probabilisticcomputations,andtheircombinationwithnondeter-minism.Final - PDF document

probabilisticcomputations,andtheircombinationwithnondeter-minism.Finally,wereturntoHuttonandFulger'streerelabellingprobleminSection9,andSection10concludes.ButwestartinSection2withsomebackgroundonmonads.2.BackgroundAsiswellknown[16,38],thecategoricalnotionofamonadpre-ciselyexpressesanabstractionofsequentialcomputations,whichisnecessaryforcontrollingtheconsequencesofcomputationalef-fectsinalazyfunctionalprogramminglanguage.The`return'and`bind'methodsmodeltheidentityandsequentialcompositionofcomputations,respectively.Theyarecapturedinthefollowingtypeclass:classMonadmwherereturn::a!ma(��=)::ma!(a!mb)!mbThetwooperationsarerequiredtosatisfythreelaws,correspondingtothemonoidalpropertiesofsequentialcomposition:returnx��=k=kxmx��=return=mx(mx��=k)��=k0=mx��=(lx!kx��=k0)Wewillmakeuseoftwoimportantspecializationsoftheoperationsassociatedwithamonad,whichmorepreciselymatchtheideaoftheidentitycomputationandsequentialcomposition:skip::Monadm)m()skip=return()(��)::Monadm)ma!mb!mbmx��my=mx��=constmyWewillalsomakesignicantuseofthederivedoperatorliftM::Monadm)(a!b)!ma!mbliftMfmx=mx��=returnfThereadermayenjoycheckingthattheunitandassociativitypropertiesimplythatliftMsatisesthemaplawsofafunctor:liftMid=idliftM(fg)=liftMfliftMgAnuncurriedversionofHaskell'sliftM2canbedenedasliftMfpair,wherepairsequencesapairofmonadiccomputations:pair::Monadm)(ma;ma)!m(a;a)pair(mx;my)=mx��=lx!my��=ly!return(x;y)2.1ImperativefunctionalprogrammingThereturnandbindoperationsoftheMonadclassaresufcienttosupportaveryconvenientmonadcomprehensionor`do'nota-tionforcomputations,offeringanelegantimperativeprogrammingstyle[37,23].Thebodyofadoexpressionconsistsofanon-emptysequenceofqualiers,whichmaybeexpressions,generators,orlocaldenitions—exceptforthelastqualier,whichmustbeanexpression.Inthispaper,werestrictattentiontopatternsconsistingofsimplevariablesortuplesofsuch;thenthedonotationcanbedenedintermsofjust��=andordinarylet(andreturn,whichisusuallyneededforthenalexpression):dofeg=edofe;esg=e��dofesgdofx e;esg=e��=lx!dofesgdofletdecls;esg=letdeclsindofesgForexample,analternativedenitionofpairispair(mx;my)=dofx mx;y my;return(x;y)g(Moregenerally,thepatternmatchagainstageneratedvaluemightberefutable;thensomemechanismforhandlingfailedmatchesisnecessary.InHaskell,theMonadclasshasanadditionaloperationfailforthispurpose;wewilldowithout.)Thedonotationmakesitclearerthatthemonadlawsarenotawkwardimpositions,butpropertiesessentialformanipulatingse-quentialcompositionsandblocks:dofy returnx;kyg=dofkxgdofx mx;returnxg=dofmxgdofx mx;y kx;k0yg=dofy dofx mx;kxg;k0ygwhere,inthethirdlaw,xisnotfreeink0.Thersttwolawsstatethatreturnisaunitofsequentialcomposition,andthethirdthatnestedblockscanbeattened,givenappropriatecareoverboundvariables.3.Acounterexample:TowersofHanoiTheMonadclassspeciesonlytheverybasicgeneral-purposeplumbingofsequentialcomposition.Toobtainanyinterestingcomputationaleffects,onemustaugmenttheinterfacewithad-ditionalmethods.Inthispaper,wewillconsistentlydothisbydeningsubclassesofMonad,ratherthanbydeclaringinstancesofMonadwithadditionaloperations;andwewillstudiouslyprogramandreasonaccordingtotheinterface,nottoaparticularimplemen-tation.Forexample,hereisaclassofmonadssupportingasimpleeffectofcounting:classMonadm)MonadCountmwheretick::m()AndhereisaprogramforsolvingtheTowersofHanoiproblem—itticksthecounteronceforeachmoveofadisc.hanoi::MonadCountm)Int!m()hanoi0=skiphanoi(n+1)=hanoin��tick��hanoinWeclaimthathanoin=rep(2n�1)tickwherereprepeatsaunitcomputationaxednumberoftimes:rep::Monadm)Int!m()!m()rep0mx=skiprep(n+1)mx=mx��repnmx(ThisisatypespecializationofthefunctionreplicateM intheHaskellstandardlibrary.)Notethatrep1mx=mxrep(m+n)mx=repmmx��repnmxThevericationofhanoiisbyinductiononn.Thebasecaseistrivial;fortheinductivestep,weassumetheresultforn,andcalculate:hanoi(n+1)=[[denitionofhanoi]]hanoin��tick��hanoin=[[inductivehypothesis]]rep(2n�1)tick��tick��rep(2n�1)tick=[[propertyofrep]]rep((2n�1)+1+(2n�1))tick=[[arithmetic]]rep(2n+1�1)tick Wehaveinmindtheclassofeffectcalledexceptions.Aswithnondeterminism,thereisaspecialconstantfail,whichisaleftzeroofcomposition.Thereisalsoabinaryoperator,whichwewillcallcatch,whichformsamonoidinconjunctionwithfail.WecapturethelatterbymeansofadistinctsubclassMonadExceptofMonadFail:classMonadFailm)MonadExceptmwherecatch::ma!ma!maTheideaisthatfailraisesanexception,andthatcatchmhexecutesbodym,butpassescontroltothehandlerhifanexceptionisraisedduringtheexecutionofm.Thisoperationalintuitionisexpressedaxiomaticallybythelaws—thatcatchandfailformamonoid:catchfailh=hcatchmfail=mcatchm(catchhh0)=catch(catchmh)h0thatunexceptionalbodiesneednohandler:catch(returnx)h=returnxandthatexceptionsareleft-zerosofsequentialcomposition:fail��mx=failNootherpropertiesareexpected;inparticular,weexpectthatingeneraldistributivityofcompositionoverexceptionhandlerswillfail:(catchmh)��=k6=catch(m��=k)(h��=k)—exceptionsraisedbykontheleft-handsidemaybeerroneouslyhandledontheright-handside.Conversely,withnondeterminismthereisnorequirementthatpurecomputationsareleftzerosof.5.1FastproductWecanillustratereasoningwithexceptionsviathe`fastproduct'algorithm,whichmultipliestheelementsofalistofintegers,butraisesanexceptionifitndsazero,subsequentlycatchingtheexceptionandreturningzerofortheoverallproduct.Wedenefastprod::MonadExceptm)[Int]!mIntfastprodxs=catch(workxs)(return0)whereworkisspeciedbywork::MonadFailm)[Int]!mIntworkxs=if02xsthenfailelsereturn(productxs)Andwecalculate:fastprodxs=[[denitionoffastprod]]catch(workxs)(return0)=[[specicationofwork]]catch(if02xsthenfailelsereturn(productxs))(return0)=[[liftouttheconditional]]if02xsthencatchfail(return0)elsecatch(return(productxs))(return0)=[[lawsofcatch,fail,andreturn]]if02xsthenreturn0elsereturn(productxs)=[[arithmetic:02xs=)productxs=0]]if02xsthenreturn(productxs)elsereturn(productxs)=[[redundantconditional]]return(productxs)Thus,fastprodispure,neverthrowinganunhandledexception.Moreover,workmayberenedseparately,toeliminatethemultipletraversals;onecanusetheuniversalpropertyoffoldrtoderivework=foldrnext(return1)wherenextnmx=ifn 0thenfailelseliftM(n)mxThetwostepsofthecalculationconcerningconditionalsdependonlyonpurereasoning:fornon-bottombooleanb,wehave:ifbthenfxelsefy=f(ifbthenxelsey)ifbthenxelsex=x6.StatefulcomputationsPerhapstheforemostclassofeffectthatspringstomindisthatofstatefulcomputations.ThesearecapturedbytheinterfaceclassMonadm)MonadStatesmjm!swhereget::msput::s!m()Here,theclassMonadStatesmdenotesmonadsminvolvingfunc-tionsthattransformastateoftypes;thedeclarationincludesafunctionaldependency,declaringthatmdeterminess.Theopera-tiongetyieldsacopyofthecurrentstate,andputoverwritesthestatewithanewvalue(returningunit);theyarerelatedbyfourax-ioms:puts��puts0=puts0puts��get=puts��returnsget��=put=skipget��=ls!get��=ks=get��=ls!kss6.1EightqueensAsanexampleofastatefulcomputation,weconsiderafewpro-gramsforthe`nqueens'problem.First,westartwithapurelyfunc-tionalimplementation,implicitlyplacingonequeenineachcolumnoftheboard,andexplicitlyassigningtherowsofthequeensfromthepermutationofthecolumnnumbers,sothatbyconstructionitisonlythediagonalsthatarepotentialthreats.Themaindatastructurewemanipulateisapairoflistsrecordingtheup-diagonalsanddown-diagonalsthreatenedbythequeenstotherightofagivencolumn,whereaqueeninposition(c;r)threatensup-diagonalr�canddown-diagonalr+c.Fornotationalbrevity,wedenetypeSquarea=(a;a)square::(a!b)!(Squarea!Squareb)squaref(a;b)=(fa;fb)andwrite`a2'and`f2'for`Squarea'and`squaref',respectively.Theessenceoftheprogramisthefollowingfunctiontest,whichtakesa(column,row)positionforaqueen,andlistsofalreadythreatenedup-anddown-diagonals,andreturnsapairconsistingofabooleanforwhetherthisqueenpositionissafe,andupdatedlistsofthreatenedup-anddown-diagonals.test::Int2![Int]2!(Bool;[Int]2)test(c;r)(ups;downs)=(u=2ups^d=2downs;(u:ups;d:downs))where(u;d)=(r�c;r+c)Predicatesafe1checksaputativeplacementofqueensforsafety,usingafoldfromrighttoleftoverthelistofcolumn-rowpairs.Thecarrier(Bool;[Int]2)ofthefoldconsistsofabooleanindicatingwhetherthequeenstotheright,whichhavealreadybeenchecked,aresafe,andtheup-anddown-diagonalsunderthreatfromthequeensconsideredsofar.safe1::[Int]2![Int2]!(Bool;[Int]2)safe1=foldrstep1start1 Fortheemptylist,wehave:dofuds get;let(ok;uds0)=safe1uds[];putuds0;returnokg=[[denitionofsafe1]]dofuds get;let(ok;uds0)=start1uds;putuds0;returnokg=[[denitionofstart1]]dofuds get;let(ok;uds0)=(True;uds);putuds0;returnokg=[[liftingthelet;get��=put=return()]]returnTrue=[[denitionofsafe2]]safe2[]whilefornon-emptylists,wehave:dofuds get;let(ok;uds0)=safe1uds(cr:crs);putuds0;returnokg=[[denitionofsafe1asafoldr]]dofuds get;let(ok;uds0)=step1cr(safe1udscrs);putuds0;returnokg=[[introducealet]]dofuds get;let(b0;uds00)=safe1udscrs;let(ok;uds0)=step1cr(b0;uds00);putuds0;returnokg=[[denitionofstep1]]dofuds get;let(b0;uds00)=safe1udscrs;let(b;uds000)=testcruds00;let(ok;uds0)=(b^b0;uds000);putuds0;returnokg=[[puts��puts0=puts0]]dofuds get;let(b0;uds00)=safe1udscrs;let(b;uds000)=testcruds00;let(ok;uds0)=(b^b0;uds000);putuds00;putuds0;returnokg=[[movetwoofthelets]]dofuds get;let(b0;uds00)=safe1udscrs;putuds00;let(b;uds000)=testcruds00;let(ok;uds0)=(b^b0;uds000);putuds0;returnokg=[[puts��get��=k=puts��ks]]dofuds get;let(b0;uds00)=safe1udscrs;putuds00;uds0000 get;let(b;uds000)=testcruds0000;let(ok;uds0)=(b^b0;uds000);putuds0;returnokg=[[associativityof��=]]dofb0 dofuds get;let(ok;uds00)=safe1udscrs;putuds00;returnokg;uds0000 get;let(b;uds000)=testcruds0000;let(ok;uds0)=(b^b0;uds000);putuds0;returnokg=[[denitionofstep2]]step2cr(dofuds get;let(ok;uds00)=safe1udscrs;putuds00;returnokg) Figure1.Provingtherelationshipbetweensafe2andsafe1inastatefulsetting,itamountstorememberingthecurrentstates,executingastatefulversionofqueens,andrestoringtheoriginalstatesagain.7.2Queens,explorativelyThereisamorenaturalgenerate-and-testalgorithmforthen-queensproblem:ratherthancomputingabooleanokforwhetheranarrangementofqueensissafe,andthenassertingok,weexplorethepossiblethreatstoeachqueeninturn,andimmediatelyaban-donthisarrangementifevertwoqueensconict.Howdoesthisalgorithmrelatetothepreviousone?Verystraightforwardly,asitturnsout.Sinceguardscommutewithanything,intheversionofthequeensprogramfromSection7.1,theputsandguardokinpar-ticularcommute,andwehave:queensn=dofs get;rs perms[1::n];putempty;ok safe2(placenrs);guardok;puts;returnrsgLetusthereforedenesafe3crs=safe2crs��=guardsothatqueensn=dofs get;rs perms[1::n];putempty;safe3(placenrs);puts;returnrsgNow,letusinvestigatesafe3.Recallthatsafe2isafold.Moreover,(��=guard)combineswiththatfoldusingthefusionproperty,aswenowshow.Theinitialvalueissimple:start2��=guard=guardTrue=skipFortheinductivestep,wehave:step2crk��=guard=[[denitionofstep2]]dofb0 k;uds get;let(b;uds0)=testcruds;putuds0;return(b^b0)g��=guard=[[do-notation]]dofb0 k;uds get;let(b;uds0)=testcruds;putuds0;guard(b^b0)g=[[guarddistributesoverconjunction]]dofb0 k;uds get;let(b;uds0)=testcruds;putuds0;guardb;guardb0g=[[guardscommutewithanything]]dofb0 k;guardb0;uds get;let(b;uds0)=testcruds;putuds0;guardbg=[[associativityof��=]]dof(k��=guard);uds get;let(b;uds0)=testcruds;putuds0;guardbg=[[denitionofstep3(seebelow)]]step3cr(k��=guard)wherewedene playswitch=uniform[True;True;False]playstick=uniform[False;False;True]Thekeyisthefactthatuniformchoicesareindependent,inthesensethatchoosingconsecutivelyfromtwouniformdistributionsisequivalenttochoosingsimultaneouslyfromtheircartesianproduct:pair(uniformx;uniformy)=uniform(cpxy)wherecp::[a]![b]![(a;b)]cpxy=[(a;b)ja x;b y]Weomitthestraightforwardproofbyinduction.Expandingdenitionsandexploitingindependenceofuniformchoices,wehaveplaystrategy=dof(h;p) uniform(cpdoorsdoors);t teasehp;s strategypt;return(s h)gSowecalculate:playstick=[[denitionofplay]]dof(h;p) uniform(cpdoorsdoors);t teasehp;s stickpt;return(s h)g=[[stickpt=returnp]]dof(h;p) uniform(cpdoorsdoors);t teasehp;return(p h)g=[[tunused,anduniformside-effect-free;liftM]]liftM(uncurry( ))(uniform(cpdoorsdoors))=[[naturalityofuniform;denitionofcp, ]]uniform[True;False;False;False;True;False;False;False;True]=[[simplifying:threeTrues,sixFalses]]uniform[True;False;False]andplayswitch=[[denitionofplay]]dof(h;p) uniform(cpdoorsdoors);t teasehp;s switchpt;return(s h)g=[[switchpt=return(the(doorsnn[p;t]))—seebelow]]dof(h;p) uniform(cpdoorsdoors);t teasehp;s return(the(doorsnn[p;t]));return(s h)g=[[returnisleftunit]]dof(h;p) uniform(cpdoorsdoors);t teasehp;return(h the(doorsnn[p;t]))g=[[caseanalysisonh p—seebelow]]dof(h;p) uniform(cpdoorsdoors);if(h p)thenreturnFalseelsereturnTrueg=[[liftoutconditional;booleans]]dof(h;p) uniform(cpdoorsdoors);return(h6 p)g=[[denitionofliftM]]liftM(uncurry(6 ))(uniform(cpdoorsdoors))=[[naturalityofuniform;denitionofcp, ]]uniform[False;True;True;True;False;True;True;True;False]=[[simplifying:threeFalses,sixTrues]]uniform[False;True;True]Forthesecondstepabove,notethattisbyconstructiondistinctfromp,andsodoorsnn[p;t]isasingleton;wethereforeintroducethefunctionthesuchthatthe[a]=a.Nowforthecaseanalysis.Forthecaseh=p,wehave:doft teasehp;return(h the(doorsnn[p;t]))g=[[usingh=p]]doft teasehp;return(h the(doorsnn[h;t]))g=[[hisnotindoorsnn[h;t]]]doft teasehp;returnFalseg=[[tunused,anduniformxside-effect-free]]dofreturnFalsegAndforthecaseh6=p,wehave:doft teasehp;return(h the(doorsnn[p;t]))g=[[denitionoftease]]doft uniform(doorsnn[h;p]);return(h the(doorsnn[p;t]))g=[[h6=p,sodoorsnn[h;p]isasingleton]]doflett=the(doorsnn[h;p]);return(h the(doorsnn[p;t]))g=[[h6=p,andt6=h;p;sot;h;pdistinct]]doflett=the(doorsnn[h;p]);return(h h)g=[[tunused]]dofreturnTruegThisconcludesourproofthatvosSavantwasright,andthatthemanymathematicsPhDswhowroteintoParademagazinechas-tizingherwere—atbest—thinkingaboutadifferentproblem.8.2ProbabilityandnondeterminismOnemightarguethatamoreaccuraterepresentationoftheMontyHallscenarioallowsthehostanondeterministicratherthanprob-abilisticchoiceinhidingandteasing:Montyisincharge,andno-bodysaysthathehastoplayfair.Theinteractionofnondeterministicandprobabilisticchoiceisnotoriouslytricky[40,15],butitturnsouttobemostlystraightfor-wardtogiveamodelintermsofmonads.WecombinethetwoclassesMonadAlt(interpretedcommutativelyandidempotently)andMonadProbofeffects:class(MonadAltm;MonadProbm))MonadAltProbmwhereAsbefore,therearenonewoperations.Butthereisanadditionallaw,relatingthetwokindsofchoice—probabilisticchoiceshoulddistributeovernondeterministic:m/p.(n1n2)=(m/p.n1)(m/p.n2)Intuitively,nofreedomislostfromtheprogramontheleftbymakingthenondeterministicchoicebeforetheprobabilisticoneratherthanafterwards.Asaconsequenceofthisdistributionproperty,thesemanticmodelisroughlyassetsofdistributions,asforexamplewiththeprobabilisticpredicatetransformerworkofMcIverandMorgan[15].Butnotquitesets;inordertoretaintheidempotenceofprobabilisticchoicemx/p.mx=mxwehavetolivewithequivalenceuptoconvexclosure[33]—thatis,ifacomputationmayyieldanytwodistributionsd;d0,thenitmayalsoyieldtheirconvexcombinationrd+¯rd0foranyrwith06r61.Thisisintuitivelyreasonable;ifd;d0arepossibleoutcomesofanexperiment,thenasequenceofexperimentsmayyieldanycombinationofdsandd0s.Thealternativesolution,promotedbyVaracca[34],istoabandonidempotence;thisisunappealingtous,becauseitmeansthatunusedchoices,suchasMonty'steaseinthefaceofthestickstrategy,cannotbediscarded.Asasimpleexampleofacomputationthatmixesnondetermin-isticandprobabilisticfeatures,considerthebasicoperationsofafaircointoss[15]:coin::MonadProbm)mBoolcoin=returnTrue/1=2.returnFalseandanarbitrarybooleanchoice: Inparticular,whenp=distinct,thenq=disjointsufces:theconcatenationoftwolistsisalldistinctifbothlistsarealldistinct,andtheyarealsodisjoint.Fortheremainderofthesection,wewilluseonlypandq,notdistinctanddisjointthemselves.Abstractingouttherelevantpropertiesofthepredicateishelpful,becauseitmeansthatthereasoningtofollowcanbegeneralizedtootherproblems.Forexample,wemightsupposethattheSymboltypeisnotjustanequalitytype,butanenumeration,andwewanttoprovethattreerelabellingyieldsacontiguoussegmentoftheenumerationofallsymbols—informally,thatnofreshsymbolsarewasted.Thenthesameconditiononsymbolssufces,butwherethepredicatepis`isacontiguoussegmentoftheenumeration'—thisissegmentclosed,withqbeingthepredicateonpairs`areadjacentsegments':q(xs;ys)=nullxs_nullys_(succ(lastxs) headys)9.2TreerelabellingTreerelabellingisatreefold,usingfreshateachtip.Givenafoldcombinatorfoldt::(a!b)!(b2!b)!Treea!bfoldtfg(Tipa)=fafoldtfg(Bin(t;u))=g(foldtfgt;foldtfgu)thenwedenerelabel::MonadFreshm)Treea!m(TreeSymbol)relabel=foldt(MTipconstfresh)(MBinpair)Extractingthedistinctsymbollistfromatreeisanotherfold,butthistimewithinMonadFail:dlabels::MonadFailm)TreeSymbol!m[Symbol]dlabels=foldt(returnwrap)(Mcatassertqpair)wherewrapa=[a]makesasingletonlist.Ourclaimisthatthecompositionofdlabelsandrelabelneverfails—thesymbollistsatisesthepredicate,andwealwaysgetapropersymbollistoftheappropriatelength:dlabelsrelabel=symbolssizewheremn=joinMmnisKleislicomposition,andsize::Treea!Intsize=foldt(const1)addWejustifythatclaiminthenextsection.9.3VerifyingtreerelabellingFirst,weshowthatrelabellingatreeandextractingitsdistinctsymbolsfusetoasinglefold.Wehave(dlabelsrelabel)Tip=[[Kleislicomposition]]joinMdlabelsrelabelTip=[[denitionofrelabelasafold]]joinMdlabelsMTipconstfresh=[[functors;denitionofdlabelsasafold]]joinM(returnwrap)constfresh=[[functors,monads]]Mwrapconstfreshand(dlabelsrelabel)Bin=[[Kleislicomposition]]joinMdlabelsrelabelBin=[[denitionofrelabelasafold]]joinMdlabelsMBinpairrelabel2=[[functors;denitionofdlabelsasafold]]joinM(Mcatassertqpairdlabels2)pairrelabel2=[[functors;naturalityofpairandjoin]]McatjoinM(assertqpair)pair(Mdlabelsrelabel)2=[[commutativityofassertions—seebelow]]McatassertqjoinMpairpair(Mdlabelsrelabel)2=[[joinandpairs—seebelow]]Mcatassertqpair(joinMdlabelsrelabel)2=[[Kleislicomposition]]Mcatassertqpair(dlabelsrelabel)2andso,bytheuniversalpropertyoffold,dlabelsrelabel=foldtdrTipdrBinwheredrTip=MwrapconstfreshdrBin=McatassertqpairTherearetwonon-trivialsteps.Therstis`commutativityofas-sertions'joinM(assertq)=assertqjoinwhichfollowsfromguardscommutingwithanything.Thesecondisthe`joinandpairs'stepjoinlistMpairpair=pairjoin2Thisdoesnotholdingeneral.Itdoesholdforcommutativemon-ads;butourMonadFreshFailisnotcommutative.However,italsoholdsonpairs(mmx;mmy)inthespecialcasethattheinnercom-putationinthemmxhaseffectsonlyfromMonadFail,becausethoseeffectscommutewiththoseofmmy.Inourcase,mmx=Mdlabels(relabelt),andindeeddlabelsintroducesonlythepossi-bilityoffailure,notanystatefulness.Nowweshowthatsymbolssizeisthesamefold.WehavesymbolssizeTip=[[denitionofsizeasafold]]symbolsconst1=[[propertyofsymbols]]MwrapconstfreshandsymbolssizeBin=[[specicationofsymbols]]assertpsymbolssizeBin=[[denitionofsize]]assertpsymbolsaddsize2=[[propertiesofsymbols;functors]]assertpMcatpair(symbolssize)2=[[assertpdistributesoverconcatenation]]Mcatassertqpair(assertpsymbolssize)2=[[specicationofsymbols]]Mcatassertqpair(symbolssize)2andso,againbytheuniversalpropertyoffold,symbolssize=foldtdrTipdrBinalso.(Thetwo`propertiesofsymbols'referredtoarethatsymbolsconst1=Mwrapconstfreshsymbolsadd=Mcatpairsymbols2whichfolloweasilyfromthedenitionofsymbolsbysimpleequa-tionalreasoning.) =[[denitionofhanoi]]doft total;skip;u total;(u�t 20�1)!;return(t;u)g=[[skipisaunitofcomposition]]doft total;u total;(u�t 20�1)!;return(t;u)g=[[totalisaquery]]doft total;(t�t 20�1)!;return(t;t)g=[[arithmetic;True!isjustskip]]doft total;return(t;t)g=[[reversingrstthreesteps]]doft total;hanoi0;u total;return(t;u)gFortheinductivestep,weassumethestatementforn,andcalculate:doft total;hanoi(n+1);u total;(u�t 2n+1�1)!;return(t;u)g=[[denitionofhanoi]]doft total;hanoin;tick;hanoin;u total;(u�t 2n+1�1)!;return(t;u)g=[[insertingsomequeries]]doft total;hanoin;u0 total;tick;t0 total;hanoin;u total;(u�t 2n+1�1)!;return(t;u)g=[[inductivehypothesis;propertyoftick]]doft total;hanoin;u0 total;(u0�t=2n�1)!;tick;t0 total;(t0=u0+1)!;hanoin;u total;(u�t0=2n�1)!;(u�t 2n+1�1)!;return(t;u)g=[[arithmetic:nalguardfollowsfromtheothers]]doft total;hanoin;u0 total;(u0�t=2n�1)!;tick;t0 total;(t0=u0+1)!;hanoin;u total;(u�t0=2n�1)!;return(t;u)g=[[reversingrsttwosteps]]doft total;hanoi(n+1);u total;return(t;u)gThisproofissignicantlymoreverbosethantheoneinSec-tion3,becauseitphrasedindirectly.Calculationstendtohavearightwards-pointingtriangular(`.')shape—denitionsareex-panded,thenalassertioneliminated,anddenitionscontractedagain—andthesecondhalfofeachcalculationisamirrorimageofthersthalf.PerhapsthereaderfeelsthattheTowersofHanoiproblemistootrivialtoformthebasisofanyverdict.Wefeltsotoo,andalthoughwecouldeasilyseethesimplersolutionforthatproblem,ittookalongtimetondthecorrespondingsolutionshowninSection9forthetreerelabellingproblem.AswiththeTowersofHanoi,weextendedthemonadwithaghostoperation:classMonadm)MonadFreshmwherefresh::mSymbolused::m(SetSymbol)sothatusedisaquery,returningthesetofsymbolsusedsofar,andfreshreturnsandusesupsomefreshsymbols:x used;n fresh;y usedfxy^n2y�xgTheproblemisthentoprovethatforsomesuitabledenitionofafunctionrelabel::MonadFreshm)Treea!m(TreeSymbol)wehaveu relabeltfdistinctugforeveryt,wheredistinct::TreeSymbol!Booldistinct(Tipa)=Truedistinct(Bin(t;u))=distinctt^distinctu^(labelst\labelsu /0)andlabels::TreeSymbol!SetSymbollabels(Tipa)=faglabels(Bin(t;u))=labelst[labelsuAsithappens,thecorrectnessconditionistooweaktosupportaninductiveargument,andithastobestrengthenedtox used;t0 relabelt;y usedfdistinctt0^xy^labelst0y�xgTheresultingcalculationwasratherlongwinded,andwemuchprefertheproofpresentedinSection9.AswellastheverbosityoftheHoare-styleapproach,itseemsalittleoddthatweusedonlypostconditionsandnotpreconditions.WemightdenetheHoaretriplefpgmfqgasashorthandfortheidentitydofp!;x m;q!;returnxg=dofp!;mgButnotethatthisisequivalenttotheearliernotationforassertions,sincefpgmfqg=p!;mfqgandinparticularfTruegmfqg=mfqgOthershavecometothesameconclusion;forexample,Schr¨oderandMossakowski'smonad-independentHoarelogic[29]simi-larlydenesHoaretriplesintermsof`globalevaluationformulae',whichareanalogoustoourassertions.10.3DiscussionWehavepresentedanapproachtoeffectfulfunctionalprogram-mingthattreatsclassesofeffectsasanabstractdatatype,withanalgebraicspecicationcapturingitsoperationsandequations.Wedidn'tstartoutthisway,butitturnsoutthattheapproachtowhichwehavebeenledhaslesstodowithmonadsasintroducedintofunctionalprogrammingbyMoggi[16]andWadler[38],andmoretodowithso-calledLawveretheories[13].Fundamentally,monadsarisefromadjunctions—classically,be-tweenalgebraicconstructionssuchastermalgebrasinonedirec-tion,andanunderlyingforgetfulfunctorintheotherdirection.Lawveretheoriesarisemoredirectlyfromequationaltheoriesofoperationsandtheirlaws.Bothweredevelopedascategoricalfor-mulationsofuniversalalgebra[10],butLawveretheoriesstartoffwiththeassociatedoperationsandtheirequationalproperties,whereaswithmonadstheseareasecondarynotion.Indeed,thead-junctionclassicallyarisingfromtheconstructionofthefreemodelofanequationaltheoryyieldspreciselythemonadinMoggi'ssense[24];buttheadditionaloperationsandequationstosupportaclassofeffectsplaylittlepartinthestorythatstartswithmonads.Nev-ertheless,themonadicviewmakesaconvenientinterfaceforpro-gramming,andofcourseisembeddedwithinthedesignofpro-gramminglanguagessuchasHaskell;sowedonotwishtoaban-donit.(Power[10]pointsoutthatmonadsareinfactslightlymoregeneralthanLawveretheories:inparticular,themonadsforcon-tinuationsandforpartialitydonotarisefromoperationsandtheirequationsinthesamewayastheothermonadsfamiliartofunc-tionalprogrammers.)ThereisanintriguingdualityintheLawveretheoryapproachbetweenalgebraicoperationsandeffecthandlers[25].Forexam-ple,thecatchoperationofMonadExceptisaneffecthandlerinthissense;technicallyitdoesn'tforman`operation'ofaLawveretheory,becauseitdoesn'thavetherightdistributivitypropertieswithrespectto��=.Operationsandhandlerscanbeseenas`effectconstructors'and`effectdeconstructors',respectively;andthehan-dlerscanbedenedasfoldsovertheinitialalgebrainducedbythe