]; the third
unfolding tells us that the result is in the interval [7/8,1], and so on. Thus, the operational semantics applied to 1 ⊕ 1
produces a shrinking sequence of intervals converging to 1. The other cases are analogous.
Of course, a drawback of such a recursive definition is that, during evaluation, the number of parallel processes
grows exponentially in the number of unfoldings. In order to overcome this, we switch back to the usual sequential
conditional, and we replace the partial less-than test by the multi-valued test discussed in the introduction:
Average(x, y) = if rtestl,r(x)
then if rtestl,r(y)
then consL(Average(tailL(x),tailL(y)))
else consC(Average(tailL(x),tailR(y)))
else if rtestl,r(y)
then consC(Average(tailR(x),tailL(y)))
else consR(Average(tailR(x),tailR(y))),
where c of the previous program splits into two points
l = 1/4,
r = 3/4
and this time we choose
L = [0,r],
The intuition behind this program is similar. What is interesting is that, despite the use of the multi-valued
construction rtest, the overall result of the computation is single valued. In other words, different computation
paths will give different shrinking sequences of intervals, but all of them will shrink to the same number. A proof of
this fact and of the correctness of the program is provided in Section 6, using the techniques developed below. For
further examples see [22].
C = [1/8,7/8],
R = [l,1].
3. Background
For domain-theoretic concepts, the reader is referred to [1,26], and for topological concepts to [32,33] (see
also [16]). Here we briefly summarize the notions and facts that are relevant to our purposes.
3.1. Continuous domains
Let P be a set with a preorder ?. For a subset X of P and an element x ∈ P we write
↓X = {y ∈ P | y ? x for some x in X},
↑X = {y ∈ P | x ? y for some x in X},
↓x = ↓{x},
We also say that X is a lower set iff X = ↓X, and that X is an upper set iff X = ↑X.
Let x and y be elements of a directed complete partial order (dcpo) D. We say that x is way-below or approximates
y, denoted x ? y, if for every directed subset A of D, y ?
x is compact if it approximates itself. We define↑ ↑x = {y ∈ D | x ? y},↓ ↓x = {y ∈ D | y ? x} and
K(D) = {x ∈ D | x is compact}. We say that a subset B of a dcpo D is a basis for D, if for every element x
of D the set↓ ↓x ∩ B contains a directed subset with supremum x. A dcpo is called a continuous domain or simply a
domain if it has a basis. A dcpo is called an algebraic domain if it has a basis of compact elements. An example of an
algebraic domain is the domain T⊥= {⊥,false,true} of booleans, ordered by ⊥ ? false,⊥ ? true. A function f
from a domain D to a domain E is Scott continuous if it is monotone and f (?A) =?f (A) for all directed subsets
↑x = ↑{x}.
?A implies ∃a ∈ A with x ? a. We say that
Page 6
J.R. Marcial-Romero, M.H. Escard´ o / Theoretical Computer Science 379 (2007) 120–141125
A of D. A Scott closed subset of a domain D is a lower set closed under a directed supremum. We say that a Scott
closed set is finitely generated if it is the lower set of a finite set. The following is easily established:
Lemma 3.1. If D is a continuous domain, C a finitely generated Scott closed subset of D and f : D → D Scott
continuous then
↓{ f (x) | x ∈ C} = cl{ f (x) | x ∈ C}.
where cl denotes topological (Scott) closure.
3.2. The interval domains R and I
The set R of non-empty compact subintervals of the Euclidean real line ordered by reverse inclusion,
x ? y iff x ⊇ y,
is a continuous domain, referred to as the interval domain. Here intervals are regarded as “partial numbers”, with the
singleton intervals playing the role of “total numbers”. If we add a bottom element to R, then R becomes a bounded
complete continuous domain R⊥. For any interval x ∈ R, we write
x = inf x
so that x = [x,x]. Its length is defined by
κx= x − x.
A subset A ⊆ R has a least upper bound iff it has non-empty intersection, and in this case
?
The way-below relation of R is given by
x ? y iff x < y and y < x.
A basis for R is given by the intervals with distinct rational (alternatively dyadic) end-points.
The set I of all non-empty closed intervals contained in the unit interval [0,1] is a bounded complete, countably
based continuous domain, referred as the unit interval domain. The bottom element of I is the interval [0,1].
3.3. Powerdomains
andx = sup x
A =
?
A =
?
sup
a∈A
a, inf
a∈Aa
?
.
Powerdomains [24,30,31] are usually constructed as ideal completions [18] of finite subsets of basis elements.
For our purposes, it is more convenient to work with their topological representations [26,1,19], which we now
summarize. It is enough for our purposes to restrict attention to ω-continuous dcpos, which we refer to as domains in
this subsection.
A subset A of a dcpo D is called Scott closed if it is closed in the Scott topology, that is, if it is a lower set and
is closed under the formation of suprema of directed subsets. We use the notation cl(A) for the topological closure
of A, i.e. the smallest Scott closed set containing A. A lense is a non-empty set that arises as the intersection of a
Scott-closed set and a Scott compact upper subset. Here the notion of Scott compact set is to be understood in the
topological sense (every cover consisting of Scott open sets has a finite subcover). On the set of lenses of a dcpo D,
we define the topological Egli–Milner ordering, ?TEMby K ?TEML if L ⊆ ↑K and K ⊆ cl(L). Notice that in
a finite domain such as the flat domain of booleans, the lenses are just order-convex sets, and that the topological
Egli–Milner order coincides with the usual order-theoretical one [16]. This is because in a finite domain the closed
sets are precisely the lower sets, and all sets are compact.
The Plotkin powerdomain PPD of a domain D consists of the lenses of D under the Egli–Milner order, and the
formal-union operation A ∪ B is given by actual union A ∪ B followed by topological convex closure (intersection
of all convex closed sets containing it). There is a natural topological embedding η: D → PPD given by x ?→ {x}.
Page 7
126 J.R. Marcial-Romero, M.H. Escard´ o / Theoretical Computer Science 379 (2007) 120–141
The Smyth powerdomain PSD consists of the set of non-empty Scott-compact upper subsets ordered by reverse
inclusion, with formal union given by actual union. In this case, we have a natural topological embedding η: D →
PSD given by x ?→ ↑x.
The Hoare powerdomain PHD consists of all non-empty Scott-closed subsets of D ordered by inclusion. Because
we use this to obtain a denotational model of our language, we consider it in more detail. Least upper bounds are
given by
?
The construction is the functor part of a monad, with action on continuous maps given by
? f : PHD → PHE
for any f : D → E. Its unit is given by
ηD: D → PHD
x ?→ ↓x,
which is also a topological embedding. Instead of considering multiplication, one can equivalently consider the
extension operator [21, Proposition 2.14], in this case given by
¯f : PHD → PHE
A ?→ cl
a∈A
for any continuous map f : D → PHE. Finally, formal unions are given by actual unions as in the case of the Smyth
powerdomain:
i∈I
Ai= cl
?
i∈I
Ai.
A ?→ cl f [A]
?
f a
A ∪ B = A ∪ B.
4. Semantics of the multi-valued construction
In order to make the development of the introduction precise, we assume that we are given a functorial
powerdomain construction P, in a suitable category of domains, with a natural embedding
ηD: D → PD
and a continuous formal-union operation
(− ∪ −): PD × PD → PD
for every domain D. Then the definition of the function rtesta,b: R → PT, where a < b are real numbers, can be
formulated as
need to embed the real line into a domain of total and partial real numbers. We choose to work with the domain R⊥,
where R is the interval domain introduced in Section 3. Similarly, as usual, we enlarge the domain T of booleans with
a bottom element. Hence we have to work with an extension R⊥→ PT⊥of the above function, which we denote by
the same name:
rtesta,b
− − − − → PT
?
rtesta,b(x) =
η(true),
η(true) ∪ η(false),
η(false),
if x ∈ (−∞,a],
if x ∈ (a,b),
if x ∈ [b,∞).
Because in our language there will be computations on the reals that diverge or fail to fully specify a real number, we
R
?
R⊥
rtesta,b
− − − − → PT⊥
Page 8
J.R. Marcial-Romero, M.H. Escard´ o / Theoretical Computer Science 379 (2007) 120–141 127
Fig. 1. Powerdomains of T⊥.
For the moment, we do not insist on any particular extension. However, in order for a powerdomain construction
to qualify for a denotational model of the language, the minimum requirement is that it makes the rtesta,bfunction
continuous.
Lemma 4.1. If rtesta,b: R⊥ → PT⊥ is a continuous extension of the function rtesta,b : R → PT, then the
inequalities
η(true) ? η(true) ∪ η(false),
η(false) ? η(true) ∪ η(false)
must hold in the powerdomain PT⊥.
Proof. Because the embedding R ?→ R⊥is continuous when R is endowed with its usual topology and R⊥with its
Scott topology, so is its composition with the function rtesta,b: R⊥→ PT⊥, which we denote by r : R → PT⊥.
(This is the diagonal of the above commutative square.) In any dcpo, the relation d ? e holds if and only if every
neighbourhood of d is a neighbourhood of e. Let V be a neighbourhood of t := η(true). We have to show that
n := η(true) ∪ η(false) ∈ V. The set U := r−1(V) is open in R by continuity of r : R → PT. Because
r(a) = t ∈ V, we have that a ∈ r−1(V) = U. Hence, because U is open in R, there is an open interval (u,v) with
a ∈ (u,v) ⊆ U. Choose x such that a < x < v and x < b, that is, such that x ∈ (a,b)∩(u,v) ⊆ U. By construction,
r(x) = n. But x ∈ r−1(V), which shows that n ∈ V and hence that t ? n, which amounts to the first inequality. The
second inequality is obtained in the same way.
?
Thus, any powerdomain not satisfying the above two inequalities does not qualify for a model. In particular,
this rules out the Plotkin and Smyth powerdomains, Fig. 1. In fact, for the Plotkin powerdomain one has that
η(true) = {true} and η(false) = {false}, and their formal union is {true,false} because this set is order-convex,
but the sets {true} and {true,false} are incomparable in the Egli–Milner order. For the Smyth powerdomain, the same
sets are obtained by the embedding, formal union is given by actual union, and hence the inequalities do not hold
because the order is given by reverse inclusion. We omit routine proofs of the fact that e.g. the mixed [17] and the
sandwich [5] powerdomains also fail to satisfy the inequalities and hence to make the rtesta,bconstruction continuous.
Page 9
128 J.R. Marcial-Romero, M.H. Escard´ o / Theoretical Computer Science 379 (2007) 120–141
On the other hand, for the Hoare powerdomain, the inequalities do hold. In fact, η(true) = {true,⊥} and
η(false) = {false,⊥}, their formal union is their actual union {true,false,⊥}, and the ordering is given by inclusion.
Moreover:
Proposition 4.2. There is a continuous extension rtestH
a,b: R⊥→ PHT⊥of the function rtesta,b: R → PT.
Proof. The functions f,g: R⊥→ PT⊥defined by
?
⊥,
?
⊥,
are easily seen to be continuous, and they are consistent because η(true) and η(false) are consistent elements. Hence
their join
f (x) =
η(true),
if x ⊆ (−∞,b),
otherwise,
g(x) =
η(false),
if x ⊆ (a,∞),
otherwise,
rtestH
a,b= f ? g
is well-defined and continuous. An easy verification shows that this function has the required extension property.
?
As we want to match our model with the operational semantics of the construction, it would be desirable to
distinguish between the elements {true} and {true,⊥} in the model. However, the Hoare powerdomain does not
distinguish them, and, on the other hand, as we have just seen, other powerdomains do not give a continuous
interpretation of our construction. In order to overcome this problem when the Hoare powerdomain is used as a
denotational model, one usually decomposes proofs of program correctness into partial correctness and termination.
A related approach is considered in Section 6.
From now on, we denote rtestH
the situation 0 < a < b < 1 and the restriction of this function to the domain I of closed subintervals of the interval
[0,1], again written rtesta,b: I → PT⊥.
a,b: R⊥→ PHT⊥simply by rtesta,b. In our applications, we are only interested in
4.0.0.1. Remark on the boundary cases of rtest. Before proceeding to the main goal of this paper, we briefly digress
to discuss a natural variation rtest?
a,b: R → PT of the rtesta,bconstruction, defined by
rtest?
a,b(x) =
η(true),
η(true) ∪ η(false),
η(false),
if x ∈ (−∞,a),
if x ∈ [a,b],
if x ∈ (b,∞).
With a proof similar to that of Lemma 4.1, we conclude that if rtest?
a,bis continuous then
η(true) ∪ η(false) ? η(true)
η(true) ∪ η(false) ? η(false).
This rules out the Plotkin and Hoare powerdomains, but not the Smyth powerdomain. However, it is not clear what the
operational counterpart of this function would be. The function rtesta,bis operationally computable because, for any
argument x given intensionally as a shrinking sequence of intervals, the computational rules systematically establish
one of the semidecidable conditions a < x and x < b. However, the conditions a ≤ x and x ≤ b are not semi-
decidable, and hence it is not immediately apparent what a computationally adequate operational semantics for rtest?
would be. But it is interesting, as pointed out by one of the referees, that the cotransitivity law given in the introduction
as a constructive justification of rtest can be equivalently formulated as “a ≤ x or x ≤ b whenever a < b”. In any
case, it is not clear to us, at the time of writing, whether or how this reformulation of the cotransitivity law would lead
to a computational mechanism for rtest?.
Page 10
J.R. Marcial-Romero, M.H. Escard´ o / Theoretical Computer Science 379 (2007) 120–141129
5. A programming language for sequential real-number computation
We introduce the language LRT for the rtest construction, which amounts to the language considered by
Escard´ o [11] with the parallel conditional removed and a constant for rtesta,badded. We remark that this is a call-
by-name language. Because real-number computations are infinite, and there are no canonical forms for partial real-
number computations, it is not clear what a call-by-value operational semantics ought to be. We leave this as an open
problem.
5.1. Syntax
The language LRT is an extension of PCF with a ground type for real numbers and suitable primitive functions for
real-number computation. Its raw syntax is given by
x ∈ Variable,
t ::= nat | bool | I | t → t,
P ::= x | n | true | false | (+1)(P) | (−1)(P) |
(= 0)(P) | if P then P else P | consa(P) |
taila(P) | rtesta,b(P) | λx : t.P | PP | YP,
where the subscripts of the constructs cons, tail are rational intervals and those of rtest are rational numbers. (We
apologize for using the letters a and b to denote numbers and intervals in different contexts.) Terms of ground type I
are intended to compute real numbers in the unit interval.
It is convenient for our purposes to first define the denotational and then the operational semantics.
5.2. Denotational semantics
The ground types bool,nat and I are interpreted as the Hoare powerdomain of the domains of booleans, natural
numbers and intervals, respectively. Function types are interpreted as function spaces in the category of dcpos:
?bool? = PHT⊥,
This reflects the fact that we are considering a call-by-name language.
The interpretation of constants in LRT is defined as follows:
?nat? = PHN⊥,
?I? = PHI,
?σ → τ? = ?σ? → ?τ?.
?true? = η(true),
?consa? = ?
?false? = η(false),
?taila? =?
if B = η(true),
if B = η(false),
X ∪ Y,
⊥,
are defined as in Section 3.3, the functions (+1),(−1),(= 0) are the standard interpretations
in the Scott model of PCF, the functions consa,tailaare defined in Section 2, and the function rtesta,bis defined in
Section 4.
?n? = η(n),
?(+1)? =?
?rtesta,b? = rtesta,b,
(+1),
consa,
?(−1)? =?
?Y?(F) =
X,
Y,
(−1),
?(= 0)? =?
Fn(⊥),
(= 0),
taila,
?
n≥0
?if?(B, X,Y) =
Here the symbols η,?,
if B = η(true) ∪ η(false),
if B = ⊥.
5.3. Operational semantics
We consider a small-step style operational semantics for our language. We define the one-step reduction relation
→ to be the least relation containing the one-step reduction rules for evaluation of PCF [25] together with those given
below.
Page 11
130 J.R. Marcial-Romero, M.H. Escard´ o / Theoretical Computer Science 379 (2007) 120–141
We first need some preliminaries. For intervals a and b in I, we define
ab = consa(b),
where cons is the extension to the interval domain of the function defined in Section 2. This operation is associative,
and has the bottom element of I as its neutral element [11]:
(ab)c = a(bc),
Moreover,
a⊥ = ⊥a = a.
a ? b ⇐⇒ ∃c ∈ I. ac = b,
and this c is unique if a has non-zero length, i.e. it is not maximal, and in this case we denote c by
b \ a.
For intervals a and b, we define
a ≤ b ⇐⇒ a ≤ b
and
a ↑ b ⇐⇒ ∃c. a ? c and b ? c.
With this notation, the rules for Real PCF as defined in [11] are:
(1) consa(consbM) → consabM
(2) consaM → consaM?
(3) taila(consbM) → YconsL
(4) taila(consbM) → YconsR
(5) taila(consbM) → consb\aM
(6) taila(consbM) → cons(a?b)\a(tail(a?b)\bM)
if M → M?and (1) is not applicable
if b ≤ a
if b ≥ a
if a ? b and a ?= b
if a ↑ b,a ?? b,b ?? a,
b ? a and a ? b
if M → M?and (3)–(6) are not applicable
(7) taila(M) → taila(M?)
(8) if true M N → M
(9) if false M N → N
(10) if M N1N2→ if M?N1N2
For our language LRT, we add:
(11) rtestb,c(consaM) → true if a < c,
(12) rtestb,c(consaM) → false if b < a,
(13) rtestb,cM → rtestb,cM
Remark 5.1. (1) Rule 1 plays a crucial role and amounts to the associativity law. The idea is that both a and b
give partial information about a real number, and ab is the result of gluing the partial information together in an
incremental way. See the paper [11] for a further discussion, including a geometrical interpretation.
(2) Notice that if the interval a is contained in the interval [b,c], rules 11 and 12 can be applied.
(3) Rules 11–13 cannot be made deterministic given the particular computational adequacy formulation which is
proved in Section 5.4. We shall show that the set of rewrite rules is rich enough to allow one to derive operationally
everything that the denotational semantics suggests. This does not mean that we are giving a specification for an
implementation of LRT. In the absence of rtestb,c, rules 1–10 are deterministic without loss of computational
adequacy. See Section 6 for a further discussion.
(4) In practice, one would like to avoid divergent computations by considering a strategy for application of the rules.
This is the topic of Section 6 where we study total correctness. For the purposes of this section, we consider the
non-deterministic view.
if M → M?and (8), (9) are not applicable
?if M → M
?.
Page 12
J.R. Marcial-Romero, M.H. Escard´ o / Theoretical Computer Science 379 (2007) 120–141131
We now introduce a notion of operational meaning of a term, where the operational values are taken in a
powerdomain too. The difference between this operational semantics and the denotational semantics given above
is that the former is obtained by reduction but the latter is obtained, as usual, by compositional means.
Definition 5.2. Firstly, we define the operational meaning of closed terms M of ground types γ in i steps of
computation, written [M]i, which is to be an element of the domain ?γ?.
[M]i= ∪ {η(a) | ∃M?∃k ≤ i, M
(If this set is empty, then of course [M]i= ⊥.) Here the relation
If M : nat, then we define
[M]i= ∪ {η(n) | ∃k ≤ i, M
if this set is non-empty, and [M]i= ⊥ otherwise. The operational meaning of M : bool is defined similarly.
It is immediate that [M]i? [M]i+1. Hence we can define
[M] =
i
If M : I, then we define
k
→ consaM?}.
k
→ denotes the k-fold composition of the relation →.
k
→ n}
?
[M]i.
Of course, only in the case of the ground type of real numbers this definition is non-trivial, but it is convenient to have
a uniform treatment for all types.
5.4. Computational adequacy
In our setting, computational adequacy amounts to the equation [M] = ?M? for all closed terms M of ground type,
For a deterministic language such as PCF, soundness of the denotational semantics follows from the fact that
M → N implies ?M? = ?N?. For our non-deterministic language, we rely on the following:
Proof. The proof is by structural induction on M.
If M is a value, there is nothing to prove.
Suppose M ≡ (−1)M?and M → N, there are three rules that apply to the predecessor.
First case: M ≡ (−1)k0and (−1)k0→ k0≡ N,
?(−1)k0? =?
Second case: M ≡ (−1)kn+1→ kn≡ N,
?(−1)kn+1? =?
Third case: M ≡ (−1)M?and M → (−1)N?if M?→ N?. By the induction hypothesis, ?M?? = ∪ {?N?? | M?→
?M? = ?(−1)M?? =?
= ∪ {?(−1)N?? | M?→ N?},
The proof for the other constants follows similarly, except for rtesta,b, whose proof we include below.
Suppose M = rtestp,q(M?). There are three possible cases:
where [M] is the operational meaning of M and ?M? is the denotational meaning of M defined above.
Lemma 5.3. ?M? =∪ {?N? | M → N} (notice that this is a finite union).
(−1)?k0? =?
(−1){0,⊥} = cl{(−1)0,(−1)⊥}
= cl{0,⊥} = {0,⊥} = ?k0? = ?N?.
(−1)(?kn+1?) =?
(−1){n + 1,⊥} = cl{(−1)n + 1,(−1)⊥}
= cl{n,⊥} = {n,⊥} = ?kn? = ?N?.
(−1) to both sides of the equation:
(−1)?M?? =?
N?}, applying?
(−1)?∪ {?N?? | M?→ N?}?
= ∪ {?
(−1)?N?? | M?→ N?}
as we wanted.
Page 13
132 J.R. Marcial-Romero, M.H. Escard´ o / Theoretical Computer Science 379 (2007) 120–141
First case: M is of the form rtestp,q(M?) where M?is not a consaterm. Hence, the only single-step reductions
available are of the form M → rtestp,qN?where M?→ N?. As the semantics of rtestp,qis rtestp,q, we get
?M? = rtestp,q
= ∪??rtestp,qN?? | M?→ N??
Second case: M is of the form rtestp,q(consa(M??)). Note that the above equality still holds but the last ∪ does
not exhaust the single-step derivations. Furthermore,
?∪??N?? | M?→ N???
= ∪?rtestp,q?N?? | M?→ N??
Since the last expression exhausts the terms that are single-step derivable from M, we are done with this case.
?M? = rtestp,q(?
?M? = ∪?rtestp,qN?| M?→ N??
Now rtestp,q(a) is exactly the set
???b? | M → b and b ∈ {true,false}?.
j
→ N}.
Lemma 5.4 (Soundness). For all closed terms M of ground type,
consa(M?)) ? rtestp,q(a).
As ∪ is inflationary, we can throw smaller terms into the above equation:
= rtestp,q(a) ∪
????rtestp,qN?? | M?→ N???
?
Hence, by induction on the length j of the evaluation using the previous lemma, for every j, ?M? = ∪ {?N? |
M
[M] ? ?M?.
[M]i? ?M?.
?consaM??, Lemma 5.3 shows that b ∈ ↓?consaM??. Therefore b ∈ ?M? because a ? consa(x) for all x ∈ I, and
In order to establish completeness, we proceed as in [25,11].
Proof. It suffices to show that, for all closed terms M of ground type,
Let b ∈ [M]i,b ?= ⊥. By definition, b ? a for some a and M?such that M
in particular for all x ∈ ?M??.
Definition 5.5. We define a notion of computability for closed terms by induction on types as follows:
(1) A closed term M of ground type is computable whenever ?M? ? [M],
of type σ,
An open term M : σ with free variables x1,...,xnof type σ1,...,σnis computable whenever [N1/x1]···[Nn/xn]M
is computable for every family Ni: σiof closed computable terms.
Because PH(D) is a continuous domain if D is, we have:
Lemma 5.6. A closed term M of ground type is computable iff for every X ? ?M? there is i with X ? [M]i.
supremum is [M], and hence there is i with X ? [M]i. (⇐) By continuity of the Hoare powerdomain of a continuous
domain, in order to show that ?M? ? [M], it suffices to show that for all X ? ?M?, X ? [M]. But this holds by
Recall the following from domain theory [1,16].
i→ consaM?. Because ?
consa?M?? =
?
(2) A closed term M : σ → τ is computable whenever MQ : τ is computable for every closed computable term Q
Proof. (⇒) Suppose that M is computable and let X ? ?M?. We have that [M]1? [M]2? ··· is a chain whose
hypothesis.
?
Page 14
J.R. Marcial-Romero, M.H. Escard´ o / Theoretical Computer Science 379 (2007) 120–141133
Lemma 5.7. For any continuous function f : D → E of continuous dcpos, if y ? f (x) then there is x?? x with
y ? f (x?).
Lemma 5.8 (Completeness). Every term is computable.
Proof. The proof is by structural induction on the formation rules of terms.
Constants: (1) rtestp,qis computable:
We have to show that
?rtestp,qM? ? [rtestp,qM]
?rtestp,qM? = rtestp,q?M?
= rtestp,q
for computable M. So
? rtestp,q[M]
?
i
[M]i
=
?
?
?
?
i
rtestp,q[M]i
=
i
rtestp,q
??
η(a) | ∃M?∃k ≤ i.M →kconsaM??
rtestp,q(η(a)) | ∃M?∃k ≤ i.M →kconsaM??
rtestp,q(a) | ∃M?∃k ≤ i.M →kconsaM??
=
i
??
??
=
i
.
But when M →kconsaM?holds, so does rtestp,q(a) ? [rtestp,qM]k+1? [rtestp,qM]. So the directed sup of
formal joins also lies below [rtestp,qM].
(2) if is computable:
We have to show that
?if L M N? ? [if L M N].
M. Hence, ?M? ? [if L M N]. Similarly, if η(false) ? ?L?, then ?M? ? [if L M N]. Now, we need the four
Because ∪ is inflationary (and η(⊥) is the identity for it); in all four cases ?if L M N? ? [if L M N].
Assume that ?consaM? ?= ⊥ for a computable term M of type I. Let Y ? ?consaM? = ?
Y ? ?
there is t ∈ [M]jwith m ? consa(t) = at. Because there is t ∈ [M]j, we deduce that there is M?such that the
reduction M
→ constM?, k ≤ j holds, and so consaM
i = j + 1.
(4) tailais computable:
We have to show that if M is computable, then so is tailaM. Assume that ?tailaM? ?= ⊥ for a computable term
follows that [M]j ?? {a} in the Egli–Milner order, and if [M]j ? {a} then Y ??
Suppose η(true) ? ?L?. By the induction hypothesis, ?L? ? [L], so L →ltrue for some l. Thus if L M N →l+1
?L? = η(false), then ?if L M N? = ?N?; and if ?L? = η(true) ∪ η(false), then ?if L M N? = ?M? ∪ ?N?.
(3) consais computable:
We have to show that if M is computable, then so is consaM.
cases of the proof: if ?L? = η(⊥), then ?if L M N? = η(⊥); if ?L? = η(true), then ?if L M N? = ?M?; if
consa?M?. We need
consa[M]j, by Lemma 3.1
to show that there is i with Y ? [consaM]i. By Lemma 5.7, there is X ? ?M? with Y ? ?
consa[M]j. So for every y ∈ Y, there is m ∈ ?
consaX. As M is
consa, we have thatcomputable, there is j such that X ? [M]j. Because Y ? ?
consaX and by monotonicity of ?
consa[M]j, with y ? m. Let m ∈ ?
kk
→ consa(constM?)
1
→ consatM?. Hence we can take
M of type I. Let Y ? ?tailaM? =?
cl{⊥} = {⊥}. Then exactly one of the following four cases holds:
taila?M?. We need to show that there is i with Y ? [tailaM]i. By Lemma 5.7,
there is X ? ?M? with Y ??
tailaX. As M is computable, there is j such that X ? [M]j. Because Y ?= {⊥}, it
tailaX ??
taila[M]j ??
taila{a} =
Page 15
134 J.R. Marcial-Romero, M.H. Escard´ o / Theoretical Computer Science 379 (2007) 120–141
(a) [M]j ≤ {a}: Then since X ? [M]j, we have that?
t ∈ [M]jwith m ? tailat. Because there is t ∈ [M]jit follows that there is M?such that M
Because [M]j≤ {a} we conclude that tailaM
(b) {a} ≤ [M]jSimilar to 1.
(c) {a} ? [M]j: Then since X ? [M]j, we have that?
t ∈ [M]jwithm ? tailat = t\a.Because thereist ∈ [M]jitfollowsthatthere is M?suchthat M
holds. We conclude that tailaM
→ taila(constM?)
(d) {a} ↑ [M]j: Then since X ? [M]j, we have that?
so there is t ∈ [M]jwith m ? tailat = (a ? t) \ a. Because there is t ∈ [M]jit follows that there is M?such that the
reduction M
→ constM?,k ≤ j holds. We conclude that tailaM
can take i = k + 1.
(5) For M ≡ (+1),(−1),(= 0) the proof is similar to the if case.
(6) If M is computable so is λαM:
We must show that LN1,... Nnis computable whenever N1,... Nnare closed computable terms and L is a closed
instantiation of λαM by computable terms. Here L must have the form λαM?where M?is an instantiation of all free
variables of M, except α, by closed computable terms.
If P ? ?LN1... Nn? then we have P ? ?[N1/α]M?N2... Nn? = ?LN1... Nn?. But [N1/α]M?is computable
evaluate [N1/α]M?N2... Nn. Hence we can take i = j.
(7) Yσis computable:
In order to prove that Yσis computable it suffices to show that the term
tailaX ??
taila[M]j and since Y ??
tailaX, we have
Y ??
taila[M]j. So for every y ∈ Y, there is m ∈?
taila[M]jwith y ? m. Let m ∈?
k
→ taila(constM?)
taila[M]j, so by Lemma 3.1 there is
k
→ constM?,k ≤ j holds.
→ YconsL. Hence we can take i = k + 1.
1
tailaX ??
taila[M]j= {b \ a | b ∈ [M]j} and since Y ??
tailaX,
we have that Y ??
taila[M]j. So for every y ∈ Y, there is m ∈?
k
taila[M]jwith y ? m. Let m ∈?
→ tailmM?. Hence we can take i = k + 1.
tailaX ??
k
→ taila(constM?)
taila[M]j, so there is
k
→ constM?,k ≤ j
1
taila[M]j = {(a ? b) \ a | b ∈ [M]j} and since
taila[M]jwith y ? m. Let m ∈?
Y ??
tailaX, we have that Y ? taila[M]j. So for every y ∈ Y, there is m ∈?
taila[M]j,
k
1
→ tailmM?. Hence we
and so therefore [N1/α]M?N2... Nn. Hence there is j with P ? [[N1/α]M?N2... Nn]j. Since LN1... Nn →
[N1/α]M?N2... Nn and the reduction relation preserves meanings, in order to evaluate LN1... Nn it suffices to
Y(σ1,...,σk,PI)N1··· Nk
is computable whenever N1: σ1,..., Nk: σkare closed computable terms. It follows from (6) above that the terms
Y(n)
σ
are computable and that the combination and abstraction formation rules preserve computability.
Let P ? ?YN1··· NK? be different from ⊥. Because ?Y? =??Y(n)?, by a basic property of the way-below relation
P ? [Y(n)N1··· Nk]j. Since there is a term M with Y(n)N1··· Nk
order (see [25,11]), and Lemma 5.9 below, Y(n)? Y we have that YN1··· Nk
i = j.
As in the last part of the above proof, we denote the syntactic order by ? (see [25] or [11]).
:= λf. fn(⊥) are computable, because the proof of computability of Y(n)
σ
depends only on the fact that variables
of any continuous dcpo, there is some n such that P ? ?Y(n)N1··· NK?. Since Y(n)is computable, there is j with
j
→ conscM. Using the syntactic information
j
→ conscM for some M and therefore
?
Lemma 5.9. If M ? N and M → M1, M → M2,..., M → Mnthen either ∀i, Mi? N,1 ≤ i ≤ n or else for some
terms N1, N2,..., Nm, N → N1, N → N2,..., N → Nm, and ∀Mi,∃Nj, Mi? Nj,1 ≤ i ≤ n,1 ≤ j ≤ m.
Proof. The case that we must consider is the one that involves rtesta,b. The other cases are treated as in Real PCF.
(1) rtesta,bM ? rtesta,bM holds by definition.
(2) M ≡ rtesta,bM?? rtesta,bM??≡ N and M → true. These conditions hold if rtesta,bM” →
rtesta,b(conscM???) and c < b. By the induction hypothesis, M?→ M??so rtesta,bM??→ rtesta,b(consdMiv)
where d < b so rtesta,bM??→ true and true ? true.
(3) M ≡ rtesta,bM?? rtesta,bM??≡ N and M → false. Similar to the previous case.
(4) M ≡ rtesta,bM?? rtesta,bM??≡ N and M → true, M → false. These follow if rtesta,bM →
rtesta,b(conscM???) and a
<
c
<
b. By the induction hypothesis, M?
→
M??so rtesta,bM??
→
Download full-text